Abstract: Techniques are provided herein for receiving information at a device in a network indicating a load level for one or more server load balancers that are configured to manage network traffic load for a plurality of servers. The information represents an aggregate load across the plurality of servers. A determination is made as to whether the load level for one or more of the server load balancers exceeds a predetermined threshold. In response to determining that the load level for one or more of the server load balancers exceeds the predetermined threshold, an additional load balancer is activated that is configured to manage network traffic load for the plurality of servers. In response to determining that the load level for one or more of the server load balancers does not exceed the predetermined threshold, an additional load balancer is deactivated that was configured to manage network traffic load for the plurality of servers.

Abstract: Techniques are provided herein for receiving information at a device in a network indicating a load level for one or more server load balancers that are configured to manage network traffic load for a plurality of servers. The information represents an aggregate load across the plurality of servers. A determination is made as to whether the load level for one or more of the server load balancers exceeds a predetermined threshold. In response to determining that the load level for one or more of the server load balancers exceeds the predetermined threshold, an additional load balancer is activated that is configured to manage network traffic load for the plurality of servers. In response to determining that the load level for one or more of the server load balancers does not exceed the predetermined threshold, an additional load balancer is deactivated that was configured to manage network traffic load for the plurality of servers.

Abstract: Techniques for processing an IP packet at a router that supports SS7 signaling include receiving IP routing data that associates a network link and a destination IP address for a node in a signaling network that includes a plurality of signaling nodes. When an ingress IP data packet is received, it is determined whether conditions are satisfied for locally processing an SS7 payload within the ingress IP data packet. If it is determined that conditions are satisfied for locally processing the SS7 payload, then the SS7 payload is processed locally, i.e., without sending the SS7 payload over a network link to a different node in the signaling network. If it is determined that conditions are not satisfied for locally processing the SS7 payload, then the ingress IP data packet is routed normally. These techniques allow reduced numbers of expensive STP devices and expanded routing options in a signaling network.

Abstract: Techniques for distributing control plane traffic, from an end node in a packet switched network to a cluster of service gateway nodes that host subscriber-aware application servers, include receiving a control plane message for supporting data plane traffic from a particular subscriber. A particular service gateway node is determined among the cluster of service gateway nodes based on policy-based routing (PBR) for the data plane traffic from the particular subscriber. A message based on the control plane message is sent to a control plane process on the particular service gateway node. Thereby, data plane traffic and control plane traffic from the same subscriber are directed to the same gateway node, or otherwise related gateway nodes, of the cluster of service gateway nodes. This approach allows currently-available, hardware-accelerated PBR to be used with clusters of subscriber-aware service gateways that must also monitor control plane traffic from the same subscriber.

Abstract: Techniques for responding to intrusions on a packet switched network include receiving user data at a subscriber-aware gateway server between a network access server and a content server. The user data includes subscriber identifier data that indicates a unique identifier for a particular user, network address data that indicates a network address for a host used by the particular user, NAS data that indicates an identifier for the network access server, flow list data that indicates one or more open data packet flows, and suspicious activity data. The suspicious activity data indicates a value for a property of the open data packet flows that indicates suspicious activity. It is determined whether an intrusion condition is satisfied based on the suspicious activity data. If the intrusion condition is satisfied, then the gateway responds based at least in part on user data other than the network address data.