Abstract: A data processing system may include a plurality of host servers, each server including a device processor and a non-transitory computer readable medium including instructions stored thereon and executable by the processor, wherein the computer readable medium of each server includes instructions for running one or more virtual machines. In addition, the system may include a system controller including a device processor and a non-transitory computer readable medium including instructions stored thereon and executable by the processor, the computer readable medium of the system controller including instructions for receiving commands to host two or more virtual machines on the plurality of host servers; making a determination as to which of the virtual machines share commonalities with one another; and based on the determination, providing instructions to the plurality of host servers to host virtual machines determined to share one or more commonalities with one another on the same host server.

Abstract: A method for communicating between a first network and a second network is described. The method includes receiving, by a network device via a persistent control channel established between the network device and a server device connected to a first network, a first message that includes: (1) information indicating a tunneling protocol, and (2) information associated with a first tunneling payload. The persistent control channel is for communicating: (1) messages including control information, and (2) messages including tunneling payloads. The method also includes transmitting, by the network device to an endpoint device connected to a second network, a second message including the information associated with the first tunneling payload.

Abstract: A region-based electrical intelligence system is used to configure and control electrical usage within regions, for example, within certain areas of a floor of a building or within certain floors of a building. A number of network-enabled electric plugs are deployed in a region. Each of the network-enabled electric plugs is configured to deliver electricity from an electricity source to one or more powered devices located in the region. A server runs a web application used to monitor electrical usage information for the region based on electrical usage by each of the one or more powered devices. The web application generates rules for selectively controlling the delivery of electricity from the network-enabled electric plugs to the powered devices based on the monitored electrical usage information.

Abstract: In some embodiments, a method sets a threshold for utilization of a first table, wherein the utilization is based on layer 3 addresses and layer 2 addresses being stored in the first table. When a utilization of the first table does not meet the threshold, the method stores a layer 3 address in the first table. The first table uses a first type of lookup to determine a next hop address for the layer 3 addresses or the layer 2 addresses, and the first table also stores one or more layer 2 addresses. When the utilization of the first table meets the threshold, the method stores the layer 3 address in a second table where the second table uses a second type of lookup to determine the next hop address for layer 3 addresses.

Abstract: A security context obtaining method includes: a first access and mobility management function (AMF) receiving a first registration request message sent by a user equipment (UE) and validating integrity protection for the first registration request message; if the first AMF successfully validates integrity protection for the first registration request message, sending, by the first AMF, a second request message to a second AMF; the second AMF receiving the second request message; and if the second request message carries indication information and the indication information is used to indicate that the UE is validated, sending, by the second AMF, a security context of the UE to the first AMF.

Abstract: Techniques for initiator-based data-plane validation of segment routed, multiprotocol label switched (MPLS) networks are described herein. In examples, an initiating node may determine to validate data-plane connectivity associated with a network path of the MPLS network. The initiating node may store validation data in a local memory of the initiating node. In examples, the initiating node may send a probe message that includes a request for identification data associated with a terminating node. The terminating node may send a probe reply message that includes the identification data, as well as, in some examples, a code that instructs the initiating node to perform validation. In examples, the initiating node may use the validation data stored in memory to compare to the identification data received from the terminating node to validate data-plane connectivity. In some examples, the initiating node may indicate a positive or negative response after performing the validation.

Abstract: Systems and methods for a VLAN switching and routing service (VSRS) are disclosed herein. A method can include generating a table for an instance of a VSRS, which VSRS couples a first virtual layer 2 network (VLAN) with a second network. The table can contain information identifying IP addresses, MAC addresses, and virtual interface identifiers for instances within the virtual layer 2 network. The method can include receiving with the VSRS a packet from a first instance designated for delivery to a second instance within the virtual layer 2 network, identifying with the VSRS the second instance within the virtual layer 2 network for delivery of the packet based on information received with the packet and information contained within the table, and delivering the packet to the identified second instance.

Abstract: Various example embodiments for supporting zero-trust policy enforcement in a communication system are presented herein. Various example embodiments for supporting zero-trust policy enforcement in a communication system may be configured to support zero-trust policy enforcement, including zero-trust authentication, for Remote Direct Memory Access (RDMA) communications. Various example embodiments for supporting zero-trust policy enforcement for RDMA communications may be configured to support transparent zero-trust policy enforcement for RDMA communications by leveraging programmable Smart Network Interface Cards (SmartNICs).

