Nortel Networks Corporation

Extreme Networks, Inc.

Bay Networks, Inc.

Derek H Pitcher

Mike K Noll

Randy Ryals

H Earl Ferguson

Jeffrey Prince

Mohan V Kalkunte

James Lawrence Mangin

Vipin Kumar Jain

Victor Lin

Balaji Srinivasan

Shehzad T Merchant

Manish M Rathi

Jia-Ru Li

Amit K Maitra

Matthew R Peters

Kishore K Seshadri

Jim Mangin

Earl Ferguson

Jeanne Haney

Brian Brown

Daniel A Simone

Devices, systems and related methods are disclosed for improving operational security of a network and/or network devices, such as wireless access points (APs). In the disclosed systems, a network device is not fully operational until it is attached to a network and downloads sensitive information. The information is stored in the network device so that when the device is disconnected from the network, the sensitive information is erased from the device, making the device inoperative and removing sensitive information, such as passwords, network security keys, or the like. Disabling the network device in this manner not only prevents the theft of sensitive network access information, by also discourages theft of the device itself because it cannot be used on another network without the configuration information. In addition to downloading configuration information, the network device can also download an executable image that is likewise not permanently resident on the device.

Apparatus, method and system for improving network security

A method and apparatus for managing the flow of data within a switching device is provided. The switching device includes network interface cards connected to a common backplane. Each interface card is configured to support the maximum transfer rate of the backplane by maintaining a 'pending' queue to track data that has been received but for which the appropriate routing destination has not yet been determined. The switching device includes a switch controller that maintains a central card/port-to-address table. When an interface card receives data with a destination address that is not known to the interface card, the interface card performs a direct memory access over a bus that is separate from the backplane to read routing data directly from the central table in the switch controller. Each interface card builds and maintains a routing information table in its own local memory that only includes a routing information for the destination addresses that the interface card is most likely to receive.

Method and apparatus for managing the flow of data within a switching device

A network switch having a unified, adaptive management paradigm for wireless network devices is disclosed. The switch includes configurable ports for connecting devices. A software application running on the switch allows a network administrator to selectively configure each port to support either a wired device or wireless device. Configuration information and software images that are needed for operation of the wireless device are associated with the port. When a wireless device is first plugged into the switch port, it downloads its configuration directly from the switch port. By storing the configuration information and images at the switch and automatically downloading them to the wireless devices, the task of configuring the devices is greatly simplified for the network administrator. This is particularly advantageous in heterogeneous network environments that support both wired and wireless devices, and where wireless device are readily moved to different ports.

Unified, configurable, adaptive, network architecture

A method and apparatus for managing the flow of data within a switching device is provided. The switching device includes network interface cards connected to a common backplane. Each interface card is configured to support the maximum transfer rate of the backplane by maintaining a 'pending' queue to track data that has been received but for which the appropriate routing destination has not yet been determined. The switching device includes a switch controller that maintains a central card/port-to-address table. When an interface card receives data with a destination address that is not known to the interface card, the interface card performs a direct memory access over a bus that is separate from the backplane to read routing data directly from the central table in the switch controller. Each interface card builds and maintains a routing information table in its own local memory that only includes routing information for the destination addresses that the interface card is most likely to receive.

A method and a system for improving communication performance between nodes in a network is disclosed. In one embodiment, the system includes routers, switches, and a communication interface. The communication interface detects a communication flow between a source and a destination in response to a flow criteria. Upon detecting the communication flow, the communication interface issues a resolution request for identifying data path. After receipt of a response to the resolution request, multiple connections between switches are established in response to levels of quality of service (QoS).

Flow detection scheme to support QoS flows between source and destination nodes

A technique for dynamically adjusting the aging time of a shortcut virtual circuit connection (VCC) in a Multi-protocol over ATM (MPOA) client based on one or more factors. In one embodiment, a method of dynamically adjusting aging time of a shortcut VCC includes detecting a packet flow between a source and a destination, establishing a shortcut VCC between the source and destination, and adjusting an aging time of the shortcut VCC in response to the number of VCCs available by the MPOA client. In other embodiment, the aging time is dynamically adjusted based on the VCC threshold level, the protocol of the flow, and/or the application type of the flow.

Method and apparatus for providing efficient management of resources in a multi-protocol over ATM (MPOA)

A technique for establishing a shortcut Virtual Channel Connection (VCC) in a Multi-Protocol Over ATM (MPOA) system detects a packet flow, and then determines whether to establish the shortcut VCC based upon an expected MPOA server response time. Specifically, an expected MPOA server response time is determined based upon an MPOA server response time history. The expected MPOA server response time is then compared to a predetermined MPOA server response time threshold to determine whether the expected MPOA server response time is within the predetermined MPOA server response time threshold. The shortcut VCC is established if the expected MPOA server response time is within the predetermined MPOA server response time threshold. Upon establishing the shortcut VCC, the MPOA server response time history is updated to reflect an actual MPOA server response time incurred when establishing the shortcut VCC.

