Abstract: Systems, methods, and computer-readable storage media for load-balancing are disclosed. An access point receives a communication request and an identifier from a wireless device. The access point determines a plurality of potential endpoints and selects at least one preferred potential endpoint for the wireless device, based on the identifier and the plurality of potential endpoints. The access point establishes a tunnel between the access point and the preferred endpoint for routing traffic associated with the wireless device.

Abstract: In a method for forwarding packets in a network device a plurality of hash values is generated based on a lookup key. The plurality of hash values includes at least a first hash value generated using a first hash function, a second hash value generated using a second hash function and a third hash value generated using a third hash function. The third hash function is different from the first hash function and the second hash function. An entry in a lookup table is selected using the first hash value and the second hash value, wherein the selected entry includes an offset for the lookup key. A forwarding entry in a forwarding table is selected using the third hash value and the offset for the lookup key, wherein the forwarding entry corresponds to the lookup key. The packet is forwarded to one or more ports of the network device using the selected forwarding entry.

Abstract: In one implementation, a method of maintaining continuous identity for mobile devices includes: obtaining a first address for a first device; and obtaining, from one or more auxiliary sensors, auxiliary sensor information related to the first device. The method also includes determining whether the auxiliary sensor information matches information associated with a second address, where the second address was previously associated with the first device. The method further includes linking the first address with the second address for the first device, in order to continue tracking the first device when the second address is no longer detected, in response to determining that the auxiliary sensor information matches information associated with the second address.

Abstract: A computer-implemented method for designing an industrial product modeled with a binary tree having leaf nodes representing basic volumes, non-leaf nodes representing binary commutative operation combining volumes, the method comprising the steps of: performing a design operation triggering the adding or the removing of a leaf node; and idealizing the binary tree, i.e. modifying the binary tree while maintaining the optimality of the tree by minimizing the number of weak leaf nodes, a weak leaf node being a leaf node such that, when removed, the resulting binary tree is not optimal anymore.

Abstract: In various embodiments, a software load balancer is deployed to distribute incoming managed file traffic among multiple nodes running in a cluster. In one aspect, a separate instance of the software load balancer may be instantiated for each protocol that will be used (e.g., FTP, FTP-SSL & SSH-FTP). In one embodiment, the software load balancer includes a standalone java application that is configured to run outside the purview of an application server. In a further embodiment, the software load balancer is able to manage transfers to multiple nodes in (e.g., multiple managed file transfer servers) in a cluster. Therefore, in one embodiment, only one instance of the software load balance needs to be deployed.

Abstract: Systems and methods for increasing layer 2 visibility of layer 3 network devices so as to facilitate implementation of device-oriented policy actions by layer 3 network devices are provided. According to one embodiment, unique physical addresses of one or more host devices are retrieved by a dynamic host configuration protocol (DHCP) agent that is operatively coupled with a DHCP server. The physical addresses are mapped to corresponding Internet Protocol (IP) addresses assigned by the DHCP server to the one or more host devices. The mapping is relayed directly or indirectly to a network security device. Network traffic management/security policies are defined within the network security device corresponding to at least one of the unique physical addresses.

Abstract: A method for classification includes storing in a TCAM classification rules comprising respective tags, each including an update bit. Data items are classified by extracting a respective key from each data item, appending an update-select bit to construct an extended key, and matching the extended key to one of the tags in the TCAM. In response to an instruction to atomically replace a group of existing rules in the TCAM with new rules, the update bit is unmasked and set to the first bit value in the group of the existing rules. The new rules are stored in the TCAM, with their update bit set to a second bit value. After storing the new rules in the TCAM, the update-select bit in the extended key of the received data items is set to the second bit value.

Abstract: Systems, methods, and apparatus to identify media devices are disclosed. An example method includes determining an internet protocol address of a requesting device of a received network communication. A first lookup is performed to identify a media access control address of the requesting device based on the internet protocol address. Data identifying the network communication is stored in association with the media access control address.

Abstract: In one implementation, a method of maintaining continuous identity for mobile devices includes: obtaining a first address for a first device; and obtaining, from one or more auxiliary sensors, auxiliary sensor information related to the first device. The method also includes determining whether the auxiliary sensor information matches information associated with a second address, where the second address was previously associated with the first device. The method further includes linking the first address with the second address for the first device, in order to continue tracking the first device when the second address is no longer detected, in response to determining that the auxiliary sensor information matches information associated with the second address.

