Abstract: A structure and technique for preventing collisions using a hash table in conjunction with a CAM to identify and prevent collision of binary keys. A portion of the hash value of a binary key, which does not collide with a portion of the hash value of any other reference binary key, is used as an entry in the hash table. If two or more binary keys have identical values of the portions of the hash values, each of these binary keys are stored in their entirety, in the CAM. The key in the CAM provides a pointer to a data structure where the action associated with that binary key is stored. If the binary key is not found in the CAM, the binary key is hashed, and a specific entry in the hash table is selected using a portion of this hash value.

Abstract: A method and system for transmitting packets in a packet switching network. Packets received by a packet processor may be prioritized based on the urgency to process them. Packets that are urgent to be processed may be referred to as real-time packets. Packets that are not urgent to be processed may be referred to as non-real-time packets. Real-time packets have a higher priority to be processed than non-real-time packets. A real-time packet may either be discarded or transmitted into a real-time queue based upon its value priority, the minimum and maximum rates for that value priority and the current real-time queue congestion conditions. A non-real-time packet may either be discarded or transmitted into a non-real-time queue based upon its value priority, the minimum and maximum rates for that value priority and the current real-time and non-real-time queue congestion conditions.

Abstract: A structure and technique for preventing collisions using a hash table in conjunction with a CAM to identify and prevent collisions of binary keys. A portion of the hash value of a binary key, which does not collide with a portion of the hash value of any other reference binary key, is used as an entry in the hash table. If two or more binary keys have identical values of the portions of the hash values, each of these binary keys are stored in their entirety, in the CAM. The key in the CAM provides a pointer to a data structure where the action associated with that binary key is stored. If the binary key is not found in the CAM, the binary key is hashed, and a specific entry in the hash table is selected using a portion of this hash value.

Abstract: System and method for recording temperature on an RFID tag. A first RFID tag is attached to a container. The first RFID tag includes a temperature sensor. The container contains a multiplicity of packages. A multiplicity of second RFID tags are attached to the multiplicity of packages, respectively. The first RFID tag transmits temperature information to the multiplicity of second RFID tags. In response, the multiplicity of second RFID tags record the temperature information. Consequently, there is no need for expensive temperature sensors on the multiplicity of RFID tags on the packages. According to features of the present invention, the first RFID tag is an active RFID tag, and the multiplicity of second RFID tags are passive RFID tags. The first RFID tag also transmits other information to the multiplicity of second RFID tags to enable the second RFID tags to authenticate the temperature information.

Abstract: A method of progressive response for invoking and suspending blocking measures that defend against network anomalies such as malicious network traffic so that false positives and false negatives are minimized. When an anomaly is detected, the detector notifies protective equipment such as a firewall or a router to invoke a blocking measure. The blocking measure is maintained for an initial duration, after which it is suspended while another test for the anomaly is made. If the anomaly is no longer evident, the method returns to the state of readiness. Otherwise, a loop is executed to re-applying the blocking measure for a specified duration, then suspend the blocking measure and test again for the anomaly. If the anomaly is detected, the blocking measure is re-applied, and its duration is adapted. If the anomaly is no longer detected, the method returns to the state of readiness.

Abstract: The decision within a packet processing device to transmit a newly arriving packet into a queue to await processing or to discard the same packet is made by a flow control method and system. The flow control is updated with a constant period determined by storage and flow rate limits. The update includes comparing current queue occupancy to thresholds and also comparing present queue occupancy to previous queue occupancy. The outcome of the update is a new transmit probability value. The value is stored for the subsequent period of flow control and packets arriving during that period are subject to a transmit or discard decision that uses that value.

Abstract: A method and system for controlling a plurality of pipes in a computer network, including at least one processor for a switch, the at least one processor having a queue, the plurality of pipes utilizing the queue for transmitting traffic through the switch, wherein each pipe is assigned a priority ranking class, each class has a unique priority rank with respect to each of the other classes, the ranks ranging from a highest priority rank to a lowest priority rank. A transmission probability is calculated for each pipe responsive to its priority rank. If excess bandwidth exists for the queue, the transmission probability of each pipe is linearly increased. Alternatively, if excess bandwidth does not exist, the transmission probability for each pipe is exponentially decreased. Packets are transferred from a pipe to the queue responsive to the pipe transmission probability and priority rank.

