Abstract: Detecting anomalous network activity through transformation of a terrain is disclosed. A set of network properties is mapped into a multidimensional terrain. The terrain is transformed into an observation domain in which data events of interest are amplified relative to other data comprising the terrain. The transformed terrain is evaluated for anomalous network activity.

Abstract: Apparatus are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a router includes a subscriber manager, a database and a virtual interface. The subscriber manager is operable to receive a connection request from a subscriber of a service provider. The database has stored therein hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected to the service provider by (i) explicitly defining the subscriber services or (ii) referring to one or more of the plurality of lower-level profile identifiers.

Abstract: The disclosed system and method allow secure packet transmission to be provided with a minimum amount of overhead and to employ a cache having copies distributed among a plurality of different locations. SSL/TLS session information for a session with each of the proxy servers is stored in the cache so that it is accessible to at least one other proxy server. Using this arrangement, when a client computer switches from a connection with a first proxy server to a connection with a second proxy server, the second proxy server can retrieve SSL/TLS session information from the cache corresponding to the SSL/TLS communication session between the client device and the first proxy server. The second proxy server can then use the retrieved SSL/TLS session information to accept a session with the client device.

Abstract: Methods and products are disclosed for analyzing network traffic using an improved Markov Modulated Poisson Process Model with one bursty state and a plurality of idle states that include: establishing a time scale of operation for each state in the improved MMPP model; establishing a transition value for each state in dependence upon the time scale of operation for the state; measuring inter-arrival times between individual packets received in one or more network adapters; and determining a current state for the network traffic independence upon the measured inter-arrival time of a most recently received packet and the transition values.

Abstract: The invention provides a leaky-bucket method for delivering packets from a first node (A) to a second node (B) in a packet switched network, comprising the steps of: receiving at the first node (A) of at least one transmission comprising buffered packets, and at least one transmission comprising real-time packets; transmitting the received packets to the second node (B) and increase a bucket counter for the bucket, which bucket has a leak rate that is equal to or larger than the byte transmitting ratio of the real-time packets.

Abstract: A storage switch in accordance with an embodiment of the invention is a highly scalable switch that allows the creation of a SAN that is easy to deploy and that can be centrally managed. Moreover, such a storage switch also allows the deployment of a global infrastructure, allowing the resources of the SAN, such as storage devices, to essentially be positioned anywhere on the globe. Further, such a storage switch allows a multi-protocol SAN, e.g., one that includes both iSCSI or Fibre Channel, and processes data packets at “wire speed.” To further enable wire-speed processing, a switch in accordance with the invention has “intelligence” distributed to each of its linecards, through which it classifies packets into data and control packets, it performs virtualization functions, and it performs protocol translation functions. A switch in accordance with the invention further performs serverless storage services such as mirroring, snapshot, and replication.

Abstract: A method is provided for generating a feasible schedule for n jobs given a duration and a revisit time for each job. The method comprises determining whether it is impossible to generate a feasible schedule, determining whether a round robin schedule is possible, calculating theoretical probabilities, calculating actual probabilities, creating a potential schedule based on the theoretical probabilities and the actual probabilities, and searching for a feasible schedule from the potential schedule.

Abstract: A network flow control system utilizes flow-aware pause frames that identify a specific virtual stream to pause. Special codes may be utilized to interrupt a frame being transmitted to insert a pause frame without waiting for frame boundaries.

Abstract: Quality of Service (QoS) is provided to a secure data tunnel such an an IPsec tunnel using information about the tunnel and the underlying data session to formulate a set of bandwidth requirements. A policy server operates to receive the information to create the set of bandwidth requirements which are enforced by a termination device. The termination device sets the bandwidths. QoS can be provided on a static or continuous basis. QoS can be provided on a dynamic basis. QoS can be provided at different levels depending on the type of data session. Multiple QoS can be provided for multiple data sessions existing simultaneously using multiple SSIDs.

