Abstract: Disclosed is an apparatus including an interchassis network having a plurality of network interface connections; an interchassis switch coupled to an egress communications system, the interchassis switch having an egress transmission capacity, the interchassis switch including a plurality of ingress transmission connections collectively having an ingress transmission capacity; and a controller, coupled to the plurality of network interface connections and to the interchassis switch, for controlling a maximum ingress transmission capacity of the interchassis switch. The method of controlling an ingress transmission capacity of an interchassis switch includes comparing the ingress transmission capacity to a threshold capacity; and controlling, using a controller external to the interchassis switch, the ingress transmission capacity responsive to the ingress transmission capacity comparing step.

Abstract: Disclosed is an apparatus including an interchassis network having a plurality of network interface connections; and an interchassis switch coupled to an egress communications system having an egress transmission capacity, a plurality of ingress transmission channels coupled to the plurality of network interface connections collectively having a potential ingress transmission capacity greater than the egress transmission capacity, and a capacity controller coupled to the plurality of ingress transmission channels for controlling an operational ingress capacity of the plurality of network interface connections. The method of controlling an ingress transmission capacity of an interchassis switch includes the steps of comparing the ingress transmission capacity to a threshold capacity; and controlling the ingress transmission capacity responsive to the ingress transmission capacity comparing step.

Abstract: A system and method in which network packets sharing a common destination are bundled into one or more larger packets. In one embodiment, an originating server, gateway, or other network device recognizes the presence of multiple, small IP packets having a common IP address. The network device according to the present invention is configured to concatenate or bundle two or more such small packets. The bundled packet as a whole is then given a new header, the bundle header, that includes the network destination address and information that informs the receiving protocol processing device that the packet is a bundled packet. The receiving device can then strip off the bundle header and process the component packets individually according to an existing protocol.

Abstract: A method and system for determining the connectivity of a virtual private network IP security (IPSec) tunnel between two network elements by originating a plurality of connection tests between the network elements. The first network element transmits a connectivity test message to the second network element over the secure tunnel upon receipt of an initiate connectivity test command. The secure tunnel includes two unidirectional tunnels. The second network element receives the connectivity test message over the first unidirectional secure tunnel and transmits a response back to the first network element over the second unidirectional secure tunnel. The number of successful responses received from the second network element are accumulated and the results are reported back to the source of the connectivity test command.

Abstract: A method and system for providing multilevel information about aspects of accounting. The method comprises the steps of generating a display, on a computer display screen, of a tree having a plurality of nodes, and embedding in the nodes multilevel information about said accounting aspects. For example, trees may be generated that represent credit, debit, revenue, expense, credit and/or debit plans, credit or debit thresholds, assets (cash, investments, receivables), inventory costing and control, short term and/or long term liabilities (stocks, bonds, mortgage notes), stockholders (equity, dividends, cost basis, restrictions, donations), working capital, cash flow (income statement, operations, earnings, forecast, historical data), customer data, manufacturing costs (processing, target), profit (product, division) taxes (income, sales, real estate, etc.). Information may be embedded with a matrix approach.

Abstract: An application specific integrated circuit (ASIC) is disclosed. The ASIC comprises a standard cell, the standard cell including a plurality of logic functions. The ASIC further includes at least one FPGA interconnect coupled to at least a portion of the logic functions. The FPGA interconnect can be configured to select a particular logic function of the plurality of logic functions. An ASIC in accordance with the present invention allows “field selection” of functions that are connected to the internal bus(es) and to external I/O. In addition, functional block connections made with internal buses can be significantly wider and faster than buses brought on chip via external chip I/Os. Further, the ASIC reduces cost because selective bus connections can be made internal to the chip, thus eliminating the need for external pins. Finally, the ASIC reduces the cost of the packaged component by allowing the chip to be packaged in a lower pin count package.

Abstract: A method and system for providing multilevel information about aspects of accounting. The method comprises the steps of generating a display, on a computer display screen, of a tree having a plurality of nodes, and embedding in the nodes multilevel information about said accounting aspects. For example, trees may be generated that represent credit, debit, revenue, expense, credit and/or debit plans, credit or debit thresholds, assets (cash, investments, receivables), inventory costing and control, short term and/or long term liabilities (stocks, bonds, mortgage notes), stockholders (equity, dividends, cost basis, restrictions, donations), working capital, cash flow (income statement, operations, earnings, forecast, historical data), customer data, manufacturing costs (processing, target), profit (product, division), taxes (income, sales, real estate, etc.). Information may be embedded with a matrix approach.

