Abstract: The present disclosure discloses a method and a system for performing check recovery based on Gaussian elimination, a apparatus, and a storage medium. The method includes: a disk array by using normal data blocks and normal check blocks is constructed, a first reference matrix constructed by using coding matrix rows corresponding to the normal data blocks and the normal check blocks is converted into an inverse matrix through Gaussian elimination; it is determined that coding matrix rows corresponding to a predetermined quantity of blocks, and a second reference matrix is constructed by using the coding matrix rows, the abnormal data blocks, and the abnormal check blocks; and the inverse matrix and the second reference matrix are multiplied to obtain a first matrix, the first matrix and the disk array are multiplied to obtain an output matrix, and original data are obtained according to the output matrix.

Abstract: Methods, systems, and devices for selectable error control for memory device are described. An apparatus may include a memory array and a circuit configurable to perform a first error control operation and a second error control operation on data stored by the memory array. The circuit may include a first plurality of gates enabled during the first error control operation and configured to generate a first set of bits associated with a first matrix of the first error control operation. The circuit may also include a second plurality of gates enabled during the second error control operation and configured to generate a second set of bits associated with the second matrix of the second error control operation. The circuit may further include a third plurality of gates configured to generate a third set of bits that are common to both the first matrix and the second matrix.

Abstract: A storage system, and a method for operating a storage system. In some embodiments, the system includes a first storage device and a second storage device, and the method includes: determining that the first storage device is in a read-only state and that the second storage device is in a read-write state; performing a write operation, of a first stripe, to the storage system; performing a first read operation, of a second stripe, from the storage system; and performing a second read operation, of the first stripe, from the storage system, wherein: the performing of the write operation includes: writing a portion of the first stripe to the second storage device, and making an entry in a mapping table for the first stripe.

Abstract: The method for reducing impact of flapping links on performance of network devices is implemented in 3 steps: Step 1: initialize a number of points of the interface to define interface status; Step 2: add a number of points to T and change interface status to isolated; Step 3: the interface comes back to normal state; By all those steps above, the routers can reduce impact of flapping links on route calculation and its performance.

Abstract: An integrated circuit includes a plurality of logic function circuits disposed on the integrated circuit and interconnected by metal interconnect lines to form a logic network. A plurality of configurable logic function circuits is also disposed on the integrated circuit, each configurable logic function circuit being disposed on a respective area on the integrated circuit and not interconnected by the metal interconnect lines to form the logic network.

Abstract: Techniques are provided for a management application in a first virtual network to start a first cloud gateway in the first virtual network. First messages are sent to a second virtual network, the first messages comprising information configured to start a second cloud gateway and a first virtual switch in the second virtual network. A connection is established between the first cloud gateway and the second cloud gateway, where the first cloud gateway, the second cloud gateway, and the first virtual switch form a first scalable cloud network element. One or more second messages are sent to the second virtual network, the one or more second messages comprising information configured to start a virtual machine and a first virtual machine interface configured to allow the virtual machine to access processing resources in the second virtual network. Data are stored that associates the virtual machine with the first virtual switch.

Abstract: Methods, machine-readable tangible storage media, and data processing systems that enable a debug host device to acquire memory dump information from a debug target device after the target device suffers an unrecoverable system malfunction are disclosed. In one embodiment, data in the volatile memory on a debug target device is accessed via a hardware integrated debug framework, which is also used to access data on a nonvolatile electronically erasable semiconductor memory of a debug target device, and one or more registers of one or more processors on a debug target device, and a core dump is created on the debug host device.

Abstract: Techniques for managing a fused processing element are described. Embodiments receive streaming data to be processed by a plurality of processing elements. Additionally, an operator graph of the plurality of processing elements is established. The operator graph defines at least one execution path and wherein at least one of the processing elements of the operator graph is configured to receive data from at least one upstream processing element and transmit data to at least one downstream processing element. Embodiments detect an error condition has been satisfied at a first one of the plurality of processing elements, wherein the first processing element contains a plurality of fused operators. At least one of the plurality of fused operators is selected for removal from the first processing element. Embodiments then remove the selected at least one fused operator from the first processing element.