Abstract: A management device can establish an anonymous communication session between a first device and a second device. The anonymous communication session can include a first outgoing communication session with the second device and a second incoming communication session with a third device. The first device can be a client in the first outgoing communication session. The second device can be a server in the second incoming communication session. The third device can route communications received from the second device to the first device. The management device can intercept first communications from the first device, modify the intercepted first communications to accord with the second incoming communication session, and provide the modified first communications to the second device.

Abstract: A user group session management method includes receiving, by a session management network element from a mobility management network element, a first message for requesting to establish a user group session for a first terminal, where the first message comprises an identifier of the first terminal and an identifier of a user group, generating, by the session management network element based on the identifier of the user group, a routing forwarding policy for the first terminal, and sending, by the session management network element, a second message to a user plane network element, where the second message indicates the user plane network element to establish a first session for the first terminal, and the second message carries the routing forwarding policy.

Abstract: A method for communication between controllers in TSN. A first controller receives a first packet that is sent by a second controller and that includes an identifier of a TSN domain to which the second controller belongs. The first controller determines, based on the TSN domain identifier, that the first controller and the second controller belong to a same TSN domain. The first controller sends, to the second controller, a second packet that carries user information. According to the foregoing method, communication and exchange between the controllers may be implemented, so that the controllers cooperatively configure a network device in the TSN.

Abstract: Techniques for hub and spoke publish-subscribe are described herein. In some examples, an outgoing-data database comprising addresses of remote device hubs on respective remote devices is maintained. First data is received from a first process operating on the device. The first data is sent to a first remote hub associated with a first remote device and associated with an entry in the outgoing-data database. An incoming-data database is maintained to associate processes operating on the device with data to which the processes subscribe. Second data is received from a second device hub associated with a second device. It is determined—by reference to the incoming-data database—that the second data is data subscribed-to by a second process operating on the device. The second data is sent to the second process.

Abstract: Computing system operational methods and apparatus are described. According to one aspect, a computing system operational method includes accessing user information regarding a user logging onto a computing device of the computing system, processing the user information to determine if the user information is authentic, as a result of the processing determining that the user information is authentic, first enabling the computing device to execute an application segment, and as a result of the processing determining that the user information is authentic, second enabling the application segment to communicate data externally of the computing device via one of a plurality of network segments of the computing system.

Abstract: Asynchronous and/or synchronous zero charge telephony protocol systems and methods may include an asynchronous signaling switch and/or a call duration time quota from a synchronous charging onset to place and complete a call. A call request is received with a second device mobile address. The asynchronous systems include instructions to automatically modify the mobile address with a routing prefix when the first device has insufficient balance or independent of balance, route to the asynchronous signaling switch based on an associated modified address trunk path, revert to the call signal at the asynchronous signaling switch, and deliver and automatically disconnect the call immediately when the call is completed. The synchronous systems include instructions to automatically set the call duration time quota upon insufficient balance, and deliver and automatically disconnect the call from the second user mobile device when the call is completed and the call duration time quota is exceeded.

Abstract: Supporting a scalable and Highly Available (HA) service platform. The service platform may be a virtual Cable Modem Termination System (vCMTS), a Passive Optical Network (PON), or a Broadband Network Gateway (BNG). A software component receives, from the service platform, an update about a particular unit of equipment, such as a cable modem (CM), Optical Network Unit (ONU)/Optical Network Terminal (ONT), or customer premises equipment (CPE). In response to receiving the update, the software component provides, to at least one edge router, route data for the particular unit of equipment. The route data informs the edge router of a next hop network address for a network address of the unit of equipment. The edge router is not and need not be provided with either (a) any Address Resolution Protocol (ARP) data for the particular unit of equipment and (b) any Neighbor Discovery (ND) data for the particular unit of equipment.

Abstract: A network device receives an Ethernet frame, checks a destination media access control (MAC) address based on a first cyclic redundancy check (CRC) code, to determine whether an error occurs in the destination MAC address. If the network device determines that no error occurs in the destination MAC address, the network device forwards the Ethernet frame based on the destination MAC address. The Ethernet frame includes the destination MAC address, the first CRC code, and a payload, a parameter of the first CRC code includes the destination MAC address, and the parameter of the first CRC code does not include the payload.

