Cisco Technology, Inc.

Palo Alto Networks, Inc.

Harshavardhan Parandekar

Vikram Guleria

Nazanin Magharei

Ali Sajassi

Pratap Pereira

Tapraj Singh

Sanjay Dhar

Rimu Bhardwaj

Sangeeta Ramakrishnan

Mark E Millet

Avaneesh Anandrao Kadam

Ravinandan Govinda Rao Arakali

Zhijian Zhang

Gitesh Shah

Tung-Fai Chan

Jeffrey Yi Dar Lo

Prasanna Mucharikar

Yu Zhang

A pseudo-active/active firewall configuration handles firewall switchover events with minimized session disconnection. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. During updating of a corresponding Network Address Translation (NAT) table to route traffic to the now-active firewall, the pseudo-active firewall enters a forwarding state wherein it forwards ingress network sessions to the now-active firewall and processes the ingress network sessions according to its active state. The now-active firewall receives the ingress network sessions and records session states prior to discarding them. After updating the NAT table, when traffic is routed to the now-active firewall, the recorded session states are used to maintain active sessions.

Firewall switchover with minimized session disconnection

A recommendation system can be configured to provide tailored software update relevance information for deployed software. The recommendation engine can obtain running state information for a current version of software running on a device, as well as build data for each of the current version of the software and a new version of the software. The recommendation engine can obtain software version difference information based on the build data and determine, based on at least the software version difference information and the running state information, a number of functions in the current version of software that are directly impacted by the new version. The recommendation engine can cause relevance information derived from this determination to be displayed on a computing device, and/or the recommendation engine can automatically cause an update to the new version of the software to be applied or rejected based on the determination.

Providing tailored software update relevance information for deployed software

A pseudo-active/active firewall configuration handles firewall switchover events without traffic disruption. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. An Internet protocol address binding linking the now pseudo-active firewall to an Internet gateway that forwards traffic to the firewalls is updated in a network address translation (NAT) table to route traffic to the newly active firewall. Once a pseudo-active timer expires and the binding is successfully updated to route traffic to the newly active firewall, the pseudo-active firewall is set to a passive state.

Firewall switchover with minimized traffic disruption

A proxy server can be configured to manage flow between terminated transport layer connections despite incongruous network conditions. The proxy server is programmed to dynamically adjust window size of one transport layer connection in the pair of proxy terminated connections to accommodate the other connection. After detecting a network condition related to one of the connections, the proxy server determines a drain rate of the transmit buffer of the transport layer connection corresponding to the impacting network condition. The proxy server then adjusts the transport layer window size for the other connection of the connection pair based on the determined drain rate.

Managing proxy throughput between paired transport layer connections

This disclosure describes techniques to compile source code corresponding to a portion of a software program. The techniques include generating first object code by processing the source code. Based at least in part on processing the source code, generating second object code, wherein the second object code, when executed by one or more processors, causes the one or more processors to perform an operation unconditionally bound to a unique identifier of the operation. The described techniques further include generating an indication of a mapping of the unique identifier to the portion of the software program.

Compiler-enabled application execution tracking

A wideband cable network system includes multiple wideband cable modems and a Wideband Cable Modem Termination System (WCMTS). The WCMTS operates a Media Access Control (MAC) layer that communicates with the cable modems over multiple different downstream Radio Frequency (RF) channels and upstream RF channels. A wideband failure analytic manager tracks fault indicators associated with the MAC layer communications. Separate failure analytics are then generated, indexed, and correlated for different cable modems and different upstream or downstream channels.

Wideband fault correlation system

Methods and apparatus are disclosed for offering broadcast IPTV solutions over cable (HFC networks). Rather than bypass the CMTS, a reduced number of downstream ports are utilized for video streams. Each input video stream is streamed to a multicast group address. In one embodiment, several RF channels are configured so that they are RF spanned across all the Fibernodes in the CMTS service area. In an embodiment, an STB sends a service request for a desired video stream using an IGMP request, and the CMTS responds by issuing a DBC request to tune the corresponding CM to the RF channel that is carrying the requested stream. Preferably, the CMTS ports that carry the static multicast streams are RF spanned across all the Fibernodes, or a selected subset.

Broadcast solution for cable IPTV

A network device has a network interface to allow the device to send and receive traffic across a network. The device also has a cable connection to allow the device to exchange data with at least one cable modem and a processor to associate a cable interface and cable service identifier with a cable modem; receive a packet from the cable modem; and insert a layer 2 network identifier, the identifier comprising two service provider VLAN (SP-VLAN) tags, into the packet. The processor in the network device identifies a virtual trunk interface based on the outer SP-VLAN tag and identifies the virtual private network based on the inner SP-VLAN tag.

System and method for providing support for multipoint L2VPN services in devices without local bridging

A network device has a network interface to allow the device to send and receive traffic across a network. The device also has a cable connection to allow the device to exchange data with at least one other device across a cable network. The device has a processor to receive traffic having a network identifier through the network interface and determine if the network identifier is associated with a virtual private network. If the network identifier is associated with a virtual private network, the device then routes the traffic to an appropriate receiving entity through the cable connection if the network identifier is associated with a local are network.

Growing community of inventors

San Jose, CA, United States of America

Harshavardhan Parandekar