Abstract: A method, system, and computer usable program product for selective link aggregation in a virtualized data processing environment are provided in the illustrative embodiments. A data packet is received at a switch. An identifier associated with the data packet is determined. The identifier corresponds to a logical partition in a logical partitioned data processing system. A lookup is performed in a data structure to determine a set of ports associated with the identifier. The set of ports is retrieved from the data structure. A port is selected from the set of ports and the data packet is transmitted from the port to the logical partition.

Abstract: A router detects a network attack and forwards traffic associated with the network attack to a discard interface. The router applies one or more filters to calculate traffic flow statistics for the traffic forwarded to the discard interface. The router may exchange routing communications with one or more other routers to alert the routers of the network attack. For example, the router may generate a routing communication in accordance with a routing protocol that advertises a route to the targeted device, and includes a policy tag that indicates the existence of a network attack. The other routers update forwarding information in accordance with the advertised route, and automatically forward traffic to respective discard interfaces based on the policy tag, thereby diffusing the network attack.

Abstract: A network switch device receives a communication packet having a source MAC address s and a destination MAC address d at a switch port p. Then, the network switch device determines whether a valid routing table entry (s, p) exists, there by indicating that the source MAC address s is reachable via a switch port p. The network switch device further determines for the destination MAC address d whether there is at least one switch port q for which a valid routing table entry (d, q) exists, there by indicating that d is reachable via a switch port q. When the routing table entries (s, p) and (d, q) exist, the network switch device routes the communication packet to the switch port q.

Abstract: A switching node comprises edge nodes interconnected by independent switch units. The switch units are arranged in at least one switch plane and the switch units of each switch plane are arranged in a matrix having several rows and several columns. Each edge node has a channel to a switch unit in each column in each switch plane and a channel from each switch unit in a selected column in each switch plane. Simple paths, each traversing only one switch unit in a switch plane, may be established for any directed edge-node pair. Additionally, several non-intersecting compound paths, each comprising at most two simple paths, may be established for any edge-node pair. A significant proportion of traffic may be routed through simple paths. The switching node employs distributed control scheme and scales gracefully from a capacity of a fraction of a terabit per second to thousands of terabits per second.

Abstract: A switching network for efficiently receiving and transmitting data packets having both frames and messages includes a crossbar switch with a plurality of surrounding ports for exclusively switching frames which normally consist of large data streams of 40 to 60 bytes. Then the ports are connected together in a message ring and small data entity messages, for example 4, 8, or 12 bytes, are switched from an input port to an output port around the ring avoiding congestion of the crossbar switch.

Abstract: A technique is disclosed for managing load balancing operations in a storage area network. A frame is received at a switch in the fibre channel fabric. According to a specific implementation, the frame includes header information including a source device identity and a destination device identity. Zone and/or flow information relating to the identity of the zone/flow which is associated with the frame is identified. Using the identified information, a load balancing mechanism to be used for handling the frame is selected. According to a specific implementation, the selection of the load balancing mechanism is based at least in part upon the identity of the zone and/or flow which is associated with the frame.

Abstract: A method for communication includes associating respective feature chains with a plurality of interfaces of a data switch. The feature chains include service features. A respective failure policy is defined for each of one or more of the service features in each of the feature chains. Upon detecting a failure in a service feature in a feature chain associated with one of the interfaces, data packets are routed through the data switch while applying, responsively to the failure, the respective failure policy to the one of the interfaces.

Abstract: Methods and apparatus are presented for implementing a uniform platform for data/voice service, in which a base station controller and a Multi-BSSFast Packet Server are integrated into one rack, and a base station controller is connected to the Multi-BSSFast Packet Server via a link based on E1 over Ethernet (E1oE).

Abstract: Virtual Network Interface Controllers (vNICs) provide for communication among modules of Enterprise Server (ES) embodiments via a switch fabric dataplane. Processes executing on compute complexes of the servers exchange data as packets or messages by interfaces made available through vNICs. The vNICs further provide for transparent communication with network and storage interfaces. vNIC provisioning capabilities include programmable bandwidth, priority scheme selection, and detailed priority control (such as round-robin weights). In some embodiments, vNICs are implemented in Virtual Input/Output Controllers (VIOCs). In another aspect, Virtual Local Area Networks (VLANs) enable access to layer-2 and selected layer-3 network functions while exchanging the packets and messages. VLAN identification is provided in each vNIC, and VLAN processing is partially performed in VIOCs implementing vNICs.

