US20030067874A1 - Central policy based traffic management - Google Patents
Central policy based traffic management Download PDFInfo
- Publication number
- US20030067874A1 US20030067874A1 US10/127,167 US12716702A US2003067874A1 US 20030067874 A1 US20030067874 A1 US 20030067874A1 US 12716702 A US12716702 A US 12716702A US 2003067874 A1 US2003067874 A1 US 2003067874A1
- Authority
- US
- United States
- Prior art keywords
- policy
- repository
- traffic management
- packet
- policies
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/20—Traffic policing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
- H04L12/462—LAN interconnection over a bridge based backbone
- H04L12/4625—Single bridge functionality, e.g. connection of two networks over a single bridge
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0893—Assignment of logical groups to network elements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0894—Policy-based network configuration management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2408—Traffic characterised by specific attributes, e.g. priority or QoS for supporting different services, e.g. a differentiated services [DiffServ] type of service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/245—Traffic characterised by specific attributes, e.g. priority or QoS using preemption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/70—Admission control; Resource allocation
- H04L47/76—Admission control; Resource allocation using dynamic resource allocation, e.g. in-call renegotiation requested by the user or requested by the network in response to changing network conditions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/70—Admission control; Resource allocation
- H04L47/78—Architectures of resource allocation
- H04L47/781—Centralised allocation of resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/70—Admission control; Resource allocation
- H04L47/80—Actions related to the user profile or the type of traffic
- H04L47/805—QOS or priority aware
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/70—Admission control; Resource allocation
- H04L47/82—Miscellaneous aspects
- H04L47/822—Collecting or measuring resource availability data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/20—Support for services
- H04L49/205—Quality of Service based
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/90—Buffering arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q11/00—Selecting arrangements for multiplex systems
- H04Q11/04—Selecting arrangements for multiplex systems for time-division multiplexing
- H04Q11/0428—Integrated services digital network, i.e. systems for transmission of different types of digitised signals, e.g. speech, data, telecentral, television signals
- H04Q11/0478—Provisions for broadband connections
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/54—Store-and-forward switching systems
- H04L12/56—Packet switching systems
- H04L12/5601—Transfer mode dependent, e.g. ATM
- H04L2012/5625—Operations, administration and maintenance [OAM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/54—Store-and-forward switching systems
- H04L12/56—Packet switching systems
- H04L12/5601—Transfer mode dependent, e.g. ATM
- H04L2012/5678—Traffic aspects, e.g. arbitration, load balancing, smoothing, buffer management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/54—Store-and-forward switching systems
- H04L12/56—Packet switching systems
- H04L12/5601—Transfer mode dependent, e.g. ATM
- H04L2012/5678—Traffic aspects, e.g. arbitration, load balancing, smoothing, buffer management
- H04L2012/5684—Characteristics of traffic flows
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/25—Routing or path finding in a switch fabric
- H04L49/253—Routing or path finding in a switch fabric using establishment or release of connections between ports
- H04L49/254—Centralised controller, i.e. arbitration or scheduling
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/30—Peripheral units, e.g. input or output ports
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/30—Peripheral units, e.g. input or output ports
- H04L49/3027—Output queuing
Definitions
- the present invention relates generally to traffic control in a data communications network, and more particularly, to configuring different network protocols associated with traffic management via a single centralized set of policies.
- Policy based traffic control has become increasingly important in data communication networks as data traffic competes for limited bandwidth. Policy based traffic control generally involves separate, independent interfaces for configuring different traffic management protocols.
- FIG. 1 is a schematic block diagram of a switching node 9 for policy based traffic control according to conventional mechanisms.
- the switching node includes separate, independent policy engines 11 , 13 , 15 and associated interfaces 17 , 19 , 21 for managing and configuring different traffic management protocols.
- a switching node may include a separate policy engine for controlling quality of service (QoS), IP filtering via access control lists (ACL), network address translation (NAT), and the like.
- QoS quality of service
- ACL access control lists
- NAT network address translation
- Each policy engine is associated with a control interface used by a network administrator to configure and manage the associated policies for a discrete traffic management protocol.
- an inbound packet is processed by a first policy engine, such as, a QoS policy engine, for a matching policy. If a match is found, the matching policy is enforced and the packet is generally not processed by the other policy engines. If a match is not found, the packet is processed by a next policy engine for a match.
- a first policy engine such as, a QoS policy engine
- the matching policy is enforced and the packet is generally not processed by the other policy engines. If a match is not found, the packet is processed by a next policy engine for a match.
- multiple actions from different policy engines are either impossible or difficult to perform for a specific traffic flow. It is often desirable, however, to be able to perform such multiple actions. For example, it may be desirable to invoke a NAT policy engine for address translation based on a source IP address while simultaneously invoking the QoS policy engine for assigning a QoS priority to the flow based on the same source address.
- Another problem with the current policy based traffic control is that the use of separate, independent interfaces for configuring the policies generally requires the network administrator to learn and use different command sequences for configuring and managing different policy engines. This may result in the configuration of conflicting policy rules that may lead to unpredictable results, especially if the configurations are done by different administrators or the same administrator at different times.
- the present invention is directed to traffic management via a single centralized set of policies.
- the invention is directed to a switching node in a data communications network that includes an input, a repository, a policy engine, and a management engine.
- the repository stores a single set of policies for controlling a plurality of different traffic management protocols.
- the policy engine is coupled to the input and the repository, and is configured to evaluate an inbound packet based on a policy selected from the single set of policies, and configure one or more traffic management protocol entities based on the selected policy.
- the management engine is coupled to the repository and the policy engine. The management engine configures and manages the single set of policies via a common set of commands.
- the invention is directed to a method for policy based traffic management where the method includes storing in a repository a single set of policies for controlling a plurality of different traffic management protocols.
- the method includes receiving a first packet, retrieving a first policy from the repository where the first policy identifies a first action for configuring a traffic management protocol entity of a first protocol type, and configuring the traffic management protocol entity based on the first action.
- the method also includes receiving a second packet, retrieving a second policy from the repository where the second policy identifies a second action for configuring a traffic management protocol entity of a second protocol type, and configuring the traffic management protocol entity based on the second action.
- the invention is directed to a method for policy based traffic management where the method includes storing in a repository a single set of policies for controlling a plurality of different traffic management protocols, receiving a packet, and retrieving a policy from the repository which identifies a first and second action for controlling traffic management protocol entities of a first and second protocol type.
- the method includes configuring the traffic management protocol entity of the first protocol type based on the first action and configuring the traffic management protocol of the second protocol type based on the second action.
- the invention is directed to a method for policy based traffic management where the method includes storing in a repository a single set of policies for controlling a plurality of different traffic management protocols, receiving a packet, and searching a policy cache for a policy applicable to the packet. If the policy cache does not include an applicable policy, the method includes searching the repository for a match, and generating and storing a new policy in the policy cache. The new policy is selected as applicable to a future packet if the repository contains no other policies that are also applicable to a future packet but are different from the new policy.
- FIG. 1 is a schematic block diagram of a switching node for policy based traffic management according to conventional mechanisms
- FIG. 2 is a schematic block diagram of a network environment including a packet switching node according to one embodiment of the invention
- FIG. 3 is a block diagram of a switching interface in one embodiment of the present invention.
- FIG. 4 is a schematic block diagram of the packet switching controller providing and applying a common, centralized set of simple policies for controlling a plurality of traffic management protocols according to one embodiment of the invention
- FIG. 5 is a more detailed diagram of the switching controller of FIG. 4 according to one embodiment of the invention.
- FIG. 6 is a conceptual layout diagram of various types of policy objects provided by a central management engine for creating a centralized set of policies according to one embodiment of the invention
- FIG. 7 is a conceptual layout diagram of a central policy repository according to one embodiment of the invention.
- FIG. 8 is a flow diagram of a central policy based traffic management according to one embodiment of the invention.
- FIG. 2 is a schematic block diagram of a network environment including a packet switching node 10 according to one embodiment of the invention.
- the packet switching node may also be referred to as a switch, a data communication node or a data communication switch.
- the packet switching node 10 includes switching interfaces 14 , 16 and 18 interconnected to respective groups of LANs 30 , 32 , 34 , and interconnected to one another over data paths 20 , 22 , 24 via switching backplane 12 .
- the switching backplane 12 preferably includes switching fabric.
- the switching interfaces may also be coupled to one another over control paths 26 and 28 .
- the switching interfaces 14 , 16 , 18 preferably forward packets to and from their respective groups of LANs 30 , 32 , 34 in accordance with one or more operative communication protocols, such as, for example, media access control (MAC) bridging and Internet Protocol (IP) routing.
- MAC media access control
- IP Internet Protocol
- the switching node 10 is shown for illustrative purposes only. In practice, packet switching nodes may include more or less than three switching interfaces.
- FIG. 3 is a block diagram of a switching interface 50 in one embodiment of the present invention.
- the switching interface 50 may be similar, for example, to the switching interfaces 14 , 16 , 18 of FIG. 2.
- the switching interface 50 includes an access controller 54 coupled between LANs and a packet switching controller 52 .
- the access controller 54 which may, for example, include a media access controller (MAC), preferably receives inbound packets off LANs, performs flow-independent physical and MAC layer operations on the inbound packets and transmits the inbound packets to the packet switching controller 52 for flow-dependent processing.
- the access controller 54 also receives outbound packets from the packet switching controller 52 and transmits the packets on LANs.
- the access controller 54 may also perform physical and MAC layer operations on the outbound packets prior to transmitting them on LANs.
- the packet switching controller 52 receives inbound packets, classifies the packets, modifies the packets in accordance with flow information and transmits the modified packets on switching backplane, such as the switching backplane 12 of FIG. 2.
- the packet switching controller 52 preferably also receives packets modified by other packet switching controllers via the switching backplane and transmits them to the access controller 54 for forwarding on LANs.
- the packet switching controller 52 may also subject selected ones of the packets to egress processing prior to transmitting them to the access controller 54 for forwarding on LANs.
- FIG. 4 is a schematic block diagram of the packet switching controller 52 providing and applying a common, centralized set of simple policies for coordinating a plurality of traffic management protocols, such as, for example, access control, address translation, server load balancing, quality of service, and the like.
- the switching controller 52 includes a central policy engine 56 coupled to a central management engine 58 .
- the central policy engine 56 evaluates the traffic flow against the centralized set of policies to perform, from a central location, one or more policy actions typically performed by separate, independent policy engines.
- the centralized set of policies include, but are not limited to system policies, network policies, access policies, services policies, and the like.
- the one or more actions include, but are not limited to packet filtering, packet prioritizing, address translation, server load balance group assignment, and assignment of 802.1p. TOS, or DSCP values.
- the central management engine 58 may include software and/or hardware components to enable a network administrator to configure and manage the centralized set of policies. With the central management engine 58 , the network administrator may, from a single location and using a common set of commands, create policies that manage different traffic management protocols.
- FIG. 5 is a more detailed diagram of the switching controller 52 according to one embodiment of the invention.
- the switching controller includes a packet buffer 102 , packet classification engine 104 , central policy engine 106 , central policy enforcement engine 120 , central policy repository 100 , and central management engine 107 .
- the packet classification engine 104 , central policy engine 106 , central policy enforcement engine 120 , and central policy management engine 107 are logical devices that may be implemented in software, hardware, firmware (e.g. ASIC), or any combination thereof.
- FIG. 5 illustrates a block diagram of the packet switching controller without obfuscating inventive aspects of the present invention with additional elements and/or components that may be required for creating the controller. These additional elements and/or components, which are not shown in FIG. 5 are well known to those skilled in the art.
- the switching controller 52 receives inbound packets 108 .
- the packets may include, but are not limited to, Ethernet frames, ATM cells, TCP/IP and/or UDP/IP packets, and may also include other Layer 2 (Data Link/MAC Layer), Layer 3 (Network Layer) or Layer 4 (Transport Layer) data units.
- Layer 2 Data Link/MAC Layer
- Layer 3 Network Layer
- Layer 4 Transport Layer
- the received packets are stored in the packet buffer 102 .
- the packet buffer 102 provides via output signal 110 the stored packets or portions thereof to the packet classification engine 104 for processing.
- the packet classification engine 104 may include one or more of a data extractor and a data cache.
- the data extractor and data cache are provided within the packet buffer 102 .
- the data extractor is used to extract one or more fields from the packets, and to store the extracted fields in the data cache as extracted data.
- the extracted data may include, but is not limited to, some or all of the packet header.
- the extracted data may include, but are not limited to, one or more of Layer 2 MAC addresses, 802.1P/Q tag status, Layer 2 encapsulation type, Layer 3 protocol type, Layer 3 addresses, ToS (type of service) values, Layer 4 port numbers, portions of the packet body, and/or any other data used for determining a policy.
- the extracted data is transmitted to the central policy engine 106 via an output signal 112 .
- the central policy engine 106 may be similar to the central policy engine 56 of FIG. 4.
- the central policy engine 106 accesses either an internal policy cache 116 or the central policy repository 100 for selecting a policy applicable to the packet. In accessing the central policy repository 100 , the central policy engine 106 communicates with the repository using protocols such as, for example, LDAP.
- the policy cache 116 includes sufficient information for applying policies to existing traffic flows without having to process the entire list of policies in the central policy repository 100 for every packet in the traffic flow.
