Abstract: Methods and apparatuses, including computer program products, are described for applying service based on classification and grouping of traffic flows. The method includes receiving a traffic flow, and matching the traffic flow to classification groups. The matching includes determining a first event associated with the traffic flow, comparing attributes of the first event with entry criteria of the classification groups, and assigning the first event to one or more classification groups where the first event meets the entry criteria of the one or more classification groups. The method includes identifying one or more service definitions for the traffic flow based on the classification groups assigned to the traffic flow, reconciling the one or more service definitions for the traffic flow, and providing a service to the traffic flow based on the reconciled service definitions.

Abstract: Methods and apparatuses, including computer program products, are described for applying service based on classification and grouping of traffic flows. The method includes receiving a traffic flow, and matching the traffic flow to classification groups. The matching includes determining a first event associated with the traffic flow, comparing attributes of the first event with entry criteria of the classification groups, and assigning the first event to one or more classification groups where the first event meets the entry criteria of the one or more classification groups. The method includes identifying one or more service definitions for the traffic flow based on the classification groups assigned to the traffic flow, reconciling the one or more service definitions for the traffic flow, and providing a service to the traffic flow based on the reconciled service definitions.

Abstract: A system for recording a communication session is disclosed. The system includes an edge device configured to receive a message that includes information about the communication session, determine whether to record the communication session based on at least one criterion, and mark the message to indicate that the communication session should be recorded if the at least one criterion is satisfied. The system also includes a signaling entity configured to receive the message from the edge device and, if the at least one criterion is satisfied, direct the message to a recorder configured to record the communication session.

Abstract: Methods, systems, and computer program products are described associated with publicly-switched telephone network (“PSTN”) signaling at a media gateway for a packet-based network. The described signaling involves receiving, at a media gateway in communication with a packet-based network, signaling information and content information associated with one or more calls. The signaling information is based on a PSTN standard. At least a portion of both the signaling information and the content information is processed at the media gateway using a common processor. At least a portion of the content information is transmitted to a destination based on at least a portion of the signaling information.

Abstract: Described are computer-based methods and apparatuses, including computer program products, for loosely-coupled encryption functionality for operating systems. A data packet is processed through one or more internet protocol stack layers to generate a processed data packet. Encryption information is determined that includes parameters for encrypting and decrypting data packets transmitted between the first computing device and the remote computer. A message comprising data indicative of the encryption information is transmitted to a second computing device, wherein an operating system being executed is unaware of a security nature of the transmission. A bypass encryption routine is executed to generate a unencrypted data packet, wherein the bypass encryption routine does not encrypt the processed data packet. The unencrypted data packet is transmitted to the second computing device.

Abstract: Described are computer-based methods and apparatuses, including computer program products, for loosely-coupled encryption functionality for operating systems. A data packet is processed through one or more internet protocol stack layers to generate a processed data packet. Modified encryption information is determined that does not comprise a desired security policy for the data packet and comprises null parameter(s) and is based on encryption information that comprises the desired security policy. A message comprising data indicative of the encryption information is transmitted. An operating system is unaware of a security nature of the transmission. A null-encryption routine is executed to generate an unencrypted data packet, wherein the null-encryption routine does not encrypt the processed data packet. The unencrypted data packet is transmitted to the second computing device.

Abstract: Described are computer-based methods and apparatuses, including computer program products, for load balancing among VOIP servers. An identity table includes an identity entry for a plurality of servers, each identity entry comprising a FQDN and load balancing information. A persistence table stores persistence entries indicative of a persistent connection between a client and a server. Updated load balancing information determined by the first server is received. The identity table is updated based on the updated load balancing information. A service request is received from a client. If the client is not associated with a persistence entry, a second server is selected from the plurality of servers based on load balancing information for each identity entry in the identity table. A persistence entry is stored indicative of a persistent connection between the client and the selected second server, the persistence entry comprising a FQDN and an identifier for the client.

Abstract: Described are computer-based methods and apparatuses, including computer program products, for testing network elements in a communication network. A record file is received, comprising one or more record file elements, each record file element including data indicative of a request received by a network element in a network during normal operation. A virtual client is created for each of one or more identified sources. One or more regenerated requests are generated, each of the one or more regenerated requests being generated based on data in a corresponding record file element from the one or more record file elements. For each of the one or more regenerated requests, the virtual client associated with the regenerated request transmits the regenerated request to a subject network element to test the subject network element, wherein the one or more regenerated requests simulate requests received by the network element during normal operation.

Abstract: A system and method for maintaining service availability for an Internet Protocol Multimedia Subsystem (IMS) network is provided. A primary network receives a request from one or more subscribers of the primary network to place a call. The primary network registers the one or more subscribers. The primary network assigns an identifier to data of the one or more registered subscribers for the registration. The identifier associates the one or more subscribers with the primary network upon migration of the one or more subscribers from the primary network to the secondary network. The secondary network monitors the primary network to detect an event on the primary network. The secondary network migrates the one or more subscribers from the secondary network to the primary network based on the identifier and after initiation of the migration in response to the occurrence of the event on the primary network.

