Abstract: To mitigate attacks utilizing compromised DNS caches, a server gateway provides clients with unique IP addresses to contact the server. Packets sent to a server IP address from a particular client which are not linked to that particular with the server gateway are dropped. Thus, even if a client is compromised, the IP address for the server in the client's DNS cache cannot be used by other machines or virtual machines. With a one to one client to server IP address relationship, malicious actors cannot use numerous machines or virtual machines to overload the server with requests.

Abstract: A mechanism is disclosed for identifying, classifying, and controlling flows in a network. In one implementation, a separate set of behavioral statistics is maintained for each flow. These behavioral statistics are updated as packets belonging to a flow are processed. Whenever a packet belonging to a flow is processed, a set of policies that the flow's behavioral statistics satisfy is determined. For each policy that the flow's behavioral statistics satisfy, actions that are associated with that policy are applied relative to the packet. The actions may be designed to cause a router to handle, in a user-specified manner, packets that are likely to represent a particular kind of traffic. Thus, different flows, such as VOIP, gaming, streaming, and P2P flows, which are associated with different behavioral statistics, may be handled in ways applicable for the specific application traffic type.

Abstract: A mechanism is disclosed for identifying, classifying, and controlling flows in a network. In one implementation, a separate set of behavioral statistics is maintained for each flow. These behavioral statistics are updated as packets belonging to a flow are processed. Whenever a packet belonging to a flow is processed, a set of policies that the flow's behavioral statistics satisfy is determined. For each policy that the flow's behavioral statistics satisfy, actions that are associated with that policy are applied relative to the packet. The actions may be designed to cause a router to handle, in a user-specified manner, packets that are likely to represent a particular kind of traffic. Thus, different flows, such as VoIP, gaming, streaming, and P2P flows, which are associated with different behavioral statistics, may be handled in ways applicable for the specific application traffic type.

Abstract: A mechanism is disclosed for identifying, classifying, and controlling flows in a network. In one implementation, a separate set of behavioral statistics is maintained for each flow. These behavioral statistics are updated as packets belonging to a flow are processed. Whenever a packet belonging to a flow is processed, a set of policies that the flow's behavioral statistics satisfy is determined. For each policy that the flow's behavioral statistics satisfy, actions that are associated with that policy are applied relative to the packet. The actions may be designed to cause a router to handle, in a user-specified manner, packets that are likely to represent a particular kind of traffic. Thus, different flows, such as VOIP, gaming, streaming, and P2P flows, which are associated with different behavioral statistics, may be handled in ways applicable for the specific application traffic type.

Abstract: A highly scalable in-band mechanism for updating the state information in flows associated with new or ongoing sessions in a data communications network. The method addresses past scalability issues by using the inherent packet forwarding and flow state capabilities of a networking device to also perform configuration and event response updates to the flow's state information.