- the information in the policy cache 116 is specific enough to prevent packets for which a different applicable rule may exist in the central policy repository 100 to be processed by the policy cache 116 .
- the central policy repository 100 may be implemented in a local memory and/or an external directory server with Lightweight Directory Access Protocol (LDAP) access.
- the central policy repository 100 includes a list of policies that are based on the contents of a packet and/or other elements such as, for example, time information, port information, and the like.
- policies are rules composed of one or more conditions that describe a packet and one or more actions defining how the packet is to be processed if the condition is satisfied.
- the central policy engine 106 compares the extracted packet data with either the policies in the policy cache 116 or central policy repository 100 . If a match is found between the condition(s) in the policy and the extracted data, the policy engine determines the action(s) to be taken on the packet. The action(s) to be taken on the packet are transmitted to the central policy enforcement engine 120 via an output signal 117 .
- the central policy enforcement engine 120 ensures that the packet is processed according to the parameters defined in the action(s). In this regard, the central policy enforcement engine 120 interacts with other hardware and software elements in the switching node 30 for causing a desired processing of the packet. For example, if the policy actions specify that the packet is to be transmitted at a high priority, the policy enforcement engine 120 may direct the packet buffer 102 to place the packet in a high priority queue of an egress port.
- the central management engine 107 of FIG. 5 may be similar to the central management engine 58 of FIG. 4.
- the engine 107 may be either a dedicated console or part of a network management console.
- a network administrator accesses the central management engine 107 for configuring and managing the policies in the central policy repository 100 and the central policy engine 106 .
- the central management engine 107 provides a graphical user interface that provides a common set of commands and tools for configuring and managing polices that control different network elements such as, for example, QoS, NAT, ACL, and the like.
- the central management engine 107 also allows a network administrator to test policies before they are applied.
- FIG. 6 is a conceptual layout diagram of various types of policy objects provided by the central management engine 107 for creating the centralized set of policies according to one embodiment of the invention.
- the policy objects include rule 200 objects, condition 202 objects, action 204 objects, service 206 objects, and group 208 objects.
- Rules 200 are top level objects including conditions 202 and actions 204 .
- rules are provided precedence values indicative of an order in which the rules are to be applied.
- Conditions 202 are parameters used to classify traffic, and actions 204 are parameters describing how to treat the classified traffic.
- a condition 202 may include a service 206 and/or a group 208 .
- a policy service 206 may be used as a shorthand for certain parts of a condition.
- a policy service 206 is defined by a service name, an IP protocol, a source IP port, and/or a destination IP port.
- a “video” service may be defined as being associated with a “UDP” protocol and destination IP port number “4500.”
- a “telnet” service may be defined as being associated with a “TCP” protocol and destination IP port number “23.”
- a policy group 208 may be defined by a list of IP/MAC addresses, ports, or services. Policy groups allow a network administrator to define conditions for a group of address, ports, or services, instead of creating a separate condition for each address, port, or service. For example, an “engineering” group may be defined as a set of particular IP addresses. A “basic services” group may be defined as a set of particular services such as telnet, FTP, HTTP, and Sendmail.
- the central management engine 107 allows the creation of policies defining multiple actions for managing different traffic management protocols.
- a policy in the central policy repository 100 may indicate that traffic with a particular source address and a particular destination address is to have the source address translated and receive a high priority.
- two different actions, a NAT policy action and a QoS policy action may be defined via a single policy rule.
- FIG. 7 is a conceptual layout diagram of the central policy repository 100 according to one embodiment of the invention.
- the repository includes a policy table 300 including a list of simple policy rules 302 . Associated with each policy rule are a precedence number 304 , condition 306 , and action 308 .
- the precedence number 304 indicates an order in which the rules are to be applied. If traffic matches more than one rule, the central policy engine 106 uses the rule with the highest precedence. In the illustrated embodiment, rule 4 is not matched since it is a subset, or more specific, than the higher precedence rule 2 .
- the precedence ordering of the rules helps eliminate any rule conflicts and ensures that the results of evaluating a traffic flow against the policies is predictable and consistent.
- the condition 306 for each rule defines parameters used for classifying inbound packets. These parameters include but are not limited to individual source addresses or source address groups, individual destination addresses or destination groups, and individual IP protocols 306 e, individual IP ports 306 d, or policy service groups 306 c.
- the action 308 for each rule defines one or more operations to be performed on the packet and/or traffic management protocol entities.
- the action 308 may be a filtering action, such as for example, dropping or admitting a packet.
- the action 308 may also be a QoS action such as, for example, assigning a priority to the packet.
- the action 308 may further be server load balancing, source or destination address translation, mapping or marking 802.1P, TOS, or DSCP values, or a combination of any of the discussed actions.
- FIG. 8 is a flow diagram of a central policy based traffic control according to one embodiment of the invention.
- the packet buffer 102 receives an inbound data packet and stores the packet in the buffer.
- the packet classification engine 104 extracts one or more fields from the packets.
- the central policy engine 106 determines whether the policy cache contains entries that match the extracted fields of the packet. If the answer in YES, the central policy enforcement engine 120 ensures that the policy action indicated in the matched entry of the policy cache is enforced.
- the central policy engine 106 determines in step 408 whether there is an exact match of the extracted fields with conditions of a rule in the central policy repository 100 . If the answer is YES, the central policy engine proceeds to program, in step 414 , the policy cache 116 with the condition fields of the matched policy, the fields having the values of the corresponding extracted fields. This allows future data packets with the same extracted fields to match the newly programmed entry in the policy cache 116 , avoiding another search of the central policy repository 100 . In step 416 , the central policy enforcement engine 120 proceeds to take the policy actions indicated in the matched policy rule.
- step 410 If there is no exact match of the conditions of a rule in the central policy repository 100 , a determination is made in step 410 whether a partial match exists. If the answer is YES, the central policy engine 106 proceeds to program the policy cache 116 in step 418 with the condition fields of the selected policy, the fields having the values of the corresponding extracted fields, and with a default action. In step 420 , the central policy enforcement engine 120 proceeds to take the default policy action.
- the central policy engine 106 proceeds to program the policy cache 116 , in step 412 , with minimal information needed to forward the packet.
- minimal information is a source address of the packet, a destination address of the packet, and a default policy action.
- the minimal necessary information is simply the destination address and the default policy action.
- the default policy action is enforced by the central policy enforcement engine 120 in step 420 .
- a first packet received by the central policy engine 106 includes the following fields extracted by the classification engine 104 :
- Source IP 192.200.200.200
- the central policy engine 106 compares the extracted information with entries in the policy cache 116 . Assuming for purposes of this example that this is a first packet processed by the central policy engine 106 , no entries are contained in the policy cache 116 .
- the central policy engine 106 then proceeds to search the central policy repository 100 for a match. Upon a finding of no match in the central policy repository 100 , the central policy engine programs the policy cache with a minimal amount of information needed to process and forward future similar packets. In one example, the central policy engine may program the policy cache with a source IP address, destination IP address, and a default action. The default action in this example is the assignment of a default priority.
- the entry placed in the policy cache is as follows:
- Source IP 192.200.200.200
- the central policy engine 106 next receives a packet that includes the following fields:
- Source IP 192.200.200.200
- the central policy engine 106 compares the extracted information with entries in the policy cache 116 . Upon a no match, the extracted information is compared against the rules in the central policy repository 100 . Rule 1 matches the packet's source IP address, destination IP address, and protocol. However, there is no match in the port information, resulting in a partial match with rule 1 .
- the central policy engine 106 determines the number of condition fields of the rule that resulted in the partial match.
- Rule 1 that resulted in the partial match includes four condition fields: source IP address, destination IP address, protocol and port.
- the entry placed in the fast path includes four condition fields although only the source IP and the destination IP are needed to forward future packets. The value of the four fields is based on the information extracted from the packet. Accordingly, the entry placed in the policy cache is as follows:
- Source IP 192.200.200.200
- a next packet received by the central policy engine 106 includes the following fields:
- Source IP 192.200.200.200
- the central policy engine 106 compares the extracted information with entries in the policy cache 116 and does not find a match. If, however, the policy cache had been programmed with less than four fields in processing the previous packet, a match would have resulted in the policy cache, causing the current packet to the forwarded without consulting the rules in the central policy repository.
- the central policy engine 106 proceeds to search the central policy repository 100 and finds an exact match with rule 1 . In determining the entry to be programmed in the policy cache, the central policy engine determines the number of condition fields in the rule that resulted in the exact match. The four condition fields of the matching rule 1 are then programmed into the policy cache. The value of the four fields is based on the information extracted from the packet.
- the entry placed in the policy cache is as follows:
- Source IP 192.200.200.200
- the central policy engine 106 next receives a packet that includes the following fields:
- Source IP 192.200.200.200
- the central policy engine 106 compares the extracted information with entries in the policy cache 116 and does not find a match. The central policy engine 106 then proceeds to search the rules in the central policy repository 100 and finds an exact match with Rule 2 .
- the fields in Rule 2 that resulted in the exact match are source IP address and destination IP address. Accordingly, the entry placed in the policy cache is as follows:
- Source IP 192.200.200.200
Abstract
A switching node configuring different traffic management protocols via a single centralized set of policies. The switching node includes a central policy repository, a central policy engine, and a central management engine. The central policy repository stores a single set of policies used to manage a plurality of different traffic management protocols in a consistent and predictable manner. The different traffic management protocols may include QoS, NAT, ACL, and the like. The central policy engine evaluates inbound traffic flows based on the policies in the central policy repository, and configures one or more traffic management protocol entities based on a selected policy. The management engine configures and manages the single set of policies via a common set of commands helping to eliminate the danger of creating conflicting policies that may lead to unpredictable results.
Description
- This application claims the benefit of U.S. provisional application No. 60/328,159, filed on Oct. 10, 2001, the content of which is incorporated herein by reference.
- The present invention relates generally to traffic control in a data communications network, and more particularly, to configuring different network protocols associated with traffic management via a single centralized set of policies.
- Policy based traffic control has become increasingly important in data communication networks as data traffic competes for limited bandwidth. Policy based traffic control generally involves separate, independent interfaces for configuring different traffic management protocols.
- FIG. 1 is a schematic block diagram of a
switching node 9 for policy based traffic control according to conventional mechanisms. The switching node includes separate,independent policy engines interfaces - In general terms, an inbound packet is processed by a first policy engine, such as, a QoS policy engine, for a matching policy. If a match is found, the matching policy is enforced and the packet is generally not processed by the other policy engines. If a match is not found, the packet is processed by a next policy engine for a match. Under existing technology, therefore, multiple actions from different policy engines are either impossible or difficult to perform for a specific traffic flow. It is often desirable, however, to be able to perform such multiple actions. For example, it may be desirable to invoke a NAT policy engine for address translation based on a source IP address while simultaneously invoking the QoS policy engine for assigning a QoS priority to the flow based on the same source address.
- Another problem with the current policy based traffic control is that the use of separate, independent interfaces for configuring the policies generally requires the network administrator to learn and use different command sequences for configuring and managing different policy engines. This may result in the configuration of conflicting policy rules that may lead to unpredictable results, especially if the configurations are done by different administrators or the same administrator at different times.
- Accordingly, there is a need for a mechanism for providing and applying a common and consistent set of policies to traffic flowing through a data communications network. The mechanism should allow a switching node to enforce a singe policy with multiple actions in a consistent manner.
- The present invention is directed to traffic management via a single centralized set of policies. According to one embodiment, the invention is directed to a switching node in a data communications network that includes an input, a repository, a policy engine, and a management engine. The repository stores a single set of policies for controlling a plurality of different traffic management protocols. The policy engine is coupled to the input and the repository, and is configured to evaluate an inbound packet based on a policy selected from the single set of policies, and configure one or more traffic management protocol entities based on the selected policy. The management engine is coupled to the repository and the policy engine. The management engine configures and manages the single set of policies via a common set of commands.
- According to another embodiment, the invention is directed to a method for policy based traffic management where the method includes storing in a repository a single set of policies for controlling a plurality of different traffic management protocols. The method includes receiving a first packet, retrieving a first policy from the repository where the first policy identifies a first action for configuring a traffic management protocol entity of a first protocol type, and configuring the traffic management protocol entity based on the first action. The method also includes receiving a second packet, retrieving a second policy from the repository where the second policy identifies a second action for configuring a traffic management protocol entity of a second protocol type, and configuring the traffic management protocol entity based on the second action.
- According to a further embodiment, the invention is directed to a method for policy based traffic management where the method includes storing in a repository a single set of policies for controlling a plurality of different traffic management protocols, receiving a packet, and retrieving a policy from the repository which identifies a first and second action for controlling traffic management protocol entities of a first and second protocol type. The method includes configuring the traffic management protocol entity of the first protocol type based on the first action and configuring the traffic management protocol of the second protocol type based on the second action.
- In an additional embodiment, the invention is directed to a method for policy based traffic management where the method includes storing in a repository a single set of policies for controlling a plurality of different traffic management protocols, receiving a packet, and searching a policy cache for a policy applicable to the packet. If the policy cache does not include an applicable policy, the method includes searching the repository for a match, and generating and storing a new policy in the policy cache. The new policy is selected as applicable to a future packet if the repository contains no other policies that are also applicable to a future packet but are different from the new policy.
