Cisco Technology, Inc.

Tzu-Ming Tsang

Louis F Menditto

Mark Albert

Chris O'Rourke

Pranav Kumar Tiwari

Richard A Howes

Edward A Kersey

James A Jordan

Robert Michael Batz

William Monte LeBlanc

Jacob Mark McGuire

Richard Gray

Barron Cornelius Housel, Iii

Walter Glenn Dixon

Pranav Tiwari

Gaurang Shah

Robert A Mackie

Michael Sutton

Bhagatram Yaugand Janarthanan

Jan Vilhuber

Bruce F Wong

Scott W Brim

Mauro Zallocco

Anurag Bhargava

Imnaz Meher Jilani

Sean W Hull

Shannon Nix

Richard Mandfred Pruss

Edward Curt Kersey

Wayne Roiger

Ravishankar Chandrasekaran

Wai-tak Siu

James A Jordon

Pranav K Tiwari

Michael S Sutton

Richard L Gray

A data flow is received at a network processor that includes a plurality of frames. A first set of frames in the plurality of frames are passed from the network processor to a general processor for processing by the general processor. A flow acceleration request is received at the network processor from the general processor based at least in part on inspection of a first frame in the first set of frames. The flow acceleration request is received subsequent to passing at least two of the first set of frames to the general processor. A particular frame in the plurality of frames received subsequent to the first set of frames is processed by the network processor such that it is accelerated relative to processing of the first set of frames by the general processor and bypasses the general processor.

Selective packet sequence acceleration in a network environment

Techniques for separately accounting for multiple transactions in the same data packets communicated over a network using Transport Control Protocol (TCP) include receiving an Internet Protocol (IP) data packet that includes Transport Control Protocol (TCP) payload data. The TCP payload is parsed to determine boundary data that indicates a byte location on a boundary between a first transaction and a second transaction. A byte count that indicates a number of bytes in the TCP payload associated with the first transaction is determined based on the boundary data. Accounting data for the first transaction is determined based at least in part on the byte count. These techniques allow a service gateway to bill separately for different requests and responses carried in TCP data packets, such as those for Hypertext Transfer Protocol (HTTP) and Real Time Streaming Protocol (RTSP).

Techniques for accounting for multiple transactions in a transport control protocol (TCP) payload

At least one first frame of a first data flow is inspected by a general processing unit to at least determine whether a subsequent portion of the first data flow can be delegated to a network processing unit for accelerated processing. A deceleration trigger is defined for the first data flow from the inspection of the first frame. A first subsequent portion of the first data flow is delegated to a network processing unit for accelerated processing based, at least in part, on the defining of the first deceleration trigger. The first deceleration trigger defines at least one first condition that, when met during accelerated processing of the first data flow, prompts returning processing of the first data flow from the network processing unit to the general processing unit for further inspection of subsequent packets.

At least one first frame of a first data flow can be received and passed to a general processor to inspect the at least one first frame. A flow acceleration request can be received including a set of conditions for accelerated processing, by a network processor, of a set of frames in the first data flow subsequent to the at least one first frame. At least one subsequent frame in the set of frames can be processed, using the network processor, in connection with forwarding of the subsequent frame to at least one remote network node, where processing of the subsequent frame is accelerated relative to processing of the at least one first frame and based, at least in part, on the set of conditions included in the flow acceleration request.

Resolving a Layer 3 address includes maintaining an address resolution table at each slave processor of a number of slave processors. The slave processors have a master processor, and the master processor and the slave processors are associated with a unified address. An address resolution table includes one or more Layer 2-Layer 3 address mappings. An address resolution request requesting a Layer 2 address corresponding to a Layer 3 address is sent from a slave processor. The address resolution request uses the unified address. An address resolution response comprising the Layer 2 address is received at the master processor. The master processor sends the response to the slaves.

Resolving a layer 3 address in a processor system with a unified IP presence

A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

Method for protecting a firewall load balancer from a denial of service attack

A system and method are disclosed for providing a network service. A first criteria specifying a first set of flows from a first service manager is received at a forwarding agent. The first criteria specifies an expiration time interval. The first criteria is stored on the forwarding agent. A second criteria is received that specifies a second set of flows from a second service manager at the forwarding agent. The second set of flows includes flows that are in the first set of flows and the second criteria is designated as a lower priority criteria. The second criteria is stored on the forwarding agent. The first criteria is deleted from the forwarding agent upon the expiration of the expiration time interval. A packet is received that belongs to a flow that is included in the first set and the second set. It is determined that the packet matches the second set ant the packet is forwarded to the second service manager.

Backup service managers for providing reliable network services in a distributed environment

An information service provider network includes a content gateway to process requests for information from a client terminal. The content gateway includes a router for receiving a request for information from the client terminal. The request includes a domain name and additional content. The router forwards the request according to the domain name to a selected one of a plurality of processors to further process the request. The selected one of the plurality of processors identifies an information source to satisfy the request in response to the additional content of the request.

System and method for processing a request for information in a network

A forwarding agent is implemented on a router. The forwarding agent receives instructions from a service manager for redirecting packets that match the instructions. A packet is received that matches the instructions and the packet is redirected according to the instructions.

Distributed, rule based packet redirection

A system and method are described for selecting a server to handle a connection. The method includes receiving at a service manager a connection request intercepted by a network device having a forwarding agent that is operative to receive instructions from a service manager, the connection request having been forwarded from the forwarding agent on the network device to the service manager. A preferred server is selected at the service manager from among a group of available servers. The preferred server is the server that is to service the connection request. Instructions are sent from the service manager to the forwarding agent. The instructions include the preferred server that is to service the connection request so that the connection request may be forwarded from the network device to the preferred server.

Load balancing using distributed forwarding agents with application based feedback for different virtual machines

Mechanisms and techniques provide a method for routing a packet that includes a content request and an Internet Protocol address and port number that identify a source transmitting the packet. The method relates to selecting a routing policy to forward the packet, based upon at least a portion of content request. The method includes a data communications device receiving a packet having a content request and an Internet Protocol address and port number that identify a source transmitting the packet. The device performs a network address translation, based upon at least a portion of the content request, to translate the Internet Protocol address and port number of the packet to a respective communications device Internet Protocol address and communications device port number. The device then selects a routing policy based upon the communications device Internet Protocol address and routes the packet to a destination according to the routing policy.

Methods and apparatus for routing a content request

A network includes a service selection gateway that receives information from a network user having a network locator address in order to establish a communications session and an identity of the network user. A client service gateway can receive a request from the network user upon establishment of the communications session. In response to the request, the client service gateway determines if there is an association in a local memory for the network locator address and an identity of the network user, obtains additional information associated with the network user, and processes the request according to the additional information. If an association is not stored in the local memory, the client service gateway sends a query for the identity of the network user to the service selection gateway.

Growing community of inventors

Chapel Hill, NC, United States of America

Tzu-Ming Tsang