Cabletron Systems, Inc.

Enterasys Networks, Inc.

Richard Bussiere

Brendan J Fee

William T Haggerty

Jeff Cioli

David Belser

Richard W Graham

John Roese

David Harrington

Steven A Pettit

Mark Townsend

A system and method to respond to intrusions detected on a network system including attached functions and a network infrastructure. The system includes means for receiving from an intrusion detection function information about intrusions, a directory service function for gathering and reporting at least the physical and logical addresses of devices of the network infrastructure associated with the detected intrusions, and a plurality of distributed enforcement devices of the network infrastructure for enforcing policies responsive to the detected intrusions. A policy decision function evaluates the reported detected intrusions and makes a determination whether one or more policy changes are required on the enforcement devices in response to a detected intrusion. A policy manager function configures the distributed enforcement devices with the responsive changed policy or policies. Policy changes rules can vary from no change to complete port blocking on one or more identified enforcement devices associated with the detected intrusion, to redirecting the associated traffic including the intrusion and these policies may be modified or removed over time as warranted by network operation.

Distributed intrusion response system

A method and apparatus are provided for connection-oriented switching in a communications network wherein a pre-established path is established between a select pair of an ingress switch and an egress switch. The use of pre-established paths enables a reduction in the total number of connections required inside the switch cloud, reduces the CPU load on trunk switches, and shortens the time for connection setup. In the embodiment described, the DA/SA fields of a MAC frame data packet are replaced with a &ldquo;virtual path&rdquo;, which identifies the pre-established path between the ingress and egress switches. A &ldquo;virtual circuit&rdquo; is provided in another field of the modified packet which specifies the out-port and out-header on the egress switch for demultiplexing the modified packet upon receipt at the egress switch. The virtual circuit is exchanged between the ingress and egress switches at connection setup. The virtual path is assumed to already be in place, and known to both switches, prior to connection setup.

Aggregation of data flows over a pre-established path to reduce connections

A method and apparatus are provided for connection-oriented switching in a communications network wherein a pre-established path is established between a select pair of an ingress switch and an egress switch. The use of pre-established paths enables a reduction in the total number of connections required inside the switch cloud, reduces the CPU load on trunk switches, and shortens the time for connection setup. In the embodiment described, the DA/SA fields of a MAC frame data packet are replaced with a 'virtual path', which identifies the pre-established path between the ingress and egress switches. A 'virtual circuit' is provided in another field of the modified packet which specifies the out-port and out-header on the egress switch for demultiplexing the modified packet upon receipt at the egress switch. The virtual circuit is exchanged between the ingress and egress switches at connection setup. The virtual path is assumed to already be in place, and known to both switches, prior to connection setup.

Aggregation of mac data flows through pre-established path between

Method and apparatus for remote monitoring of data on a communications network, wherein data transmitted and received by a port can be examined at a location other than on the device having the examined port. A method includes the steps of selecting a mirror-from-port of a first device from which to mirror packets, selecting an analyzer port of a second device to which to mirror the packets, and mirroring the packets from the mirror-from-port of the first device to the analyzer port of the second device. The mirroring step may include establishing a connection path through the network, encapsulating the packets with a connection path identifier, and sending the encapsulated packets through the network to the second device. The benefits include ease of use, fewer resources (analyzers) needed, time savings, and not having to dedicate a physical port as the mirror-to-port on the device.

Remote port mirroring system and method thereof

Growing community of inventors

Andover, MA, United States of America

Richard Bussiere