Abstract: Techniques are disclosed relating to managing dependencies between shared data objects in a database system. In various embodiments, a data storage system may maintain a function cache that is operable to store functions that are accessible to one or more applications hosted by a server system. In response to a request to invalidate a first data type utilized by one or more of these functions, various embodiments may include accessing an inverted index that specifies a mapping between data types and corresponding functions, stored in the function cache, which depend on those data types. Using the inverted index, various embodiments include identifying a set of functions that depend on the first data type and invalidating the set of functions in the function cache such that the set of functions are no longer accessible by the applications.

Abstract: Method for producing a bidirectional connection between a device forming a field device and an application in a central facility, wherein a bidirectional connection is produced between the device that forms the field device and the application in a central facility, where a bridge function running on a mobile communication terminal establishes a short-range radio connection with the device, establishes a long-range radio connection with the application in the central facility and establishes a data channel for bidirectional communication between the application in the central facility via the long-range radio connection and the device via the short-range radio interface.

Abstract: A system and method to support identity theft protection and, in particular, to a system and method for supporting identity theft protection as part of a distributed service oriented ecosystem in Internet protocol (IP) multimedia subsystem (IMS) and non-IMS networks. The system includes an identity session initiation protocol (SIP) application server configured to act as a security assertion markup language (SAML) bridge, which allows an SIP enabled device or a non-SIP enabled device to attach to a telecommunications service provider network. A user may accept or reject an authorization request using the SIP enabled device or non-SIP enabled device.

Abstract: A wireless communication device includes a memory and a wireless interface and processing circuitry. The memory configured to store data to be transmitted and received. The wireless interface configured to transmit and receive a wireless signal. The processing circuitry coupled to the memory and configured to receive a message from another wireless device, including destination information and acknowledgement information, via the wireless interface, set, in a first period being a period in which the message from a child node which transmits the message upward while setting the child node itself as a destination is received, the acknowledgement information with respect to data received from the child node, process the message including the destination information and the acknowledgement information, and transmit a message including the set acknowledgement information via the wireless interface to another wireless device.

Abstract: A portable gateway device for use with a Building Management System (BMS) enables voice command control of BMS devices. The portable gateway device comprises a Wi-Fi module, a serial communications interface, and a data conversion module. The Wi-Fi module is configured to enable communication with a user device via Wi-Fi. The portable gateway device is configured to receive a voice command spoken by a user of the user device. The serial communications interface is configured to enable communication with a bus connected to a BMS device. The data conversion module is configured to translate the voice command received from the user device into a control action associated with the BMS device. The portable gateway device is configured to provide the control action to the BMS device via the serial communications interface. The control action affects a state or condition of the BMS device.

Abstract: Certain aspects of the disclosure are directed to customized communication monitoring and alerts using a high-level programming interface. According to a specific example, a data communication server provides a database with data communication features available to remotely-situated client entities. The data communication server is configured to provide to the client entities, a set of instructions written in a first programming language that defines a message exchange protocol. The data communication server is further configured to receive from each client entity, client-specific sets of control data written in a second programming language that is compatible with the first programming language. The data communication server may monitor an operating state of each of the virtual office features provided to the client entity based on received event data, and generate alerts to end-users of the client entity according to the event data satisfying a set of criteria.

Abstract: Client fingerprints can be used to detect and defend against malware and hacking into information systems more effectively than using IP addresses. A unique client fingerprint can be based on data found in the client's SSL client hello packet. SSL version, cipher suites, and other fields of the packet can be utilized, preferably utilizing individual field values in the order in which they appear in the packet. The ordered values are converted to decimal values, separated by delimiters, and concatenated to form an identifier string. The identifier string may be mapped, preferably by a hash function, to form the client fingerprint. The client fingerprint may be logged, and whitelists and blacklists may be formed using client fingerprints so formed.

Abstract: A GRE tunnel is configured between multiple computing devices of a distributed cloud computing network and a single origin router of the origin network. The GRE tunnel has a first GRE endpoint that has an IP address that is shared among the computing devices of the distribute cloud computing network and a second GRE endpoint that has a publicly routable IP address of the origin router. A first computing device receives an IP packet from a client that is destined to an origin server. The first computing device processes the received IP packet and encapsulates the IP packet inside an outer packet to generate a GRE encapsulated packet whose source address is the first GRE endpoint and the destination address is the second GRE endpoint. The GRE encapsulated packet is transmitted over the GRE tunnel to the single origin router.

