专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US06854063B1 Method and apparatus for optimizing firewall processing 有权
标题翻译：优化防火墙处理的方法和装置
公开(公告)号：US06854063B1
公开(公告)日：2005-02-08
申请号：US09517961
申请日：2000-03-03
申请人： Diheng Qu , Kevin Li , Sami Boutros , Seren Fan , Steve Truong
发明人： Diheng Qu , Kevin Li , Sami Boutros , Seren Fan , Steve Truong
IPC分类号： H04L29/06 , G06F15/173 , G06F15/177 , H04L9/00 , H04L12/28 , H04L12/56
CPC分类号： H04L63/0245 , H04L63/0254 , H04L63/101
摘要： A firewall system and method which optimizes the performance of the firewall process by reducing overhead associated with ACL verification and firewall application-level authorization. The firewall system comprises a session manager operating in the firewall services component and a firewall module operating in the switching process component. In one embodiment, the firewall module is configured to provide certain “non-application” level inspection of data packets and update the context of “sessions” associated with the data packets without sending the packets to the firewall services component using session information provided by the session manager.
摘要翻译：防火墙系统和方法，通过减少与ACL验证和防火墙应用级授权相关的开销来优化防火墙进程的性能。防火墙系统包括在防火墙服务组件中操作的会话管理器和在切换过程组件中操作的防火墙模块。在一个实施例中，防火墙模块被配置为提供数据分组的某些“非应用”级别检查，并且更新与数据分组相关联的“会话”的上下文，而不会使用由所述数据分组提供的会话信息将分组发送到防火墙服务组件会话经理。

2. 发明授权

US09094344B2 Establishing a bidirectional forwarding detection (BFD) asynchronous mode session without knowing a Prior layer-2 or layer-3 information 有权
标题翻译：建立双向转发检测（BFD）异步模式会话，不知道第2层或第3层信息
公开(公告)号：US09094344B2
公开(公告)日：2015-07-28
申请号：US13234331
申请日：2011-09-16
申请人： Sami Boutros , George Leonard Swallow , Nobushige Akiya
发明人： Sami Boutros , George Leonard Swallow , Nobushige Akiya
IPC分类号： H04L12/26 , H04L12/721 , H04L12/931 , H04L12/935
CPC分类号： H04L45/66 , H04L49/3054 , H04L49/351
摘要： In one embodiment, a Bidirectional Forwarding Detection (BFD) asynchronous mode session is established between two packet switching devices interconnected by one or more physical links. Prior to L2 or L3 services being established, each of these packet switching devices does not know the Media Access Control (MAC) nor Internet Protocol (IP) addresses of each interface of the other packet switching device that is connected to one of these link(s). A request to establish a BFD session is sent from one packet switching device to the other, with a MAC frame including the request being addressed to a group, broadcast, or other address that the receiving packet switching device will recognize and thus process the received request. Based on information contained in this received MAC frame, the receiving packet switching device has the information it needs, and sends a BFD control frame to the other packet switching device.
摘要翻译：在一个实施例中，通过一个或多个物理链路互连的两个分组交换设备之间建立双向转发检测（BFD）异步模式会话。在建立L2或L3服务之前，这些分组交换设备中的每一个不知道连接到这些链路之一的另一分组交换设备的每个接口的媒体接入控制（MAC）或互联网协议（IP）地址 s）。将建立BFD会话的请求从一个分组交换设备发送到另一个分组交换设备，其中MAC帧包括寻址到接收分组交换设备将识别的组，广播或其他地址的请求，从而处理接收到的请求。根据接收的MAC帧中包含的信息，接收分组交换装置具有需要的信息，向另一个分组交换装置发送BFD控制帧。

3. 发明授权

US08467403B2 Coordinated updating of forwarding information bases in a multistage packet switching device 有权
标题翻译：协调更新多级分组交换设备中的转发信息库
公开(公告)号：US08467403B2
公开(公告)日：2013-06-18
申请号：US12769946
申请日：2010-04-29
申请人： Yuri Tsier , Parag Kumar Jain , Clarence Filsfils , Sami Boutros , John H. W. Bettink
发明人： Yuri Tsier , Parag Kumar Jain , Clarence Filsfils , Sami Boutros , John H. W. Bettink
IPC分类号： H04L12/28
CPC分类号： H04L45/00 , H04L45/02 , H04L49/253 , H04L49/3009
摘要： Disclosed are, inter alia, methods, apparatus, computer-storage media, mechanisms, and means associated with the coordinated updating of forwarding information bases (FIBs) in a multistage packet switching device, which performs at least lookup operations on multiple different FIBs in determining how to forward a packet. One embodiment uses lookup operations on two different FIBs, with these being an ingress FIB on an ingress line card and an egress FIB on an egress line card. In response to a change in the forwarding information for a stream of packets, the egress FIBs are first updated to include both the old and new forwarding information. After all egress FIBs have been updated, the ingress FIBs are updated to use the new forwarding information. This update procedure is designed to eliminate loss or duplication of packets induced during the updating of these FIBs to use the new forwarding information.
摘要翻译：公开了尤其涉及在多级分组交换设备中与转发信息库（FIB）的协调更新相关联的方法，装置，计算机存储介质，机制和装置，其在多个不同的FIB中执行至少查找操作来确定如何转发数据包。一个实施例对两个不同的FIB进行查找操作，这些FIB是入口线卡上的入口FIB和出口线卡上的出口FIB。响应于分组流的转发信息的改变，首先更新出口FIB以包括旧的和新的转发信息。在所有出口FIB已被更新之后，入口FIB被更新以使用新的转发信息。该更新过程旨在消除在更新这些FIB期间引起的分组丢失或重复以使用新的转发信息。

