Abstract: A system and method for providing rapid rerouting of real-time transport protocol (RTP) multi-media flows is disclosed. Generally, a first endpoint is connected to a second endpoint, wherein the first endpoint comprises a transceiver, software stored within the first endpoint defining functions to be performed by the first endpoint, and a processor configured by the software. The processor is configured to perform the steps of, performing flow processing on a data packet received at a first endpoint, from a second endpoint, removing a multi-protocol label switching (MPLS) tag from the data packet, translating a source address and destination address of the data packet, and determining a forwarding destination if more than one destination address of the data packet is provided.

Abstract: A method and apparatus for performing classification in a hierarchical classification system performing caching are described. In one embodiment, the method comprises walking a classification tree in the hierarchical classification system to determine whether an incoming flow matches a class in the classification tree, and performing a lookup on a cache storing a data structure of multiple classes of one classification type to compare the incoming flow with multiple classes at the same time to determine whether the incoming flow matches one of the classes.

Abstract: A system and method for assisting in controlling real-time transport protocol flow through multiple networks via media flow routing is disclosed. The system utilizes a first computer and a second computer connected to the first computer, via a group of associated computers, wherein each of the first computer, second computer, and group of associated computers comprise a transceiver, a memory, and a processor.

Abstract: Methods, apparatuses and systems allowing for dynamic detection of network devices, located along communications paths associated with a computer network, that include compatible transformation tunneling capabilities. In one embodiment, a tunnel probing device, having transformation tunneling capabilities, monitors data flows to respective destination hosts and probes for other network devices, having compatible transformation tunneling capabilities, located along respective communications paths to the destination hosts. A network device in a communications path, recognizing probes transmitted by the tunnel probing device, responds to the probe by communicating its transformation tunneling capabilities, and passes the probe along the path to the destination host for possible recognition by other compatible network devices. The present invention allows for recognition and optimization of network traffic between network devices without prior configuration.

Abstract: Methods, apparatuses and systems directed to measuring delay attributable to a network. The network delay is computed, in one implementation by determining a round-trip time for a network connection based on the arrival times of selected packets transmitted by first and second endpoints to establish the network connection, measuring the time gaps between consecutively increasing data packets in an ordered packet stream associated with a transaction, comparing the measured time gaps to the round-trip time, and computing a network delay for the transaction by adding the round-trip time to the measured time gaps that exceed the round trip time.

Abstract: The present invention is a method and system which extracts, manipulates and embeds data from a compressed and standard compliant video bitstream which may be used for digital rights management, e.g. controlling access to a bitstream or for authenticating a video bitstream. The method embeds binary data bits into compressed and standard compliant video bitstream with minimal visual artifacts. The method first parses the compressed video bitstream and locates coded blocks. The codeword C for the last triplet in the original block(RUNc,LEVELc, LASTc=1) is replaced by the VLC code word C? for the last triplet (RUNC,LEVELC, LASTC?=0). A codeword corresponding to a triplet with LAST=1 is placed after C? whose sign bit “s” can be either 0 or 1 and is an embedded data bit, and can be used for authentication.

Abstract: A system and method for efficiently forwarding client requests from a proxy server in a TCP/IP computing environment is described. A plurality of transient requests are received from individual sending clients into a request queue. Each request is commonly addressed to an origin server. Time estimates of TCP overhead, slow start overhead, time-to-idle, and request transfer time for sending the requests over each of a plurality of managed connections to the origin server are dynamically calculated, concurrent to receiving and during processing of each request. The managed connection is chosen from, in order of preferred selection, a warm idle connection, an active connection with a time-to-idle less than a slow start overhead, a cold idle connection, an active connection with a time-to-idle less than a TCP overhead, a new managed connection, and an existing managed connection with a smallest time-to-idle. Each request is forwarded to the origin server over the selected managed connection.

Abstract: A system for assisting in controlling real-time transport protocol flow through multiple networks via use of a cluster of session routers is disclosed. The system utilizes a first computer and a cluster of computers, wherein the cluster of computers comprises at least two associated computers that are connected to the first computer. Each of the associated computers comprises a second transceiver, a second memory having logic stored therein defining functions to be performed by the associated computers, and a second processor.

Abstract: A system and method for dynamically identifying internal hosts in a heterogeneous computing environment with multiple subnetworks is disclosed. A plurality of packets are analyzed. Each such packet includes a source address of an originating host and a destination address of a receiving host. An unknown originating host located at the source address of an outbound packet is classified as an inside host with high confidence. An unknown receiving host located at the destination address of an inbound packet is classified as an inside host. The unknown receiving host is reclassified as an inside host with high confidence upon receiving a further outbound packet having a source address corresponding to the address of the unknown receiving host.

