Abstract: A mechanism for detecting denial of service attacks in a digital communications system is described. A probabilistically determined portion of input packets of a connection are processed using a hash function to determine whether the packets belong to the flow initiated by a TCP SYN packet. The hash function includes a secret key for additional security. The result of the hash function is added to a value which is dependent on the sequence number of a packet being processed.

Abstract: Techniques for bandwidth management and flow control on a resilient packet ring (RPR) network is described. The RPR requires allocation and guarantee of a bandwidth for each channel between two nodes on the ring. The bandwidth is managed by shaping traffic on a channel at the source by using a bandwidth allocation factor calculated at each node. The bandwidth allocation factor, which is communicated to other nodes, is calculated by using a recursive nonlinear function of the transit buffer size.

Abstract: Whenever a DSLAM or a network node receives a Group Join message, it compares the MAC address of the originating STB to that of previous Join messages with their existing connections. If a match is found, then the DSLAM will initiate a GSQ for the group of the matching previous Join request. If there is not enough resources to satisfy the requirements of Group Join messages, then it may either be ignored, or queued for later processing, once the normal GSQ sequence is complete and resources are available. If the multicast group is no longer needed, the connection to the group is then terminated, as per normal GSQ processing. This frees up bandwidth for any new Join messages. The normal GSQ processing clears the trouble caused by the loss of Leave Message.

Abstract: A method and apparatus for communicating functional characteristics of nodes in a communications network to the network manager in the network is presented. This is accomplished by defining a bit field that indicates whether or not a particular functions or services are supported by a particular node. The bit field for each node within the communications network is communicated to the network manager which stores the bit fields for each node within a database. The database is then utilized to perform network management functions, as it informs the network manager whether a particular service/feature is available on the node to which the bit field corresponds.

Abstract: The invention provides a system and method of managing service information in a network management system. The method includes the steps of loading the service information from a database into objects in a structure stored in a memory, receiving a change to be made to the service information, updating particular objects in accordance with the received change and sending a change notification to network nodes in accordance with a relationship in the structure between the particular objects.

Abstract: There is a disclosed communications network for the transmission of network traffic from a distribution network to an access network having at least one end user terminal. The distribution network and the access network each having a respective traffic transmission capacity with the traffic transmission capacity of the distribution network being greater than the traffic transmission capacity of the access network. The communications network has a first network device operatively connected to the distribution network. The first network apparatus is capable of receiving network traffic from the distribution network. The communications network also has a second network device operatively connected to the access network. The second network device is capable of transmitting network traffic to the access network. The communications network also has a transmission link operatively connected between the first network device and the second network device.

Abstract: The invention provides a system and a method of selecting a version of a program code from a series of program codes for a program element associated with a hardware element for a circuit board. The invention identifies a compatible program code for a particular hardware element and downloads the compatible program code. A record is associated with the hardware element to identify its compatible program codes. The program codes are stored in a bundle and are associated with a software code. A program loader, associated with each bundle, checks the compatibilities of the hardware element to both the software code and the selected program code. Another record stores compatibility information of the program codes with hardware element versions and is also associated with the bundle. Code downloads are made first to an inactive memory bank and after the codes are verified, the inactive memory bank is made active.

Abstract: A computer communications network comprises a plurality of interconnected ATM switches forming a WAN or LAN area network over which ATM cells are transmitted, and a plurality of user devices including LAN interface adapters for connection to one or more to local area networks (LANs). An interface device connects at least some of the respective ATM switches to the LAN interface adapters. The interface adapts the ATM cells for transport over the LANS. The user devices can thus communicate through the LAN interface adapters transparently with the wide area network.

Abstract: A method and module for tracking transmission of messages being sent from a transmitting module to a receiving module in a communication device is provided. The method includes the step of (a) receiving a message at the receiving module. The method also includes the step of (b) evaluating the received message to determine whether the received message was received by the receiving module in a proper sequence to a previous message, if any, sent by the transmitting module. The method further includes the step of (c) generating an acknowledgement message from the receiving module to the transmitting module, the acknowledgement message including an indicator, a value of the indicator indicating whether the previous message, if any, transmitted from the transmitting module to the receiving module immediately before the received message was received by the receiving module.

Abstract: A method and apparatus of communicating data packets across the midplane of an electronic system in which the packets are partitioned into segments of a predetermined size and then serialized to a predetermined width. The serialized packets are transmitted, in phase staggered segments, across the midplane on a respective channel, received into receiving end and the serialized segments that have traversed the midplane, are deserialized and reassembled into the original data packet.