Abstract: The present invention provides methods and devices for implementing a Low Latency Ethernet (“LLE”) solution, also referred to herein as a Data Center Ethernet (“DCE”) solution, which simplifies the connectivity of data centers and provides a high bandwidth, low latency network for carrying Ethernet and storage traffic. Some aspects of the invention involve transforming FC frames into a format suitable for transport on an Ethernet. Some preferred implementations of the invention implement multiple virtual lanes (“VLs”) in a single physical connection of a data center or similar network. Some VLs are “drop” VLs, with Ethernet-like behavior, and others are “no-drop” lanes with FC-like behavior. Some preferred implementations of the invention provide guaranteed bandwidth based on credits and VL. Active buffer management allows for both high reliability and low latency while using small frame buffers. Preferably, the rules for active buffer management are different for drop and no drop VLs.

Abstract: A method and device for identifying degradation in service quality for a wireless media service. The wireless media service has a known expected packet generation rate, which may be determined by the device based upon the codec and payload size selected on initiating the media service. At a receiving device, the packets actually received by the device from the other termination point are counted over a time period, and this number is compared with the number of packets that were expected based upon the known packet generation rate. From this comparison a packet loss rate may be determined. If the packet loss rate exceeds a threshold level, then the device may issue a user alert, terminate the service, or take other action. The threshold level may be established based upon a packet loss rate corresponding to a significant degree of service quality degradation.

Abstract: A method for performing admission control in order to offer assurances on forwarding quality in networks comprising setting a threshold for each link where the threshold defines a maximum sum of forwarding resources requested by applications for their application data flows, ADFs, on the link. The level of the threshold is chosen by utilising knowledge about multiplexing properties of the ADFs on each link and by utilising knowledge about the forwarding resources of the links.

Abstract: A method for bandwidth allocation for delivery of multimedia data from at least one server to one or more clients over a network. The method includes the steps of: determining a maximum flow rate and a minimum flow rate for each client; determining a flow rate range for each client as given by the difference between the maximum flow rate and the minimum flow rate; sorting the one or more clients according to the flow rate range; initializing a current flow rate for each client as the minimum flow rate and summing the flow rate into total server flow rate; establishing remaining server bandwidth; and allocating the remaining server bandwidth to clients, based upon the sorted client's flow rate ranges.

Abstract: The present invention is directed to obtain a statistic multiplexing effect in an image transmission system using terminals stipulated by H.310 of an ITU-T recommendation. In a network including a first local area ATM network, a second local area ATM network and a public ATM network connected to the first and second ATM local area networks, multiplex gateway devices are interposed between the local area ATM networks and the public ATM network, respectively. The multiplex gateway apparatus includes ATM transmission line units 21 to 23 for calculating statistic information represented by a mean rate and a peak cell rate of ATM cells in the transmission ATM signal. A statistic multiplexing control unit 24 conducts rate addition after statistic multiplexing according to the statistic information and determines the rate addition result.

Abstract: Congestion is adaptively controlled in a data center Ethernet (DCE) network. Packets are received over at least one virtual lane in the DCE network. An absolute or relative packet arrival rate is computed over a time period. The absolute or relative packet arrival rate is compared to at least a first threshold and a second threshold. If the absolute or relative packet arrival rate increases beyond the first threshold, the packet transmission rate is caused to decrease. If the absolute or relative packet arrival rate is less than a second threshold, the packet transmission rate is caused to increase.

Abstract: Various embodiments of a network protocol that utilizes a congestion control algorithm that distinguishes between congestion loss and damage loss are described. In response to a packet loss on a network, a delay-based detection algorithm may be performed based on RTT (Round-Trip Time) information to determine whether the network is congested. If the delay-based detection algorithm does not determine that the network is congested then a consistency-based detection algorithm may be performed based on packet loss rate information. If either the delay-based detection algorithm or the consistency-based detection algorithm determine that the network is congested then the rate of data transmission may be reduced, e.g., by reducing a congestion window size.

Abstract: A method to promote connectivity between a user agent (UA) and a packet data network (PDN) is provided. The method comprises determining a quality of service class identifier (QCI) to associate with a service data flow, determining a sense of change in at least one of a priority, a packet delay budget, and a packet error loss rate of the QCI to associate with the service data flow, and sending a request to establish a service data flow treatment, the request comprising the QCI and a QCI extension encapsulating the sense of change of the QCI.

