Abstract: A method and device for detecting and inoculating emails infected with viruses are described. The method involves identifying a particular traffic and its associated data packets as an email session and scanning the associated data packets in order to compare their contents with a database of known signatures. If a match is found between the data packets and a signature of a known virus, it is determined if there is an attachment to the email. If an attachment is detected, some or all of the bits of the data packets associated with the attachment are altered, thereby rendering the infected attachment harmless. The network device includes memory for storing the database of known signatures and a content processor able to compare the contents of data packets with a database of known signatures. The content processor is also operable to alter some or all of the bits of the attachment to inoculate the email and attachment.

Abstract: A queue engine is described that is operable to reorder and reassemble data packets from network traffic into unfragmented and in order traffic flows for applications such as deep packet classification and quality of service determination. The queue engine stores incoming data packets in a packet memory that is controlled by a link list controller. A packet assembler extracts information from each data packet, particularly fields from the header information, and uses that information among other things, to determine if the data packet is fragmented or out of order, and to associate the data packet with a session id. If the packet is determined to be out of order, the queue engine includes a reordering unit which is able to modify links with the link list controller to reorder data packets. A fragment reassembly unit is also included which is capable of taking fragments and reassembling them into complete unfragmented data packets.

Abstract: A network processing system is described that is able to monitor IP network traffic, including the ability to perform trap and trace on IP communications flowing over the IP network. The network processing system is able to scan the entire contents of data packets passing through it, and to associate related data packets into discrete sessions, or flows, which allows the network processing system to search for predetermined search criteria contained within those flows. If a flow is found to contain a predetermined search criteria, the network processing system is able to maintain a record of the flow or to replicate the flow and save it or send it to another IP address for monitoring. The monitoring of a flow can include the entire contents of the flow, or any subset of information in the flow such as call identifying information.

Abstract: A content aware network device is described that is able to scan the contents of entire data packets including header and payload information. The network device includes a physical interface for converting analog network signal into bit streams and vise versa. The bit stream from the physical interface is sent to a traffic flow scanning processor that may be, but is not necessarily, divided into a header processor and a payload analyzer. The header processor scans the header information from each data packet, which is used to determine routing information and session identification. The payload analyzer scans the data packet's payload and matches the payload against a database of known strings. The payload analyzer is able to scan across packet boundaries and to scan for strings of variable and arbitrary length. Once the payload has been scanned the network device can operate on the data packet based on the results of the payload analyzer.

Abstract: A content processor is described that is able to scan the contents of entire data packets including header and payload information. The content processor includes a queue engine operable to reorder out of order data packets and reassemble fragmented data packets. The queue engine sends the reordered and reassembled data packets to the context engine, which schedules the packets to be scanned. The packets are scanned by the content scanning engine using one or more string memories and one or more leaf string memories. The string memories are used by the content scanning engine to determine if there is a potential match between the data packet being scanned and any of the strings contained in database of known strings. If a potential match is identified, whether or not there is an exact match is determined using the leaf string memories and the leaf string compare engine. The scanning of the data packet results in a conclusion being generated by the content scanning engine.

Abstract: A circuit and a method for providing current sharing between parallel power supplies using a modified master/slave scheme in which any of the parallel modules can be designated the master is described. A current-share circuit is incorporated into each power supply which includes its own controller producing an internal control signal and is interconnected to the other power supply modules on a current-share bus. The current-share circuit includes a switch, which is operable to connect the power supplies internal control signal to the current-share bus when closed and disconnect the internal control signal from the current-share bus when open. The switch is controlled by master/slave logic, which determines whether the power supply is the master or a slave and controls the switch accordingly. The master is determined by closing all of the switches, thereby placing all of the power supplies' internal control signals on the bus.

Abstract: A power supply module package suitable for both high packaged power density and cost effective manufacture. In an exemplary embodiment, the power supply module includes: (1) at least one printed circuit board containing conductors for interconnecting components of the power supply, (2) a thermally conductive baseplate or case operable for transferring heat generated inside the module to the outside environment, wherein the external package dimensions are of a sufficiently small size to allow the user the greatest flexibility in the design of the overall circuit assembly, (3) at least one power magnetic device operable for providing electrical isolation between the input and the output of the power module, and (4) a set of electrical leads to facilitate communication and power flow between the module and circuitry being powered.