Abstract: A computer-implemented method, a computerized system and a product for providing a cluster of replicated servers. The method performed by a computerized server in a cluster of servers, wherein the cluster of servers are executing replicated instances of an application, wherein the replicated instances are configured to perform the same processing of the same input, comprising: detecting a message loss in the server; electively determining a responsive action to the message loss; and notifying the cluster of servers of the responsive action determined by the server, whereby other servers of the cluster of servers are able to mimic operation of the server by simulating the responsive action.

Abstract: A method for improving the performance of a RAID under rebuild is disclosed. In one embodiment, such a method includes identifying a RAID requiring rebuild, such as by identifying a RAID having one or more failed storage-drive components. The method then automatically performs the following in response to identifying the RAID: the method identifies hot extents (i.e., extents most heavily accessed) in the RAID; the method migrates the hot extents from the identified failed RAID to a normal RAID not requiring rebuild, such as to an underused RAID; and the method rebuilds the failed RAID. The migration of the hot extents will ideally occur while the RAID is being rebuilt but may also be performed prior to the rebuild process. A corresponding apparatus and computer program product are also disclosed.

Abstract: A disaster recovery appliance is described herein. The disaster recovery appliance is coupled to one or more servers. The disaster recovery appliance continuously receives backup data for each of the one or more servers. When a server fails, the disaster recovery appliance, replaces the failed server. While the failed server is inaccessible, the disaster recovery appliance is able to mimic the functionality of the failed server. In some embodiments, the disaster recovery appliance is able to act as a server in addition to a backup device for the other servers.

Abstract: Provided are systems and methods for accessing a storage device from a node when a local connection failure occurs between the node and the storage device. A failure is determined to have occurred at a first node access path between a first node and a storage device that prevents an application at the first node from accessing the storage device from the first node access path. An access request is sent from the first node to a second node. The second node has a second node access path to the storage device. A determination is made that the second node can communicate with the storage device. The storage device is accessed by an application at the first node via the second node access path.

Abstract: A load balancer includes a failover logic unit to identify servers to execute services, generate and store in the load balancer a failover rule and a service rule, and to determine a failure in a first server that executes a first service responsive to a lack of response by the first server to a keepalive message sent by the load balancer to the first server. The load balancer can then perform an operation to cause an automatic failover of the first service to another server based on the failover and service rules.

Abstract: Methods and apparatus relating to repurposing a data lane as a clock lane by migrating to reduced speed link operation are described. In one embodiment, speed of a link is reduced upon detection of failure on a clock lane of the link and one of a plurality of data lanes of a link is repurposed as a replacement clock lane. Other embodiments are also disclosed and claimed.

Abstract: Techniques involving replication of virtual machines of virtual machines in a clustered environment are described. One representative technique includes receiving a replication request to replicate a primary virtual machine. A clustering broker is configured to act on the replication request on behalf of a cluster of recovery nodes, by at least placing a replicated virtual machine corresponding to the source virtual machine on a recovery node and facilitate tracking the migration of the replicated virtual machine within the cluster. The clustering broker returns an address of the recovery node that has been placed or found through tracking for the particular virtual machine.

Abstract: An embodiment of the invention is an optical communication system including: a plurality of interface boards which transmit and receive optical signals to and from interface boards facing the plurality of interface boards; and a monitoring control device which monitors states of the plurality of interface boards. A first interface board of the plurality of interface boards includes: a replacement unit capable of monitoring the states of the plurality of interface boards on behalf of the monitoring control device and independently receiving supply of power; and a control unit configured to start the replacement unit in a case where a fault occurs in the monitoring control device and stop or halt the replacement unit in a case where there is no fault in the monitoring control device.

Abstract: In one embodiment, a particular node in a computer network, that is, one receiving electrical power from a grid source, may determine routing metrics to a plurality of neighbor nodes of the particular node in the computer network. In addition, the node also determines power grid connectivity of the plurality of neighbor nodes. Traffic may be routed from the particular node to one or more select neighbor nodes having preferred routing metrics, until a power outage condition at the particular node is detected, at which time the traffic (e.g., last gasp messages) may be routed from the particular node to one or more select neighbor nodes having diverse power grid connectivity from the particular node. In this manner, traffic may be routed via a device that is not also experiencing the power outage condition.