Abstract: A system may determine an identifier associated with a location of a user device in response to receiving an indication that the user device has moved to the location and perform a first lookup to determine an application specific location associated with the identifier. A second lookup may be performed to determine one or more network functions available in the application specific location. An indication of the one or more network functions may be outputted.

Abstract: Aspects of the disclosure relate to preventing unauthorized access to information resources by deploying and utilizing multi-path data relay systems and sectional transmission techniques. A computing platform may receive, from one or more data storage computer systems, source data associated with a source dataset. Subsequently, the computing platform may generate at least two data blocks based on the source data received from the one or more data storage computer systems, and the at least two data blocks may include one or more overlapping portions. Thereafter, the computing platform may apply one or more tags to the at least two data blocks, thereby producing at least two tagged data blocks. Then, the computing platform may select at least two paths for transmitting the at least two tagged data blocks. Subsequently, the computing platform may send, across the at least two selected paths, the at least two tagged data blocks.

Abstract: An apparatus for use in a serving gateway user plane (SGW-U) of an evolved packet core (EPC) of a wireless communication network is disclosed. The apparatus comprises one or more processors configured to process a downlink (DL) data signal comprising a DL data packet for a user equipment (UE) in the network, buffer the DL data packet in the DL data signal and identify a serving gateway control plane (SGW-C) associated with the SGW-U that serves the UE, when the UE is in idle mode. The one or more processors is further configured to provide an SGW-U DL data notification message to the SGW-C, generated selectively based on a priority of the received DL data signal, in order to inform the SGW-C about the availability of DL data for the UE.

Abstract: Mechanisms support machine-to-machine service layer sessions that can span multiple service layer hops where a machine-to-machine service layer hop is a direct machine-to-machine service layer communication session between two machine-to-machine service layer instances or between a machine-to-machine service layer instance and a machine-to-machine application. Mechanisms are also disclosed that illustrate machine-to-machine session establishment procedures for oneM2M Session Management Service supporting multiple resources.

Abstract: A physical host machine of a public cloud system includes a set of processing units for executing instructions stored in non-transitory machine readable media. The physical host machine also includes a physical network interface cars (PNIC) and a non-transitory machine readable medium that stores a data compute node (DCN). The DCN includes first and second applications, first and second logical interfaces, a network stack, and a managed forwarding element (MFE). The first application is connected to the pNIC through the network stack, the first logical interface, and the MFE. The second application is connected to the PNIC through the network stack, the second logical interface, and the MFE.

Abstract: A method for communications is proposed. The method may comprise obtaining, by a terminal device, network addresses of another terminal device from a message broker to which the terminal device and the another terminal device are registered. At least one of the terminal device and the another terminal device is connected to a cellular network. The method may further comprise initiating a connectivity check procedure to determine one or more candidate paths through which the terminal device has connectivity to the another terminal device. The one or more candidate paths are from at least two paths associated with the network addresses of the another terminal device. The method may further comprise selecting a path for the terminal device and the another terminal device among the one or more candidate paths, based at least in part on a predefined criterion.

Abstract: In a control terminal device for controlling a plurality of devices, when account information is registered in a first device which is one of the plurality of devices, after completion of registration of account information in the first device, a second device in which the account information is not registered is searched, and the account information is registered in the searched second device.

Abstract: Disclosed are a data transmission method, apparatus and system. A first paging message carries first indication information related to random access, so that a base station can complete identification of a terminal when the base station receives a preamble sent by the terminal, and downlink data to be transmitted may be carried in a second signaling flow. Meanwhile, second indication information indicating whether the transmission of the downlink data is completed may also be carried so that the terminal enters a radio resource control (RRC) suspension state. Finally, power consumption, a latency and resource overhead of the terminal are effectively reduced.

Abstract: System and method of dynamically selecting an egress edge node for data transmission between different autonomous systems based on real-time route performance detection. With respect to a destination node located in a second autonomous system, a plurality of edge nodes in the first autonomous system each operate to detect route performance in real-time and send the detected information to a control center for evaluation. The evaluation results are compared and used to select an optimal edge node and an associated link for transporting data between the source node and the destination node. To switch from a first edge node to a second one, the IP address of the source node contained in the data packets are converted from an address assigned to the first edge node to an address assigned to the second edge node.

