Abstract: Methods, apparatuses and systems that dynamically adjust the selection of differentiated network services for selected classes of traffic in response to changing network conditions or application performance levels. In one implementation, the present invention allows for a differentiated network services scheme that adapts to existing network conditions and, in one implementation, selects higher, generally more expensive classes of differentiated network service for certain data flows when the performance of selected applications degrades below a threshold level. The present invention, in one implementation, allows for bandwidth cost savings without sacrificing application performance.

Abstract: Methods, apparatuses and systems facilitating the concurrent classification and control of tunneled and non-tunneled data flows in a packet-based computer network environment. As discussed in more detail below, embodiments of the present invention allow for the “intra-tunnel” classification of data flows and, based on the classification, the deterministic and intelligent application of aggregate bandwidth utilization controls on data flows corresponding to a given tunnel. Embodiments of the present invention allow for the allocation of bandwidth on an application-level basis between tunneled and non-tunneled traffic, as well as between applications within a given tunnel. Other embodiments of the present invention can be configured to provide a differentiated security model for non-tunneled and tunneled traffic. In addition, embodiments of the present invention can be further configured to implement a layered security model for tunneled traffic.

Abstract: A system and method for dynamically controlling aggregate and individual packet flow characteristics within a compressed logical data tunnel. A logical data tunnel is formed and includes one or more packet flows. Each packet flow includes individual packets having a shared destination address. Bandwidth allocated to control an aggregated flow of packets routed through the logical data tunnel. A transfer rate is assigned to control each packet flow transiting within the logical data tunnel.

Abstract: Methods, apparatuses and systems directed to the classification of encrypted network traffic. In one implementation, the present invention facilitates the classification of network traffic that has been encrypted according to a dynamically-created encryption mechanism involving a handshake between two end-systems, such as the SSL and TLS protocols. In one implementation, the present invention observes and analyzes attributes of the handshake between two nodes to enhance the classification of network traffic. In one embodiment, the enhanced classification mechanisms described herein operate seamlessly with other Layer 7 traffic classification mechanisms that operate on attributes of the packets themselves. Implementations of the present invention can be incorporated into a variety of network devices, such as traffic monitoring devices, packet capture devices, firewalls, and bandwidth management devices.

Abstract: Methods, apparatuses and systems that facilitate the classification of web services network traffic. In one implementation, the present invention processes interface definitions corresponding to a given Web service to construct a traffic classification configuration for the Web service, including one or more traffic classes and corresponding matching rules or attributes for each traffic class. In one implementation, the present invention automatically creates traffic classes and matching rules that allow for differentiation between the operations supported by a Web service. Implementations of the present invention provide a mechanism allowing for classification of Web services network traffic on a granular basis to enhance network monitoring and analysis tasks, as well as network control functions, such as bandwidth management, security and other functions.

Abstract: Methods, apparatuses and systems directed to a network traffic synchronization mechanism facilitating the deployment of network devices in redundant network topologies. In certain embodiments, when a first network device directly receives network traffic, it copies the network traffic and transmits it to at least one partner network device. The partner network device processes the copied network traffic, just as if it had received it directly, but, in one embodiment, discards the traffic before forwarding it on to its destination. In one embodiment, the partner network devices are operative to exchange directly received network traffic. As a result, the present invention provides enhanced reliability and seamless failover. Each unit, for example, is ready at any time to take over for the other unit should a failure occur.

Abstract: Methods, apparatuses and systems directed to the coordinated classification of network traffic. In one implementation, the present invention enables a coordinated network environment for traffic classification where an upstream network device classifies a data flow and adds traffic class information to at least one packet in the data flow. Downstream network devices in the communications path to the destination host can use the traffic class information in the modified packet, bypassing at least some of the local traffic classification operations and thereby reducing CPU utilization. In one implementation, the last downstream network device strips the traffic classification information from the modified packet before it is forwarded to the destination host. Embodiments of the invention reduce or eliminate redundant network traffic classification operations performed by a plurality of network devices in a communications path.

Abstract: The present invention, in particular embodiments, provides methods, apparatuses and systems directed to providing a Wide Area File System that is robust against network connectivity issues. In particular implementations, the present invention provides a WAFS disconnected-mode read-write access that provides for a more seamless user experience against WAN or other network connectivity failures. Specific embodiments provide for management, at a network device such as an EFG node, of file objects previously opened during a connected state with a remote file server appliance, creation of new file objects during a disconnected state and re-synchronization of those file objects (data and meta-data) when a connection becomes available.

Abstract: The present invention, in particular embodiments, provides methods, apparatuses and systems directed to providing a Wide Area File System that is robust against network connectivity issues. In particular implementations, the present invention provides a WAFS disconnected-mode read-write access that provides for a more seamless user experience against WAN or other network connectivity failures. Specific embodiments provide for management, at a network device such as an EFG node, of file objects previously opened during a connected state with a remote file server appliance, creation of new file objects during a disconnected state and re-synchronization of those file objects (data and meta-data) when a connection becomes available.

