Abstract: Systems, methods, and non-transitory computer readable media for storing and processing metadata corresponding to files are presented. The system comprises first, second, and third computing nodes. The computing nodes comprise a plurality of slices of a metadata database that is separate and independent from file storage, and each slice is configured to store metadata. The computing nodes further comprise a slice route table that indicates primary and secondary locations of each unique slice in the plurality of slices. The slice route table comprises a plurality of entries, each of which comprise a slice number corresponding to a slice in the plurality of slices of the metadata database, a primary computing node number corresponding to a primary computing node that comprises the slice and corresponds to the primary location, and a secondary computing node number corresponding to a secondary computing node that comprises the slice and corresponds to the secondary location.

Abstract: Systems and methods for migrating metadata are presented. A remote network attached storage server comprises a plurality of network interfaces. Each network interface in the plurality of network interfaces has one or more corresponding internet protocol addresses. A network storage controller comprises: a first computing node comprising a first backplane network interface and a second computing node comprising a network interface logically connected to one of the plurality of network interfaces and a second backplane network interface physically connected to the first backplane network interface. At least one of the first or second computing nodes are configured to perform deep packet inspection on network traffic between a client device and the remote network attached storage server. The at least one of the first or second computing node responds to the network traffic.

Abstract: Methods and systems are provided for using keyword preprocessing, Boyer-Moore analysis, and hybrids thereof, in intrusion-prevention systems. In one embodiment, a state-transition table representative of a data pattern is provided. The table has a plurality of states, each having egress events that define transitions to other states. The data pattern is parsed to identify character strings. A subject is received for evaluation, and preprocessed to find any instances of those character strings. A keyword table is populated with the character strings found during preprocessing. While using the table to evaluate the subject, a first state having a first one of the character strings as an egress event is transitioned into. The keyword table is checked for the first character string, and, responsive to finding the first character string in the keyword table, a transition is taken from the first state to the second state.

Abstract: A system and method for IP telephony are disclosed, including an IP telephone (IPT) and a Service Gateway (SG). The SG receives an identifier, e.g., a vendor class identifier, included in a DHCP discover message from the IP telephone and determines the identifier's validity. If so, the SG issues a DHCP offer comprising DHCP lease information to the IP telephone, including a range of port numbers assigned to the IP telephone based on the identifier, where the range of port numbers comprises ports which are not reserved for use by other IP protocols. The DHCP lease information includes information indicating operational software for the IP telephone which the IP telephone executes to enable IP communications. The SG mediates IP communications between the IP telephone and an IP device, where the IP telephone uses at least a subset of the range of port numbers to send or receive IP communications.

Abstract: Methods and systems are provided for using lambda transitions for processing regular expressions in intrusion-prevention systems. In an embodiment, a state-transition table is provided, said table being representative of a predetermined data pattern, and including states having egress events defining transitions to other states. A subject is received for evaluation for the presence of the predetermined data pattern. While using the state-transition table for said evaluation, a first state is transitioned into, the first state having an egress event defining a transition to a second state, a state count corresponding to a number of times the first state has been transitioned into, a state-count threshold, and a state-count condition. After transitioning into the first state, the state count is incremented. Responsive to determining that the state-count condition is satisfied by comparing the incremented state count with the state-count threshold, the transition to the second state is taken.

Abstract: System and method for IP telephony. The system includes an IP telephone (IPT) and a Service Gateway (SG). The SG receives an identifier, e.g., a vendor class identifier, included in a DHCP discover message from the IP telephone and determines if the identifier is valid. If so, the SG issues a DHCP offer comprising DHCP lease information to the IP telephone, including a range of port numbers assigned to the IP telephone based on the identifier, where the range of port numbers comprises ports which are not reserved for use by other IP protocols. The DHCP lease information includes information indicating operational software for the IP telephone which the IP telephone executes to enable IP communications. The SG mediates IP communications between the IP telephone and an IP device, where the IP telephone uses at least a subset of the range of port numbers to send or receive IP communications.

Abstract: Methods and systems are provided for using incremental operation for processing regular expressions in intrusion-prevention systems. In an embodiment, a state-transition table is provided, said table representative of a predetermined data pattern, and including states each having one or more egress events defining transitions to other states. A first portion of a subject is received, where the subject is to be evaluated for the presence of the predetermined data pattern. While using the state-transition table for said evaluation, a first state is transitioned into, after which it is determined that a set of restart information should be saved for the first state, said determination including identifying a tail to save from an end of the first portion of the subject. The restart information is saved, along with at least the identified tail.

Abstract: A system includes a plurality of deep packet inspection engines for performing deep packet inspection on packets in a network. The deep packet inspection engines share at least some state. One of the deep packet inspection engines is assigned responsibility for writing data to the shared state. For one of the deep packet inspection engines to write data to the shared state, the deep packet inspection write provides a write request to the assigned “writer” deep packet inspection engine, which queues the request on a write queue. The writer deep packet inspection engine may queue multiple write requests from multiple deep packet inspection engines. The writer deep packet inspection engine dequeues the write requests and processes them serially, thereby avoiding the need to manage contention using locks.