Abstract: The present invention relates to a method for transmitting a control message by a control entity in a software defined network-based mobile communication system, the method comprising the steps of: detecting the occurrence of at least one event associated with at least one terminal; buffering the at least one event until a predetermined condition is satisfied; and transmitting, to a switching entity, a control message corresponding to the at least one buffered event when the predetermined condition is satisfied. However, the present invention is not limited to the above embodiment, and other embodiments are possible.

Abstract: The present disclosure provides a method of interconnecting between network applications and a type of network access apparatus, the method includes: acquiring a network address and a network application Port Number of a first network device and first validation information; receiving a network address and an application Port Number of a second network device and second validation information according to the network address and the network application Port Number of the first network device and the first validation information; validating whether the network address and the application Port Number of the second network device is connection information requested by the network application of the first network device according to the second validation information; if yes, connecting the network application of the first network device with the network application of the second network device according to the network address and the network application Port Number of the second network device.

Abstract: An interface bridge to enable communication between a first integrated circuit die and a second integrated circuit die is disclosed. The two integrated circuit die may be connected via chip-to-chip interconnects. The first integrated circuit die may include programmable logic fabric. The second integrated circuit die may support the first integrated circuit die. The first integrated circuit die and the secondary integrated circuit die may communicate with one another via the chip-to-chip interconnects using an interface bridge. The first and second component integrated circuits may include circuitry to implement the interface bridge, which may provide source-synchronous communication using a data receive clock from the second integrated circuit die to the first integrated circuit die.

Abstract: Various embodiments provide for using data encapsulation to extend support of an Audio Video Transport Protocol (AVTP) standard, which can be used in such applications as data network communications between sensors (e.g., cameras, motion, radar, etc.) and computing equipment within vehicles (e.g., smart and autonomous cars).

Abstract: A scalable hierarchical low latency communication network architecture is disclosed. This architecture uses a novel multi-node, multi-packet block acknowledgement (ACK) wireless communication method. The method is used in a scalable hierarchical architecture for a non-transitory computer readable storage medium storing one or more programs. The one or more programs comprising instructions to perform the following steps: receive multiple data and control packets at a central hub from multiple nodes; create a single ACK packet for the multiple data and control packets received at the central hub from the multiple nodes; and communicate the single ACK packet that acknowledges reception of the multiple data and control packets to the multiple nodes.

Abstract: Connection control circuitry is provided for a User Equipment (UE) configurable to offload communication of packet data from a cellular radio-access network comprising a Trusted Wireless Local Access Network (TWLAN) and a Trusted Wireless Access Gateway (TWAG) with IP Address preservation. The connection control circuitry has a connection requesting module configured to send a distinguishable-connection establishment message to the TWAG, requesting setup of a TWAG-routed data connection comprising at least one of a Packet Data Network (PDN) connection and a Non-Seamless Wireless Offload (NSWO) connection. A unique virtual gateway interface address is used to identify a point-to-point link between the UE and the TWAG. This allows the TWAG to distinguish between multiple substantially simultaneous point-to-point links which support multiple substantially simultaneous packet data connections. Other embodiments may be described and claimed.

Abstract: Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Abstract: Some embodiments provide a novel method for configuring managed forwarding elements (MFEs) to handle data messages for multiple logical networks that are implemented in a data center at the MFEs and to provide gateway service processing (e.g., firewall, DNS, etc.). A controller, in some embodiments, identifies logical networks implemented in the datacenter and MFEs available to provide gateway service processing and assigns gateway service processing for each logical network to a particular MFE. The MFEs, in some embodiments, receive data messages from endpoints in the logical networks that are destined for an external network. In some embodiments, the MFEs identify that the data messages require gateway service processing before being sent to the external network. The MFEs, in some embodiments, identify a particular MFE that is assigned to provide the gateway service processing for logical networks associated with the data messages.