Abstract: A capability is provided for statelessly load balancing Transmission Control Protocol (TCP) connections across a set of servers. A load balancer receives a TCP SYN packet from a client, selects a server for a TCP connection for the client, forms a modified TCP SYN packet including an address of the client, and propagates the modified TCP SYN packet toward the server. The server receives the modified TCP SYN packet, forms a TCP SYN+ACK packet including an identifier (e.g., n bits of an address, an n-bit server index based on mapping information of the load balancer, or the like) of the server, and propagates the modified TCP SYN+ACK packet toward the load balancer. The load balancer receives a TCP packet from the client on the TCP connection, determines a server associated with the TCP connection based on information included within the TCP packet, and propagates the TCP packet toward the server.

Abstract: A node transmits data based on a routing information table when receiving the data. The node determines whether a second candidate neighboring node of which flag information is true and to which the data has not yet been transmitted is present when the data transmission to a first candidate neighboring node fails. The node aborts retransmission of the data when no second candidate neighboring node of which the flag information is true and to which the data has not yet been transmitted is present.

Abstract: Assigning a set of port names to storage access paths of virtual machines accessing storage resources via storage area networks is provided. A first computing system cluster that is associated with a set of computing system identifiers is created. A first computing system identifier associated with a first computing system is added to the set of computing system identifiers. The first computing system is disassociated from the first computing system identifier. The first computing system is added to the first computing system cluster.

Abstract: The invention provides an Ethernet bridge or router comprising a network fabric adapted to provide interconnectivity to a plurality of Ethernet ports, each of the Ethernet ports being adapted to receive and/or transmit Ethernet frames, and wherein the Ethernet bridge or router further comprises an encapsulator connected to receive Ethernet Protocol Data Units from the Ethernet ports, wherein the encapsulator is operable to generate a Fabric Protocol Data Unit from a received Ethernet Protocol Data Unit, the Fabric Protocol Data Unit comprising a header portion, and a payload portion which comprises the Ethernet Protocol Data Unit concerned, and wherein the encapsulator is operable to transform Ethernet destination address information from the Ethernet Protocol Data Unit into a routing definition for the network fabric, and to include this routing definition in the header portion of the Fabric Protocol Data Unit. Also provided is a method of data delivery across a network.

Abstract: Methods, computing devices, and computer readable storage media for testing network connections are disclosed. A first processor of a plurality of processors may define a new TCP connection to be opened. The first processor may apply a hash function to determine a second processor of the plurality of processors to open the new TCP connection. The first processor may provide data defining the new TCP connection to the second processor. The second processor may open the new TCP connection in accordance with the data provided by the first processor.

Abstract: A flow deflection capability is provided for deflecting data flows within a Software Defined Network (SDN) in order to provide security for the SDN. A flow forwarding rule is generated for a first network element of the SDN based on detection of a condition (e.g., TCAM utilization condition, CPU utilization condition, or the like) associated with the first network element. The flow forwarding rule is generated by a control element of the SDN or the first network element of the SDN. The flow forwarding rule is indicative that at least a portion of new flow requests received at the first network element are to be forwarded from the first network element to a second network element of the SDN. The flow forwarding rule may specify full flow deflection or selective flow deflection.

Abstract: Network device and method for routing a packet and setting up a new flow. The device includes a packet classifier, a field-selection table, a hash module, and a routing table. A packet is routed by finding an entry in the field-selection table using the packet classifier, selecting bits from the packet based on the entry in the field-selection table, and hashing the selected bits along with an identifier from the packet classifier or the field-selection table, using the hash module. The hash result is used to locate instructions in the routing table. When setting up a new flow, the hash module result may point to an existing entry in the routing table. In such instances, a new entry is added to the packet classifier, such that the hash module will produce a different result that points to an available entry in the routing table.

