Aruba Networks, Inc.

Hewlett Packard Enterprise Development LP

Hewlett-Packard Development Company, L.p.

Santashil PalChaudhuri

Sandeep Unnimadhavan

Pradeep Iyer

Naveen Manjunath

Prateek Kapoor

Sudeepto Roy

Tilak Kumar Adhya

Sandip Kumar Devnath

Manoj Gupta

Brijesh Kumar Yadav

Rajalakshmi Manoharan

Shekhar Kshirsagar

Jagachittes Vadivelu

Manish Mehta

Amit Madan

Sandeep Yelburgi

Deepika Dwivedi

Joseph Garcia Baniqued

Partha Narasimhan

Gopalakrishna Raman

David Wilson

Ramprasad Vempati

Guojun Zhang

Anandakrishnan Viswanathan

Varaprasad Amaraneni

Herman Robers

Deepakparasar Avalur

Shanta Patil

Provisioning remote access points for use in a telecommunication network. A remote access point contains identity information established during manufacturing; this identity information may be in the nature of a digital certificate. The identity information is stored in the remote access point, and may be stored in a Trusted Platform Module if present. When the remote access node is powered up in unprovisioned state, outside the manufacturing environment, it attempts to establish an internet connection via a first wired interface, and queries a user for information representing the TCP/IP address of its controller via a second wired interface. Once an internet connection is present, and a TCP/IP address has been provided, the remote access point attempts to connect to the controller at that address. Once a connection is established, controller and access point exchange and verify each other's identities.

Provisioning remote access points

A network device may detect packets being transmitted on a network to obtain detected packets, identify Internet Protocol (IP) addresses corresponding to the detected packets, and identify candidate IP subnets that do not include any IP address in the IP addresses corresponding to the detected packets. A particular IP subnet may be selected from the set of candidate IP subnets for allocation to a set of target devices. A network device may identify a set of candidate Internet Protocol (IP) subnets, select a particular IP subnet from the set of candidate IP subnets, and transmit, to other network devices, an advertisement including an intent to use the particular IP subnet. Responsive to determining that none of the other network devices are using the particular IP subnet, the network device may select the particular IP subnet for allocating to a set of target devices.

Method to distribute a centralized service

The present disclosure relates to a network device that detects a deauthentication and/or disassociation attack in a wireless local area network (WLAN). In example implementations, the network device selects a random Media Access Control (MAC) address that is unused in the WLAN. The network device then transmits a request using the selected MAC address over a shared wireless communication channel. Next, the network device transmits a response using a MAC address corresponding to the network device over the shared wireless communication channel. Subsequently, the network device receives a disconnection request using the selected MAC address over the shared wireless communication channel. In response to receiving the disconnection request, the network device can detect an attacker device in the WLAN.

Detecting deauthentication and disassociation attack in wireless local area networks

The present disclosure discloses a system and method for classifying an application session for forwarding or refrain from forwarding to a client. Generally, classifying an application session includes: receiving a first request from a client device at a first network device; transmitting, by the first network device, a second request to obtain classification information corresponding to the first request; forwarding, by the first network device, the first request from the client device prior to receiving the classification information corresponding to the first request; receiving, by the first network device, the classification information corresponding to the first request; receiving, by the first network device, a first response corresponding to the forwarded first request; and based on the classification information, forwarding or refraining from forwarding the first response to the client device.

Leak-proof classification for an application session

Zero touch configuration support for a universal serial bus (USB) modem is described herein. For example, as described herein, an identifier of a modem connected to an access point may be determined. Location information corresponding to the access point may also be determined. Based on the identifier of the modem and the location information, the access point may select a particular configuration, for the modem, where the particular configuration is suitable for a geographical location associated with the location information.

Zero touch configuration support for universal serial bus modem on a network device

The present disclosure discloses a method and network device for providing VLAN mismatch detection in networks. Specifically, a network device monitors a plurality of packets received by a first device from a second device to identify a first set of VLAN identifiers indicated by at least one of the plurality of packets. The network device receives from a third device at least one packet tagged with a particular VLAN identifier, whereas the at least one packet to be forwarded by the first device to the second device. The network device then determines whether the particular VLAN identifier is included in the first set of VLAN identifiers indicated by at least one of the plurality of packets received by the first device from the second device. If the particular VLAN identifier is not included in the first set of VLAN identifiers, the network device presents a notification.

