Abstract: A system and method is directed to managing network communications and improving network security. In a communication protocol, an improved method of generating a value that encodes information received in an incoming message, and a corresponding way of validating an incoming message with an encoded value, improves network security. A technique for directing a network device to delay communications includes sending an instruction designating an initial window size of zero to the device. Another technique uses a TCP fast retransmit protocol. The techniques can be used to provide layer four switching, change to layer seven switching when desired, and then change back to layer four switching to improve security in a layer four switching device. Levels of trust can also be used to selectively perform aspects of the invention.

Abstract: Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD) to discover devices, roles, applications, and application dependencies present on the monitored networks. A NMD may monitor network packets that may be flowing on monitored networks. Using OSI L2-to-L3 data the NMD may determine the devices that may be on the monitored networks. Also, the NMD may determine the network protocols that may be in use on the monitored networks. Further, the NMD may reassemble monitored network packets into transactions based on knowledge regarding the network protocols are in use on the monitored networks. The NMD may perform various tests to determine the applications that may be running on the discovered devices. Some of the tests used by the NMD may examine OSI L4-L7 data that may be included in the transactions.

Abstract: Embodiments are directed towards receiving packets communicated over at least one network, determining layer 3 header information for the received packets, normalizing the determined layer 3 header information for each received packet, employing a determined value based on the normalized layer 3 header information to detect each received packet that is a duplicate, disregarding duplicate packets, and enabling monitoring and analysis of at least selected flows that include packets that are determined to be non-duplicated. Also, if the determined layer 3 header information indicates that the received packet is fragmented, that packet is de-fragmented at least in accordance with a fragment offset. Additionally, normalization may include at least one of masking at least one value in the layer 3 header information, or rolling back changes in the layer 3 header information.

Abstract: Embodiments are directed towards resynchronizing the processing of a monitored flow based on hole detection. A network monitoring device (NMD) may be employed to passively monitor flows of packets for a session between endpoints. The NMD may receive copies of the monitored flow and perform processes on the monitored flow. In some situations, some copies of packets may not be fully processed by the NMD, creating a hole in the processing. If a hole is detected in the monitored flow and the processing of the monitored flow is desynchronized, then the NMD may suspend processing until it is resynchronized or for a remainder of the session. If the processing is desynchronized, then the NMD may resynchronize the processing by resuming the processing of the monitored flow at a downstream position of the monitored flow based on the detected hole.

Abstract: A system, apparatus, and method are directed to managing an ordered page flow browsing of a website. As a request is received for a webpage on the website, a referrer is examined. If the referrer indicates that the request is from another website, the request may be redirected to a pre-selected webpage on the website. In addition, a cookie may be generated that includes, in part, the request and a secret. The request and rotating secret may also be encrypted. The cookie may then be provided along with a response to the request. When another request is received with the cookie, the cookie may be compared, in part, with the referrer and the secret to determine if the request is from an ordered page within the website. If it is not, the request may be redirected to the pre-selected webpage, thereby enforcing orderly page flow browsing.

Abstract: A system, apparatus, and method for managing TCP over TCP communications using multiple TCP network connections. A plurality of tunneled network connections may be established between network devices. The network devices may employ one of the tunneled network connections over which to establish a plurality of application sessions. If congestion is detected on the employed tunneled network connection that exceeds a threshold, then a reset flag may be sent to abort that tunneled network connection. At least some of the application sessions are also transferred to another one of plurality of tunneled network connections, without terminating the moved application sessions. In one embodiment, at least one more tunneled network connection may be established between the network devices.

Abstract: Embodiments are directed towards resynchronizing the processing of a monitored flow based on hole detection. A network monitoring device (NMD) may be employed to passively monitor flows of packets for a session between endpoints. The NMD may receive copies of the monitored flow and perform processes on the monitored flow. In some situations, some copies of packets may not be fully processed by the NMD, creating a hole in the processing. If a hole is detected in the monitored flow and the processing of the monitored flow is desynchronized, then the NMD may suspend processing until it is resynchronized or for a remainder of the session. If the processing is desynchronized, then the NMD may resynchronize the processing by resuming the processing of the monitored flow at a downstream position of the monitored flow based on the detected hole.