Abstract: The present invention relates to the field of mobile communication, including method, apparatus and system for implementing IuUp/NBUP procedure control. The method includes parsing a received UP frame; generating a control message based on a value obtained from the parsing, and buffering the control message; executing the buffered control message. When multiple time alignment or rate control messages are received, the dropping or suspending of the later received messages due to the execution of a control message may be avoided; by way of setting the state of the message and adding a message identification, the successive rate adjustment procedure may be optimized. The method according to an embodiment of the present invention is capable of originating a rate or time adjustment initiatively. The present invention also discloses an apparatus and system for implementing IuUp/NBUP procedure control, with a good good extensibility, which improves the response efficiency of the system.

Abstract: Methods and apparatus for managing subscriber profiles are described herein. In one embodiment, the method includes receiving, from a requester, a request to determine an operation to be performed on a data packet. The method also includes determining profile identifiers associated with the requester, wherein the profile identifiers include, a first-level profile identifier associated with a lower-level profile identifier that defines the operation. The method also includes determining, based on the profile identifiers, that the operation should be performed on the data packet and transmitting an indication of the operation to the requestor, wherein the requestor performs the operation on the data packet.

Abstract: A method involving a mode for detecting the protocol implemented within and by a portable object. After transmission of a response upon turning on the portable object, an initial signal is received from the interface device. The initial signal is sampled according to at least one of the first and second speeds associated with the first and second respective protocols. In the portable object, at least one sample of a resulting sampling signal is compared to at least one key protocol condition proper to one of the first and second protocols. According to the result of the comparison, the data exchanged according to one of the first or second communication protocols is processed in the portable object.

Abstract: This invention provides a tool for reliability evaluation and performance analysis of an IP backbone network by using the network packet loss ratio as the main measurement. A queuing model and algorithm is presented for calculating packet loss at congested interfaces or links. A reliability model is presented for considering network hardware component failures such as router failures, ATM switch failures, and physical link failures. Based on the measurement and models presented, a network reliability and performance (NetRAP) apparatus calculates IP network reliability and performance measurements. The NetRAP apparatus uses the network topology, a traffic matrix, and the reliability parameters of a network as inputs and calculates the network packet loss ratio and sigma score, and provides a list of heavily congested links under non-failure or different single failure conditions.

Abstract: An improvement for a phasor fragmentation engine and method, whereby a phasor flipping algorithm is applied when determining fragment phasors for a non-constant envelope modulation signal (e.g. OFDM). The phasor flipping algorithm avoids sharp phase transitions for the fragment phasors, which cause an increase in bandwidth, by performing a comparison of the phasor angle separation between the prior and current time samples. This comparison corresponds to a determination of whether the modulation signal V has passed near or through zero.

Abstract: A method and device for identifying degradation in service quality for a wireless media service. The wireless media service has a known expected packet generation rate, which may be determined by the device based upon the codec and payload size selected on initiating the media service. At a receiving device, the packets actually received by the device from the other termination point are counted over a time period, and this number is compared with the number of packets that were expected based upon the known packet generation rate. From this comparison a packet loss rate may be determined. If the packet loss rate exceeds a threshold level, then the device may issue a user alert, terminate the service, or take other action. The threshold level may be established based upon a packet loss rate corresponding to a significant degree of service quality degradation.

Abstract: A system for the assessment of network performance criteria, and applying this criteria to the classification of network addresses into appropriate ranges, using these ranges to consolidate performance measurements for the associated addresses, and applying these metrics toward the optimization of the network towards performance or policy objectives.

Abstract: The present invention is directed to using measurement packets to compute network performance. Embodiments that send, receive and both send and receive measurement packets are described. Some embodiments are described that compute statistics based at least partly on measurement traffic. Some embodiments are described that communicate computed statistics within measurement traffic. Some embodiments are described that rank and select paths based at least partly on computed statistics.

