Abstract: A device includes one or more network interfaces to receive layer two (L2) communications from an L2 network having a plurality of L2 devices; and a control unit to forward the L2 communications in accordance with forwarding information defining a plurality of flooding next hops. Each of the flooding next hops stored by the control unit specifies a set of the L2 devices within the L2 network to which to forward L2 communications in accordance with a plurality of trees, where each of the trees has a different one of the plurality of L2 devices as a root node. The control unit of the device computes a corresponding one of flooding next hops for each of the trees using only a subset of the trees without computing all of the trees having all of the different L2 network devices as root nodes.

Abstract: In general, techniques are described for performing distributed network address translation (NAT) with a network device. The network device includes an interface card and a control unit. The interface card receives a packet including a source address. The control unit includes NAT modules. each of which stores a local pool of unallocated NAT resources that have not yet been allocated for use in performing network address translation. The NAT resources each include a network address and a network port number. One of the NAT modules receives the packet, determines whether any of the NAT resources from the local pool of NAT resources are available, in response to the determination that none of the NAT resources from the local pool of NAT resources are available, requests additional NAT resources, and performs NAT to obscure the source address of the packet using one of the additional NAT resources to generate a modified packet. The interface card forwards the modified packet.

Abstract: In general, techniques are described for translating authorization information within computer networks. For example, a first network device of a computer network may receive authentication information from an endpoint device requesting access to the computer network. The first network device authenticates the endpoint device based on this authentication information and stores authorization information in accordance with a first vendor-specific authorization data model. The first network device stores and applies an export translation policy to translate this information from the vendor-specific data model to a vendor-neutral authorization data model, which it then publishes to an intermediate storage device that implements the vendor-neutral data model. A second network device of the computer network may store an import translation policy to translate this same authorization information from the vendor-neutral authorization data model to a different vendor-specific data model.

Abstract: The present invention provides an efficient system and method for routing information through a dynamic network. The system includes at least one ingress point and one egress point. The ingress and egress point cooperate to form a virtual circuit for routing packets to destination subnets directly reachable by the egress point. The egress point automatically discovers which subnets are directly accessible via its local ports and summarizes this information for the ingress point. The ingress point receives this information, compiles it into a routing table, and verifies that those subnets are best accessed by the egress point. Verification is accomplished by sending probe packets to select addresses on the subnet. Additionally, the egress point may continue to monitor the local topology and incrementally update the information to the ingress to allow the ingress to adjust its compiled routing table.

Abstract: In general, embodiments of the present disclosure are directed to techniques for quickly displaying metadata of media objects (e.g., music files) using gestures. In one example a method includes, generating for display a browsing view including browsing content, wherein the browsing content includes one or more media objects; receiving user input including one or more gestures to select at least one media object; determining an input operation that selects a quantity of metadata associated with the selected media object, wherein the metadata includes information that describes the selected media object, and wherein the quantity of the metadata is proportional to a detected property of the one or more gestures to select the media object; and generating for display in an expanded view, the metadata associated with the at least one selected media object.

Abstract: In one example, a backup intrusion detection and prevention (IDP) device includes one or more network interfaces to receive a state update message from a primary IDP device, wherein the state update message indicates a network session being inspected by the primary IDP device and an identified application-layer protocol for the device, to receive an indication that the primary device has switched over or failed over to the backup device, and to receive a plurality of packets of the network session after receiving the indication, each of the plurality of packets comprising a respective payload including application-layer data, a protocol decoder to detect a beginning of a new transaction from the application-layer data of one of the plurality of packets, and a control unit to statefully process only the application-layer data of the network session that include and follow the beginning of the new transaction.

Abstract: An intrusion detection system (“IDS”) device is described that includes a flow analysis module to receive a first packet flow from a client and to receive a second packet flow from a server. The IDS includes a forwarding component to send the first packet flow to the server and the second packet flow to the client and a stateful inspection engine to apply one or more sets of patterns to the first packet flow to determine whether the first packet flow represents a network attack. The IDS also includes an application identification module to perform an initial identification of a type of software application and communication protocol associated with the first packet flow and to reevaluate the identification of the type of software application and protocol according to the second packet flow. The IDS may help eliminate false positive and false negative attack identifications.

Abstract: In general, embodiments of the present disclosure are directed to techniques for quickly displaying metadata of media objects (e.g., music files) using gestures. In one example a method includes, generating for display a browsing view including browsing content, wherein the browsing content includes one or more media objects; receiving user input including one or more gestures to select at least one media object; determining an input operation that selects a quantity of metadata associated with the selected media object, wherein the metadata includes information that describes the selected media object, and wherein the quantity of the metadata is proportional to a magnitude of the one or more gestures to select the media object; and generating for display in an expanded view, the metadata associated with the at least one selected media object, wherein the expanded view is generated for display without changing the browsing content.

Abstract: Techniques are described for resynchronizing mutually shared data stored on network devices of a computer network. Upon receiving change instruction and globally unique identifier (GUID) messages, each of the network devices records the change instructions and GUIDs in a journal of the network device. When communication is lost for a period of time between a first network device and a second network device, the mutually shared data of the first network device may need to be resynchronized with the mutually shared data of the second network device. The techniques described herein allow resynchronization of the mutually shared data of the first network device based on a common GUID recorded in the journals of both first and second network devices, the journal of the first network device, and the journal of the second network device.