Abstract: A method of updating a suffix tree includes providing an initial suffix tree based on a first sequence of symbols drawn from an alphabet. The suffix tree includes existing nodes representing respective subsequences occurring in the first sequence of symbols. The existing nodes are associated with information relating to membership of the subsequences in at least one class of repeat subsequences. A second sequence of symbols is received and the initial suffix tree is updated to form an updated suffix tree by adding new nodes representing subsequences occurring in the second sequence of symbols that are not represented by the existing nodes. The subsequences represented by the new nodes are ordered in a new node data structure which is processed to updating the information relating to the at least one class of repeat subsequences associated with at least some of the nodes in the updated suffix tree.

Abstract: A method for processing a request for content by a routing device in a communication network implementing a name-based routing. The device includes plural interfaces to receive a request for content and a data packet associated with a content, and a routing table adapted to determine, based on a content name, at least one interface to route the request. The method includes: receiving the request through a first interface; if the device is not able to provide said data packet, searching for the name of the content in a table of pending requests associated with the first interface; in case the content name does not appear in the table, storing the name of the content in the table; and transmitting the request through at least one second interface, the second interface being determined as a function of the name of the content on the basis of the routing table.

Abstract: Disclosed are a method of packet classification and a device thereof. A method for packet classification according to one embodiment of the present invention comprises the steps of: partitioning the entire rule set by using key values corresponding to packet fields, into a plurality of rule subsets; generating recursive flow classification (RFC) tables for each of the plurality of partitioned rule subsets; loading, in the same cache line, both partition information and RFC table information commonly corresponding to key values of received packets; searching for a rule subset by using the partition information on the key values of the received packets, which are loaded in the cache line; and searching for an RFC table for a rule by using the RFC table information on the key values of the received packets, which are loaded in the cache line.

Abstract: An example method for optimizing application performance in a network environment is provided and includes retrieving an L7 session identifier (ID) from a packet, generating a hash from at least the L7 session ID, and inserting the hash into a header of the packet. The L7 session ID identifies a particular application layer session between a client and a server in a network environment. The server includes a plurality of processors configured to process the packet, and the hash indicates a specific processor in the plurality of processors.

Abstract: Implementations related to detecting control data are presented herein. A detector searches for control data in a first set of pre-determined control data, wherein a respective subset of the first set is assigned to a respective logical port and the respective subset is excluded from the first set when searching for the control data received from the respective logical port.

Abstract: A device that can sufficiently speed up a communication of a TCP is provided. A network device relays a TCP communication between hosts. The network device holds a request rate and a first output rate indicative of an effective bandwidth for transferring data to a second network. The network device divides data from a first network into a plurality of connections a second network, and transfers the data between the hosts. The network device holds a second output rate for each of the divided connections. When the request rate is equal to or larger than the first output rate by a threshold value, and a relatively low-speed connection is detected among the plurality of connections of the second network, the network device conducts a communication with the use of a connection other than the relatively low-speed connection.

Abstract: A method of packet classification implemented by a network router, the method comprising obtaining a packet whose header comprises a plurality of dimensional fields specified by a set of rules, matching one or more bits in at least two of the dimensional fields with a corresponding entry stored in a ternary content-addressable memory (TCAM), generating a hash key based on data associated with the corresponding entry in the TCAM, wherein the associated data is stored in at least one non-TCAM memory, searching, using the hash key, a multi-dimensional trie stored in the at least one non-TCAM memory, and mapping the packet to one or more of the set of rules based on the search.

Abstract: In one embodiment, a method comprises identifying prefix groups for searchable character symbols, each prefix group having a corresponding searchable character symbol comprising at least one searchable character; assigning at least one prefix group to each of a plurality of distributed hash table nodes in a network, each distributed hash table node containing at least one of the prefix groups, each distributed hash table node assigned a corresponding prescribed keyspace range of a prescribed keyspace, each distributed hash table node configured for storing data records having respective primary data record keys within the corresponding prescribed keyspace range; and assigning secondary indexes that start with one of the searchable character symbols to the corresponding prefix group in the associated distributed hash table node, enabling any prefix search starting with the one searchable character symbol to be directed to the corresponding prefix group in the associated distributed hash table node.

Abstract: A physical host executes a hypervisor or virtual machine monitor (VMM) that instantiates at least one virtual machine (VM) and a virtual input/output server (VIOS). The VIOS determines by reference to a policy data structure a disposition of a packet of network communication with the VM, where the disposition includes one of dropping the packet and forwarding the packet. Thereafter, the determined disposition is applied to a subsequent packet in a same packet flow as the packet.

