会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 3. 发明授权
    • System and method to process data packets in a network using stateful decision trees
    • 使用有状态决策树处理网络中数据包的系统和方法
    • US07813350B2
    • 2010-10-12
    • US11551932
    • 2006-10-23
    • Sumeet SinghGeorge VargheseFlavio Giovanni BonomiJonathan J. Chang
    • Sumeet SinghGeorge VargheseFlavio Giovanni BonomiJonathan J. Chang
    • H04L12/28
    • H04L47/10H04L43/50H04L45/742H04L45/745H04L47/22H04L47/2441H04L47/32
    • A method and device to process a packet received by a network device is described. The method may comprise analyzing the packet to identify at least one set of a plurality of sets, mapping the at least one set to at least one functional unit, and performing functionality associated with the at least one functional unit. Analyzing the packet to identify at least one of a plurality of sets may comprise determining when the packet includes at least one set identifier, and identifying the at least one set based on the at least one set identifier. A set status identifier may be defined for each set, the set status identifier indicating when set identifiers associated with a corresponding set are detected in the packet. The device may be a router, switch or any other device that processes digital data e.g., packet data including packets headers, payload or the like.
    • 描述了一种处理由网络设备接收的分组的方法和设备。 该方法可以包括分析分组以识别多个集合中的至少一个集合,将至少一个集合映射到至少一个功能单元,以及执行与至少一个功能单元相关联的功能。 分析分组以识别多个集合中的至少一个集合可以包括确定分组何时包括至少一个集合标识符,以及基于至少一个集合标识符来识别该至少一个集合。 可以为每个集合定义集合状态标识符,所设置的状态标识符指示何时在分组中检测到与对应集合相关联的集合标识符。 该设备可以是处理数字数据的路由器,交换机或任何其他设备,例如包括分组报头,有效载荷等的分组数据。
    • 5. 发明申请
    • Method and apparatus to process packets in a network
    • 在网络中处理数据包的方法和装置
    • US20060098687A1
    • 2006-05-11
    • US11271209
    • 2005-11-09
    • Sumeet SinghGeorge Varghese
    • Sumeet SinghGeorge Varghese
    • H04J3/16
    • H04L12/2854H04L69/22
    • A method and apparatus is described to process packets in a network. The method may comprise receiving the packet and determining a length K of the packet. If the length of the packet is less than a reference length M then no analysis may be performed on the packet. However, if the packet length K is not less than M, the method may determine if the packet length K is at least greater than a reference window size WRef. When the packet length is greater than WRef then a window size W for the processing of the packets is set equal to WRef; and the packet length is less than WRef then a window size W for the processing of the packets is set equal to the packet size K. Thereafter, the packet is processed using the window size W.
    • 描述了一种在网络中处理分组的方法和装置。 该方法可以包括接收分组并确定分组的长度K. 如果分组的长度小于参考长度M,则不能对分组执行分析。 然而,如果分组长度K不小于M,则该方法可以确定分组长度K是否至少大于参考窗口大小W ref。 当分组长度大于W 时,用于处理分组的窗口大小W被设置为等于W<< 并且分组长度小于W ,则用于处理分组的窗口大小W被设置为等于分组大小K.然后,使用窗口大小W处理分组。
    • 6. 发明申请
    • Detecting malicious attacks using network behavior and header analysis
    • 使用网络行为和标题分析来检测恶意攻击
    • US20060098585A1
    • 2006-05-11
    • US11271133
    • 2005-11-09
    • Sumeet SinghGeorge Varghese
    • Sumeet SinghGeorge Varghese
    • H04L12/26
    • H04L63/1416H04L69/22
    • A method and apparatus for detecting malicious attacks is described. The method may comprise obtaining routing information from a packet communicated via a network and maintaining a count of packets associated with a device associated with the routing information. For example, the routing information may a source or destination IP address, a port number, or any other routing information. The device may be classified as a potentially malicious device when the count exceeds a threshold. The count may be incremented when the TCP SYN flag is set and the TCP ACK flag is not set. An embodiment comprises obtaining a source hash of the source IP address and a destination hash of the destination IP address. Thereafter, the source hash and the destination hash may be mapped to multi stage filters. The device associated with the packet may then be selectively categorizing as a suspicious device.
