F5 Networks, Inc.

Koninklijke Philips Corporation N.v.

Tektronix, Inc.

Other

Fs Networks, Inc.

Paul Imre Szabo

Timothy Scott Michels

David Dean Schmitt

Richard Roderick Masters

Hao Cai

William Ross Baumann

Peter Michael Thornewell

Saxon Carl Amdahl

Carlton Gene Amdahl

Greg W Davis

Bryan David Skene

Robert George Gilde

Benn Sapin Bollay

Alan B Mimms

Ning Xiang Li

Kim J Hansen

Thomas Allen Solosko

Anthony George Picardo

David Alan Hansen

Steven William Ranta

Ian G MacDuff

Christine Janae

Tim S Michels

Joseph Diederichs

Brent Wayne Blood

John A Moren

Michael Thomas Barthelow

Anthony King

Daniel J Powers

Ron Talmor

Christopher Ryan Baker

Gennady Dosovitsky

Nat Thirasuttakorn

Robert Andrew Kovalchik

Bill Baumann

Lisa M Golden

David A Hansen

Antonio Torzillo

Jeroen De Borst

Nathan McMahon

Amit Fridman

Allen B Mimms

Itai Druckmann

James Arthur Thomson

Steve Ranta

Donovan S Lowe

Daniel Wright

Dayne Miller

Dave Schmitt

Embodiments are directed towards managing name service communications. A name service device may be arranged to employ a hardware domain name service (DNS) processor to receive a name service query. The hardware DNS processor may perform operations on the name service query. If operations performed by the hardware DNS processor do not resolve the name service query, further operations may be performed. The name service device may be arranged to provide a name service reply that includes the answer to the name service query. And, the name service device may be arranged to send the name service reply back to the hardware DNS processor. Accordingly, the hardware DNS processor on the name service device may send the name service reply that includes at least an answer to the name service query to the requesting computers.

Methods of collaborative hardware and software DNS acceleration and DDOS protection

Embodiments are directed towards using policy rules that may be extended by scripting operative on a traffic management device. Each policy rule may have a condition and a corresponding action. If the condition is a script, a script engine separate from the policy engine may be employed to execute the script to determine if the condition is met. Otherwise, the policy engine may determine if the condition is met based on declarative expressions that comprise the condition. If the condition is met the action corresponding to the policy rule may be executed. Scripts may be used to compute the values of operands that may be used in one or more of the expression that comprise a condition for a policy rule. Also, the action corresponding to a policy rule may be implemented using a script that is executed by a script engine.

Extending policy rulesets with scripting

Embodiments are directed to managing communication over a network with traffic management computers (TMCs). If network traffic that is statelessly monitored is selected for stateful monitoring, the TMCs may perform operations to transition from stateless monitoring to stateful monitoring with minimal disruption of users/clients. TMCs may receive the network traffic that include network packets. If the network packets are statelessly monitored by the TMCs one or more stateless network management operations may be performed on the network packets. If the network packets may be statefully monitored the TMCs may perform stateful network management operations on the network packets.

Inserting and removing stateful devices in a network

Embodiments are directed towards overprovisioning IP addresses among a plurality of traffic management devices (TMDs). A plurality of IP addresses may be distributed among a plurality of available TMDs. A corresponding mirror TMD may be determined for each IP address. The corresponding mirror TMD for an IP address may be different than the available TMD currently associated with the IP address. In various embodiments, connections associated with each IP address may be mirrored at their corresponding mirror TMDs. The available TMDs may be employed to perform traffic management tasks on received packets based on at least a destination IP address of the received packets and the IP addresses associated with the available TMDs. If a TMD becomes unavailable, the IP addresses associated with the unavailable TMD may be redistributed to at least one remaining available TMD.

Overprovisioning floating IP addresses to provide stateful ECMP for traffic groups

Embodiments are directed towards upgrading hypervisors operating in hardware clusters that may be hosting one or more virtual clusters of virtual traffic managers. Virtual clusters may be arranged to span multiple computing devices in the hardware cluster. Spanning the virtual clusters across multiple hardware nodes the virtual cluster may enable the virtual clusters to remain operative while one or more hardware nodes may be upgraded. Hypervisor may include a management control plane for virtual clusters of virtual traffic managers. Hypervisors running on hardware nodes may manage the lower level networking traffic topology while the virtual traffic managers may manage the higher level network processing. Further, hypervisor based management control planes may interface with the virtual clusters and virtual traffic manager's using pluggable translation modules may enable different versions of hypervisor based management control planes and virtual traffic managers to communicate and cooperatively manage network traffic.

In service upgrades for a hypervisor or hardware manager hosting virtual traffic managers

Embodiments are directed towards employing a traffic management system (TMS) that is enabled to deploy component virtual machines (CVM) to the cloud to perform tasks of the TMS. In some embodiments, a TMS may be employed with one or more CVMs. In at least one embodiment, the TMS may maintain an image of each CVM. Each CVM may be configured to perform one or more tasks, to operate in specific cloud infrastructures, or the like. The TMS may deploy one or more CVMs locally and/or to one or more public and/or private clouds. In some embodiments, deployment of the CVMs may be based on a type of task to be performed, anticipated resource utilization, customer policies, or the like. The deployment of the CVMs may be dynamically updated based on monitored usage patterns, task completions, customer policies, or the like.