Abstract: Methods and apparatuses, including computer program products, are described for transparent recovery of transport connections. The method includes collecting a state associated with a first connection between a first server and a remote server via a first network socket and transmitting the state from a first networking module to a second networking module. The method includes storing the state, opening a second network socket based on failure of the first networking module, intercepting outbound packets associated with a request to initiate a second connection between the first server and the remote server via the second socket, modifying the intercepted packets based on the state, and transmitting the modified packets to the remote server to elicit an acknowledgement to maintain the first connection. The method includes receiving packets associated with the acknowledgment from the remote server, and modifying the received packets to acknowledge the request to initiate the second connection.

Abstract: A method for control of real-time traffic entry of a managed packet network includes the step of receiving, from a border element processor, a first message indicative of a new active registration request associated with a client. The border element processor is one of a plurality of border element processors at an edge of a managed packet network controlling packets (e.g., relating to real-time multimedia traffic) entering the managed packet network. The method also includes the step of load balancing, by a load balancing engine, the new active registration request across the plurality of border element processors and assigning the client to a designated border element processor. A second message is generated in response to the new activation registration request. The second message includes a parameter identifying the designated border element processor assigned to the client.

Abstract: Described are computer-based methods and apparatuses, including computer program products, for identifying attackers on a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.

Abstract: Methods and apparatuses, including computer program products, are described for policing and prioritizing of data services. Each packet in a data stream is directed to a substream policer of a plurality of substream policers. Each packet is allowed through the substream policer based on rate parameters associated with the substream policer. The packets allowed by the substream policer are directed to an aggregate policer. Each packet allowed through the substream policer is allowed through the aggregate policer based on rate parameters associated with the aggregate policer. The substream policer and the aggregate policer are charged for each packet allowed by both the substream policer and the aggregate policer. The substream policer and the aggregate policer are not charged for each packet not allowed by either the substream policer or the aggregate policer.

Abstract: Described are a method, a computer program product and apparatus for implementing signaling gateway redundancy. A signaling network management message is received, at a first signaling gateway, from a first signaling network. Routing control information associated with the first signaling gateway is updated based on the signaling network management message. A first SIGTRAN protocol signaling network management message is transmitted, from the first signaling gateway, to a first application server on a first IP network. The first SIGTRAN protocol signaling network management message is based on the signaling network management message. A second SIGTRAN protocol signaling network management message is transmitted, from the first signaling gateway, to a second signaling gateway on a second IP network. The second SIGTRAN protocol signaling network management message is based on the signaling network management message. The second signaling gateway is mated with the first signaling gateway.

Abstract: Methods and apparatuses, including computer program products, are described for establishing M3UA linksets and routes. The method includes generating, at a signaling gateway, a linkset that includes a plurality of M3UA links between two or more IP hosts on the signaling gateway and a single IP host on a signal transfer point. The method also includes configuring, at the signaling gateway, a route based on the linkset to direct messages from the signaling gateway to a single destination node.

Abstract: Described are a method, a computer program product and apparatus for implementing signaling gateway redundancy. A first SIGTRAN protocol application server process maintenance message is received, at a first signaling gateway, from a first application server process. Connection control information associated with one or more connections to the first signaling gateway is updated based on the first SIGTRAN protocol application server process maintenance message. A second SIGTRAN protocol application server process maintenance message is transmitted, from the first signaling gateway, to a second signaling gateway. The second SIGTRAN protocol application server process maintenance message is based on the first SIGTRAN protocol application server process maintenance message. The second signaling gateway is mated with the first signaling gateway.

Abstract: Methods and apparatuses, including computer program products, are described for priority policing of requests with deferred determination of priority level. The method includes directing each packet in a data stream to a policer. The method also includes determining whether to allow, reject, or conditionally pass each packet through the policer based on parameters associated with the policer. The method also includes directing each packet conditionally passed by the policer to a classifier associated with the policer. The method also includes determining, by the classifier, a priority value of each packet received from the policer. The method also includes directing, by the classifier, each prioritized packet to the policer. The method also includes determining whether to allow or reject each prioritized packet through the policer based on the priority value.

Abstract: A system and method automates and simplifies tasks associated with setting up a user self-activating network-based service. A configurable input engine is configured to define the service. The service may, for example, use a plurality of networking devices and/or computing devices. After the service is defined, an offer of the service is published to a user. The offer includes values of commercial terms and/or values of configuration parameters associated with the offer. Upon receiving an acceptance of the offer from the user, the configurable input engine automatically generates activations for the devices to be used by the service. The activations are sent to policy distribution points (PDPs) where the activations are translated into device-specific instructions. The device-specific instructions are in turn sent to the devices (networking devices and/or computing devices) to be configured. The device-specific instructions configure the devices, thereby automatically setting up the service for the user.

Abstract: Described are methods and apparatus, including computer program products, for active switch replacement using a single point code. Signaling data associated with the point code is received via signaling links associated with the active switch. The signaling data is routed to a replacement switch if the signaling data is associated with voice trunks associated with the replacement switch. The signaling data is routed to the active switch if the signaling data is associated with voice trunks associated with the active switch.

Abstract: Described are methods and apparatuses, including computer program products, for limiting server overload via client control. A first set of a plurality of requests are transmitted to a server at a first transmission rate during a first period of time. The first transmission rate is limited to be less than or equal to a first transmission limit rate. An overload value is determined based on whether at least two or more requests of the first set of requests for service satisfy an overload criterion. A second transmission limit rate is determined based on the overload value and the first transmission limit rate. A second set of a plurality of requests is transmitted to the server at a second transmission rate during a second period of time. The second transmission rate is limited to be less than or equal to the second transmission limit rate.