Abstract: Modules and methods are described for buffering packets to be switched in a system, such as a programmed device. The modules can be configured for different packet lengths, protocols, applications, and/or designs in a larger system. Techniques and mechanisms are further described for implementing a central memory and a linked-list addressing scheme. Accordingly, memory blocks of the central memory can be used for variable length packets and further reused at substantially the same time as they become available, thereby improving packet switching efficiency and/or flexibility.

Abstract: A communication method for transmitting Ethernet messages in a distributed real-time system in which a plurality of network node computers, e.g. four network node computers (111, 112, 113, 114), each comprising at least one communication controller (121, 122, 123, 124), are linked via a communication system comprising one or more communication channels (109), one or more intelligent star couplers (101, 102) being disposed in each communication channel. According to the invention, a distinction is made between conventional Ethernet messages (ET messages) and time-triggered Ethernet messages (TT messages), the TT messages being transported with an a priori known constant delay time (?) between transmitter and receiver, and, when there is a time conflict between ET and TT messages, the transport of the ET message that is in conflict being delayed or aborted in order to be able to transport the TT message with the constant delay time (?).

Abstract: This invention provides a new architecture for a communication system between head-ends and end-users which expands bandwidth and reliability of the communication system. A mux-node receives communication signals from a head-end and forwards the received communication signals to one or more mini-fiber nodes. The connection to the head-end is via a small number of optical fibers and the connections to each of the mini-fiber nodes may be via one or more optical fibers that may provide full duplex communication. The head-end may communicate with the mux-node using digital or digital and analog signals. The mini-fiber nodes may combine the signals received from the head-end with loop-back signals used for local media access control prior to forwarding the signals to the end-users. Upstream data are received by the mini-fiber nodes and transmitted to the mux-node.

Abstract: Setting up a group of virtual circuits using a single set up message request. In an embodiment, fewer than all of the virtual circuits in the group are immediately provisioned, and the remaining virtual circuits are placed in an inactive status by appropriate configuration of all the devices in the path of the group of virtual circuits. Each of the inactive virtual circuits can be activated (complete provisioning) as and when required. The bandwidth overhead on the networks is reduced as fewer signaling messages would be used in provisioning several virtual circuits. The parsing overhead is reduced on the devices processing the signaling messages as a result.

Abstract: A packet switch including input ports and output ports allocates an output bandwidth of each output port among virtual channels based on bandwidth allocations values corresponding to the virtual channels and a bandwidth precision value of the output port. The bandwidth precision value indicates a number of bandwidth precision bits, which may be outside a bandwidth reservation precision range specified in a serial RapidIO standard. The packet switch receives data packets compliant with the serial RapidIO standard at the input ports, identifies an output port for each data packet, and selects input ports based on the output ports of the data packets. Further, the packet switch routes a data packet from each selected input port to the output port of the data packet, and the output port outputs the data packet by using the output bandwidth of the output port allocated to the virtual channel identified by the data packet.

Abstract: The embodiment of the present invention provides a method for establishing P2P connection, comprising the steps of: a first terminal initiating connection sends a message to a second terminal to be connected, wherein the message contains the address of the first terminal; the second terminal reads the address of the first terminal initiating connection upon receiving the message, and initiates a P2P connection to the address of the first terminal. The embodiment of the present invention also provides another method for establishing P2P connection, through which both UDP P2P connection and TCP P2P connection can be established.

Abstract: A relay device (1) includes a plurality of network processing units (200-1˜200-N) having the same function and structure. A session management unit (202-1) in a certain network processing unit (e.g. 200-1), when receiving a packet from an external network through an IF unit (e.g. 204-1-1) in the same processing unit, searches a session table (230-1) for IF specifying information indicative of an IF unit as an output destination determined for a session to which the above packet belongs. When the above IF specifying information indicates an IF unit (e.g. 204-N-M) in other network processing unit (e.g. 200-N), a packet processing unit (201-1) transfers the above IF specifying information and the above packet to the network processing unit (200-N) through a switch unit (300). A packet processing unit (201-N) in the network processing unit (200-N) outputs the above packet to the IF unit (204-N-M) represented by the IF specifying information.