Abstract: An interface device (100) for interfacing between a network device (170-240) and a software-defined networking (SDN) controller (150), the interface device (100) comprising: a first interface (140) for connecting the interface device (100) to the SDN controller (150); a second interface (160) for connecting the interface device (100) to the network device (170-240); a vendor and technology specific layer module (110), which is operative to transmit control and message data to, and to receive control and message data from, the network device (170-240) in a native control and message data protocol of the network device; a device abstraction layer module (120), which is operative to generate a device abstraction model (400) representing capabilities of the network device (170-240); and a protocol mapping layer module (130), which is operative to map control and message data used by the network device (170-240) onto the device abstraction model (400), such that messages issued by the SDN controller (150) in its n

Abstract: A system can include a host device that includes a host management component and a virtual machine execution environment. The host device can execute the host management component and determine that the host device, a hypervisor machine in the virtual machine execution environment, or a virtual machine in the virtual machine execution environment violates at least one compliance rule. The host device can also cause the host management component to perform an action in response to determining that the at least one compliance rule is violated.

Abstract: A computer system for controlling data linkage achieves higher rate data transfer between a first system that performs operations and a second system that acquires data regarding the operations reduces influence on the operations and between the systems. The first system includes a storage unit that manages resources storing data and a control unit that controls data transfer and the second system includes a data acquisition unit. The control unit calculates cost that represents a load of the first system with respect to each of multiple data transfer schemes, determines an applicable data transfer scheme based on the cost, and notifies the second system of that scheme. The data acquisition unit manages states associated with the determined data transfer scheme and sends a request to acquire data from resources based on the determined data transfer scheme and the states.

Abstract: Improved virtualized application performance is provided through disabling of unnecessary functions, such as unnecessary encryption and decryption operations. An example method performed by a hypervisor includes the steps of obtaining a request from a first virtual machine to perform one or more of encrypting and decrypting of a communication between the first virtual machine and a second virtual machine; determining when the first and second virtual machines execute on a same host as the hypervisor; and in response to the first and second virtual machines executing on the same host: processing the communication without performing the one or more of encrypting and decrypting of the communication, wherein the hypervisor initiates an encryption of further communications between the first virtual machine and the second virtual machine in response to at least one of the first virtual machine and the second virtual machine being moved from the same host.

Abstract: Systems and methods for locating a cellular phone are provided. More particularly, systems and methods for providing the location of a requested user's cellular phone from a requesting user's device (e.g., a second cellular phone) based on access rights defined by the requested user. Location descriptions may be provided at a multitude of levels. For example, if a cellular phone, or an identity associated to (e.g., logged into) a cellular phone, has been given access rights to a cell phone's exact location for an indefinite amount of time, that cell phone can receive, on command, the exact location of the approved cell phone. Other levels of location information that can be granted include, for example, proximities, states, and countries.

Abstract: A system for configuring a data center includes a fabric management server coupled to a management switch. A provisional Software Defined Networking (SDN) controller executing on the fabric management server can discover physical servers coupled to the management switch, receive network interface configuration information from the physical servers, and use the discovered network interface configuration information to determine a configuration for switches and servers coupled to an IP fabric. The configuration can be migrated to a full functionality SDN controller.

Abstract: For a virtual distributed network environment employing physical forwarding elements that includes both software forwarding elements and third party devices serving as hardware forwarding elements, a scalable method for synchronizing configuration data of logical forwarding elements that are distributed across the various physical forwarding elements is provided. The method generates and updates the configuration data at a set of central controllers and then distributes the configuration data to the physical forwarding elements. The method delivers the updated configuration data to some of the physical forwarding elements by (i) determining a delta/differential between the updated configuration data held at the central controller and the obsolete configuration data held at those physical forwarding elements and (ii) delivering the determined differential configuration data to the physical forwarding elements.

Abstract: A configured mode of operation of a wireless sensor node unit can selectively activate a first subset of sensor channels of data and selectively deactivate a second subset of sensor channels of data. The configured mode of operation customizes the sensor functionality in the wireless sensor node unit in support of the delivery of data streams to customers.