4. 发明申请

US20110280121A1 SYSTEM AND METHOD FOR SUMMARIZING ALARM INDICATIONS IN A NETWORK ENVIRONMENT 有权
标题翻译：在网络环境中总结报警指示的系统和方法
公开(公告)号：US20110280121A1
公开(公告)日：2011-11-17
申请号：US12778871
申请日：2010-05-12
申请人： Sami Boutros , Nagi Reddy Jonnala , Muthurajah Sivabalan , George Swallow , David D. Ward
发明人： Sami Boutros , Nagi Reddy Jonnala , Muthurajah Sivabalan , George Swallow , David D. Ward
IPC分类号： H04L12/24 , H04L12/26
CPC分类号： H04L41/0677
摘要： An example method includes detecting a failure at a first network element, the failure is associated with a link between the first network element and a second network element. The method also includes generating a list of network elements to be notified based on the failure, the second network element is included on the list. The method further includes generating an alarm indication signal (AIS) message, the AIS message identifies a plurality of tunnels affected by the failure. The AIS message is communicated to the second network element. In more detailed embodiments, each link between the first network element and the second network element includes a globally unique link identifier, which includes an associated autonomous system number. The globally unique link identifier can represent a string to be associated with the plurality of tunnels, the globally unique link identifier includes a source address and a destination address.
摘要翻译：示例性方法包括检测第一网络元件的故障，故障与第一网络元件和第二网络元件之间的链路相关联。该方法还包括基于故障生成要通知的网元的列表，第二网元包括在列表中。该方法还包括生成报警指示信号（AIS）消息，AIS消息识别受故障影响的多个隧道。 AIS消息被传送到第二网元。在更详细的实施例中，第一网络元件和第二网络元件之间的每个链路包括全球唯一链接标识符，其包括相关联的自主系统号码。全球唯一的链路标识符可以表示要与多个隧道相关联的字符串，全球唯一的链路标识符包括源地址和目的地址。

5. 发明授权

US08908527B2 Using context labels to scale MAC tables on computer network edge devices 有权
标题翻译：使用上下文标签缩放计算机网络边缘设备上的MAC表
公开(公告)号：US08908527B2
公开(公告)日：2014-12-09
申请号：US13018125
申请日：2011-01-31
申请人： Sami Boutros , Yuri Tsier , Muthurajah Sivabalan , Pradosh Mohapatra , Clarence Filsfils , John H. W. Bettink , Luca Martini
发明人： Sami Boutros , Yuri Tsier , Muthurajah Sivabalan , Pradosh Mohapatra , Clarence Filsfils , John H. W. Bettink , Luca Martini
IPC分类号： G01R31/08 , G06F11/00 , G08C15/00 , H04J1/16 , H04J3/14 , H04L1/00 , H04L12/26
CPC分类号： H04L45/502 , H04L12/18 , H04L45/04
摘要： In one embodiment, an access component of a local network edge device receives traffic, and generates a frame for the traffic that includes a remote context label that identifies an access component of the remote network edge device to which the traffic is to be forwarded upon arrival at the remote network edge device, and a virtual circuit label corresponding to a particular virtual service of the traffic. The local network edge device forwards the frame towards the remote network edge device. In another embodiment, the frame may be received at a core component of the remote network edge device, an in response to the remote context label identifying an access component of the remote network edge device, forwarded to the access component, which determines the particular virtual service, and forwards the traffic from the frame out the access component towards an endpoint for the traffic.
摘要翻译：在一个实施例中，本地网络边缘设备的接入组件接收业务，并且生成包括远程上下文标签的业务的帧，所述远程上下文标签识别到达所述业务将被转发到的远程网络边缘设备的接入组件在远程网络边缘设备处，以及对应于业务的特定虚拟服务的虚拟电路标签。本地网络边缘设备将帧转发到远程网络边缘设备。在另一个实施例中，可以在远程网络边缘设备的核心组件处接收帧，响应于远程上下文标签识别远程网络边缘设备的接入组件，转发到接入组件，其确定特定虚拟服务，并将来自帧的流量从访问组件转发到流量的端点。