Abstract: This invention provides a new architecture for a communication system between head-ends and end-users which expands bandwidth and reliability of the communication system. A mux-node receives communication signals from a head-end and forwards the received communication signals to one or more mini-fiber nodes. The connection to the head-end is via a small number of optical fibers and the connections to each of the mini-fiber nodes may be via one or more optical fibers that may provide full duplex communication. The head-end may communicate with the mux-node using digital or digital and analog signals. The mini-fiber nodes may combine the signals received from the head-end with loop-back signals used for local media access control prior to forwarding the signals to the end-users. Upstream data are received by the mini-fiber nodes and transmitted to the mux-node.

Abstract: A network system (10). The system comprises a network (WAN1, LAN1, LAN2) having an architectural model comprising a plurality of layers. The system also comprises a centralized manager node (CM1), coupled to the network. The system also comprises a plurality of routers (ERx) coupled to the network for communicating packets along the network and coupled to communicate with the centralized manager node. The centralized manager is programmed to perform the step (28) of communicating mapping information to each of the plurality of routers, and the mapping information comprises a correspondence of a behavior on a first of the plurality of layers with a behavior on a second of the plurality of layers.

Abstract: The invention relates to a method for controlling a bit-rate of a session in a packet-switched communications system where multiple sessions are set-up via a shared resource. A current bit-rate of the session is compared to a bit-rate range valid for the session to determine a distance from the position of the current bit-rate to one of the end-points of the bit-rate range. The current bit-rate is then adapted differently depending on the distance to the selected end-point. By controlling the bit-rate of each session that is set-up via the shared resource for applications that provide delay-sensitive services to users in this way the method and corresponding system and sender-receiver arrangements have the effect that rate adaptations can be distributed among the applications so that users share responsibility for rate adaptations.

Abstract: A switching apparatus distributes incoming calls to end point terminals that belong to a service group and that interact with the switching apparatus via messages. The messages query the end point terminals by specifying a range and asking those end point terminals that meet a criterion associated with the range to respond. By iteratively narrowing the range, for example, in a binary search fashion, one of the end point terminals is selected. In one embodiment, the range relates to fixed sequence IDs of the end point terminals and the criterion relates to whether an end point terminal is idle or not. In another embodiment, the range incorporates the idle/not idle state of the end point terminals by specifying idle time durations.

Abstract: A packet switching system capable of ensuring the sequence and continuity of packets and further compensating for delays in transmission is disclosed. Each of two redundant switch sections has a high-priority queue and a low-priority queue for each of output ports. A high-priority output selector selects one of two high-priority queues corresponding to respective ones of the two switch sections to store an output of the selected one into a high-priority output queue. A low-priority output selector selects one of two low-priority queues corresponding to respective ones of the two switch sections to store an output of the selected one into a low-priority output queue. The high-priority and low-priority output selectors are controlled depending on a system switching signal and a packet storing status of each of the high-priority and low-priority queues.

Abstract: This invention is an architecture, system, method, program product, licensing method, or apparatus for sharing and protecting data in a data storage environment, wherein there is more than one site for data storage and a connection broker is used.

Abstract: A communication system between head-ends and end-users is provided which expands bandwidth and reliability. A concentrator receives communication signals from a head-end and forwards the received communication signals to one or more fiber nodes and/or one or more mini-fiber nodes. The concentrator demultiplexes/splits received signals for the mini-fiber nodes and the fiber nodes and forwards demultiplexed/split signals respectively. The mini-fiber nodes may combine signals received from the head-end with loop-back signals used for local medium access control prior to forwarding the signals to the end-users. Upstream data are received by the mini-fiber nodes and/or fiber node and transmitted to the concentrator. The concentrator multiplexes/couples the mini-fiber node and the fiber node upstream signals and forwards multiplexed/coupled signals to the head-end.

Abstract: A method for changing zoning in a fiber channel fabric is provided. The method includes receiving zone date from a management module, wherein the zone data is received by a fiber channel switch; waiting for active Zone Set; and sending a merge request to neighboring switches. The method also includes: sending Zone Merge Data Start message to the management module; sending new zone data to management module; and comparing the new zone data with current zone data. The method also includes creating acceptance message for new zoning, wherein the management module creates the acceptance message.

Abstract: A multiport switch circuit which performs transfer according to flow control and a protocol with an ordering rule specified, wherein the circuit for avoiding packets from clogging is realized in a small size. A packet receiving side circuit has a packet selection output circuit to suppress a circuit size by decreasing the number of transfer data paths, and the packet selection output circuit performs output of selected packets according to a priority packet type selection instruction signal in addition to output of a receiving order packet according to a receiving order output instruction signal to make it possible to avoid clogging caused because the packets made to wait for transmission by the flow control cannot be overtaken by another packet type according to the ordering rule.