Abstract: Packet flow rate control techniques are enhanced by the interactive and early invocation of packet queuing to control short flows of packets and to eliminate undershoot and overshoot of a targeted flow rate. Packet queuing involves the scheduled release of packets in accordance with flow policies (priorities) to achieve a pre-selected outgoing target flow rate. The combination of controlled packet queuing and packet flow rate control with appropriate mechanisms for favoring one over the other improves the efficiency of data transmission.

Abstract: A system and method for dynamically controlling a rogue application through incremental bandwidth restrictions is disclosed. A network connection supporting a flow of network traffic in a distributed computing environment is monitored. The network traffic flow includes a stream of data packets generated by a rogue application. Bandwidth allocated to the monitored network connection is incrementally adjusted until the flow of the network traffic for the rogue application achieves a steady state of bandwidth restriction. The flow of subsequent network traffic over the monitored network connection is controlled at the steady state of bandwidth restriction.

Abstract: Methods, apparatuses and systems facilitating enhanced classification of network traffic that extends beyond analysis of explicitly presented packet attributes and holistically analyzes data flows, and in some implementations, related data flows against known application behavior patterns to classify the data flows. Implementations of the present invention facilitate the classification of encrypted or compressed network traffic, or where the higher layer information in the data flows are formatted according to a non-public or proprietary protocol.

Abstract: An exemplary embodiment provides a method for use in a data compression device wherein optimal compression is maintained in response to network characteristics by switching between a first compression mode, including use of a stateful compression algorithm and a reliable transport protocol, to a second compression mode, including a second compression algorithm and an unreliable transport protocol, as needed in order to keep data flowing. In the second compression mode, rather than bypassing an established tunnel between two data compression devices altogether and losing the benefits of compression, this method allows data to be compressed using an algorithm that does not require reliable packet delivery. When a positive change in network conditions is detected, data transmission using the first compression mode resumes.

Abstract: A method for use in a network device that uses a proportional/integral/derivative (PID)-type algorithm to compute one or more flow control parameters intended to achieve a target rate for a data flow.

Abstract: Methods, apparatuses and systems directed to an adaptive network traffic monitoring and measurement system. In one implementation, the present invention provides a measurement engine that monitors data flows on the packet processing path of a network device and executes measurement policy that control the granularity with which measurement data is recorded. In one implementation, the present invention provides a filtering and aggregation mechanism that can seamlessly adapt to changes in measurement policy configuration.

Abstract: Methods, apparatuses and systems facilitating remote deployment of network devices. Implementations of the present invention enable deployment workflows that reduce the costs associated with installing and configuring network devices on computer networks. Other implementations of the present invention enable an automated, remote deployment and configuration system for network devices.

Abstract: Flow-aware task distribution in network devices having multiple processor architectures. In one embodiment, the present invention can be used for high bandwidth network processing in an application and flow aware Quality of Service (QoS) network device. In some implementations, the present invention provides a task distribution architecture capable of flow state awareness and link level QoS control. In some implementations, the present invention can incorporate one or more processes, such as flow distributors and device distributors, that route packets for processing among different processing units on the basis flow correspondence and/or link or network path attributes. The flow and device distributors, in one implementation, allow for the separation and paralletization of packet processing functionality into flow-specific and link-specific processing units, allowing for a highly-scalable, flow-aware task distribution in a network device that processes network application traffic.

Abstract: Synchronization of network traffic compression mechanisms deployed in redundant network topologies. In one implementation, the present invention features the synchronization of compression statistics on redundant network devices to facilitate failover and load sharing operations in the management of data flows traversing computer network environments. In one implementation, compression meta data is appended to synchronization packets and transmitted to one or more partner or redundant network devices. The receiving network devices use the compression meta data to synchronize one or more data flow control processes or data structures. Implementations of the present invention also feature process flows that increase the efficiency of synchronizing compression related operations.

Abstract: A method and apparatus for using an application layer demarcation point are described. In one embodiment, the method comprises monitoring end-to-end performance of a network application at an application demarcation point in a network, and mediating between provider infrastructure and customer infrastructure based on results of monitoring.

Abstract: An exemplary embodiment provides for a method for recording network traffic data that can be used in a network device operably disposed in a network, wherein the network device comprises a measurement data structure including at least one entry and a corresponding measurement key and wherein the at least one entry comprises at least one measurement attribute. The method includes receiving a packet and matching the packet to a data flow. A measurement policy for the data flow is identified, wherein the measurement policy comprises one or more measurement axes corresponding to respective data flow attributes, and a rule set relating to at least one of the one or more measurement axes. The rule set is applied to dynamically select one or more of the measurement axes in the measurement policy to be applied to the data flow. A measurement key is created based on the selected one or more measurement axes and attributes of the data flow corresponding to the selected one or more measurement axes.