Abstract: Systems and methods for optimizing usage of an available bandwidth for VoIP communications include a communications system, such as the Internet, for carrying the VoIP communication signals. A switch and a bandwidth limiter connected to the switch restrict bandwidth usage by applications other than those required for the VoIP communications. In the system, a modem or other narrowband network interface, a router, a network adapter, and a VoIP element are housed as a unit. The switch turns “on” and “off” the bandwidth limiter, and the bandwidth limiter when “on” restricts bandwidth usage of the adapter. The communications system is a digital data network, and the modem accesses the digital data network via connection of the modem to the network. Features for emergency bypass and external power supplies are included.

Abstract: A sketch-based change detection technique is introduced for anomaly detection. The technique is capable of detecting significant changes in massive data streams with a large number of network time series. As part of the technique, we designed a variant of the sketch data structure, called k-ary sketch, uses a constant, small amount of memory, and has constant per-record update and reconstruction cost. A variety of time series forecast models are implemented on top of such summaries and detect significant changes by looking for flows with large forecast errors. Heuristics for automatically configuring the forecast model parameters are presented. Real Internet traffic data is used to demonstrate and validate the effectiveness of sketch-based change detection method for utilization as a building block for network anomaly detection and traffic measurement in large computer networks.

Abstract: Disclosed is an apparatus and method for granting guaranteed bandwidth between one or more data transmission priority requesting sources and one or more resources upon request. Data sources that do not request an assigned bandwidth are served on a “best efforts” basis. The system allows additional bandwidth to priority requesting sources when it is determined that the resource and/or the communication path to the resource is under-utilized. The system further allows the granted bandwidth to be shared by more than one source in a multiprocessor system.

Abstract: A method and apparatus for analyzing traffic arriving at and/or departing from a traffic aggregate defined as a given IP-related protocol, a given port associated with a given protocol, an IP address or subset of IP addresses, or by other traffic aggregation, during a given time interval, to determine whether there is a significant increase or decrease in traffic aggregate's traffic volume as compared to the traffic aggregate's expected traffic volume are disclosed. In one embodiment, the present method defines a traffic share ratio threshold associated with a given protocol or a given protocol port or a given IP address or a given subset of IP addresses or other traffic aggregation using said collected volumetric traffic data. The present method also defines a current traffic share, a baseline traffic share and a traffic share ratio to be evaluated for the said traffic aggregate.

Abstract: A method for sharing an aggregate bandwidth among a group of traffic classes may include allocating a portion of the aggregate bandwidth to one of the group of traffic classes having a first priority associated therewith, where the allocated portion is referred to as a first bandwidth. The method may include allocating an unused portion of the aggregate bandwidth to a second one of the group of traffic classes having a second priority associated therewith in conjunction with a parameter associated with a downstream device.

Abstract: The invention provides an ATM switch which realizes hierarchical shaping for each virtual channel and each virtual path with a simple configuration. Cells are sent from cell buffers of an ATM core switch by FIFO operation to output side connection information application sections of output side circuit interfaces. In each of the output side circuit interfaces, the output side connection information application section acquires connection information such as a service class based on an intra-switch connection identification number applied to each cell and applies the connection information to the cell. An output cell buffer queues cells for each virtual channel. A VC cell rate control section reads out cells from the output cell buffer in accordance with the connection information and performs traffic priority control and rate control of the cells to be outputted.

Abstract: An ATM network traffic shaper is implemented in hardware. The traffic shaper shapes transmit data on one or more virtual circuits (VCs) according to the specified quality of service (QoS) parameters. Thus, the traffic shaper provides for the delivery of associated data cells in accordance with the specified QoS parameters. The traffic shaper is scalable in that the number of supported VCs can be increased with a relatively small increase in the size of the device and associated logic gates. The traffic shaper supports constant bit rate (CBR), variable bit rate (VBR), and unknown bit rate (UBR) service types and generates cell transmit requests with zero cell delay variation (CDVT). The traffic shaper also provides very high resolution in terms of bit rate specification. Varying shaping resolutions are achieved by varying a shaping interval time (SIT) generated by a SIT counter.

Abstract: A data flow rate policer enforces data flow policies for a number of data flows using a probabilistic policy enforcement mechanism. The policer includes a memory that stores the state of each data flow in a compact data structure. Additionally, the policer includes one or more policing engines that implement the actual data flow policies based on information derived from the data structures. The policing engines may be implemented in hardware to increase performance.

