公开(公告)号：US5500855A

公开(公告)日：1996-03-19

申请号：US187950

申请日：1994-01-26

申请人： Paul C. Hershey ,  John G. Waclawsky

发明人： Paul C. Hershey ,  John G. Waclawsky

IPC分类号： H04L12/26 ,  H04J3/14

CPC分类号： H04L43/00 ,  H04L12/2602

摘要： The realtime event classification technique is described for a data communications network, which enables the categorization of data frames based upon selection significant bit segments in the serial bit stream. A base Event Driven Interface and an extension Event Driven Interface are both coupled to the data communications network, to identify patterns in the serial bit stream. The base Event Driven Interface identifies patterns which correspond to events which are to be counted. The extension Event Driven Interface identifies patterns of bits which are selection significant for the types of categories which are desired to be monitored. A plurality of event vector counters have event inputs coupled to the base Event Driven Interface and have a selection input coupled to the extension Event Driven Interface. A selection signal output from the extension Event Driven Interface enables one of the plurality of the event vector counters to receive the event signals from the base Event Driven Interface. In this manner, a variety of monitoring and analysis operations can be performed on the data communications network.

摘要翻译： 对于数据通信网络描述了实时事件分类技术，其能够基于串行比特流中的选择有效位段来对数据帧进行分类。 基础事件驱动接口和扩展事件驱动接口都耦合到数据通信网络，以识别串行位流中的模式。 基础事件驱动接口识别对应于要计数的事件的模式。 扩展事件驱动接口识别对于希望被监视的类别类型选择有意义的位模式。 多个事件向量计数器具有耦合到基本事件驱动接口的事件输入，并且具有耦合到扩展事件驱动接口的选择输入。 从扩展事件驱动接口输出的选择信号使多个事件向量计数器中的一个可以从基础事件驱动接口接收事件信号。 以这种方式，可以在数据通信网络上执行各种监视和分析操作。

公开(公告)号：US5495426A

公开(公告)日：1996-02-27

申请号：US188166

申请日：1994-01-26

申请人： John G. Waclawsky ,  Paul C. Hershey

发明人： John G. Waclawsky ,  Paul C. Hershey

IPC分类号： H04L29/14 ,  H04L12/56 ,  H04Q11/04 ,  H04J3/26

CPC分类号： H04L45/00 ,  H04L45/24 ,  H04Q11/0478 ,  H04L2012/5615 ,  H04L2012/5619 ,  H04L2012/5672

摘要： A dynamic realtime, inband routing mechanism is disclosed for a data communications network, which provides an Event Driven Interface to perform realtime, inband directed routing for load distribution and load balancing of data frames over one of a plurality of destination paths. The Event Driven Interface is programmed with control vectors to identify load balancing and load distribution bit patterns in the data frames on the data communications network. Enabling signals produced by the Event Driven Interface are applied to the control input of a multiplexer whose data input is connected to the data communications network. The multiplexer will steer the data frames from the data communications network to one of a plurality of output alternative routing paths, in response to the enabling signals it receives from the Event Driven Interface.

摘要翻译： 公开了一种用于数据通信网络的动态实时带内路由机制，其提供事件驱动接口以执行实时带内定向路由以用于在多个目的地路径之一上的数据帧的负载分配和负载平衡。 事件驱动接口用控制向量编程，以识别数据通信网络上的数据帧中的负载平衡和负载分配位模式。 将由事件驱动接口产生的使能信号应用于数据输入连接到数据通信网络的多路复用器的控制输入。 响应于从事件驱动接口接收到的使能信号，复用器将数据帧从数据通信网转向多个输出备选路由路径之一。

公开(公告)号：US5365514A

公开(公告)日：1994-11-15

申请号：US24575

申请日：1993-03-01

申请人： Paul C. Hershey ,  Kenneth J. Barker ,  Charles S. Lingafelt, Sr. ,  John G. Waclawsky

发明人： Paul C. Hershey ,  Kenneth J. Barker ,  Charles S. Lingafelt, Sr. ,  John G. Waclawsky

IPC分类号： H04L29/14 ,  H04L12/26 ,  H04J3/14

CPC分类号： H04L43/00 ,  H04L12/2602

摘要： An Event Driven Interface (EDI) is disclosed for use as a subsystem of a monitoring and control system for a data communications network. The network communicates a serial stream of binary bits having a characteristic pattern. The system includes a control vector generator for generating a control vector C(i) which describes the characteristic pattern and an event vector analyzer for analyzing an event vector E(i) which represents a plurality of occurrences of the pattern on the network.

