3com Corporation

Utstarcom, Incorporated

3 Com Corporation

Satish Amara

Michael Freed

Boby Joseph

Michael S Borella

Rajesh Ramankutty

Sanil Kumar Puthiyandyil

Shaji Radhakrishnan

Chandra Warrier

Ching Kung

Madhvi Verma

Methods and a device for changing the message size broadcast over a network and furthermore preventing fragmentation in networks are provided. The device intercepts a message transported across a network, wherein the message is sent from a data source to a data receiver and changes the message size. In addition, the device may use the methods to change the message size of data transmitted over a network thus reducing fragmentation. As a result, network devices such as classifiers preferably avoid re-assembling fragments. More specifically by reducing re-assembling, network devices like a classifier can react more quickly to applications requiring information found in both of an IP and TCP/UDP header.

Methods and device for managing message size transmitted over a network

A system for load balancing, the system includes a LAC, a contact LNS, and a plurality of load balancing LNSs. The LAC includes a contact LNS address, the contact LNS address specifies the address of a contact LNS. The contact LNS is communicatively coupled to the LAC and the plurality of load balancing LNSs are communicatively coupled to the contact LNS and to the LAC. The LAC sends a message to the contact LNS, the message informing the LAC of its availability and the contact LNS sends a response message containing IP address of a selected one of the plurality of load balancing LNSs to which the LAC should establish a session.

Load balancing between LNSs using virtual LNS with minimal LAC configuration

A system and methods are shown for traffic shaping and congestion avoidance in a computer network such as a data-over-cable network. A headend of the data-over-cable system includes a traffic shaper configured to calculate a packet arrival rate from a cable modem and a traffic conditioner configured to calculate an average queue size on an output interface to an external network. For example, the traffic shaper compares the packet arrival rate to three packet arrival thresholds including a committed rate threshold, a control rate threshold and a peak rate threshold. If the calculated packet arrival rate falls between the committed threshold and control rate threshold, the traffic shaper applies a link layer mechanism, such as a MAP bandwidth allocation mechanism, to lower the transmission rate from the cable modem.

System and method for traffic shaping based on generalized congestion and flow control

A system and methods for providing distributed and dynamic network services to remote access users. One of the methods includes providing a first certificate for requesting dynamic network services by a user network entity, and at least one second certificate for requesting static network services by the user network entity. According to one method, a user of the user network entity may generate a first message to request dynamic network services from a network service provider entity. For example, the first message may include the first certificate, a digital signature generated with a private encryption key associated with the first certificate and list of network service that the user wishes to set up dynamically. In one embodiment, when the network service provider entity receives the first message, the network service provider entity verifies the authenticity of the first certificate and, if the first certificate is authentic, the network service provider entity configures a network connection between the user network entity and a data network based on the network services requested by the user in the first message.

System and method for providing distributed and dynamic network services for remote access server users

A system and method for transmitting information between a source host and a destination host. A source host generates a message and forwards the message via a label switched path to the destination host so that when a central routing module receives the message, the message includes a label. A central routing module establishes a local master mapping table including a plurality of physical addresses, and each of the plurality of physical addresses is associated with a unique identifier such as a label. When a switch egress module receives the message with the label, the switch egress module determines a physical address associated with the label, maps the physical address to the message, and forwards the message to the destination host associated with the label.

System and method for providing masquerading using a multiprotocol label switching

An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.

System and method for using virtual local area network tags with a virtual private network

A method for determining the validity of an n-dimensional policy table in a router. The router may include a processor, a memory (e.g. ROM, flash memory, non-volatile memory, hard disk, etc.), and two or more policy rules stored in the memory. Each policy rule may have one or more dimensions (or parameters), designated generally by the symbol n. In accord with the method, the processor may make a determination whether any particular policy rule in the table intersects any subsequent policy rule in the table in every dimension n. If no rules in the table intersect in every dimension n, then the policy table is valid, and the router may operate normally.

Packet filter policy verification system

A system and method for processing packets of information includes an ingress module. The ingress module receives a plurality of packets of information from a first network. The ingress module determines the type of each of the plurality of packets. A route server module is coupled to the ingress module. The route server module sends a distributed processing request to the ingress module. The ingress module receives the distributed processing request and, responsively, performs a first set of processing operations on selected ones of the plurality of packets. The selected ones of the plurality of packets are of a first type. The ingress module forwards others of the plurality of packets of information to the route server module. Each of the others of the plurality of packets are of a type distinct from the first type. The route server module receives the others of the plurality of packets of information and performs a second set of processing operations on the others of the plurality of packets of information.

Distributed MPLS architecture

A method and apparatus for avoiding network congestion. An exemplary packet forwarding device may apply policy rules to incoming packets to assign relative drop probabilities to the packets based on the priority of the packets. In times of network congestion, packets may be selectively dropped according to their associated drop probability.

Policy-based weighted random early detection method for avoiding congestion in internet traffic

A mobile node may roam away from its home network to a foreign network. The mobile node may communicate using the Mobile Internet Protocol, and it may use Internet Protocol security to communicate with its home network. A foreign agent on the foreign network and a home agent on the home network may dynamically link a policy to be used for a Internet Protocol security session between the foreign agent and the home agent. The foreign agent and the home agent may dynamically create a filter to be used for the Internet Protocol Security session.

Method to provide dynamic internet protocol security policy service

A packet-forwarding device for providing policy-based services has at least a first interface, a second interface, and a packet forwarder for forwarding external packets between the first and second interfaces. The packet-forwarding device also runs internal applications that may be remotely accessed. The first and second interfaces transmit and receive internal and external packets, the internal packets being those packets generated or received by the internal applications during remote access, and the external packets being those packets destined for devices other than the packet-forwarding device. The packet forwarder forwards external packets between the first and second interfaces. An internal interface forwards internal packets between the internal applications and the first and second interfaces, and a policy engine logically connected to the internal interface applies a policy to the internal packets.

Growing community of inventors

Mount Prospect, IL, United States of America

Satish Amara