Abstract: A video encoding device (e.g., a wireless transmit/receive unit (WTRU)) may transmit an encoded frame with a frame sequence number using a transmission protocol. The video encoding device, an application on the video encoding device, and/or a protocol layer on the encoding device may detect a packet loss by receiving an error notification. The packet loss may be detected at the MAC layer. The packet loss may be signaled using spoofed packets, such as a spoofed NACK packet, a spoofed XR packet, or a spoofed ACK packet. A lost packet may be retransmitted at the MAC layer (e.g., by the encoding device or another device on the wireless path). Packet loss detection may be performed in uplink operations and/or downlink operations, and/or may be performed in video gaining applications via the cloud. The video encoding device may generate and send a second encoded frame based on the error notification.

Abstract: A first provider edge device may receive device information from a second provider edge device included in an Ethernet virtual private network (EVPN). The device information may identify a media access control (MAC) address and may indicate that the device is connected to the second provider edge device. The first provider edge device may receive data transmitted by the device and may determine, based on information included in the data, that the device has moved from the second provider edge device to the first provider edge device. The first provider edge device may generate a data packet including mobility information indicating that the device has moved to the first provider edge device. The first provider edge device may transmit, via a data plane of the EVPN, the data packet to the second provider edge device to permit the second provider edge device to update routing information for the device.

Abstract: Systems, methods, and software are disclosed herein for routing in-bound communications to an infrastructure service. In an implementation, an infrastructure service receives a request from an end point for content associated with an origin. The service sends a connection request to the origin from an initial network address. After detecting a failure of the origin to respond to the connection request, the service sends multiple connection requests to the origin from different network addresses. Upon receiving one or more replies to the connection requests, the service identifies which reply was received first and a network address to which the reply was sent. The service proceeds to establish a connection with the origin using the identified network address and obtains the content from the origin over the connection. The infrastructure service may then send the content to the end point.

Abstract: In one or more embodiments, one or more systems, methods, and/or processes may receive, from first computer systems, data sets via a first different data encapsulations; obtain the data sets from the first different data encapsulations; produce second different data encapsulations that include the data sets; and provide the second different data encapsulations that include the data sets to second computer systems that subscribed to receive the data sets. In one or more embodiments, the data sets may be included in one or more data streams. In one or more embodiments, the one or more systems, methods, and/or processes may store at least two of the data sets. For example, at least two of the data sets may be stored until they are requested by one or more computer systems. In one or more embodiments, one of the data sets may be duplicated and provided to multiple computer systems.

Abstract: There is presented a method and apparatus for controlling secure communications in a communications network. An intermediate network element (INE) receives a request from a client to establish a secure connection between the client and a first server. The received request is analysed to determine a client identifier. The INE determines, based on the client identifier whether to attempt to establish a secure connection between the client and the INE. Responsive to a determination not to attempt to establish a connection, the received request is forwarded on to a second server. Responsive to a determination to attempt to establish a connection, a message comprising information for the client to use in establishing a secure connection with the INE is sent to the client.

Abstract: A method of bootstrapping between endpoint client and server in a low power wireless network, the method comprising: initiating a bootstrap request from an endpoint client to the server with the bootstrap request including an endpoint client name in an identifier; determining a registry apparatus to be assigned to the endpoint client; accepting the bootstrap request at the server and in response to the bootstrap request providing a security object and an identifier to the endpoint client to identify the assigned registry apparatus.

Abstract: A method may include receiving a first message requesting a change associated with an Ethernet service that includes routing data from a user device to a destination device via a first service provider and a second service provider. The method may also include determining, by the first service provider, whether resources are available in a first network associated with the first service provider to fulfill the requested change and determining, by the second service provider, whether resources are available in a second network associated with the second service provider to fulfill the requested change. The method may further include sending a second indicating whether the change is accepted and in response to determining that the change is accepted, automatically implementing the change for the Ethernet service.

Abstract: A system and a method of detection of an attack on a computer network including a plurality of nodes, the method including: associating the plurality of nodes with each other in a distributed ledger configuration; producing, by a requesting node of the plurality of nodes, a request to set a value of at least one key derivation parameter; performing a vote of confidence among a subset of the plurality of nodes regarding the validity of the request; and detecting an attack on at least one node of a plurality of nodes according to the vote of confidence.

Abstract: Methods and systems are described wherein an initiating device sends a communication requesting a voice call session with a recipient device. In response, the initiating device receives a communication indicating that the initiating device can provide a text message instead of establishing the voice call session. In some cases, the communication may refuse the request voice call session, while in other cases the communication may simply indicate that the recipient device supports text messaging as an alternative to voice mail. As a result of the received communication, the initiating device outputs a text input prompt. After receiving text input in response to the prompt, the initiating device sends a text message containing the received text input.