摘要翻译： 事件驱动接口（EDI）被公开用作数据通信网络的监视和控制系统的子系统。 网络传送具有特征图案的二进制位串行流。 该系统包括用于生成描述特征模式的控制向量C（i）的控制向量生成器和用于分析表示网络上的模式的多次出现的事件向量E（i）的事件向量分析器。

公开(公告)号：US5594728A

公开(公告)日：1997-01-14

申请号：US551283

申请日：1995-10-31

申请人： Paul C. Hershey ,  John G. Waclawsky

发明人： Paul C. Hershey ,  John G. Waclawsky

IPC分类号： H04L29/04 ,  H04L29/06 ,  H04L12/417 ,  H04L12/46

CPC分类号： H04L29/06 ,  H04L69/22

摘要： The invention includes indirect addressing which is the realtime calculation of the location of variably offset fields in a frame in a high speed medium. Data frames in a communication medium, include a presence bit which indicates the presence of a variable length field whose length is defined by a length field in the data frame. In accordance with the invention, an Event Driven Interface has its input coupled to the data communications network, to receive the data frame and to identify the presence of the presence bit. In response to this, the Event Driven Interface branches to a first logic path which ignores the plurality of bits in the variable length field corresponding to the length field. Then, the Event Driven Interface branches to a second logic path after the plurality of bits have been ignored, to locate the variably offset field being sought in the data frame. This enables the realtime location of data at variable offsets in the data frame.

摘要翻译： 本发明包括间接寻址，其是在高速介质中的帧中可变偏移场的位置的实时计算。 通信介质中的数据帧包括存在位，其表示其长度由数据帧中的长度字段定义的可变长度字段的存在。 根据本发明，事件驱动接口将其输入耦合到数据通信网络，以接收数据帧并识别存在位的存在。 响应于此，事件驱动接口分支到忽略对应于长度字段的可变长度字段中的多个比特的第一逻辑路径。 然后，在多个位被忽略之后，事件驱动接口分支到第二逻辑路径，以定位数据帧中正在寻找的可变偏移字段。 这使得数据帧中可变偏移量的数据的实时位置成为可能。

公开(公告)号：US5784298A

公开(公告)日：1998-07-21

申请号：US678253

申请日：1996-07-11

申请人： Paul C. Hershey ,  John G. Waclawsky

发明人： Paul C. Hershey ,  John G. Waclawsky

IPC分类号： G06F11/34 ,  H04L12/26 ,  G06F11/30

CPC分类号： H04L43/10 ,  G06F11/348

摘要： An adaptive, active monitor invention is useful in detecting characteristic data patterns in messages on a high speed data network, such as starting delimiters, tokens, various types of frames, and protocol information. Such serial data streams include serial patterns of binary bits, and can also include serial patterns of multiple state symbols, such as in token ring networks and FDDI networks. The adaptive, active monitor includes two finite state machines (FSM) which are constructed to detect the occurrence of a characteristic data pattern having multiple component bit patterns. A first FSM is the predecessor FSM, and it is configured to detect the first occurring component pattern. A second FSM is called the successor FSM, and it is configured to detect the second occurring component pattern. The first FSM will send a starting signal to the second FSM, when the first FSM has successfully detected the first component pattern. The starting signal initializes the second FSM, to take over the analysis of the portion of the bit stream which follows the first component pattern. If the second FSM successfully detects the second component pattern, it then outputs a pattern alarm signal, indicating the successful detection of the entire characteristic data pattern.

摘要翻译： 自适应主动监视器发明对于检测高速数据网络上的消息中的特征数据模式是有用的，例如开始分隔符，令牌，各种类型的帧和协议信息。 这种串行数据流包括二进制位的串行模式，并且还可以包括诸如令牌环形网络和FDDI网络中的多个状态符号的串行模式。 自适应主动监视器包括两个有限状态机（FSM），其被构造为检测具有多个分量位模式的特征数据模式的出现。 第一个FSM是先前的FSM，它被配置为检测第一个出现的组件模式。 第二个FSM被称为后续FSM，它被配置为检测第二个出现的组件模式。 当第一个FSM成功检测到第一个组件模式时，第一个FSM将向第二个FSM发送启动信号。 起始信号初始化第二FSM，以接管第一分量模式之后的比特流部分的分析。 如果第二FSM成功地检测到第二分量模式，则输出模式报警信号，指示成功检测整个特征数据模式。

