Abstract: A data structure for linking or chaining at least two 32 bit words or control markers that are inserted into a packet before the header of the packet that is also positioned at the front of a flow of packets that is being processed by a network processor in a network device. There are at least two types of control markers, primary and cluster. A reserved single bit field in the control marker indicates if multiple control markers are included and chained together in the packet ahead of the header and if the control marker is not a primary control marker, another three bit field indicates the type of that particular control marker, such as a cluster control marker.

Abstract: A data structure represented by a single 32 bit word or “cluster control marker” that is inserted ahead of a header of a packet at the front of a flow of packets from a cluster that is being processed by a network processor in a network device. The cluster control marker includes the results of calculations that have been accelerated through the use of hardware (ASICs) to perform certain tasks in advance for the network processor. The data structure includes the results of Word Type, MAC destination address and Cluster MAC address match, IP destination address and Cluster IP address match, Protocol Type and Destination Port indication, Cluster Hash Calculation value, and fragmentation indication.

Abstract: A wireless communication interface in a network appliance that enables secure wireless management of the network appliance over a relatively limited (short) distance with a mobile node. The operator of the mobile node is authenticated and communication between the network appliance and the mobile node is encrypted. Even if an unauthorized person was able to be positioned in relatively close proximity to a network appliance such as within the physical confines of a data center, these authentication and encryption measures would make it extremely difficult for unauthorized wireless management of the operation of the network appliance.

Abstract: A convenient way for securely storing sensitive data in a public storage area over a wireless network is disclosed. Data that is to be backed up is encrypted using a public key of the user and is sent over the wireless network using a Wireless Application Protocol (WAP) technique and preferably contained within the body of a SyncML document or an XML document. The encrypted data can be later retrieved using a WAP technique and decrypted using the private key of the user.

Abstract: A bridge for converting a relatively high speed communication interfaces provided by a network processor into another type of relatively high speed interface that is supported by an I/O card in a network device. A proprietary high speed communication interface can be a first-in-first-out (FIFO) streaming data interface. The other type of high speed interface supported by an I/O card can be PL3, PL4, SPI 3, SPI 4, and the like. The network devices can include, routers, switches, firewalls, gateways, and the like. The bridge can be configured as an application specific integrated circuit (ASIC).

Abstract: An apparatus for a multi-domain computer system includes multiple virtual system domains, each having an associated, independent routing instance. A virtual switch is created to forward packets between the domains. The virtual switch is configured to operate substantially as if it were a physical layer-2 switch. The virtual switch and the virtual domains are connected together by virtual interfaces, where the virtual switch, the virtual domains, and the virtual interfaces are all created in software. Further, protocols such as ARP, IP, and/or IPv6 operate over the virtual interfaces in substantially the same way that they would over Ethernet. Also, each domain has a software driver that behaves like an Ethernet driver, and has a 48-bit Ethernet-like address that is used for the physical address.

Abstract: A data structure represented by a single 32 bit word or “primary control marker” that is inserted ahead of a header of a packet at the front of a flow of packets that is being processed by a network processor in a network device. The primary control marker includes the results of calculations that have been accelerated through the use of hardware (ASICs) to perform certain tasks in advance for the network processor. Because the insertion of in-band information has an impact on packet stream throughput, both the location of the insertion in the packet header and the type of results that are included in the primary control marker have an effect on the overall performance of the network processor, The data structure includes the results of IP header checksum verification, MAC level filtering and classification, VLAN indication, Flow Hash Index Calculation and Channel Identification.

Abstract: An apparatus and method are directed to managing a configuration of a cluster of members. The invention employs an atomic cluster configuration approach that includes applying a change to the configuration uniformly across the members in the cluster. Each member within the cluster is initialized to a transaction mode. If all members are in the transaction mode, a change is provided to each member, which evaluates the received change. If the change is determined to be unacceptable for any of the members, the change is determined to be globally unacceptable, and is rejected for all the members in the cluster.

Abstract: A method and system for controlling wireless communication between a mobile terminal and a plurality of wireless access points. Link status and quality data is determined about each communication link between the mobile terminal and each wireless access point that is currently detectable by the mobile terminal. A priority list of the detected wireless access points is also generated. Also determined are access point status and quality data about the wireless access points themselves and/or a network connecting them. This access point data may not be accessible to the mobile terminal. The access point data can also include status and/or quality of neighboring wireless access points that are near the detected wireless access points, but not yet detected by the mobile terminal. The link data, access point data and another ranking are used to select a best wireless access point with which the mobile terminal will communicate.

