Abstract: The present disclosure discloses a method and network device for an enhanced serialization mechanism. Specifically, the disclosed system receives a plurality of packets from a plurality of transport layer flows corresponding to a security association. Also, the system designates one processor of a plurality of processors to be associated with the security association. Moreover, the system assigns a sequence number to each packet, and transmits the plurality of packets from the plurality of transport layer flows such that packets within the same transport layer flow are transmitted in order of their sequence numbers. However, at least two packets from two different transport layer flows may be transmitted out of incremental order of their sequence number.

Abstract: The present disclosure discloses a method and network device for session based forwarding. Specifically, the disclosed system receives a first packet in a session, and performs a route lookup to determine a route for the first packet. Then, the system caches a reference to the route and a neighbor in the session, and also caches a reference to the session in a tunnel within which packets in the session are to be forwarded. Based on a comparison between the route version number cached in the session and the route version number in a route table corresponding to the route referenced by a route index in the session, the system determines whether the route is stale. If so, the system performs another route lookup to update the route. Moreover, the system uses cached reference to the session in the tunnel for forwarding subsequent packets in the session.

Abstract: The present disclosure discloses a method and network device for maintaining captive portal user authentication. Specifically, the disclosed system determines an association status between a client and an access point in a wireless network, as well as whether to remove an entry corresponding to the client from a network layer (L3) cache based on the association status. If it is determined that the entry is to be removed, the disclosed system removes the entry corresponding to the client from the network layer (L3) cache. Note that, the association status can be determined based on one or more of an indication by a station management process at the network device, and a detection of radio link activities.

Abstract: A first data set is derived from a second data set. The first data set is stored in a database of derived data sets. The second data set is updated without updating the first data set, such that the first data set and the second data are inconsistent. The first data set is deleted or updated during batch processing of the database of the derived data sets.

Abstract: The present disclosure discloses a method and network device for a rate limiting mechanism based on device load/capacity or traffic content. Specifically, the system receives a request from a network node, and determines whether a ratio between a current load and a capacity exceeds a threshold. If so, the system determines a wait time period based on current load/capacity ratio, and responds to the network node with a message including the wait time period. Moreover, the system can inspect content of the request to determine a message type, and whether the message type indicates that the request is associated with dependent messages. If so, the system responds to the request with a busy message including the wait time period. Further, the system rejects new session requests if the number of concurrent sessions currently connected to the network device approaches the number of sessions associated with a regression point.

Abstract: According to one embodiment, a method comprises an operation of determining whether an ingress control message is locally terminated control traffic on a digital device prior to the ingress control message being forwarded to a hardware processor of the digital device for processing. A priority is assigned to the ingress control message based on information within the ingress control message, if the ingress control message is determined to be locally terminated control logic.

Abstract: The present disclosure discloses a method and network device for home VLAN identification for roaming mobile clients. Specifically, the disclosed method and system detects that the mobile client has roamed away from a first network to a second network, maintains a mapping between a virtual local area network (VLAN) corresponding to the mobile client and a tunnel corresponding to a foreign agent in the second network, and forwards packets to or from the mobile client on the VLAN based on the mapping between the VLAN and the tunnel via which the packets are received. Therefore, the disclosed method and system allows for identification of home VLANs for roaming mobile clients without merging VLAN policy configurations at the home agent and the foreign agent.

Abstract: A method includes subsequent to a client associating with a first access node and the client being communicatively coupled with a first controller through the first access node: storing information on one or more of: active broadcast sessions for the client or active multicast sessions for the client. The method further includes subsequent to the client associating with a second access node and the client being communicatively coupled with a second controller through the second access node: the second controller establishing one or more of: the active broadcast sessions for the client or the active multicast sessions for the client using the information.

Abstract: Synchronization of mobile multicast membership in a wireless network. A controller supports one or more wireless access points, each of which supports wireless clients. A Mobility Manager (MM) in the controller monitors wireless client activity. The controller establishes an IGMP proxy which intercepts IGMP messages from wireless clients and handles the IGMP messages on clients' behalf. When a wireless client wishes to join a multicast, the client's IGMP join message is intercepted by the controller IGMP proxy, and the controller IGMP proxy joins the multicast for the client. The Mobility Manager observes the actions of the IGMP proxy. If a client moves from its home agent (HA) controller to a different foreign agent (FA) controller, the Mobility Manager in the FA controller locates the Mobility Manager in the HA controller and receives information on the client including information on any multicast streams the client is receiving.