Abstract: A method and system for detecting attempted intrusions into a network, including: providing a network processor for monitoring packets transmitted over a communications link of the network; receiving a plurality of packets from the communications link by the network processor; and pre-filtering the plurality of packets by the network processor to identify packets potentially with patterns of interest. These packets are forwarded to a NIDS. The NIDS then examines the forwarded packets to identify the packets that have the pattern of interest. By using the network processor to pre-filter the packets, the number of packets examined by the NIDS is significantly reduced. Also, the capacity of the NIDS can be increased without requiring changes in the NIDS.

Abstract: An apparatus for performing complex pattern matching in a data stream within a computer network is disclosed. The apparatus includes a serial array register and a content-addressable memory (CAM). The CAM includes multiple CAM entries, and each of the CAM entries includes a k-byte pattern concatenated with an n-byte mask. The positions of the k-byte pattern and n-byte mask in each of the CAM entries offset from those in other CAM entries by one byte. Preferably, the k-byte pattern is each of the CAM entries represents a known computer virus pattern. After the capture of a data pattern from a data stream by the serial array register, the CAM register performs a comparison operation between the captured data pattern and all the CAM entries. If there is a match between the captured data pattern and one of the CAM entries, the CAM signals that the data stream contains information that are potentially harmful to the computer network.

Abstract: A method and system for providing multilevel information about multicast distribution. The method comprises the steps of generating a display, on a computer display screen, of a tree having a plurality of nodes, and embedding in the nodes information about the multicast distribution. The tree may display information about one or more of a variety of aspects of the multicast distribution. These aspects include display of the members of each of a plurality of particular multicast groups, group and/or member connectivity, group parameters, group statistics control, monitor and maintenance; acknowledge and/or operational status, etc. As a specific example, the nodes may represent capacities of a defined aspect. Displays may allow users having particular privileges to add, delete and/or modify nodes. Geometric shapes, having geometric aspects, may be used to represent the nodes; and the aspects of these shapes may be used to represent predetermined aspect of the multicast distribution.

Abstract: A network processor is disclosed. The network processor comprises a plurality of standard cells; and at least one field programmable gate array (FPGA) cell that can communicate with at least one of the standard cells. The at least one FPGA cell can provide a specified function based upon field programming techniques to allow for customization of the network processor. Utilizing a method and system in accordance with the present invention, a network processor can be customized to implement a variety of functions in hardware using embedded FPGA macros. The combined technology of ASIC standard cells plus FPGA cells enables fast time-to-market for new designs while optimizing cost and performance. In addition, the combined ASIC plus FPGA on a single die allows the chip developer to use proven standard cell macros for common logic and programmable cells for high-risk logic.

Abstract: A hardware function performed in the data link control layer first determines if a received frame is an IP frame requiring IPSec processing, and if it is, places the IPSec frame on a separate receive queue for subsequent inbound processing. The hardware function further determines if a frame to be transmitted is an IP frame requiring IPSec outbound processing, and if it is, places the IPSec frame on a separate transmit queue for subsequent outbound processing. To determine if an IP frame is an IPSec frame, the hardware function examines both the type field in the Medium Access Control (MAC) header and the protocol field in the IP header, both at the data link control layer. Once IPSec and non-IPSec traffic are separated at the data link layer into different receive or transmit queues, a hardware assist component processes the IPSec data frames in parallel with the processing of non-IPSec data frames by the processor in the network device.

Abstract: A method and system for monitoring the status of an active secure tunnel between a pair of network elements in a communications network. The first network element originates and transmits an Internet Protocol Security (IPSec) test message to a second network element using a first unidirectional secure tunnel in response to the receipt of an active tunnel monitor command. The second network element receives the IPSec test message and transmits a response back to the first network element using a second unidirectional secure tunnel. The number of times that second network element failed to return a response to an IPSec test message is accumulated during a predetermined time interval and then compared with a threshold value to determine if the active secure tunnel has become disabled.

