A 10 Networks, Incorporated

Cisco Technology, Inc.

Martin Grimm

Rajkumar Ramniranjan Jalan

Ali Golshan

Yang Yang

Micheal Thompson

Vernon Richard Groves

Patrick Darrell Tate

Anurag Kahol

Alexander S Waterman

Sumandra Majee

Eric A Fritzges

Hema M Prasad

Anh Tien Nguyen

Brad Barfield

Robert R Branum, Jr

Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, in response to the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Transmission control of protocol state exchange for dynamic stateful service insertion

Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, based on the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Provided are methods and systems for load balancing client requests between sites associated with a domain name. A method comprises determining a first active response delay time between a Domain Name System server and a first site. The method further comprises determining a first application response delay time between the first site and one or more first servers associated with the first site. According to the method, the first active response delay time and the first application response delay time are compounded to produce a first compounded response delay time. The method further comprises determining a second active response delay time and a second application response delay for a second site to produce a second compounded response delay time. The first compounded response delay time and the second compounded response delay time are compared to perform load balancing between the first site and the second site.

Active application response delay time

Provided are methods and systems for load balancing client requests between sites associated with a domain name. A method comprises determining a first active response delay time between a local Domain Name System (DNS) server and a first site. The method further comprises determining a first application response delay time between the first site and one or more first servers associated with the first site. According to the method, the first active response delay time and the first application response delay time are compounded to produce a first compounded response delay time. The method further comprises determining a second active response delay time and a second application response delay for a second site to produce a second compounded response delay time. The first compounded response delay time and the second compounded response delay time are compared to perform load balancing between the first site and the second site.

A method is disclosed for reproxying connections. According to one aspect, a first connection is established between a client and a proxy device. A second connection is established between the proxy device and a server. The first connection comprises a first endpoint at the client and a second endpoint at the proxy device. The second connection comprises a third endpoint at the proxy device and a fourth endpoint at the server. The first and second connections are unproxied by dissolving the second and third endpoints while maintaining the first and fourth endpoints. After the connections have been unproxied, a packet is received at the proxy device. In response, the first and second connections are reproxied by creating fifth and sixth endpoints at the proxy device, so that the first connection comprises the fifth endpoint and the second connection comprises the sixth endpoint.

Reproxying an unproxied connection

Network connection switchover is accomplished through a method comprising receiving information defining a first connection between a first network device and a computer; establishing a replication channel between the first network device and a backup device; storing backup control information at the backup device; communicating a message flow between the first network device and the computer on the first transport connection; in response to unavailability of the first network device, communicating messages on the replication channel that cause (a) establishing a second connection between the backup device and the computer; (b) continuing communication of the message flow between the backup device and the computer based on the backup control information. TCP connections, for example, can be switched from an active device to a backup device without reset or re-transmission.

Method and apparatus for replicating a transport layer protocol stream

An approach for preventing denial-of-service attacks on Secure Sockets Layer ('SSL') protocol is described. Queues are generated for handshake state connections and data transmission connections. A connection object representing a new SSL connection is time-stamped as it enters the handshake portion of the SSL protocol. A connection pointer to the connection object is placed at the head of the handshake queue. As new SSL messages are transferred between client and SSL server, the time-stamp is updated when the entire message is received, the connection pointer is repositioned to the head of the queue. A timer event periodically surveys the queues. If connection packet transmission gaps remain below a specified maximum handshake gap time, a connection is allowed to progress to the data transmission state. If any connection exceeds the specified gap time, the SSL connection is dropped.

Growing community of inventors

Snoqualmie, WA, United States of America

Martin Grimm