Abstract: Methods and systems are provided for using state ranges for processing regular expressions in intrusion-prevention systems. In an embodiment, in an intrusion-prevention system for examining network traffic and identifying therein the presence of signature data patterns, a state-transition table is provided. The state-transition table is representative of a predetermined data pattern, and includes states each having one or more egress events defining transitions to other states. A subject is received for evaluation for the presence of the predetermined data pattern. While using the state-transition table for said evaluation, the presence of a first egress event of a first state is detected in the subject, resulting in a transition from the first state to a second state. A second-state range in the subject is calculated, and the second-state range is searched for the presence of at least one of the second state's egress events.

Abstract: System and method for IP telephony including internal and external call sessions. The system includes at least one IP telephone (IPT), a Service Gateway (SG), and a Media Gateway Controller (MGC). The SG receives a Call Setup request, including a source IP address and a destination telephone number. A first Media Gateway is selected based on the source IP address. A second Media Gateway is selected based on the destination telephone number. A public IP address of the first Media Gateway is compared to a public IP address of the second Media Gateway, and if the same, respective private IP addresses of the first and second Media Gateway are selected for Call Setup. If different, the respective public IP addresses of the first and second Media Gateway are selected for Call Setup. Thus, the system and method distinguish between external and internal call sessions and route the IP traffic accordingly.

Abstract: System and method for routing packets for IP telephony. The system includes an IP telephone (IPT) and a Service Gateway (SG) coupled via a network. The SG receives a data packet from the IPT, including a private source IP address (SIPA), source port number (SPN), and destination information for an IP device, performs network address persistent port translation (NAPPT) on the data packet, and sends it to the IP device. NAPPT changes the private SIA to a public SIA, leaving the SPN unchanged. The SG receives a data packet from the IP device, including a public destination IP address (DIPA, i.e., said public SIPA), a destination port number (DPN, i.e., said SPN), and source information, NAPPTs the data packet, using the public DIPA and the DPN to identify the IPT, changing the public DIPA to the private SIPA, leaving the DPN unchanged, and sends the data packet to the IPT.

Abstract: System and method for IP telephony. The system includes at least one IP telephone (IPT), a Service Gateway (SG), and a Media Gateway Controller (MGC). After the IPT is activated, the SG performs client DHCP lease negotiation with the IPT, using an identifier of the IPT to assign a range of ports to the IPT, and providing DHCP lease information, which is stored on the SG and the IPT. Operational software is downloaded from a TFTP server and executed by the IPT for initialization. The MGC registers the IPT, which then performs IP communications using one or more ports in the range of assigned ports, where the SG receives packets, performs NAPPT on source/destination IP addresses in the packet header for outgoing/incoming calls, while leaving port information unchanged, and sends the packets on to their destination, where the IPT is uniquely identified using a public IP address and port number.

Abstract: System and method for IP telephony including internal and external call sessions. The system includes at least one IP telephone (IPT), a Service Gateway (SG), and a Media Gateway Controller (MGC). The SG receives a Call Setup request, including a source IP address and a destination telephone number. A first Media Gateway is selected based on the source IP address. A second Media Gateway is selected based on the destination telephone number. A public IP address of the first Media Gateway is compared to a public IP address of the second Media Gateway, and if the same, respective private IP addresses of the first and second Media Gateway are selected for Call Setup. If different, the respective public IP addresses of the first and second Media Gateway are selected for Call Setup. Thus, the system and method distinguish between external and internal call sessions and route the IP traffic accordingly.

Abstract: System and method for routing packets for IP telephony. The system includes an IP telephone (IPT) and a Service Gateway (SG) coupled via a network. The SG receives a data packet from the IPT, including a private source IP address (SIPA), source port number (SPN), and destination information for an IP device, performs network address persistent port translation (NAPPT) on the data packet, and sends it to the IP device. NAPPT changes the private SIA to a public SIA, leaving the SPN unchanged. The SG receives a data packet from the IP device, including a public destination IP address (DIPA, i.e., said public SIPA), a destination port number (DPN, i.e., said SPN), and source information, NAPPTs the data packet, using the public DIPA and the DPN to identify the IPT, changing the public DIPA to the private SIPA, leaving the DPN unchanged, and sends the data packet to the IPT.

Abstract: System and method for IP telephony. The system includes an IP telephone (IPT) and a Service Gateway (SG). The SG receives an identifier, e.g., a vendor class identifier, included in a DHCP discover message from the IP telephone and determines if the identifier is valid. If so, the SG issues a DHCP offer comprising DHCP lease information to the IP telephone, including a range of port numbers assigned to the IP telephone based on the identifier, where the range of port numbers comprises ports which are not reserved for use by other IP protocols. The DHCP lease information includes information indicating operational software for the IP telephone which the IP telephone executes to enable IP communications. The SG mediates IP communications between the IP telephone and an IP device, where the IP telephone uses at least a subset of the range of port numbers to send or receive IP communications.

Abstract: System and method for IP telephony. The system includes at least one IP telephone (IPT), a Service Gateway (SG), and a Media Gateway Controller (MGC). After the IPT is activated, the SG performs client DHCP lease negotiation with the IPT, using an identifier of the IPT to assign a range of ports to the IPT, and providing DHCP lease information, which is stored on the SG and the IPT. Operational software is downloaded from a TFTP server and executed by the IPT for initialization. The MGC registers the IPT, which then performs IP communications using one or more ports in the range of assigned ports, where the SG receives packets, performs NAPPT on source/destination IP addresses in the packet header for outgoing/incoming calls, while leaving port information unchanged, and sends the packets on to their destination, where the IPT is uniquely identified using a public IP address and port number.