Abstract: In general, one embodiment of the invention is a air monitor adapted to a wireless network. The air monitor enforces policies followed by the wireless network even though it is not involved in the exchange of data between wireless devices of the wireless network such as access points and wireless stations.

Abstract: Initiating peer-to-peer tunnels between clients in a mobility domain. When initiated by the controller, the access nodes establish a peer-to-peer tunnel for suitable client traffic so as to bypass “slow” tunnels through the controller. Traffic through this “fast” tunnel may be initiated once established or traffic may be temporarily queued. This queue and release process may be bidirectional or unidirectional depending on the traffic. Completion of slow tunnel traffic may be sensed in a number of ways. Slow tunnel traffic may be timed out, and queued traffic released after a preset time since the last packet was sent through the slow tunnel. The identity of the last packet sent through the slow tunnel may be retained, and queued traffic released when an acknowledgement for that packet is received. A special packet may be sent through the slow tunnel and queued traffic released when an acknowledgement for that packet is received.

Abstract: Band steering for multi-band wireless clients. In a wireless digital network having at least one central controller and a plurality of access nodes connected to the central controller, and wherein some of the access nodes support a preferred wireless band and at least one non-preferred wireless band, the central controller identifies wireless client devices capable of multi-band operation, and encourages them to connect to the preferred wireless band. Client devices may be identified as multi-band capable by tracking probe requests. The central controller keeps a list of multi-band capable clients, for example in a database. This information is provided to other central controllers, and to access nodes attached to the central controller. Multi-band capable clients are encouraged to connect on the preferred wireless band for example by having the access nodes not respond to probe requests on the non-preferred wireless bands.

Abstract: According to one embodiment of the invention, a method comprises advertising services by a first wireless device. The services are provided by different basic service sets, each basic service set having the same service set identifier (SSID). Thereafter, one of the basic service sets is selected.

Abstract: In one embodiment of the invention, a wireless network is adapted with a wireless network switch in communication with a plurality of access points, which are in communication with one or more stations. Coupled to the access points over an interconnect, the wireless network switch is adapted to receive a DEAUTHENTICATION message sent by one of the plurality of access points in the same coverage area of the station so as to detect the DEAUTHENTICATION message and to block communications between the plurality of access points and the station in response to determining that the DEAUTHENTICATION message is invalid.

Abstract: In general, one embodiment of the invention is a air monitor adapted to a wireless network. The air monitor enforces policies followed by the wireless network even though it is not involved in the exchange of data between wireless devices of the wireless network such as access points and wireless stations.

Abstract: According to one embodiment of the invention, a method comprises advertising services by a first wireless device. The services are provided by different basic service sets, each basic service set having the same service set identifier (SSID). Thereafter, one of the basic service sets is selected.

Abstract: Balancing client load on an access point in a wireless digital network. An access point tracks the number of connected users and accepts new connections only if the number of connected users is below a preset threshold. The number of connected users may be tracked on an access point wide basis, a per-band basis, a per-BSSID basis, or a combination. Similarly, accepting new connections may be done on an access point wide basis, a per-band basis, a per-BSSID basis, on the basis of client 802.11 capabilities, or a combination.

Abstract: Initiating peer-to-peer tunnels between clients in a mobility domain. Client traffic in a mobility domain normally passes from the initiating client to an access node, and from the access node through a tunnel to a controller, and then through another tunnel from the controller to the destination access node, and the destination client. When initiated by the controller, the access nodes establish a peer-to-peer tunnel for suitable client traffic, bypassing the “slow” tunnels through the controller with a “fast” peer-to-peer tunnel. Traffic through this “fast” tunnel may be initiated once the tunnel is established, or traffic for the “fast” tunnel may be queued up until traffic has completed passing through the “slow” tunnel. This queue and release process may be bidirectional or unidirectional depending on the traffic. Completion of slow tunnel traffic may be sensed in a number of ways.