Abstract: A method, system and computer program product for detecting the dissemination of malicious programs. The degree of randomness in the Internet Protocol (IP) destination addresses of received IP packets to be forwarded to an external network may be detected by performing a hash function on the IP destination addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets examined, then random IP destination addresses may be detected. By detecting random destination IP addresses, the dissemination of a malicious program, e.g., virus, worm program, may be detected.

Abstract: A structure and technique for preventing collisions using a hash table in conjunction with a CAM to identify and prevent collisions of binary keys. A portion of the hash value of a binary key, which does not collide with a portion of the hash value of any other reference binary key, is used as an entry in the hash table. If two or more binary keys have identical values of the portions of the hash values, each of these binary keys are stored in their entirety, in the CAM. The key in the CAM provides a pointer to a data structure where the action associated with that binary key is stored. If the binary key is not found in the CAM, the binary key is hashed, and a specific entry in the hash table is selected using a portion of this hash value.

Abstract: Novel data structures, methods and apparatus for a Software Managed Tree (SMT) which provides a mechanism to create tree structures that follow a search mechanism defined by a control point processor. The search mechanism does not require storage on the previous pointer and uses only a forward pointer along with a next bit or group of bits to test thereby reducing storage space for nodes. The search mechanism processes multiple filter rules for an application without requiring multiple searches and also allows various filter rules to be chained. Two patterns of the same length are stored in each leaf to define a range compare. A compare at the end operation is either a compare under range or a compare under mask. In a compare under range, the input key is checked to determine if it is in the range defined by the two patterns. In a compare under mask, the bits in the input key are compared with the bits in a first leaf pattern under a mask specified in a second leaf pattern.

Abstract: A method and apparatus useful in network management which makes intelligent, high speed, connection allocation decisions, overcoming difficulties encountered heretofore and providing enhanced network services. During episodes of network congestion, some connection requests for a class of service of low value and with currently a high number of existing connections may be purposefully ignored (not acknowledged with an Acknowledge (ACK) packet) so that the processing capability of a device will not become overwhelmed, causing the dropping of new connection is to note the numbers of connections of different classes relative to their service-level contracts, to ignore abundant, low-value connection requests in accordance with value policies when and only when necessary, and to insure that valuable new connection requests that conform to their contract connection rates can be intelligently accommodated.

Abstract: An intrusion event detection system, method, and program product with an enumeration of specific known benign intrusion events, and performing a vulnerability test on specific elements of the computer system for the particular known benign intrusion event. These vulnerability tests are performed at predetermined time intervals measured from a previous test or previous intrusion event of the known benign intrusion event. The predetermined time interval is increased based on various attributes, passage of time since the last intrusion event of either the specific known benign intrusion event or another known benign intrusion event, or even a an undetermined or harmful intrusion event, or the present detection of an intrusion even; or the vulnerability of a specific element in the computer system to a specific intrusion event.

Abstract: A packet network redistributes excess bandwidth for voice and data sessions applying a Quality of Service (QoS) algorithm. The network includes interacting client stations using H.323 protocol managing bit rate according to an algorithm as voice and data sessions are added or removed from the network. The client stations include codecs coupled to the network. The codecs provide voice sessions at a minimum bandwidth using a voice codec bit rate and preferred bandwidth using another voice codec bit rate. A first algorithm applies the QoS algorithm allocating bandwidth between interacting client stations after the addition of a new voice or data session when there is insufficient bandwidth for the new session to receive preferred bandwidth. A second algorithm is applied when a voice or data session is removed from the interacting client stations. If any session is allocated minimum bandwidth the QoS increases a voice session at minimum bandwidth to preferred bandwidth if excess bandwidth is available.

Abstract: A receiver may be adapted to prevent overflow or underflow of its data storage by generating a transmit rate value as a feedback to the sender. Speed adjustments are performed periodically with a fixed time period denoted by Dt. Transmission rates are explicitly 0, Max/2, and Max. The receiver queue is itself drained at a rate R that at any time satisfies 0<=R<=Max. The level of occupancy of the receiver storage queue is denoted by Q. The maximum capacity of the receiving queue is designated Qmax, so at any time, 0<=Q<=Qmax. Two thresholds T1 and T2 (with 0<T1<T2<Qmax) of levels of the receiver queue value Q are determined. A transmit rate is then determined by the level of the receiver queue Q compared to the thresholds. The transmit rate feedback value achieves the desired goal of avoiding overflow and, once the value of Q has been positive at least once, avoiding underflow.