Abstract: A packet processor provides for rule matching of packets in a network architecture. The packet processor includes a lookup cluster complex having a number of lookup engines and respective on-chip memory units. The on-chip memory stores rules for matching against packet data. A lookup front-end receives lookup requests from a host, and processes these lookup requests to generate key requests for forwarding to the lookup engines. As a result of the rule matching, the lookup engine returns a response message indicating whether a match is found. The lookup front-end further processes the response message and provides a corresponding response to the host.

Abstract: Disclosed are various embodiments of a network switch for storing a prefix address and a mask corresponding to the prefix address, the prefix address and the mask each representing a binary value, the mask representing a number of significant bits of an address beginning with a most significant bit. The network switch obtains a network frame via one of a plurality of network interfaces, the network frame comprising a network address in a header of the network frame, the network address being a binary value representing a physical address of a network interface device. The network switch determines a truth value associated with a comparison of a mask number of bits of the prefix and network addresses, the truth value indicating an equivalence of the comparison. In response to the truth value, the network switch may initiate at least one action associated with the network frame.

Abstract: Techniques are disclosed for hash-based routing table management in a distributed network switch having multiple switch modules. Upon determining that an attempt to insert a first routing entry into a first hash table of the routing table has failed, a second routing entry, which exists in the first hash table, is attempted to be moved to a second hash table of the routing table. If the move attempt is successful, then the first routing entry is added to the location previously occupied by the second routing entry. If the move attempt is unsuccessful, then a third routing entry, which exists in the first hash table, is attempted to be moved.

Abstract: A network device receives a join request on a downstream interface, wherein the join request specifies a source device and multicast group, wherein the network device is positioned within a core network of a multicast virtual private network (MVPN) that transmits multicast traffic between the source device and a plurality of receivers associated with customer sites. The network device selects an upstream router to which to send the join request from among a plurality of upstream routers on paths leading to the source device, so as to avoid creating a join request loop in the core network. At least one of the upstream routers is positioned on an Exterior Border Gateway Protocol (EBGP) path toward the source device, and at least one of the upstream routers is positioned on an Interior BGP (IBGP) path toward the source device. The network device sends the join request to the selected upstream device.

Abstract: An example method involves generating, without manual intervention, a table to store current reroute statistics based on rerouting of data from a logical circuit that has failed to a logical failover circuit in a network. The current reroute statistics include trap data corresponding to the logical circuit. The trap data includes a committed burst size. The logical circuit is identified by a first logical circuit identifier. The logical failover circuit is identified by a second logical circuit identifier. The first and second logical circuit identifiers are renamed until the logical circuit has been restored from failure. The table is updated, without manual intervention, to store updated reroute statistics. The updated reroute statistics include updated trap data corresponding to the logical circuit. The updated reroute statistics are based on a change in status of the logical circuit corresponding to a dropped frame when the committed burst size has been exceeded.

Abstract: A method and apparatus for characterizing an infrastructure of a wireless network are disclosed. For example, the method obtains a first data set from a server log, and obtains a second data set from a plurality of wireless endpoint device. The method characterizes a parameter of the infrastructure of the wireless network using the first data set and the second data set and optimizes a network resource of the wireless network based on the parameter.

Abstract: A network device including a classifier and a processor. The classifier is configured to select a plurality of packets according to a rule. The rule describes a characteristic associated with the plurality of packets selected by the classifier. The processor is configured to, during runtime, execute a program to compare a portion of the plurality of packets to one or more predetermined patterns. During the runtime, one or more additional predetermined patterns can be added to the program for comparison with a portion of one or more of the plurality of packets selected by the classifier without having to reboot the network device.

Abstract: Systems and methods for hierarchical link aggregation are disclosed. A system for hierarchical link aggregation may include a network interface having a plurality of physical ports. A first plurality of the physical ports may be configured as member ports of a first link aggregation group (LAG). A second plurality of the physical ports may be configured as member ports of a second LAG. The first LAG and second LAG may be configured as member logical ports of a third LAG.