- It should be appreciated, therefore, that the evaluation of traffic via a central policy engine allows the configuration of traffic management protocol entities of different protocol types, such as quality of service, access control, network address translation, and the like, in a consistent and predictable manner. The management of the policies via a common set of commands and the storage of the policies in a central repository help eliminate the creation and application of conflicting policies that could result in unpredictable results.
- These and other features, aspects and advantages of the present invention will be more fully understood when considered with respect to the following detailed description, appended claims, and accompanying drawings where:
- FIG. 1 is a schematic block diagram of a switching node for policy based traffic management according to conventional mechanisms;
- FIG. 2 is a schematic block diagram of a network environment including a packet switching node according to one embodiment of the invention;
- FIG. 3 is a block diagram of a switching interface in one embodiment of the present invention;
- FIG. 4 is a schematic block diagram of the packet switching controller providing and applying a common, centralized set of simple policies for controlling a plurality of traffic management protocols according to one embodiment of the invention;
- FIG. 5 is a more detailed diagram of the switching controller of FIG. 4 according to one embodiment of the invention;
- FIG. 6 is a conceptual layout diagram of various types of policy objects provided by a central management engine for creating a centralized set of policies according to one embodiment of the invention;
- FIG. 7 is a conceptual layout diagram of a central policy repository according to one embodiment of the invention; and
- FIG. 8 is a flow diagram of a central policy based traffic management according to one embodiment of the invention.
- FIG. 2 is a schematic block diagram of a network environment including a
packet switching node 10 according to one embodiment of the invention. The packet switching node may also be referred to as a switch, a data communication node or a data communication switch. Thepacket switching node 10 includesswitching interfaces LANs data paths switching backplane 12. The switchingbackplane 12 preferably includes switching fabric. The switching interfaces may also be coupled to one another overcontrol paths - The
switching interfaces LANs switching node 10 is shown for illustrative purposes only. In practice, packet switching nodes may include more or less than three switching interfaces. - FIG. 3 is a block diagram of a
switching interface 50 in one embodiment of the present invention. Theswitching interface 50 may be similar, for example, to theswitching interfaces switching interface 50 includes anaccess controller 54 coupled between LANs and apacket switching controller 52. Theaccess controller 54, which may, for example, include a media access controller (MAC), preferably receives inbound packets off LANs, performs flow-independent physical and MAC layer operations on the inbound packets and transmits the inbound packets to thepacket switching controller 52 for flow-dependent processing. Theaccess controller 54 also receives outbound packets from thepacket switching controller 52 and transmits the packets on LANs. Theaccess controller 54 may also perform physical and MAC layer operations on the outbound packets prior to transmitting them on LANs. - The
packet switching controller 52 receives inbound packets, classifies the packets, modifies the packets in accordance with flow information and transmits the modified packets on switching backplane, such as the switchingbackplane 12 of FIG. 2. Thepacket switching controller 52 preferably also receives packets modified by other packet switching controllers via the switching backplane and transmits them to theaccess controller 54 for forwarding on LANs. Thepacket switching controller 52 may also subject selected ones of the packets to egress processing prior to transmitting them to theaccess controller 54 for forwarding on LANs. - FIG. 4 is a schematic block diagram of the
packet switching controller 52 providing and applying a common, centralized set of simple policies for coordinating a plurality of traffic management protocols, such as, for example, access control, address translation, server load balancing, quality of service, and the like. The switchingcontroller 52 includes acentral policy engine 56 coupled to acentral management engine 58. Thecentral policy engine 56 evaluates the traffic flow against the centralized set of policies to perform, from a central location, one or more policy actions typically performed by separate, independent policy engines. The centralized set of policies include, but are not limited to system policies, network policies, access policies, services policies, and the like. The one or more actions include, but are not limited to packet filtering, packet prioritizing, address translation, server load balance group assignment, and assignment of 802.1p. TOS, or DSCP values. - The
central management engine 58 may include software and/or hardware components to enable a network administrator to configure and manage the centralized set of policies. With thecentral management engine 58, the network administrator may, from a single location and using a common set of commands, create policies that manage different traffic management protocols. - FIG. 5 is a more detailed diagram of the switching
controller 52 according to one embodiment of the invention. The switching controller includes apacket buffer 102,packet classification engine 104,central policy engine 106, centralpolicy enforcement engine 120,central policy repository 100, andcentral management engine 107. Thepacket classification engine 104,central policy engine 106, centralpolicy enforcement engine 120, and centralpolicy management engine 107 are logical devices that may be implemented in software, hardware, firmware (e.g. ASIC), or any combination thereof. It is understood, of course, that FIG. 5 illustrates a block diagram of the packet switching controller without obfuscating inventive aspects of the present invention with additional elements and/or components that may be required for creating the controller. These additional elements and/or components, which are not shown in FIG. 5 are well known to those skilled in the art. - The switching
controller 52 receivesinbound packets 108. The packets may include, but are not limited to, Ethernet frames, ATM cells, TCP/IP and/or UDP/IP packets, and may also include other Layer 2 (Data Link/MAC Layer), Layer 3 (Network Layer) or Layer 4 (Transport Layer) data units. - The received packets are stored in the
packet buffer 102. Thepacket buffer 102 provides viaoutput signal 110 the stored packets or portions thereof to thepacket classification engine 104 for processing. - The
packet classification engine 104 may include one or more of a data extractor and a data cache. In an alternative embodiment, the data extractor and data cache are provided within thepacket buffer 102. - The data extractor is used to extract one or more fields from the packets, and to store the extracted fields in the data cache as extracted data. The extracted data may include, but is not limited to, some or all of the packet header. For example, the extracted data may include, but are not limited to, one or more of
Layer 2 MAC addresses, 802.1P/Q tag status,Layer 2 encapsulation type,Layer 3 protocol type,Layer 3 addresses, ToS (type of service) values,Layer 4 port numbers, portions of the packet body, and/or any other data used for determining a policy. - The extracted data is transmitted to the
central policy engine 106 via anoutput signal 112. Thecentral policy engine 106 may be similar to thecentral policy engine 56 of FIG. 4. - The
central policy engine 106 accesses either aninternal policy cache 116 or thecentral policy repository 100 for selecting a policy applicable to the packet. In accessing thecentral policy repository 100, thecentral policy engine 106 communicates with the repository using protocols such as, for example, LDAP. - According to one embodiment of the invention, the
policy cache 116 includes sufficient information for applying policies to existing traffic flows without having to process the entire list of policies in thecentral policy repository 100 for every packet in the traffic flow. The information in thepolicy cache 116 is specific enough to prevent packets for which a different applicable rule may exist in thecentral policy repository 100 to be processed by thepolicy cache 116. - The
central policy repository 100 may be implemented in a local memory and/or an external directory server with Lightweight Directory Access Protocol (LDAP) access. Thecentral policy repository 100 includes a list of policies that are based on the contents of a packet and/or other elements such as, for example, time information, port information, and the like. In general terms, policies are rules composed of one or more conditions that describe a packet and one or more actions defining how the packet is to be processed if the condition is satisfied. - The
central policy engine 106 compares the extracted packet data with either the policies in thepolicy cache 116 orcentral policy repository 100. If a match is found between the condition(s) in the policy and the extracted data, the policy engine determines the action(s) to be taken on the packet. The action(s) to be taken on the packet are transmitted to the centralpolicy enforcement engine 120 via anoutput signal 117. - The central
policy enforcement engine 120 ensures that the packet is processed according to the parameters defined in the action(s). In this regard, the centralpolicy enforcement engine 120 interacts with other hardware and software elements in the switchingnode 30 for causing a desired processing of the packet. For example, if the policy actions specify that the packet is to be transmitted at a high priority, thepolicy enforcement engine 120 may direct thepacket buffer 102 to place the packet in a high priority queue of an egress port. - The
central management engine 107 of FIG. 5 may be similar to thecentral management engine 58 of FIG. 4. Theengine 107 may be either a dedicated console or part of a network management console. A network administrator accesses thecentral management engine 107 for configuring and managing the policies in thecentral policy repository 100 and thecentral policy engine 106. According to one embodiment, thecentral management engine 107 provides a graphical user interface that provides a common set of commands and tools for configuring and managing polices that control different network elements such as, for example, QoS, NAT, ACL, and the like. Thecentral management engine 107 also allows a network administrator to test policies before they are applied. - FIG. 6 is a conceptual layout diagram of various types of policy objects provided by the
central management engine 107 for creating the centralized set of policies according to one embodiment of the invention. In the illustrated embodiment, the policy objects includerule 200 objects,condition 202 objects,action 204 objects,service 206 objects, andgroup 208 objects.Rules 200 are top levelobjects including conditions 202 andactions 204. According to one embodiment, rules are provided precedence values indicative of an order in which the rules are to be applied. -
Conditions 202 are parameters used to classify traffic, andactions 204 are parameters describing how to treat the classified traffic. Acondition 202 may include aservice 206 and/or agroup 208. Apolicy service 206 may be used as a shorthand for certain parts of a condition. According to one embodiment, apolicy service 206 is defined by a service name, an IP protocol, a source IP port, and/or a destination IP port. For example, a “video” service may be defined as being associated with a “UDP” protocol and destination IP port number “4500.” In another example, a “telnet” service may be defined as being associated with a “TCP” protocol and destination IP port number “23.” - A
policy group 208 may be defined by a list of IP/MAC addresses, ports, or services. Policy groups allow a network administrator to define conditions for a group of address, ports, or services, instead of creating a separate condition for each address, port, or service. For example, an “engineering” group may be defined as a set of particular IP addresses. A “basic services” group may be defined as a set of particular services such as telnet, FTP, HTTP, and Sendmail. - According to one embodiment of the invention, the
central management engine 107 allows the creation of policies defining multiple actions for managing different traffic management protocols. For example, a policy in thecentral policy repository 100 may indicate that traffic with a particular source address and a particular destination address is to have the source address translated and receive a high priority. Thus, two different actions, a NAT policy action and a QoS policy action, may be defined via a single policy rule. FIG. 7 is a conceptual layout diagram of thecentral policy repository 100 according to one embodiment of the invention. In this illustrated embodiment, the repository includes a policy table 300 including a list of simple policy rules 302. Associated with each policy rule are aprecedence number 304,condition 306, andaction 308. Theprecedence number 304 indicates an order in which the rules are to be applied. If traffic matches more than one rule, thecentral policy engine 106 uses the rule with the highest precedence. In the illustrated embodiment,rule 4 is not matched since it is a subset, or more specific, than thehigher precedence rule 2. The precedence ordering of the rules helps eliminate any rule conflicts and ensures that the results of evaluating a traffic flow against the policies is predictable and consistent. - The
condition 306 for each rule defines parameters used for classifying inbound packets. These parameters include but are not limited to individual source addresses or source address groups, individual destination addresses or destination groups, andindividual IP protocols 306 e,individual IP ports 306 d, orpolicy service groups 306 c. - The
action 308 for each rule defines one or more operations to be performed on the packet and/or traffic management protocol entities. Theaction 308 may be a filtering action, such as for example, dropping or admitting a packet. Theaction 308 may also be a QoS action such as, for example, assigning a priority to the packet. Theaction 308 may further be server load balancing, source or destination address translation, mapping or marking 802.1P, TOS, or DSCP values, or a combination of any of the discussed actions. - FIG. 8 is a flow diagram of a central policy based traffic control according to one embodiment of the invention. The process starts, and in
step 400, thepacket buffer 102 receives an inbound data packet and stores the packet in the buffer. Instep 402, thepacket classification engine 104 extracts one or more fields from the packets. Instep 404, thecentral policy engine 106 determines whether the policy cache contains entries that match the extracted fields of the packet. If the answer in YES, the centralpolicy enforcement engine 120 ensures that the policy action indicated in the matched entry of the policy cache is enforced. - If no match exists in the
policy cache 116, thecentral policy engine 106 determines instep 408 whether there is an exact match of the extracted fields with conditions of a rule in thecentral policy repository 100. If the answer is YES, the central policy engine proceeds to program, instep 414, thepolicy cache 116 with the condition fields of the matched policy, the fields having the values of the corresponding extracted fields. This allows future data packets with the same extracted fields to match the newly programmed entry in thepolicy cache 116, avoiding another search of thecentral policy repository 100. Instep 416, the centralpolicy enforcement engine 120 proceeds to take the policy actions indicated in the matched policy rule. - If there is no exact match of the conditions of a rule in the
central policy repository 100, a determination is made instep 410 whether a partial match exists. If the answer is YES, thecentral policy engine 106 proceeds to program thepolicy cache 116 instep 418 with the condition fields of the selected policy, the fields having the values of the corresponding extracted fields, and with a default action. Instep 420, the centralpolicy enforcement engine 120 proceeds to take the default policy action. - If the search of the
central policy repository 100 does not result in even a partial match of the rules, thecentral policy engine 106 proceeds to program thepolicy cache 116, instep 412, with minimal information needed to forward the packet. According to one embodiment of the invention, such minimal information is a source address of the packet, a destination address of the packet, and a default policy action. In another embodiment of the invention, the minimal necessary information is simply the destination address and the default policy action. The default policy action is enforced by the centralpolicy enforcement engine 120 instep 420. - The programming of the
policy cache 116 will be best understood when considering the following example. Assume that thecentral policy repository 100 includes the rules depicted in FIG. 7. - A first packet received by the
central policy engine 106 includes the following fields extracted by the classification engine 104: - Source IP—192.200.200.200
- Destination IP—10.5.3.4
- Protocol—TCP
- Port—80 (HTTP)
- The
central policy engine 106 compares the extracted information with entries in thepolicy cache 116. Assuming for purposes of this example that this is a first packet processed by thecentral policy engine 106, no entries are contained in thepolicy cache 116. - The
central policy engine 106 then proceeds to search thecentral policy repository 100 for a match. Upon a finding of no match in thecentral policy repository 100, the central policy engine programs the policy cache with a minimal amount of information needed to process and forward future similar packets. In one example, the central policy engine may program the policy cache with a source IP address, destination IP address, and a default action. The default action in this example is the assignment of a default priority. The entry placed in the policy cache is as follows: - Source IP—192.200.200.200
- Destination IP—10.5.3.4
- Action—0 (best effort priority)
- The
central policy engine 106 next receives a packet that includes the following fields: - Source IP—192.200.200.200
- Destination IP—192.168.1.1
- Protocol—TCP
- Port—80 (HTTP)
- The
central policy engine 106 compares the extracted information with entries in thepolicy cache 116. Upon a no match, the extracted information is compared against the rules in thecentral policy repository 100.Rule 1 matches the packet's source IP address, destination IP address, and protocol. However, there is no match in the port information, resulting in a partial match withrule 1. - In determining an entry for the policy cache, the
central policy engine 106 ensures that the entry is specific enough to prevent packets for which a different applicable rule may exist in thecentral policy repository 100 to be processed by the policy cache. In this regard, thecentral policy engine 106 determines the number of condition fields of the rule that resulted in the partial match.Rule 1 that resulted in the partial match includes four condition fields: source IP address, destination IP address, protocol and port. Thus, the entry placed in the fast path includes four condition fields although only the source IP and the destination IP are needed to forward future packets. The value of the four fields is based on the information extracted from the packet. Accordingly, the entry placed in the policy cache is as follows: - Source IP—192.200.200.200
- Destination IP—192.168.1.1
- Protocol—TCP
- Port—80 (HTTP)
- Action—0 (best effort priority)
- A next packet received by the
central policy engine 106 includes the following fields: - Source IP—192.200.200.200
- Destination IP—192.168.1.1
- Protocol—TCP
- Port—21 (FTP)
- The
central policy engine 106 compares the extracted information with entries in thepolicy cache 116 and does not find a match. If, however, the policy cache had been programmed with less than four fields in processing the previous packet, a match would have resulted in the policy cache, causing the current packet to the forwarded without consulting the rules in the central policy repository. - The
central policy engine 106 proceeds to search thecentral policy repository 100 and finds an exact match withrule 1. In determining the entry to be programmed in the policy cache, the central policy engine determines the number of condition fields in the rule that resulted in the exact match. The four condition fields of thematching rule 1 are then programmed into the policy cache. The value of the four fields is based on the information extracted from the packet. The entry placed in the policy cache is as follows: - Source IP—192.200.200.200
- Destination IP—192.168.1.1
- Protocol—TCP
- Port—21 (FTP)
- Action—7 (high priority)
- The
central policy engine 106 next receives a packet that includes the following fields: - Source IP—192.200.200.200
- Destination IP—192.168.2.2
- Protocol—UDP
- Port—300
- The
central policy engine 106 compares the extracted information with entries in thepolicy cache 116 and does not find a match. Thecentral policy engine 106 then proceeds to search the rules in thecentral policy repository 100 and finds an exact match withRule 2. The fields inRule 2 that resulted in the exact match are source IP address and destination IP address. Accordingly, the entry placed in the policy cache is as follows: - Source IP—192.200.200.200
- Destination IP—192.168.2.2
- Action—7 (high priority)
- Although this invention has been described in certain specific embodiments, those skilled in the art will have no difficulty devising variations which in no way depart from the scope and spirit of the present invention. It is therefore to be understood that this invention may be practiced otherwise than is specifically described. Thus, the present embodiments of the invention should be considered in all respects as illustrative and not restrictive, the scope of the invention to be indicated by the appended claims and their equivalents rather than the foregoing description.