    • 描述了用于检测恶意攻击的方法和装置。 该方法可以包括从经由网络传送的分组获取路由信息,并且维护与与路由信息相关联的设备相关联的分组的计数。 例如,路由信息可以是源或目的地IP地址,端口号或任何其他路由信息。 当计数超过阈值时,该设备可能被分类为潜在的恶意设备。 当TCP SYN标志置1且未设置TCP ACK标志时,计数可能会增加。 一个实施例包括获得源IP地址的源散列和目的地IP地址的目的地散列。 此后,源散列和目的地散列可以被映射到多级过滤器。 然后可以将与分组相关联的设备有选择地分类为可疑设备。
    • 8. 发明授权
    • Method and apparatus for dynamically controlling data routes through a
network
    • 用于通过网络动态控制数据路由的方法和装置
    • US5796966A
    • 1998-08-18
    • US850975
    • 1997-05-05
    • Robert SimcoeRobert E. ThomasGeorge Varghese
    • Robert SimcoeRobert E. ThomasGeorge Varghese
    • H04L12/18H04L12/935H04L12/937G06F13/00
    • H04L12/1881H04L49/254H04L49/30
    • A mechanism for operating a configurable switch to dynamically (i) route each of the data packets in an ordered string from a particular switch input port through a selected member output port of a hunt group; and (ii) route data packets which need not be transmitted in order from the input ports to available member output ports of the hunt group, as the members become available. A controller assigns each input port a service number, and directs member output ports to handle requests for ordered data packet transmissions from input ports with particular service numbers, such that the ordered transfers from an input port are handled by a single member of each group. The input port broadcasts, through the switch, a request to send ordered data packets through a particular hunt group and includes its service number in the request. The group member assigned to handle ordered transfers from the input port responds by identifying itself. Thereafter, the input port sends its ordered data packets to the identified member. Unordered data packets are queued and routed dynamically through the members of the group, as the members become available. In a local area network, data is sent from a source station to file servers using server group identifiers for multiple-route transfers or individual server identifiers for single-route transfers.
    • 一种用于操作可配置交换机的机制,用于动态地(i)将来自特定交换机输入端口的有序字符串中的每个数据分组路由到寻线组的所选成员输出端口; 以及(ii)当成员变得可用时,将从搜索组的输入端口到可用成员输出端口的顺序的数据包路由不需要传送。 控制器为每个输入端口分配服务号码,并​​指示成员输出端口处理来自具有特定服务号码的输入端口的有序数据分组传输的请求,使得来自输入端口的有序传输由每个组的单个成员处理。 输入端口通过交换机广播通过特定寻线组发送有序数据包的请求,并在请求中包括其服务号码。 分配给处理来自输入端口的有序传输的组成员通过识别自身进行响应。 此后,输入端口向已识别的成员发送其有序数据包。 随着成员可用,无序数据包将通过组的成员进行排队和路由。 在局域网中,使用用于多路由传输的服务器组标识符或单路传输的单个服务器标识符将数据从源站发送到文件服务器。
    • 9. 发明授权
    • Method and apparatus for rate based flow control
    • 用于基于速率的流量控制的方法和装置
    • US5455826A
    • 1995-10-03
    • US268076
    • 1994-06-28
    • Cuneyt M. OzverenGeorge Varghese
    • Cuneyt M. OzverenGeorge Varghese
    • H04L12/56H04L29/04
    • H04L12/5602H04L2012/5619H04L2012/5632H04L2012/5635H04L2012/5636
    • A flow control system is disclosed, for a transmitting node and a receiving node. The transmitting node and the receiving node are linked together through multiple connections or virtual circuits over a communications link. A flow control circuit in the transmitting node limits the amount of bandwidth used over each individual connection, and over all of the connections combined. In an example embodiment, a global counter is used to maintain the total amount of bandwidth consumed overall during a predetermined time period, and a global limit register limits the maximum amount of bandwidth allowed consumed by any single connection during the time period. When the global counter exceeds an upper threshold value, the global limit register is set to a minimum value representing the minimum amount of bandwidth guaranteed to each connection during the time period. If a connection transmits an amount of bandwidth greater than or equal to the value in the global limit register, further transmissions on that connection are disabled for the remainder of the current time period.