公开(公告)号：US5748925A

公开(公告)日：1998-05-05

申请号：US573586

申请日：1995-12-15

申请人： John G. Waclawsky ,  Paul C. Hershey ,  Raymond F. Daugherty

发明人： John G. Waclawsky ,  Paul C. Hershey ,  Raymond F. Daugherty

IPC分类号： H04L29/04 ,  H04L12/56 ,  H04Q11/04 ,  G06F13/00

CPC分类号： H04L45/00 ,  H04L45/566 ,  H04Q11/0478 ,  H04L2012/5615 ,  H04L2012/5619 ,  H04L2012/5672

摘要： A dynamic realtime routing mechanism for a data communications network, which provides an Event Driven Interface to perform realtime routing of data frames over one of a plurality of destination paths. The Event Driven Interface is programmed with control vectors to identify routing bit patterns in the data frames on the data communications network. Enabling signals produced by the Event Driven Interface are applied to the control input of a multiplexer whose data input is connected to the data communications network. The multiplexer will steer the data frames from the data communications network to one of a plurality of output routing paths, in response to the enabling signals it receives from the Event Driven Interface.

摘要翻译： 一种用于数据通信网络的动态实时路由机制，其提供事件驱动接口以在多个目的地路径之一上执行数据帧的实时路由。 事件驱动接口用控制向量编程，以识别数据通信网络上的数据帧中的路由位模式。 将由事件驱动接口产生的使能信号应用于数据输入连接到数据通信网络的多路复用器的控制输入。 响应于从事件驱动接口接收到的使能信号，多路复用器将把数据帧从数据通信网络引导到多个输出路由路径之一。

公开(公告)号：US5568471A

公开(公告)日：1996-10-22

申请号：US524029

申请日：1995-09-06

申请人： Paul C. Hershey ,  John G. Waclawsky

发明人： Paul C. Hershey ,  John G. Waclawsky

IPC分类号： H04L12/26 ,  H04L12/56 ,  H04L29/06 ,  H04Q11/04 ,  H04J3/14 ,  H04L12/46

CPC分类号： H04L43/00 ,  H04L12/26 ,  H04L29/06 ,  H04Q11/0478 ,  H04L2012/5616 ,  H04L2012/5627 ,  H04L2012/563 ,  H04L69/18

摘要： A workstation manages and controls a plurality of communication networks using different protocols coupled to a common bus. A programmable digital filter connected between the workstation and the networks examines frame information using real time calculation for identifying protocols in the frames. The filter identifies and counts addresses, security conditions and other information of interest on the bus and occurring in the networks. The protocol, address, security data and other information of interest counted by the filter are stored in storage for access by an interpreter. The stored data for the networks accessed by the interpreter is compared to network models for identification of traffic problems and conditions and load balancing. The network interpreter contains a graphical user interface which displays selected information at a monitor for an operator to examine and initiate corrective action by initiating commands. A microprocessor executes the commands for overcoming the traffic condition or problem occurring on the different networks. The microprocessor is further adapted to initiate load balancing in the networks according to the commands issued by the interpreter.

摘要翻译： 工作站使用耦合到公共总线的不同协议来管理和控制多个通信网络。 连接在工作站和网络之间的可编程数字滤波器使用实时计算来检查帧信息，用于识别帧中的协议。 该过滤器识别和计数总线上感兴趣的地址，安全条件和其他信息，并发生在网络中。 由过滤器计算的协议，地址，安全数据和感兴趣的其他信息存储在存储器中以由解释器访问。 将解释器访问的网络的存储数据与网络模型进行比较，以识别流量问题和条件以及负载平衡。 网络解释器包含图形用户界面，其在监视器处显示所选择的信息，以便操作者通过启动命令来检查和启动纠正措施。 微处理器执行用于克服不同网络上发生的交通状况或问题的命令。 微处理器还适用于根据解释器发出的命令在网络中启动负载均衡。

公开(公告)号：US5414833A

公开(公告)日：1995-05-09

申请号：US144161

申请日：1993-10-27

申请人： Paul C. Hershey ,  Donald B. Johnson ,  An V. Le ,  Stephen M. Matyas ,  John G. Waclawsky ,  John D. Wilkins

发明人： Paul C. Hershey ,  Donald B. Johnson ,  An V. Le ,  Stephen M. Matyas ,  John G. Waclawsky ,  John D. Wilkins