Claims (26)
1. A switching node in a data communications network, the switching node comprising:
an input receiving an inbound packet;
a repository storing a single set of policies for controlling a plurality of different traffic management protocols;
a policy engine coupled to the input and the repository, the policy engine evaluating the packet based on a policy selected from the single set of policies and configuring one or more traffic management protocol entities based on the selected policy; and
a management engine coupled to the repository and the policy engine, the management engine configuring and managing the single set of policies via a common set of commands.
2. The switching node of claim 1 , wherein the single set of policies includes a policy identifying two or more actions for controlling two or more traffic management protocols.
3. The switching node of claim 1 , wherein the single set of policies includes a first policy identifying a first action for controlling a first traffic management protocol and a second policy identifying a second action for controlling a second traffic management protocol.
4. The switching node of claim 1 , wherein one of the traffic management protocols is quality of service.
5. The switching node of claim 1 , wherein one of the traffic management protocols is access control.
6. The switching node of claim 1 , wherein one of the traffic management protocols is address translation.
7. The switching node of claim 1 further comprising a policy cache coupled to the repository and the policy engine for storing a plurality of cached policies.
8. The switching node of claim 7 , wherein the policy engine is configured to evaluate the packet based on the plurality of cached policies prior to evaluating the packet based on the policies in the repository.
9. The switching node of claim 8 , wherein the central policy engine selects a cached policy as applicable to the packet if no other policies are stored in the repository that are also applicable to the packet but are different from the selected cached policy.
10. The switching node of claim 8 , wherein if no match of a policy is found in the repository, the policy engine is configured to store in the policy cache a policy having a destination address of the packet and a default action.
11. The switching node of claim 8 , wherein if a partial match of a policy is found in the repository, the policy engine is configured to store in the policy cache a policy having condition fields of the policy in the repository where the values of the condition fields are obtained from the packet, and a default action.
12. The switching node of claim 8 , wherein if a complete match of a policy is found in the repository, the policy engine is configured to store in the policy cache a policy having condition fields of the policy in the repository where the values of the condition fields are obtained from the packet, and an action indicated by the policy in the repository.
13. A method for policy based traffic management comprising:
storing in a repository a single set of policies for controlling a plurality of different traffic management protocols;
receiving a first packet;
retrieving a first policy from the repository, the first policy identifying a first action for configuring a traffic management protocol entity of a first protocol type;
configuring the traffic management protocol of the first protocol type based on the first action;
receiving a second packet;
retrieving a second policy from the repository, the second policy identifying a second action for configuring a traffic management protocol entity of a second protocol type; and
configuring the traffic management protocol entity of the second protocol type based on the second action.
14. The method of claim 13 , wherein one of the traffic management protocols is quality of service.
15. The method of claim 13 , wherein one of the traffic management protocols is access control.
16. The method of claim 13 , wherein one of the traffic management protocols is address translation.
17. The method of claim 13 further comprising managing the single set of policies via a common set of commands.
18. A method for policy based traffic management comprising:
storing in a repository a single set of policies for controlling a plurality of different traffic management protocols;
receiving a packet;
retrieving a policy from the repository, the policy identifying a first and second action for controlling a first and second traffic management protocol entity, respectively, of a first and second protocol type, respectively;
configuring the first traffic management protocol entity based on the first action; and
configuring the second traffic management protocol entity based on the second action.
19. The method of claim 18 , wherein one of the traffic management protocols is quality of service.
20. The method of claim 18 , wherein one of the traffic management protocols is access control.
21. The method of claim 18 , wherein one of the traffic management protocols is address translation.
22. The method of claim 18 further comprising managing the single set of policies via a common set of commands.
23. A method for policy based traffic management comprising:
storing in a repository a single set of policies for controlling a plurality of different traffic management protocols;
receiving a packet;
searching a policy cache for a policy applicable to the packet;
searching the repository if the policy cache does not include an applicable policy; and
generating and storing a new policy in the policy cache, wherein if the new policy is selected as applicable to a future packet, no policies are stored in the repository that are also applicable to the future packet but are different from the new policy.
24. The method of claim 23 , wherein if no match of a policy is found in the repository, the policy generated and stored in the policy cache includes a destination address of the packet and a default action.
25. The method of claim 23 , wherein if a partial match of a policy is found in the repository, the policy generated and stored in the policy cache includes condition fields of the policy in the repository where the values of the condition fields are obtained from the packet, and a default action.
26. The method of claim 23 , wherein if a complete match of a policy is found in the repository, the policy generated and stored in the policy cache includes condition fields of the policy in the repository where the values of the condition fields are obtained from the packet, and an action indicated by the policy in the repository.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/127,167 US20030067874A1 (en) | 2001-10-10 | 2002-04-22 | Central policy based traffic management |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US32815901P | 2001-10-10 | 2001-10-10 | |
US10/127,167 US20030067874A1 (en) | 2001-10-10 | 2002-04-22 | Central policy based traffic management |
Publications (1)
Publication Number | Publication Date |
---|---|
US20030067874A1 true US20030067874A1 (en) | 2003-04-10 |
Family
ID=23279762
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/127,167 Abandoned US20030067874A1 (en) | 2001-10-10 | 2002-04-22 | Central policy based traffic management |
US10/264,786 Expired - Fee Related US7339942B2 (en) | 2001-10-10 | 2002-10-04 | Dynamic queue allocation and de-allocation |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/264,786 Expired - Fee Related US7339942B2 (en) | 2001-10-10 | 2002-10-04 | Dynamic queue allocation and de-allocation |
Country Status (4)
Country | Link |
---|---|
US (2) | US20030067874A1 (en) |
EP (2) | EP1303079B1 (en) |
AT (2) | ATE350831T1 (en) |
DE (2) | DE60217253T2 (en) |
Cited By (69)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030115347A1 (en) * | 2001-12-18 | 2003-06-19 | Gilbert Wolrich | Control mechanisms for enqueue and dequeue operations in a pipelined network processor |
US20040243835A1 (en) * | 2003-05-28 | 2004-12-02 | Andreas Terzis | Multilayer access control security system |
WO2004107131A2 (en) * | 2003-05-28 | 2004-12-09 | Caymas Systems, Inc. | Policy based network address translation |
US20040255154A1 (en) * | 2003-06-11 | 2004-12-16 | Foundry Networks, Inc. | Multiple tiered network security system, method and apparatus |
US20050025125A1 (en) * | 2003-08-01 | 2005-02-03 | Foundry Networks, Inc. | System, method and apparatus for providing multiple access modes in a data communications network |
US20050055570A1 (en) * | 2003-09-04 | 2005-03-10 | Foundry Networks, Inc. | Multiple tiered network security system, method and apparatus using dynamic user policy assignment |
US20050076138A1 (en) * | 2003-10-07 | 2005-04-07 | Alcatel | Access control listing mechanism for routers |
US20050177869A1 (en) * | 2004-02-10 | 2005-08-11 | Savage James A. | Firewall permitting access to network based on accessing party identity |
US20050198246A1 (en) * | 2004-03-08 | 2005-09-08 | Daniel Kegel | Simulating a large number of users |
US20050268146A1 (en) * | 2004-05-14 | 2005-12-01 | International Business Machines Corporation | Recovery in a distributed stateful publish-subscribe system |
US20060070131A1 (en) * | 2004-09-30 | 2006-03-30 | Citrix Systems, Inc. | Method and apparatus for providing authorized remote access to application sessions |
US20060174115A1 (en) * | 2005-01-28 | 2006-08-03 | Goutham Rao | Method and system for verification of an endpoint security scan |
US20060182100A1 (en) * | 2005-02-11 | 2006-08-17 | Microsoft Corporation | Automated NAT traversal for peer-to-peer networks |
US20060190455A1 (en) * | 2004-09-30 | 2006-08-24 | Braddy Ricky G | Method and system for assigning access control levels in providing access to networked content files |
US20060195547A1 (en) * | 2004-12-30 | 2006-08-31 | Prabakar Sundarrajan | Systems and methods for providing client-side accelerated access to remote applications via TCP multiplexing |
WO2007033782A1 (en) | 2005-09-20 | 2007-03-29 | Rohde & Schwarz Gmbh & Co. Kg | Communications network, network node device and method including a local transmission of encrypted service quality-relevant information |
US20070124433A1 (en) * | 2005-11-30 | 2007-05-31 | Microsoft Corporation | Network supporting centralized management of QoS policies |
US20070124485A1 (en) * | 2005-11-30 | 2007-05-31 | Microsoft Corporation | Computer system implementing quality of service policy |
US20070160079A1 (en) * | 2006-01-06 | 2007-07-12 | Microsoft Corporation | Selectively enabled quality of service policy |
US20070189185A1 (en) * | 2006-02-14 | 2007-08-16 | Weishan Chen | Method for selecting QoS policy and system thereof |
US20070199064A1 (en) * | 2006-02-23 | 2007-08-23 | Pueblas Martin C | Method and system for quality of service based web filtering |
US20070266158A1 (en) * | 2003-06-17 | 2007-11-15 | International Business Machines Corporation | Security checking program for communication between networks |
US20070282982A1 (en) * | 2006-06-05 | 2007-12-06 | Rhonda Childress | Policy-Based Management in a Computer Environment |
US20070283144A1 (en) * | 2006-06-02 | 2007-12-06 | Kramer David B | System and Method for Implementing ACLs Using Standard LPM Engine |
US20080109912A1 (en) * | 2006-11-08 | 2008-05-08 | Citrix Systems, Inc. | Method and system for dynamically associating access rights with a resource |
US20080144502A1 (en) * | 2006-12-19 | 2008-06-19 | Deterministic Networks, Inc. | In-Band Quality-of-Service Signaling to Endpoints that Enforce Traffic Policies at Traffic Sources Using Policy Messages Piggybacked onto DiffServ Bits |
US20080209440A1 (en) * | 2004-05-07 | 2008-08-28 | Roman Ginis | Distributed messaging system supporting stateful subscriptions |
US20080225753A1 (en) * | 2007-03-12 | 2008-09-18 | Prakash Khemani | Systems and methods for configuring handling of undefined policy events |
US20080225722A1 (en) * | 2007-03-12 | 2008-09-18 | Prakash Khemani | Systems and methods for configuring policy bank invocations |
US20080225720A1 (en) * | 2007-03-12 | 2008-09-18 | Prakash Khemani | Systems and methods for configuring flow control of policy expressions |
