Abstract: Methods, systems and computer readable media for rogue access point detection are disclosed. In some implementations, the method can include initiating, at one or more processors of a wireless controller, a rogue access point detection process for a wireless network, and transmitting, from the one or more processors, a signature frame to a mobility agent in a wireless switch. The method can also include receiving, at an authorized access point, the signature frame transmitted via a wireless signal from a rogue access point. The method can further include reporting reception of the signature frame to the wireless controller, and generating, at the one or more processors, a signal to shut down a port associated with the rogue access point.

Abstract: A method, apparatus and computer program product for using Received Signal Strength Indicator (RSSI) filtering to provide air-time optimization in wireless networks is presented. At least one message is received at an Access Point (AP) from a mobile unit (MU). A determination is made by the AP whether a received Signal Strength indicator (RSSI) associated with the at least one message from an MU is greater than a predetermined threshold. When the RSSI value associated with the at least one message from na MU is greater than to said predetermined threshold, then a response is generated by the AP and sent to the MU.

Abstract: Methods, systems and computer readable media for predictive client VLAN extension are described. In some implementations, the method can include determining client movement within a wireless network domain. The method can also include predicting one or more next hop access points for the client. The method can further include extending a client network to the one or more next hop access points prior to the client roaming to the one or more next hop access points.

Abstract: Methods, systems and computer readable media for securing mDNS in enterprise networks are described. In some implementations, the method can include authorizing one or more service advertisements and validating one or more service advertisements. The method can also include adding one or more information details to a record associated with an advertised service.

Abstract: Some implementations can include a method including reserving a range of multicast addresses for handling link-local multicasts and generating a multicast group within the range for each VLAN. The method can also include subscribing at an access point to a corresponding multicast group for a VLAN when a client associates with the access point, and tunneling link local multicast traffic from the client to a WSP component via an access tunnel. The method can further include forwarding the link local multicast traffic from the WSP component to subscribing access points.

Abstract: Implementations relate to configuring wireless access points in a wireless network. In some implementations, a method includes selecting, from a plurality of wireless access points in a communication network, a configuring subset of wireless access points and a different compensating subset of wireless access points. New settings are applied to the compensating subset of wireless access points to change a physical coverage of wireless communication provided by the compensating subset, thus at least partially compensating for disabled wireless communication of the configuring subset. The method disables wireless communication provided by the configuring subset, and configures the disabled configuring subset of wireless access points.

Abstract: A method, apparatus and computer program product for providing seamless Internet Protocol multicast connectivity in unified networks is presented. The systems disclosed herein are able to transfer, from a designated (i.e., first) VLAN to a roaming (i.e., second) VLAN, a multicast stream from a multicast server in a mobility VLAN that is not available at the roaming VLAN. In operation, example embodiments of the present invention receive a report identifying a roaming mobile unit as a member of a first VLAN and forward the report to a first mobility switch in the first VLAN. The multicast stream is then received and forwarded toward the roaming mobile unit in the second VLAN so that transfer of the multicast stream from the first VLAN to the second VLAN is seamless.

Abstract: A method, system and computer readable medium for fast failover of an access point are described. A system can cause a failover of a first wireless access point when a wireless control point determines that a first wireless switching plane has failed through a platform link failure mechanism. The system can also prevent a failover of the first wireless access point or a second wireless access point when a message is received from both the first wireless switching plane and a second wireless switching plane indicating that the other wireless switching plane has failed.

Abstract: Methods, systems and computer readable media for rogue access point detection are disclosed. In some implementations, the method can include initiating, at one or more processors of a wireless controller, a rogue access point detection process for a wireless network, and transmitting, from the one or more processors, a signature frame to a mobility agent in a wireless switch. The method can also include receiving, at an authorized access point, the signature frame transmitted via a wireless signal from a rogue access point. The method can further include reporting reception of the signature frame to the wireless controller, and generating, at the one or more processors, a signal to shut down a port associated with the rogue access point.

Abstract: A split-plane mobility network architecture separates control and data plane operations typically encapsulated in a conventional wireless controller. Configurations provide a unified split-plane mobility switch that separates the data transport and switching in a separate hardware element, and performs control plane operations via exchanges with a centralized topology, rather than simply by adjacent switches within range. In contrast to conventional switch deployment, in which the same switch handles processing demands of the control plane and the data plane, the disclosed approach separates the data plane processing base by employing a mobility agent to define adjacent switch visibility. Thus, the routing capabilities of the data plane may be enhanced, such as to handle increasingly bandwidth-hungry applications of the same user base, without uprooting the infrastructure defined by the control plane.

Abstract: A method, apparatus and computer program product for providing wireless control plane failover handling in a split-plane deployment is presented. A first AP in a split-plane deployment detects failure of a Wireless Control Plane (WCP) device. The first AP hides an SSID in beacons broadcast by the first AP. The first AP stores information for existing Mobile Units (MUs) that dissociate after the detection of the failure of the WCP device. The first AP will respond to probes from existing MUs; and also respond to probes from MUs that have their information stored in the AP, such that the first AP appears hidden from new MUs while being exposed to existing MUs.