Abstract: A system and method are disclosed for time-domain wavelength interleaved networking that reduce the need for complex time-slot scheduling and reduce the routing complexity. Substantially all communications in the time-domain wavelength interleaved network pass through a hub node. In addition, interior nodes in the time-domain wavelength interleaved network will forward substantially all communications received from the hub node that are destined for another node on all branches outward from the hub node. The central hub node can impose a timing reference. Thus, the transmission and reception of a message can be synchronized such that a message sent in a time-slot k by a node Ni will be received by a node Nj in the time-slot k. Further, the hub node can recover from a link failure by shifting transmission times of all nodes that are separated from the hub node by the failed link.

Abstract: A method and apparatus for determining information associated with a particular multicast channel in a multicast network are disclosed. In accordance with the method, a request message requesting information associated with the particular multicast channel is generated and sent to the multicast network. Further, the request message is propagated downstream in a recursive manner via a multicast topology of the multicast network. A response to the request message is propagated upstream via the multicast topology to generate a response message including requested information associated with the particular multicast channel. The information may comprise number of users receiving the particular multicast channel.

Abstract: A method of allocating switch requests within a packet switch, the method comprising the steps of collecting switch request data at each input port; processing the switch request data for each input port to generate request data for each input port-output port pairing: comparing the number of requests from each input port and to each output port with the maximum request capacity of each input port and each output port; satisfying all requests for those input-output pairs where the total number of requests is less than or equal to the maximum request capacity of each input port and each output port; reducing the number of requests for those input-output pairs where the total number of requests is greater than the maximum request capacity of each input port and each output port such that the number of requests is less than or equal to the maximum request capacity of each input port and each output port; and satisfying the remaining requests.

Abstract: A network device for processing a packet can have at least one port within the network device configured to received or transmit a packet, and a storage unit configured to store a port bit map, wherein the port bit map corresponds to the at least one port. Furthermore, the network device for processing a packet can have a rules table configured to have at least one port match entry and at least one action corresponding to the at least one port match entry therein, and a control unit configured to compare the port bit map with the at least one port match entry, and to implement the at least one action when a first positive value results from comparing the port bit map with the port match entry.

Abstract: A system is taught in which a module having processing elements can access network and storage interfaces that are external to the module of the processing elements as though those interfaces were located internal to the module of the processing elements. The system may be operated as one or more provisioned servers, each of the provisioned servers including capabilities as identified by a corresponding set of specifications and attributes, according to various embodiments. Typically the specifications (or constraints) and attributes are specified with a Server Configuration File. An Enterprise Server system may be provisioned into any combination and number of servers according to needed processing and I/O capabilities. Each of these servers may include distinct compute, storage, and networking performance. Provisioned servers may be managed similar to conventional servers, including operations such as boot and shutting down.

Abstract: An information management system for a device network is disclosed. The information management system may include a service requester node, a monitoring node, and a service provider node. The system may include a service oriented request message including a message header, having a list of destination nodes, including the service provider node, to which the service oriented request message is addressed, and a service request. The system may include a routing module disposed in the monitoring node and configured to analyze the list of destination nodes in the message, create a modified message including at least one child node selected from the service provider nodes based on a fan-out of the device network, and forward the modified message to the at least one child node, the modified message including a message header, having an updated list of one or more destination nodes, including the service provider nodes, to which the modified message is addressed, and the service request.

Abstract: In one embodiment, an apparatus includes a switch core that defines a single logical entity and has a multi-stage switch fabric physically distributed across a plurality of chassis. The multi-stage switch fabric has a plurality of ingress ports and a plurality of egress ports. The switch core is configured to be coupled to a plurality of peripheral processing devices via the plurality of ingress ports and the plurality of egress ports. The switch core is also configured to provide non-blocking connectivity at line rate between a first peripheral processing device disposed with a first chassis and a second peripheral processing device disposed within a second chassis.

Abstract: A system for switching data packets through a multiple (m) input, multiple (n) output switching device providing switching having a fast one-cycle throughput. A respective switching device behaves like an output queued switch from a set of distributed output queues reading the incoming input control information from the plurality of input ports (IP) and compresses the information in a form which allows an easy association with a respective output port (OP) to which an individual input port is temporarily mapped.