US20080225719A1 (en) * | 2007-03-12 | 2008-09-18 | Vamsi Korrapati | Systems and methods for using object oriented expressions to configure application security policies |
US20080229381A1 (en) * | 2007-03-12 | 2008-09-18 | Namit Sikka | Systems and methods for managing application security profiles |
US20080239951A1 (en) * | 2006-06-27 | 2008-10-02 | Robert Evan Strom | Method for applying stochastic control optimization for messaging systems |
US20080244025A1 (en) * | 2004-05-07 | 2008-10-02 | Roman Ginis | Continuous feedback-controlled deployment of message transforms in a distributed messaging system |
US7437473B2 (en) * | 2001-06-18 | 2008-10-14 | Softshield, Llc | Packet switch and method thereof dependent on application content |
US7516487B1 (en) | 2003-05-21 | 2009-04-07 | Foundry Networks, Inc. | System and method for source IP anti-spoofing security |
US7523485B1 (en) | 2003-05-21 | 2009-04-21 | Foundry Networks, Inc. | System and method for source IP anti-spoofing security |
US20090141737A1 (en) * | 2007-11-30 | 2009-06-04 | Texas Instruments Incorporated | Systems and methods for prioritized channel access hardware assistance design |
US20090316711A1 (en) * | 2008-06-24 | 2009-12-24 | Intel Corporation | Packet switching |
US7748032B2 (en) | 2004-09-30 | 2010-06-29 | Citrix Systems, Inc. | Method and apparatus for associating tickets in a ticket hierarchy |
US7774833B1 (en) | 2003-09-23 | 2010-08-10 | Foundry Networks, Inc. | System and method for protecting CPU against remote access attacks |
WO2010132061A1 (en) | 2009-05-15 | 2010-11-18 | Hewlett-Packard Development Company, L. P. | A method and apparatus for policy enforcement using a tag |
US7865589B2 (en) | 2007-03-12 | 2011-01-04 | Citrix Systems, Inc. | Systems and methods for providing structured policy expressions to represent unstructured data in a network appliance |
US8255456B2 (en) | 2005-12-30 | 2012-08-28 | Citrix Systems, Inc. | System and method for performing flash caching of dynamically generated objects in a data communication network |
US8261057B2 (en) | 2004-06-30 | 2012-09-04 | Citrix Systems, Inc. | System and method for establishing a virtual private network |
US8291119B2 (en) | 2004-07-23 | 2012-10-16 | Citrix Systems, Inc. | Method and systems for securing remote access to private networks |
US8301839B2 (en) | 2005-12-30 | 2012-10-30 | Citrix Systems, Inc. | System and method for performing granular invalidation of cached dynamically generated objects in a data communication network |
US8351333B2 (en) | 2004-07-23 | 2013-01-08 | Citrix Systems, Inc. | Systems and methods for communicating a lossy protocol via a lossless protocol using false acknowledgements |
US8495305B2 (en) | 2004-06-30 | 2013-07-23 | Citrix Systems, Inc. | Method and device for performing caching of dynamically generated objects in a data communication network |
US8499057B2 (en) | 2005-12-30 | 2013-07-30 | Citrix Systems, Inc | System and method for performing flash crowd caching of dynamically generated objects in a data communication network |
US8528071B1 (en) | 2003-12-05 | 2013-09-03 | Foundry Networks, Llc | System and method for flexible authentication in a data communications network |
US8559449B2 (en) | 2003-11-11 | 2013-10-15 | Citrix Systems, Inc. | Systems and methods for providing a VPN solution |
US20140044111A1 (en) * | 2012-08-08 | 2014-02-13 | Broadcom Coporation | Frame Chaining for Bridged Traffic |
US8700695B2 (en) | 2004-12-30 | 2014-04-15 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP pooling |
US8706877B2 (en) | 2004-12-30 | 2014-04-22 | Citrix Systems, Inc. | Systems and methods for providing client-side dynamic redirection to bypass an intermediary |
US20140129705A1 (en) * | 2003-07-10 | 2014-05-08 | Eric David O'Brien | Security network processor system and method |
US8739274B2 (en) | 2004-06-30 | 2014-05-27 | Citrix Systems, Inc. | Method and device for performing integrated caching in a data communication network |
US20140165133A1 (en) * | 2012-12-08 | 2014-06-12 | International Business Machines Corporation | Method for Directing Audited Data Traffic to Specific Repositories |
US20140280902A1 (en) * | 2013-03-15 | 2014-09-18 | Google Inc. | IP Allocation Pools |
US8856777B2 (en) | 2004-12-30 | 2014-10-07 | Citrix Systems, Inc. | Systems and methods for automatic installation and execution of a client-side acceleration program |
US8954595B2 (en) | 2004-12-30 | 2015-02-10 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP buffering |
US20150142948A1 (en) * | 2013-11-15 | 2015-05-21 | F5 Networks, Inc. | Extending policy rulesets with scripting |
WO2015126845A1 (en) * | 2014-02-18 | 2015-08-27 | F5 Networks, Inc. | Concurrent evaluation of large rule sets with conditions |
US20160021572A1 (en) * | 2014-07-17 | 2016-01-21 | Brocade Communications Systems, Inc. | Method and system for optimized load balancing across distributed data plane processing entities for mobile core network |
US20160219131A1 (en) * | 2007-04-11 | 2016-07-28 | Palo Alto Networks, Inc. | L2/l3 multi-mode switch including policy processing |
WO2016180191A1 (en) * | 2015-05-11 | 2016-11-17 | Huawei Technologies Co., Ltd. | Localized traffic flow management in a wireless network |
US9692705B1 (en) * | 2013-12-06 | 2017-06-27 | Google Inc. | System and method for measurement of flow statistics |
US20170195241A1 (en) * | 2009-03-30 | 2017-07-06 | Nec Corporation | Communication flow control system, communication flow control method, and communication flow processing program |
US20220271939A1 (en) * | 2021-02-25 | 2022-08-25 | Booz Allen Hamilton Inc. | Controlling power states and operation of mobile computing devices |
Families Citing this family (83)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7586944B2 (en) * | 2002-08-30 | 2009-09-08 | Hewlett-Packard Development Company, L.P. | Method and system for grouping clients of a storage area network according to priorities for bandwidth allocation |
US8060643B2 (en) * | 2002-08-30 | 2011-11-15 | Hewlett-Packard Development Company, L.P. | Method and apparatus for dynamically managing bandwidth for clients in a storage area network |
US7080126B2 (en) * | 2003-02-28 | 2006-07-18 | Bea Systems, Inc. | Computer program product for performing resource pool maintenance by maintaining resources in several deques |
US7263554B2 (en) | 2003-02-28 | 2007-08-28 | Bea Systems, Inc. | Method and system for performing resource pool maintenance by refreshing resources based on the pool resource test |
EP1455488B1 (en) * | 2003-03-07 | 2006-06-07 | Telefonaktiebolaget LM Ericsson (publ) | System and method for providing differentiated services |
US7633935B2 (en) * | 2003-05-29 | 2009-12-15 | Ericsson Ab | Dynamic port updating |
US20040264472A1 (en) * | 2003-06-27 | 2004-12-30 | Oliver Neal C. | Method and system for open-loop congestion control in a system fabric |
US7412536B2 (en) * | 2003-06-27 | 2008-08-12 | Intel Corporation | Method and system for a network node for attachment to switch fabrics |
EP1665663B1 (en) * | 2003-08-25 | 2012-05-30 | Cisco Technology, Inc. | A scalable approach to large scale queuing through dynamic resource allocation |
US8199764B2 (en) | 2003-08-25 | 2012-06-12 | Cisco Technology, Inc. | Scalable approach to large scale queuing through dynamic resource allocation |
US7835294B2 (en) * | 2003-09-03 | 2010-11-16 | Gary Stephen Shuster | Message filtering method |
DE10356128A1 (en) * | 2003-12-02 | 2005-06-30 | Robert Bosch Gmbh | Network Bridge |
US20050128945A1 (en) * | 2003-12-11 | 2005-06-16 | Chen-Chi Kuo | Preventing a packet associated with a blocked port from being placed in a transmit buffer |
US7349337B1 (en) | 2003-12-12 | 2008-03-25 | Novell, Inc. | Techniques for shaping data transmission rates |
DE10360210A1 (en) * | 2003-12-20 | 2005-07-28 | Robert Bosch Gmbh | Network Bridge |
US7546367B2 (en) * | 2004-01-15 | 2009-06-09 | Novell, Inc. | Methods and systems for managing network traffic by multiple constraints |
JP2005333434A (en) * | 2004-05-20 | 2005-12-02 | Matsushita Electric Ind Co Ltd | Radio module |
US7369495B1 (en) * | 2004-09-07 | 2008-05-06 | Juniper Networks, Inc. | Method and apparatus for shared shaping |
US7417953B2 (en) * | 2004-11-01 | 2008-08-26 | Alcatel Lucent | Port re-enabling by monitoring link status |
KR100689732B1 (en) | 2004-12-17 | 2007-03-08 | 한국전자통신연구원 | A wireless resource management structure for managing the L2 traffic, and a method thereof |
KR100651435B1 (en) * | 2005-02-19 | 2006-11-29 | 삼성전자주식회사 | Adaptive queue mechanism for efficient real-time packet transfer and adaptive queue establishment system thereof |
EP1705839A1 (en) * | 2005-03-23 | 2006-09-27 | Siemens Aktiengesellschaft | Guaranteed bandwidth end-to-end services in bridged networks |
US8488458B1 (en) * | 2005-06-28 | 2013-07-16 | Marvell International Ltd. | Secure unauthenticated virtual local area network |
US20070133546A1 (en) * | 2005-12-08 | 2007-06-14 | Electronics & Telecommunications Research Institute | Method for providing QoS using address system and system resolution protocol |
KR100850353B1 (en) | 2005-12-08 | 2008-08-04 | 한국전자통신연구원 | Method of providing QoS using address system and address resolution protocol |
US8149695B2 (en) * | 2005-12-22 | 2012-04-03 | Avaya Holdings Limited | Dynamic queue instantiation |
US20080037553A1 (en) * | 2005-12-22 | 2008-02-14 | Bellsouth Intellectual Property Corporation | Systems and methods for allocating bandwidth to ports in a computer network |
US8149708B2 (en) * | 2006-04-20 | 2012-04-03 | Cisco Technology, Inc. | Dynamically switching streams of packets among dedicated and shared queues |
US7760748B2 (en) | 2006-09-16 | 2010-07-20 | Mips Technologies, Inc. | Transaction selector employing barrel-incrementer-based round-robin apparatus supporting dynamic priorities in multi-port switch |
US7773621B2 (en) * | 2006-09-16 | 2010-08-10 | Mips Technologies, Inc. | Transaction selector employing round-robin apparatus supporting dynamic priorities in multi-port switch |
US7990989B2 (en) * | 2006-09-16 | 2011-08-02 | Mips Technologies, Inc. | Transaction selector employing transaction queue group priorities in multi-port switch |
US7961745B2 (en) * | 2006-09-16 | 2011-06-14 | Mips Technologies, Inc. | Bifurcated transaction selector supporting dynamic priorities in multi-port switch |
US7644080B2 (en) * | 2006-09-19 | 2010-01-05 | Netlogic Microsystems, Inc. | Method and apparatus for managing multiple data flows in a content search system |
JP4701152B2 (en) * | 2006-10-20 | 2011-06-15 | 富士通株式会社 | Data relay apparatus, data relay method, and data relay program |
US8667155B2 (en) * | 2007-03-02 | 2014-03-04 | Adva Ag Optical Networking | System and method for line rate frame processing engine using a generic instruction set |
US20080225872A1 (en) * | 2007-03-12 | 2008-09-18 | Collins Kevin T | Dynamically defining queues and agents in a contact center |
JP2008283646A (en) * | 2007-05-14 | 2008-11-20 | Fujitsu Ltd | Router device |
US8885634B2 (en) * | 2007-11-30 | 2014-11-11 | Ciena Corporation | Systems and methods for carrier ethernet using referential tables for forwarding decisions |
US9118636B2 (en) * | 2008-05-12 | 2015-08-25 | Nbcuniversal Media, Llc | Data transfer control system and method |
US9141446B2 (en) * | 2008-10-24 | 2015-09-22 | Sap Se | Maintenance of message serialization in multi-queue messaging environments |
US8121129B2 (en) | 2008-12-15 | 2012-02-21 | International Business Machines Corporation | Optimizing throughput of data in a communications network |
US8565118B2 (en) * | 2008-12-30 | 2013-10-22 | Juniper Networks, Inc. | Methods and apparatus for distributed dynamic network provisioning |
US8255496B2 (en) | 2008-12-30 | 2012-08-28 | Juniper Networks, Inc. | Method and apparatus for determining a network topology during network provisioning |
US8644140B2 (en) * | 2009-09-09 | 2014-02-04 | Mellanox Technologies Ltd. | Data switch with shared port buffers |
JP5271876B2 (en) * | 2009-11-12 | 2013-08-21 | 株式会社日立製作所 | Device having packet distribution function and packet distribution method |
US20110145393A1 (en) * | 2009-12-13 | 2011-06-16 | Tami Ben-Zvi | Method for dynamic reservation of cloud and on premises computing resources for software execution |
