Enterasys Networks, Inc.

Extreme Networks, Inc.

Digital Equipment Corporation

Other

Computer Associates Think, Inc.

Richard W Graham

John Roese

David E Frattura

Markus Nispel

David L Kjendal

David Harrington

Michael B Rash

Jamie R Woodhead

Jeffrey W Haskell

Ernie Eaton

Roger Durand

Brendan J Fee

Patrick A Bosa

Vala Afshar

Martin Q Thornton

William M Ferland

John-Paul Gorsky

Anja A Allen

Leo Lam

Douglas Hyde

Thomas A Stewart

Michael Lam

John J Roese

David Frattura

Roger P Durand

Ronald L Jones

Lundy M Lewis

Donald Bruce Grosser, Jr

Henry S Yang

William R Hawe

Nicholas Ilyadis

Michael Paul Shevenell

Richard Bussiere

Steven A Pettit

Jeffrey Allen Ford

Michael W Carrafiello

Mark Townsend

Steven Pettit

Scott Scheeler

The present invention provides method and systems for dynamically mirroring network traffic. The mirroring of network traffic may comprise data that may be considered of particular interest. The network traffic may be mirrored by a mirror service portal from a mirror sender, referred to as a mirror source, to a mirror receiver, referred to as a mirror destination, locally or remotely over various network segments, such as private and public networks and the Internet. The network traffic may be mirrored to locations not involved in the network communications being mirrored. The present invention provides various techniques for dynamically mirroring data contained in the network traffic from a mirror source to a mirror destination.

System, method and apparatus for traffic mirror setup, service and security in communication networks

A function is provided in a network system for the dynamic mirroring of network traffic for a variety of purposes including the identification of characteristics of the traffic. Multiple criteria are established for when, what and where to mirror the traffic. The criteria include what frames of traffic to mirror, what portions of the selected frames to mirror, one or more portals through which to minor the selected frames, a destination for the mirroring and the establishment of a mirror in a device to carry out the mirroring. The criteria may also include when to stop the mirroring. The mirroring instructions can be changed based on the detection of a triggering event, such as authentication, device type or status, ownership of an attached function attached to the device, flow status, but not limited to that. The function may be established in one or more devices of the network.

Device and related method for dynamic traffic mirroring

The subject matter described herein includes methods, systems, and computer readable media for advanced distribution in a link aggregation group (LAG). In some examples, a packet forwarding device includes physical ports for sending and receiving network traffic. The packet forwarding device includes one or more packet processors configured to perform LAG distribution by distributing incoming packets across active links of a first LAG formed between the packet forwarding device and one or more network devices. The incoming packets are in route to a destination device in communication with one of the network devices. The packet processors are configured, in an advanced distribution mode, to transmit a first packet of the plurality of incoming packets for the first LAG over a selected active link selected from a subset of the plurality of active links for the first LAG.

Methods, systems, and computer readable media for advanced distribution in a link aggregation group

A function is provided in a network system for the dynamic mirroring of network traffic for a variety of purposes including the identification of characteristics of the traffic. Multiple criteria are established for when, what and where to mirror the traffic. The criteria include what frames of traffic to mirror, what portions of the selected frames to mirror, one or more portals through which to mirror the selected frames, a destination for the mirroring and the establishment of a mirror in a device to carry out the mirroring. The criteria may also include when to stop the mirroring. The mirroring instructions can be changed based on the detection of a triggering event, such as authentication, device type or status, ownership of an attached function attached to the device, flow status, but not limited to that. The function may be established in one or more devices of the network.

A system and related method for the exchange of information, data and instructions between one or more network administrators and one or more network infrastructure devices via one or more media exchanges. Devices are managed using a social media agent including a session agent that translates media messages into network device content and vice versa while maintaining context. Particular media interfaces may be selected for messaging dependent upon the particular message to be exchanged. Shorthand may be used to facilitate messaging through media of interest.