Abstract: Establishing and controlling communication to and from a mobile terminal with multiple network interfaces that can be reached with one phone number via multiple networks. The mobile terminal simultaneously communicates with a central server over a cellular network and a WLAN to dynamically coordinate a preferred routing of a communication session with a partner node. The communication session is routed over whichever network is optimal at any given time, depending on a current location of the mobile device, current performance of each network, and other criteria. A new communication session is established through the central server to enable one number access to and from the mobile terminal. An ongoing communication session is continuously monitored to determine whether and when to perform a network handover. The mobile terminal obtains performance data regarding each network and arranges a network handover with the central server.

Abstract: The preferred embodiment of the present invention is a method and computer program product that specifies an array of elements to be incorporated into a firewall configuration protocol. When added to the configuration protocol, these added attributes allow the existing packet filtering mechanism to accommodate a terminal device that has moved and received a new IP address in a timely and efficient manner.

Abstract: An apparatus, method, and system are directed to maximizing network connectivity after a network failure in a network clustering system. A cluster master in a cluster is configured to manage membership to the cluster based, in part, on a connectivity of the members to adjacent networks. A network device sends information about its connectivity to the cluster master. The cluster master compares the received information to determine whether the network device has different connectivity than the cluster. If the network device has different connectivity, the cluster master may deny cluster membership to the network device. By rejecting network devices with different connectivity, the invention ensures that data received by the cluster may be delivered with substantially equal reliability by virtually any of the cluster members. Thus, even the cluster master may be rejected from membership to the cluster.

Abstract: A method and apparatus for synchronizing a neighbor cache table of a backup network device and with a neighbor cache table of a master network device is provided. The master network device may send an Add command or a Delete command to the backup network device whenever entry is added or deleted from the neighbor cache table of the master network device. Further, when a new network device joins the link to become master or backup, synchronize request and synchronize acknowledge commands may be employed to synchronize the new network device with the master network device. Additionally, when a network device becomes the master, it may send an update command to enable the neighbor switch devices to update their neighbor cache table, if any, to redirect traffic to the network device.

Abstract: A system and method are provided for determining link characteristics in order to calculate the optimal data rate because of a link failure. The system includes a first unit (20, 22) at a first location coupled to one end of each of a plurality of low capacity data links (28) for assisting in determining the characteristics of each of the links (28), a second unit (22, 20) at the second location coupled to the other end of each of the links (28) for assisting in determining the characteristics of each of the links (28) based on the characteristics of the test signal received at the second unit (22, 20), and a processor coupled to the second unit (22, 20) for determining the optimal transmission rate based on the characteristics of the links (28) and the number of links (28) needed to provide the desired transmission rate.

Abstract: Methods and devices are directed to authorizing a network device to a resource over a network. An access server determines based, in part, on an attribute of the network device associated with the attribute certificate, whether the network device may be authorized access to the resource over the network. The attribute may be associated with a capability granted to the network device, a condition to be satisfied for the attribute to be valid, and the like. The attribute may belong to a group of network devices, or one or more users accessing the network through the network device. In one embodiment, the attribute certificate may be provided based on an automated security scan of the network device. In another embodiment, the access server may make the attribute available to a network resource associated with the access server.

Abstract: A transport scheme is provided based on Internet protocol (IP) and multiprotocol label switching (MPLS) technology for third generation (3G) radio access networks (RAN). Label switched paths are established and managed for interconnecting base stations and radio network controllers. The process incorporates constraint-based routing and Diffserv to provide transport bearers that can support bandwidth provisioning and a variety of QoS requirements in the RAN.

Abstract: The system provides an IP network card that comprises a redundancy configuration register; an interface; and redundancy mapping logic. The redundancy configuration register stores card configuration data. The interface receives slot active signals from other cards. The redundancy mapping logic is communicatively coupled to the register and interface. The logic maps a packet to a slot having an active card based on the data in the register, an address in the packet, and received slot active signals.

Abstract: A method and system for providing protection from exploits to devices connected to a network. The system and method include a component for determining whether an encapsulation has been applied to an attachment associated with a message and unencapsulating such encapsulated attachment, and a component that performs at least one decompression of the attachment when the attachment is compressed. If it is determined that the message, including the attachment, is to be scanned, a component is included that determines whether a header, body, and/or attachment of the message includes exploits. A device that receives messages that are directed to the network employs the components above to provide exploit protection for at least one of the messages.

Abstract: An apparatus for improving communication between network devices in a cluster. is provided. A filter is used to pre-process packets to determine if they need to be further processed by the processor of the network device. If true, the packets are presented on a bus either in real time or buffered and presented at time intervals. A synch component is used to pre-process packets to determine if they are associated with synchronization information, management information, filter configuration information.

Abstract: An apparatus is described having an output packet organizer that has a first location and a plurality of second locations. The first and second locations correspond to the priority of a packet, where the first location has higher priority than the second locations. The output packet organizer has a third location. The third location has a higher priority than the first location. The first and third locations are coupled to a scheduler that serves the first and third locations. The second locations coupled to the scheduler through a round robin pointer.