Abstract: The invention provides a system and method of a selecting an egress connection from egress connections at a node for a call being established in a network along a path being associated with the node. Each connection has sufficient bandwidth to carry the call and terminates at a same destination point in said path. The system and method comprise utilizing at least a bandwidth load balance value for each connection in a set of the connections to select the egress connection from the set. An administrative factor score may be used to further define members of the set.

Abstract: Systems and methods of dynamically introducing security features into a client-server application program are described. A security server between an application server and a database has multiple security components with a shared dependency. This shared dependency enables the introduction of a new security component providing a new security function without compromising the security of the application program. The new security component acquires state information from other security components in the security server thereby dynamically reconfiguring the component-based security system.

Abstract: The invention provides a system and method of retrieving data associated with a file from a database by a field name into local memory. It comprises calculating an address reference for a storage location in the local memory for the data; fetching the data from the database; and utilizing the address reference to map the data to an address in the local memory. The address reference is an offset value from a base address of the storage location. Several files may be accessed using a cross reference table containing pointers to field tables. Entries in the cross reference table point to a field table. Each field table is a list of fields associated with the file. Each entry in the field table is a calculated offset value providing an address offset of a particular field from the base address of the file.

Abstract: The ATM transmitting apparatus for transmitting messages, such as frame relay packets, associated with a plurality of connections comprises ATM layer transmission equipment for receiving multiple messages, segmenting each received message into a plurality of smaller data units, such as 48 byte AAL SAR protocol data units, and multiplexing such data units into a single stream for transport over a physical interface. A scheduler receives messages from each of the connections and transfers the messages to the transmission equipment. The scheduler can dynamically set a transmission rate for any connection, and allocates each connection whose message is transferred to the transmission equipment a substantially maximal amount of bandwidth at any given time during the transmission of the message, to thereby minimize interleaving of data units from the various connections and reduce the average latency (per unit of message) in transmitting the messages across a network.

Abstract: The present invention provides a system and method of evaluating a shelf connected to a port of a control complex in a network element via a communications link, the shelf having shelf configuration information, and the port having a port identifier. In an embodiment, the method comprises the steps of: a) establishing communications between the shelf and the control complex; b) providing the shelf configuration information and the port identifier to the control complex; and c) utilizing the shelf configuration information and the port identifier, together with predetermined system configuration rules, to evaluate the suitability of the shelf being connected to said port. In another embodiment, the method further includes the step of assigning a shelf identifier to the shelf in response to the shelf being connected in accordance with the predetermined system configuration rules.

Abstract: A system and method for managing communication links connecting components in a network element is provided. The network element has a first component, a second component and at least two communication links. The communication links are adapted to provide a first connection and a second connection between the first component and the second component. The system includes, for each communication link of the at least two communication links connected to the first component and adapted to provide the first connection and the second connection, a detection module adapted to monitor a given communication link for an error. The system also includes, for each communication link connected to the second component and adapted to provide the first connection and the second connection, another detection module adapted to monitor another given communication link for an error.

Abstract: The present invention provides a system and method for providing a different quality of service to a flow associated with an aggregate flow is provided. For an embodiment, the method comprises scheduling a plurality of data traffic flows in a communication network, the method comprising: (i) scheduling data traffic flows in a first category of data traffic, said first category of data traffic having a first bandwidth capacity associated therewith; (ii) determining whether any portion of said first bandwidth capacity is unused by data traffic flows in said first category of data traffic; and (iii) scheduling data traffic flows in a second category of data traffic providing said unused portion of said first bandwidth capacity for use for said data traffic in said second category.

Abstract: Methods of preventing flooding-type denial-of-service attacks in a computer-based network are described. Connection establishing messages known as SYN packets are matched with connection terminating messages (FIN packets) by using a hash algorithm. The hash algorithm or message digest uses source and destination IP addresses, port numbers, and a secret key as input parameters. The SYN packets and FIN packets are mapped to buckets using the hash algorithm and statistics are maintained for each bucket. A correspondence between SYN packets and FIN packets is maintained to close a security hole.

Abstract: Methods and apparatus for detecting denial of service attacks on a system in a communications network are provided. A frequency analysis is performed on certain types of packets that arrive with a periodic nature. A frequency power spectrum obtained through Fourier Transform reveals whether the power level of any particular frequency is greater than the average power spectrum. The detection of a higher than average power level is an indication that an attack is in progress.

Abstract: A method is disclosed for detecting and diagnosing faults in a network. The network has a plurality of nodes through which switched virtual connections can be established. First, all attempts at establishing routes through the network are recorded. Then, the location of a failure is determined by analyzing the attempted routes.