Abstract: The present disclosure discloses a method and network device for home VLAN identification for roaming mobile clients. Specifically, the disclosed method and system detects that the mobile client has roamed away from a first network to a second network, maintains a mapping between a virtual local area network (VLAN) corresponding to the mobile client and a tunnel corresponding to a foreign agent in the second network, and forwards packets to or from the mobile client on the VLAN based on the mapping between the VLAN and the tunnel via which the packets are received. Therefore, the disclosed method and system allows for identification of home VLANs for roaming mobile clients without merging VLAN policy configurations at the home agent and the foreign agent.

Abstract: Improved handling of RTP streams in digital networks. A switching device in a digital network such as a controller, bridge, or access point examines streams flowing through the device. The device monitors the initial UDP packets of a stream until a predetermined number of packets have been monitored. The device monitors and fingerprints the header portion of UDP packets, looking for RTP header bit patterns, ignoring certain RTP packet types, and caching others. This fingerprinting process attempts to match cached packet header information against subsequent packets in the stream to detect RTP streams. If the stream is determined to be an RTP stream, then the RTP type from the packet header is used to tag the stream. In one embodiment, such tags are QoS tags. Tagging may also be based on the control session port used.

Abstract: Techniques are provided for configuring wireless switches within a mobility domain. In one implementation, a first designated wireless switch and a first client wireless switch are configured as part of a first mobility area of the mobility domain. An internal peering session is established between the first client wireless switch and the first designated wireless switch in the first mobility area. A second designated wireless switch is configured as part of a second mobility area of the mobility domain, and an external peering session is established between the first designated wireless switch in the first mobility area and the second designated wireless switch in the second mobility area.

Abstract: Synchronization of mobile multicast membership in a wireless network. A controller supports one or more wireless access points, each of which supports wireless clients. A Mobility Manager (MM) in the controller monitors wireless client activity. The controller establishes an IGMP proxy which intercepts IGMP messages from wireless clients and handles the IGMP messages on clients' behalf. When a wireless client wishes to join a multicast, the client's IGMP join message is intercepted by the controller IGMP proxy, and the controller IGMP proxy joins the multicast for the client. The Mobility Manager observes the actions of the IGMP proxy. If a client moves from its home agent (HA) controller to a different foreign agent (FA) controller, the Mobility Manager in the FA controller locates the Mobility Manager in the HA controller and receives information on the client including information on any multicast streams the client is receiving.

Abstract: Controlling access and capabilities on wired digital networks. According to the invention, rather than use port-centric controls, multiple virtual local area networks (VLANs) are supported by a wired controller, and these VLANS may be terminated on multiple physical ports. Capabilities are then assigned on a VLAN basis, with default capabilities assigned to the port when no VLAN is used. By defining capabilities on a VLAN basis, as an example no access, trusted access, or untrusted access. Trusted access VLANS are not subject to authentication or firewalling. Untrusted VLANS are subject to authentication and firewalling, which may be configured as required for the VLAN and its authorized users.

Abstract: Techniques are provided for configuring wireless switches within a mobility domain. In one implementation, a first designated wireless switch and a first client wireless switch are configured as part of a first mobility area of the mobility domain. An internal peering session is established between the first client wireless switch and the first designated wireless switch in the first mobility area. A second designated wireless switch is configured as part of a second mobility area of the mobility domain, and an external peering session is established between the first designated wireless switch in the first mobility area and the second designated wireless switch in the second mobility area.

Abstract: Techniques and technologies are provided for resolving conflicts among wireless switches associated with a wireless client device regarding a layer 3 (L3) mobility state of the wireless client device at the wireless switches. A conflict regarding the L3 mobility state of the wireless client device between a first wireless switch and a second wireless switch can be detected. For example, in one implementation, a first wireless switch determines that an L3 mobility state of a wireless client device at the first wireless switch is different than the L3 mobility state of the wireless client device at the second wireless switch. The conflict regarding the L3 mobility state of the wireless client device between the first wireless switch and the second wireless switch can then be resolved.

Abstract: In a network including a wireless client device, a home wireless switch of the wireless client device, and a new wireless switch within the same mobility domain as the home wireless switch, the new wireless switch can be configured to become a new home/current wireless switch for the wireless client device, and to transmit a layer 2 (L2) roam message to the home wireless switch, when the new wireless switch determines that the wireless client device has roamed from the home wireless switch to the new wireless switch. The L2 roam message indicates that the wireless client device has roamed within the same VLAN or L3 subnet. The L2 roam message comprises an IP address of the new home wireless switch, and an IP address of the new current wireless switch. The home wireless switch is configured to forward the L2 roam message to peer wireless switches within the mobility domain.