Abstract: Methods, systems, and computer programs are presented for managing a network in the presence of layer-2 loops. One method includes an operation for detecting, by a network device, a loop at a layer 2 of a network. The network device is configured to execute a network device operation system (ndOS), where network devices executing ndOS share a global switch table. The method further includes an operation for blocking ports associated with the loop where incoming packets received at the blocked ports are discarded except for loop-probe packets. Further, the method includes operations for sending loop-probe packets by one or more network devices executing ndOS through one or more ports, and for unblocking a first port of the blocked ports based on the loop-probe packets when a lack of receipt of a loop-probe packet within a predetermined amount of time is detected for the first blocked port which indicates that the first blocked port is not part of the loop.

Abstract: A network switch includes ports, memory, and a processor. The switch is operable to switch packets of a layer 2 network, and the memory is for storing a tunneling engine computer program. The processor executes the tunneling engine, where the processor identifies a second switch operable to switch layer-2 network packets. The identification includes detecting that the second switch is connected to the network switch over a layer 3 connection, and the tunneling engine creates a tunnel over the layer 3 connection between the switches to exchange layer-2 packets. The tunnels encapsulates and decapsulates the packets that are exchanged between the switches. When the processor determines that a packet from a first node to a second node that is connected to the second switch, the processor creates an encapsulation flow on the network switch to encapsulate packets from the first node to the second node over the tunnel.

Abstract: Methods, systems, and computer programs are presented for managing a network in the presence of layer-2 loops. One method includes an operation for detecting, by a network device, a loop at a layer 2 of a network. The network device is configured to execute a network device operation system (ndOS), where network devices executing ndOS share a global switch table. The method further includes an operation for blocking ports associated with the loop where incoming packets received at the blocked ports are discarded except for loop-probe packets. Further, the method includes operations for sending loop-probe packets by one or more network devices executing ndOS through one or more ports, and for unblocking a first port of the blocked ports based on the loop-probe packets when a lack of receipt of a loop-probe packet within a predetermined amount of time is detected for the first blocked port which indicates that the first blocked port is not part of the loop.

Abstract: A graphical user interface between a user of a computer service and the computer service includes a list of other users of the computer service selected by the user as significant to the user and an icon associated with one of the other listed users indicating that a communication has occurred between the user and the other user.

Abstract: A graphical user interface between a user of a computer service and the computer service includes a list of other users of the computer service selected by the user as significant to the user and an icon associated with one of the other listed users indicating that a communication has occurred between the user and the other user.

Abstract: An endpoint integrity system controls access to resources of a protected network for endpoint devices attempting to access the protected network. The system may include a number of evaluation modules that communicate with an endpoint device. The evaluation modules generate policy results for the endpoint device, in which each of the policy results assume one of three or more states, called a multi-state policy result. The multi-state policy results are combined to produce a combined Boolean policy result.

Abstract: A graphical user interface between a user of a computer service and the computer service includes a list of other users of the computer service selected by the user as significant to the user and an icon associated with one of the other listed users indicating that a communication has occurred between the user and the other user.

Abstract: A network switch includes ports, memory, and a processor. The switch is operable to switch packets of a layer 2 network, and the memory is for storing a tunneling engine computer program. The processor executes the tunneling engine, where the processor identifies a second switch operable to switch layer-2 network packets. The identification includes detecting that the second switch is connected to the network switch over a layer 3 connection, and the tunneling engine creates a tunnel over the layer 3 connection between the switches to exchange layer-2 packets. The tunnels encapsulates and decapsulates the packets that are exchanged between the switches. When the processor determines that a packet from a first node to a second node that is connected to the second switch, the processor creates an encapsulation flow on the network switch to encapsulate packets from the first node to the second node over the tunnel.

Abstract: A graphical user interface between a user of a computer service and the computer service includes a list of other users of the computer service selected by the user as significant to the user and an icon associated with one of the other listed users indicating that a communication has occurred between the user and the other user.

Abstract: A graphical user interface between a user of a computer service and the computer service includes a list of other users of the computer service selected by the user as significant to the user and an icon associated with one of the other listed users indicating that a communication has occurred between the user and the other user.

Abstract: A method may include authenticating a node over layer 2 in a network based on authentication rules; sending a node authentication code to the node; and providing layer 3 network access based on the node authentication code.

Abstract: An endpoint integrity system controls access to resources of a protected network for endpoint devices attempting to access the protected network. The system may include a number of evaluation modules that communicate with an endpoint device. The evaluation modules generate policy results for the endpoint device, in which each of the policy results assume one of three or more states, called a multi-state policy result. The multi-state policy results are combined to produce a combined Boolean policy result.

Abstract: A module may include interface logic to receive information identifying a state related to a client device via logic related to a controlled environment, and to send a valid policy result to a host device, where the valid policy result is related to the state. The module may include processing logic to process policy content according to a resource policy, where the processing is based on the information, and to produce the valid policy result based on the processing using the resource policy, where the valid policy result is adapted for use by the host device when implementing the network policy with respect to a destination device when the client device attempts to communicate with the destination device.

Abstract: An endpoint integrity system controls access to resources of a protected network for endpoint devices attempting to access the protected network. The system may include a number of evaluation modules that communicate with an endpoint device. The evaluation modules generate policy results for the endpoint device, in which each of the policy results assume one of three or more states, called a multi-state policy result. The multi-state policy results are combined to produce a combined Boolean policy result.

Abstract: A module may include interface logic to receive information identifying a state related to a client device via logic related to a controlled environment, and to send a valid policy result to a host device, where the valid policy result is related to the state. The module may include processing logic to process policy content according to a resource policy, where the processing is based on the information, and to produce the valid policy result based on the processing using the resource policy, where the valid policy result is adapted for use by the host device when implementing the network policy with respect to a destination device when the client device attempts to communicate with the destination device.

Abstract: A method may include authenticating a node over layer 2 in a network based on authentication rules; sending a node authentication code to the node; and providing layer 3 network access based on the node authentication code.

Abstract: A method may include authenticating a node over layer 2 in a network based on authentication rules; sending a node authentication code to the node; and providing layer 3 network access based on the node authentication code.

Abstract: A controller may receive a request from an endpoint and determine whether the endpoint connects via a first network or a second network. The controller may download first software to the endpoint when the endpoint connects via the first network, where the first software facilitates authentication of the endpoint via another device and instructs the endpoint to not store information regarding the controller. The controller may download second software to the endpoint when the endpoint connects via the second network, where the second software facilitates authentication of the endpoint by the device and instructs the endpoint to store information regarding the controller.

Abstract: An endpoint defense system uses endpoint health indicators and user identity information to provide fine-grain access control over network resources. For example, the endpoint defense system may include a controller, a set of protection devices, and a set of agents. The agents are software applications installed on a set of endpoints to gather the health information that represents security states of the endpoint devices. The agents send updated health information to the controller. In response to a login attempt, the controller processes the health indicators and identity information through a set of administrator-defined policies to generate a set of access rights. The controller transfers the set of access rights to the protection devices. The protection devices then control user access to network resources according to the set of access rights. The controller sends updated sets of access rights to the protection devices whenever the access rights change.

Abstract: A toolkit for developing user-interfaces for a system administration program. The toolkit has a server-side application-programming interface (API). The server-side has task-registry files that each describe a task group. The toolkit also has a client-side API. A developer can customize product-specific properties files for a specific product and write code that calls the server-side and client-side APIs to create a graphical user interface for the specific product.