Abstract: A method, system and computer program product for generating variable price billing whereby a customer may balance its data traffic in response to such billing. A subsystem in an edge gateway may extract the packet header from a copy of a received packet of data associated with a session between a customer and a server and generate a key based on the extracted packet header. The key may be used to index into a table that may store pointers to particular statistics records associated with particular sessions. Once the subsystem identifies the statistics record associated with the current session, the subsystem may execute a per packet statistics update for the statistics record associated with the session. A per packet statistics update may include one or more of the following: time stamping arrival of the packet, updating packet count, updating byte count, determining transfer rate, determining distance packet traveled.

Abstract: Method, system, and program product for port based authentication protocols where addresses are dynamically assigned within a network environment, and more particularly to port based authentication in the network environment, where connection information is captured and stored. This facilitates administrator access to information created as a result of protocol exchanges involved in dynamic address assignment, authentication, and connection.

Abstract: Provision to a customer of equipment already installed into a specified enclosure to create an assembly is accomplished in an advantageous manner by the disclosed process. A manufacturer obtains the enclosure and the components of the specified equipment, installs the equipment in the enclosure and performs appropriate tests on the completed assembly before sending the assembly to the customer.

Abstract: Disclosed is a method of controlling an ingress transmission capacity of an interchassis switch includes comparing the ingress transmission capacity to a threshold capacity; and controlling, using a controller external to the interchassis switch, the ingress transmission capacity responsive to the ingress transmission capacity comparing step.

Abstract: An interface connection is described for joining a host device, such as a Network Processor, to peripherals such as modems, printers, local area networks, Ethernets and Token-Ring interfaces. The connection is particularly useful for joining portable computers, such as laptops, to these peripherals. The connector utilizes a programmable Network Processor (NP) either in the host device or in an external fan-out box. This programmable Network Processor adapts the host device to a variety of peripheral devices utilizing different protocols and I/O speeds. The NP can use a Digital Signal Processor to provide programmable services to the physical layers. The host device may contain a high-speed communication interface with the NP contained in the external connection box.

Abstract: A method, system and computer program product for detecting the dissemination of malicious programs. The degree of randomness in the Internet Protocol (IP) destination addresses of received IP packets to be forwarded to an external network may be detected by performing a hash function on the IP destination addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets examined, then random IP destination addresses may be detected. By detecting random destination IP addresses, the dissemination of a malicious program, e.g., virus, worm program, may be detected.

Abstract: A method, system and computer program product for detecting conditions of network instability. An attribute indicative of network instability, e.g., processor and/or co-processor utilization, packet arrival rates, packet peak rates, packet size distribution, packet clustering tendencies, buffer usage patterns, occurrence of peak utilization, out-of-buffer conditions, packet discard rates, may be monitored for a network device, e.g., router. The monitored attribute may be associated with a plurality of labels (variables) where a portion of those labels may be stored in a cache. A hit ratio for the cache storing labels associated with the monitored attribute may be tracked within a period of time based on the number of requested items, i.e., labels, that are currently stored in the cache. A condition of network instability may then be detected based on the hit ratio by determining if the absolute value of the acceleration of the hit ratio exceeds a threshold.

Abstract: Disclosed is an apparatus including an interchassis network having a plurality of network interface connections; and an interchassis switch coupled to an egress communications system having an egress transmission capacity, a plurality of ingress transmission channels coupled to the plurality of network interface connections collectively having a potential ingress transmission capacity greater than the egress transmission capacity, and a capacity controller coupled to the plurality of ingress transmission channels for controlling an operational ingress capacity of the plurality of network interface connections. The method of controlling an ingress transmission capacity of an interchassis switch includes the steps of comparing the ingress transmission capacity to a threshold capacity; and controlling the ingress transmission capacity responsive to the ingress transmission capacity comparing step.

Abstract: Disclosed is an apparatus including an interchassis network having a plurality of network interface connections; an interchassis switch coupled to an egress communications system, the interchassis switch having an egress transmission capacity, the interchassis switch including a plurality of ingress transmission connections collectively having an ingress transmission capacity; and a controller, coupled to the plurality of network interface connections and to the interchassis switch, for controlling a maximum ingress transmission capacity of the interchassis switch. The method of controlling an ingress transmission capacity of an interchassis switch includes comparing the ingress transmission capacity to a threshold capacity; and controlling, using a controller external to the interchassis switch, the ingress transmission capacity responsive to the ingress transmission capacity comparing step.

Abstract: An apparatus for performing complex pattern matching in a data stream within a computer network is disclosed. The apparatus includes a serial array register and a content-addressable memory (CAM). The CAM includes multiple CAM entries, and each of the CAM entries includes a k-byte pattern concatenated with an n-byte mask. The positions of the k-byte pattern and n-byte mask in each of the CAM entries offset from those in other CAM entries by one byte. Preferably, the k-byte pattern is each of the CAM entries represents a known computer virus pattern. After the capture of a data pattern from a data stream by the serial array register, the CAM register performs a comparison operation between the captured data pattern and all the CAM entries. If there is a match between the captured data pattern and one of the CAM entries, the CAM signals that the data stream contains information that are potentially harmful to the computer network.

