COMMANDO Soldier C3000 L3 Aggregation and Access Series Modular Routing Switches has a 4K-entry VLAN table which is used by 802.1Q and Q-in-Q VLAN. It supports 4K FID (Filtering Database ID) in total. IVL (Individual VLAN Learning), SVL (Shared VLAN learning) and IVL/SVL mixed mode are supported and per VLAN basis can specify the VLAN learning mode for unicast/broadcast and L2/IP multicast traffic respectively. It has IP multicast data packets involve L2 and port-mask table lookup. If the L2 table lookup returns a hit, the data packet is forwarded to all member ports and router ports retrieved from port-mask table. If the multicast address is not stored in the address table (i.e., lookup miss), the packet is broadcast to all ports of the broadcast domain.

The device features a 32K-entry Layer 2 table. It uses a 2-left 4-way hashing structure to store L2 entries so that it could provide higher learning capability. Each entry can be recorded in one of the two formats, L2 Unicast and L2 Multicast. Both L2 Unicast and Multicast use (FID/VID, MAC) as hash key. The learn unicast entries are aged out after the specified aging period. The device per port supports a configuration to disable the aging out function. Support Source/Destination MAC filtering or Secure Source MAC Address mode that device only accepts packets whose SA is known to system. IEEE 802.1d/1w/1s (STP/RSTP/MSTP) with 128 spanning tree instances supported by the device.

The device has a 4K-entry VLAN table that is used by 802.1Q and Q-in-Q VLAN and shared by CVLAN and S-VLAN. Up to three-layer VLAN tags (Outer Tag, Inner Tag, Extra Tag) are supported for Q-in-Q applications. The device supports global four outer TPIDs, four inner TPIDs and one extra TPID which are all configurable and per port has a TPID mask to select the recognized TPID. For VLAN tag manipulation, VLAN untag set and the egress port tag status configurations are coordinated for determining the tag status for a packet. Per ingress port and per tag status can specify the forwarding VLAN is either from inner tag or outer tag. Forwarding VLAN is used for doing VLAN table lookup and ingress/egress VLAN filtering. The device also supports 8 protocol-based (IEEE 802.1v), 2K MAC-based/IP-subnet-based (shared with Ingress VLAN translation), and application-based VLANs. Per VLAN provides a 16-bit group mask which can be used as a key by ACL and provides forwarding options of some predefined types of packets (e.g., IGMP, MLD, DHCP, and ARP) for VLAN-based applications.

The device supports 2K ingress (shared with MAC-based/IP-based VLAN) and 1K egress VLAN translation table. They are used to support the 1:1 and port-based N:1 VLAN translation. For MAC-based N:1 VLAN translation, per egress port has a configuration to enable the function. In addition to the dedicated VLAN translation tables, VLAN translation can also be done by ACL. The device supports 802.3ad (Link Aggregation) for 26 groups of link aggregators with up to 8 ports per-group.

Link aggregation group frames are sent to an aggregation port of the link aggregation group according to a distribution algorithm. Two trunk distribution algorithms are supported and per group can bind to a specific distribution algorithm. L2 and L3 packet can have different parameters of the distribution algorithm. Each trunk group can optionally separate the known multicast and flooding traffic to the MSB port. Besides, H/W fail-over is also supported to prevent forwarding traffic to a link down port in stand-alone mode.

There are four mirror configurations supported in the device. Each mirror configuration can specify the ingress and egress mirrored ports, mirroring port, isolation state, and enable state. Normal forwarding packet cannot be forwarded to the mirroring port if isolation state is enabled. The mirrored traffic can cross the VLAN, that is, the mirrored port and mirroring port can reside in different VLANs. Multiple mirrored ports are matched for a multiple egress port packet. The packet transmitted through the lowest mirrored port ID is duplicated to the mirroring port. The mirroring port drops the mirrored traffic instead of triggering the flow control if it is congested. The device supports ingress and egress port sFlow sampling. Each mirror session can specify the sample rate for packet sampling.

Most common attacks can be blocked by the device including LAND attack, UDP Blat attack, TCP Blat attack, Ping of Death attack, Smurf attack, TCP NULL scan and so on. The attack prevention function is per port enabled and each attack type is globally enabled. The device provides 1K L3 interface (shared with Tunnel interface), 12K hash-based (SRAM) L3 entries and 12K LPM-based (TCAM) L3 entries which can support 24K IPv4 unicast entries or 4K IPv6 unicast entries as maximum. The device also provides 256 VRF (Virtual Routing and Forwarding) instances. The device supports uRPF (unicast reverse path forwarding) check, ECMP (256 groups, each group can have maximum 8 different nexthops and traffic metering for each path), ICMP redirect, MTU check. The device supports IPv4/IPv6 multicast routing and provides maximum 6K IPv4/2K IPv6 multicast entries (which are shared with hash-based L3 unicast routing table).

The device supports configured IP-in-IP (including IPv4-in-IPv4, IPv4-in-IPv6, IPv6-in-IPv4 and IPv6-in-IPv6) and GRE (IPv4/IPv6 + GRE + IPv4/IPv6) tunnels. Also supports ISATAP, 6to4 and 6RD auto tunnels. The system totally supports maximum 384 tunnels for configured/auto tunnels. The VLAN ACL function supports packet color-dependent drop, drop/permit/redirect/copy to CPU, log, mirror, policing, ingress inner VLAN assignment, ingress outer VLAN assignment, priority assignment, bypass, meta-data assignment, ingress queue assignment and QoS remarking functionalities. Each VLAN ACL entry corresponds to multiple actions. When a multi-match occurs (i.e., there are several ACL entries matching concurrently), these matched actions will be divided into different action groups. Each group will then execute the lowest block logic ID of lowest block group ID address entry corresponding action.