Abstract: A hybrid server and multi-layer switch system architecture, referred to hereinafter as the Enterprise Fabric (EF) architecture, forms the basis for a number of Enterprise Server (ES) chassis embodiments. Each ES embodiment generally includes one or more Processor Memory Modules (PMMs, each generally having one or more symmetric multiprocessor complexes), one or more Network Modules, and a System Control Module (SCM). The SCM includes a cellified switching-fabric core (SF) and a System Intelligence Module (SIM). Each PMM has one or more resident Virtual IO Controller (VIOC) adapters. Each VIOC is a specialized I/O controller that includes embedded layer-2 forwarding and filtering functions and tightly couples the PMM to the SF. Thus the layer-2 switch functionality within the ES chassis is distributed over all of the SCM, NM, and PMM modules.

Abstract: The solution of the present invention provides systems and methods for encoding information into an Internet Protocol identification field (IPID) of an IP layer header of a network packet in a manner acceptable to many or all of the network devices that encounter the encoded packet. In one embodiment, the solution described herein encodes the IP identification field of the IPID header with information to be communicated between devices. Appliances may use the encoded IP field as a signal or a means for a low-bandwidth subcarrier of data between the appliances that is transparent to any intervening network equipment. For example, the encoded field may be used to announce or probe the presence of a device, a functionality or capability of device or to indicate a type or speed of a network connection of a port on a device.

Abstract: A switching interface comprising a switch having an input and a plurality of outputs, and a memory associated with the switch. The switch is adapted to receive a packet from the input, the packet to be forwarded to a destination device coupled to a one of the plurality of outputs. The switch is responsive to store the packet in the associated memory. The switch is further responsive to a signal from the destination device to forward the packet from the associated memory to the destination device through the one of the plurality of outputs. Optionally, the switching interface may further comprise a packet encryption engine coupled between the input and the associated memory. Typically, the output devices coupled to the plurality of outputs will each have its own separate encryption process; in these scenarios the encryption engine will have logic for determining the appropriate encryption for the output device.

Abstract: Method and system for compressing a data packet is provided. The method includes receiving a data packet; comparing the data packet with content stored in a history module; wherein plural comparisons are performed in parallel; generating a plurality of masks based on the comparisons; comparing the plurality of masks; selecting one of the plurality of masks, based on the mask comparison; and generating a compression record, wherein the compression record includes; size of a data packet, an address field, a mask field and data; and a data packet header includes a control bit indicating if the data packet is compressed.

Abstract: A content relay node comprising a data processing unit for storing or transmitting a data packet on the basis of the data attribute, a storage connected to the data processing unit, transmitting units each for processing the header of a data packet in accordance with a control signal from the data processing unit and transferring the data packet to a neighboring relay node, and a routing control unit for selecting the transmitting unit or the data processing unit as a destination of a data packet on the basis of routing information including a storage address, wherein the storage unit stores a copy of a data packet at least until transfer of the data packet to the next node is completed.

Abstract: The solution of the present invention provides systems and methods for preserving transport layer header options traversing network devices that terminate transport layer connections. The solution described herein provides a bi-directional intelligent proxying system by which a proxy client exchanges transport layer option information with a proxy server via an application layer protocol. The proxy server, which may be in the form of an appliance, re-injects the transport layer options received from the client into the appropriate network packets communicated on the intended network. Likewise, the proxying appliance can inform the proxy client of transport layer options received from the network, such as via a server. With this solution, devices that transmit control information, exchange communications or other functionality via transport layer options may continue to operate in conjunction with transport layer terminating devices.

Abstract: A system and method for increasing transmission distance and/or transmission data rates using tedons and an encoding scheme to reduce the number of ones in a data signal is described. For example, the method for increasing transmission distance and transmission data rate of a fiber optical communications link using tedons includes the steps of encoding a data signal to be transmitted using an encoding scheme that reduces a number of ones in the data signal, transmitting the encoded data signal over the fiber optical communications link, receiving the encoded data signal and decoding the encoded data signal.

Abstract: A method of detecting congestion in a communications network and a network switch are described. The method comprises identifying an output link of a network switch as a congested link on the basis of a packet in a queue of the network switch which is destined for the output link, where the output link has a predetermined state; and identifying a packet in a queue of the network switch as a packet generating congestion if the packet is destined for a congested link.