Abstract: Jobs submitted to a primary location of a service within a period of time before and/or after a fail-over event are determined and are resubmitted to a secondary location of the service. For example, jobs that are submitted fifteen minutes before the fail-over event and jobs that are submitted to the primary network before the fail-over to the second location is completed are resubmitted at the secondary location. After the fail-over event occurs, the jobs are updated with the secondary network that is taking the place of the primary location of the service. A mapping of job input parameters (e.g. identifiers and/or secrets) from the primary location to the secondary location are used by the jobs when they are resubmitted to the secondary location. Each job determines what changes are to be made to the job request based on the job being resubmitted.

Abstract: A method of managing the workload in a computer system having one or more semi-redundant hardware components is provided. The method comprises detecting loss or degradation of the level of performance of one or more of the semi-redundant hardware components, identifying hardware components affected by the loss or degradation, migrating a critical job from an affected hardware component to an unaffected hardware component, and performing less-critical jobs on an affected hardware component. Loss or degradation of the semi-redundant component reduces the capacity of affected hardware components in the computer system without entirely disabling the computer system. Jobs identified as critical run on hardware components having the most capacity and reliability, while less-critical jobs use the remaining capacity of affected hardware components. Examples of semi-redundant hardware components include a memory module, CPU core, Ethernet port, power supply, fan, disk drive, and an input output port.

Abstract: The described embodiments include a processor that handles faults. The processor first receives a first input vector, a control vector, and a predicate vector, each vector comprising a plurality of elements. For each element in the first input vector for which a corresponding element in the control vector and the predicate vector are active, the processor then performs a read operation using an address from the element of the first input vector. When a fault condition is encountered while performing the read operation, the processor determines if the element is a first element where a corresponding element of the control vector is active. If so, the processor handles/processes the fault. Otherwise, the processor masks the fault for the element.

Abstract: A method implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable medium. The computer executable code is operable to dynamically adjust quorum requirements for a voting set V of a server cluster, including a plurality of servers, to ensure that a response of the server cluster to a client request remains Byzantine fault tolerant when at least one of: a failed server of the server cluster is replaced with at least one new server, such that a total set S of servers that have ever been members of the server cluster is increased, and an existing server is removed from the voting set V.

Abstract: The control device detects a failed node in which a failure has occurred from a plurality of computation nodes included in a plurality of computation units included in the parallel computer. The control device chooses execution nodes for executing the program from the computation nodes of the parallel computer except the detected failed nodes based on the number of computation nodes needed to execute the program. The control device selects a paths to connect the computation nodes from a plurality of links each connecting two computation units adjacent to each other through a plurality of paths configured to connect computation nodes included in two computation units adjacent to each other in a one-to-one manner included in the links connecting two computation units adjacent to each other in the plurality of computation units including the choosed execution nodes except the path connected to the detected failed node.

Abstract: The present invention discloses a method and device for a link protection in a virtual private local area network, which relates to the network data communication technology. The method of the present invention includes: in a networking process of a VPLS network, a link protection device establishing a main tunnel and a standby tunnel of MPLS TE for a link, and creating a VPLS forwarding table to deal with the information of the established MPLS TE main tunnel and standby tunnel; and when receiving a VPLS message, the link protection device searching the information of the MPLS TE main tunnel of the VPLS message according to a way of accessing the VPLS network of the VPLS message and the VPLS forwarding table, and if the found MPLS TE main tunnel is invalid, then transmitting the received VPLS message by adopting the standby tunnel of the MPLS TE main tunnel.

Abstract: In one embodiment, a method includes receiving at a network device, a packet from a component in a virtual network device, the packet transmitted across a link aggregation bundle connecting the virtual network device to the network device and indicating if the component is a master component in the virtual network device, and determining if an error exists in operation of the component as the master component or a slave component. An apparatus for assigning services to physical links in an aggregated link bundle is also disclosed.

Abstract: A method includes a first firewall device performing a firewall function on a first redundant input data packet and outputting the first redundant input data packet as a first redundant output data packet according to the firewall function. A second firewall device performs only the the same firewall function on a second redundant input data packet and outputs the second redundant input data packet as a second redundant output data packet according to the firewall function. The redundant output data packets are at least substantially similar when the firewall devices are functioning properly. A controller receives the redundant output data packets and transmits at a given time one of the redundant output data packets to a target. The controller transmits the first redundant output data packet to the target while the second device is failed.