Abstract: A method of recognizing a tamper event is provided. The method uses an optical medium having a unique signature, and transmits at least one light wave into the optical medium. The light wave is altered by the unique signature of the optical medium and at least one property of the light wave is measured. Access to at least a portion of a system is conditioned based on the at least one property of the light wave.

Abstract: Techniques are described for providing security to a protected network. Techniques are described for thwarting attempted network attacks using marked information. The attack correlation system provides marked information to computing devices that probe for sensitive information, and monitors subsequent communications for use of the marked information. In one example, the attack correlation system reroutes communications containing the marked information to a dedicated vulnerable device that logs the communications to monitor the attackers' methods. The attack correlation system may also include functionality to exchange information regarding attempted attacks with other attack correlation systems to gain broader knowledge of attacks throughout one or more networks.

Abstract: An instant messaging (IM) system has an IM server connected to a communication network, and logic operable on the IM server enabling a first user to browse contacts associated with a second user. In some cases the first user can add and list contacts accessed by browsing the contacts associated with the second user.

Abstract: In general, techniques are described for synchronizing resource bindings within computer networks. An intermediate network device comprising an interface card and a control unit may implement these techniques. The interface card receives a message from a server that allocates a network address for use by a client device identified by a unique identifier. The control unit stores data defining a binding between the unique identifier and the network address. The control unit includes a binding synchronization module that determines, based on a determination to release the binding, whether the binding release occurs in response to receiving a release message from the client device, and automatically generates a release message on behalf of the client device upon determining that the binding release did not occur in response to receiving a release message. The binding synchronization module outputs the automatically generated release message to the server that reserved the L3 network address.

Abstract: A brake disk (10) includes an annular core (12, 60, 82) formed from a plurality of non-annular pieces (40, 66, 68, 84), a first friction disk (14) mounted on a first side of the annular core (12, 60, 82), a second friction disk (14) mounted on a second side of the core (12, 60, 82) opposite from the first friction disk (14), and at least one fastener (58) connecting the first and second friction disks (14, 14) to the core (12, 60, 82). Also a method of assembling a brake disk from a core and friction elements.

Abstract: A device may receive a data unit and identify a class of the received data unit. The device may further obtain a service tag based on the class of the data unit and send the service tag and the data unit to a service module in the network device. The service module may perform a service for the data unit.

Abstract: A radiation-hardened charge pump circuit is provided. The circuit includes a first charge pump having a first charge pump output, a second charge pump having a second charge pump output, a first coincidence detector receiving as inputs the first charge pump output and the second charge pump output and producing as an output a first coincidence signal, and an analog 2:1 multiplexor for selecting either the first charge pump output or the second charge pump output based on the first coincidence signal. In alternative embodiment, the circuit includes at least three charge pumps, at least two coincidence detectors, decision logic, and a correspondingly-sized analog multiplexor.

Abstract: In general, the invention is directed to strategies pertaining to implantation of an implantable medical device between a scalp and a skull of the patient. The invention pertains to collection of data such as data pertaining to the skull of the patient, the scalp of the patient, the vascular structure or neurological structures in the head of the patient, and the like. The data may be in the form of images, such as images generated by X-ray, magnetic resonance imaging, CT-scan and fluoroscopy. A surgeon can use the collected data to determine, for example, whether the patient is a candidate for a cranial implantation, whether the patient's skull and scalp can support the implantation, what configuration of device should be implanted, where the device should be implanted, and how the surgical incisions should be made.

Abstract: In some examples, aspects of the present disclosure may include techniques for audio control of one or more multimedia objects. In one example, a method includes receiving an electronic document that includes a group of one or more multimedia objects capable of generating audio data. The method also includes registering a multimedia object of the group of one or more multimedia objects, wherein registering the multimedia object comprises storing a multimedia object identifier that identifies the multimedia object. The method further includes receiving audio data; and determining, by a computing device, a volume level of the audio data generated by the registered multimedia object based on one or more configuration parameters, wherein the one or more configuration parameters define one or more volume levels associated with the multimedia object identifier. The method also includes outputting, to an output device, the audio data at the determined volume level.

Abstract: A mass-based dispensing system includes a set of interchangeable load cell assemblies. The load cell assemblies are sized to be interchangeably received into a mass-based product dispenser. Each of the interchangeable load cell assemblies has a maximum rated load that is different from the maximum rated load of the other load cell assemblies. The interchangeable load cell assemblies are substantially modular (i.e., have substantially similar external geometries), thus enabling the product dispenser to interchangeably receive the load cells. The interchangeable load cell assemblies enable a single product dispenser to accommodate a broad range of differently weighted products and/or product containers.

Abstract: This disclosure describes various techniques for discriminating supraventricular tachycardia (SVT) from ventricular tachycardia (VT). As one example, a method includes detecting a tachycardia rhythm, identifying a rate of change in heart rate corresponding to the tachycardia rhythm, identifying a rate of change in heart rate variability corresponding to the tachycardia rhythm, and classifying the tachycardia rhythm as at least one of supraventricular tachycardia or ventricular tachycardia based on the rate of change in heart rate and rate of change in heart rate variability.