IPC分类号： G06F1/00 ,  G06F11/00 ,  G06F11/32 ,  G06F21/00 ,  H04L12/26 ,  H04L29/06 ,  H04L9/00

CPC分类号： H04L43/00 ,  G06F21/564 ,  H04L12/26 ,  H04L63/0428 ,  H04L63/145 ,  G06F11/0763 ,  G06F11/327

摘要： A system and method provide a security agent, consisting of a monitor and a responder, that respond to a detected security event in a data communications network, by producing and transmitting a security alert message to a network security manager. The alert is a security administration action which includes setting a flag in an existing transmitted protocol frame to indicate a security event has occurred. The security agent detects the transmission of infected programs and data across a high-speed communications network. The security agent includes an adaptive, active monitor using finite state machines, that can be dynamically reprogrammed in the event it becomes necessary to dynamically reconfigure it to provide real time detection of the presence of a suspected offending virus.

摘要翻译： 系统和方法通过产生和向网络安全管理器发送安全警报消息来提供响应于数据通信网络中检测到的安全事件的由监视器和应答器组成的安全代理。 该警报是安全管理动作，其包括在现有传输的协议帧中设置标志以指示发生了安全事件。 安全代理通过高速通信网络检测受感染程序和数据的传输。 安全代理包括使用有限状态机的自适应主动监视器，可以在需要动态重新配置以便实时检测疑似违规病毒的存在的情况下动态重新编程。

公开(公告)号：US5375070A

公开(公告)日：1994-12-20

申请号：US24572

申请日：1993-03-01

申请人： Paul C. Hershey ,  Kenneth J. Barker ,  Charles S. Lingafelt, Sr. ,  John G. Waclawsky

发明人： Paul C. Hershey ,  Kenneth J. Barker ,  Charles S. Lingafelt, Sr. ,  John G. Waclawsky

IPC分类号： H04L29/06 ,  G06F17/40 ,  H04L12/24 ,  H04L12/26 ,  H04L29/14 ,  G06F15/20

CPC分类号： H04L43/06 ,  H04L41/142

摘要： A system and process are disclosed that allows the collection of events to be organized and ordered so that relationship between events and the events themselves can be identified as a state or series of states which describe and allow control of performance aspects of protocol activity. The architecture allows dynamic programming of multiple of devices for the purposes of coordination and correlation of events such that monitoring, performance analysis and control can be accomplished on a real-time basis for any speed network. The architecture facilitates feedback of the correlated events for the purposes of monitoring and controlling network activity.

摘要翻译： 公开了一种系统和过程，其允许事件的收集被组织和排序，使得事件和事件本身之间的关系可以被识别为描述和允许控制协议活动的性能方面的状态或一系列状态。 该架构允许多个设备的动态编程，用于协调和关联事件的目的，使得可以实时地为任何速度网络完成监控，性能分析和控制。 该架构有助于相关事件的反馈，以便监控和控制网络活动。

公开(公告)号：US5802302A

公开(公告)日：1998-09-01

申请号：US496622

申请日：1995-06-29

申请人： John G. Waclawsky ,  Paul C. Hershey

发明人： John G. Waclawsky ,  Paul C. Hershey

IPC分类号： G06F13/38 ,  H04L12/24 ,  H04L12/26 ,  G06F13/00 ,  G06F11/30

CPC分类号： H04L12/2697 ,  G06F13/385 ,  H04L41/32 ,  H04L41/5009 ,  H04L43/50

摘要： A high speed data communication network is adapted to monitor and measure response time between a work station and a central host or processor coupled to the data communications network through a media, such as token ring, FDDI, Ethernet, etc. As the workstation communicates with the processor, a flag is set in a packet transmitted to the processor. The packet traverses the network to an application in the processor and a response returns which includes a flag. Each flag is a specific bit pattern. A programmable digital filter recognizes the flags and counts the number of bits on the network between the flags in the forward and reverse direction. By counting the bits on the media, when the flag moves in one direction or another, the total number of bits transmitted on the media between the two intervening flags is determined. The media speed is used as a clock. The number of bits counted divided by the media speed determines the response time with fine resolutions. All of the measurements are done in near real time without the use of clocks or off-line processing of data to determine response time. The measurements can be done for half duplex or full duplex operation of a network. The measurements can be also used in the network to initiate performance changes according to the response time.