Method and system for managing of denial of service attacks using bandwidth allocation technology

A computer-readable medium including a program for managing attacks in a computer system, the computer system used in sending, receiving, or sending and receiving a plurality of packets, the plurality of packets including a plurality of administrative packets, the program including instructions for:

• (a) determining whether a congestion of the administrative packets exists, the congestion of the administrative packets indicating that a potential attack exists;
• and
• (b) discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists, the portion of the plurality of packets being sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than a maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than a minimum administrative packet bandwidth guarantee.

A system managing attacks in a computer network including a switch, the switch used in sending, receiving, or sending and receiving a plurality of packets to, from, or to and from the computer network, the plurality of packets including a plurality of administrative packets, the system comprising:

• a queue for use in transmitting traffic through the switch;
• and
• an enqueuing mechanism, coupled with the queue, for controlling traffic through the switch using a minimum administrative packet bandwidth guarantee and a maximum administrative packet bandwidth limit, the enqueuing mechanism for determining whether congestions exists, the congestion of the administrative packets indicating that a potential attack exists, and for discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists, the portion of the plurality of packets being sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than the maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than the minimum administrative packet bandwidth guarantee.

A processor for use with a switch in a computer network, the processor being coupled to a plurality of ports and a switch fabric, the switch for managing attacks in a computer network including a switch, the switch used in sending, receiving, or sending and receiving a plurality of packets to, from, or to and from the computer network, the plurality of packets including a plurality of administrative packets, the processor comprising:

• a queue for use in transmitting traffic through the switch;
• and
• an enqueuing mechanism, coupled with the queue, for controlling traffic through the switch using a minimum administrative packet bandwidth guarantee and a maximum administrative packet bandwidth limit, the enqueuing mechanism for determining whether congestions exists, congestion of the administrative packets indicating that a potential attack exists, and for discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists, the portion of the plurality of packets being sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than a maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than a minimum administrative packet bandwidth guarantee.

A switch for use in a computer network including a plurality of hosts, the switch comprising:

• a plurality of processors, each of the plurality of processors coupled with a plurality of ports, the plurality of ports coupled with a portion of the plurality of hosts, each of the plurality of processors including a queue and an enqueuing mechanism, the enqueuing mechanism being coupled with the queue and for controlling traffic through the switch using a minimum administrative packet bandwidth guarantee and a maximum administrative packet bandwidth limit, the enqueuing mechanism for determining whether congestions exists, congestion of the administrative packets indicating that a potential attack exists, and for discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists, the portion of the plurality of packets being sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than a maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than a minimum administrative packet bandwidth guarantee;
• and
• a switch fabric coupling the plurality of processors.