Abstract: A physical host executes a hypervisor or virtual machine monitor (VMM) that instantiates at least one virtual machine (VM) and a virtual input/output server (VIOS). The VIOS determines by reference to a policy data structure a disposition of a packet of network communication with the VM, where the disposition includes one of dropping the packet and forwarding the packet. Thereafter, the determined disposition is applied to a subsequent packet in a same packet flow as the packet.

Abstract: This invention describes a method for expanding universal plug and play capabilities in a power constrained environment thus facilitating communication between two terminals with universal plug and play (UPnP) application capabilities, wherein one of the terminals is in a sleeping mode. The present invention can be applied (but not be limited) to mobile terminals, wireless devices, portable devices, mobile communication devices, mobile phones, etc. The invention describes a mechanism in which the UPnP application dynamically instructs the TCP/IP stack to tune-up its parameters so that it can tolerate longer delays and timeouts, due to the fact that it operates in a power constrained UPnP environment.

Abstract: A system for matching data using flow based packet data storage includes a communications interface and a processor. A communications interface receives a packet between a source and a destination. The processor identifies a flow between the source and the destination based on the packet. The processor determines whether some of packet data of the packet indicates a potential match to data in storage using hashes. The processor then stores the data from the most likely data match and second most likely data match without a packet header in a block of memory in the storage based on the flow.

Abstract: Device, system, and method of phone call placement. A method of placing a phone call from a mobile phone includes: receiving a user command to initiate a phone call from said mobile phone using a cellular network; diverting said phone call to be carried by a detected network element of a non-cellular wireless network, instead of by said cellular network; wherein the diverting is based on at least one of: a Media Access Control (MAC) address of a detected network element of said non-cellular wireless network, an Organizationally Unique Identifier (OUI) of a detected network element of said non-cellular wireless network, or a Session Initiation Protocol (SIP) account configuration data of a detected network element of said non-cellular wireless network.

Abstract: One embodiment of the present invention provides a router. The router includes a storage, a forwarding table management mechanism, and a longest prefix matching mechanism. The storage stores, in a data structure corresponding to a rich prefix node associated with a trie, a plurality of network address prefixes represented by the trie. The forwarding table management mechanism expresses a respective network address prefix using one or more of: 1) a traversal path on the trie from a root node to a subtrie of the trie; and 2) an encoded representation of a node in the subtrie. The longest prefix matching mechanism matches a network address with a longest prefix from the network address prefixes stored in the data structure corresponding to the prefix node.

Abstract: A method of merging Distributed Hash Table (DHT) rings in heterogeneous network domains, where each domain includes a DHT ring. Upon determining that a node is common to first and second DHT rings on the same hierarchical level and having at least one Overlay Router in common, a link is started between a node in the first DHT ring and a node in the second DHT ring by establishing an indirect link through the common node. An indirect link is created between the first and second DHT rings, and virtual links are created to DHT rings positioned higher in the DHT ring hierarchy until all the DHT rings are merged into a single logical ring.

Abstract: A method for optimized route caching includes comparing a destination address of a network packet to a first set of prefixes in a routing cache, and comparing the destination address to a second set of prefixes in a full routing table when a longest matching prefix for the destination address is not found in the routing cache. The method further includes copying the longest matching prefix and a set of sub-prefixes of the longest matching prefix from the full routing table to the routing cache, and forwarding the network packet.

Abstract: A hardware trie structure includes a tree of internal node circuits and leaf node circuits. Each internal node is configured by a corresponding multi-bit node control value (NCV). Each leaf node can output a corresponding result value (RV). An input value (IV) supplied onto input leads of the trie causes signals to propagate through the trie such that one of the leaf nodes outputs one of the RVs onto output leads of the trie. In a transactional memory, a memory stores a set of NCVs and RVs. In response to a lookup command, the NCVs and RVs are read out of memory and are used to configure the trie. The IV of the lookup is supplied to the input leads, and the trie looks up an RV. A non-final RV initiates another lookup in a recursive fashion, whereas a final RV is returned as the result of the lookup command.

Abstract: The path management controller 1 refers to resource information 131 including reservation statuses of working paths and advance reserved paths that are set in every link, so as to calculate a route for setting a new path and set this path in this calculated route. If the route for setting this new path cannot be obtained (1) because of a shortage of residual bandwidth of a link of interest, the path management controller 1 refers to the resource reservation information 131 of working paths and advance reserved paths and calculates an alternative route for another existing path used in the link of interest, and moves this path to the calculated alternative route.