Abstract: An application specific integrated circuit (ASIC) is disclosed. The ASIC includes a standard cell, the standard cell including a plurality of logic functions. The ASIC also includes an input/output (I/O) configuration function coupled to at least a portion of the logic functions. The ASIC further includes a field programmable gate array (FPGA) function coupled to the I/O configuration function. The FPGA function controls the I/O configuration function based upon a configuration file. A system in accordance with the present invention reduces the cost and time associated with the timing analysis activities during development. An FPGA function within the ASIC is utilized to control the I/O characteristics such as delay, termination and/or slew rate for the I/O pin mapping. Different I/O configurations will be provided by the FPGA function depending on the environment the ASIC is used in.

Abstract: A method and system for providing multilevel information about aspects of business. The method comprises the steps of generating a display, on a computer display screen, of a tree having a plurality of nodes, and embedding in the nodes information about said business aspects. For example, trees may be generated that provide information about arranging, performing, monitoring, maintaining and controlling a business. Information may be embedded with a matrix approach. As examples, matrices may be used that provide information about business models, business expansion capabilities, business short and long term predictions, business competitor data, comparison and differences, business histograms and predictors, business responsible entities, division, product, entity business plans, reporting and results, and business alarm functions.

Abstract: A network processor is used for the routing of objects in non-data networking applications. The processor utilizes the Open Shortest Path First (OSPF) algorithm to capitalize on the benefits of data control for object traffic control and costs. A network processor is used at each point in a grid represented by intersecting paths. One or more routing tables are embedded in each network processor. Each routing table describes links with other network processors in the grid to which the network processor is interconnected. A cost factor is associated with each link and is constantly updated by the OSPF as new information becomes available. If a link or route becomes unavailable, the cost is set at infinity. The system then creates an alternative path for the object between a source and the desired destination that bypasses the unavailable link or route.

Abstract: A method, system and computer program product for detecting the dissemination of malicious programs. The degree of randomness in the Internet Protocol (IP) destination addresses of received IP packets to be forwarded to an external network may be detected by performing a hash function on the IP destination addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets examined, then random IP destination addresses may be detected. By detecting random destination IP addresses, the dissemination of a malicious program, e.g., virus, worm program, may be detected.

Abstract: An integrated circuit comprising a standard cell is disclosed. The standard cell includes a plurality of logic functions; at least a portion of the logic functions requiring initialization. The circuit includes a field programmable gate array (FPGA) cell coupled to the at least a portion of the plurality of logic functions. The at least a portion of the plurality of logic functions are initialized by the FPGA cell. In a method and system in accordance with the present invention, an on-chip Field Programmable Gate Array (FPGA) cell is configured to implement the required application-specific function initializations. The FPGA cell could be wired directly to each of the registers within the functional blocks requiring initialization. These registers would also be wired to the processor bus allowing software access for normal operation after initialization.

Abstract: An application specific integrated circuit (ASIC) is disclosed. The ASIC comprises a standard cell, the standard cell including a plurality of logic functions. The ASIC further includes at least one FPGA interconnect coupled to at least a portion of the logic functions. The FPGA interconnect can be configured to select a particular logic function of the plurality of logic functions. An ASIC in accordance with the present invention allows “field selection” of functions that are connected to the internal bus(es) and to external I/O. In addition, functional block connections made with internal buses can be significantly wider and faster than buses brought on chip via external chip I/Os. Further, the ASIC reduces cost because selective bus connections can be made internal to the chip, thus eliminating the need for external pins. Finally, the ASIC reduces the cost of the packaged component by allowing the chip to be packaged in a lower pin count package.

Abstract: An integrated circuit comprising a standard cell is disclosed. The standard cell includes a plurality of logic functions; at least a portion of the logic functions requiring initialization. The circuit includes a field programmable gate array (FPGA) cell coupled to the at least a portion of the plurality of logic functions. The at least a portion of the plurality of logic functions are initialized by the FPGA cell. In a method and system in accordance with the present invention, an on-chip Field Programmable Gate Array (FPGA) cell is configured to implement the required application-specific function initializations. The FPGA cell could be wired directly to each of the registers within the functional blocks requiring initialization. These registers would also be wired to the processor bus allowing software access for normal operation after initialization.