Network Equipment Technologies, Inc.

Juniper Networks, Inc.

Cequence Security, Inc.

Bhasker R Allam

Krishna Narayanaswamy

Nitin Kumar

Nischal Sheth

Raghavendra Mallya

Shreyans Mehta

Dongyi Jiang

Harsha Jagannati

Colby Barth

Tsai-Zong Lin

Jiaxiang Su

Seiji C Armstrong

Shankar Agarwal

Xuefei Zhang

Panning Huang

Techniques to facilitate passive detection of forged web browsers are disclosed herein. In at least one implementation, security information transmitted by a client during Hypertext Transfer Protocol Secure (HTTPS) session establishment between a web server and the client is monitored, and header information transmitted by the client is processed to determine a type of web browser associated with the client. A security signature for the client is generated based on the security information transmitted by the client during the HTTPS session establishment. The security signature for the client is compared with a predetermined signature for the type of web browser associated with the client to determine if the client is a genuine web browser of the type of web browser associated with the client.

Passive detection of genuine web browsers based on security parameters

In general, techniques are for providing a direct forwarding path between virtual routers within a single virtualized routing system. In one example, a method includes combining forwarding information from a plurality of virtual routers into collapsed forwarding information that comprises one or more direct forwarding paths between the respective virtual routers. The method also includes determining a direct forwarding path to an egress interface of the second virtual router, in response to receiving a network packet at an ingress interface of a first virtual router. The method also includes forwarding the network packet from the ingress interface of the first virtual router to the egress interface of the second virtual router using the direct forwarding path, wherein the network packet traverses a switch fabric directly from the ingress interface of the first virtual router to the egress interface of the second virtual router.

Traffic cut-through within network device having multiple virtual network devices

A routing device including an operating system kernel, a virtual router residing external to the kernel, a router manager configured to manage the virtual router, an application residing external to the virtual router, and a number of physical interfaces is disclosed. The application selectively interacts with the virtual router and the kernel on a dynamic basis, which perform a number of tasks for the application. The virtual router includes a routing protocol stack configured to handle a number of routing protocols, a number of interface drivers configured to communicate with corresponding physical interfaces, an IP stack configured to interact with the routing protocol stack and perform a forwarding function via the interface drivers, the IP stack having a forwarding information table used to perform the forwarding function; and a socket layer having a corresponding socket API configured to facilitate interactions between the IP stack and one or more socket applications.

Method and system for implementing external applications using remote socket application programming interface for virtual routers

A method for optimizing routing functions in a router is provided. The router has a split plane architecture including a control plane and a data plane. The control plane includes an Address Resolution Protocol cache and the data plane includes a programmable forwarding information base. According to one aspect, when the control plane obtains information about a route, it evaluates the obtained information about the route to determine if address resolution is needed. If it is determined that address resolution is needed for the route, the control plane performs the needed address resolution to derive additional information about the route. The control plane programs the forwarding information base to incorporate the obtained and additional information. The determination as to whether address resolution is needed for the route is performed regardless of whether packets are to be delivered on the route.

Method and system for optimizing routing table changes due to ARP cache invalidation in routers with split plane architecture

An optimized interface for handling routed and non-routed point-to-point sessions is provided. According to one exemplary aspect, when a PPP session is established for a client, an interface data structure or module is dynamically created for the client corresponding to the PPP session. The interface data structure includes, for example, Layer-2 and Layer-3 information relating to the PPP session. Upon its creation, the interface data structure is linked to the optimized interface. The created interface data structure is then used by the optimized interface to facilitate communications with the client for the duration of the PPP session.

Method and system for optimizing interfaces for non-routed PPP sessions using PPP global interface

Growing community of inventors

Fremont, CA, United States of America

Bhasker R Allam