Abstract: In some embodiments a method includes receiving, at a first network device, a data unit to be sent to second network device via a tunnel, the data unit associated with an application. The method includes appending, to the data unit, an encapsulation header that includes a first portion configured such that the second network device is configured to forward the data unit based on the second portion of the encapsulation header that is configured to identify the application. The method includes sending, from the first network device to the second network device via a first portion of the tunnel, the data unit such that the second network device appends the encapsulation header to the data unit prior to forwarding the data unit via a second portion of the tunnel.

Abstract: In some embodiments a method includes receiving, at a first network device, a data unit to be sent to second network device via a tunnel, the data unit associated with an application. The method includes appending, to the data unit, an encapsulation header that includes a first portion configured such that the second network device is configured to forward the data unit based on the second portion of the encapsulation header that is configured to identify the application. The method includes sending, from the first network device to the second network device via a first portion of the tunnel, the data unit such that the second network device appends the encapsulation header to the data unit prior to forwarding the data unit via a second portion of the tunnel.

Abstract: A flow identifier is stored in a memory to identify a network flow. The memory is capable of storing multiple flow identifiers for multiple flows. Packet statistics are collected for each of the flows. The packet statistics are compared and a flow identifier is subsequently selected and removed from the memory.

Abstract: A traffic selector table for a network switch is populated with one or more entries that each identifies a tiered service. A traffic flow that matches an entry in the table is identified by the switch. The matched traffic flow is redirected to an intrusion prevention device to determine whether the traffic presents a threat to the network. The switch detects a condition in network traffic flowing through the switch. The traffic selector table is dynamically modified in response to the detected condition.

Abstract: Techniques and architectures to dynamically modify policies used to determine how data in switched network traffic is selected for security inspection. One embodiment of the invention modifies policies used to determine how data in network traffic is redirected from a switch to an intrusion prevention system, without the policy modifications interrupting the handling of network traffic by the switch.

Abstract: Path information is obtained in a VPLS-based network by generating special Layer 2 frames (referred to herein as “trace-request frames”), performing source MAC filtering to identify the trace-request frames, and generating a special frame (referred to herein as a “trace-reply frame”) when the source MAC filtering identifies a trace-request frame. Upon identifying a trace-request frame, path information is collected and embedded into the trace-reply frame. The trace-reply frame is then sent to the originating node where the path information is used to learn the path that the trace-request frame traversed. By sending multiple trace-request frames with different source MAC addresses, path information received from source MAC filtering at different nodes in the VPLS-based network can be collected and used to learn an entire path of interest.

Abstract: A method of establishing Quality-of-Service (QoS) communications within a network proposes the encapsulation of a control message that facilitates QoS for an associated data flow, according to a protocol not implementing resource reservation, such as the User Datagram Protocol (UDP). The encapsulated control message is then propagated through the network on a routed path, while the associated data flow is propagated over a short-cut path through the network.

Abstract: A method of establishing Quality-of-Service (QoS) communications within a network proposes the encapsulation of a control message that facilitates QoS for an associated data flow, according to a protocol not implementing resource reservation, such as the User Datagram Protocol (UDP). The encapsulated control message is then propagated through the network on a routed path, while the associated data flow is propagated over a short-cut path through the network.