Abstract: Migrating virtual machines among networked servers, the servers coupled for data communications with a data communications network that includes a networking device, where migrating includes: establishing, by a virtual machine management module (‘VMMM’), one or more virtual machines on a particular server; querying, by the VMMM, the networking device for link statistics of a link coupling the network device to the particular server for data communications; determining, by the VMMM in dependence upon the link statistics, whether the link coupling the network device to the particular server is degrading; and if the link coupling the network device to the particular server is degrading, migrating a virtual machine executing on the particular server to a destination server. In some embodiments, migrating occurs is carried out only if non-degrading link is available. If no non-degrading links are available, the network device, rather than the link, may be failing.

Abstract: A method of dynamically allocating a task or a signal on a statically allocated and embedded software architecture of a vehicle includes identifying a faulty component. The faulty component may include a software component, a hardware component or a signal or communications link between components. Once the faulty component is identified, any tasks performed by or signals associated with the faulty component are identified, and the tasks performed by or the signals associated with the faulty component are re-allocated to an embedded standby component so that performance of the re-allocated task and/or signal for future system operations is performed by the standby component.

Abstract: A method comprises the steps of providing a plurality of mobile routers; providing a main server for tracking and monitoring the plurality of mobile routers; initially configuring each mobile router of the plurality of mobile routers to communicate with the main server; providing a first linked communication between each mobile router and the main server; registering each mobile router with the main server and uploading configuration information from each mobile router to the main server; assigning each mobile router with a predetermined group; subsequent to the registering and assigning steps, providing a second linked communication between each mobile router and the main server; and operating the main server such that when the second linked communication occurs, the main server reassigns each mobile router to communicate with at least one group server assigned to communicate with the predetermined group.

Abstract: Embodiments of the invention include a method for fault tolerance management of workers nodes during map/reduce computing in a computing cluster. The method includes subdividing a computational problem into a set of sub-problems, mapping a selection of the sub-problems in the set to respective nodes in the cluster, directing processing of the sub-problems in the respective nodes, and collecting results from completion of processing of the sub-problems. During a first early temporal portion of processing the computational problem, failed nodes are detected and the sub-problems currently being processed by the failed nodes are re-processed. Conversely, during a second later temporal portion of processing the computational problem, sub-problems in nodes not yet completely processed are replicated into other nodes, processing of the replicated sub-problems directed, and the results from completion of processing of sub-problems collected.

Abstract: Embodiments that generate checkpoint images of an application for use as warm standby are contemplated. The embodiments may monitor accesses of external references by threads. An external reference may comprise a connection or use of services of an entity that is external to the set of processes that constitute the application, to which a process of the application attempts to connect by means of a socket or inter-process communication (IPC). Various embodiments comprise two or more computing devices, such as two or more servers. One of the computing devices may generate a checkpoint image of an application at a suitable point in time during initialization, when the state of the application is not yet dependent on interactions with external references. The second computing device may preload checkpoint image for the application and activate the checkpoint images when needed, following the specific resource management rules of the distributed subsystem.

Abstract: Systems and computer-implemented methods of electing a new leader node in distributed systems of simple topologies connecting a plurality of nodes on at least one computer system. The computer-implemented method comprises several steps including at least one node, which detected the absence of a leader, starting a first round for its approval as an Approved Election Initiator. If a quorum accepts the StartElection request during the first round, then the Election Initiator starts a second round to set the leader. If a quorum of all nodes has not been reached during the first round, then the first round fails. The method repeats until a leader is set and is repeated each time a node discovers that the network does not have an active leader. Also provided herein is a computer readable medium having computer executable instructions stored thereon for performing the computer-implemented method.

Abstract: A computer program product and method of managing the workload in a computer system having one or more semi-redundant hardware components are provided. The method comprises detecting loss or degradation of the level of performance of one or more of the semi-redundant hardware components, identifying hardware components that are affected by the loss or degradation of the one or more semi-redundant components, migrating a critical job from an affected hardware component to an unaffected hardware component, and performing less-critical jobs on an affected hardware component. Loss or degradation of the semi-redundant component reduces the capacity of affected hardware components in the computer system without entirely disabling the computer system. Jobs identified as being critical are run on hardware components having the most capacity and reliability, while allowing less-critical jobs to make use of the remaining capacity of affected hardware components.

