Abstract: A computer implemented method, apparatus, and computer usable program code for processing data packets. A set of data fragments are received at the data processing system to form a set of received data fragments. Assembly of the set of data fragments is initiated into a data packet, and a determination as to whether the data packet is an incomplete data packet. Responsive to a determination that the data packet is an incomplete data packet, the incomplete data packet is filled with at least one character to form a final data packet. The final data packet is forwarded to the target.

Abstract: A system and method of responding to a full TCP queue. After a server receives a TCP connection request from a client, the server places the request on an embryonic queue of TCP connection requests sorted by the amount of elapsed time since the server has respond to each respective TCP connection request. When the server attempts to place a new TCP connection request on a full embryonic queue, the host, via the TCP protocol, will remove the entry at the end of the embryonic queue. The last entry, due to the high timer value, is more likely to having performed unsuccessful attempts at completing a connection.

Abstract: A system and method of responding to a flood attack on a data processing system is disclosed. The present invention mitigates the affects of SYN attacks with false IP addresses by immediately removing the associated embryonic connection from the system upon receiving notification that the IP address in the original SYN request is false. Immediate removal of the connection request will mitigate the effects of the flood attack by not requiring the system to devote resources to servicing a connection request from a false IP address, which could result in denial of service for legitimate clients. Immediate removal of the connection request will mitigate the effects of the flood attack by not requiring the system to devote resources to servicing a connection request from a false IP address, which could result in denial of service for legitimate clients.

Abstract: Methods, system, and products are disclosed for administering requests for data communications connections in a wide area network that include receiving, according to a data communications protocol, by a receiver from a sender, a request for a data communications connection, wherein the sender has a network address on a sender's network and the receiver has a network address on a receiver's network; characterizing the sender as local with respect to the receiver's network if the sender's network is the receiver's network; characterizing the sender as remote with respect to the receiver's network if the sender's network is not the receiver's network; and responding to the request in dependence upon a value of a location response flag and in dependence upon the characterization of the sender's network with respect to the receiver's network.

Abstract: The reassembly timer in a TCP/IP receiver is dynamically set to avoid data corruption on fast networks caused by IP identification wrap-around. A sender generates IP packets with a special option specifying a reassembly time for fragments based on the subnet of the destination or on the calculated round-trip time of the connection. A receiver sets the reassembly timer to the reassembly time specified in the option. A sender can generate IP packets with an alternative option setting a time stamp for the generated packet. A receiver calculates a traversal time based on the difference between the arrival time of the fragment and this time stamp, and sets the reassembly timer based on this traversal time.

Abstract: Methods, systems, and media to sub-divide an ephemeral port range and allocate ports from the sub-divided ephemeral port ranges to facilitate communication with another destination, or target, application are contemplated. Embodiments involve a client computer system having one or more source applications. Embodiments also include hardware and/or software for categorizing transactions based upon characteristics of the transactions. Such categories correspond to categories with which sub-divisions of ephemeral port numbers are assigned. After a transaction is associated with a category, a port number selected from a pool of available port numbers in a sub-division of ephemeral port numbers assigned to that category. In many embodiments, an initial configuration is implemented via a configuration file at the startup of the client computer system. In further embodiments, assignments of ephemeral port numbers to the categories of transactions are dynamically adjusted based upon, e.g.

Abstract: A method for enhancing port allocation procedures in a computer network by reserving specific ports to particular users and processes. Access protocol for ports are modified to enable a system administrator to defined/pre-select particular users and processes that may access the specific ports. A table structure is provided with the list of users and processes with bind authority for the particular port. When a bind request is received the ID of the user or process is confirmed against those within the table of the requested port. Bind access is provided only when the user ID or process ID matches one that is within the table. The port is allocated to the user/program until the user/process is complete, and other requests for access to the port are ignored until final completion of the ongoing process, even when a temporary disconnect of the port occurs.

Abstract: A nitrification-inhibiting agent is described which is characterized in that it comprisesa) dicyandiamide andb) guanylthiourea and/or ammonium thiosulphate and/or ammonium phosphate.This agent is distinguished by an increased activity compared to the individual components and by its low toxicity.