Abstract: A virtual private network (VPN) service is provided through a shared network infrastructure comprising interconnected provider edge (PE) devices having customer edge (CE) interfaces. Some of the CE interfaces are allocated to a VPN supporting virtual LANs. A correspondence between a CE interface and a virtual LAN is learnt on the basis of tagged frames received at this CE interface and including an identifier of this virtual LAN. The learning process permits the detection of pairs of CE interfaces which correspond to a common virtual LAN. Upon such detection, a virtual circuit is established in the shared network infrastructure between the PE devices having these CE interfaces, and subsequently used for forwarding frames including the identifier of the common virtual VLAN.

Abstract: The invention enables the surveillance of computer-like devices while they are connected to a communications network. This latter includes a Network Surveillance Server (NSS). Upon joining said communications network, a device is first required to log-in to NSS. After which, NSS polls it while connected on the network so that an alarm can be issued, from NSS, to a central surveillance unit, if the device fails responding to polling. Hence, prior to leaving the communications network, the computer-like device is also required to log-out to NSS. Thus, as long as it is connected to the communications network, the computer-like device is watched.

Abstract: The invention allows a system to prevent robots from browsing a Web site beyond a welcome page. When an initial request from an undefined originator is received Web site responds to it with a welcome page including at least one trap. Then, on receiving further requests from the undefined originator Web site can check whether a trap is used or not. If not used the undefined originator is assumed to be a human being and is authorized to go on. If a trap is however used the undefined originator is assumed to be a robot in which case site access is further denied. The invention prevents Web site contents from being investigated by robots while not requiring users to have to log on.

Abstract: The invention prevents robots from browsing a Web site beyond a welcome page. When an initial request from an undefined originator is received, the Web site responds to it with a welcome page including a challenge. Then, on receiving a further request from the undefined originator, the Web site can check whether the challenge is fulfilled or not. If fulfilled, the undefined originator is assumed to be a human being and authorized to go on. If the challenge is not fulfilled, the undefined originator is assumed to be a robot, in which case site access is further denied.

Abstract: Methods and a system for defeating TCP SYN flooding attacks are disclosed. In a server running TCP the invention assumes that, whenever receiving a SYN message, the server computes an ISR (Initial Sequence number Receiver side) and includes it in its SYN-ACK response to the client. Then, the server, also listening for the receiving of ACK messages from clients, checks the ISR. If checking fails, ACK message is dropped. If passing checking, ISR is accepted as an authentic computed ISR and decoded accordingly. Only then, resources are allocated and a TCP connection is actually established, after which, listening state is returned to in order to keep processing all received TCP messages.

Abstract: A method and system for determining the best data path in a communication network is presented. A Least Cost Routing path between end users in a multi-network environment, including both public and private networks, is determined based upon a longest prefix match. At network activation time, the numbers or prefixes of numbers of end users attached to the public network (304, 305) are stored in entry node data bases A and C of the private network (303). Assuming an end user terminal U1 calls a target end user U3, an entry node B first checks for a longest prefix match between the called number and numbers already stored into its memory. If this is the first time U3 is called via node B, no match will occur and node B will then broadcast a Query to all nodes in the private network (i.e. Nodes A and C). Only those nodes providing possible access to U3 answer this Query.

Abstract: An apparatus for connecting a data communication equipment, such as a data terminating equipment (DTE) to an ISDN digital communication network providing a first 64 kbps and a second 64 kbps B digital communication channel which involve different transmission delays. The apparatus includes a transmit part with a separation for separating a unique high rate 128 kbps data flow into two distinctive 64 kbps data flows to be transmitted through both B channels. The apparatus includes a receive part (9999) including storage for storing the data received from digital network, measurement and comparison circuits for measuring the difference between the two transmission delays, address generators for addressing the storage in order to extract the data received through both digital channels, control circuits responsive to the measure and comparison for controlling the address generators in order to provide a 128 kbps which is not affected by the difference of transmission delays introduced by both digital channels.

Abstract: An adaptation device (90) and method allows an efficient interconnection of data processing devices (91,92) and networks (93,94). It is based on layer 2 connectivity of entities complying with various High-level Data Link Control (HDLC) protocols, including LAPD and LAPB protocols.