Establishing shortcuts in a Multiprotocol-over-ATM system

A method and apparatus for managing the flow of data within a switching device is provided. The switching device includes network interface cards connected to a common backplane. Each interface card is configured to support the maximum transfer rate of the backplane by maintaining a &ldquo;pending&rdquo; queue to track data that has been received but for which the appropriate routing destination has not yet been determined. The switching device includes a switch controller that maintains a central card/port-to-address table. When an interface card receives data with a destination address that is not known to the interface card, the interface card performs a direct memory access over a bus that is separate from the backplane to read routing data directly from the central table in the switch controller. Each interface card builds and maintains a routing information table in its own local memory that only includes routing information for the destination addresses that the interface card is most likely to receive.

A method and apparatus for performing per-port Internet Protocol (IP) multicast pruning, proxying of IP multicast group membership reports, and generating pseudo membership queries for determining IP multicast group membership are provided. A switch may implement per-port IP multicast pruning by establishing a mapping of IP multicast groups to its ports. The mapping is based upon membership reports received from each end-station participating in an IP multicast group. Based upon the mapping, the switch forwards IP multicast packets only to those of the end-stations that are participating in the IP multicast group addressed. Once per-port IP multicast pruning is implemented, multicast routers must process membership reports from all end-stations participating in an IP multicast group. To reduce this burden, a switch may act as a proxy device. The switch receives a membership report identifying an IP multicast group. If the membership report is the first received for the IP multicast group after a membership query, then the switch forwards the membership report. However, if the membership report is not the first received, then the switch discards the membership report. To allow IP multicast group membership determination when no querier is present, a switch determines if another device is currently acting as a querier for a switched network. If not, the switch sends a membership query on one or more of its ports. Responsive to the membership query, an end-station transmits a membership report to the switch. The switch records the IP multicast group membership indicated in the membership report.

Method and apparatus for performing per-port IP multicast pruning

A method and apparatus for reducing the amount of control plane processing and flow detection required in a Multiprotocol Over ATM (MPOA) system are provided. According to one aspect of the present invention, flow detection processing may be altered based upon a packet's content. A first MPOA client (MPC) may include a plurality of flow detection mechanisms including standard MPOA processing and modified flow detection processing. For example, a flow may be determined to exist when the number of packets to a particular destination within a predetermined time interval exceeds a threshold value. Alternatively, a flow may be determined to exist immediately for certain types of traffic and detection of a flow may be suppressed for other types of traffic. Upon receipt at a first MPC, traffic may be classified based upon any information contained within a packet, including the header, the payload, or portions and/or combinations thereof. Based upon the packet's content, the MPC then selects among the plurality of flow detection mechanisms for purposes of determining whether or not a flow exists. According to another aspect of the present invention, control plane processing may be managed based upon a packet's content. A first MPC determines whether or not a stream of data with which a packet is associated justifies establishing a shortcut between the first MPC and the MPC with which the target is associated. After determining that the shortcut is justified, the first MPC allows or disallows the transmission of a resolution request based upon the packet's content.

Optimizing flow detection and reducing control plane processing in a multi-protocol over ATM (MPOA) system

A method and apparatus for filtering data packets from a network device, such as a LAN switch, onto a network coupled thereto based on the content of the data packets. A pattern is defined and a forwarding action performed on data packets whose contents match or do not match the pattern, according to a specified condition. Filters may be configured on a per port basis, i.e., a filter can be applied to data packets entering or exiting a specific port on a networking device such as a LAN switch. A data packet received or transmitted at a port of a network device whose contents meet a condition specified by a filter may be processed in a number of ways: the packet may be forwarded to a normal destination port according to normal forwarding rules, forwarded to additional destination ports, forwarded to a monitor destination port, dropped, or subjected to another filter. The next filter may define a different forwarding action for data packets that do not meet the condition specified by the present filter.

Method and apparatus for processing data packets in a network

A method and apparatus for controlling data flow within a switching device are provided. The switching device includes a cell-switched backplane. Both packet switched and cell switched network interface cards may be coupled to the cell-switched backplane. A destination tag is created for each unique destination port and for each unique set of destination ports. The destination tags are used to index a master destination tag table. The entry of the master destination tag table that corresponds to a given destination tag includes a destination mask that indicates which ports are destination ports the given destination tag. Local tables are built and maintained within each network interface card based on the information contained in the master destination tag table. When a network interface receives data from an external device, the network interface determines the destination tag associated with the data. Once the destination tag is determined, it is used as an index to the locally stored tables to determine whether the data should be forwarded to any local ports, and whether the data should be sent over the cell-switched backplane to other network interfaces within the switching device. When a network interface receives data over the backplane, the network interface uses the destination tag as an index to a locally stored table to determine to which local ports the data should be sent. Tables also establish correlations between destination tags and control information for converting data between packets and cells.

Growing community of inventors

Los Altos, CA, United States of America

Derek H Pitcher