Virtual local area network mismatch detection in networks

The present disclosure discloses a network device and/or method for centralized configuration with dynamic distributed address management. The disclosed network device receives, at a first network node, a range of sub network addresses and a specified size for a sub network. The disclosed network device then divides the range of sub network addresses into a plurality of sub-ranges of sub network addresses based on the specified size. Further, the network device allocates the plurality of sub-ranges of sub network addresses to a plurality of sub networks, and transmits an allocated sub-range of sub network addresses to a corresponding sub network at a second network node through an established secure communication channel. Moreover, the network device can retrieve a profile template that includes the range of sub network addresses and the specified size of the sub network; and create a profile based on the profile template.

Centralized configuration with dynamic distributed address management

The present disclosure discloses a method and system for partitioning WLAN in order to separate network traffic from different WLANs. Specifically, a network device receives a packet from a client connected to a first network device on an access network. The network device then determines that the received packet is associated with a VLAN that is pre-configured on the first network device based on the access network to which the client is connected. Furthermore, the network device transmits the packet to a MAC layer switching device, which is not configured with the VLAN that is pre-configured on the network device. The packet includes one of a DHCP discovery message, an ARP request message, a unicast message, a multicast message, and a broadcast message. The unicast message will be transmitted to the second network device on the pre-configured VLAN prior to being transmitted to another network device outside the pre-configured VLAN.

Method and system for partitioning wireless local area network

The present disclosure discloses a method and a network device for efficient mobile client device roaming in a wireless local area network with multiple access points. Specifically, a network device determines a first received signal strength value for a first set of signals transmitted between a client device and a first access point during a first time period; and, determines a second received signal strength value for a second set of signals transmitted between a client device and the access point during a second time period. Based on the first and the second signal strength values, the network device computes a change in signal strength value corresponding to wireless communication between the client device and the first access point. Based on the change in signal strength value, the network device selects the access point from a plurality of access points for providing network access to the client device.

Efficient roaming of mobile clients

The present disclosure discloses a method and a system for determining whether to use a local authentication server. Specifically, a first network device executing a first authentication server receives a request for authentication from a client device. The first network device determines whether the client device was previously successfully authenticated by a second authentication server executing on a second network device within a particular period of time. If so, the first network device attempts to authenticate the client device using the first authentication server. Otherwise, the first network device declines the request for authentication from the client device.

Determining whether to use a local authentication server

A non-transitory computer readable medium includes computer readable program code including instructions for subsequent to a client device associating with an access point, receiving a request for a set of allowed shared devices, removing, by the access point and to obtain the set of allowed shared devices, a shared device from a set of shared devices based on a client device user of the client device failing to have a permission required by a device sharing policy of the shared device, and transmitting the set of allowed shared devices to the client device.

Method and system for controlling access to shared devices

A non-transitory computer readable medium includes instructions which, when executed by one or more network devices, causes performance of operations. The operations include sending, to shared devices, one or more status queries regarding one or more device conditions for each of the shared devices, obtaining responses to the one or more status queries from each of the plurality of shared devices, the responses including the one or more device conditions for each of the shared devices, filtering the shared devices based on the one or more device conditions to obtain a subset of the shared devices, identifying the subset of the shared devices as a set of available shared devices, and transmitting information identifying the set of available shared devices to a client device.

Method and system for network service health check and load balancing

Automatically configuring split DNS operation in a wireless network device connected to a network. The wireless network device snoops one or more exchanged DHCP messages to obtain domain name(s) associated with the organization that are now used as target domain name suffix(es) for split DNS operations. For subsequent DNS queries, information within the message is analyzed to determine if the request includes a domain delimiter. If no delimiter, the DNS query message is sent to an internal DNS server that is located within an organization. If a delimiter exists, but the domain name in the message matches one of the target domain name suffixes, the DNS query message is sent to the internal DNS server as well. Otherwise, the DNS query message is routed over a different communication path.

Growing community of inventors

West Bengal, India

Santashil PalChaudhuri