    • 公开了一种用于发射节点和接收节点的流控制系统。 发送节点和接收节点通过通信链路通过多个连接或虚拟电路链接在一起。 发送节点中的流量控制电路限制了在每个单独连接上使用的带宽量,并且限制了组合的所有连接。 在示例实施例中,使用全局计数器来维持在预定时间段内总体消耗的总带宽量,并且全局限制寄存器限制在该时间段期间由任何单个连接消耗的最大带宽量。 当全局计数器超过上限阈值时,全局限制寄存器被设置为表示在该时间段期间为每个连接保证的最小带宽量的最小值。 如果连接发送的带宽量大于或等于全局限制寄存器中的值,则该连接上的进一步传输将在当前时间段的剩余时间内被禁用。
    • 10. 发明授权
    • Synchronization mechanism for link state packet routing
    • 链路状态分组路由的同步机制
    • US5265092A
    • 1993-11-23
    • US853647
    • 1992-03-18
    • Stuart R. SolowayAnthony G. LauckGeorge Varghese
    • Stuart R. SolowayAnthony G. LauckGeorge Varghese
    • H04L12/56
    • H04L45/02H04L45/18
    • A method of providing loop free and shortest path routing of data packets in a network having a plurality of switches, routing messages for communicating network topology information between the switches, a plurality of links connecting the switches and a plurality of channels connecting the switches to the links. The loop free routing of data packets is achieved through modifications to known link state packet (LSP) routing protocols and permits each switch to inform adjacent switches in the network of the information in the switch's database used to compute forwarding tables. A switch uses a received LSP to compute a forwarding table and informs neighboring switches on attached links of the routing change. The switch discards any subsequent data packets whose path would be affected by the changed routing information. The discarding of data packets continues until the switch receives notification from each adjacent switch affected by the changed routing information that all affected routing paths have been recalculated and the forwarding table of each affected switch has been updated. Thus, while adjacent switches temporarily contain inconsistent LSP databases and possibly inconsistent forwarding tables, the looping of data packets is prevented. Shortest path routing for data packets from a source endnode to a destination endnode is achieved by assuring that the first switch to forward the packet is on the shortest path to the packet's destination endnode. A source endnode transmits a data packet with an appropriate destination header and the determination of the actual routing path is performed transparently to endnodes. A data packet reaches its destination endnode by following the shortest path possible based on the network topology as represented in the database of the first switch that forwards it.
    • 一种在具有多个交换机的网络中提供数据分组的无循环和最短路径路由的方法,用于在交换机之间传送网络拓扑信息的路由消息,连接交换机的多个链路和将交换机连接到 链接。 通过修改已知的链路状态分组(LSP)路由协议来实现数据分组的无循环路由,并允许每个交换机通知交换机用于计算转发表的数据库中的信息的网络中的相邻交换机。 交换机使用接收到的LSP来计算转发表,并通知相邻交换机对路由更改的附加链路。 交换机将丢弃其路由将被更改的路由信息​​影响的任何后续数据包。 丢弃数据包继续进行,直到交换机接收到受改变的路由信息​​影响的每个相邻交换机的通知,所有受影响的路由路径已被重新计算,并且每个受影响的交换机的转发表已被更新。 因此,相邻交换机临时包含不一致的LSP数据库和可能不一致的转发表,防止了数据包的循环。 通过确保转发数据包的第一个交换机位于分组目的地节点的最短路径上,实现从源节点到目标节点的数据包的最短路径路由。 源端节点发送具有适当目的地头部的数据分组,并且实际路由路径的确定对端点进行透明化。 数据包通过遵循可转发的第一个交换机的数据库中基于网络拓扑的最短路径到达目的地节点。