Abstract: In one embodiment, label distribution sessions are established between a Modular Cable Modem Termination System (M-CMTS) core and one or more remote PHYs. The label distribution sessions facilitate association of labels with either Radio Frequency (RF) channels or groups of the RF channels that extend from the remote PHYs to one or more cable modems. The labels are then used to facilitate communications between the M-CMTS core and the remote PHYs over a MultiProtocol Label Switching (MPLS) network.

Abstract: In one embodiment, a network device joins a first multicast tree to receive post-ad-inserted video content. The network device also joins a second multicast tree to receive the pre-ad-inserted video content. The content from the first multicast tree is forwarded by the network device to the receiver(s). The network device determines if it does not receive the content on the first multicast tree due to any failure, in which case, it delivers the content from the second multicast tree to the receiver(s). This enables the receiver to receive the original (pre-ad-inserted) content during the failure in first multicast tree. When the failure is resolved, the network device can go back to sending the content from the first multicast tree to the receiver(s).

Abstract: A system transmits, to a hub from a first spoke, first routing information associated with the first spoke. The system receives, at the first spoke, from the hub, second routing information associated with a plurality of spokes in communication with the hub. The plurality of spokes includes a second spoke. The system resolves, at the first spoke, a next hop determination for the packet based on the second routing information received from the hub. The system routes the packet from the first spoke to the second spoke using the next hop determination.

Abstract: A method, apparatus and computer program product for providing an encrypted multipoint Virtual Private Network (VPN) service is presented. A first packet of a plurality of packets is received at an ingress provider edge (PE) the plurality of packets destined for a remote server in communication with said egress PE router. A lookup for a destination prefix of a first packet is preformed, and a determination made that a next-hop for the first packet is reachable through a mGRE tunnel. A resolution request is sent to a hub to acquire a routable IP address. The packets sent to the hub are encapsulated, and encrypting until a resolution reply is received and until security associations (SAs) have been exchanged. Then a VPN is established between the ingress and egress PEs and is used for all subsequent packets.

Abstract: In one embodiment, a method can include: receiving a packet in a device; classifying the received packet as a first packet type or a second packet type; when the packet is the first packet type, forwarding the packet to a next hop; and when the packet is the second packet type: performing forward error correction (FEC) encoding on the packet to generate repair data, modifying the packet by adding a multi-protocol label switching (MPLS) header to indicate that the packet is to be forwarded on an FEC-protected label switched path (LSP), generating an additional MPLS packet carrying the repair data, and forwarding the modified packet and the additional packet to a next hop.

Abstract: A method for IP Security within Multi-Topology Routing is disclosed. Disclosed methods may also include IKE extensions. A route eligible for IPSec protection is injected into a topology routing table. Network traffic can then be protected in accordance with a security session, such as an IPSec session, between a first network node and a second network node and forwarded through a selected topology to take advantage of the service-differentiation capabilities of MTR.

Abstract: Systems and methods for using routing protocol extensions to improve spoke to spoke communication in a computer network are disclosed. Embodiments provide systems and methods to establish a tunnel between a first spoke and a hub, exchange routing information between the first spoke and the hub using a routing protocol, extend the routing protocol and an associated database to include next hop mapping information, and establish a tunnel between the first spoke and a second spoke according to information in the database.

Abstract: The embodiments described herein provide methods and apparatuses for implementing a User Datagram Protocol traceroute probe extension. In an example embodiment, a request to transmit a User Datagram Protocol (UDP) packet to a remote destination is received. A probe header and a probe data element is then stored in a data field of the UDP packet. The UDP packet is then transmitted toward the remote destination. In an example embodiment, a User Datagram Protocol (UDP) packet is received and it is determined whether the UDP packet includes a probe data structure. When the determination is affirmative, the probe data structure is processed.

Abstract: In one embodiment, a Home Agent receives a Mobile IP registration request from a group member, where the group member is a Mobile Node. The Home Agent generates a mobility binding for the group member that associates the group member with a care-of address, wherein the group member is a member of one or more groups. The Home Agent generates a Mobile IP registration reply, where the Mobile IP registration reply identifies one or more key servers. Each of the one or more key servers serves at least one of the one or more groups and is adapted for distributing group cryptography material to members of each group that is served by the corresponding key server. The Home Agent sends the Mobile IP registration reply to the group member, thereby enabling the group member to obtain cryptography material for at least one of the one or more groups from at least one of the one or more key servers to enable the group member to use the cryptography group material to securely communicate with other group members.

Abstract: Various embodiments of the disclosed subject matter provide methods and systems for improved efficiency in spoke-to-spoke network communication. Embodiments provide systems and methods for registering a spoke with a hub, updating at least one database with spoke registration information at the hub, and advertising the spoke registration information to other spokes using a single control plane that includes transport security, peer discovery, and unicast routing information.