System and related method for management of devices of a network system via social media interfaces

A function is provided in a network system for adjusting network policies associated with the operation of network infrastructure devices of the network system. Network policies are established on network devices including packet forwarding devices. The network has a capability to identify computer applications associated with traffic running on the network. A network policy controller of the network is arranged to change one or more policies of one or more network devices based on computer application information acquired. The policies changed may be network policies as well as mirroring policies. An example policy to change is direct a network device to mirror traffic to an application identification appliance for the purpose of identifying applications running on the network through a plurality of mechanisms. The function may be provided in one or more devices of the network.

Device and related method for establishing network policy based on applications

The present invention provides method and systems for activating or deactivating network devices by managing the power of the network device. By controlling the power for network devices, the size and coverage of the network can be adjusted to meet the needs for the current usage. This can be particularly advantageous in wireless networks where multiple wireless access points may be provided to provide coverage during peak usage but present the additional security concern of the network being accessible to unauthorized users. Being able to power down unneeded wireless access points during off-peak usage allows for the minimization of such potential security concerns.

Power controlled network devices for security and power conservation

A function is provided in a network system for policy-based dynamic mirroring for network traffic. The function monitors events, topology and status of the network and installs, enables, selects or changes traffic mirrors associated with the operation of one or more devices of the network. The mirror policies are established based on network polices and/or rules. The mirror policies and the enablement, installation, selection or changing of them are based on multiple criteria. The function provides for the selection of traffic to mirror, how much of it to mirror, where to mirror it and when to stop the mirroring. The function may be established in network entry devices as well as core switching devices of the network. The function can select portals for the mirroring activity and can secure the mirroring.

Device and related method for dynamic traffic mirroring policy

A function is provided for identifying computer applications running on a network. Information obtained from frames having content associated with computer applications is examined and compared to information stored on the network. The stored information is obtained from a plurality of mechanisms including computer application signatures. An application identification engine of the function compares examined content with the known application information and determines an indication of the likely computer application associated with the examined frames. The determination output may include a level of confidence in the accuracy of the determination. The function includes an application programming interface to allow the introduction into the engine of custom mechanisms for application identification. The different mechanisms may be weighted. The function may be provided in one or more devices of the network including a standalone appliance.

Device and related method for application identification

A function is provided for effectively identifying computer applications running on a network. The function receives information related to frames of packets moving through the network. The information is compared to known information about computer applications. The known information is obtained from a plurality of mechanisms, including the option of obtaining it through custom mechanisms. The comparison information is scored for each of the plurality of mechanisms and those scores are combined to establish a single score indicative of the likely computer application associated with the received frames. One or more mathematical operations can be used to combine the scores. The mechanisms may be weighted for likely accuracy and the score that is established may include with it an indication of the level of confidence in that score. One or more of the plurality of mechanisms may be used to weight others of the types of mechanisms.

Device and related method for scoring applications running on a network

A network architecture system that expands the control network administrators have on existing networks. The system provides application identification and usage data by user, by device and network location. Dynamic traffic mirroring of the system allows for the efficient use of a tool to identify computer applications running on the network. The system includes the ability to embed the tool where needed rather than pervasively based on the use of the dynamic mirroring to bring the packets to the tool. The architecture implemented functions allow the ability to start small with a single application identification tool added to a network management server, examine flows from throughout the network (via mirroring) and upgrade policy control based on real application identification data and usage, then grow to pervasive deployment where virtually all new flows could be identified and controlled via policy. This architecture enables substantially complete application visibility and control.

System and related method for network monitoring and control based on applications

A request for network access is received from a client device at a network entry device of a network infrastructure. The network infrastructure determines a physical location of the client device and determines authorization of the client device based on the physical location. The approach can include providing the physical location along with other user credentials to an authorizing device. The method can also include determining a level of service based on the physical location. Communication for the approach can make use of the IEEE 802.1X protocol.

Location-based access control in a data network

Growing community of inventors

Derry, NH, United States of America

Richard W Graham