Abstract: Subject matter described herein is directed to reallocating an application component from a faulty data-center resource to a non-faulty data-center resource. Background monitors identify data-center resources that are faulty and schedule migration of application components from the faulty data-center resources to non-faulty data-center resources. Migration is carried out in an automatic manner that allows an application to remain available. Thresholds are in place to control a rate of migration, as well as, detect when resource failure might be resulting from data-center-wide processes or from an application failure.

Abstract: A SCADA system includes a main switching hub and a backup switching hub that relay transmission data between a wind turbine generator and terminals provided in another SCADA system and client terminals, and a network switch for performing switching between the main switching hub and the backup switching hub for relaying transmission data between the wind turbine generator and the terminals. A backup remote I/O connected to the backup switching hub causes the network switch to perform switching based on a switching command from a SCADA terminal input via the backup switching hub. This serves to solve a data transmission problem caused by a problem in a switching hub on the wind turbine generator side from a remote location.

Abstract: A method, system, and computer program product for changing hardware in a data processing system without disrupting processes executing on the data processing system. A hardware change to a selected portion of hardware in the data processing system may be required, such as to repair hardware errors or to implement a system update. Responsive to a determination that a hardware change to the selected portion of the hardware is required, a process being performed by the selected portion is moved from the selected portion of the hardware to an alternate portion of the hardware. The hardware change is applied to the selected portion of the hardware. The selected portion of the hardware is returned for use by the data processing system after the hardware change is applied.

Abstract: An electronic calendar includes such features as recurring reminders, dividing unpredictable work loads into equal pieces, template free parsing, a reminders scheduling algorithm to reduce spikes, dynamic delivery and recovery algorithms, methods for splitting the work load between controllers and workers and for monitoring progress, all within the context of a calendar architecture for a large enterprise.

Abstract: [Object] To increase the speed of copy processing from an online computer 101 to a standby computer 102. [Solution] When copying copy target information from the online computer 101 to the standby computer 102, a status copy processing unit 110: recognizes, as a synchronous point, a point in time when execution of a first application (AP #1), from among applications 108, is completed; extracts only information stored in a use area 401 of an OS 106 and a use area 403 of a second application (AP #2) from a storage area 400 of a memory at this synchronous point; and transfers the extracted information, as the copy target information necessary to continue the processing, from the online computer 101 to the standby computer 102. [Selected Drawing] FIG.

Abstract: An automated method for provisioning a grid used to run a load test on a target website includes sending one or more requests in a multi-threaded manner to at least one cloud provider, the one or more requests for an allocation of N load server instances and M result server instances which comprise the grid. Requests received back from the cloud provider are also handled in a multi-threaded manner; any errors occurring during the allocation being corrected automatically. The N load server instances and the M result server instances are then verified to be operational and correctly running software deployed to provide defined test services. Errors identified during the verification are automatically corrected either by attempting to restart a failed instance or allocating a different instance.

Abstract: Embodiments of the invention include a method for fault tolerance management of workers nodes during map/reduce computing in a computing cluster. The method includes subdividing a computational problem into a set of sub-problems, mapping a selection of the sub-problems in the set to respective nodes in the cluster, directing processing of the sub-problems in the respective nodes, and collecting results from completion of processing of the sub-problems. During a first early temporal portion of processing the computational problem, failed nodes are detected and the sub-problems currently being processed by the failed nodes are re-processed. Conversely, during a second later temporal portion of processing the computational problem, sub-problems in nodes not yet completely processed are replicated into other nodes, processing of the replicated sub-problems directed, and the results from completion of processing of sub-problems collected.

Abstract: There is provided an intra-realm AAA (authentication, authorization and accounting) fallback mechanism, wherein the single global realm may be divided in one or more sub-realms. The thus presented mechanism exemplarily comprises detecting a failure of an authentication server serving at least one authentication client within a first sub-realm of a single-realm authentication system, and routing authentication messages of the at least one authentication client to a fallback authentication server within a second sub-realm of the single-realm authentication system, wherein routing may exemplarily comprise sub-realm based source routing.

Abstract: Whether or not a signal which is transmitted from a current operation side node to a stand-by side node has been disconnected is determined on a communication route for the signal. When the signal is determined to have been disconnected, the network route is switched to the network route used when a client unit and the stand-by side node perform data communication. With this, the switching of the network route when processing having been performed by a node of a system is performed by another node in place of the node can be made quickly.