Abstract: In one embodiment, group member devices may be divided into at least one cluster, wherein each cluster includes a primary key server designated to synchronize with a master key server. Each cluster further includes at least one registration server configured to communicate with member devices in the group within the cluster and to synchronize with the primary key server.

Abstract: One embodiment provides a method to interconnect virtual network segments (VNETs) defined for a local-area network (LAN) infrastructure separated by a wide-area network infrastructure. The technique involves the routing device at the LAN-WAN interconnection points to impose or dispose the VNET-shim, which encodes the VNET-id information in a Layer 4 portion of the packet. In a data plane, a new IP protocol value may be used to signify the presence of the VNET-shim followed by cryptography specific information in an IP packet. In a control plane, the routing protocol is expanded to exchange the routing information along with the VNET information.

Abstract: In one embodiment, label distribution sessions are established between a Modular Cable Modem Termination System (M-CMTS) core and one or more remote PHYs. The label distribution sessions facilitate association of labels with either Radio Frequency (RF) channels or groups of the RF channels that extend from the remote PHYs to one or more cable modems. The labels are then used to facilitate communications between the M-CMTS core and the remote PHYs over a MultiProtocol Label Switching (MPLS) network.

Abstract: In one embodiment, a technique for updating an address associated with a first entity in a communications network with a second entity in the communications network wherein the address is used to forward information to the first entity from the second entity. The first entity registers a first address associated with the first entity with the second entity. The first entity determines that a second address associated with the first entity is to be used instead of the first address to communicate with the first entity. The first entity generates an update message containing the second address, the update message obviating having to register the second address with the second entity. The first entity forwards the update message to the second entity to cause the second entity to use the second address instead of the first address to forward information to the first entity.

Abstract: An apparatus for limiting Virtual Private Network (VPNv4) prefixes per VPN in an inter-autonomous system environment are presented. A limit on the number of VPNv4 routes per VPN for a Route Distributor (RD) or a group of RDs associated with a VPN is defined, at an Autonomous System Border Router (ASBR). When the number of received routes at the ASBR exceeds the limit, then a soft notification is sent to a neighboring ASBR and routes exceeding the limit are discarded at the ASBR.

Abstract: A method, apparatus and computer program product for limiting Virtual Private Network (VPNv4) prefixes per VPN in an inter-autonomous system environment are presented. A limit on the number of VPNv4 routes per VPN for a Route Distributor (RD) or a group of RDs associated with a VPN is defined, at an Autonomous System Border Router (ASBR). When the number of received routes at the ASBR exceeds the limit, then a soft notification is sent to a neighboring ASBR and routes exceeding the limit are discarded at the ASBR.

Abstract: In one embodiment, a QoS manager process that receives, at an EzVPN server device, connection speed data from an EzVPN client device. In addition, the QoS manager process processes, at the EzVPN server device, the connection speed data to determine a QoS policy for a communications session between the EzVPN client device and the EzVPN server device. Furthermore, the QoS manager process applies, at the EzVPN server device, the QoS policy to the communications session between the EzVPN client device and the EzVPN server device as determined by the processing of the connection speed data.

Abstract: A method, apparatus and computer program product for preventing infection propagation in a DMVPN is presented. An infected spoke router site is isolated from the DMVPN network such that the spoke router may (bi-directionally) completely or partially limit communicating with any network devices (including the hub router, any other spoke routers etc.) within the DMVPN which prevents the DMVPN melt-down, isolates a worm-infected spoke router site from the rest of the DMVPN and restricts the spread of the worm within the DMVPN network.

Abstract: Method and system for providing ad-splicer N+1 redundancy in a network by employing TIP network intelligence & techniques to facilitate a redundant ad-splicer presuming, within few seconds, the functionality of the failed primary ad-splicer. The network triggers the installation of unlist and multi cast route on an interface by tracking one or more unlist routes to deliver the unlist and (pre-spliced) multi cast traffic to the redundant ad-splicer. The network dynamically adjusts the multi cast trees to continue to deliver the post-spliced multi cast traffic to the intended receivers.

Abstract: An edge router (disposed between a packet-switched network and a label-switching network) is configured to receive an IKE message originating from a client on the Internet (e.g., packet-switched network) attempting to set up a tunnel. Upon receipt of the IKE message, the edge router utilizes a unique identifier in the IKE message to identify a virtual private network in the label-switching network. In lieu of terminating an IPSec tunnel at the edge router and performing a respective key exchange with the client, the edge router identifies a corresponding forwarding table associated with the virtual private network (identified by the unique identifier in the IKE message) and, based on the corresponding forwarding table, forwards the IKE message to a destination reachable via the label-switching network. The destination (e.g., a key server in a corresponding VPN) communicates with the client through the edge router to set up the tunnel.