Abstract: Provided is a relay device including: a relay unit configured to perform a relay process for a frame transmitted and received between a plurality of function units; and a relay management unit. The relay unit receives, from a function unit, a target frame which is transmitted and received according to a predetermined communication protocol and includes information with which a request source of a service is identifiable and information with which a content of the requested service is identifiable, and the relay unit outputs the received target frame to the relay management unit. The relay management unit performs determination regarding setting change in the relay process of the relay unit, on the basis of the information included in the target frame received from the relay unit, and outputs the target frame to the relay unit or discards the target frame, according to a result of the determination.

Abstract: The present subject matter relates to methods, systems, devices, circuitry and equipment providing for communication service to be transported between first and second networks, and which monitors the communication service and/or injects test signals, and which can provide redundancy. At least one demarcation point or line is established between the first network and the second network, and/or between the first network, the second network and/or a third network. The Circuitry comprises a plurality of input amplifiers, output amplifiers, and multiplexer switches between a plurality of Port connectors. An SFP module or a WSFP module is inserted in the Ports.

Abstract: A system may include multiple electronic devices and multiple hardware transceivers. The multiple electronic devices may be coupled to each other via an interface network, and may include multiple chiplets. The multiple hardware transceivers, with at least one transceiver included in or coupled to a respective electronic device of the multiple electronic devices, may each be configured to receive data packets from a source device. The data packets may each include a path field including path information indicating a path to a destination device and a bridge-type field including bridge-type information indicating a type of the path information in the path field. The source device and the destination device may each include a chiplet. The multiple hardware transceivers may each be further configured to transmit the received data packets to the destination device using the path information and the bridge-type information of each received data packet.

Abstract: A network performance parameter sending method includes: obtaining, by a first network node, a segment identifier of a second network node in a segment list of a packet, where the second network node is a next-hop segment node of the first network node on a forwarding path of the packet; and adding, by the first network node, a network performance parameter of the first network node to the segment list, and then sending the packet to the second network node. In a process of forwarding the packet by using the segment list in the packet, the first network node uses the segment list to carry the network performance parameter of the network node.

Abstract: Presented herein are methods and systems that facilitate data plane signaling of a packet as a candidate for capture at various network nodes within an IPv6 network. The signaling occurs in-band, via the data plane—that is, a capture or interrogation signal is embedded within the respective packet (e.g., in the packet header) that carries a user traffic. The signaling is inserted, preferably when the packet is classified, e.g., at the ingress node of the network, to which subsequent network nodes with the IPv6 network are signaled to capture or further inspect the packet for capture.

Abstract: Techniques for providing consistent monitoring and analytics for security insights for network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing consistent monitoring and analytics for security insights for network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; inspecting the flow to determine whether the flow is associated with a split tunnel; and monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service.

Abstract: This application relates to the field of communications technologies, and discloses a service forwarding method and a network device that performs such method. The method includes: forwarding, by a first network device, a data packet of a first service to a second network device in a period (T1); and if the data volume of the forwarded first service reaches a threshold, forwarding, by the first network device, a data packet of a second service to the second network device. The first service is a low-latency service, and the second service is a non-low-latency service. In addition, the period (T1) is determined based on a delay allowed by a device for forwarding the data packet of the first service, and the threshold is a value determined based on a maximum transmission rate of the first service.

Abstract: A network node may receive a packet that originated from a root network node and may process the packet to determine segment identifier (SID) information associated with a point-to-multipoint transport chain. The network node may determine, based on the SID information, that the network node is a transit leaf node in the point-to-multipoint transport chain. The network node may generate, based on determining that the network node is a transit leaf node in the point-to-multipoint transport chain, a copy of the packet and may process the copy of the packet to perform one or more actions. The network node may update, based on determining that the network node is a transit leaf node in the point-to-multipoint transport chain, the SID information and may send, after updating the SID information, the packet, with the updated SID information, to another network node.

Abstract: In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.