Abstract: A packet switch apparatus for switching a packet between a plurality of input ports and a plurality of output ports includes a plurality of input buffers for storing a packet inputted to the input port, a plurality of output buffers for storing a packet outputted to the output port, and a path controller for transmitting the packet stored in the input buffer to the output buffer on the basis of path information of the packet stored in the input buffer by a higher transfer rate than an input rate for receiving the packet at the input port.

Abstract: A multi-service platform system (100) includes a VXS backplane (104), a switched fabric (106) operating on the VXS backplane, a parallel bus (108) operating coincident with the switched fabric on the VXS backplane, a VXS payload module (102) coupled to the VXS backplane, and a storage module (110) coupled to the VXS payload module, wherein the storage module is coupled to communicate with the switched fabric.

Abstract: A hybrid server and multi-layer switch system architecture, referred to hereinafter as the Enterprise Fabric (EF) architecture, forms the basis for a number of Enterprise Server (ES) chassis embodiments. Each ES embodiment generally includes one or more Processor Memory Modules (PMMs, each generally having one or more symmetric multiprocessor complexes), one or more Network Modules, and a System Control Module (SCM). The SCM includes a cellified switching-fabric core (SF) and a System Intelligence Module (SIM). Each PMM has one or more resident Virtual IO Controller (VIOC) adapters. Each VIOC is a specialized I/O controller that includes embedded layer-2 forwarding and filtering functions and tightly couples the PMM to the SF. Thus the layer-2 switch functionality within the ES chassis is distributed over all of the SCM, NM, and PMM modules.

Abstract: The invention discloses a communication method for modules within device. The method sets a centralized exchanging and controlling unit in the device, and every module is connected with the centralized exchanging and controlling unit through its own communication control interface. When a message is sending from one module to another module, first the source module sends the message to the centralized exchanging and controlling unit, after processing in the centralized exchanging and controlling unit the message is forwarded to the destination module defined in the message. Since every module is directly connected with the centralized exchanging and controlling unit in a high-speed link, so any two modules communication with the following advantages: high reliability, to locate a fault point is easier, number of the modules that take part in the communication is unlimited, the system design is simple, easier and flexible.

Abstract: A fiber channel switch element for routing fiber channel frame is provided. The switch element includes a fiber channel port that can be configured to support plural data transfer rates. The data transfer rate may be 1 G, 2 G, 4 G, 8 G or 10 G. The switch element includes a clock configuration module for providing a clock signal that is based on the data transfer rate. A receive segment of the fiber channel port sends a signal to a transmit segment to avoid an under flow condition. The receive segment also waits for a certain frame length after a fiber channel frame is written and before the fiber channel frame is read, depending upon a data transfer rate of a source port. Multiple lanes may be configured as a single 10 G multi lane port or as multiple individual ports.

Abstract: A system, apparatus, method and article to perform dynamic service management for multicore processors are described. The apparatus may include, for example, a processing device having multiple types of processors to process packets. A service manager may dynamically assign executable files for multiple services to the multiple types of processors during execution of the executable files based on packets processed for each service. Other embodiments are described and claimed.

Abstract: The present invention allows multi-customer access to the common high speed carrier for contracting customers. The customer initiates a data transfer utilizing a registered address that activates high speed encapsulation to accelerate the data transmission. This change allows multiple users, who share the same local environment to access the infrastructure under contract. Central office routers will identify incoming customer's addresses and then provide specific, pre-defined services based upon the addressee of the data.

Abstract: The routing control system 100 according to the present invention comprises a control server 1 as the control system, and routers 10-60 as the transfer system. The control server 1 receives the temporary routing control table which is transmitted from the routers 10-60, and stores this temporary routing control table in the routing control table DB 6 as the routing control table of the router which is the transmission source. This routing control table is updated as needed when a predetermined time has elapsed from the previous update. The control server 1 refers to the data in the routing control table DB 6 constructed in this way, and performs the routing control of packets which pass through each router 10-60 on the network.

Abstract: A router detects a network attack and forwards traffic associated with the network attack to a discard interface. The router applies one or more filters to calculate traffic flow statistics for the traffic forwarded to the discard interface. The router may exchange routing communications with one or more other routers to alert the routers of the network attack. For example, the router may generate a routing communication in accordance with a routing protocol that advertises a route to the targeted device, and includes a policy tag that indicates the existence of a network attack. The other routers update forwarding information in accordance with the advertised route, and automatically forward traffic to respective discard interfaces based on the policy tag, thereby diffusing the network attack.