6. 发明授权

US08908517B2 Traffic distribution across a plurality of attachment circuits of a multihome site with a computer network using hashing algorithm 有权
标题翻译：通过计算机网络使用散列算法在多个站点的多个连接电路之间的流量分配
公开(公告)号：US08908517B2
公开(公告)日：2014-12-09
申请号：US13045408
申请日：2011-03-10
申请人： Clarence Filsfils , Pradosh Mohapatra , Sami Boutros
发明人： Clarence Filsfils , Pradosh Mohapatra , Sami Boutros
IPC分类号： H04L1/00 , H04L12/721 , H04L12/743
CPC分类号： H04L45/38 , H04L45/7453
摘要： In one embodiment, an edge device of a core network may receive a plurality of packets from a peripheral network having a plurality of active connections to the core network, where each packet has a destination address and a source address. The edge device may compute a hash on the destination address or the source address of each packet, and determine whether the computed hash corresponds to the edge device. In response to the computed hash not corresponding to the edge device, the edge device may drop the packet, and in response to the computed hash corresponding to the edge device, the edge device may process the packet to forward the packet, where the dropping and processing load balances the plurality of packets over the active connections and prevents formation of loops in the core network.
摘要翻译：在一个实施例中，核心网络的边缘设备可以从具有到核心网络的多个活动连接的外围网络接收多个分组，其中每个分组具有目的地地址和源地址。边缘设备可以计算目的地址或每个分组的源地址上的散列，并确定所计算的散列是否对应于边缘设备。响应于不对应于边缘设备的计算哈希，边缘设备可以丢弃该分组，并且响应于与边缘设备相对应的计算出的哈希，边缘设备可以处理分组以转发分组，其中丢弃和处理负载通过主动连接来平衡多个分组，并且防止在核心网络中形成环路。

7. 发明授权

US08761048B2 Managing hierarchical ethernet segments 有权
标题翻译：管理分层以太网段
公开(公告)号：US08761048B2
公开(公告)日：2014-06-24
申请号：US13471676
申请日：2012-05-15
申请人： Ali Sajassi , Samer Salam , Sami Boutros
发明人： Ali Sajassi , Samer Salam , Sami Boutros
IPC分类号： H04L12/28 , H04L12/24 , H04L29/12
CPC分类号： H04L41/12 , H04L29/12066 , H04L45/02 , H04L45/04 , H04L45/50 , H04L61/1511
摘要： In one embodiment, a method includes determining when a predetermined period of time has elapsed, and determining whether at least a first message has been obtained on a first port of a node during the predetermined period of time when it is determined that the predetermined period of time has elapsed. The method also includes identifying the first port as being connected to a single-homed site when it is determined that the at least first message has not been obtained on the first port during the predetermined period of time. The first port is identified as being connected to a multi-homed network, a multi-homed device, or a hierarchical Ethernet segment when it is determined that the at least first message has been obtained on the first port during the predetermined period of time.
摘要翻译：在一个实施例中，一种方法包括确定何时经过了预定的时间段，并且在确定在预定时间段的预定时间段内，确定在节点的第一端口上是否已经获得了至少第一消息时间已经过去了该方法还包括当在预定时间段内确定在第一端口上尚未获得至少第一消息时，将第一端口识别为连接到单个归属站点。当在预定时间段内确定已经在第一端口上获得了至少第一消息时，第一端口被识别为连接到多归属网络，多归属设备或分层以太网段。

8. 发明申请

US20130254359A1 ADDRESS RESOLUTION SUPPRESSION FOR DATA CENTER INTERCONNECT 有权
标题翻译：数据中心互连地址解析抑制
公开(公告)号：US20130254359A1
公开(公告)日：2013-09-26
申请号：US13428436
申请日：2012-03-23
申请人： Sami Boutros , Samer Salam , Ali Sajassi , Clarence Filsfils
发明人： Sami Boutros , Samer Salam , Ali Sajassi , Clarence Filsfils
IPC分类号： G06F15/173
CPC分类号： H04L61/103 , H04L61/6009
摘要： An example method is provided that includes determining whether an address resolution protocol reply from a local machine has been received at an edge node; updating a local cache based on the reply from the local machine; and sending the reply to a plurality of edge nodes through a data plane of a data center interconnect. In more specific implementations, the method can include determining whether an address resolution protocol request has been received from the local machine. The method could also include updating a local machine cache based on the request. In certain implementations, the method can include determining whether the request is targeting the local machine; and dropping the request if the request is targeting the local machine. The method could also include sending the request through the data center interconnect if the request is not targeting the local machine.
摘要翻译：提供了一种示例性方法，其包括确定在边缘节点处是否已经接收到来自本地机器的地址解析协议应答; 根据本地机器的回复更新本地缓存; 并通过数据中心互连的数据平面将答复发送到多个边缘节点。在更具体的实现中，该方法可以包括确定是否已经从本地机器接收到地址解析协议请求。该方法还可以包括基于该请求更新本地机器缓存。在某些实现中，该方法可以包括确定请求是否针对本地机器; 如果请求针对本地机器，则删除该请求。该方法还可以包括如果请求不针对本地机器，则通过数据中心互连发送请求。

