Abstract: A technique manages packets in a data communications device having a memory using a real-time feedback signal. The technique involves transmitting an initial set of packets from the data communications device. The technique further involves monitoring transmission of the initial set of the packets from the data communications device, and providing the real-time feedback signal indicating transmission information regarding the initial set of packets. Additionally, the technique involves manipulating a new set of packets within the memory of the data communications device based on the real-time feedback signal, and transmitting the new set of packets from the data communications device based on how the new set of packets was manipulated within the memory of the data communications device. The use of the real-time feedback signal enables the data communications device to make on-the-fly adjustments to dynamically changing traffic patterns without the need for human intervention.

Abstract: The invention features a system and method to enable real-time establishment and maintenance of a standard of operation for a data communications network. The standard is a data set which includes network activity which is historically categorized by traffic type and by activity. The process begins with monitoring the network media or some network component over some period of time. The monitoring information is used to build benchmark data sets. The benchmark data sets contain a standard of operation for the network, which are historically categorized by either traffic type or activity. This standard of operation is constantly built by the intelligent monitoring facilities. After some period of time which is referred to as the benchmark data set refresh interval, the benchmark that was created is employed in a fashion to allow a determination as to whether the data that is taken from the current monitoring activity indicates normal network behavior.

Abstract: A high speed data communication network is adapted to monitor and measure response time between a work station and a central host or processor coupled to the data communications network through a media, such as token ring, FDDI, Ethernet, etc. As the workstation communicates with the processor, a flag is set in a packet transmitted to the processor. The packet traverses the network to an application in the processor and a response returns which includes a flag. Each flag is a specific bit pattern. A programmable digital filter recognizes the flags and counts the number of bits on the network between the flags in the forward and reverse direction. By counting the bits on the media, when the flag moves in one direction or another, the total number of bits transmitted on the media between the two intervening flags is determined. The media speed is used as a clock. The number of bits counted divided by the media speed determines the response time with fine resolutions.

Abstract: A high speed data communication network is adapted to monitor and measure response time between a work station and a central host or processor coupled to the data communications network through a media, such as token ring, FDDI, Ethernet, etc. As the workstation communicates with the processor, a flag is set in a packet transmitted to the processor. The packet traverses the network to an application in the processor and a response returns which includes a flag. Each flag is a specific bit pattern. A programmable digital filter recognizes the flags and counts the number of bits on the network between the flags in the forward and reverse direction. By counting the bits on the media, when the flag moves in one direction or another, the total number of bits transmitted on the media between the two intervening flags is determined. The media speed is used as a clock. The number of bits counted divided by the media speed determines the response time with fine resolutions.

Abstract: An adaptive, active monitor invention is useful in detecting characteristic data patterns in messages on a high speed data network, such as starting delimiters, tokens, various types of frames, and protocol information. Such serial data streams include serial patterns of binary bits, and can also include serial patterns of multiple state symbols, such as in token ring networks and FDDI networks.The adaptive, active monitor includes two finite state machines (FSM) which are constructed to detect the occurrence of a characteristic data pattern having multiple component bit patterns. A first FSM is the predecessor FSM, and it is configured to detect the first occurring component pattern. A second FSM is called the successor FSM, and it is configured to detect the second occurring component pattern. The first FSM will send a starting signal to the second FSM, when the first FSM has successfully detected the first component pattern.

Abstract: A dynamic realtime routing mechanism for a data communications network, which provides an Event Driven Interface to perform realtime routing of data frames over one of a plurality of destination paths. The Event Driven Interface is programmed with control vectors to identify routing bit patterns in the data frames on the data communications network. Enabling signals produced by the Event Driven Interface are applied to the control input of a multiplexer whose data input is connected to the data communications network. The multiplexer will steer the data frames from the data communications network to one of a plurality of output routing paths, in response to the enabling signals it receives from the Event Driven Interface.

