Cisco Technology, Inc.

Juniper Networks, Inc.

Nokia Corporation

Nokia Siemens Networks Oy

Atul Mahamuni

Navindra Yadav

Jonathan W Hui

Jean-Philippe Vasseur

Alec Woo

Sreeram Parameswara Iyer

Wei Hong

Carol Barrett

Vijay K Chander

Sreenivas Voruganti

Ramkumar Sankar

Anand Ammundi

Henry Hong-Yi Tzeng

Chi Fai Ho

Sandip K Shah

Pere Monclus

Vina Ermagan

Thomas Jeffrey Enderwick

Sachchidanand Vaidya

Shashi Kumar

Valentina Alaria

Rudramahesh S Rugge

Bora A Akyol

Aji Joseph

Azim Ozakil

Kalyan Bade

Peirong Feng

Sambasivam Valliappan

Chi-Fai Ho

Ashutosh Mate

A network filter is implemented so that filter terms that include intra-term OR conditions and converted to sub-terms that include only logical AND conditions. In one implementation, a device may include logic to receive a filter definition including one or more terms, at least some of the terms including logical OR conditions, that define how network traffic through the device is to be filtered, the logic expanding the one or more terms in the filter such that terms that contain logical OR conditions are expanded into a plurality of sub-terms that each contains only logical AND conditions. The device may further include a ternary content-addressable memory (TCAM) programmed to include a separate entry corresponding to each of the sub-terms.

Intra-term logical or operation in a network filter

According to one embodiment, techniques are provided to enable secure communication among devices in a mesh network using a group temporal key. An authenticator device associated with a mesh network stores a pairwise master key for each of a plurality of devices in a mesh network upon authentication of the respective devices. Using the pairwise master key, the authenticator device initiates a handshake procedure with a particular device in the mesh network to mutually derive a pairwise temporal key from the pairwise master key. The authenticator device encrypts and signs a group temporal key using the pairwise temporal key for the particular device and sends the group temporal key encrypted and signed with the pairwise temporal key to the particular device.

Group key management and authentication schemes for mesh networks

In one embodiment, a service enabled network (SEN) controller receives, from a control plane of a network service device, service instructions for corresponding network services. The SEN controller may then distribute the service instructions for the network services to appropriate network access devices within the computer network, such that each of the network access devices may correspondingly implement the network services at their respective data planes, thus providing a distributed implementation of the network service within the computer network.

Service enabled network

In one embodiment, a source node monitors a quality of a primary link, and forwards one or more duplicate copies of a packet in response to poor quality of the primary link. Specifically, forwarding generally comprises transmitting a first copy of the packet on the primary link with an indication of duplicate copies, and transmitting a second copy of the packet on a backup link with an indication of duplicate copies. In another embodiment, an intermediate node receives a first copy of a packet with an indication of duplicate copies, and stores an identifier of the first copy of the packet in response to the indication. Upon receiving a second copy of the packet with the indication of duplicate copies, the node determines whether the identifier of the second copy matches the stored identifier of the first copy, such that in response to a match, the second copy is dropped.

Duplicating traffic along local detours before path remerge to increase packet delivery

In one embodiment, a device in a computer network establishes a reliable map that defines a set of packet criteria for which reliability is desired over an unreliable link to a peer device. In response to receiving a first packet from the peer device over the unreliable link, the device acknowledges the first packet to the peer device when the first packet matches the packet criteria of the reliable map. Also, in response to receiving a second packet destined via the peer device over the unreliable link, the device buffers the second packet when the second packet matches the packet criteria of the reliable map and retransmits the buffered second packet over the unreliable link to the peer device until acknowledged by the peer device.

Reliable packet delivery with overlay network (RPDON)

In one embodiment, a router establishes a serial-over-TCP/IP (Transmission Control Protocol/Internet Protocol) communication session between terminal units using raw-TCP encapsulation. For the session, the router maps serial characters to TCP out-of-band (OOB) communication fields, maps serial flow control signals to TCP/IP receiver-window advertisements, and dynamically adjusts a TCP/IP priority based on serial payload priority. Accordingly, the router may thus communicate data over the serial-over-TCP/IP session based on the mappings and priority.

