Abstract: Techniques for separately accounting for multiple transactions in the same data packets communicated over a network using Transport Control Protocol (TCP) include receiving an Internet Protocol (IP) data packet that includes Transport Control Protocol (TCP) payload data. The TCP payload is parsed to determine boundary data that indicates a byte location on a boundary between a first transaction and a second transaction. A byte count that indicates a number of bytes in the TCP payload associated with the first transaction is determined based on the boundary data. Accounting data for the first transaction is determined based at least in part on the byte count. These techniques allow a service gateway to bill separately for different requests and responses carried in TCP data packets, such as those for Hypertext Transfer Protocol (HTTP) and Real Time Streaming Protocol (RTSP).

Abstract: A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

Abstract: A method of providing a network service is disclosed. The method includes implementing a forwarding agent on a router. The forwarding agent is operative to receive instructions from a service manager. Packets are forwarded from the forwarding agent to the service manager, and the forwarding agent receives instructions from the service manager detailing how to handle the forwarded packets.

Abstract: A system and method are described for providing instructions for forwarding packets. The method includes broadcasting a general instruction specifying a plurality of flows to a plurality of forwarding agents and receiving at a service manager a first message responsive to the general instruction indicating that a packet for a specific flow has been received by a specific forwarding agent. A specific instruction is generated at the service manager for handling the specific flow and the specific instruction for handling the specific flow is sent to the specific forwarding agent.

Abstract: A system and method are disclosed for specifying network address translation for a set of packets. A first set of instructions is sent to a forwarding agent specifying criteria for designated packets that are designated to undergo network address translation. A matching packet is received from the forwarding agent that matches the specified criteria. A network address translation scheme is determined for the matching packet. A second set of instructions are sent specifying the network address translation scheme for packets associated with the matching packet.

Abstract: An information service provider network includes a content gateway to process requests for information from a client terminal. The content gateway includes a router for receiving a request for information from the client terminal. The request includes a domain name and additional content. The router forwards the request according to the domain name to a selected one of a plurality of processors to further process the request. The selected one of the plurality of processors identifies an information source to satisfy the request in response to the additional content of the request.

Abstract: A system and method are described for selecting a server to handle a connection. The method includes receiving at a service manager a connection request intercepted by a network device having a forwarding agent that is operative to receive instructions from a service manager, the connection request having been forwarded from the forwarding agent on the network device to the service manager. A preferred server is selected at the service manager from among a group of available servers. The preferred server is the server that is to service the connection request. Instructions are sent from the service manager to the forwarding agent. The instructions include the preferred server that is to service the connection request so that the connection request may be forwarded from the network device to the preferred server.

Abstract: An information service provider network includes a content gateway to process requests for information from a client terminal. The content gateway includes a router for receiving a domain name server query from an originator associated with a request for information. The router including a database defining a relationship between domain names and addresses associated with accelerated servicing of requests. The router determines whether the domain name of the domain name server query is indexed in the database. The domain name is qualified in response to the domain name being in the database. If qualified, the router sends an address to the originator of the query corresponding in the database to the domain name. The address is to a processor associated with the router that performs accelerated services on the request.

Abstract: A system and method are described for selecting a server to handle a connection. The method includes receiving at a service manager a connection request intercepted by a network device having a forwarding agent that is operative to receive instructions from a service manager, the connection request having been forwarded from the forwarding agent on the network device to the service manager. A preferred server is selected at the service manager from among a group of available servers. The preferred server is the server that is to service the connection request. Instructions are sent from the service manager to the forwarding agent. The instructions include the preferred server that is to service the connection request so that the connection request may be forwarded from the network device to the preferred server.

Abstract: A method of obtaining instructions for routing a packet is described that includes receiving a packet having a packet flow identifier that includes a packet source IP address, a packet destination IP address, a packet source port, and a packet destination port and checking whether the packet flow identifier matches a stored instruction. If the packet flow identifier does not match a stored instruction, whether the packet flow identifier matches a stored criteria is checked and if the packet matches a stored criteria, the packet is forwarded to a service manager.