Abstract: A codec detects congestion in a packet network and responds via a session control protocol to re-negotiate codec-type and/or parameters with the receiving codec to reduce bit rate for supporting a session. Once the connection and session are established, encoded packets start flowing between the two codecs. A control entity sends and receives network congestion control packets periodically in the session. The congestion control packets provide a “heartbeat” signal to the receiving codec. When the network is not congested, all “heartbeat” packets will be passed through the network As network congestion increases, routers within the network discard excess packets to prevent network failure. The codecs respond to the missing packets by slowing down the bit rate or proceeding to renegotiate a lower bit rate via the session control protocol. If there are no missing packets, the codecs detect if the session is operating at the highest bit rate, and if not, re-negotiate a higher bit rate.

Abstract: A method and system for providing a path for a new flow between a source node and a destination node in a network is disclosed. The network has a plurality of nodes and a plurality of links between the nodes. The nodes include the source node and the destination node. Each of the links is capable of including a plurality of existing flows and has a capacity. Each of the existing flows has a minimum guaranteed bandwidth. The method and system include determining a benefit for each link of a portion of the plurality of links coupled with a node of the plurality of nodes. The benefit is determined based on the capacity of the link and the minimum guaranteed bandwidth for a portion of the plurality of existing flows that is through the link, the node being a part of the path. The method and system also include selecting a link of the portion of the plurality of links to be part of the path.

Abstract: A method and system for performing a pattern match search for a data string having a plurality of characters separated by delimiters. In accordance with the method of the present invention a search key is constructed by generating a full match search increment comprising the binary representation of a data string element, wherein the data string element comprises all characters between a pair of delimiters. The search key is completed by concatenating a pattern search prefix to the full match search increment, wherein the pattern search prefix is a cumulative pattern search result of each previous full match search increment. A full match search is then performed within a lookup table utilizing the search key. In response to finding a matching pattern within the lookup table, the process returns to constructing a next search key. In response to not finding a matching pattern, the previous full match search result is utilized to process the data string.

Abstract: A packet network congestion control system using a biased packet discard policy includes a plurality of end points having codecs operating in a framework, e.g. ITU-T H.323 protocol to establish a communication session. The protocol enables the codecs to negotiate codec type and associated parameters. Once a connection and session are established, compressed voice and data packets start flowing between the two end points. A control entity supplies congestion control packets periodically. The control packets provide a “heartbeat” signal to the codec at the other end of the session. Each codec receiver uses the “heartbeat” signal as an indication of network congestion. As network congestion increases, routers within the network discard excess packets to prevent network failure. The network discards all packets classified as congestion control packets whenever a flow control mechanism detects congestion or a trend toward congestion.

Abstract: A method and system for determining whether to enforce a plurality of filter rules for a packet including a key in a computer network is disclosed. Each of the plurality of filter rules has a priority. The method and system include accumulating statistics for each of the plurality of filter rules. The statistics indicate a frequency of enforcement for each of the plurality of filter rules. The method and system also include placing the plurality of filter rules in an order for testing against the key. The order is based on the frequency of each filter rule of the portion of the plurality of filter rules. Consequently, more frequently enforced filter rules may be tested first.

Abstract: Packetized voice, video, and data traffic (data frames) are received in a communication traffic sorter. The data frames have a dispatch priority corresponding to their transmission characteristics (flow) and a quality of service parameters. The communication traffic sorter analyzes information in data packets within each data frame and determines an optimum flow for the data frames. A data frame is assigned to a selected queue based on an analysis of the information in its data packets. A data frame may also be assigned to a queue based on a prior analysis of a data frame with like transmission characteristics. Results of analysis are stored and indexed to facilitate processing of subsequent data frames. The network access sorter has circuits to un-pack and re-pack the data frame, when called for, to allow user transmitted data to be processed to create a modified data frame.