Abstract: Methods and a device for changing the message size broadcast over a network and furthermore preventing fragmentation in networks are provided. The device intercepts a message transported across a network, wherein the message is sent from a data source to a data receiver and changes the message size. In addition, the device may use the methods to change the message size of data transmitted over a network thus reducing fragmentation. As a result, network devices such as classifiers preferably avoid re-assembling fragments. More specifically by reducing re-assembling, network devices like a classifier can react more quickly to applications requiring information found in both of an IP and TCP/UDP header.

Abstract: A system for load balancing, the system includes a LAC, a contact LNS, and a plurality of load balancing LNSs. The LAC includes a contact LNS address, the contact LNS address specifies the address of a contact LNS. The contact LNS is communicatively coupled to the LAC and the plurality of load balancing LNSs are communicatively coupled to the contact LNS and to the LAC. The LAC sends a message to the contact LNS, the message informing the LAC of its availability and the contact LNS sends a response message containing IP address of a selected one of the plurality of load balancing LNSs to which the LAC should establish a session.

Abstract: A system and methods are shown for traffic shaping and congestion avoidance in a computer network such as a data-over-cable network. A headend of the data-over-cable system includes a traffic shaper configured to calculate a packet arrival rate from a cable modem and a traffic conditioner configured to calculate an average queue size on an output interface to an external network. For example, the traffic shaper compares the packet arrival rate to three packet arrival thresholds including a committed rate threshold, a control rate threshold and a peak rate threshold. If the calculated packet arrival rate falls between the committed threshold and control rate threshold, the traffic shaper applies a link layer mechanism, such as a MAP bandwidth allocation mechanism, to lower the transmission rate from the cable modem.

Abstract: A system and methods for providing distributed and dynamic network services to remote access users. One of the methods includes providing a first certificate for requesting dynamic network services by a user network entity, and at least one second certificate for requesting static network services by the user network entity. According to one method, a user of the user network entity may generate a first message to request dynamic network services from a network service provider entity. For example, the first message may include the first certificate, a digital signature generated with a private encryption key associated with the first certificate and list of network service that the user wishes to set up dynamically.

Abstract: A system and method for transmitting information between a source host and a destination host. A source host generates a message and forwards the message via a label switched path to the destination host so that when a central routing module receives the message, the message includes a label. A central routing module establishes a local master mapping table including a plurality of physical addresses, and each of the plurality of physical addresses is associated with a unique identifier such as a label. When a switch egress module receives the message with the label, the switch egress module determines a physical address associated with the label, maps the physical address to the message, and forwards the message to the destination host associated with the label.

Abstract: An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.

Abstract: A method for determining the validity of an n-dimensional policy table in a router. The router may include a processor, a memory (e.g. ROM, flash memory, non-volatile memory, hard disk, etc.), and two or more policy rules stored in the memory. Each policy rule may have one or more dimensions (or parameters), designated generally by the symbol n. In accord with the method, the processor may make a determination whether any particular policy rule in the table intersects any subsequent policy rule in the table in every dimension n. If no rules in the table intersect in every dimension n, then the policy table is valid, and the router may operate normally.

Abstract: A system and method for processing packets of information includes an ingress module. The ingress module receives a plurality of packets of information from a first network. The ingress module determines the type of each of the plurality of packets. A route server module is coupled to the ingress module. The route server module sends a distributed processing request to the ingress module. The ingress module receives the distributed processing request and, responsively, performs a first set of processing operations on selected ones of the plurality of packets. The selected ones of the plurality of packets are of a first type. The ingress module forwards others of the plurality of packets of information to the route server module. Each of the others of the plurality of packets are of a type distinct from the first type.

Abstract: A mobile node may roam away from its home network to a foreign network. The mobile node may communicate using the Mobile Internet Protocol, and it may use Internet Protocol security to communicate with its home network. A foreign agent on the foreign network and a home agent on the home network may dynamically link a policy to be used for a Internet Protocol security session between the foreign agent and the home agent. The foreign agent and the home agent may dynamically create a filter to be used for the Internet Protocol Security session.

Abstract: A mobile node may roam away from its home network to a foreign network. The mobile node may communicate using the Mobile Internet Protocol, and it may use Internet Protocol security to communicate with its home network. A foreign agent on the foreign network and a home agent on the home network may dynamically link a policy to be used for a Internet Protocol security session between the foreign agent and the home agent. The foreign agent and the home agent may dynamically create a filter to be used for the Internet Protocol Security session.

Abstract: An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.

Abstract: A packet-forwarding device for providing policy-based services has at least a first interface, a second interface, and a packet forwarder for forwarding external packets between the first and second interfaces. The packet-forwarding device also runs internal applications that may be remotely accessed. The first and second interfaces transmit and receive internal and external packets, the internal packets being those packets generated or received by the internal applications during remote access, and the external packets being those packets destined for devices other than the packet-forwarding device. The packet forwarder forwards external packets between the first and second interfaces. An internal interface forwards internal packets between the internal applications and the first and second interfaces, and a policy engine logically connected to the internal interface applies a policy to the internal packets.

Abstract: A system and method is provided for transferring packet-switched data across a network. A network interface may be connected to a primary switch and a secondary switch, both of which may be connected to a network. The network interface may also convert between circuit-switched data and packet-switched data. Further, packet-switched data may be transferred between the network interface and the network across the primary switch if the primary switch is operable, and across the secondary switch if the primary switch is inoperable. The system and method may also include a selection switch, route server and controller. Additionally, the system and method may include a primary router and a secondary router. Packet-switched data may be transferred across the primary router if the primary router is operable, and across the secondary router if the primary router is inoperable.