Abstract: A wireless access point employs monitor to scrutinize priority of mobility unit assigned priority values, and replaces invalid or reserved values to prevent rogue or poorly constructed applications (apps) from improper priority specification and subsequent imbalance of priority message transmission for control and other high-priority message traffic. The access point receives an indication of reserved message priorities from a wireless switching point at a remote end of an access tunnel providing backhaul network access to mobility units coupled to the access point. The access point stores the reserved message priorities for comparison with priorities assigned at the mobility units. Messages having invalid priorities are modified to reduce the priority to an allowed value, such as best effort, prior to the message transmission through the access tunnel to the backhaul network.

Abstract: A method, system and computer readable medium for fast failover of an access point are described. A system can cause a failover of a first wireless access point when a wireless control point determines that a first wireless switching plane has failed through a platform link failure mechanism. The system can also prevent a failover of the first wireless access point or a second wireless access point when a message is received from both the first wireless switching plane and a second wireless switching plane indicating that the other wireless switching plane has failed.

Abstract: A method, apparatus and computer program product for providing wireless control plane failover handling in a split-plane deployment is presented. A first AP in a split-plane deployment detects failure of a Wireless Control Plane (WCP) device. The first AP hides an SSID in beacons broadcast by the first AP. The first AP stores information for existing Mobile Units (MUs) that dissociate after the detection of the failure of the WCP device. The first AP will respond to probes from existing MUs; and also respond to probes from MUs that have their information stored in the AP, such that the first AP appears hidden from new MUs while being exposed to existing MUs.

Abstract: Methods, apparatus and a computer program product provide for a Tolerant License Manager that defines a cluster of a plurality of network controllers, wherein each respective network controller contributes at least one license to a current total amount of licenses in a license pool. The Tolerant License Manager identifies at least one threatened access point upon detecting a first network controller has become unavailable. Each threatened access point comprises any access point connected to the first network controller when the first network controller becomes unavailable. The Tolerant License Manager establishes (and/or) approves a connection between a back-up controller and the threatened access point(s). While the first network controller is unavailable, the Tolerant License Manager allocates a license to each threatened access point via the back-up network controller.

Abstract: In a mobility domain providing wired and wireless network transport to an enterprise or campus environment, a mobility switch maps a logical network identifier, such as a VLAN ID, to a “home” or wired network VLAN ID so that a mobile device is mapped to the wired VLAN for user identification, IP address consistency, and network policy enforcement. Propagation of the mapping to mobility switches ensures that a roaming user is mapped to the wired network VLAN from a remote L2 switch, and mobility tunnels across L3 boundaries allow roaming into a different broadcast domain or L3 switch connectivity in the mobility domain. Users are assigned to mobility VLAN(s) which are mapped to a VLAN in the wired domain at a mobility switch. The wireless users can roam within the wireless enterprise, or mobility domain, and the network maintains access to the user assigned mobility VLAN(s).

Abstract: A method, apparatus and computer program product for providing Virtual Local Area Network (VLAN) server redundancy is presented. A mobility switch (MS) advertises to at least one peer mobility switch, VLANs configured as server capable, the advertising including providing priority information relating to a server for the VLAN. The MS receives advertising from the at least one peer mobility switch and elects a server for a mobility VLAN which is not mapped locally. The MS maintains a current server and a list of alternative servers for the VLAN and determines when the MS looses connection with the current server for the VLAN and moves the VLAN to an alternate server contained on the list.

Abstract: A method, apparatus and computer program product for using Received Signal Strength Indicator (RSSI) filtering to provide air-time optimization in wireless networks is presented. At least one message is received at an Access Point (AP) from a mobile unit (MU). A determination is made by the AP whether a received Signal Strength indicator (RSSI) associated with the at least one message from an MU is greater than a predetermined threshold. When the RSSI value associated with the at least one message from na MU is greater than to said predetermined threshold, then a response is generated by the AP and sent to the MU.

Abstract: Techniques disclosed herein include systems and methods for providing a mechanism to enable smooth, seamless, and reliable connectivity for wireless devices in a unified network, such as networks that apply a given security policy to both wired and wireless devices. The system supports roaming of mobile units across mobility switches. A given mobile unit can retain its IP address in both intra-subnet and inter-subnet roaming scenarios. The given mobile unit also retains its membership to a mobility VLAN to which the mobile unit had been assigned, even during roaming scenarios. The system moves or propagates IP address to MAC address bindings from one network to another network within a mobility domain. As soon as a mobile user roams to another network, authentication information is readily available to enable immediate connection to the new network to begin sending and receiving data traffic. The mobile unit can be using either static IP addressing, or can dynamically acquire IP addresses through DHCP.

Abstract: Unified mobility switches often define a virtual LAN (VLAN), including a combination of mobility tunnels and access tunnels, via which packets are transported to a mobile device over a combination of physical connections and wireless links. A unified switch may have multiple ports available to route a packet to a particular destination, since the unified switches identify routing paths for both physical connections and VLANs. A particular unified switch may therefore have multiple routes to a common destination, which can lead to a routing loop across a network of switches supporting both physical and virtual connections. A unified mobility switch provides loop detection and prevention through a set of rules for qualifying connections as virtual tunnels or physical connections, and defining a single path where multiple potential paths exist.