Tippingpoint Technologies, Inc.

Cisco Technology, Inc.

3com Corporation

Breakingpoint Systems, Inc.

Hewlett-packard Development Company, L.P.

Cisco Systems Inc.

Keysight Technologies Singapore (holdings) Pte. Ltd.

Keysight Technologies Singapore (sales) Pte. Ltd.

Dennis James Cox

Brian Smith

Craig S Cantrell

Marc Willebeek-LeMair

Donovan Kolbly

John Francis McHale

Joe Wayne Blackard

Charles R Buckman

Francis S Webster, Iii

Jon Harald Werner

Aravind Sitaraman

Shujin Zhang

John A Joyce

Alexander Tomlinson

Kristopher Len Raney

Michael Moriarty

Kip R McClanahan

Bernard Roycroft James

Rene T Tio

Peter S Heitman

Santanu Paul

Aziz Abdul

Matthew Laswell

Ryan S Clifton

Deep Datta

Mark Veteikis

Jeremy B Moss

Donovan M Kolby

John H Werner

Joseph Dempsey

Scott Strentzsch

Stephen Egbert

Terry G Ahnstedt

Craig Cantrell

John Mchale

Marc Lemair-Willebeek

Methods and systems are disclosed that provide in-session splitting of network traffic sessions for monitoring of traffic between network clients and network servers. This in-session splitting is based upon monitoring traffic sessions for one or more events and then initiating a proxied session based upon detection of the one or more events. For further embodiments, the creation of the proxied session is implemented based upon detection of a request for a secure link within the session traffic, and the proxied session is then implemented such that original session participants are not aware of the proxied session. The encrypted secure communications between the network client and the network server are split into two connections that decrypted and re-encrypted so that the contents of the secure link can be analyzed to identify network threats and/or other desired network related activities.

In-session splitting of network traffic sessions for server traffic monitoring

Methods and systems are disclosed that provide active firewall control for network traffic sessions within virtual processing platforms. Client agent instances run within virtual machine (VM) platforms (e.g., hypervisor, container, etc.) within virtual processing environments and enforce access, proxy, and/or other firewall rules with respect to network traffic sessions for application instances also running within the VM platforms. For certain embodiments, the agent instances collect information about applications and services running within the VM platforms and use this collected information to automatically enforce firewall rules. Additional disclosed embodiments redirect packets from 'bad' network sources to a proxied application instance that interacts with the 'bad' network source. This proxied interaction allows an agent instance monitoring the proxied session to analyze and assess the actual activity by the &#x201c;bad&#x201d; network source without putting the original data or network service at risk. Other features and variations are also be disclosed.

Active firewall control for network traffic sessions within virtual processing platforms

Systems and methods are disclosed for application identification and dynamic signature generation for managing network communication systems. Communication sessions and related packet flows are monitored within a network communication system. Application level information is extracted from session packets by unpacking one or more communication protocols associated with the network packets to obtain application level information encapsulated within the network packets. The extracted application level information is compared to a database of known application signatures in order to identify known applications. For unknown applications, the application level information is used to generate new dynamic application signatures. The application level information can also be used to identify and access external network-accessible resources to obtain additional identification information for the unknown application. Identification information for the newly detected application can then be provided to a user along with flow control options for the newly detected application.

Application identification and dynamic signature generation for managing network communications

A method for enabling virtual data loopback in a computing system may include forwarding a data packet from a first device to a second device; the second device identifying from the data packet egress interface information indicating a first interface for forwarding the data packet out of the computing system; based on the first interface identified from the egress interface information, automatically determining a second interface to the first interface; inserting into the data packet ingress interface information that indicates the second interface; forwarding the data packet, including the ingress interface information, back to the first device; and the first device identifying the ingress interface information indicating the second interface; such that the data packet is looped back to the first device without being communicated via the first or second interface, and such that from the perspective of the first device the data packet was received via the second interface.

Virtual data loopback and/or data capture in a computing system

A system for identifying a subscriber includes an access server coupled to a number of subscribers using a first communication network and further coupled to a second communication network, a memory coupled to the access server, and a processor coupled to the memory. The access server receives a communication from a particular subscriber using a particular one of a number of virtual circuits associated with the first communication network. The memory stores path information that identifies a virtual circuit assigned to the particular subscriber. The processor identifies the particular subscriber for connection to the second communication network based upon the path information and the particular virtual circuit used to receive the communication from the particular subscriber.

System and method for identifying a subscriber for connection to a communication network

A network node includes a classify engine interfaced with the Internet. The classify engine accepts packets from the Internet and determines classification information for each packet. A process engine is interfaced with the classify engine, and has ports, each port being associated with a function. A controller is interfaced with the classify engine and the process engine. The controller programs the classify engine with a dataflow program to route each packet to a predetermined port of the process engine based on the classification information of the packet.

System and method for processing network packet flows

A system and method provides a broadband network node for a best effort network such as the Internet or intranets which supports the inexpensive and rapid deployment of services to the best efforts network. Separate data path and control path mechanisms allow high-speed data transfers with parallel processing flows for the data path that are controlled across data flows by the control path. Packets are classified, modified and shaped to enable the service on the network with an accountant to track packet traffic for control and billing purposes. A series of processing blades perform a modification function for each blade that processes packets according to classifications. The processing blades are modular and scalable for insertion in the broad band switch to rapidly adapt the broadband network node for new services.

A method is provided for blocking attacks on a private network (). The method is implemented by a routing device () interconnecting the private network () to a public network (). The method includes analyzing an incoming data packet from the public network (). The incoming data packet is then matched against known patterns where the known patterns are associated with known forms of attack on the private network (). A source of the data packet is then identified as malicious or non-malicious based upon the matching. In one embodiment, one of the known forms of attack is a denial of service attack and an associated known pattern is unacknowledged data packets. In another embodiment, one of the known forms of attack is an address spoofing attack and an associated known pattern is a data packet having a source address matching an internal address of the private network ().

Method for blocking denial of service and address spoofing attacks on a private network

A network processor is enabled to retrieve a packet transmission data structure (PTD) from a memory. The NP parses packet data from the PTD and transmits the data over the network as a network packet. The PTD may include repetition information used by the NP to transmit a plurality of packets. The PTD use transmission interval information to control transmission timing of consecutive network packets. The PTD may include modification information used to modify the data packet portion. The modification may include incrementing, decrementing, or storing a random number into any portion of the data packet. The PTD may include flow control information to determine the next PTD to process. The flow control information may include criteria including acknowledgement criteria and time delay criteria. The packet data portion preferably includes all formatting information applicable to the network.

Focused function network processor

An active network defense system is provided that is operable to monitor and block traffic in an automated fashion. This active network defense system is placed in-line with respect to the packet traffic data flow as a part of the network infrastructure. In this configuration, inspection and manipulation of every passing packet is possible. An algorithmic filtering operation applies statistical threshold filtering to the data flow in order to identify threats existing across multiple sessions. A trigger filtering operation applies header and content match filtering to the data flow in order to identify threats existing within individual sessions. Threatening packet traffic is blocked and threatening sessions are terminated. Suspicious traffic is extracted from the data flow for further examination with more comprehensive content matching as well as asset risk analysis. A flow control mechanism is provided to control passage rate for packets passing through the data flow.

Active network defense system and method

A network discovery functionality, intrusion detector functionality and firewalling functionality are integrated together to form a network security system presenting a self-deploying and self-hardening security defense for a network.

Network security system integration

Growing community of inventors

Austin, TX, United States of America

Dennis James Cox