Abstract: Cluster-free techniques for enabling a directory protocol-based Domain Name System (DNS) service for high availability are presented. A DNS service monitors a node for wild-carded IP address that migrate to the node when a primary node fails to service DNS requests for a directory of the network. The DNS service forwards the wild-carded IP address to a distributed directory service for resolution and uses the distributed directory service to dynamically configure the DNS service for directly handling subsequent DNS requests made to the directory over the network while the primary node remains inoperable over the network.

Abstract: A reconfiguration manager is operable to reconfigure a repurposable recovery environment between a recovery environment for a production environment and a second environment different from the recovery environment. A storage system in the repurposable recovery environment periodically saves production information from the production environment while the repurposable recovery environment is operating as the second environment. The production information in the storage system is used to reconfigure the repurposable recovery environment from the second environment to the recovery environment.

Abstract: Methods for configuring a system to collect and aggregate datasets are disclosed. One embodiment includes, identifying a data source in the system from where dataset is to be collected, configuring a machine in the system that generates the dataset to be collected, to send the dataset to the data source, identifying an arrival location where the dataset that is collected is to be aggregated or written, and/or configuring an agent node by specifying a source for the agent node as the data source in the system and specifying a sink for the agent node as the arrival location.

Abstract: When a fault occurs in a guest machine 2b of a virtual machine system 100b, a stop control part 5a of a guest machine 2a of a virtual machine system 100a requests a stop control part 4b of a host machine 1b to stop operation of the guest machine 2b. If the guest machine 2b does not stop operation normally, the stop control part 5a requests a BMC 8b to stop operation of the host machine 1b. The BMC 8b stops the host machine 1b, so that the machine where the fault occurs can be stopped.

Abstract: Exemplary embodiments adapted to distribute power from four input lines to a plurality of power supply units (PSUs) configured in an N+1 architecture are provided. In one such embodiment, a plurality of rectifier devices have first and second ends, each of the plurality of rectifier devices connected at the first end to one of the four input lines, and adapted to be bypassed by a first relay in a first operating mode and provide rectified input current in a second operating mode. A plurality of second relays is connected between each of the second ends of the plurality of rectifier devices. The plurality of second relays are adapted to be closed in the second operating mode to sum the rectified input current from each of the plurality of rectifier devices in a single node connecting each of the plurality of PSUs.

Abstract: When a primary computer is taken over to a secondary computer in a redundancy configuration computer system where booting is performed via a storage area network (SAN), a management server delivers an information collecting/setting program to the secondary computer before the user's operating system of the secondary computer is started. This program assigns a unique ID (World Wide Name), assigned to the fibre channel port of the primary computer, to the fibre channel port of the secondary computer to allow a software image to be taken over from the primary computer to the secondary computer.

Abstract: A system comprising a memory storing a set of instructions executable by a processor. The instructions being operable to monitor progress of an application executing in a first operating system (OS) instance, the progress occurring on data stored within a shared memory area, detect a failover event in the application and copy, upon the detection of the failover event, the data from the shared memory area to a fail memory area of a second instance of the OS, the fail memory area being an area of memory mapped for receiving data from another instance of the OS only if the application executing on the another instance experiences a failover event.

Abstract: A method (100) is proposed for safely switching back to a first computer center (DC1) following failover by a second computer center (DC2), where at least one transaction terminal is connected as a client (CLA) to the second computer center (DC2) during the downtime of the first computer center (DC1) and at the end of the downtime is switched back again to the first computer center (DC1), where the following steps are performed: the second computer center (DC2) is shown that the first computer center (DC1) is operational again (step 110); the client (CLA) is prompted to go out of service (step 120); synchronization (STD) of configuration and/or transaction data between the first and second computer centers is performed (step 130); at the conclusion of synchronization(STD), the client (CLA) is prompted to switch back to the first computer center (DC1) (step 140).

Abstract: In one example, a backup intrusion detection and prevention (IDP) device includes one or more network interfaces to receive a state update message from a primary IDP device, wherein the state update message indicates a network session being inspected by the primary IDP device and an identified application-layer protocol for the device, to receive an indication that the primary device has switched over or failed over to the backup device, and to receive a plurality of packets of the network session after receiving the indication, each of the plurality of packets comprising a respective payload including application-layer data, a protocol decoder to detect a beginning of a new transaction from the application-layer data of one of the plurality of packets, and a control unit to statefully process only the application-layer data of the network session that include and follow the beginning of the new transaction.