Abstract: A system, method, and interface for segregating a network controller and a security gateway is provided. A security gateway-network controller interface is established between a security gateway and a network controller. One or more application interfaces are carried over the security gateway-network controller interface. An admission policy interface may be maintained on the security gateway-network controller interface that allows establishment of dynamic access control lists for admission policies applied on specific secure tunnels. Additionally, a security association-international mobile subscriber identity interface may be maintained on the security gateway-network controller interface that facilitates ensuring an IMSI used during a registration process matches an identity used to establish a tunnel. Thus, a subscriber validation mechanism is provided over the security gateway-network controller interface that couples the network controller and the security gateway.

Abstract: A method and apparatus of transmitting a modulated data over a digital voice network that includes voice compression. The method and apparatus determine whether a voice signal to be transmitted over the network includes a modulated data signal and then encodes or demodulates the modulated data signal and bypasses voice compression when a modulated data signal is detected. The method and apparatus may detect a modulated data signal by detecting the presence of an answer tone and then searching for a plurality of phase reversals having a particular time distance from each other in the voice signal. Once the encoded or demodulated signal is transmitted over the digital voice network, the method and apparatus of the present invention may detect whether the received signal is an encoded data signal or a demodulated data signal. Then the coded data signal may be decoded back into a modulated data signal. Likewise, the demodulated data signal may be modulated back into a modulated data signal.

Abstract: A method and apparatus is described that allow the creation of virtual routing domains in an IP network. These virtual routing domains allow individual networks to be configures so that it appears that its routing domain covers the entire IP address space. A network processing system is used to implement the virtual routing domains and to allow network traffic to cross the individual routing domains. The network processing system is able to use application layer information to allow the crossing of virtual routing domain boundaries. By examining application layer information the network processing system is able to look up customer/user information and use that information to determine destination virtual routing domains and route otherwise unroutable addresses between domains.

Abstract: A method and computer-readable medium for obtaining information associated with a VoIP communication session includes tapping the computer network passively to obtain signaling and media information in a first format, separating the signaling and media information, determining transport information from at least one of the signaling and media information, transcoding the media information to a second format, and storing the transcoded media information in the second format. The media information includes data, voice, audio, and/or video information.

Abstract: A method and system are described for resolving problems created by implementing multiple networks using private IP addresses and layer two tunneling protocols is described. A network processing system is operable to map flows from private IP addresses and ports on layer two tunneling protocol networks to public IP addresses and ports using the private IP addresses and ports and identifiers for the layer two tunneling protocol network. The network processing system uses its own public IP addresses and ports to anchor the traffic from the private network and performs the required mapping to pass traffic between the public and private networks.

Abstract: A method is described for detecting rogue packets in real-time protocol (“RTP”) data streams. Rogue packets occur due to a malfunctioning device continuing to send RTP packets after the termination of the media session, or by third party devices due to malfunction or malicious activity. The method recognizes rogue RTP packets by examining identifying fields in each packet associated with the RTP stream. The fields can be in the header of the packet or in the payload, and can include information such as destination address, destination port, protocol, sequence number, SSRC number, and others. Once rogue activity is detected the method can quarantine the associated pinhole information and/or alert a network operator.

Abstract: A method is described that is operable to reorder and reassemble data packets from network traffic into unfragmented and in-order traffic flows for applications such as deep packet classification and quality of service determination. A queue engine stores incoming data packets in a packet memory that is controlled by a link list controller. A packet assembler extracts information from each data packet, particularly fields from the header information, and uses that information among other things, to determine if the data packet is fragmented or out of order, and to associate the data packet with a session id. If the packet is determined to be out of order, the queue engine includes a reordering unit, which is able to modify links with the link list controller to reorder data packets. A fragment reassembly unit is also included which is capable of taking fragments and reassembling them into complete unfragmented data packets.

Abstract: A method and computer-readable medium for obtaining information associated with a VoIP communication session includes tapping the computer network passively to obtain signaling and media information in a first format, separating the signaling and media information, determining transport information from at least one of the signaling and media information, transcoding the media information to a second format, and storing the transcoded media information in the second format. The media information includes data, voice, audio, and/or video information.

Abstract: A method of obtaining information associated with a Voice over Internet Protocol (VoIP) communication session includes tapping the computer network passively to obtain signaling information and media information in a first format, separating the signaling information from the media information, transcoding the media information to a second format, and storing the transcoded media information in the second format. The media information includes data, voice, audio, and/or video information. A system adapted to obtain information associated with a VoIP communication session on a computer network includes a tapping device to passively tap the computer network to obtain signaling information and media information in a first format, a processing device adapted to transcode the media information from the first format to a second format and separate the signaling information from the media information, and a storage device adapted to store the transcoded media information in the second format.

Abstract: A network processing system is described that is able to monitor IP network traffic, including the ability to perform trap and trace on IP communications flowing over the IP network. The network processing system is able to scan the entire contents of data packets passing through it, and to associate related data packets into discrete sessions, or flows, which allows the network processing system to search for predetermined search criteria contained within those flows. If a flow is found to contain a predetermined search criteria, the network processing system is able to maintain a record of the flow or to replicate the flow and save it or send it to another IP address for monitoring. The monitoring of a flow can include the entire contents of the flow, or any subset of information in the flow such as call identifying information.

Abstract: A system and method for allowing bidirectional network traffic to pass through a network address translation (“NAT”)/firewall device thereby allowing bidirectional traffic to flow between the private side of the NAT/firewall device and the public side of the NAT/firewall device while maintaining security between the public side and the private side is described. A network processing system on the public side of the NAT/firewall device anchors network traffic to and from the private side of the NAT/firewall device. A traversal client resides on the private side of the NAT/firewall device and has a secure connection with the network processing system. The traversal client is operable to pass signaling packets bound for a terminal on the private side of the NAT/firewall from the network processing system.