The ingress ACL function supports packet color-dependent drop, drop/permit/redirect/copy to CPU, log, mirror, policing, egress inner VLAN assignment, egress outer VLAN assignment, priority assignment and QoS remarking functionalities. The egress ACL function supports packet color-dependent drop, log, policing, egress inner VLAN assignment, egress outer VLAN assignment, and QoS remarking functionalities. The device supports 512 policers. Policers belong to different block groups can be executed concurrently to support hierarchy policing. The policer is flow controlled via leaky bucket. The rate ranges from 16Kbps~10Gbps with 16Kbps granularity. Each ACL entry has an index to point to 512 ACL policers. One limitation is that different phase ACL or different block group cannot share the same policer.

The per-port L2 storm filtering control mechanism suppresses the flow rate of storm packets. The device supports five control types: Unknown Unicast, Unicast, Unknown Multicast, Multicast, and Broadcast Storm. Egress bandwidth control configurations are supported to each port and each egress queue. Per-queue is also provided assured bandwidth and maximum bandwidth. Each bandwidth setting ranges from 16Kbps~10Gbps. The Packet Scheduler controls the multiple traffic classes (i.e., controls the packet sending sequence of the priority queue). The device scheduling algorithm is divided into Weighted Fair-Queuing (WFQ) and Weighted Round-Robin (WRR). Note that the Strict Priority queue is the highest priority of all queues, and overrides WFQ & WRR. A larger strict priority queue ID indicates the priority is higher. Remarking can be divided into Inner 1p, Outer 1p, DEI and DSCP Remarking. Per egress port per type supports a configuration to turn on the remarking function. For Inner 1p Remarking and Outer 1p Remarking, the remarking source can be internal priority, original inner 1p priority, original outer 1p priority or original DSCP value. For DEI Remarking, the remarking source can be either from internal priority or internal drop precedence (DP). For DSCP Remarking, the remarking source can be internal priority, original inner 1p priority, original outer 1p priority, original DSCP value, internal DP and internal-priority-and-internal-DP.

There are two mechanisms for half duplex backpressure, Collision-Based Backpressure (Jam Mode) and Carrier-Based Backpressure (Defer Mode). WRED is not configured, output buffers fill during periods of congestion. When the buffers are full, tail drop occurs. All additional packets are dropped. Since the packets are dropped all at once, global synchronization of TCP hosts can occur as multiple TCP hosts reduce their transmission rates. The congestion clears, and the TCP hosts increase their transmissions rates, resulting in waves of congestion followed by periods where the transmission link is not fully used. WRED reduces the chances of tail drop by selectively dropping packets when the output interface begins to show signs of congestion. By dropping some packets early rather than waiting until the buffer is full, SWRED avoids dropping large numbers of packets at once and minimizes the chances of global synchronization. Thus, WRED allows the transmission line to be used fully at all times. The device supports 512 ACL policers which can also be used as color-aware/color-blind srTCM (Single Rate Three Color Marker) and color-aware/color-blind trTCM (Two Rate Three Color Marker).

The srTCM meters a traffic stream and marks its packets according to three traffic parameters, Committed Information Rate (CIR), Committed Burst Size (CBS), and Excess Burst Size (EBS), to Green, Yellow, or Red. The trTCM meters a traffic stream and marks its packets based on two rates, Peak Information Rate (PIR) and Committed Information Rate (CIR), and their associated burst sizes to be green, yellow, or red. Each policer can specify the counting mode to be either PPS (Packet-Per-Second) or BPS (Bit-PerSecond). The packet is marked a color by srTCM/trTCM and the color is then referenced by associated ACL entry to perform drop or remark action. The color of packet is also referenced by SWRED to perform egress random dropping for congestion avoidance. BPE (Bridge Port Extension) provides the capability to extend MAC service over an Extended Bridge. This capability may be used to extend a bridge over multiple physical devices or the mac service of a virtual end station. The data center topology experiences a dramatic increased number of Ethernet switches. BPE simplifies the complexity of vSwitch and the loading of hypervisor. The supported MIB (Management Information Base) which include TCP/IP-based MIB-II (RFC 1213), Ethernet-like MIB (RFC 3635), Interface Group MIB (RFC 2863), RMON (Remote Network Monitoring) MIB (RFC 2819), Bridge MIB (RFC 1493), Bridge MIB Extension (RFC 2674).

It supports OAM (Operation, Administration, Maintenance) IEEE 802.3ah which provides mechanisms useful for monitoring link operation such as remote fault indication and remote loopback control. In general, OAM provides network operators the ability to monitor the health of the network and quickly determine the location of failing links or fault conditions. The OAM loopback function supported by the device is wire-speed guaranteed and the source/destination MAC address can be swapped for the loopback packet. It supports 802.1ag CFM (Connectivity Fault Management) specifies protocols and protocol entities within the architecture of VLAN-aware Bridges that provide capabilities for detecting, verifying, and isolating connectivity failures in Virtual Bridged Local Area Networks. CFM describes the protocols and procedures used by Maintenance Points to detect and diagnose connectivity faults within a MD (Maintenance Domain).

It has EEE proposes a low power idle (LPI) mode where the MAC and PHY can shut down parts of electric circuits to reduce power consumption. If there is no traffic to be transmitted, the TX part of a port can enter LPI mode to sleep. If the link partner enters TX LPI mode, the connected port can enter RX LPI mode. The device per port can enable the TX/RX EEE function separately for different link speed (excludes 10Mbps)