Data link layer switch with protection against internet protocol spoofing attacks
    11.
    发明授权
    Data link layer switch with protection against internet protocol spoofing attacks 有权
    数据链路层交换机,防止互联网协议欺骗攻击

    公开(公告)号:US08028160B1

    公开(公告)日:2011-09-27

    申请号:US11170904

    申请日:2005-06-29

    申请人: Michael Orr

    发明人: Michael Orr

    IPC分类号: H04L29/06 G06F11/00

    摘要: A data link layer switch having an associated method and computer program comprises a processor; a plurality of ports to exchange packets of data with a network; a memory to store a switch table; and a packet processor to transfer the packets of data between the ports according to the switch table, the packet processor comprising a classifier to send copies of selected ones of the packets of data to the processor; wherein the processor determines whether an attack upon the data link layer switch has occurred based on the copies of the selected ones of the packets.

    摘要翻译: 具有关联方法和计算机程序的数据链路层交换机包括处理器; 多个端口,用于与网络交换数据包; 存储切换表的内存; 以及分组处理器,用于根据所述交换表在所述端口之间传送数据分组,所述分组处理器包括分类器,以向处理器发送所选数据分组的副本; 其中所述处理器基于所选择的分组的副本来确定是否已经发生对所述数据链路层交换机的攻击。

    Using standard fields to carry meta-information

    公开(公告)号:US09729431B1

    公开(公告)日:2017-08-08

    申请号:US13569622

    申请日:2012-08-08

    申请人: Michael Orr

    发明人: Michael Orr

    摘要: A method of processing one or more packets includes receiving, at a first processing unit, a first packet including first information bits. The first information bits indicate a first control parameter. The method also includes determining whether the first control parameter will be utilized to process the first packet in at least a second processing unit and, at least partially in response to determining that the first control parameter will not be utilized to process the first packet in at least the second processing unit, replacing one or more bits of the first information bits in the first packet with second information bits. The second information bits indicate a second control parameter. The method also includes providing the first packet including the second information bits to the second processing unit.

    Data link layer switch with protection against internet protocol spoofing attacks
    14.
    发明授权
    Data link layer switch with protection against internet protocol spoofing attacks 有权
    数据链路层交换机,防止互联网协议欺骗攻击

    公开(公告)号:US08661241B1

    公开(公告)日:2014-02-25

    申请号:US13245501

    申请日:2011-09-26

    申请人: Michael Orr

    发明人: Michael Orr

    IPC分类号: H04L29/06

    摘要: A network switch including a plurality of ports, a packet processor, and a first processor. The plurality of ports are configured to receive a plurality of packets transmitted from a network to the network switch. The packet processor comprises a classifier configured to select a subset of the plurality of packets according to sampling criteria. The first processor is configured to determine, based on the subset of the plurality of packets, whether the plurality of packets are associated with an attack on the network switch. The classifier is further configured to, prior to the first processor determining whether the plurality of packets are associated with an attack, copy the subset of the plurality of packets to the first processor while maintaining the plurality of packets in the packet processor.

    摘要翻译: 包括多个端口的网络交换机,分组处理器和第一处理器。 多个端口被配置为接收从网络发送到网络交换机的多个分组。 分组处理器包括分类器,其被配置为根据抽样标准来选择多个分组的子集。 第一处理器被配置为基于多个分组的子集来确定该多个分组是否与网络交换机上的攻击相关联。 分类器还被配置为在第一处理器确定多个分组是否与攻击相关联之前,将多个分组的子集复制到第一处理器,同时保持分组处理器中的多个分组。

    Model driven command language translator
    15.
    发明授权
    Model driven command language translator 有权
    模型驱动命令语言翻译器

    公开(公告)号:US08478580B1

    公开(公告)日:2013-07-02

    申请号:US13480587

    申请日:2012-05-25

    IPC分类号: G06F15/16

    CPC分类号: G06F15/177 G06F8/51

    摘要: An embodiment includes a method that includes receiving source commands to establish a configuration to control a computer networking function in a computer networking device, wherein the source commands are written in a source command language. The method selectively translates the source commands from the source command language to target commands written in a target command language, wherein the translation is based, at least in part, on a function-to-function translation model. The configuration is established in the computer networking device based on the target commands.

    摘要翻译: 一个实施例包括一种方法,其包括接收源命令以建立用于控制计算机网络设备中的计算机联网功能的配置,其中源命令以源命令语言编写。 所述方法选择性地将来自源命令语言的源命令转换为以目标命令语言编写的目标命令,其中,所述翻译至少部分地基于功能到功能的翻译模型。 基于目标命令在计算机网络设备中建立配置。

    Hybrid multicast switch employing network-layer routing
    16.
    发明授权
    Hybrid multicast switch employing network-layer routing 有权
    采用网络层路由的混合组播切换

    公开(公告)号:US08238337B1

    公开(公告)日:2012-08-07

    申请号:US12062036

    申请日:2008-04-03

    IPC分类号: H04L12/28

    摘要: A switch having first, second, and third ports receives a multicast join message into the first port on a first VLAN, wherein the first and second ports are associated with the first VLAN, the second and third ports are associated with a second VLAN, and the first, second, and third ports are associated with a multicast VLAN, and wherein the multicast join message represents a first request to join a multicast group; creates an association between the multicast group and the ports associated with the multicast VLAN based on the multicast join message; transmits a network-layer routing protocol message from the second port, wherein the network-layer routing protocol message represents a second request to join the multicast group; receives a multicast packet for the multicast group into the second port; and transmits the multicast packet on the multicast VLAN based on the association.