Abstract: According to some example embodiments of the present disclosure, in a method for a memory lookup mechanism in a high-bandwidth memory system, the method includes: using a memory die to conduct a multiplication operation using a lookup table (LUT) methodology by accessing a LUT, which includes floating point operation results, stored on the memory die; sending, by the memory die, a result of the multiplication operation to a logic die including a processor and a buffer; and conducting, by the logic die, a matrix multiplication operation using computation units.

Abstract: Various examples are provided related to software and hardware architectures that enable lightweight and trust-aware routing. In one example, among others, a method for trust-aware routing includes calculating trust values to represent how much a node can be trusted to route packets through its router. Each node can store the trust values of routers that are one hop and two hops away from it, which represent direct trust and delegated trust, respectively. When a router receives a packet, the router can update trust values and forward the packet to the next hop.

Abstract: Provided are systems and methods for reliable, out-of-order transmission of packets. In some implementations, provided is an apparatus configured to communicate with a network and a host device. The apparatus may receive out-of-order packets from a remote device. The apparatus may transmit selective-acknowledgements to the remote device such that remote device can retransmit certain packets. The out-of-order packets can be provided to software for re-ordering.

Abstract: A method and a system for processing a data flow with an incomplete comparison process are provided. The method is implemented by a network device that includes a flow table and a flow filter in a memory thereof. A flow analyzing module is provided for analyzing and classifying packets of an input flow, and identifying an application category to which the input flow belongs. The flow table is queried according to a result of resolving the input flow for determining whether the input flow matches any flow entry of the flow table. The flow filter is queried if the input flow fails to match any flow entry of the flow table for determining whether features of the input flow match conditions of the flow filter. The input flow is processed accordingly, without needing to copy all flows that do not match the flow entries to the flow table.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Span port information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: A cryptography service provides an interface layer between an application and a cryptographic device, such as a hardware security module, trusted platform module, or cryptoprocessor that includes non-exportable tamper-resistant memory. A translation layer is provided between the customer application and the load-balancing service that accepts requests from the client application in a first protocol, such as KMIP, and converts the requests into a second protocol that is compatible with the cryptographic device. Results that are returned from the cryptographic device are translated and returned in accordance with the first protocol. In an embodiment, the cryptographic devices may be arranged in a cluster configuration where each cryptographic device stores a matching set of cryptographic keys, and a load-balancing service acts as an interface to the cluster of cryptographic devices.

Abstract: An edge termination point (ETP) transport protocol between two or more ETPs in a network, such as a Layer 2 transport network, may be provided. A device may receive an incoming internet protocol (IP) transaction at an edge termination point (ETP) in a network. The device may terminate the received incoming IP transaction at the ETP. The device may map the terminated incoming IP transaction onto an ETP-to-ETP communication. The device may control the ETP-to-ETP communication. For example, the device may control the ETP-to-ETP communication based on a resource management regime. The device may map the ETP-to-ETP communication onto one or more outgoing IP transactions at the ETP. The device may map the IP transaction onto an ETP-ETP communication. The ETP-ETP communication may include one or more ETP flows and one or more ETP transactions.

Abstract: Embodiments provide techniques for providing return-link routing in a hybrid communications network that includes a number of different networks having different characteristics. User terminal routing systems (UTRSs) provide interfaces between local user networks and the multiple communications networks of the hybrid network. Each UTRS can include a routing table having stored mappings that are populated according to forward-link communications (implicitly or explicitly), each associating a respective one of a plurality of routing table entries with one of the communications networks. When a UTRS receives return-link data from its respective local user network, the received data indicates a destination node. The UTRS can determine which of the stored mappings corresponds to the destination node and can route the received return-link data over a selected one of the communications networks in accordance with the identified one of the mappings.

Abstract: A method and system of transmitting network traffic through a stack having at least two switches is provided. The method includes receiving encapsulated network traffic via an inbound stack port of a switch of the stack, wherein the encapsulated network traffic was encapsulated with a flow identification (flow ID), and wherein the flow ID is assigned to a particular flow and is unique across the stack. The method further includes decapsulating the encapsulated network traffic using the flow ID contingent upon the switch being configured to decapsulate using the flow ID and transmitting the decapsulated network traffic from the switch in accordance with mapping information associated with the flow ID, wherein the switch is preconfigured with the mapping information.