Abstract: A network is disclosed that includes a first tier of forwarding agents connected to a first tier of network devices. A second tier of forwarding agents is connected to a second tier of network devices. A service manager is configured to receive a packet from one of the forwarding agents; determine the tier of the forwarding agent; and send an instruction to the forwarding agent directing the forwarding agent to forward the packet to a network device connected to the tier of forwarding agents that includes the forwarding agent.

Abstract: An apparatus for managing network access is provided that includes a billing system element operable to receive one or more packets of a communication flow and to communicate with a price server. The price server is operable to receive a query from the billing system element associated with a pricing parameter relating to a data segment to be accessed by an end user associated with the communication flow. The price server is also operable to return a response to the billing system element that includes the pricing parameter relating to the data segment such that the end user can verify the pricing parameter before accessing the data segment.

Abstract: A forwarding agent is implemented on a router. The forwarding agent receives instructions from a service manager for redirecting packets that match the instructions. A packet is received that matches the instructions and the packet is redirected according to the instructions.

Abstract: A system and method are disclosed for controlling access to a server. Instructions are sent to a forwarding agent that instruct the forwarding agent to forward packets to a service manager from clients attempting to establish a client connection to the server. A client connection is established with the client. A server connection is established from the service manager to the server and data is transferred from the server connection to the client connection.

Abstract: A system and method for providing a network service is described. A fragment criteria is sent from a service manager to a forwarding agent that instructs the forwarding agent how to determine whether a received packet fragment at the forwarding agent matches the fragment criteria. A matching packet fragment is received from the forwarding agent at the fragment service manager. The fragment is assembled into a packet at the fragment service manager and in the event that the fragment completes the packet, a flow identifier specifying a flow is determined from the completed packet and completed packet is sent to a service manager that handles the flow specified in the flow identifier.

Abstract: A system and method are disclosed for providing a plurality of network services. The method includes receiving at a forwarding agent a plurality of matching instructions corresponding to a specified flow from one or more service managers and storing the plurality of matching instructions on the forwarding agent having a forwarding agent network interface. A packet for the specified flow at the forwarding agent is received on the forwarding agent network interface. A highest service priority matching instruction stored on the forwarding agent is determined. The packet is processed according to the highest priority matching instruction. A next highest service priority matching instruction stored on the forwarding agent is determined and the packet is processed according to the next highest service priority matching instruction.

Abstract: A system and method are disclosed for providing a network service. A first criteria specifying a first set of flows from a first service manager is received at a forwarding agent. The first criteria specifies an expiration time interval. The first criteria is stored on the forwarding agent. A second criteria is received that specifies a second set of flows from a second service manager at the forwarding agent. The second set of flows includes flows that are in the first set of flows and the second criteria is designated as a lower priority criteria. The second criteria is stored on the forwarding agent. The first criteria is deleted from the forwarding agent upon the expiration of the expiration time interval. A packet is received that belongs to a flow that is included in the first set and the second set. It is determined that the packet matches the second set ant the packet is forwarded to the second service manager.

Abstract: A system and method are disclosed for specifying network address translation for a set of packets. A first set of instructions is sent to a forwarding agent specifying criteria for designated packets that are designated to undergo network address translation. A matching packet is received from the forwarding agent that matches the specified criteria. A network address translation scheme is determined for the matching packet. A second set of instructions are sent specifying the network address translation scheme for packets associated with the matching packet.

Abstract: A system and method are described for partitioning a network service among a plurality of service managers. The method includes configuring a first service manager to send a first request to a forwarding agent for packets meeting a first criteria and sending the first request to the forwarding agent. A second service manager is configured to send requests to the forwarding agent for packets meeting a second criteria and the second request is sent to the forwarding agent. Packets are checked at the forwarding agent to determine whether the packets meet the first criteria or the second criteria and packets that meet the first criteria are received at the first service manager; and packets that meet the second criteria are received at the second service manager.

Abstract: A system and method are disclosed for providing a network service. The method includes storing at a forwarding agent a tag table. The tag table includes a list of tags and each tag specifies an interface and a destination. An instruction is received from a service manager specifying an overriding packet destination. The overriding packet destination is a destination that corresponds to a specific destination in a specific one of the tags. A packet is dispatched from the forwarding agent to the overriding packet destination using the specific one of the tags in response to the instruction from the service manager.