Abstract: The disclosure relates to migration of virtual machines. In an example implementation, migration of a virtual machine (VM) is initiated from a source hypervisor to a destination hypervisor. A destination fibre channel (FC) port associated with the destination hypervisor is assigned to support a virtual initiator port of the VM upon migration, where the destination FC port is assigned using at least error statistics collected for the destination FC port. The VM is migrated from the source hypervisor to the destination hypervisor by supporting the virtual initiator port of the VM on the assigned destination FC port associated with the destination hypervisor.

Abstract: This application provides a data service method relates to the field of communications technologies, the method comprises: a first router is connected to a second router, and the first router establishes a connection to the Internet. The terminal establishes a wireless local area network connection to the second router. A terminal broadcasts request information for obtaining a network configuration parameter. The terminal receives and stores a first network configuration parameter and a second network configuration parameter respectively sent by the first router and the second router; and determines a network configuration parameter used for network configuration. The second router receives a second data service request sent by the terminal, and forwards the request to the first router, so that the first router sends the request to a server through the Internet, thereby implementing a second data service of the terminal.

Abstract: In general, embodiments of the invention relate to distributed monitoring of operations of production hosts and applications executing thereon. The distributed monitoring may enable more granular monitoring of production hosts and applications without increasing the overhead required to perform such monitoring, e.g., without substantially increasing the overhead on the production hosts or applications and/or without increasing the overhead of a management device that is managing the production hosts.

Abstract: A socket-intercept layer in kernel space on a network device may intercept a packet destined to egress out of the network device. The socket-intercept layer may then query a routing daemon for the Maximum Transmission Unit (MTU) value of the interface out of which that packet is to egress from the network device. In response to this query, the routing daemon may provide the socket-intercept layer with the MTU value of that interface. A tunnel driver in kernel space may identify the size of the packet and fragment the packet into segments whose sizes are each less than or equal to the MTU value of the interface. The tunnel driver may then push the segments of the packet to a packet forwarding engine on the network device. In turn, the packet forwarding engine may forward the segments of the packet to the corresponding destination via the interface.

Abstract: In a situation of setting a file name and the like by using a character string obtained by performing OCR processing to a scan image, a file name and the like can be immediately set with less calculation resources.

Abstract: A system and method for providing multiple modes of communication in wireless networks includes a network manager and a plurality of network nodes. The plurality of network nodes form a wireless network with the network manager and are configured to communicate data to the network manager using respective communication links having a first bandwidth. The plurality of network nodes are further configured to transition to a two-hop mode of communication upon one or more failures in communication to the network manager. While in the two-hop mode of communication, a respective network node of the plurality of nodes is configured to transmit node data to at least one other network node over a communication link having a second bandwidth different than the first bandwidth. The other network nodes are configured to listen for communication from the respective network node and re-transmit to the network manager the node data received from the respective network node.

Abstract: A cloud environment is provided generally having a private data center possessing a controller/routing system and nonvolatile mass storage, a plurality of data objects retained in the nonvolatile mass storage, and a public cloud storage service provider linked to the controller/routing system. The public cloud storage service provider possessing a database containing policy decisions and metadata of the plurality of data objects. When a data object is uploaded by an end-user to a specific data bucket to the private data center in the cloud environment. Meta data and location information about the data object is uploaded to the public cloud storage service provider. The private data center is not in possession of the policy decisions and the metadata for data objects. The data center is independent of the public cloud storage provider.

Abstract: A method for flow rule installation in a flow-based programmable network device, includes obtaining packet flow information that includes information about times and intervals of packet flow transmissions from data transmitting devices, programming, by a controller entity, forwarding rules into a flow table based on the packet flow information, and triggering activation of a forwarding rule programmed for a particular packet flow just-in-time before actual transmission of the particular packet flow. The flow-based programmable network device comprises input/output ports, a flow table including forwarding rules that map packet flows from data transmitting devices in the network, received on an input port, to an output port based on a packet flow matching a rule in the forwarding rules, and a state table including state entries that specify states of the packet flows.