International Business Machines Corporation

Other

Cisco Technology, Inc.

John Kenneth Stacy

William Gavin Holland

Joseph Franklin Logan

Joseph Gerald McDonald

Henry Michael Garrett

William Robert Lee

Richard L Jackson

Trevor Garner

Martin Hughes

Kenneth James Barker

Paul Henry Nichols

Mark Crane Wartski

Dennis Briddell

Russell Evan Schroter

Ryan Lance Badger

A system and method is provided for automatically identifying and removing malicious data packets, such as denial-of-service (DoS) packets, in an intermediate network node before the packets can be forwarded to a central processing unit (CPU) in the node. The CPU's processing bandwidth is therefore not consumed identifying and removing the malicious packets from the system memory. As such, processing of the malicious packets is essentially 'off-loaded' from the CPU, thereby enabling the CPU to process non-malicious packets in a more efficient manner. Unlike prior implementations, the invention identifies malicious packets having complex encapsulations that can not be identified using traditional techniques, such as ternary content addressable memories (TCAM) or lookup tables.

Hardware filtering support for denial-of-service attacks

A technique efficiently searches a hash table containing a plurality of 'ranges.' In contrast with previous implementations, the technique performs fewer searches to locate one or more ranges stored in the hash table. To that end, the hash table is constructed so each hash-table entry is associated with a different linked list, and each linked-list entry stores, inter alia, 'signature' information and at least one pair of values defining a range associated with the signature. The technique modifies the signature based on the results of one or more preliminary range checks. As a result, the signature's associated ranges are more evenly distributed among the hash table's linked lists. Thus, the linked lists are on average shorter in length, thereby enabling faster and more efficient range searches. According to an illustrative embodiment, the technique is applied to flow-based processing implemented in an intermediate network node, such as a router.

Header range check hash circuit

A method for transferring data between non-contiguous buffers in a memory and an I/O device via a system I/O bus uses a descriptor queue stored in memory. Each descriptor points to a buffer and includes the length of the buffer. The I/O device is provided with the base address of the queue, the length of the queue and a current address which at initialization is the same as the base address. When data is to be transferred a device driver located in the processor sends the number of available descriptors (DescrEnq) to the I/O device which accesses the descriptors individually or in burst mode to gain access to the data buffers identified by the descriptors.

Efficient data transfer mechanism for input/output devices having a device driver generating a descriptor queue and monitoring a status queue

Efficient data transfer mechanism for input/out devices having a device driver generating a descriptor queue and monitoring a status queue

Efficient data transfer mechanism for input/output devices

A a scoring tool which can be used to aid in removing wallpaper. The tool has a hand grip to which is connected a pair of cutting wheels. The wheels are mounted in the lower portion of the hand grip so the wheels diverge away from each other.

Scoring tool

A method of removing wall paper which includes the steps of dipping an absorbent fabric into water or a solution of aqueous wall paper remover. Allowing excess solution to drain from the fabric and then placing the fabric in direct contact with the wall paper. The fabric adheres to the wall merely through water cohesion. The fabric is allowed to remain on the wall paper for a period of time to allow the solution to soak into the paper. Once this occurs, the fabric is removed and the paper can be scraped off the wall.

Method of wallpaper removal

An ATM communications network includes a system processor having a device driver and a memory coupled to an adapter at an interface. Frames stored in the memory are transmitted to the network using a transmit ready queue residing in the adapter and defined by transmit control registers. The frames are linked together by descriptors and pointers to received ready lists maintained by the device driver. A transmit frame complete list is established in the system memory using the transmit control registers. An interrupt is generated by the adapter indicating when frame transmission is complete. Simultaneously, cells are received from the network and stored in system memory according to a free buffer list established by the device driver. A pointer is maintained by the device driver to the last entry of the receive free buffer list. The adapter maintains a pointer to the next buffer to be used from the receive free buffer list. A receive ready list is established by the device driver in system memory with the location indicated to the adapter via the receive control registers in the adapter. The receive data cells are reassembled into frames in buffers from the free buffer list. At completion of a received frame, the frame is added to an appropriate receive ready list. An interrupt is generated to the processor by the adapter when one or more completed frames reside on the receive ready list for transmission to the network.

System and method for an efficient ATM adapter/device driver interface

Growing community of inventors

Cary, NC, United States of America

John Kenneth Stacy