This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back towards their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or ``spoofed'', source addresses. In this paper we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed ``post-mortem'' -- after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backwards compatible and can be efficiently implemented using conventional technology.

/pdf/practical-network-support-for-ip-traceback-2j0ra46p0a.pdf

Practical network support for IP traceback

An intelligent gateway device provided at a premise (home or business) for providing and managing application services associated with use and support of a plurality of digital endpoint devices associated with the premises. The device includes a communications and processing infrastructure integrated with a peer and presence messaging based communications protocol for enabling communications between the device and an external support network and between the device and connected digital endpoint devices. A services framework at the gateway device implements the communications and processing infrastructure for enabling service management, service configuration, and authentication of user of services at the intelligent gateway. The framework provides a storage and execution environment for supporting and executing received service logic modules relating to use, management, and support of the digital endpoint devices. Thus, the gateway device provides a network-based services point of presence for a plurality of digital endpoint devices at the premises.

Multi-services application gateway and system employing the same

The World Wide Web can be considered as a large distributed information system that provides access to shared data objects. As one of the most popular applications currently running on the Internet, the World Wide Web is of an exponential growth in size, which results in network congestion and server overloading. Web caching has been recognized as one of the effective schemes to alleviate the service bottleneck and reduce the network traffic, thereby minimize the user access latency. In this paper, we first describe the elements of a Web caching system and its desirable properties. Then, we survey the state-of-art techniques which have been used in Web caching systems. Finally, we discuss the research frontier in Web caching.

/pdf/a-survey-of-web-caching-schemes-for-the-internet-jf7e8c3wv1.pdf

A survey of web caching schemes for the Internet

Resource usage accounting may be implemented in information management environments using resource utilization values. Resource usage accounting may be employed, for example, to make possible run-time enforcement of system operations on one or more subsystems or processing engines of an information management system, such as a content delivery system, for example, to advantageously provide intelligent admission control in a distributed environment. In one embodiment, resource usage accounting may be implemented to make possible the management of system resources on a per subsystem or processing engine basis, for example, based on at least two types of resource utilization indicative information: 1) resource usage that has been tracked internally throughout the life span of the overload and policy finite state machine module; and 2) resource status messages received directly or indirectly from one or more subsystems or processing engines.

Systems and methods for managing resource utilization in information management environments

Logging and analysis of resource utilization information may be implemented, for example, to achieve intelligent capacity management of information management system resources. In one implementation, resource utilization information may be collected from one or more subsystems or processing engines of an information management system, and analyzed to gain insights into system performance. System capacity management may be implemented using collected resource utilization information, for example, to achieve dynamic management of system resources.

Systems and methods for resource utilization analysis in information management environments

A fault tolerant recoverable connection device and methods are disclosed that include a primary router in an active state to provide a connection between clients and servers in a network, and a backup router in a standby state. The states of the primary and backup routers are switched when the primary router fails, the backup router has a better reach-ability state than the primary router, or by an operator command. Each router has a synchronization manager which maintains synchronized tables between the active and standby routers; a monitoring manager which monitors and switch the state of the routers; a reach-ability manager which monitors, updates, and compares the reach-ability set and state of the routers; and a keep alive manager which monitors the routers to provide a status notification to the monitoring manager.

Fault tolerant recoverable TCP/IP connection router

A method and system for building scaleable TCP/IP services such as a cluster web server out of a switch or switched network such as an ATM switch or ATM switched network. For example, a distributed large scale TCP router can be built using an ATM switch network. The scaled services can be presented as a single service to clients. The scaleable services can balance the load on the individual servers in the cluster. The clients can be directly or indirectly connected to the switch or switched network. One version includes two separate components: a Control Engine (CE); and a Forwarding Engine (FE). The Control Engine is in charge of assigning a connection to a server and forwarding information about the assigned server and connection to the Forwarding Engine. The Forwarding Engine applies the assignments received from the Control Engine to map a TCP connection onto a switched ATM connection. At the end, the Forwarding Engine communicates the connection termination event back to the Control Engine. A preferred embodiment takes advantage of the switched nature of ATM networks to shortcut paths from clients to servers, wherever possible. Using ATM shortcuts can increase performance by several order of magnitude, while providing efficient distribution of the load balancing function.

Distributed scalable device for selecting a server from a server cluster and a switched path to the selected server

Each network node having at least one destination-oriented link toward a directed acyclic graph (DAG) destination can receive a corresponding set of path performance metrics via the destination-oriented link. The set of path performance metrics, initiated by the DAG destination outputting initial link metrics on each of its source-connecting links, identifies aggregate link metrics for a corresponding path to the DAG destination via the corresponding destination-oriented link. The network node outputs a corresponding updated set of path performance metrics on each of its source-connecting links based on the received set of path performance metrics and the corresponding link metric for the corresponding source-connecting link. Hence, each network node in the DAG can assess the performance of each connected path to the DAG destination, and forward a data packet via a selected destination-oriented link based on the corresponding path performance metrics and forwarding policies for the forwarded data packet.

Forwarding packets to a directed acyclic graph destination using link selection based on received link metrics

Load balancing of client transactions, for the duration of a client session, in a Web site is implemented by a cluster of servers. An initial request in each client session is sent to the site load balancer, thus, greatly enhancing the capability of the site to accept new session requests. All subsequent requests from a client are forwarded directly to the server first selected so that the sessions cannot be later broken by the load balancer.

Method and system for dispatching client sessions within a cluster of servers connected to the World Wide Web

The present invention is related to high speed packet switching networks and, more particularly, to a process for selecting an optimal path for packets transmission without bandwidth reservation in communication systems supporting both bandwidth-reserved and non-bandwidth-reserved connections. Non-reserved network connections do not have bandwidth set aside either implicitly or explicitly. The lowest delay priority is assigned to non-reserved traffic and the networks drops non-reserved packets when their buffer overflow at intermediate links. Because the data profile over the connections is bursty and non deterministic, reserved traffic does not lead to a full links utilization except on peaks. Therefore, non-reserved traffic can be transmitted when some bandwidth is available on the links. The purpose of an efficient bandwidth management is to reserve on the links as many bandwidth as possible with a guaranteed quality of service, and to use the inherent remaining bandwidth to transport traffic from the users who are just expecting a "best effort" service. The Path Selection algorithm for non-reserved connections comprises the step of weighing each transmission link with a weighing function dependent of both reserved non-reserved traffic.

Eric Levy-Abegnoli

Papers

Fault tolerant recoverable TCP/IP connection router

Distributed scalable device for selecting a server from a server cluster and a switched path to the selected server

Forwarding packets to a directed acyclic graph destination using link selection based on received link metrics

Method and system for dispatching client sessions within a cluster of servers connected to the World Wide Web

Method and system for selecting path according to reserved and not reserved connections in a high speed packet switching network