Abstract: A method includes reading content of network traffic that arrives at a network port of a network switch of a mesh of network switches. A hash algorithm is applied to the read content to indicate a path to a destination network switch of the mesh, the hash algorithm being common to all network switches of the mesh. The network traffic is forwarded via a network port that is associated with the indicated path.

Abstract: Techniques are provided for cached routing table management in a distributed network switch. A frame having a source address and a destination address is received. If no routing entry for the source address is found in a routing table of a switch module in the distributed network switch, then routing information is determined for the source address and a routing entry is generated. The routing table is modified to include the routing entry, based on a set of hash functions. Upon accessing the generated routing entry in the modified routing table responsive to a subsequent lookup request for the source address, the set of caches is modified to include the generated routing entry.

Abstract: An apparatus and methods for transmitting information over a home coax network are provided. A method according to the invention for transmitting information over a home coax network preferably includes adding a multicast transmission mode to a system that previously only had unicast transmission mode and broadcast mode. The method preferably includes broadcasting multicast (“MC”) traffic. The MC traffic may be directed to a predetermined MC group. The MC traffic may be transmitted from an ingress node to a plurality of egress nodes. A portion of the plurality of egress nodes may belong to the MC group. Upon receipt by at least one of the egress nodes of the MC traffic, the method may further include using the at least one egress node to filter the received MC traffic to determine whether the MC traffic is directed to a group for which the egress node is a member.

Abstract: Techniques are provided for hash-based routing table management in a distributed network switch. A frame having a source address and a destination address is received by a switch module having bridge elements and a routing table divided into slices of buckets, each slice having a respective property and including one or more buckets. If a routing entry for the source address is found in a first slice of a first set of buckets of the routing table responsive to a lookup request for the source address, and the property of the first slice satisfies a replication condition, then the routing entry is replicated to a second set of buckets of the routing table.

Abstract: Management of congestion level, in a computer-related context, is disclosed. Also disclosed is a system generating a plurality of computer network-related tables during system operation. A number of the tables are each separately indexed by a different index. The system includes at least one tangible computer-readable medium adapted to store, at each indexed location, a swap count providing an indication of the congestion level of the indexed location. The system also includes insert logic stored as instructions on the at least one medium for execution. When executed, the insert logic is operable to: i) insert, when a predetermined condition has been satisfied, a new entry by overwriting the current entry stored in the indexed location having the lowest swap count; and ii) update the swap counts in each of the indexed locations in a manner that maintains the total swap count at least substantially constant over time.

Abstract: A stateless load balancer may route a request to a computing device without tracking state information of the communication connection that delivered the request. The stateless load balancer may receive a request that is initiated by a client device. The request may be transported to the stateless load balancer via a communication connection that includes a public destination internet protocol (IP) address. One of the routing devices in the stateless load balancer may obtain connection tuples of the communication connection that transported the request, in which the connection tuples include the public destination IP address. Once obtained, the routing device may generate a hash value from one or more connection tuples. Subsequently, the routing device may map the hash value to a target network address of a particular computing device in a cluster of multiple computing devices by accessing stored mapping data, and then route the request to the particular computing device for processing.

Abstract: A system and method for receiving, from one or more ingress routers, a first set of records including data corresponding to network traffic, receiving, from one or more egress routers, a second set of records including data corresponding to network traffic and creating a multicast traffic matrix using at least a portion of the data included in the first and second sets of records.

Abstract: A first site comprises a first ISP, a first server and a first router interposed between the first ISP and the first server. A second site comprises a second ISP, a second server and a second router interposed between the second ISP and the second server. While the second server is operating, both the first and second routers broadcast announcements of an IP address of the second server. The announcements of the IP address broadcast by the first router indicate the first router as a less preferred route to the IP address than the announcements of the IP address by the second router indicating the second router as a route to the IP address. Consequently, packets addressed to the IP address are routed to the second server via the second ISP and the second router. Subsequently, the second site fails, and concurrently, the second router ceases to broadcast announcements of the IP address of the second site and the first router continues to broadcast announcements of the IP address of the second site.