Abstract: A network processor is disclosed. The network processor comprises a plurality of standard cells; and at least one field programmable gate array (FPGA) cell that can communicate with at least one of the standard cells. The at least one FPGA cell can provide a specified function based upon field programming techniques to allow for customization of the network processor. Utilizing a method and system in accordance with the present invention, a network processor can be customized to implement a variety of functions in hardware using embedded FPGA macros. The combined technology of ASIC standard cells plus FPGA cells enables fast time-to-market for new designs while optimizing cost and performance. In addition, the combined ASIC plus FPGA on a single die allows the chip developer to use proven standard cell macros for common logic and programmable cells for high-risk logic.

Abstract: Provision to a customer of equipment already installed into a specified enclosure to create an assembly is accomplished in an advantageous manner by the disclosed process. A manufacturer obtains the enclosure and the components of the specified equipment, installs the equipment in the enclosure and performs appropriate tests on the completed assembly before sending the assembly to the customer.

Abstract: A system, method and program product for optimizing a product order in real time where the product includes at least one customer-selectable component. Component information such as component cost, delivery lag time and availability are determined in real-time by querying a manufacturer system and, in response to a component being unavailable at the manufacturer, querying at least one supplier system that can supply the component to the manufacturer. The customer is then offered at least one order option in real time based on the results of the determination.

Abstract: An interface connection is described for joining a host device, such as a Network Processor, to peripherals such as modems, printers, local area networks, Ethernets and Token-Ring interfaces. The connection is particularly useful for joining portable computers, such as laptops, to these peripherals. The connector utilizes a programmable Network Processor (NP) either in the host device or in an external fan-out box. This programmable Network Processor adapts the host device to a variety of peripheral devices utilizing different protocols and I/O speeds. The NP can use a Digital Signal Processor to provide programmable services to the physical layers. The host device may contain a high-speed communication interface with the NP contained in the external connection box.

Abstract: A method, system and computer program product for detecting conditions of network instability. An attribute indicative of network instability, e.g., processor and/or co-processor utilization, packet arrival rates, packet peak rates, packet size distribution, packet clustering tendencies, buffer usage patterns, occurrence of peak utilization, out-of-buffer conditions, packet discard rates, may be monitored for a network device, e.g., router. The monitored attribute may be associated with a plurality of labels (variables) where a portion of those labels may be stored in a cache. A hit ratio for the cache storing labels associated with the monitored attribute may be tracked within a period of time based on the number of requested items, i.e., labels, that are currently stored in the cache. A condition of network instability may then be detected based on the hit ratio by determining if the absolute value of the acceleration of the hit ratio exceeds a threshold.

Abstract: A method, system and computer program product for detecting the dissemination of malicious programs. The degree of randomness in the Internet Protocol (IP) destination addresses of received IP packets to be forwarded to an external network may be detected by performing a hash function on the IP destination addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets examined, then random IP destination addresses may be detected. By detecting random destination IP addresses, the dissemination of a malicious program, e.g., virus, worm program, may be detected.

Abstract: A method and system within a telecommunications network for allocating available bandwidth among a plurality of sessions that share a common data link. First, a repeating unit time interval is designated for conducting the plurality of sessions. Next, the input flow rate from the source node of each of the sessions into the common data link is monitored. Thereafter, a target flow rate is computed and assigned to each of the sessions. The sum of the target flow rates is equal to the available bandwidth of the common data link. Finally, for each of the sessions in which the monitored input flow rate exceeds the assigned target flow rate, the source node is dynamically paused during each repeating unit time interval, such that the monitored input flow rate conforms to the assigned target flow rate for each of the sessions.

Abstract: Methods, systems and computer program products are provided which control message storms in a network by classifying multiple destination messages into a plurality of broadcast message classes based upon characteristics of the broadcast messages. The number of multiple destination messages for each class of broadcast messages of the plurality of classes of broadcast messages are then counted so as to provide a plurality of broadcast message class counts. Multiple destination messages of a class of broadcast messages are then selectively transmitted based upon the broadcast message class count for the class of broadcast messages.

Abstract: A network processor is disclosed. The network processor comprises a plurality of standard cells; and at least one field programmable gate array (FPGA) cell that can communicate with at least one of the standard cells. The at least one FPGA cell can provide a specified function based upon field programming techniques to allow for customization of the network processor. Utilizing a method and system in accordance with the present invention, a network processor can be customized to implement a variety of functions in hardware using embedded FPGA macros. The combined technology of ASIC standard cells plus FPGA cells enables fast time-to-market for new designs while optimizing cost and performance. In addition, the combined ASIC plus FPGA on a single die allows the chip developer to use proven standard cell macros for common logic and programmable cells for high-risk logic.

Abstract: A method, system and computer program product for using a variable pricing structure for transmitting packets across a communications link. A variable pricing structure including a plurality of pricing options may be generated by a processor in a gateway by counting the number of packets received from a customer as well as analyzing those received packets. The generated variable pricing structure embodied in a billing record may be transmitted to the customer. The customer upon receiving the billing record may select a pricing option based on one or more criteria, e.g., file size, transmission rate. The packets to be transmitted by the customer to a network device via the gateway may be temporarily stored by an equipment coupled to the customer if the one or more criteria upon which the selected pricing option is based exceed a threshold value thereby ensuring that the customer does not incur extra charges.