Elastic offload of prebuilt traffic management system component virtual machines

Embodiments are directed towards improving the performance of network traffic management devices by optimizing the management of hot connection flows. A packet traffic management device ('PTMD') may employ a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS may perform high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS may perform statistics gathering, per-packet policy enforcement (e.g., packet address translations), or the like, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components that may be comprised of high-performance computer memory. Making efficient use of the high speed flow cache capacity may be improved by maximizing the number of hot connection flows and minimizing the number of malicious and/or in-operative connections flows (e.g., non-genuine flows) that may have flow control data stored in the high-speed flow cache.

Data flow segment optimized for hot flows

Embodiments are directed towards network address based flood attack mitigation methods. A PTMD disposed between one or more computers may monitor several network flows and generate metrics associated with malicious network activity, such as, flood attacks. If flood attacks are determined to be occurring, the PTMD may determine the network addresses targeted by the flood attack. Further, the PTMD may activate flood attack mitigation procedures for the targeted network addresses such that other network addresses associated with the monitored network flows are excluded from the flood attack mitigation procedure. The PTMD may monitor the network traffic subsequently communicated to the targeted network addresses. Accordingly, the PTMD may determine if the flood attack has ceased based on characteristics of the monitored network traffic. If the flood attack has ceased, the flood attack mitigation procedures for the targeted network addresses may be deactivated.

Systems and methods for network destination based flood attack mitigation

Embodiments are directed towards improving the performance of network traffic management devices by optimizing the management of hot connection flows. A packet traffic management device ('PTMD') employs a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS performs high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS performs statistics gathering, and per-packet policy enforcement, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components. Making efficient use of the high speed flow cache capacity may be improved by maximizing the number of hot connection flows based on unique service and network traffic characteristics through adaptive feedback pattern learning together with administrator configurable service preferences that may have flow control data for most bandwidth hungry and desired hot services offloaded to the high-speed flow cache, at appropriate time.

Hot service flow hardware offloads based on service priority and resource usage

Embodiments are directed towards employing a packet traffic management device that has a split data flow segment ('DFS') and control segment ('CS') to determine if a connection flow update provided by the DFS to the CS is valid. The CS may be utilized to establish connection flows at the DFS based on connection flow requests. The CS may generate a connection flow identifier (&#x201c;CFID&#x201d;) for a connection flow request. The CS may cache the CFID at the CS. The CS may establish a connection flow at the DFS based at least on the connection flow request and the CFID. After a connection flow is established, a DFS may provide a connection flow update and a corresponding CFID to the CS. The CS may determine that the connection flow update is valid if the corresponding CFID matches the CFID cached at the CS.

Minimize recycle SYN issues for split TCP hot flows to improve system reliability and performance

A method performed by a hypervisor in a virtual network traffic management cluster, the method comprising: assigning a set of continuous available source media access control (SMAC) addresses to one or more virtual network traffic management devices in a network traffic management cluster, the one or more virtual network traffic management devices configured to handle connections for virtual guest instances; assigning a region of predetermined size in a SMAC-index mapping table to a corresponding virtual network traffic management device; wherein the assigned SMAC addresses and assigned region in the SMAC-index mapping table are accessible by the virtual guest instances; and maintaining SMAC-index pool allocation to virtual guest instances handled by corresponding virtual network traffic management devices.

Hardware assisted flow acceleration and L2 SMAC management in a heterogeneous distributed multi-tenant virtualized clustered system

A method, non-transitory computer readable medium, and host device that receives, at a routing interface, a request from a transmission control protocol (TCP) connection with a stateful network device. A media access control (MAC) address of the stateful network device is determined and the MAC address and the routing interface are stored as associated with information for the TCP connection in a per-connection routing table. The request is sent to one of a plurality of virtual machines, a response is received from the one of the virtual machines, and the MAC address and routing interface are retrieved from the per-connection routing table based on a comparison of information included in the response to the information for the TCP connection. The response is sent to the stateful network device using the retrieved MAC address and routing interface.

Methods for providing per-connection routing in a virtual environment and devices thereof

Creating a connection between one of a first plurality of computing devices in a primary chassis and one of a second plurality of computing devices in a failover chassis. A first plurality of buckets may be associated with the primary chassis, a second plurality of buckets may be associated with the failover chassis, where the first plurality of buckets may correspond to the second plurality of buckets. One of the first plurality of computing devices may be associated with one of the first plurality of buckets, and can create a connection with attributes such that a disaggregator in the failover chassis routes the connection to one of the second plurality of computing devices, wherein the one of the second plurality of computing devices may be associated with a bucket of the second plurality of buckets that corresponds to the one of the first plurality of buckets.

Connection bucketing in mirroring asymmetric clustered multiprocessor systems

Growing community of inventors

Seattle, WA, United States of America

Paul Imre Szabo