TL;DR: In this article, a flexible, policy-based, mechanism for managing, monitoring, and prioritizing traffic within a network and allocating bandwidth to achieve true quality of service (QoS) is provided.
Abstract: A flexible, policy-based, mechanism for managing, monitoring, and prioritizing traffic within a network and allocating bandwidth to achieve true quality of service (QoS) is provided. According to one aspect of the present invention, a method is provided for managing bandwidth allocation in a network that employs a non-deterministic access protocol, such as an Ethernet network. A packet forwarding device receives information indicative of a set of traffic groups, such as: a MAC address, or IEEE 802.1p priority indicator or 802.1Q frame tag, if the QoS policy is based upon individual station applications; or a physical port if the QoS policy is based purely upon topology. The packet forwarding device additionally receives bandwidth parameters corresponding to the traffic groups. After receiving a packet associated with one of the traffic groups on a first port, the packet forwarding device schedules the packet for transmission from a second port based upon bandwidth parameters corresponding to the traffic group with which the packet is associated. According to another aspect of the present invention, a method is provided for managing bandwidth allocation in a packet forwarding device. The packet forwarding device receives information indicative of a set of traffic groups. The packet forwarding device additionally receives information defining a QoS policy for the traffic groups. After a packet is received by the packet forwarding device, a traffic group with which the packet is associated is identified. Subsequently, rather than relying on an end-to-end signaling protocol for scheduling, the packet is scheduled for transmission based upon the QoS policy for the identified traffic group.
TL;DR: In this paper, a set of security rules are defined in a high level form and translated into a packet filter code, which is loaded into packet filter modules located in strategic points in the network.
Abstract: A filter module allows controlling network security by specifying security rules for traffic in the network and accepting or dropping communication packets according to these security rules. A set of security rules are defined in a high level form and are translated into a packet filter code. The packet filter code is loaded into packet filter modules located in strategic points in the network. Each packet transmitted or received at these locations is inspected by performing the instructions in the packet filter code. The result of the packet filter code operation decides whether to accept (pass) or reject (drop) the packet, disallowing the communication attempt.
TL;DR: In this article, a monitor for and a method of examining packets passing through a connection point on a computer network is presented. The method includes receiving a packet from a packet acquisition device and performing parsing/extraction operations on the packet to create a parser record comprising a function of selected portions of the packet.
Abstract: A monitor for and a method of examining packets passing through a connection point on a computer network. Each packets conforms to one or more protocols. The method includes receiving a packet from a packet acquisition device and performing one or more parsing/extraction operations on the packet to create a parser record comprising a function of selected portions of the packet. The parsing/extraction operations depend on one or more of the protocols to which the packet conforms. The method further includes looking up a flow-entry database containing flow-entries for previously encountered conversational flows. The lookup uses the selected packet portions and determining if the packet is of an existing flow. If the packet is of an existing flow, the method classifies the packet as belonging to the found existing flow, and if the packet is of a new flow, the method stores a new flow-entry for the new flow in the flow-entry database, including identifying information for future packets to be identified with the new flow-entry. For the packet of an existing flow, the method updates the flow-entry of the existing flow. Such updating may include storing one or more statistical measures. Any stage of a flow, state is maintained, and the method performs any state processing for an identified state to further the process of identifying the flow. The method thus examines each and every packet passing through the connection point in real time until the application program associated with the conversational flow is determined.
TL;DR: A nonblocking, self-routing copy network with constant latency is proposed, capable of packet replications and switching, which is usually a serial combinations of a copy network and a point-to-point switch.
Abstract: In addition to handling point-to-point connections, a broadband packet network should be able to provide multipoint communications that are required by a wide range of applications. The essential component to enhance the connection capability of a packet network is a multicast packet switch, capable of packet replications and switching, which is usually a serial combinations of a copy network and a point-to-point switch. The copy network replicates input packets from various sources simultaneously, after which copies of broadcast packets are routed to their final destination by the switch. A nonblocking, self-routing copy network with constant latency is proposed. Packet replications are accomplished by an encoding process and a decoding process. The encoding process transforms the set of copy numbers, specified in the headers of incoming packets, into a set of monotone address intervals which form new packet headers. The decoding process performs the packet replication according to the Boolean interval splitting algorithm through the broadcast banyan network, the decision making is based on a two-bit header information. This yields minimum complexity in the switch nodes. >
TL;DR: In this article, a system and method for facilitating packet transformation of multi-protocol, multi-flow, streaming data is presented, where packet portions subject to change are temporarily stored, and acted upon through processing of protocoldependent instructions, resulting in a protocol-dependent modification of the temporarily stored packet information.
Abstract: A system and method for facilitating packet transformation of multi-protocol, multi-flow, streaming data. Packet portions subject to change are temporarily stored, and acted upon through processing of protocol-dependent instructions, resulting in a protocol-dependent modification of the temporarily stored packet information. Validity tags are associated with different segments of the temporarily-stored packet, where the state of each tag determines whether its corresponding packet segment will form part of the resulting modified packet. Only those packet segments identified as being part of the resulting modified packet are reassembled prior to dispatch of the packet.