USING A SERVER'S CAPABILITY PROFILE TO ESTABLISH A CONNECTION

• US 20100161741A1
• Filed: 12/24/2008
• Published: 06/24/2010
• Est. Priority Date: 12/24/2008
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Pi, Jianwen, Tumuluru, Laxminarayana, Jiang, Dongyi
• Granted Patent: US 8,224,976 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

A network device connects between a client and a server. The network device is configured to store information regarding a capability of the server; receive a first message, from the client, intended for the server; obtain the stored information regarding the capability of the server; generate a second message that includes the information regarding the capability of the server; send the second message to the client; receive a third message from the client; and establish, based on the third message, a connection between the client and the server.

Claims

1. A network device connected between a client and a server, comprising:

a memory to store a plurality of records, one of the records including information regarding a capability of the server; and

a processor, connected to the memory, to;

receive a first message, from the client, intended for the server,

access the memory, in response to the first message, to obtain the information regarding the capability of the server,

generate a second message that includes the information regarding the capability of the server,

send the second message to the client,

receive a third message from the client, and

establish, based on the third message, a connection between the client and the server.

2. The network device of claim 1, where the first message is a synchronization (SYN) message, the second message is a synchronization (SYN)+acknowledgment (ACK) (SYN+ACK) message, and the third message is an ACK message.

3. The network device of claim 1, where the information, stored in the memory, regarding the capability of the server includes a value regarding at least one of a maximum segment size, a window scale size, a selective acknowledgment, or a window size.

4. The network device of claim 1, where the processor is further configured to:

monitor communication between the server and a client, where the communication includes the information regarding the capability of the server, and

store the information regarding the capability of the server in the memory.

5. The network device of claim 1, where the network device is a firewall connected between the client and the server.

6. The network device of claim 1, where, when establishing the connection between the client and the server, the processor is configured to:

send a fourth message to the server,

receive a fifth message from the server, and

send a sixth message to the server and to the client to establish the connection.

7. The network device of claim 6, where the fourth message is a synchronization (SYN) message, the fifth message is a synchronization (SYN)+acknowledgment (ACK) (SYN+ACK) message, and the sixth message is an ACK message.

8. The network device of claim 1, where the network device connects to a plurality of servers, and where each of the records, in the memory, stores information regarding a capability of one of the plurality of servers.

9. The network device of claim 1, where the processor is further configured to:

generate a signature from information regarding at least one of the client or the server, and

store the signature as an initial sequence number in the second message.

20. The network device of claim 1, where the network device is a firewall connected between the client and the server.

10. A method, comprising:

storing, in a memory, information regarding a capability of a server;

intercepting, from a client and over a network, a synchronization (SYN) message intended for the server;

identifying, from the memory, the information regarding the capability of the server;

generating a SYN+acknowledgment (ACK) (SYN+ACK) message that includes the information regarding the capability of the server;

transmitting the SYN+ACK message to the client;

receiving an ACK message from the client over the network; and

determining whether to establish the connection between the client and the server based on the ACK message.

11. The method of claim 10, where storing the information regarding the capability of the server includes storing a value regarding at least one of a maximum segment size, a window scale size, a selective acknowledgment, or a window size.

12. The method of claim 10, further comprising:

monitoring communication from the server, where the communication includes the information regarding the capability of the server.

13. The method of claim 10, where the method is performed by a firewall connected between the client and the server.

14. The method of claim 10, further comprising:

transmitting a second SYN message to the server;

receiving a second SYN+ACK message from the server; and

transmitting a second ACK message to the server to establish the connection between the client and the server.

15. The method of claim 10, further comprising:

generating a signature from information regarding the client and the server; and

storing the signature as an initial sequence number in the SYN+ACK message.

16. The method of claim 10, further comprising:

monitoring information provided by the server during a three-way handshake; and

storing the information as the information regarding the capability of the server.

17. A network device connected between a client and a server, comprising:

means for monitoring information provided by the server during a three-way handshake;

means for storing the information as information regarding a capability of the server;

means for receiving, from the client, a request to establish a connection with the server;

means for performing, on behalf of the server, a three-way handshake with the client, where the information regarding the capability of the server is provided during the three-way handshake;

means for performing a three-way handshake with the server when the three-way handshake with the client is successful; and

means for establishing the connection between the client and the server when the three-way handshake with the server is successful.

18. The network device of claim 17, where the three-way handshake with the client includes a synchronization (SYN) message, a synchronization (SYN)+acknowledgment (ACK) (SYN+ACK) message, and an ACK message.

19. The network device of claim 17, where the information regarding the capability of the server includes a value regarding at least one of a maximum segment size, a window scale size, a selective acknowledgment, or a window size.