Abstract: A process and system for flexibly switching connections of data packet flows between nodes of data processing system networks by dividing data packets into cells and logically linking these cells on multiple queues of linked pointer lists.

Abstract: A network device for interconnecting computer networks, the device including a bridge having a plurality of ports through which network communications pass to and from the bridge, the bridge also including a first interface enabling a user to partition the plurality of bridge ports into a plurality of groups, wherein each group represents a different virtual network, wherein the bridge treats all ports within a given group as part of the virtual network corresponding to that group and the bridge isolates the virtual networks from each other, whereby any communications received at a first port of the bridge are directly sent by the bridge to another bridge port only if the other bridge port and the first bridge port are part of the same group.

Abstract: A process and system for switching connections of data packet flows between nodes of data processing system networks operating on diverse protocols according to the application layer information on the data packets. The process retrieves and hashes the header information to from an index into memory where a flow tag pointer is stored. The flow tag points to flow switching information that directs the forwarding of the packet. The switching information is sent along with the packet data to direct the forwarding state information about the flow is updated in the flow switching information. The hash function includes a multiplication and division by polynomials forming a hash result and a signature result. Both hash and signature are used to ensure that the information retrieved is valid. If invalid, The pre hashed header information is parsed to determine the forwarding information. This forwarding information is stored for later use and the appropriate flow tag pointer is stored in the hash result index.

Abstract: In a data communication switch, process and apparatus for tracking the number of data bytes associated with data flow that is part of a session and automatically lowering the priority given to the transmission of the remainder of a flow once a certain threshold has been reached that indicates that the flow is part of a bulk e-mail or other bulk file transfer.

Abstract: A network switch has a plurality of mirror ports to which data is copied for purposes such as networking monitoring. Data flows are identified and copied to an appropriate mirror port in response to the type of flow, a mirroring policy set up by a network administrator, and a distribution mechanism. A monitoring device attached to each mirror port is able to monitor specific types of traffic. Because the data flows are distributed among a plurality of mirror ports and monitoring devices, the ports and devices are less likely to overflow and therefore are more likely to be able handle the copied data without dropping data packets. The mirror ports are collected into groups of such ports. A given port may only be a member of a single group at one time. The mirroring policy must identify the group to which a particular type of flow is copied.

Abstract: A process and system for switching connections of data packet flows between nodes of data processing system networks operating on diverse protocols according to the application layer information on the data packets.

Abstract: A network device for interconnecting computer networks, the device including a bridge having a plurality of ports through which network communications pass to and from the bridge, the bridge also including a first interface enabling a user to partition the plurality of bridge ports into a plurality of groups, wherein each group represents a different virtual network, wherein the bridge treats all ports within a given group as part of the virtual network corresponding to that group and the bridge isolates said virtual networks from each other, whereby any communications received at a first port of the bridge are directly sent by the bridge to another bridge port only if the other bridge port and the first bridge port are part of the same group.

Abstract: A way of doing source address and destination address lookups is described, as may be used in a packet data communication system. A way of searching a relatively large database is described, using a combination of programmable hash algorithms, binary search algorithms, and a small content-addressable memory (CAM). The technique is efficient in space, time and cost, compared to prior methods. For example, prior methods using conventional binary reads may have used thirteen reads, whereas this technique requires on average two reads, with a worst case of four reads.

Abstract: A technique for establishing and maintaining full duplex communication between two stations connected to a token ring network, without physically reconfiguring the station connections or otherwise disturbing the network. Each station continually performs a two node test to ascertain whether there are only two active stations on the network, and updates a two node flag that indicates whether or only two active stations are present. The two node test uses both upstream neighbor and downstream neighbor addresses to update the two node flag, and requires validation of either one of these addresses if the other one of them appears to have changed since the previous observation. A concurrently running full duplex control process uses the two node flag and other conditions to decide whether to initiate or continue transition to full duplex mode.

Abstract: A packet data communication network employs a local switch, router or bridge device functioning to transfer packets between segments of a larger network. When packets enter this device, an address translation is performed to generate local source and destination addresses which are much shorter than the globally-unique addresses contained in the packet as dictated by the protocol. These local addresses are inserted in a header that is added to the packet, in addition to any header already contained in the packet. This added header travels with the packet through the local switch, router or bridge device, but then is stripped off before the packet is sent out onto another network segment. The added header may also contain other information, such as a local name for the source and destination segment (link), as well as status information that is locally useful, but not part of the packet protocol and not necessary for transmission with the packet throughout the network.

Abstract: A technique for establishing and maintaining full duplex communication between two stations connected to a token ring network, without physically reconfiguring the station connections or otherwise disturbing the network. In an auto-configuration full duplex mode of operation, each station ascertains whether there are only two active stations on the network and, if so, performs an exchange of frames with the other station to establish full duplex communication. One way to ascertain whether only two stations are active is for each station to transmit periodically a neighbor information frame, which contains the identities of the source station and the source station's nearest upstream neighbor. Once established, full duplex communication can proceed at a greater bandwidth than communication in a token ring network, and without latency delays and distance limitations associated with token ring networks.

Abstract: Cryptographic apparatus, and a related method for its operation, for in-line encryption and decryption of data packets transmitted in a communication network. A full-duplex cryptographic processor is positioned between two in-line processing entities of a network architecture. For example, in a fiber distributed data interface (FDDI) network, the processor is positioned between a media access control (MAC) sublayer and a ring memory controller (RMC). Incoming information packets are analyzed to decide whether or not they contain encrypted data and, if they do, are subject to decryption before forwarding. Outbound information packets have their data portions encrypted if called for, and are usually forwarded toward the network communication medium. Cryptographic processing in both directions is performed in real time as each packet is streamed through the processor.

Abstract: A technique for establishing and maintaining full duplex communication between two stations connected to a token ring network, without physically reconfiguring the station connections or otherwise disturbing the network. In an auto-configuration full duplex mode of operation, each station ascertains whether there are only two active stations on the network and, if so, performs an exchange of frames with the other station to establish full duplex communication. One way to ascertain whether only two stations are active is for each station to transmit periodically a neighbor information frame, which contains the indentities of the source station and the source station's nearest upstream neighbor. Once established, full duplex communication can proceed at a greater bandwidth than communication in a token ring network, and without latency delays and distance limitations associated with token ring networks.

Abstract: A method and related cryptographic processing apparatus for handling information packets that are to be cryptographically processed prior to transmission onto a communication network, or that are to be locally cryptographically processed and looped back to a node processor. A special cryptographic preamble is included in each information packet that is to be subject to cryptographic processing. The cryptographic preamble contains an offset value pointing to the starting location of information that is to be processed, and completely defines the type of cryptographic processing to be performed. The cryptographic processor can then perform the processing as specified in the preamble without regard to a specific protocol. If the packet is to be transmitted onto the network, the preamble is stripped from the packet after cryptographic processing, so that the formats of packets transmitted onto the network will be unaffected by the preamble.