Amazon Technologies, Inc.

Kirk Arlo Petersen

Andrew Bruce Dickinson

Sridhar Boyapati

Alexander Michael McNamara

Jack Bradley Jones

Nathan Lee Wesling

Joseph Paul Zipperer

Korwin Jon Smith

Benjamin Ralph Hollis

David William Bettis

Ajith Jayamohan

Félix Joseph Étienne Pageau

Natalie Thuy-Tien Nguyen

Ethan Joseph Torretta

Kevin Alexander Lee

Preetha Chatterjee

Lu Ye

Upendra Bhalchandra Shevade

Shuai Ye

Matthew B Barr

Colin Whittaker

Mathew Lehwess

Young Ha Jung

Akshay Choudhry

Michael Weyandt

Chaithan Mysore Prakash

Described is a system and method for developing and dynamically updating user paths through a materials handling facility. A user path through a materials handling facility may be developed that will route a user past one or more items (e.g., pick list items, recommended items, wish list items, promotional items) planned for the user. If the user does not follow the user path, the user path may be dynamically updated to account for the current location of the user and/or to consider other actions performed by the user.

Item based path development

Packets received at a routing intermediary and directed to a resource are transmitted to a data plane node of a partition of a traffic management service. The data plane node transmits an indication of a high-arrival-rate destination group, identified based on a metric of network packets received at the data plane node, to a control plane node of the service. A resource is identified at the control plane node as a rate limiting target based on high-arrival-rate group information from several data plane nodes. A limit is applied to the rate at which packets are received at the target. The control plane node changes the number of data plane nodes in the partition based on a triggering condition.

Scalable network traffic shaping service with dynamically configured partitions

Described is a system and method for routing output information to one or more of a plurality of output devices. In one implementation, output information that includes information to be presented and a location information identifying where the output information is to be presented may be generated by an output host. The output information is received by an output router that determines, based on the location information, an output device and routes the output information to the output device for presentation.

Altering output hosts

Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network, where the ingress traffic is destined for a block of public or private IP addresses. The route instructs the edge routing device to forward such ingress traffic to a network interface of a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of one or more public or private IP addresses in the block of public/private IP addresses. The edge routing device may identify the route in the route table that forwards the ingress network traffic destined for the block of public or private IP addresses to the network interface for the network appliance.

Routing ingress traffic for logically isolated networks destined for IP blocks without any network address translation

User path development

Systems and method are provided for source-dependent address resolution. Multiple computing devices may be associated with identifiers, such as network names. These computing devices may further be associated with both internally and externally accessible network addresses. A source-dependent address resolution component may resolve a network identifier into an internal or external address based on a network of a requesting device. Specifically, a request for address resolution may be received from a source network, and be resolvable into an address of a target network. If the source network and target network are the same, an internal address of that shared network is returned. If the source network and the target network are different, an external address enabling external communication with the target network is returned. In some embodiments, determination of a source network may be facilitated based on a source port of a request.

Source-dependent address resolution

A method and apparatus for rate limiting network traffic are provided. A plurality of network devices may receive network traffic and route the network traffic to a destination. Rate limits may be imposed on the output rate of the plurality of network devices. The rate limits may be adjusted as the flow of the network traffic changes.

Rate limiting of network traffic

Controlling routing of output information to output devices

Functionality is disclosed herein for regulating bandwidth that is available for network traffic flowing through a data communications network. In response to attack traffic being detected, one or more traffic regulators are set to control an available bandwidth to be used by the attack traffic. The one or more traffic regulators are adjusted until an attack is no longer detected. After the attack ends, the traffic regulator may be disabled or set to a different mode of operation.

Dynamic traffic regulation

Functionality is disclosed herein for dynamically deploying an upstream network traffic filter in a network. The upstream network filter is dynamically deployed in a location that is closer to an entry point of an attack such that attack traffic reaches the upstream network filter before reaching a network traffic filter that is configured to perform network traffic filtering for a computing resource that is under attack. The upstream network traffic filter includes rules that are based on at least a portion of the rules that are applied by the network traffic filter.

Dynamically deploying a network traffic filter

Techniques are disclosed for dividing a TCP handshake into multiple parts, in a system comprising an edge device, an intermediary computing node, and a destination computing node. A client sends a TCP SYN packet to the edge device, to establish a TCP connection with the destination computing node. The edge device performs the handshake, and then forwards an ACK packet to the intermediary computing node. The intermediary computing node uses that ACK packet to generate a second SYN packet, and uses that SYN packet to perform a TCP handshake with the destination computing node. Then, TCP sequence numbers are converted between what is expected by the client and destination in packets sent between the two.

Two-stage TCP handshake

Denial-of-service protection for a computing device on a first network is disclosed. In an embodiment, a packet containing a network address corresponding to a computing device on the first network is received from a source address of a second network by a gateway device. The packet includes a request to initiate a connection to the computing device on the first network. In response, an acknowledgement is transmitted to the source address. The acknowledgement includes sequence information sufficient to establish the requested connection, including a unique identifier. Subsequently received packets addressed to the network address of the computing device are forwarded by the gateway device to a corresponding network address of the computing device on the first network upon verifying a response to the acknowledgement.

Growing community of inventors

Seattle, WA, United States of America

Kirk Arlo Petersen