A computer network having multiple, dissimilar network devices includes a system for implementing high-level, network policies. The high-level policies, which are generally device-independent, are translated by one or more policy servers into a set of rules that can be put into effect by specific network devices. Preferably, a network administrator selects an overall traffic template for a given domain and may assign various applications and/or users to the corresponding traffic types of the template. Location-specific policies may also be established by the network administrator. The policy server translates the high-level policies inherent in the selected traffic template and location-specific policies into a set of rules, which may include one or more access control lists, and may combine several related rules into a single transaction. Intermediate network devices, which may have one or more roles assigned to their interfaces, are configured to request traffic management information from the policy server which replies with a particular set of transactions and rules. The rules, which may correspond to the particular roles assigned to the interfaces, are then utilized by the intermediate devices to configure their particular services and traffic management mechanisms. Other rules are utilized by the intermediate devices to classify packets with a particular priority and/or service value and to treat classified packets in a particular manner so as to realize the selected high-level policies within the domain.

Method and apparatus for defining and implementing high-level quality of service policies in computer networks

A system within a computer network identifies specific traffic flows originating from a given network entity and requests and applies appropriate policy rules or service treatments to the traffic flows. A network entity includes a flow declaration component that communicates with one or more application programs executing on the entity. The flow declaration component includes a message generator and an associated memory for storing one or more traffic flow data structures. For a given traffic flow, the application program issues one or more calls to the flow declaration component providing it with information identifying the traffic flows. The flow declaration component then opens a flow management session with a local policy enforcer that obtains policy rules or service treatments for the identified flow from a policy server and applies those rules or treatments to the specific traffic flows from the network entity.

Method and apparatus for identifying network data traffic flows and for applying quality of service treatments to the flows

The adaptive bandwidth throttling system implements a graceful diminution of services to the clients by delaying a first class of services provided by a network server in response to the effective bandwidth utilized by this network server exceeding a first threshold. If the demand for the bandwidth by this network server exceeds a second threshold, the bandwidth throttling system escalates the throttling response and blocks the first class of services from execution and can also concurrently delay execution of a second class of services. The implementation of the throttling process can be varied, to include additional levels of response or finer gradations of the response, to include subsets of a class of services. In addition, the threshold levels of bandwidth used to trigger the throttling response can be selected as desired by the system administrator.

Adaptive bandwidth throttling for network services

A method of monitoring data on a first communication line. Data is received from the first communication line (402) and a plurality of packets (406) are extracted (416) from the data. Statistics are then recursively generated (408), the statistics corresponding to the plurality of packets.

Apparatus and method for collecting and analyzing communications data

A system in which a single VLAN architecture spans multiple VLAN transport protocols and technologies, including a method and system in which multiple different VLANs may be combined in a single enterprise network. Each LAN-switch in the sytem identifies each frame with an identifier, and associates that identifier with particular VLAN identifiers for each type of VLAN technology. When a frame is bridged or routed from a first type of VLAN to a second type of VLAN, the first VLAN encapsulation is removed and the second VLAN encapsulation is added, with appropriate change in the VLAN identifier for the frame or packet. The identifier may also be implicit for the frame, such as when a particular set of sender's MAC addresses are identified with a particular VLAN. Individual VLANs, of whatever architecture, may be added, configured or reconfigured, modified, or deleted, using control tools associated with the multiple VLAN architecture system. Individual ports may be associated with particular VLANs, or may be designated "dynamic" so that frames or packets associated with those ports are associated with particular VLANs in response to source or destination addresses or other information.

Multiple VLAN architecture system

A method for controlling congestion in a packet switching network uses a packet dropping algorithm to determine when to drop a marked packet wherever the network is congested at any point along the path being traversed by the marked packet.

Packet switching system arranged for congestion control

In a packet switching network, packet monitoring and marking algorithms are used for determining which data packets, received from a customer by an access node, are being transmitted at an excessive transmission rate and accordingly are marked. Additionally every packet from a special customer can be marked. Along in the network, marked packets are dropped where the network is congested along the path being traversed by the data packets.

Daniel Ta-Duan Luan

Papers

Packet switching system arranged for congestion control

Packet switching system arranged for congestion control through bandwidth management