Abstract: A network infrastructure element such as a packet data router or switch hosts an application program and one or more user program extensions to the application program. Logic in the network element is configured to perform creating and storing one or more default program security permissions; receiving a user-defined security policy that defines one or more user extension security permissions for the one or more user program extensions; creating and storing only each of the one or more user extension security permissions that do not conflict with the default program security permissions; receiving a request from one of the user program extensions to access a resource of the apparatus or the network; permitting the request to access the resource or the network only when the access does not violate the user extension security permissions and the default program security permissions.

Abstract: A method is disclosed for reducing the sizes of application layer messages in a network element such as a network switch or router. According to one aspect, the network element receives data packets and determines an original application layer message that is collectively contained in payload portions of the data packets. The network element compresses the original application layer message into a compressed message, and sends the compressed message toward an application that is hosted on a device other than the network element. According to another aspect, the network element receives data packets and determines a compressed message that is collectively contained in payload portions of the data packets. The network element decompresses the compressed message into an original application layer message, and sends the original application layer message toward an application that is hosted on a device other than the network element. Compressed messages consume less network bandwidth.

Abstract: A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.