Abstract: An integrated circuit monitors the most active traffic flow rates on a communications network by using a leaky bucket model having a variable fill rate. As a switch receives packets, the packet identifications are sampled. A sampled packet identification is compared to record identifications in a table of identifications. If the sampled and record identifications match, an activity value for the packet identification is increased by an amount inversely proportional to an activity value associated with the record identification. If the sampled and record identifications do not match, the activity value is decreased. Record identifications are removed from the table when the activity value decreases to a specified level. New sampled identifications are added to the table if empty records exist.

Abstract: The method can be implemented on a processor executing software instructions stored in memory. In one embodiment of the invention, the method includes receiving an Ethernet frame, wherein the Ethernet frame comprises an IP datagram, wherein the IP datagram comprises an IP header and an IP payload, wherein the IP payload comprises a User Datagram Protocol (UDP) header. When the Ethernet frame is received, a length in bytes of the IP payload of the IP datagram is calculated.

Abstract: Disclosed is a method and apparatus for checking link layer protocol frames such as Ethernet frames. The method can be implemented on a processor executing software instructions stored in memory. In one embodiment of the invention, the method includes receiving an Ethernet frame, and counting data bytes of the Ethernet frame to generate a total number of counted bytes. The total number of counted bytes can be used to calculate a data length of a datagram of the Ethernet frame. Once calculated, the datagram data length can be compared to a predetermined value. If the datagram length does not fall within an acceptable range of the predetermined value, the Ethernet frame may be dropped so that the Ethernet frame does not reach its final destination.

Abstract: The method can be implemented on a processor executing software instructions stored in memory. In one embodiment of the invention, the method includes receiving an Ethernet frame, wherein the Ethernet frame comprises an IP datagram, wherein the IP datagram comprises an IP header and an IP payload, wherein the IP payload comprises a User Datagram Protocol (UDP) header. When the Ethernet frame is received, a length in bytes of the IP payload of the IP datagram is calculated.

Abstract: The method can be implemented on a processor executing software instructions stored in memory. In one embodiment of the invention, the method includes receiving an Ethernet frame, wherein the Ethernet frame comprises a Transmission Control Protocol (TCP) header, wherein the TCP header comprises a TCP header length value. When the Ethernet frame is received, the TCP header length value is compared to a predetermined value.

Abstract: An integrated circuit monitors the most active traffic flow rates on a communications network by using a leaky bucket model having a variable fill rate. As a switch receives packets, the packet identifications are sampled. A sampled packet identification is compared to record identifications in a table of identifications. If the sampled and record identifications match, an activity value for the packet identification is increased by an amount inversely proportional to an activity value associated with the record identification. If the sampled and record identifications do not match, the activity value is decreased. Record identifications are removed from the table when the activity value decreases to a specified level. New sampled identifications are added to the table if empty records exist.