Abstract: A system and method for passively measuring and correcting ring latency on a token or FDDI ring includes generating bits and token frames in a defined pattern according to the token ring protocol. A passive device coupled to the token ring measures CMIN, the minimum spacing, CMAX, the maximum spacing in bits and calculates Fi the frequency of changes in Cmin and Cmax between successive tokens or a token and a frame on the ring. A latency event vector Li is generated by the passive device. A controller responsive to the latency vector Li corrects the spacing between successive tokens or a token and frame to achieve a constant ring latency regardless of electrical or operational changes on the token ring.

Abstract: A system and method monitors and controls an asynchronous transfer mode (ATM) network having at least two ATM stations. An event driven interface is coupled to the ATM network for monitoring the selected ranges of contiguous non-empty cells and of contiguous empty cells communicated between the ATM stations and outputting count values for selected ranges of contiguous non-empty cells and of contiguous empty cells. An analysis computer is coupled to the output of the event driven interface, for analyzing the count values and outputting control signals. The control signals are used to reorder or change the time of transmission of data at a transmitting ATM station on the communications link, in response to the control signals.

Abstract: A hardwired, dynamically reconfigurable counter array counts occurrences of different traffic events having different rates of occurrences monitored on a high speed data network by an Event Driven Interface (EDI). The array includes a plurality of "N" bit counters, where "N" is a binary multiple. The counters are arranged in an array of size "m,n", where "m" is the number of rows and "n" is the number of columns in the array. A signal input is provided to each counter as a first input, each signal being definitive of a specific traffic event occurring on the high speed network. Each counter is connected to the adjacent counter in the column through a multi-terminal logic element, each logic element in a column receives the output of a counter as a first input and provides an output to the succeeding counter as a second input. A counter logic switch responsive to an input signal generates a counter logic vector as an output.

Abstract: The invention includes indirect addressing which is the realtime calculation of the location of variably offset fields in a frame in a high speed medium. Data frames in a communication medium, include a presence bit which indicates the presence of a variable length field whose length is defined by a length field in the data frame. In accordance with the invention, an Event Driven Interface has its input coupled to the data communications network, to receive the data frame and to identify the presence of the presence bit. In response to this, the Event Driven Interface branches to a first logic path which ignores the plurality of bits in the variable length field corresponding to the length field. Then, the Event Driven Interface branches to a second logic path after the plurality of bits have been ignored, to locate the variably offset field being sought in the data frame. This enables the realtime location of data at variable offsets in the data frame.

Abstract: An adaptive, active monitor invention is useful in detecting characteristic data patterns in messages on a high speed data network, such as starting delimiters, tokens, various types of frames, and protocol information. Such serial data streams include serial patterns of binary bits, and can also include serial patterns of multiple state symbols, such as in token ring networks and FDDI networks.The adaptive, active monitor includes two finite state machines (FSM) which are constructed to detect the occurrence of a characteristic data pattern having multiple component bit patterns. A first FSM is the predecessor FSM, and it is configured to detect the first occurring component pattern. A second FSM is called the successor FSM, and it is configured to detect the second occurring component pattern. The first FSM will send a starting signal to the second FSM, when the first FSM has successfully detected the first component pattern.

Abstract: A workstation manages and controls a plurality of communication networks using different protocols coupled to a common bus. A programmable digital filter connected between the workstation and the networks examines frame information using real time calculation for identifying protocols in the frames. The filter identifies and counts addresses, security conditions and other information of interest on the bus and occurring in the networks. The protocol, address, security data and other information of interest counted by the filter are stored in storage for access by an interpreter. The stored data for the networks accessed by the interpreter is compared to network models for identification of traffic problems and conditions and load balancing. The network interpreter contains a graphical user interface which displays selected information at a monitor for an operator to examine and initiate corrective action by initiating commands.

Abstract: A realtime high speed data capture is provided in response to a trigger bit pattern detected in a serial bit stream. An Event Driven Interface is connected to a data communications network to receive a serial bit stream. A capture buffer is connected to the network to store at least a portion of the serial bit stream. The capture buffer is selectively connected to the network by means of a gate. The Event Driven Interface is programmed to recognize a trigger bit pattern in the serial bit stream and to output an enable signal to the gate. In response to this, the capture buffer will store a predetermined portion of the serial bit stream from the network.