Abstract: Methods, apparatuses and systems enabling a network services provider to deliver application performance management services to its enterprise customers. The invention allows network service providers to extend their service model beyond connectivity-oriented MNS services to more productivity-oriented, managed application services. The present invention, in one embodiment, allows network service providers to offer an application-aware service that provides real-time monitoring, measurement and control of application performance over MNS and other wide-area network services.

Abstract: According to the present invention a telecommunications apparatus for providing transport of packetized information over large distances. The apparatus provides a bi-directional flow of information from a first satellite gateway using a connection over a satellite network to a second satellite gateway. The apparatus uses a gateway that translates the information using the TCP protocol into information using a satellite protocol, which is suitable for transmission of such information over the satellite network.

Abstract: A method for explicit data rate control is introduced into a packet communication environment (10) which does not have data rate supervision by adding latency to the acknowledgment (ACK) packet and by adjusting the size of the flow control window associated with the packet in order to directly control the data rate of the source data at the station (12 or 14) originating the packet.

Abstract: In a switching device, a method of communicating data packets from sending ports to destination ports includes storing in a first stage queue packet-related data from a sending port; determining from the packet-related data which destination ports are to receive the packet-related data in the first stage queue; storing in a second stage queue associated with each determined destination port the packet-related data from the first stage queue; and using the packet-related data in the second stage queue to complete the communication of the data packet from the sending port to each determined destination port. Apparatus for practicing the method comprises a first stage queue storing packet-related data from a sending port; and a second stage queue associated with each of a set of destination ports storing the packet-related data from the first stage queue.

Abstract: A system and method for recompressing a JPEG image using requantization is described. DCT transform coefficients for a compressed JPEG image are statistically analyzed to generate a stored numeric error representation. Local minimizers are determined from the stored numeric error representation with selective rounding. A new quantization matrix Q1 is selected from the local minimizers bounded by a target quantization matrix Qbound. The compressed JPEG image is recompressed using the new quantization matrix Q1.

Abstract: A novel and useful virtual private network (VPN) mechanism and related security association processor for maintaining the necessary security related parameters to perform security functions such as encryption, decryption and authentication. A security association database (SAD) and related circuitry is adapted to provide the necessary parameters to implement the IPSec group of security specifications for encryption/decryption and authentication. Each security association (SA) entry in the database comprises all the parameters that are necessary to receive and transmit VPN packets according to the IPSec specification.

Abstract: A method for explicit data rate control is introduced into a packet communication environment (10) which does not have data rate supervision by adding latency to the acknowledgment (ACK) packet and by adjusting the size of the flow control window associated with the packet in order to directly control the data rate of the source data at the station (12 or 14) originating the packet.

Abstract: The packet processor system has a port for receiving packets from a first network. A line interface unit is connected to the port for determining the types of packets that are received by the port. A generic pipeline stage assembly is connected to the line interface unit and includes a plurality of generic pipeline stages each having a request engine for sending lookup requests to a lookup engine and a modifier engine for receiving lookup results from the lookup engine. A packet memory is connected to a last generic pipeline stage of the generic pipeline stage assembly and an output line interface unit is connected to the packet memory and a second network.

Abstract: A novel and useful dynamic packet filter that can be incorporated in a hardware based firewall suitable for use in portable computing devices such as cellular telephones and wireless connected PDAs that are adapted to connect to the Internet. The invention performs dynamic packet filtering on packets received over an input packet stream. The dynamic filter checks dynamic protocol behavior using information extracted from the received packet. Sessions are created and stored in a session database to track the state of communications between the source and destination. Recognition of a session is accelerated by use of a hash table to quickly determine the corresponding session record in the session database. Session related data is read from the session database and the received packet is checked against a set of rules for determination of whether to allow or deny the packet.

Abstract: A system and method for providing statistics gathering within a packet network is disclosed. The system comprises a network processor, a traffic manager, a host processor, and a field programmable gate array. The network processor adds a header to received multimedia packets and the traffic manager measures and enforces multimedia flow rates. The host processor performs multimedia flow quality measurement services on a per flow basis, wherein the multimedia flow quality measurement services comprise maintaining current statistics for multimedia flows within the network processor including aggregate and minimum/maximum statistics for the multimedia flow.

Abstract: In packet communication, a method for automatically classifying packet flows for use in allocating bandwidth resources and the like by a rule of assignment of a service level. By rendering discoverable the attributes of a flow specification for packet flows, a finer grained hierarchy of classification is provided automatically that is based on information which is specific to the type of program or application supported by the flow and thus allowing greater flexibility in control over different flows within the same application. The method comprises applying individual instances of traffic classification paradigms to packet network flows based on selectable information obtained from a plurality of layers to define a characteristic class, then mapping the flow to the defined traffic class. The flow specification is provided with some application-specific attributes, some of which are discoverable.