FR2955992B1 (en) * | 2010-01-29 | 2012-04-20 | Inst Nat Rech Inf Automat | MODULATING SWITCHING OR ROUTING DEVICE |
US8589941B2 (en) | 2010-04-23 | 2013-11-19 | International Business Machines Corporation | Resource affinity via dynamic reconfiguration for multi-queue network adapters |
US20110282980A1 (en) * | 2010-05-11 | 2011-11-17 | Udaya Kumar | Dynamic protection of a resource during sudden surges in traffic |
US20120079063A1 (en) * | 2010-09-27 | 2012-03-29 | Research In Motion Limited | Method, apparatus and system for providing event notifications across a plurality of computers |
US8316034B2 (en) * | 2010-10-20 | 2012-11-20 | International Business Machines Corporaion | Analyzing binary data streams to identify embedded record structures |
US8862603B1 (en) | 2010-11-03 | 2014-10-14 | Netlogic Microsystems, Inc. | Minimizing state lists for non-deterministic finite state automatons |
US8429127B2 (en) * | 2010-12-09 | 2013-04-23 | International Business Machines Corporation | Circumventing queue downtime in a queue damage scenario |
US8891406B1 (en) | 2010-12-22 | 2014-11-18 | Juniper Networks, Inc. | Methods and apparatus for tunnel management within a data center |
US9074463B2 (en) | 2010-12-30 | 2015-07-07 | Baker Hughes Incorporated | Method and devices for terminating communication between a node and a carrier |
US8549579B2 (en) * | 2011-07-06 | 2013-10-01 | International Business Machines Corporation | Dynamic data-protection policies within a request-reply message queuing environment |
US8699491B2 (en) | 2011-07-25 | 2014-04-15 | Mellanox Technologies Ltd. | Network element with shared buffers |
CN102647352B (en) * | 2012-04-05 | 2015-04-22 | 北京星网锐捷网络技术有限公司 | Message forwarding method and device as well as communication equipment |
US9317842B2 (en) | 2012-04-10 | 2016-04-19 | Bank Of America Corporation | Dynamic allocation of video resources |
US9582440B2 (en) | 2013-02-10 | 2017-02-28 | Mellanox Technologies Ltd. | Credit based low-latency arbitration with data transfer |
US9391875B2 (en) * | 2013-02-11 | 2016-07-12 | Fujitsu Limited | Resource oriented dependency graph for network configuration |
US10375155B1 (en) | 2013-02-19 | 2019-08-06 | F5 Networks, Inc. | System and method for achieving hardware acceleration for asymmetric flow connections |
US8989011B2 (en) | 2013-03-14 | 2015-03-24 | Mellanox Technologies Ltd. | Communication over multiple virtual lanes using a shared buffer |
US9641465B1 (en) | 2013-08-22 | 2017-05-02 | Mellanox Technologies, Ltd | Packet switch with reduced latency |
US9548960B2 (en) | 2013-10-06 | 2017-01-17 | Mellanox Technologies Ltd. | Simplified packet routing |
US9253102B2 (en) * | 2013-11-13 | 2016-02-02 | Verizon Patent And Licensing Inc. | Time weighted queuing scheduler for machine-to-machine communications |
US20150244804A1 (en) * | 2014-02-21 | 2015-08-27 | Coho Data, Inc. | Methods, systems and devices for parallel network interface data structures with differential data storage service capabilities |
US9325641B2 (en) | 2014-03-13 | 2016-04-26 | Mellanox Technologies Ltd. | Buffering schemes for communication over long haul links |
CN111666148A (en) | 2014-04-30 | 2020-09-15 | 华为技术有限公司 | Computer, control apparatus, and data processing method |
US9584429B2 (en) | 2014-07-21 | 2017-02-28 | Mellanox Technologies Ltd. | Credit based flow control for long-haul links |
US9843550B2 (en) * | 2015-11-29 | 2017-12-12 | International Business Machines Corporation | Processing messages in a data messaging system using constructed resource models |
US9679426B1 (en) | 2016-01-04 | 2017-06-13 | Bank Of America Corporation | Malfeasance detection based on identification of device signature |
US10373131B2 (en) | 2016-01-04 | 2019-08-06 | Bank Of America Corporation | Recurring event analyses and data push |
CN107491351B (en) * | 2016-06-13 | 2021-07-27 | 阿里巴巴集团控股有限公司 | Resource allocation method, device and equipment based on priority |
US10673704B2 (en) * | 2017-02-15 | 2020-06-02 | Arista Networks, Inc. | System and method of dynamic hardware policer allocation |
US11720408B2 (en) * | 2018-05-08 | 2023-08-08 | Vmware, Inc. | Method and system for assigning a virtual machine in virtual GPU enabled systems |
US20200104193A1 (en) * | 2018-09-28 | 2020-04-02 | Apple Inc. | Port Groups |
US10951549B2 (en) | 2019-03-07 | 2021-03-16 | Mellanox Technologies Tlv Ltd. | Reusing switch ports for external buffer network |
US11144226B2 (en) | 2019-04-11 | 2021-10-12 | Samsung Electronics Co., Ltd. | Intelligent path selection and load balancing |
US11216190B2 (en) * | 2019-06-10 | 2022-01-04 | Samsung Electronics Co., Ltd. | Systems and methods for I/O transmissions in queue pair-based NVMeoF initiator-target system |
US11240294B2 (en) | 2019-08-23 | 2022-02-01 | Samsung Electronics Co., Ltd. | Systems and methods for spike detection and load balancing resource management |
US11262945B2 (en) * | 2019-10-30 | 2022-03-01 | EMC IP Holding Company, LLC | Quality of service (QOS) system and method for non-volatile memory express devices |
US11558316B2 (en) | 2021-02-15 | 2023-01-17 | Mellanox Technologies, Ltd. | Zero-copy buffering of traffic of long-haul links |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6167445A (en) * | 1998-10-26 | 2000-12-26 | Cisco Technology, Inc. | Method and apparatus for defining and implementing high-level quality of service policies in computer networks |
Family Cites Families (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4593157A (en) * | 1984-09-04 | 1986-06-03 | Usdan Myron S | Directory interface and dialer |
US4953157A (en) | 1989-04-19 | 1990-08-28 | American Telephone And Telegraph Company | Programmable data packet buffer prioritization arrangement |
AU650339B2 (en) * | 1991-04-10 | 1994-06-16 | Philips Electronics N.V. | Low delay or low loss cell switch for ATM |
DE4323405A1 (en) * | 1993-07-13 | 1995-01-19 | Sel Alcatel Ag | Access control method for a buffer memory and device for buffering data packets and switching center with such a device |
DE4328862A1 (en) * | 1993-08-27 | 1995-03-02 | Sel Alcatel Ag | Method and device for buffering data packets and switching center with such a device |
JPH104431A (en) * | 1996-06-17 | 1998-01-06 | Fujitsu Ltd | Scheduling device and method |
US5768257A (en) * | 1996-07-11 | 1998-06-16 | Xylan Corporation | Input buffering/output control for a digital traffic switch |
US6078564A (en) * | 1996-08-30 | 2000-06-20 | Lucent Technologies, Inc. | System for improving data throughput of a TCP/IP network connection with slow return channel |
US6137777A (en) * | 1997-05-27 | 2000-10-24 | Ukiah Software, Inc. | Control tool for bandwidth management |
US6104700A (en) * | 1997-08-29 | 2000-08-15 | Extreme Networks | Policy based quality of service |
IES80918B2 (en) * | 1997-12-15 | 1999-06-30 | Tellabs Research Limited | An atm cell processor |
GB2341059A (en) * | 1998-08-28 | 2000-03-01 | Nokia Oy Ab | Internet protocol flow detection |
US6286052B1 (en) * | 1998-12-04 | 2001-09-04 | Cisco Technology, Inc. | Method and apparatus for identifying network data traffic flows and for applying quality of service treatments to the flows |
DE60024228T2 (en) * | 1999-01-08 | 2006-08-10 | Nortel Networks Ltd., St. Laurent | DYNAMIC ASSIGNMENT TRAFFIC CLASSES ON A PRIORITY MAINTENANCE JUMP IN A PACKAGE TRANSPORT DEVICE |
US6597669B1 (en) * | 1999-03-16 | 2003-07-22 | Northrop Grumman Corporation | Queue segmentation and addressing method and apparatus for a cell switch in a processing communications satellite |
US6449251B1 (en) * | 1999-04-02 | 2002-09-10 | Nortel Networks Limited | Packet mapper for dynamic data packet prioritization |
JP2003512799A (en) * | 1999-10-20 | 2003-04-02 | アルカテル・インターネツトワーキング・インコーポレイテツド | On-switch policy rule caching for data communication switches |
US7089335B2 (en) * | 2000-10-30 | 2006-08-08 | Microsoft Corporation | Bridging multiple network segments and exposing the multiple network segments as a single network to a higher level networking software on a bridging computing device |
AU2002306495A1 (en) * | 2001-02-13 | 2002-08-28 | Candera, Inc. | Storage virtualization and storage management to provide higher level storage services |
US6970921B1 (en) * | 2001-07-27 | 2005-11-29 | 3Com Corporation | Network interface supporting virtual paths for quality of service |
US6865388B2 (en) * | 2001-08-09 | 2005-03-08 | Hughes Electronics Corporation | Dynamic queue depth management in a satellite terminal for bandwidth allocations in a broadband satellite communications system |
-
2002
- 2002-04-22 US US10/127,167 patent/US20030067874A1/en not_active Abandoned
- 2002-09-27 AT AT02021812T patent/ATE350831T1/en not_active IP Right Cessation
- 2002-09-27 DE DE60217253T patent/DE60217253T2/en not_active Expired - Lifetime
- 2002-09-27 EP EP02021812A patent/EP1303079B1/en not_active Expired - Lifetime
- 2002-10-04 US US10/264,786 patent/US7339942B2/en not_active Expired - Fee Related
- 2002-10-10 DE DE60224629T patent/DE60224629D1/en not_active Expired - Lifetime
- 2002-10-10 AT AT02022902T patent/ATE384381T1/en not_active IP Right Cessation
- 2002-10-10 EP EP02022902A patent/EP1303087B1/en not_active Expired - Lifetime
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6167445A (en) * | 1998-10-26 | 2000-12-26 | Cisco Technology, Inc. | Method and apparatus for defining and implementing high-level quality of service policies in computer networks |
Cited By (173)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9356877B1 (en) * | 2001-06-18 | 2016-05-31 | Open Invention Network, Llc | Intelligent switching of client packets among a group of servers |
US7437473B2 (en) * | 2001-06-18 | 2008-10-14 | Softshield, Llc | Packet switch and method thereof dependent on application content |
US8656047B1 (en) | 2001-06-18 | 2014-02-18 | Open Invention Network, Llc | Intelligent switching of client packets among a group of servers |
US9032090B1 (en) * | 2001-06-18 | 2015-05-12 | Open Invention Network, Llc | Intelligent switching of client packets among a group of servers |
US20030115347A1 (en) * | 2001-12-18 | 2003-06-19 | Gilbert Wolrich | Control mechanisms for enqueue and dequeue operations in a pipelined network processor |
US7269179B2 (en) * | 2001-12-18 | 2007-09-11 | Intel Corporation | Control mechanisms for enqueue and dequeue operations in a pipelined network processor |
US8006304B2 (en) | 2003-05-21 | 2011-08-23 | Foundry Networks, Llc | System and method for ARP anti-spoofing security |
US8533823B2 (en) | 2003-05-21 | 2013-09-10 | Foundry Networks, Llc | System and method for source IP anti-spoofing security |
US8245300B2 (en) | 2003-05-21 | 2012-08-14 | Foundry Networks Llc | System and method for ARP anti-spoofing security |
US20090254973A1 (en) * | 2003-05-21 | 2009-10-08 | Foundry Networks, Inc. | System and method for source ip anti-spoofing security |
US8918875B2 (en) | 2003-05-21 | 2014-12-23 | Foundry Networks, Llc | System and method for ARP anti-spoofing security |
US7523485B1 (en) | 2003-05-21 | 2009-04-21 | Foundry Networks, Inc. | System and method for source IP anti-spoofing security |
US7562390B1 (en) | 2003-05-21 | 2009-07-14 | Foundry Networks, Inc. | System and method for ARP anti-spoofing security |
US7516487B1 (en) | 2003-05-21 | 2009-04-07 | Foundry Networks, Inc. | System and method for source IP anti-spoofing security |
US20090307773A1 (en) * | 2003-05-21 | 2009-12-10 | Foundry Networks, Inc. | System and method for arp anti-spoofing security |
US20090260083A1 (en) * | 2003-05-21 | 2009-10-15 | Foundry Networks, Inc. | System and method for source ip anti-spoofing security |
US7979903B2 (en) | 2003-05-21 | 2011-07-12 | Foundry Networks, Llc | System and method for source IP anti-spoofing security |
US20050013298A1 (en) * | 2003-05-28 | 2005-01-20 | Pyda Srisuresh | Policy based network address translation |
WO2004107131A3 (en) * | 2003-05-28 | 2005-04-07 | Caymas Systems Inc | Policy based network address translation |
US8194673B2 (en) * | 2003-05-28 | 2012-06-05 | Citrix Systems, Inc. | Policy based network address translation |
US20100251335A1 (en) * | 2003-05-28 | 2010-09-30 | Pyda Srisuresh | Policy based network address translation |