Abstract: An apparatus and method for dynamic assignment of classes of traffic to a priority queue. Bandwidth consumption by one or more types of packet traffic received in the packet forwarding device is monitored to determine whether the bandwidth consumption exceeds a threshold. If the bandwidth consumption exceeds the threshold, assignment of at least one type of packet traffic of the one or more types of packet traffic is changed from a queue having a first priority to a queue having a second priority.

Abstract: A technique for estimating the upstream bandwidth for a modem is provided. Various-sized packets are sent on roundtrip journeys through the modem. The roundtrip times for the various-sized packets are compared to provide an estimate of the modem's upstream bandwidth. Alternatively, a block file may be transmitted through the modem to a TFTP server. The TFTP server reports the time needed to complete the file transfer. Based upon the block file transmission start time and the completion time, an upstream bandwidth estimate may be performed. Given the upstream bandwidth estimation, non-VoIP upstream data traffic may be limited accordingly to provide a desired QoS to VoIP calls being supported by the modem.

Abstract: Dynamic rate limiting of background traffic to alleviate congestion in the access network is enabled. ICMP echo round-trip times and ICMP losses to a nearby node outside the local area and just beyond the divergence in end-to-end paths are measured, allowing unambiguous discrimination of nearby from distant congestion points. Using round-trip time samples, either short-run delay or short-run variance in delay can be measured to estimate congestion. When combined with an appropriate control law, background traffic can be rapidly reduced to allow interactive traffic to traverse unhindered through the access network. The described system and methods can be implemented in the application-layer and without any additional support from the network.

Abstract: According to the invention, a content delivery network (CDN) for delivering content objects over the Internet is disclosed. The CDN includes a point of presence (POP), a content object request interface, and a routing function. At least one POP is coupled to a plurality of full-route networks. The content object request interface receives requests for content objects for delivery to a number of end users using a plurality of terminal networks. The routing function that routes content objects in at least two modes, where a first mode routes content objects based upon a first route path chosen based upon delivery efficiency, and a second mode routes at least some content objects using a second route path when at least of a portion of the first route path reaches a level of use. The first and second route paths egress to different full-route networks.

Abstract: In a communication system, transmission/reception of data can be performed between end hosts connected to a relay switch in a subnet even in an improper connection at a L2 level in the relay switch in a communication. Communication failure due to a packet loop generated by the improper connection of the L2 level is recovered by wherein the packet loop is stopped by continuously transmitting long-size MAC packets longer than a packet generating the packet loop into the subnet, which have destinations as a broadcast MAC address or multicast MAC address.

Abstract: The invention includes a method for determining a window size for a connection. One method according to the invention includes determining a peak information rate for the connection, determining a round trip time for the connection, and determining the window size using the peak information rate and the round trip time. Another method includes determining a token bucket size of a token bucket in response to detecting a condition associated with the token bucket and determining the window size using the token bucket size. Another method includes determining a plurality of connection window sizes for each of a plurality of connections. In this embodiment, the connection window sizes are determined by distributing a total window size across the plurality of connections. A determined window size may be communicated to at least one of a sender of the connection, a receiver of the connection, and a policing module.

Abstract: A method for scheduling channel usage for an over-the-air (“wireless”) network downlink is described. Information associated with incoming traffic and outgoing traffic to a node as associated with user equipment is obtained. The user equipment is capable of establishing a communication link with the node. The information obtained is placed in respective queues, which are each associated with the user equipment. A count level of the queues is obtained. An interval rate for the incoming traffic is determined. A receive rate for the user equipment is obtained. An incoming average rate for the incoming traffic is determined. An outgoing average rate for the outgoing traffic is determined. A proportion value is generated responsive to the incoming average rate, the outgoing average rate, the receive rate, and the interval rate.

Abstract: In one illustrative scanning and decoding method, a signal strength level of an RF signal on an RF channel is measured for a plurality of RF channels of an RF band. The act of measuring a signal strength level is repeated at least one time to obtain at least one other signal strength level of the RF signal. Subsequently, an averaging function is completed with use of the signal strength level and the at least one other signal strength level for identifying an averaged signal strength level of the RF signal. At least one optimal RF signal is then identified based on the averaged signal strength levels of the RF signals on the RF channels. In between the repeated acts of measuring signal strength levels of the RF signals, and prior to identifying the averaged signal strength levels, control information is decoded on at least one of the RF channels and stored in memory.

