Enterasys Networks, Inc.

Emc IP Holding Company LLC

Extreme Networks, Inc.

Avaya Inc.

David E Frattura

Richard W Graham

John Roese

David Harrington

Brendan J Fee

Anja A Allen

Stephen J Todd

Srikanth Keesara

Roger Durand

Edgar J St Pierre

Deborah Ellen Fitzgerald

Nalinkumar Mistry

Christopher Monti

Mats N Wahlstrom

John-Paul Gorsky

Iain Balmer

Victor Da Costa De Oliveira

The present invention provides method and systems for dynamically mirroring network traffic. The mirroring of network traffic may comprise data that may be considered of particular interest. The network traffic may be mirrored by a mirror service portal from a mirror sender, referred to as a mirror source, to a mirror receiver, referred to as a mirror destination, locally or remotely over various network segments, such as private and public networks and the Internet. The network traffic may be mirrored to locations not involved in the network communications being mirrored. The present invention provides various techniques for dynamically mirroring data contained in the network traffic from a mirror source to a mirror destination.

System, method and apparatus for traffic mirror setup, service and security in communication networks

Systems and methods are provided for implementing virtual data management services. For example, a method for providing virtual data management services in a computing system comprising a cluster of server nodes, includes receiving a request for a data management service, provisioning one or more server nodes within the cluster of server nodes to execute the requested data management service, configuring one or more instances of virtual data services from a plurality of available virtual data service templates to implement the requested data management service, and executing the configured instances of virtual data services on the one or more provisioned server nodes to perform the requested data management service.

Virtual data management services

Distributed nodes are implemented using virtualization infrastructure of at least one processing platform. The processing platform is implemented using at least one processing device comprising a processor coupled to a memory. The distributed nodes collectively provide at least a portion of a distributed contextual analytics framework comprising analytics functions deployed at respective ones of the nodes. For example, the distributed nodes illustratively comprise multiple local nodes and at least one central node, with the distributed contextual analytics framework comprising local analytics functions deployed at respective ones of the local nodes and a central analytics function deployed at the central node.

Distributed contextual analytics

A network management and monitoring application employs diagnostic messages for confirming network path connectivity and identifying and locating connectivity faults. Diagnostic messages similar to conventional 'ping' and 'traceroute' messages traverse the network along a prescribed path for which diagnostic feedback is desired. The application receives and analyzes return messages sent from network entities along the path to ascertain connectivity issues on the path. The application receives layer 3 identifiers such as IP addresses, however performs diagnostic operations such as continuity checks based on layer 2 identifiers such as MAC (Media Access Control) identifiers because certain network entities operate on L2 identifiers and would otherwise evade a continuity check based on layer 3 identifiers. The monitoring application therefore performs continuity diagnostics such as ping and traceroute operations using L2 identifiers, therefore pinpointing problems with an L2 network forwarding entity such as a bridge that lies between L3 entities such as routers.

Multi-layer network diagnostic tracing

A request for network access is received from a client device at a network entry device of a network infrastructure. The network infrastructure determines a physical location of the client device and determines authorization of the client device based on the physical location. The approach can include providing the physical location along with other user credentials to an authorizing device. The method can also include determining a level of service based on the physical location. Communication for the approach can make use of the IEEE 802.1X protocol.

Location-based access control in a data network

Systems and methods are provided for preserving the privacy of data contained in mirrored network traffic. The mirrored network traffic may comprise data that may be considered confidential, privileged, private, or otherwise sensitive data. For example, the data payload of a frame of mirrored network traffic may include private Voice over IP (VoIP) communications between users on one or more networks. The present invention provides various techniques for securing the privacy of data contained in the mirrored network traffic. Using the techniques of the present invention, network traffic comprising confidential, privileged, private, or otherwise sensitive data may be mirrored in such a manner as to provide for the privacy of such data over at least a portion if not all of the mirrored communications between the mirror source point and the mirror destination point.

Method for network traffic mirroring with data privacy

A lost contact policy response system and related method for adjusting the operation of one or more network infrastructure devices upon detection of a loss of contact with a policy server function. The response system includes a policy enforcement function ('PEF'), a policy manager function, and either or both of policy set(s) and policy enforcement rule ('PER') set(s). The PEF implements stored or generated PER set(s). The policy manager function includes a monitoring function and an analysis function. The monitoring function monitors for continuing connectivity or signal exchange contact with a network policy server function. The analysis function selects a designated policy, policy set, PER or PER set, and instructs the PEF to implement the selected policy, PER or set. The policy and/or PER sets may be pre-installed, updated, re-installed, revised, or otherwise changed when and as desired. The related method includes corresponding steps for implementing the operations of the functions described.

System and method for lost contact response

A method and apparatus are provided that allows for the representation of a larger number of classes of network traffic and logical queues than is physically available on a per port basis within a network device. A number of logical queues, whose number can match the number of classes of network traffic a network device handles, may be supported across an aggregated set of ports even though the network device has fewer physical queues per port than there are classes of network traffic. The method and apparatus improve the management of network traffic sensitive to time delay and jitter, and further facilitates the operation of these applications in a simultaneous or near simultaneous manner.

Method and apparatus of virtual class of service and logical queue representation through network traffic distribution over multiple port interfaces

A system that associates physical locations with network-linked devices in a network to which such devices are connected. This system employs a variety of techniques for establishing device location. The system configuration can vary and can include any type of data network, including LANs, MANs, Wide Area Networks (WANs), Personal Area Networks (PANs), and Home Networks. The system provides location information for particular devices to the network devices and management, and may be used in any of a variety of ways to improve configuration accuracy, control, and security. The location information may also be used to control or secure a device itself.

Locating devices in a data network

A method for location discovery in a data network includes receiving, at a first device, connection information from a neighboring network device and determining a physical location of the first device based on the connection information. The method can include receiving, at the first device, the physical location transmitted from the neighboring network device. The method can further include associating a level of trust with the physical location based on the neighboring network device. The first device be one of a variety of devices, such as a router, a switch, a network entry device, a firewall device, or a gateway.

Location discovery in a data network

One or more trusted network devices within a data network infrastructure determine a physical location of a client device requesting access to the data network infrastructure. A trusted physical location is generated and associated with the client device. The approach can include determining whether a candidate network device is a trusted network device based on a likelihood that the candidate network device can be modified to provide false physical location data. The approach also can include determining a response for an access request by the client and controlling network resources provided to the client based on the trusted physical location.

Verified device locations in a data network

A method includes receiving, on a first network device, an announcement message from an endpoint device connected to the first network device via a network connection. The announcement message, which includes at least one connection criteria, is transmitted to one or more downstream network devices.

Growing community of inventors

New York, NY, United States of America

David E Frattura