Abstract: Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD) to discover devices, roles, applications, and application dependencies present on the monitored networks. A NMD may monitor network packets that may be flowing on monitored networks. Using OSI L2-to-L3 data the NMD may determine the devices that may be on the monitored networks. Also, the NMD may determine the network protocols that may be in use on the monitored networks. Further, the NMD may reassemble monitored network packets into transactions based on knowledge regarding the network protocols are in use on the monitored networks. The NMD may perform various tests to determine the applications that may be running on the discovered devices. Some of the tests used by the NMD may examine OSI L4-L7 data that may be included in the transactions.

Abstract: Embodiments are directed towards receiving packets communicated over at least one network, determining layer 3 header information for the received packets, normalizing the determined layer 3 header information for each received packet, employing a determined value based on the normalized layer 3 header information to detect each received packet that is a duplicate, disregarding duplicate packets, and enabling monitoring and analysis of at least selected flows that include packets that are determined to be non-duplicated. Also, if the determined layer 3 header information indicates that the received packet is fragmented, that packet is de-fragmented at least in accordance with a fragment offset. Additionally, normalization may include at least one of masking at least one value in the layer 3 header information, or rolling back changes in the layer 3 header information.

Abstract: Embodiments are directed towards resynchronizing the processing of a monitored flow based on hole detection. A network monitoring device (NMD) may be employed to passively monitor flows of packets for a session between endpoints. The NMD may receive copies of the monitored flow and perform processes on the monitored flow. In some situations, some copies of packets may not be fully processed by the NMD, creating a hole in the processing. If a hole is detected in the monitored flow and the processing of the monitored flow is desynchronized, then the NMD may suspend processing until it is resynchronized or for a remainder of the session. If the processing is desynchronized, then the NMD may resynchronize the processing by resuming the processing of the monitored flow at a downstream position of the monitored flow based on the detected hole.

Abstract: A method, system, and apparatus are directed towards enabling access to payload by a third-party sent over an SSL session. The third-party may be a proxy situated between a client and a server. SSL handshake messages are sent between the client and the server to establish the SSL connection. As the SSL handshake messages are routed through the proxy, the proxy may extract data. In addition, one of the client or the server may send another message within, or out-of-band to, the series of SSL handshake message directly to the proxy. The other SSL message may include secret data that the proxy may use to generate a session key for the SSL connection. With the session key, the proxy may receive SSL messages over the SSL connection, modify and/or transpose the payload within the received SSL messages, and/or terminate the SSL connection at the proxy.

Abstract: A method, apparatus, and system are directed toward managing network traffic over a plurality of Open Systems Interconnection (OSI) Level 2 switch ports. A network traffic is received over the plurality of OSI Level 2 switch ports. At least a part of the network traffic is categorized into a flow. The categorization may be based on a IP address, an OSI Level 4 port, a protocol type, a Virtual Local Area Network (VLAN) number, or the like, associated with the network traffic. One of the plurality of OSI Level 2 switch ports is selected based on a load-balancing metric. The load-balancing metric may be a priority of the flow, a congestion characteristic, a prediction of a load usage for the flow, a combination thereof, or the like. A frame associated with the flow is sent over the selected one of the plurality of OSI Level 2 switch ports.

Abstract: A system, apparatus, and method are directed towards managing traffic over a network by imposing temporal delays in acknowledgments (ACKs). A Traffic Management Device (TMD), interposed between two network session end-points monitors a buffer of relayed packets. If the contents of the buffer exceed a threshold value, delays are imposed on sending of acknowledgements. If the buffer contents exceed the threshold, and the buffer's contents are increasing, the delays may be increased. If the buffer's contents are about at steady state, the acknowledgement delays may be decreased, or maintained at a current delay status. In one embodiment, if the sender is sending packets at a rate above a receiver's ability to receive the packets, and the sender appears not to be decreasing its rate of transmission, an explicit congestion notification echo (ECE) may be sent to the sender.