Abstract: Methods and apparatus are provided for applying color based policing at a network node. Committed information rate (CIR) and peak information rate (PIR) buckets used to monitor transmission rates are augmented using CIR overflow and PIR overflow buckets. The CIR and PIR overflow buckets hold tokens provided to CIR and PIR buckets that exceed the associated burst limits. Based on the availability of tokens and the color associated with a received packet, an action can be applied to the packet that promotes the color associated with the packet.

Abstract: The present invention provides a system and method for establishing a data transmission rate in a communication network for data transmission from a first communication module to a second communication module. Generally, the method comprises: (a) reading at the first module a predetermined data reception rate limit of the second module; and (b) for the data at the first module to be transmitted to the second module, establishing a first module data transmission rate in dependence upon the predetermined data reception rate limit read in step (a).

Abstract: A system for protocol processing in a computer network has an intelligent network interface card (INIC) or communication processing device (CPD) associated with a host computer. The INIC provides a fast-path that avoids protocol processing for most large multi-packet messages, greatly accelerating data communication. The INIC also assists the host for those message packets that are chosen for processing by host software layers. A communication control block for a message is defined that allows DMA controllers of the INIC to move data, free of headers, directly to or from a destination or source in the host. The context is stored in the INIC as a communication control block (CCB) that can be passed back to the host for message processing by the host. The INIC contains specialized hardware circuits that are much faster at their specific tasks than a general purpose CPU.

Abstract: A method and apparatus are described for controlling connection admission for a connection request in a network. A first estimator estimates an equivalent cell rate (ECR) based on description of the connection request. The description includes a booking factor. A second estimator estimates a measured utilization factor for admitted connections in the network using measurements of data streams arriving at queues. A controller is coupled to the first and second estimators to generate an admission decision for the connection request based on the estimated ECR and the estimated measured utilization factor.

Abstract: A method and system for providing acknowledgment and/or data rate control (DRC) information with respect to data packets conveyed on a plurality of active forward link (FL) carriers. The number of reverse link (RL) carriers employed for the acknowledgment and/or DRC information may be less than the number of active FL carriers, and may be a single carrier, even when the signaling protocol is, in the limit, consistent with presently-supported standardized CDMA protocols. Code multiplexing techniques are employed inventively to convey information for up to fifteen FL carriers on a single, standard CDMA channel designed to provide such signaling for only a single FL carrier at a time.

Abstract: A channel merging method for a VOD system, said method comprises the steps of: in response to requests from a plurality of clients for a video program, establishing a root channel (S1) and at least one sub-channel (S11), said root channel (S1) being established according to a request from a client that makes the earliest request, each of said sub-channels (S11) being established in response to a request from a client that makes a later request; and monitoring variation of the number of the clients that are using each of said established channels, and maintaining the channel if the number of the clients using the monitored channel is not zero, and closing the channel if the number of the clients using the monitored channel becomes zero.

Abstract: Method for admitting new voice calls to a VoIP network. Various points in the network are polled to generate a link utilization parameter. Parameters denoting threshold values of link utilization in the network are compared to the link utilization parameter. A first comparison is made between a first (current) link utilization parameter and first and second link utilization threshold parameters. Then, a second comparison is made between the current link utilization parameter and a second (previous) value of link utilization. A calculation of new calls allowed into the network is performed based on these comparisons and whether the current level of link utilization is rising or falling when compared to a previous level of link utilization.

Abstract: A method for use in a network device that uses a proportional/integral/derivative (PID)-type algorithm to compute one or more flow control parameters intended to achieve a target rate for a data flow.

Abstract: A method of calibrating automatic test equipment (ATE) having transmission paths that transport signals includes obtaining amplitude gains of the signals across the transmission paths, obtaining phase delays of the signals across the transmission paths, obtaining magnitude and phase offsets associated with the signals based on the amplitude gains and the phase delays, and calibrating the ATE using the magnitude and phase offsets.