US20100325697A1 (en) * | 2003-05-28 | 2010-12-23 | Citrix Systems, Inc. | Multilayer access control security system |
US7900240B2 (en) | 2003-05-28 | 2011-03-01 | Citrix Systems, Inc. | Multilayer access control security system |
US8528047B2 (en) | 2003-05-28 | 2013-09-03 | Citrix Systems, Inc. | Multilayer access control security system |
US20040243835A1 (en) * | 2003-05-28 | 2004-12-02 | Andreas Terzis | Multilayer access control security system |
WO2004107131A2 (en) * | 2003-05-28 | 2004-12-09 | Caymas Systems, Inc. | Policy based network address translation |
US7760729B2 (en) * | 2003-05-28 | 2010-07-20 | Citrix Systems, Inc. | Policy based network address translation |
US20040255154A1 (en) * | 2003-06-11 | 2004-12-16 | Foundry Networks, Inc. | Multiple tiered network security system, method and apparatus |
US20070266158A1 (en) * | 2003-06-17 | 2007-11-15 | International Business Machines Corporation | Security checking program for communication between networks |
US7882229B2 (en) * | 2003-06-17 | 2011-02-01 | International Business Machines Corporation | Security checking program for communication between networks |
US20140129705A1 (en) * | 2003-07-10 | 2014-05-08 | Eric David O'Brien | Security network processor system and method |
US9838289B2 (en) * | 2003-07-10 | 2017-12-05 | Mcafee, Llc | Security network processor system and method |
US20050025125A1 (en) * | 2003-08-01 | 2005-02-03 | Foundry Networks, Inc. | System, method and apparatus for providing multiple access modes in a data communications network |
US20100325700A1 (en) * | 2003-08-01 | 2010-12-23 | Brocade Communications Systems, Inc. | System, method and apparatus for providing multiple access modes in a data communications network |
US8249096B2 (en) | 2003-08-01 | 2012-08-21 | Foundry Networks, Llc | System, method and apparatus for providing multiple access modes in a data communications network |
US8681800B2 (en) | 2003-08-01 | 2014-03-25 | Foundry Networks, Llc | System, method and apparatus for providing multiple access modes in a data communications network |
US8239929B2 (en) | 2003-09-04 | 2012-08-07 | Foundry Networks, Llc | Multiple tiered network security system, method and apparatus using dynamic user policy assignment |
US20050055570A1 (en) * | 2003-09-04 | 2005-03-10 | Foundry Networks, Inc. | Multiple tiered network security system, method and apparatus using dynamic user policy assignment |
US7735114B2 (en) * | 2003-09-04 | 2010-06-08 | Foundry Networks, Inc. | Multiple tiered network security system, method and apparatus using dynamic user policy assignment |
US20100333191A1 (en) * | 2003-09-23 | 2010-12-30 | Foundry Networks, Inc. | System and method for protecting cpu against remote access attacks |
US7774833B1 (en) | 2003-09-23 | 2010-08-10 | Foundry Networks, Inc. | System and method for protecting CPU against remote access attacks |
US8893256B2 (en) | 2003-09-23 | 2014-11-18 | Brocade Communications Systems, Inc. | System and method for protecting CPU against remote access attacks |
EP1523138A3 (en) * | 2003-10-07 | 2005-04-20 | Alcatel | Access control mechanism for routers |
US7509674B2 (en) | 2003-10-07 | 2009-03-24 | Alcatel Lucent | Access control listing mechanism for routers |
US20050076138A1 (en) * | 2003-10-07 | 2005-04-07 | Alcatel | Access control listing mechanism for routers |
EP1523138A2 (en) * | 2003-10-07 | 2005-04-13 | Alcatel | Access control mechanism for routers |
US8559449B2 (en) | 2003-11-11 | 2013-10-15 | Citrix Systems, Inc. | Systems and methods for providing a VPN solution |
US8528071B1 (en) | 2003-12-05 | 2013-09-03 | Foundry Networks, Llc | System and method for flexible authentication in a data communications network |
US20050177869A1 (en) * | 2004-02-10 | 2005-08-11 | Savage James A. | Firewall permitting access to network based on accessing party identity |
US20050198246A1 (en) * | 2004-03-08 | 2005-09-08 | Daniel Kegel | Simulating a large number of users |
US8244891B2 (en) * | 2004-03-08 | 2012-08-14 | Ixia | Simulating a large number of users |
US7962646B2 (en) | 2004-05-07 | 2011-06-14 | International Business Machines Corporation | Continuous feedback-controlled deployment of message transforms in a distributed messaging system |
US8533742B2 (en) | 2004-05-07 | 2013-09-10 | International Business Machines Corporation | Distributed messaging system supporting stateful subscriptions |
US20080244025A1 (en) * | 2004-05-07 | 2008-10-02 | Roman Ginis | Continuous feedback-controlled deployment of message transforms in a distributed messaging system |
US20080209440A1 (en) * | 2004-05-07 | 2008-08-28 | Roman Ginis | Distributed messaging system supporting stateful subscriptions |
US7886180B2 (en) | 2004-05-14 | 2011-02-08 | International Business Machines Corporation | Recovery in a distributed stateful publish-subscribe system |
US20050268146A1 (en) * | 2004-05-14 | 2005-12-01 | International Business Machines Corporation | Recovery in a distributed stateful publish-subscribe system |
US8495305B2 (en) | 2004-06-30 | 2013-07-23 | Citrix Systems, Inc. | Method and device for performing caching of dynamically generated objects in a data communication network |
US8261057B2 (en) | 2004-06-30 | 2012-09-04 | Citrix Systems, Inc. | System and method for establishing a virtual private network |
US8726006B2 (en) | 2004-06-30 | 2014-05-13 | Citrix Systems, Inc. | System and method for establishing a virtual private network |
US8739274B2 (en) | 2004-06-30 | 2014-05-27 | Citrix Systems, Inc. | Method and device for performing integrated caching in a data communication network |
US8634420B2 (en) | 2004-07-23 | 2014-01-21 | Citrix Systems, Inc. | Systems and methods for communicating a lossy protocol via a lossless protocol |
US8897299B2 (en) * | 2004-07-23 | 2014-11-25 | Citrix Systems, Inc. | Method and systems for routing packets from a gateway to an endpoint |
US8363650B2 (en) * | 2004-07-23 | 2013-01-29 | Citrix Systems, Inc. | Method and systems for routing packets from a gateway to an endpoint |
US9219579B2 (en) | 2004-07-23 | 2015-12-22 | Citrix Systems, Inc. | Systems and methods for client-side application-aware prioritization of network communications |
US8351333B2 (en) | 2004-07-23 | 2013-01-08 | Citrix Systems, Inc. | Systems and methods for communicating a lossy protocol via a lossless protocol using false acknowledgements |
US8914522B2 (en) | 2004-07-23 | 2014-12-16 | Citrix Systems, Inc. | Systems and methods for facilitating a peer to peer route via a gateway |
US8892778B2 (en) | 2004-07-23 | 2014-11-18 | Citrix Systems, Inc. | Method and systems for securing remote access to private networks |
US8291119B2 (en) | 2004-07-23 | 2012-10-16 | Citrix Systems, Inc. | Method and systems for securing remote access to private networks |
US7870294B2 (en) | 2004-09-30 | 2011-01-11 | Citrix Systems, Inc. | Method and apparatus for providing policy-based document control |
US7865603B2 (en) | 2004-09-30 | 2011-01-04 | Citrix Systems, Inc. | Method and apparatus for assigning access control levels in providing access to networked content files |
US7748032B2 (en) | 2004-09-30 | 2010-06-29 | Citrix Systems, Inc. | Method and apparatus for associating tickets in a ticket hierarchy |
US8613048B2 (en) | 2004-09-30 | 2013-12-17 | Citrix Systems, Inc. | Method and apparatus for providing authorized remote access to application sessions |
US8286230B2 (en) | 2004-09-30 | 2012-10-09 | Citrix Systems, Inc. | Method and apparatus for associating tickets in a ticket hierarchy |
US8065423B2 (en) | 2004-09-30 | 2011-11-22 | Citrix Systems, Inc. | Method and system for assigning access control levels in providing access to networked content files |
US9401906B2 (en) | 2004-09-30 | 2016-07-26 | Citrix Systems, Inc. | Method and apparatus for providing authorized remote access to application sessions |
US20060190455A1 (en) * | 2004-09-30 | 2006-08-24 | Braddy Ricky G | Method and system for assigning access control levels in providing access to networked content files |
US20100229228A1 (en) * | 2004-09-30 | 2010-09-09 | Timothy Ernest Simmons | Method and apparatus for associating tickets in a ticket hierarchy |
US9311502B2 (en) | 2004-09-30 | 2016-04-12 | Citrix Systems, Inc. | Method and system for assigning access control levels in providing access to networked content files |
US8352606B2 (en) | 2004-09-30 | 2013-01-08 | Citrix Systems, Inc. | Method and system for assigning access control levels in providing access to networked content files |
US20060070131A1 (en) * | 2004-09-30 | 2006-03-30 | Citrix Systems, Inc. | Method and apparatus for providing authorized remote access to application sessions |
US8549149B2 (en) | 2004-12-30 | 2013-10-01 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP multiplexing |
US8706877B2 (en) | 2004-12-30 | 2014-04-22 | Citrix Systems, Inc. | Systems and methods for providing client-side dynamic redirection to bypass an intermediary |
US8954595B2 (en) | 2004-12-30 | 2015-02-10 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP buffering |
US8700695B2 (en) | 2004-12-30 | 2014-04-15 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP pooling |
US8856777B2 (en) | 2004-12-30 | 2014-10-07 | Citrix Systems, Inc. | Systems and methods for automatic installation and execution of a client-side acceleration program |
US20060195547A1 (en) * | 2004-12-30 | 2006-08-31 | Prabakar Sundarrajan | Systems and methods for providing client-side accelerated access to remote applications via TCP multiplexing |
US8788581B2 (en) | 2005-01-24 | 2014-07-22 | Citrix Systems, Inc. | Method and device for performing caching of dynamically generated objects in a data communication network |
US8848710B2 (en) | 2005-01-24 | 2014-09-30 | Citrix Systems, Inc. | System and method for performing flash caching of dynamically generated objects in a data communication network |
US8024568B2 (en) | 2005-01-28 | 2011-09-20 | Citrix Systems, Inc. | Method and system for verification of an endpoint security scan |
US8312261B2 (en) | 2005-01-28 | 2012-11-13 | Citrix Systems, Inc. | Method and system for verification of an endpoint security scan |
US20060174115A1 (en) * | 2005-01-28 | 2006-08-03 | Goutham Rao | Method and system for verification of an endpoint security scan |
US20060182100A1 (en) * | 2005-02-11 | 2006-08-17 | Microsoft Corporation | Automated NAT traversal for peer-to-peer networks |
US7912046B2 (en) * | 2005-02-11 | 2011-03-22 | Microsoft Corporation | Automated NAT traversal for peer-to-peer networks |
WO2007033782A1 (en) | 2005-09-20 | 2007-03-29 | Rohde & Schwarz Gmbh & Co. Kg | Communications network, network node device and method including a local transmission of encrypted service quality-relevant information |
US20070124433A1 (en) * | 2005-11-30 | 2007-05-31 | Microsoft Corporation | Network supporting centralized management of QoS policies |
US7979549B2 (en) * | 2005-11-30 | 2011-07-12 | Microsoft Corporation | Network supporting centralized management of QoS policies |
US20070124485A1 (en) * | 2005-11-30 | 2007-05-31 | Microsoft Corporation | Computer system implementing quality of service policy |
US8255456B2 (en) | 2005-12-30 | 2012-08-28 | Citrix Systems, Inc. | System and method for performing flash caching of dynamically generated objects in a data communication network |
US8301839B2 (en) | 2005-12-30 | 2012-10-30 | Citrix Systems, Inc. | System and method for performing granular invalidation of cached dynamically generated objects in a data communication network |
US8499057B2 (en) | 2005-12-30 | 2013-07-30 | Citrix Systems, Inc | System and method for performing flash crowd caching of dynamically generated objects in a data communication network |
US20070160079A1 (en) * | 2006-01-06 | 2007-07-12 | Microsoft Corporation | Selectively enabled quality of service policy |
US9112765B2 (en) | 2006-01-06 | 2015-08-18 | Microsoft Technology Licensing, Llc | Selectively enabled quality of service policy |
US8170021B2 (en) | 2006-01-06 | 2012-05-01 | Microsoft Corporation | Selectively enabled quality of service policy |
US7654121B2 (en) * | 2006-02-14 | 2010-02-02 | Huawei Technologies Co., Ltd. | Method for selecting QoS Policy |