    摘要翻译: 具有第一,第二和第三端口的交换机在第一VLAN上接收到第一端口中的多播加入消息,其中第一和第二端口与第一VLAN相关联,第二和第三端口与第二VLAN相关联,以及 第一,第二和第三端口与组播VLAN相关联,其中多播加入消息表示加入多播组的第一请求; 基于组播加入消息,在组播组和与组播VLAN关联的端口之间建立关联; 从所述第二端口发送网络层路由协议消息,其中所述网络层路由协议消息表示加入所述多播组的第二请求; 将组播组的组播报文接收到第二端口; 并根据关联在组播VLAN上发送组播报文。

    Congestion avoidance for network traffic
    18.
    发明授权
    Congestion avoidance for network traffic 有权
    拥塞避免网络流量

    公开(公告)号:US08411694B1

    公开(公告)日:2013-04-02

    申请号:US12792082

    申请日:2010-06-02

    申请人: Michael Orr Gad Hutt

    发明人: Michael Orr Gad Hutt

    IPC分类号: H04L12/56 H04J1/16

    摘要: In one embodiment, an apparatus comprises a plurality of queues and a queue scheduler configured to schedule frames from a plurality of Transmission Control Protocol flows. The frames are buffered through one of the plurality of queues based, at least in part on, a pre-assigned priority of the frames. Congestion control logic is configured to change a pre-assigned priority of selected frames from the plurality of Transmission Control Protocol (TCP) flows to reduce TCP global loss synchronization among the plurality of TCP flows.

    摘要翻译: 在一个实施例中,一种装置包括多个队列和被配置为从多个传输控制协议流调度帧的队列调度器。 至少部分地基于帧的预分配优先级,将帧缓冲通过多个队列之一。 拥塞控制逻辑被配置为改变来自多个传输控制协议(TCP)流的所选帧的预分配优先级,以减少多个TCP流之间的TCP全局丢失同步。

    Custom automatic remote monitoring for network devices
    19.
    发明授权
    Custom automatic remote monitoring for network devices 有权
    网络设备的自定义自动远程监控

    公开(公告)号:US08305923B1

    公开(公告)日:2012-11-06

    申请号:US12861294

    申请日:2010-08-23

    申请人: Michael Orr

    发明人: Michael Orr

    摘要: A network device including a port configured to exchange packets of data with one or more networks. The network device further includes a rule storing circuit is configured to store a plurality of event classification rules. Each of the event classification rules describes at least one event characteristic for an event in the network device. At least one of the event classification rules includes a change in state of the at least one port of the network device. The change in state of the at least one port is generated by a change in spanning tree mode. The network device further includes an event classifier is configured to identify events having the at least one event characteristic described by any of the event classification rules, and a plurality of event counters configured to count the events identified by the event classifier for a respective one of the event classification rules.

    摘要翻译: 一种网络设备,包括被配置为与一个或多个网络交换数据包的端口。 网络设备还包括规则存储电路,用于存储多个事件分类规则。 每个事件分类规则描述了网络设备中事件的至少一个事件特征。 事件分类规则中的至少一个包括网络设备的至少一个端口的状态改变。 至少一个端口的状态变化是通过生成树模式的改变生成的。 网络设备还包括:事件分类器被配置为识别具有由任何事件分类规则描述的至少一个事件特性的事件;以及多个事件计数器,被配置为对事件分类器识别的事件进行计数, 事件分类规则。

    Apparatus, systems, methods, algorithms and software for control of network switching devices
    20.
    发明授权
    Apparatus, systems, methods, algorithms and software for control of network switching devices 有权
    用于控制网络交换设备的装置,系统,方法,算法和软件

    公开(公告)号:US08144630B1

    公开(公告)日:2012-03-27

    申请号:US11999846

    申请日:2007-12-06

    申请人: Michael Orr

    发明人: Michael Orr

    摘要: Apparatuses, systems, methods, algorithms, and software for distributed control and/or configuration of network switching devices. The apparatus generally comprises a plurality of network I/O ports, a local control I/O port, and a controller configured to, when the apparatus is a master, receive control input data from at least one of the network I/O ports, process the control input data, and provide control output data to at least one of the network I/O ports, and when the apparatus is a slave, receive the control input data from the local control I/O port, provide the control input data to at least one of the network I/O ports, receive the control output data from at least one of the network I/O ports, and provide the control output data to the local control I/O port. The present disclosure advantageously enables control and/or configuration of a stack of network switch devices by communicating through a local control port of at least one of the devices in the stack.

    摘要翻译: 用于分布式控制和/或配置网络交换设备的设备,系统,方法,算法和软件。 该装置通常包括多个网络I / O端口,本地控制I / O端口和控制器,其被配置为当设备是主设备时从至少一个网络I / O端口接收控制输入数据, 处理控制输入数据,并向至少一个网络I / O端口提供控制输出数据,并且当设备是从设备时,从本地控制I / O端口接收控制输入数据,提供控制输入数据 到至少一个网络I / O端口,从至少一个网络I / O端口接收控制输出数据,并将控制输出数据提供给本地控制I / O端口。 本公开有利地使得能够通过通过堆叠中的至少一个设备的本地控制端口进行通信来控制和/或配置网络交换机设备的堆叠。