Transporting serially over TCP/IP using raw TCP encapsulation

Techniques are provided to facilitate monitoring of utility application traffic streams. At a network device that routes utility application traffic for utility devices, control information is received, where the control information is configured to cause the network device to monitor utility application traffic that passes through the network device. The network device monitors a header inserted into utility application traffic messages based on the control information.

Session layer for monitoring utility application traffic

A device stores forwarding information associated with fragments of a first data unit, stores information common to the fragments of the first data unit, receives fragments of a second data unit, and forwards the fragments of the second data unit based on the forwarding information of the first data unit and the information common to the first data unit.

Identification fragment handling

In one embodiment, a technique may enable control of routing convergence in a computer network during reboot of a node of a routing topology represented by a directed acyclic graph (DAG). The rebooting node, e.g., a DAG root node, may transmit a reboot notification message to nodes of the routing topology indicating that the rebooting node is unavailable during a subsequent reboot process. In response to receiving and processing the reboot notification message, the nodes of the routing topology may enter a DAG freeze state that inhibits (prevents) routing convergence in the routing topology during the reboot process so as prevent adverse consequences on network stability, such as collapse of the DAG. Thereafter upon completion of the reboot process, the rebooting node may transmit a clear message to the nodes of the routing topology that instructs the nodes to exit the DAG freeze state.

Method and apparatus to control routing convergence during node reboot by entering a freeze state that inhibits routing convergence during the reboot process

In one embodiment, a method includes receiving a communication from an endpoint device at a network access device located within a data path between the endpoint device and a network, identifying a network admission control policy for the endpoint device, enforcing at the network access device, the network admission control policy for traffic received from the endpoint device, and forwarding at the network access device, traffic from the endpoint device to the network in accordance with the network admission control policy. An apparatus is also disclosed.

Integration of network admission control functions in network access devices

Techniques are provided for adaptive routing of authentication packets in a network, such as a wireless mesh network. At an authenticated device in the network, an authentication packet is received over the network from a device that is seeking authentication. The authentication packet is encapsulated for transmission in Layer 3 packets over an Internet Protocol (IP) tunnel to an authenticator device associated in the network. Similarly, for an authentication packet encapsulated in Layer 3 packets from the authenticator device over the IP tunnel, the authentication packet is decapsulated from the Layer 3 packets and transmitted over the network to the device seeking authentication.

Adapting extensible authentication protocol for layer 3 mesh networks

In one embodiment, a management device in a computer network determines when nodes of the computer network join any one of a plurality of field area routers (FARs), which requires a shared-media mesh security key for that joined FAR. The management device also maintains a database that indicates to which FAR each node in the computer network is currently joined, and to which FARs, if any, each node had previously joined, where the nodes are configured to maintain the mesh security key for one or more previously joined FARs in order to return to those previously joined FARs with the maintained mesh security key. Accordingly, in response to an updated mesh security key for a particular FAR of the plurality of FARs, the management node initiates distribution of the updated mesh security key to nodes having previously joined that particular FAR that are not currently joined to that particular FAR.

Reduced authentication times for shared-media network migration

Methods and systems consistent with the present invention provide dynamic buffer allocation to a plurality of queues of differing priority levels. Each queue is allocated fixed minimum number of buffers that will not be de-allocated during buffer reassignment. The rest of the buffers are intelligently and dynamically assigned to each queue depending on their current need. The system then monitors and learns the incoming traffic pattern and resulting drops in each queue due to traffic bursts. Based on this information, the system readjusts allocation of buffers to each traffic class. If a higher priority queue does not need the buffers, it gradually relinquishes them. These buffers are then assigned to other queues based on the input traffic pattern and resultant drops. These buffers are aggressively reclaimed and reassigned to higher priority queues when needed.

Growing community of inventors

San Jose, CA, United States of America

Atul Mahamuni