Riverbed Technology, Inc.

Opnet Technologies, Inc.

Riverbed Technologies, Inc.

Calix Limited

Riverbad Technology, Inc.

Nitin Gupta

David Tze-Si Wu

Pradeep Singh

Vinod Jeyachandran

Steven McCanne

Michael Demmer

Vivasvat Keswani

Alain J Cohen

MArk Stuart Day

Kand Ly

Alfred Landrum

Blanco Zee Leung Lam

Brian Miller

James Mark Shaw

Raghavendra B Uppalli

Shashidhar Merugu

Jerrold Stiffler

Pradeep Natarajan

Soren Lasen

Kartik Subbana

William J Welch

Adityashankar Kini

Case Larsen

Steve McCanne

Paras Suresh Shah

Kartik Subbanna

Charles Fraleigh

Charles Huang

Steven James Procter

Eric Ogren

Oleg Smolsky

Morteza Ghodrat

Anil Srirangapatna Nagesh

Kiron Vijayasankar

Michael Rollins

Joshua Berry

Prashant Wason

Robert Adler

Bart Robinson

Daniel Conor O'Sullivan

Michael J Demmer

A central management component deployed in a cluster of broadband network gateways (BNGs) balances load among subscribers through the cluster by monitoring subscriber states comprising usage of the BNGs based on load parameters to detect an overload condition on any BNG. In the event of an overload condition, the component performs a horizontal sharding operation to move at least some access load from the overloaded BNG to an underutilized BNG. Sharding separates a large group of BNGs into smaller and more numerous BNGs by reassigns one or more subscribers among the gateways. A load balancer applies rules to re-direct traffic based on a defined load balancing rule using one of: preference, present load, proximity, and operating characteristic.

Subscriber sharding across a broadband network gateway (BNG) cluster using a policy-driven load balancer

Virtual storage arrays consolidate branch data storage at data centers connected via wide area networks. Virtual storage arrays appear to storage clients as local data storage; however, virtual storage arrays actually store data at the data center. The virtual storage arrays overcomes bandwidth and latency limitations of the wide area network by predicting and prefetching storage blocks, which are then cached at the branch location. Virtual storage arrays leverage an understanding of the semantics and structure of high-level data structures associated with storage blocks to predict which storage blocks are likely to be requested by a storage client in the near future. Virtual storage arrays determine the association between requested storage blocks and corresponding high-level data structure entities to predict additional high-level data structure entities that are likely to be accessed. From this, the virtual storage array identifies the additional storage blocks for prefetching.

Virtualized data storage system architecture

A network analysis system invokes an application specific, or source-destination specific, path discovery process. The application specific path discovery process determines the path(s) used by the application, collects performance data from the nodes along the path, and communicates this performance data to the network analysis system for subsequent performance analysis. The system may also maintain a database of prior network configurations to facilitate the identification of nodes that are off the path that may affect the current performance of the application. The system may also be specifically controlled so as to identify the path between any pair of specified nodes, and to optionally collect performance data associated with the path.

Network path discovery and analysis

Serial clustering uses two or more network devices connected in series via a local and/or wide-area network to provide additional capacity when network traffic exceeds the processing capabilities of a single network device. When a first network device reaches its capacity limit, any excess network traffic beyond that limit is passed through the first network device unchanged. A network device connected in series with the first network device intercepts and will process the excess network traffic provided that it has sufficient processing capacity. Additional network devices can process remaining network traffic in a similar manner until all of the excess network traffic has been processed or until there are no more additional network devices. Network devices may use rules to determine how to handle network traffic. Rules may be based on the attributes of received network packets, attributes of the network device, or attributes of the network.

Serial clustering

Network traffic is monitored and an optimal framing heuristic is automatically determined and applied. Framing heuristics specify different rules for framing network traffic. While a framing heuristic is applied to the network traffic, alternative framing heuristics are speculatively evaluated for the network traffic. The results of these evaluations are used to rank the framing heuristics. The framing heuristic with the best rank is selected for framing subsequent network traffic. Each client/server traffic flow may have a separate framing heuristic. The framing heuristics may be deterministic based on byte count and/or time or based on traffic characteristics that indicate a plausible point for framing to occur. The choice of available framing heuristics may be determined partly by manual configuration, which specifies which framing heuristics are available, and partly by automatic processes, which determine the best framing heuristic to apply to the current network traffic from the set of available framing heuristics.

Automatic framing selection

Relatively small capacity solid-state storage devices (SSD) are combined with larger capacity magnetic disk storage devices for storing storage block write data to ensure data consistency. Write operations are stored in a sequential write buffer in an SSD to guarantee the storage of write data and then copied from the sequential write buffer to the destination address in a magnetic disk storage device. The sequential write buffer store write data in locations corresponding to the order of receipt of write operations. Write data from the sequential write buffer is transferred to the magnetic disk storage device in the same order and a checkpoint index is frequently updated to indicate the completion of some transfers. During system initialization, the most recent value of the checkpoint index is retrieved and used as a starting location for transferring write data from the sequential write buffer to the magnetic disk storage device.