9. 发明申请

US20130148657A1 MECHANISM FOR E-VPN INTEROPERABILITY WITH VPLS 有权
标题翻译：用于VPLS的E-VPN互操作性的机制
公开(公告)号：US20130148657A1
公开(公告)日：2013-06-13
申请号：US13313968
申请日：2011-12-07
申请人： Samer Salam , Ali Sajassi , Sami Boutros
发明人： Samer Salam , Ali Sajassi , Sami Boutros
IPC分类号： H04L12/56
CPC分类号： H04L45/68 , H04L12/4641 , H04L45/66
摘要： In one embodiment, a network device in a set of network devices obtains a pseudowire label for a Provider Edge (PE) device, where the pseudowire label corresponds to a Virtual Local Area Network (VLAN) on the PE device. In addition, the network device obtains a set of one or more MAC addresses reachable via the PE device, wherein the set of network devices support Ethernet Virtual Private Network (E-VPN) and are in the same redundancy group such that the set of network devices are coupled to the same customer edge device. The network device stores the pseudowire label in association with the set of one or more MAC addresses. The network device uses the pseudowire label to encapsulate traffic associated with the VLAN that is received from the customer edge device and destined to the set of MAC addresses reachable via the PE device.
摘要翻译：在一个实施例中，一组网络设备中的网络设备获得用于提供商边缘（PE）设备的伪线标签，其中伪线标签对应于PE设备上的虚拟局域网（VLAN）。另外，网络设备获得通过PE设备可达到的一个或多个MAC地址的集合，其中该组网络设备支持以太网虚拟专用网（E-VPN），并且处于相同的冗余组中，使得该组网络设备耦合到相同的客户边缘设备。网络设备将伪线标签与一组或多个MAC地址相关联地存储。网络设备使用伪线标签封装与客户边缘设备接收到的VLAN相关联的流量，并发往可通过PE设备到达的一组MAC地址。

10. 发明申请

US20130070764A1 Establishing a Bidirectional Forwarding Detection (BFD) Asynchronous Mode Session without Knowing A Priori Layer-2 or Layer-3 Information 有权
标题翻译：建立双向转发检测（BFD）异步模式会话，不知道第2层或第3层信息
公开(公告)号：US20130070764A1
公开(公告)日：2013-03-21
申请号：US13234331
申请日：2011-09-16
申请人： Sami Boutros , George Leonard Swallow , Nobushige Akiya
发明人： Sami Boutros , George Leonard Swallow , Nobushige Akiya
IPC分类号： H04L12/56
CPC分类号： H04L45/66 , H04L49/3054 , H04L49/351
摘要： In one embodiment, a Bidirectional Forwarding Detection (BFD) asynchronous mode session is established between two packet switching devices interconnected by one or more physical links. Prior to L2 or L3 services being established, each of these packet switching devices does not know the Media Access Control (MAC) nor Internet Protocol (IP) addresses of each interface of the other packet switching device that is connected to one of these link(s). A request to establish a BFD session is sent from one packet switching device to the other, with a MAC frame including the request being addressed to a group, broadcast, or other address that the receiving packet switching device will recognize and thus process the received request. Based on information contained in this received MAC frame, the receiving packet switching device has the information it needs, and sends a BFD control frame to the other packet switching device.
摘要翻译：在一个实施例中，通过一个或多个物理链路互连的两个分组交换设备之间建立双向转发检测（BFD）异步模式会话。在建立L2或L3服务之前，这些分组交换设备中的每一个不知道连接到这些链路之一的另一分组交换设备的每个接口的媒体接入控制（MAC）或互联网协议（IP）地址 s）。将建立BFD会话的请求从一个分组交换设备发送到另一个分组交换设备，其中MAC帧包括寻址到接收分组交换设备将识别的组，广播或其他地址的请求，从而处理接收到的请求。根据接收的MAC帧中包含的信息，接收分组交换装置具有需要的信息，向另一个分组交换装置发送BFD控制帧。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式