Abstract: Various embodiments comprise systems, methods, mechanisms, and apparatus providing a traffic management function suitable for use at an intermediate Transmission Control Protocol (TCP) node (e.g., a cable modem) through which TCP uplink (UL) and downlink (DL) session traffic flows via respective linked UL and DL buffers is configured to manage ACK/NACK message insertion into the DL buffer to provide accelerated TCP UL packet size increases to so as to rapidly increase TCP UL data flow through the intermediate network node, and to provide constrained TCP UL packet size so as to rapidly decrease TCP UL data flow (apply backpressure) so as to avoid a buffer overflow condition.

Abstract: A dynamic SRMS (DSRMS) in a MPLS network generates unique segment identifiers for nodes of the network lacking segment identifiers (SIDs). The DSRMS receives network information from other nodes of the network that may include, for example, Internal Gateway Protocol (IGP) routing information, advertised prefix values for the nodes, and label values used in MPLS routing. The DSRMS analyzes the information and identifies nodes of the network that are not associated with a SID. For each identified node, the DSRMS generates a unique SID and then announces the SID to other nodes within the network. Generating the unique SID may include executing a hashing function using the IP address of the identified node as an input.

Abstract: An application information storage unit configured to store information obtained by associating application information including flow characteristics of an application of a flow constituted by a packet with a flow identifier for identifying the flow of the packet, an acquisition unit configured to acquire, in a case where an input port receives a packet, application information of a flow constituted by the packet from the application information storage unit, and an output unit configured to output the packet received by the input port to a packet transfer apparatus in a load state indicating that a load due to the flow of the flow characteristics is light among a plurality of packet transfer apparatuses according to the flow characteristics included in the application information acquired by the acquisition unit are provided.

Abstract: One embodiment provides a hub of a collecting device that receives messages from entities. The messages are formatted in a message structure that is dependent upon an entity sending the message. The hub analyzes each of the received messages by identifying, from the message structure, information corresponding to an interest of the collecting entity, and discarding information of the message not of interest to the collecting entity. The analysis is agnostic with respect to the entity sending the message and the message structure of the message. The hub performs an action based upon the information corresponding to an interest of the collecting entity.

Abstract: Systems and methods discussed herein involve designating a default playback device in a local playback network. One method may involve determining that a networked microphone device is available for assignment to one or more playback zones within a local playback network, displaying a prompt to indicate at least one playback zone to which the network microphone device is to be assigned, receiving an input indicating a particular playback zone in the local playback system to which the network microphone device is to be assigned, and storing data indicating an assignment of the network microphone device to the particular playback zone.

Abstract: For a multi-tenant environment, some embodiments of the invention provide a novel method for forwarding tenant traffic through a set of service machines to perform a set of service operations on the tenant traffic. In some embodiments, the method performs a classification operation on a data message flow of a tenant, in order to identify a set of service operations to perform on the data message flow. For some data message flows, the classification operation selects the identified set of service operations from several candidate sets of service operations that are viable service operation sets for similar data message flows of the tenant. In some embodiments, the classification operation is based on a set of attributes associated with the data message flow (e.g., five tuple identifier, i.e., protocol and source and destination ports and IP addresses).

Abstract: Ordering rules, such as those enforced by the peripheral component interconnect express (PCIe) protocol for data communications, can be intelligently enforced for independent transactions. A single device might host or be associated with multiple PCIe devices, such as virtual machines, and treating requests from these separate PCIe devices as coming from separate domains enables the ordering rules to be bypassed for certain transactions. Further, since a virtual machine might host multiple applications or be associated with multiple processors that can submit independent requests, the ordering rules can be bypassed at the transaction level in at least some instances. The ability to intelligently bypass ordering rules can help to improve the performance of the overall system, as requests do not need to be unnecessarily delayed and data storage capacity can be more fully utilized.

Abstract: This application provides a network slice configuration method, apparatus, and system, and pertains to the field of wireless communications technologies. The method includes: after receiving a management request of a network slice, obtaining or determining, by a network slice manager, network resource information corresponding to a subnet included in the network slice, and then sending, in a form of a subnet management request to a subnet manager, the network resource information corresponding to the subnet, so that the subnet manager configures the corresponding subnet based on the network resource information corresponding to the subnet. In this application, network slice configuration efficiency can be improved.