Ensuring write operation consistency using multiple storage devices

A method and apparatus are provided for split-terminating a secure client-server communication connection when the client and server perform mutual authentication by exchanging certificates, such as within a Lotus Notes environment. When the client submits a certificate to the server, an intermediary device intercepts the certificate and submits to the server a substitute client certificate generated by that intermediary. A certificate authority's private key is previously installed on the intermediary to enable it to generate public keys, private keys and digital certificates. With the private key corresponding to the substitute certificate, the intermediary extracts a temporary key from a subsequent server message. The intermediary uses the temporary key to read a session key issued later by the server. Thereafter, the intermediary shares the session key with another intermediary, and together they use the session keys to access and optimize (e.g., accelerate) messages sent by the client and the server.

Split termination of secure communication sessions with mutual certificate-based authentication

A simulator simulates routing system protocols to build routing tables corresponding to a modeled network, and a comparator compares the routing tables in the actual network to these simulator-created routing tables. Because the modeled system represents a fault-free version of the actual system, and assuming that the modeled routing system protocols are representative of the algorithms used in the actual routers, these simulator-produced routing tables can represent steady-state routing tables that should be present in the routers of the actual network at steady state. By querying each router in the actual network for its routing table and comparing each routing table to the corresponding simulator-produced routing table, any differences from the steady state can be identified.

Routing validation

Transparent network devices intercept messages from non-transparent network devices that establish a connection. Transparent network devices modify these messages to establish an inner connection with each other. The transparent network devices mimic at least some of the outer connection messages to establish their inner connection. The mimicked messages and any optional reset messages are intercepted by the transparent network devices to prevent them from reaching the outer connections. Transparent network devices modify network traffic, using error detection data, fragmentation data, or timestamps, so that inner connection network traffic inadvertently received by outer connection devices is rejected or ignored by the outer connection network devices. Transparent network devices may use different sequence windows for inner and outer connection network traffic. To prevent overlapping sequence windows, transparent network devices monitor the locations of the inner and outer connection sequence windows and may rapidly advance the inner connection sequence window as needed.

Establishing network connections between transparent network devices

Virtual storage arrays consolidate data storage at a data center for physical and virtual computer systems at one or more branch network locations. Standalone and virtualized computer systems at a branch network location load, execute, and store their operating systems, applications, and data using virtual storage arrays and do not require any built-in or external non-volatile data storage devices such as hard disk drives or solid-state drives at the branch network location. The virtual disks of the virtual storage array are mapped to physical data storage at the data center and accessed via a WAN using storage block-based protocols. A storage block cache at the branch network location includes storage blocks prefetched based on knowledge about the computer systems at the branch network location and the behavior of their operating systems and applications.

Booting devices using virtual storage arrays over wide-area networks

Association information is used to build association trees to associate base pages and embedded objects at a proxy. An association tree has a root node containing a URL for a base page, and zero or more leaf nodes each containing a URL for an embedded object. In most cases, an association tree will maintain the invariant that all leaves contain distinct URLs. However, it is also possible to have an association tree in which the same URL appears in multiple nodes. An association tree may optionally contain one or more internal nodes, each of which contains a URL that is an embedded object for some other base page, but which may also be fetched as a base page itself. Given a number of association trees and a base-page URL, a prefetch system finds the root or interior node corresponding to that URL (if any) and traverses the tree from that node, prefetching URLs until the URL of the last leaf node is prefetched. The prefetching starts the process of bringing over the various embedded objects before the user or program would ordinarily fetch them.

Method and apparatus for acceleration by prefetching associated objects

Methods and apparatus are provided for intercepting a client-server communication connection in a computing environment. A first network intermediary configured to facilitate optimization of client-server transactions may be installed in a path of communications between the client and the server. A second network intermediary configured to cooperate with the first network intermediary is not in the path of communications between the client and the server. The first network intermediary intercepts a connection request from the client and forwards a modified request toward the server. A module within the server intercepts the connection request and redirects it to the second network intermediary. The client-server connection is thus split-terminated at the two network intermediaries, which establish cooperative sessions between themselves and with the client and with the server.

Interception of a cloud-based communication connection

A network stack includes a packet loss analyzer that distinguishes between packet losses due to congestion and due to lossyness of network connections. The loss analyzer observes the packet loss patterns for comparison with a packet loss model. The packet loss model may be based on a Forward Error Correction (FEC) system. The loss analyzer determines if lost packets could have been recovered by a receiving network device, if FEC had been used. If the lost packets could have been corrected by FEC, the loss analyzer assumes that no network congestion exists and that the packet loss comes from the lossy aspects of the network, such as radio interference for wireless networks. If the loss analyzer determines that some of the lost packet could not have been recovered by the receiving network device, the loss analyzer assumes that network congestion causes these packet losses and reduces the data rate.

Congestion management over lossy network connections

Growing community of inventors

Fremont, CA, United States of America

Nitin Gupta