Abstract: A method of classifying data packets based on general property ranges. An interval tree is constructed to represent the applicability of rules to non-overlapping ranges of a data classification property. The interval tree can be a binary tree such as a balanced binary tree or red-black tree. To determine which rules apply to a data packet, the data packet property, for example a field in a data packet header, is compared to the intervals in the tree to find a match.

Abstract: A method and a system for establishing network tunnels are disclosed. In one embodiment, a transport action is identified in response to packet parameters. Once the transport action is determined, the transport action is pushed onto a pending stack. When a tunnel action is, subsequently, identified in response to the packet parameters, the tunnel action is also pushed onto the pending stack. Upon completion of rule evaluation, at least one tunnel is established according to a tunnel action stored in the pending stack. The action stored at the top of the pending stack is performed first and the action stored at the bottom of the pending stack is performed last.

Abstract: A method of determining a maximum packet size for data packets sent along a network path. A sending computer sends a packet to a receiving computer through a sending interface. The packet is fragmented during transfer to a receiving interface. The fragments are analyzed at the receiving interface and their size determined. The size of a fragment is compared to a pre-determined maximum packet size, and in response to the comparison, the maximum packet size is changed. The change is then reported to the sending interface and stored in a memory. Subsequent communications from the sending interface to the receiving interface are sent in packets of the size stored in the memory. Because the maximum packet size of a network path can change over time, test packets can be sent periodically to determine the maximum packet size.

Abstract: A system and method for determining the source, on a network, of unwanted messages generated by a malicious agent, toward a target device such as a web server. The malicious agent directs one or more computers on a sub network to direct a flood of communications toward the server on a second sub network designed to substantially reduce the ability of the server to respond to other communications. Messages passing through points on a path between the malicious agent computers and the server are monitored for indicia of messages uncharacteristic of normal network communication. The first point along the path that the unwanted messages pass through is identified. A network device at that point is instructed to block portion of communications passing through that point.

Abstract: The time taken for connection establishment is monitored to aid in selecting load distribution among nodes in a data delivery system, such as a server cluster. The failure of a node to respond to a connection request may be used to identify a crashed node. The number of connections being maintained and the amount of bandwidth being consumed may also be monitored for each node, and this information may be used to determine when a node should be removed from contention for new connection requests and when a node should be reinstated to receive new connection requests.

Abstract: Communicating over a network includes establishing a communication path between a mobile-device in a first communication area and a server through a home-agent, and maintaining the communication path through the home agent when the mobile-device moves to a second-communication-area.