Abstract: Establishing peer-to-peer tunnels between clients in a mobility domain. In normal operation, clients attached to a network having access nodes connected to a central controller transfer all traffic through the central controller. This traffic is passed using tunnels between the access node and the central controller. Tunnels may be encrypted, and GRE tunnels may be used. A mobility manager operating in the controller tracks access nodes connected to the controller, and clients connected to those access nodes. When the mobility controller recognizes traffic passing between clients in its mobility domain that is eligible for peer-to-peer forwarding, it instructs the access nodes supporting the clients to establish a peer-to-peer tunnel between the nodes, and direct the client traffic through this peer-to-peer tunnel. The peer-to-peer tunnel may be session based, or may be aged.

Abstract: Overlaying a Wireless Macro Cell architecture on a Micro Cell network. WLAN MAC Address Translation (WMAT) is used to translate BSSIDs from the BSSID used to initialize a radio in an access node and identify communications between the radio in the access node and a controller, and the BSSID used over the air for Macro Cell operation. WMAT is used for transmit operations, translating the BSSID of outgoing packets to the Macro Cell BSSID prior to wireless transmission. On the receive side, packets undergo WMAT and transmission to the controller if the STN MAC address of the sender is in an ACK table associated with the radio, or the packet is one of a predetermined type. The ACK table is managed by transmit operations, and by control commands from the controller.

Abstract: Enterprise location discovery in dual-mode phones. As dual-mode phones move within the enterprise Wi-Fi network, they track which cell tower they are associated with, reporting this information to an enterprise mobility controller. The enterprise mobility controller builds a list of cell tower identifiers which are associated with enterprise Wi-Fi coverage, and makes this list available to subscribing dual-mode phones. Subscribing dual-mode phones can use this list to only scan for Wi-FI availability when they are associated with a cell tower which is on the list.

Abstract: Band steering for multi-band wireless clients. In a wireless digital network having at least one central controller and a plurality of access nodes connected to the central controller, and wherein some of the access nodes support a preferred wireless band and at least one non-preferred wireless band, the central controller identifies wireless client devices capable of multi-band operation, and encourages them to connect to the preferred wireless band. Client devices may be identified as multi-band capable by tracking probe requests. The central controller keeps a list of multi-band capable clients, for example in a database. This information is provided to other central controllers, and to access nodes attached to the central controller. Multi-band capable clients are encouraged to connect on the preferred wireless band for example by having the access nodes not respond to probe requests on the non-preferred wireless bands.

Abstract: In general, one embodiment of the invention relates to a method of operation where the type of an incoming Media Access Control (MAC) frame is initially determined. Based on such determination, the MAC frame is processed locally at an access point if the MAC frame is one of a first group of MAC frames. Otherwise, the MAC frame is processed remotely at a switch communicatively coupled to the access point.

Abstract: According to one embodiment of the invention, a method for securely extending a private network to include one or more remote access points (APs) comprises a first operation of establishing a secure communication path with a destination device. Then, the information received from a source device is prepared for transmission to the destination device. This involves the received information undergoing Layer 3 (L3) encryption prior to encapsulation into a message for transmission to the destination device if the received information constitutes control information. If the received information constitutes data, the received information optionally undergoes L3 encryption, since the payload data might be already L2 encrypted by the source device, prior to encapsulation into the message.

Abstract: In general, one embodiment of the invention is a air monitor adapted to a wireless network. The air monitor enforces policies followed by the wireless network even though it is not involved in the exchange of data between wireless devices of the wireless network such as access points and wireless stations.

Abstract: A server and method for determining physical connectivity between end nodes and networking devices within a network. With respect to one embodiment, the method comprises an initial act of establishing levels of priority for a plurality of link types capable of being established between networking devices and end nodes of a communication system. For example, as described herein, the types of links include an inferred link having a first level of priority, and other link types having a lesser priority. Once the priority levels are established, the method involves initially detecting a plurality of links associated with selected ports of the networking devices. After detection of these links, a determination is made from these links as to which links are associated with the end nodes and have the highest priority level. From that group, the physical connectivity between the end nodes and the networking devices is ascertained.