Abstract: A system is disclosed for the dynamic switching between a first Event Driven Interface and a second Event Driven Interface based upon inband information contained in the data frames of a data communications network. This enables the selective realtime transfer of routing control based upon diverse communications protocols, for example. A first routing table can be contained in a first Event Driven Interface and a second routing table can be embodied in a second Event Driven Interface, and in this example, by means of the first Event Driven Interface identifying the switchover pattern contained within a switching segment of the data frame, the system can automatically switch over to connect a second Event Driven Interface to the data communications network, containing a second routing table configuration. In this manner, realtime control of routing, for example, can be accomplished with inband information in a data communications network.

Abstract: The realtime event classification technique is described for a data communications network, which enables the categorization of data frames based upon selection significant bit segments in the serial bit stream. A base Event Driven Interface and an extension Event Driven Interface are both coupled to the data communications network, to identify patterns in the serial bit stream. The base Event Driven Interface identifies patterns which correspond to events which are to be counted. The extension Event Driven Interface identifies patterns of bits which are selection significant for the types of categories which are desired to be monitored. A plurality of event vector counters have event inputs coupled to the base Event Driven Interface and have a selection input coupled to the extension Event Driven Interface. A selection signal output from the extension Event Driven Interface enables one of the plurality of the event vector counters to receive the event signals from the base Event Driven Interface.

Abstract: A dynamic realtime, inband routing mechanism is disclosed for a data communications network, which provides an Event Driven Interface to perform realtime, inband directed routing for load distribution and load balancing of data frames over one of a plurality of destination paths. The Event Driven Interface is programmed with control vectors to identify load balancing and load distribution bit patterns in the data frames on the data communications network. Enabling signals produced by the Event Driven Interface are applied to the control input of a multiplexer whose data input is connected to the data communications network. The multiplexer will steer the data frames from the data communications network to one of a plurality of output alternative routing paths, in response to the enabling signals it receives from the Event Driven Interface.

Abstract: A system and process are disclosed for configuring an Event Driven Interface and analyzing its output for monitoring and controlling a data communications network. The invention is a combination of a source of control vectors, which sends control vectors to a Programmable Performance Vector Generator which is coupled to a data communications network to be monitored and controlled. The control vectors configure an Event Driven Interface contained in the Programmable Performance Vector Generator, based upon the protocol of the network, performance information required, and the type of analysis and network characteristics required from the system. Event vectors are then output to an expert system which analyzes them and provides monitoring information and control signals to the network. The invention enables real-time load distribution, load balancing, problem determination, routing and customer services.

Abstract: The method enables realtime establishment and maintenance of a standard of operation for a data communications network. The process begins by monitoring the network over some period of time to build benchmark data sets. The benchmark data sets contain a standard of operation for the network, which is historically categorized by either traffic type or activity. This standard of operation is accumulated by the intelligent monitoring facilities. After a period of accumulation, the benchmark is used to determine whether data taken from current monitoring activity indicates normal network behavior. Network monitoring information is analyzed using criteria in modules that have an interface to an expert system. The criteria modules evaluate the current monitored data against the prior benchmark collected data. The criteria module determines if the current network operating characteristics are outside the bounds of normal behavior. If they are, then alerts and logs of information can be sent to the expert system.

Abstract: A system and method provide a security agent, consisting of a monitor and a responder, that respond to a detected security event in a data communications network, by producing and transmitting a security alert message to a network security manager. The alert is a security administration action which includes setting a flag in an existing transmitted protocol frame to indicate a security event has occurred. The security agent detects the transmission of infected programs and data across a high-speed communications network. The security agent includes an adaptive, active monitor using finite state machines, that can be dynamically reprogrammed in the event it becomes necessary to dynamically reconfigure it to provide real time detection of the presence of a suspected offending virus.

Abstract: A system and process are disclosed that allows the collection of events to be organized and ordered so that relationship between events and the events themselves can be identified as a state or series of states which describe and allow control of performance aspects of protocol activity. The architecture allows dynamic programming of multiple of devices for the purposes of coordination and correlation of events such that monitoring, performance analysis and control can be accomplished on a real-time basis for any speed network. The architecture facilitates feedback of the correlated events for the purposes of monitoring and controlling network activity.