Abstract: A method includes providing a library of hardware-agnostic packet-processing functions. A functional hardware-agnostic specification of a packet-processing pipeline, for use in a network device, is received from a user. The specification is defined in terms of one or more of the packet-processing functions draws from the library. A hardware-specific design of the packet-processing pipeline, which is suited to given hardware, is derived from the specification.

Abstract: A computing device which may include a programmable hardware device and a microcontroller to, based on a policy and parameters of a packet received by the programmable hardware device, program a rule in the programmable hardware device, the rule indicating how to process the packet.

Abstract: A classification apparatus includes a memory and a processor. The memory is configured to store rules corresponding to a corpus of rules in respective rule entries, each rule includes a respective set of unmasked bits having corresponding bit values, and at least some of the rules include masked bits. The rules in the corpus conform to respective Rule Patterns (RPs), each RP defining a respective sequence of masked and unmasked bits. The processor is configured to cluster the RPs, using a clustering criterion, into extended Rule Patterns (eRPs) associated with respective hash tables including buckets for storing rule entries. The clustering criterion aims to minimize an overall number of the eRPs while meeting a collision condition that depends on a specified maximal number of rule entries per bucket.

Abstract: Examples of methods, systems, and computer program products relating to supervising data in a wireless network are disclosed. At least part of a system may be located between a packet data network and a base station, and/or may be at least logically separate from the base station. The system may be capable of evaluating the service provided by the base station, and may be capable of determining whether or not any action should consequently be performed. Examples of an action may include an action which may not necessarily affect en-route data packets such as outputting a report, and/or an action which may affect en-route data packets such as delaying packets, not delaying packets, and/or stopping the delaying of packets. An action which affects data packets may or may not affect data packets uniformly. An action may or may not result in an improvement in quality of user experience.

Abstract: Described embodiments include a system that includes a network interface and a processor. The processor is configured to identify, via the network interface, a state of congestion in a communication channel between a base station belonging to a cellular network and a client device, to calculate, responsively to the state of congestion, a maximum sustainable encoding bit rate (MSEBR) for a video that is being downloaded by the client device, from a server, via the communication channel, the video being encoded at a plurality of different predefined bit rates, and to inhibit the client device, in response to calculating the MSEBR, from downloading a segment of the video that is encoded at any one of the predefined bit rates that exceeds the MSEBR. Other embodiments are also described.

Abstract: In one embodiment, a device includes an interface to send and receive packets of network flows, and processing circuitry to track a connection status of each of the network flows, selectively assign some network flows of the network flows having a non-terminated connection status to a flow aging process based on a statistical model of connection termination, operate the flow aging process to identify idle network flows of the some network flows, and release resources associated with the idle network flows.

Abstract: Examples of methods, systems, and computer program products relating to supervising data in a wireless network are disclosed. At least part of a system may be located between a packet data network and a base station, and/or may be at least logically separate from the base station. The system may be capable of evaluating the service provided by the base station, and may be capable of determining whether or not any action should consequently be performed. Examples of an action may include an action which may not necessarily affect en-route data packets such as outputting a report, and/or an action which may affect en-route data packets such as delaying packets, not delaying packets, and/or stopping the delaying of packets. An action which affects data packets may or may not affect data packets uniformly. An action may or may not result in an improvement in quality of user experience.

Abstract: A classification apparatus includes a memory and a processor. The memory is configured to store rules corresponding to a corpus of rules in respective rule entries, each rule includes a respective set of unmasked bits having corresponding bit values, and at least some of the rules include masked bits. The rules in the corpus conform to respective Rule Patterns (RPs), each RP defining a respective sequence of masked and unmasked bits. The processor is configured to cluster the RPs, using a clustering criterion, into extended Rule Patterns (eRPs) associated with respective hash tables including buckets for storing rule entries. The clustering criterion aims to minimize an overall number of the eRPs while meeting a collision condition that depends on a specified maximal number of rule entries per bucket.

Abstract: In one embodiment, a device includes an interface to send and receive packets of network flows, and processing circuitry to track a connection status of each of the network flows, selectively assign some network flows of the network flows having a non-terminated connection status to a flow aging process based on a statistical model of connection termination, operate the flow aging process to identify idle network flows of the some network flows, and release resources associated with the idle network flows.