US20070189185A1 (en) * | 2006-02-14 | 2007-08-16 | Weishan Chen | Method for selecting QoS policy and system thereof |
US20100080232A1 (en) * | 2006-02-14 | 2010-04-01 | Huawei Technologies Co., Ltd | METHOD FOR SELECTING QoS POLICY AND SYSTEM THEREOF |
US7770217B2 (en) * | 2006-02-23 | 2010-08-03 | Cisco Technology, Inc. | Method and system for quality of service based web filtering |
US20070199064A1 (en) * | 2006-02-23 | 2007-08-23 | Pueblas Martin C | Method and system for quality of service based web filtering |
US20070283144A1 (en) * | 2006-06-02 | 2007-12-06 | Kramer David B | System and Method for Implementing ACLs Using Standard LPM Engine |
US7861291B2 (en) * | 2006-06-02 | 2010-12-28 | Freescale Semiconductor, Inc. | System and method for implementing ACLs using standard LPM engine |
US20070282982A1 (en) * | 2006-06-05 | 2007-12-06 | Rhonda Childress | Policy-Based Management in a Computer Environment |
US20080239951A1 (en) * | 2006-06-27 | 2008-10-02 | Robert Evan Strom | Method for applying stochastic control optimization for messaging systems |
US7792038B2 (en) * | 2006-06-27 | 2010-09-07 | International Business Machines Corporation | Method for applying stochastic control optimization for messaging systems |
US8533846B2 (en) | 2006-11-08 | 2013-09-10 | Citrix Systems, Inc. | Method and system for dynamically associating access rights with a resource |
US20080109912A1 (en) * | 2006-11-08 | 2008-05-08 | Citrix Systems, Inc. | Method and system for dynamically associating access rights with a resource |
US9401931B2 (en) | 2006-11-08 | 2016-07-26 | Citrix Systems, Inc. | Method and system for dynamically associating access rights with a resource |
US20080144502A1 (en) * | 2006-12-19 | 2008-06-19 | Deterministic Networks, Inc. | In-Band Quality-of-Service Signaling to Endpoints that Enforce Traffic Policies at Traffic Sources Using Policy Messages Piggybacked onto DiffServ Bits |
US7983170B2 (en) | 2006-12-19 | 2011-07-19 | Citrix Systems, Inc. | In-band quality-of-service signaling to endpoints that enforce traffic policies at traffic sources using policy messages piggybacked onto DiffServ bits |
US20080225753A1 (en) * | 2007-03-12 | 2008-09-18 | Prakash Khemani | Systems and methods for configuring handling of undefined policy events |
US20080225719A1 (en) * | 2007-03-12 | 2008-09-18 | Vamsi Korrapati | Systems and methods for using object oriented expressions to configure application security policies |
US7853678B2 (en) | 2007-03-12 | 2010-12-14 | Citrix Systems, Inc. | Systems and methods for configuring flow control of policy expressions |
US7853679B2 (en) | 2007-03-12 | 2010-12-14 | Citrix Systems, Inc. | Systems and methods for configuring handling of undefined policy events |
US7865589B2 (en) | 2007-03-12 | 2011-01-04 | Citrix Systems, Inc. | Systems and methods for providing structured policy expressions to represent unstructured data in a network appliance |
US20080225720A1 (en) * | 2007-03-12 | 2008-09-18 | Prakash Khemani | Systems and methods for configuring flow control of policy expressions |
US20080229381A1 (en) * | 2007-03-12 | 2008-09-18 | Namit Sikka | Systems and methods for managing application security profiles |
US9450837B2 (en) | 2007-03-12 | 2016-09-20 | Citrix Systems, Inc. | Systems and methods for configuring policy bank invocations |
US20080225722A1 (en) * | 2007-03-12 | 2008-09-18 | Prakash Khemani | Systems and methods for configuring policy bank invocations |
US7870277B2 (en) | 2007-03-12 | 2011-01-11 | Citrix Systems, Inc. | Systems and methods for using object oriented expressions to configure application security policies |
US9160768B2 (en) | 2007-03-12 | 2015-10-13 | Citrix Systems, Inc. | Systems and methods for managing application security profiles |
US8631147B2 (en) | 2007-03-12 | 2014-01-14 | Citrix Systems, Inc. | Systems and methods for configuring policy bank invocations |
US8341287B2 (en) | 2007-03-12 | 2012-12-25 | Citrix Systems, Inc. | Systems and methods for configuring policy bank invocations |
US8490148B2 (en) | 2007-03-12 | 2013-07-16 | Citrix Systems, Inc | Systems and methods for managing application security profiles |
US20160219131A1 (en) * | 2007-04-11 | 2016-07-28 | Palo Alto Networks, Inc. | L2/l3 multi-mode switch including policy processing |
US9800697B2 (en) * | 2007-04-11 | 2017-10-24 | Palo Alto Networks, Inc. | L2/L3 multi-mode switch including policy processing |
US20090141737A1 (en) * | 2007-11-30 | 2009-06-04 | Texas Instruments Incorporated | Systems and methods for prioritized channel access hardware assistance design |
US8934344B2 (en) | 2008-06-24 | 2015-01-13 | Intel Corporation | Packet switching |
US20090316711A1 (en) * | 2008-06-24 | 2009-12-24 | Intel Corporation | Packet switching |
US8031606B2 (en) * | 2008-06-24 | 2011-10-04 | Intel Corporation | Packet switching |
US8675491B2 (en) | 2008-06-24 | 2014-03-18 | Intel Corporation | Packet switching |
US10447604B2 (en) | 2008-06-24 | 2019-10-15 | Intel Corporation | Packet switching |
US9674097B2 (en) | 2008-06-24 | 2017-06-06 | Intel Corporation | Packet switching |
US10084714B2 (en) * | 2009-03-30 | 2018-09-25 | Nec Corporation | Communication flow control system, communication flow control method, and communication flow processing program |
US20170195241A1 (en) * | 2009-03-30 | 2017-07-06 | Nec Corporation | Communication flow control system, communication flow control method, and communication flow processing program |
EP2430800A1 (en) * | 2009-05-15 | 2012-03-21 | Hewlett-Packard Development Company, L.P. | A method and apparatus for policy enforcement using a tag |
CN102461089A (en) * | 2009-05-15 | 2012-05-16 | 惠普开发有限公司 | A method and apparatus for policy enforcement using a tag |
EP2430800A4 (en) * | 2009-05-15 | 2014-01-08 | Hewlett Packard Development Co | A method and apparatus for policy enforcement using a tag |
WO2010132061A1 (en) | 2009-05-15 | 2010-11-18 | Hewlett-Packard Development Company, L. P. | A method and apparatus for policy enforcement using a tag |
US20140044111A1 (en) * | 2012-08-08 | 2014-02-13 | Broadcom Coporation | Frame Chaining for Bridged Traffic |
US9973536B2 (en) | 2012-12-08 | 2018-05-15 | International Business Machines Corporation | Directing audited data traffic to specific repositories |
US9124619B2 (en) * | 2012-12-08 | 2015-09-01 | International Business Machines Corporation | Directing audited data traffic to specific repositories |
US9106682B2 (en) * | 2012-12-08 | 2015-08-11 | International Business Machines Corporation | Method for directing audited data traffic to specific repositories |
US10110637B2 (en) | 2012-12-08 | 2018-10-23 | International Business Machines Corporation | Directing audited data traffic to specific repositories |
US10397279B2 (en) | 2012-12-08 | 2019-08-27 | International Business Machines Corporation | Directing audited data traffic to specific repositories |
US20140165189A1 (en) * | 2012-12-08 | 2014-06-12 | International Business Machines Corporation | Directing Audited Data Traffic to Specific Repositories |
US20140165133A1 (en) * | 2012-12-08 | 2014-06-12 | International Business Machines Corporation | Method for Directing Audited Data Traffic to Specific Repositories |
US9729500B2 (en) * | 2013-03-15 | 2017-08-08 | Google Inc. | IP allocation pools |
US10142285B2 (en) | 2013-03-15 | 2018-11-27 | Google Llc | IP allocation pools |
US20140280902A1 (en) * | 2013-03-15 | 2014-09-18 | Google Inc. | IP Allocation Pools |
US10439983B2 (en) | 2013-03-15 | 2019-10-08 | Google Llc | IP allocation pools |
WO2015073546A1 (en) * | 2013-11-15 | 2015-05-21 | F5 Networks, Inc. | Extending policy rulesets with scripting |
US20150142948A1 (en) * | 2013-11-15 | 2015-05-21 | F5 Networks, Inc. | Extending policy rulesets with scripting |
US10454768B2 (en) * | 2013-11-15 | 2019-10-22 | F5 Networks, Inc. | Extending policy rulesets with scripting |
US9692705B1 (en) * | 2013-12-06 | 2017-06-27 | Google Inc. | System and method for measurement of flow statistics |
WO2015126845A1 (en) * | 2014-02-18 | 2015-08-27 | F5 Networks, Inc. | Concurrent evaluation of large rule sets with conditions |
US20160021573A1 (en) * | 2014-07-17 | 2016-01-21 | Brocade Communications Systems, Inc. | Method and system for idle mode transfer for load balancing across distributed data plane processing entities for mobile core network |
US20160021572A1 (en) * | 2014-07-17 | 2016-01-21 | Brocade Communications Systems, Inc. | Method and system for optimized load balancing across distributed data plane processing entities for mobile core network |
US9712488B2 (en) * | 2014-07-17 | 2017-07-18 | Brocade Communications Systems, Inc. | Method and system for idle mode transfer for load balancing across distributed data plane processing entities for mobile core network |
US10225232B2 (en) | 2014-07-17 | 2019-03-05 | Mavenir Systems, Inc. | Method and system for idle mode transfer for load balancing across distributed data plane processing entities for mobile core network |
US9749286B2 (en) * | 2014-07-17 | 2017-08-29 | Brocade Communications Systems, Inc. | Method and system for optimized load balancing across distributed data plane processing entities for mobile core network |
US10084728B2 (en) | 2015-05-11 | 2018-09-25 | Futurewei Technologies, Inc. | Localized traffic flow management in a wireless network |
WO2016180191A1 (en) * | 2015-05-11 | 2016-11-17 | Huawei Technologies Co., Ltd. | Localized traffic flow management in a wireless network |
US20220271939A1 (en) * | 2021-02-25 | 2022-08-25 | Booz Allen Hamilton Inc. | Controlling power states and operation of mobile computing devices |
Also Published As
Publication number | Publication date |
---|---|
EP1303079B1 (en) | 2007-01-03 |
EP1303087A2 (en) | 2003-04-16 |
DE60224629D1 (en) | 2008-03-06 |
US7339942B2 (en) | 2008-03-04 |
EP1303079A2 (en) | 2003-04-16 |
ATE350831T1 (en) | 2007-01-15 |
US20030076849A1 (en) | 2003-04-24 |
ATE384381T1 (en) | 2008-02-15 |
EP1303087A3 (en) | 2004-01-02 |
DE60217253D1 (en) | 2007-02-15 |
EP1303087B1 (en) | 2008-01-16 |
EP1303079A3 (en) | 2004-08-11 |
DE60217253T2 (en) | 2007-10-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP1303079B1 (en) | Central policy based traffic management | |
US6377577B1 (en) | Access control list processing in hardware | |
US9800697B2 (en) | L2/L3 multi-mode switch including policy processing | |
US9407605B2 (en) | Routing a packet by a device | |
US6674743B1 (en) | Method and apparatus for providing policy-based services for internal applications | |
US6940862B2 (en) | Apparatus and method for classifying packets | |
US6996102B2 (en) | Method and apparatus for routing data traffic across a multicast-capable fabric | |
US7688761B2 (en) | Method and system for classifying packets in a network based on meta rules | |
US6865153B1 (en) | Stage-implemented QoS shaping for data communication switch | |
US7945941B2 (en) | Flexible access control policy enforcement | |
US7185073B1 (en) | Method and apparatus for defining and implementing high-level quality of service policies in computer networks | |
US6643260B1 (en) | Method and apparatus for implementing a quality of service policy in a data communications network | |
US20100100616A1 (en) | Method and apparatus for controlling traffic between different entities on a network | |
US20120023217A1 (en) | Method and apparatus for policy enforcement using a tag | |
EP1244254A2 (en) | Classification and tagging rules for switching nodes | |
AU2002327757A1 (en) | Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device | |
US6950429B2 (en) | IP data transmission network using a route selection based on level 4/5 protocol information | |
Cisco | Configuring QoS | |
Cisco | Configuring QoS | |
Cisco | Configuring QoS | |
Cisco | Configuring QoS | |
Cisco | Configuring QoS |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: ALCATEL INTERNETWORKING, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SEE, MICHAEL E.;MORGAN, DAVID;CLAWSON, STEPHEN;AND OTHERS;REEL/FRAME:012881/0127;SIGNING DATES FROM 20020329 TO 20020415 |
|
AS | Assignment |
Owner name: ALCATEL, FRANCE Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ALCATEL INTERNETWORKING, INC.;REEL/FRAME:013776/0827 Effective date: 20021216 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |