Abstract: Methods, systems, and computer readable media for handling unexpected virtual station interface (VSI) discovery and configuration protocol (VDP) packets received by a VSI are disclosed. One method includes, at a network equipment test device, emulating an ER and VSIs behind the ER. The method further includes transmitting a keep-alive message for a session from one of the VSIs to a virtual Ethernet port aggregation (VEPA) bridge under test. The method further includes receiving a de-associate message from the bridge, tearing down the session, and attempting to re-establish the session with the bridge. The method further includes, while waiting to initiate the attempt to re-establish the session with the bridge, receiving an unexpected message from the bridge and intercepting and logging receipt of the at least one unexpected message.

Abstract: Methods, systems, and computer readable media for handling unexpected virtual station interface (VSI) discovery and configuration protocol (VDP) packets received by a VSI are disclosed. One method includes, at a network equipment test device, emulating an ER and VSIs behind the ER. The method further includes transmitting a keep-alive message for a session from one of the VSIs to a virtual Ethernet port aggregation (VEPA) bridge under test. The method further includes receiving a de-associate message from the bridge, tearing down the session, and attempting to re-establish the session with the bridge. The method further includes, while waiting to initiate the attempt to re-establish the session with the bridge, receiving an unexpected message from the bridge and intercepting and logging receipt of the at least one unexpected message.

Abstract: In some embodiments, a malware detecting system is configured to conduct an iterative, collaborative scan of a target object (computer file or process), comprising a server-side scan and a client-side scan, and to assess the malware status of the target object according to the results of the client-side and server-side scans. The client-side scan comprises computationally-intensive operations such as virtual-environment emulation, decryption and data compression methods, while the server-side scan comprises database-intensive operations such as hash lookups. The information exchanged between client and server systems may be limited to relatively-compact data, such as hashes, which may amount to a few bytes per target object.