Abstract: Embodiments are directed to monitoring communication over a network using a network monitoring device (NMD) to discover devices, roles, applications, and application dependencies present on the monitored networks. A NMD may monitor network packets that may be flowing on monitored networks. Using OSI L2-to-L3 data the NMD may determine the devices that may be on the monitored networks. Also, the NMD may determine the network protocols that may be in use on the monitored networks. Further, the NMD may reassemble monitored network packets into transactions based on knowledge regarding the network protocols are in use on the monitored networks. The NMD may perform various tests to determine the applications that may be running on the discovered devices. Some of the tests used by the NMD may examine OSI L4-L7 data that may be included in the transactions.

Abstract: A method, system, and apparatus are directed towards dynamically managing certificates for a virtual host server. A certificate may be uniquely associated with each of the websites hosted on the virtual host. In one embodiment, the certificate is an X.509 certificate. Also, the certificate may be managed by a network device residing between a client and the virtual host server. When the client that is browsing one of the hosted websites, the network device may store a persistence record that maps client information to the hosted website. The client may employ an SSL protocol to establish a secure connection. When a certificate associated with the hosted website is to be provided, the network device uses the persistence record to determine which hosted website the client was browsing, selects, and provides the appropriate certificate to the client.

Abstract: Embodiments are directed towards receiving packets communicated over at least one network, determining layer 3 header information for the received packets, normalizing the determined layer 3 header information for each received packet, employing a determined value based on the normalized layer 3 header information to detect each received packet that is a duplicate, disregarding duplicate packets, and enabling monitoring and analysis of at least selected flows that include packets that are determined to be non-duplicated. Also, if the determined layer 3 header information indicates that the received packet is fragmented, that packet is de-fragmented at least in accordance with a fragment offset. Additionally, normalization may include at least one of masking at least one value in the layer 3 header information, or rolling back changes in the layer 3 header information.

Abstract: A system, apparatus, and method are directed towards selectively combining data into a packet to modify a number of packets transmitted over a network based on a detection of a transaction boundary. If it is determined to concatenate the data, such concatenation may continue until an acknowledgement (ACK) is received, or a predetermined amount of data is concatenated in the packet, or a transaction boundary is detected. If at least one of these conditions is satisfied, concatenation may be inhibited, and the packet may be sent. Concatenation is then re-enabled. In one embodiment, Nagle's algorithm is used for concatenating data into a packet. In one embodiment, an ACK may be sent based on a write completion indicator included within a packet. Receipt of the ACK may disable concatenation.

Abstract: A system, apparatus, and method are directed towards selectively combining data into a packet to modify a number of packets transmitted over a network based on a detection of a transaction boundary. If it is determined to concatenate the data, such concatenation may continue until an acknowledgement (ACK) is received, or a predetermined amount of data is concatenated in the packet, or a transaction boundary is detected. If at least one of these conditions is satisfied, concatenation may be inhibited, and the packet may be sent. Concatenation is then re-enabled. In one embodiment, Nagle's algorithm is used for concatenating data into a packet. In one embodiment, an ACK may be sent based on a write completion indicator included within a packet. Receipt of the ACK may disable concatenation.

Abstract: A system, apparatus, and method are directed towards selectively combining data into a packet to modify a number of packets transmitted over a network based on a detection of a transaction boundary. If it is determined to concatenate the data, such concatenation may continue until an acknowledgement (ACK) is received, or a predetermined amount of data is concatenated in the packet, or a transaction boundary is detected. If at least one of these conditions is satisfied, concatenation may be inhibited, and the packet may be sent. Concatenation is then re-enabled. In one embodiment, Nagle's algorithm is used for concatenating data into a packet. In one embodiment, an ACK may be sent based on a write completion indicator included within a packet. Receipt of the ACK may disable concatenation.

Abstract: A system, apparatus, and method selectively provides content compression to a client based, in part, on whether the network connection from the client is determined to be a high latency, low-bandwidth connection. The present invention gathers one or more network metrics associated with the connection from the client. In one embodiment, the metrics include estimated TCP metrics, including smoothed round trip time, maximum segment size (MSS), and bandwidth delay product (BWDP). These estimated network metrics are employed to make an application layer decision of whether the client connection is a high latency, low-bandwidth connection. If it is, then content may be selectively compressed virtually on the fly for transfer over the network connection. In one embodiment, the selective compression uses a content encoding compression feature of the HTTP protocol standard.