Abstract: Described embodiments include a system that includes a network interface and a processor. The processor is configured to identify, via the network interface, a state of congestion in a communication channel between a base station belonging to a cellular network and a client device, to calculate, responsively to the state of congestion, a maximum sustainable encoding bit rate (MSEBR) for a video that is being downloaded by the client device, from a server, via the communication channel, the video being encoded at a plurality of different predefined bit rates, and to inhibit the client device, in response to calculating the MSEBR, from downloading a segment of the video that is encoded at any one of the predefined bit rates that exceeds the MSEBR. Other embodiments are also described.

Abstract: A processor is configured to receive, from a first device, a plurality of first-direction packets belonging to a flow of communication, pass the first-direction packets to a second device, receive, from the second device, a plurality of second-direction packets belonging to the flow, pass the second-direction packets to the first device, calculate, after receiving each of at least some of the second-direction packets, an estimated in-flight number, by assuming that the second-direction packet acknowledges receipt of a number of the first-direction packets that is based on an estimated average number of received first-direction packets acknowledged by the second-direction packets, the estimated in-flight number being an estimated volume of payload data, contained at least partly in the first-direction packets, that has been passed by the processor to the second device but has not yet been received by the second device, and to regulate the flow, based on the estimated in-flight number.

Abstract: A method includes monitoring a media stream that is streamed over a network at a given media bit-rate in a sequence of traffic bursts. Respective data volumes of one or more traffic bursts of the sequence are estimated, and the given media bit-rate is derived from the estimated data volumes.

Abstract: A device receives a packet from a local network. The packet may be directed toward a cloud computing resource. The device determines that the packet is associated with a new packet flow. In response to determining that the packet is associated with the new packet flow, the device provides one or more packets from the new packet flow to a machine learning model for packet inspection. The device receives an output from the machine learning model and routes the new packet flow based on the output received from the machine learning model. The output indicates whether or not the new packet flow is associated with a network attack.

Abstract: A method includes providing a library of hardware-agnostic packet-processing functions. A functional hardware-agnostic specification of a packet-processing pipeline, for use in a network device, is received from a user. The specification is defined in terms of one or more of the packet-processing functions draws from the library. A hardware-specific design of the packet-processing pipeline, which is suited to given hardware, is derived from the specification.

Abstract: A method includes monitoring a media stream that is streamed over a network at a given media bit-rate in a sequence of traffic bursts. Respective data volumes of one or more traffic bursts of the sequence are estimated, and the given media bit-rate is derived from the estimated data volumes.

Abstract: A processor is configured to receive, from a first device, a plurality of first-direction packets belonging to a flow of communication, pass the first-direction packets to a second device, receive, from the second device, a plurality of second-direction packets belonging to the flow, pass the second-direction packets to the first device, calculate, after receiving each of at least some of the second-direction packets, an estimated in-flight number, by assuming that the second-direction packet acknowledges receipt of a number of the first-direction packets that is based on an estimated average number of received first-direction packets acknowledged by the second-direction packets, the estimated in-flight number being an estimated volume of payload data, contained at least partly in the first-direction packets, that has been passed by the processor to the second device but has not yet been received by the second device, and to regulate the flow, based on the estimated in-flight number.

Abstract: A network device includes one or more communication ports, a packet processing circuit and an activity evaluation circuit. The one or more communication ports are configured to communicate packets over a network. The packet processing circuit is configured to process the packets. The activity evaluation circuit is configured to generate a sequence of multiple evaluation times independently of the packets, and, for each evaluation time among at least some of the evaluation times in the sequence, for any packet that is processed by the packet processing circuit at the evaluation time, to identify a session to which the packet belongs and issue an increment event associated with the identified session.

Abstract: A network device includes one or more communication ports, a packet processing circuit and an activity evaluation circuit. The one or more communication ports are configured to communicate packets over a network. The packet processing circuit is configured to process the packets. The activity evaluation circuit is configured to generate a sequence of multiple evaluation times independently of the packets, and, for each evaluation time among at least some of the evaluation times in the sequence, for any packet that is processed by the packet processing circuit at the evaluation time, to identify a session to which the packet belongs and issue an increment event associated with the identified session.

Abstract: A method includes monitoring a media stream that is streamed over a network at a given media bit-rate in a sequence of traffic bursts. Respective data volumes of one or more traffic bursts of the sequence are estimated, and the given media bit-rate is derived from the estimated data volumes.

Abstract: A method includes monitoring a media stream that is streamed over a network at a given media bit-rate in a sequence of traffic bursts. Respective data volumes of one or more traffic bursts of the sequence are estimated, and the given media bit-rate is derived from the estimated data volumes.