Abstract: Devices, systems, and techniques for global network state management are described herein. In one example, the present disclosure describes an example method performed by a software-defined network (SDN) controller that manages a network of a plurality of devices. The method include maintaining, by processing circuitry of the SDN controller, global network state information, configuring, by the processing circuitry, a notification service with a subscription for updates to a portion of the global network state information, wherein the notification service is configured to arrange the updates to the portion of the global network state information into a plurality of events, and distributing, by the notification service and via a plurality of interfaces, the plurality of events as event notifications to a plurality of subscriber micro-services of the SDN controller.

Abstract: A system and a method are disclosed for receiving, from a source of a plurality of candidate sources, a payload comprising content and metadata. The system selects a destination to which to route the payload based on the source and the content, and generates an entry at the destination based on the content. The system inputs the metadata into a classification engine, and receives, as output from the classification engine, one or more classifications for the payload. The system applies a metadata tag to the entry, the metadata tag indicating the one or more classifications. The system receives a search request from a client device specifying at least one of the one or more classifications, and, in response to receiving the search request, provides the entry to the client device based on a matching classification.

Abstract: Some embodiments provide a method of forwarding data messages between source and destination host computers that execute source and destination machines. At a source computer on which a source machine for a data message flow executes, the method in some embodiments identifies a source tunnel endpoint group (TEPG) associated with the source machine. For the flow, the method selects one TEP of the TEPG as the source TEP. The method then uses the selected source TEP to forward the flow to the destination computer on which the destination machine executes.

Abstract: Methods and systems are provided. A method includes managing, by a software defined network (SDN) controller, OpenFlow rules stored on an OpenFlow network device having a ternary content addressable memory (TCAM). The OpenFlow rules include unreachable OpenFlow rules and reachable OpenFlow rules. The managing step includes querying at least one OpenFlow rule from among the unreachable OpenFlow rules and the reachable OpenFlow rules on the at least one OpenFlow network device. The managing step further includes determining whether any of the OpenFlow rules are reachable or unreachable from indicia used to mark the OpenFlow rules as reachable or unreachable. The managing step also includes causing a removal of the unreachable OpenFlow rules from the OpenFlow network device.

Abstract: Some embodiments provide a method for identifying network architecture in a datacenter. The method identifies connection information for multiple network elements. The connection information for each network element specifies other network elements to which the network element connects. The method assigns a set of the network elements to a set of two or more layers based on the connection information for the network element. The method uses the connection information to identify at least one group of network elements organized into a particular network architecture. The identified groups are for use in displaying user interface visualizations of the network elements of the datacenter.

Abstract: Some embodiments provide a method for configuring an edge computing device to implement a logical router belonging to a logical network. The method configures a datapath executing on the edge computing device to use a first routing table associated with the logical router for processing data messages routed to the logical router. The method configures a routing protocol application executing on the edge computing device to (i) use the first routing table for exchanging routes with a network external to the logical network and (ii) use a second routing table for exchanging routes with other edge computing devices that implement the logical router.

Abstract: A processor receives data corresponding to a sensor, and generates a frame having a header and a payload. A data type value is selected from a set of multiple data type values corresponding to different respective types of data, the set of multiple data type values including at least i) a first data type value corresponding to video data from a camera, and ii) a second data type value corresponding to non-video data. The header is generated to include one or more fields set to the selected data type value to indicate a type of data included in the payload, and the payload is generated to include the data received from the sensor. The processor provides the frame to an Ethernet network interface. The Ethernet network interface encapsulates the frame in an Ethernet packet, and transmits the Ethernet packet via an Ethernet link.

Abstract: The present disclosure provides a method and apparatus for suppressing the spread of viruses in a local area network (LAN). The method includes, in response to that an ARP packet is received, determining whether a number of interacting terminals corresponding to a target terminal that sent the ARP packet reaches a first preset threshold; in response to that the number of interacting terminals reaches the first preset threshold, further determining whether a number of abnormal terminal relationships corresponding to the target terminal reaches a second preset threshold; and in response to that the number of abnormal terminal relationships reaches the second preset threshold, providing protection to the target terminal to so to suppress virus propagation in the LAN.