Juniper Networks, Inc.

Crossbeam Systems, Inc.

Akamai Technologies, Inc.

Blue Coat Systems, Inc.

Verivue, Inc.

Weidong Xu

Craig R Frink

Paul S Gallo

Yevgeny Korsunsky

Moisey Akerman

Charles Ching Lee

Stephen D Justus

Harsh Kapoor

Chunsheng Fu

Anurag P Gupta

Santosh Krishnan

Steve Branam

Michael G Hluchyj

Timothy M Martin

Harshad B Agashe

Qin-Fan Zhu

John C Ferguson

Jc Ferguson

Thomas Radogna

Monte Becker

Shirish B Dandekar

Daniel Pond

Jean Zhou

Yongseok Yi

A network device may receive packets and may calculate, during a time interval, an arrival rate and a departure rate, of the packets, at one of multiple virtual output queues. The network device may calculate a current oversubscription factor based on the arrival rate and the departure rate, and may calculate a target oversubscription factor based on an average of previous oversubscription factors associated with the multiple virtual output queues. The network device may determine whether a difference exists between the target oversubscription factor and the current oversubscription factor and may calculate, when the difference exists, a scale factor based on the current oversubscription factor and the target oversubscription factor. The network device may calculate new scheduling weights based on prior scheduling weights and the scale factor, and may process packets received by the multiple virtual output queues based on the new scheduling weights.

Determining rate differential weighted fair output queue scheduling for a network device

An apparatus for switching network traffic includes an ingress packet forwarding engine and an egress packet forwarding engine. The ingress packet forwarding engine is configured to determine, in response to receiving a network packet, an egress packet forwarding engine for outputting the network packet and enqueue the network packet in a virtual output queue. The egress packet forwarding engine is configured to output, in response to a first scheduling event and to the ingress packet forwarding engine, information indicating the network packet in the virtual output queue and that the network packet is to be enqueued at an output queue for an output port of the egress packet forwarding engine. The ingress packet forwarding engine is further configured to dequeue, in response to receiving the information, the network packet from the virtual output queue and enqueue the network packet to the output queue.

Combined input and output queue for packet forwarding in network devices

A network device may receive one or more packets, and may determine a flow control parameter, a rate limiting parameter, and a statistical sampling parameter associated with a slow counter. The network device may determine whether the flow control parameter satisfies a first threshold, whether the rate limiting parameter satisfies a second threshold, and whether the statistical sampling parameter satisfies a third threshold. The network device may identify a counter event associated with one of the one or more packets, and may selectively assign the counter event to a fast counter when at least one of the first threshold, the second threshold, or the third threshold being satisfied, or to the slow counter when none of the first threshold, the second threshold, and the third threshold being satisfied.

Determining network device statistics associated with fast counters and slow counters

A flow processing facility, which uses a set of artificial neurons for pattern recognition, such as a self-organizing map, in order to provide security and protection to a computer or computer system supports unified threat management based at least in part on patterns relevant to a variety of types of threats that relate to computer systems, including computer networks. Flow processing for switching, security, and other network applications, including a facility that processes a data flow to address patterns relevant to a variety of conditions are directed at internal network security, virtualization, and web connection security. A flow processing facility for inspecting payloads of network traffic packets detects security threats and intrusions across accessible layers of the IP-stack by applying content matching and behavioral anomaly detection techniques based on regular expression matching and self-organizing maps. Exposing threats and intrusions within packet payload at or near real-time rates enhances network security from both external and internal sources while ensuring security policy is rigorously applied to data and system resources. Intrusion Detection and Protection (IDP) is provided by a flow processing facility that processes a data flow to address patterns relevant to a variety of types of network and data integrity threats that relate to computer systems, including computer networks.

Systems and methods for processing data flows

Described are computer-based methods and apparatuses, including computer program products, for efficiently storing transport streams. A first sequence of one or more packets associated with the first transport stream is received, the first sequence comprising one or more data packets. A storage packet is generated by selecting one or more packets from the first sequence, the storage packet comprising a packet header and the one or more data packets. One or more null packet insertion locations are identified in a second sequence of one or more packets associated with a second transport stream. Null packet insertion information is generated based on the one or more null packet insertion locations, the information including data indicative of a reconstruction parameter related to reconstructing the second sequence from the storage packet by inserting one or more null packets that are not stored in the storage packet, wherein the packet header includes the null packet insertion information. The storage packet is stored.

Efficiently storing transport streams

Described are computer-based methods and apparatuses, including computer program products, for scalable seamless digital video stream splicing. Data packets in a first video stream of bits are rearranged. Placeholder packets are created in a second video stream of bits. The first video stream of bits and the second video stream of bits are combined to generate a spliced stream by inserting data packets from the first video stream of bits into the placeholder packets in the second video stream of bits.

Scalable seamless digital video stream splicing

Described are computer-based methods and apparatuses, including computer program products, for input queued content switching using a playlist. A retrieval sequence is generated using a plurality of content requests based on content location information. A first portion of content is requested to be queued at a first content source, and a second portion of content is requested to be queued at a second content source. A content stream of the first portion and the second portion of content is generated using the retrieval sequence. The generating includes selecting the first portion of content from a queue associated with the first content source and transferring the first portion of content to an output buffer, then terminating transfer of the first portion of content and initiating transfer of the second portion of content from a queue associated with the second content source. The portion of content in the output buffer is transmitted to a client device.

Input queued content switching using a playlist

Described are computer-based methods and apparatuses, including computer program products, for canonical scheduling for heterogeneous content delivery. A content stream of bits is preprocessed by dividing the content stream of bits into data packets and assigning a timestamp to each data packet. The preprocessed content stream of bits is transmitted upon request from a receiver. A second timestamp based on the assigned timestamp from at least a portion of the respective data packets is established. The data packets are scheduled for transmission based on the second timestamp. The data packets are transmitted based on the schedule.

Canonical scheduling for heterogeneous content delivery

Methods and systems for flow processing and switching, security, and other network applications, including a facility that processes a data flow to address patterns relevant to a variety of conditions are directed at internal network security, virtualization, and web connection security are described. Such flow processing facilities may be used for inspecting network traffic packet payloads to detect security threats and intrusions across accessible layers of the network IP stack by applying content matching and behavioral anomaly detection techniques based on regular expression matching and self-organizing maps. Exposing threats and intrusions within packet payload at or near real-time rates enhances network security from both external and internal sources while ensuring security policy is rigorously applied to data and system resources.

Growing community of inventors

Westford, MA, United States of America

Weidong Xu