51
LLDP-MED endpoint devices are located at the network edge and communicate using the LLDP-MED
framework. Any LLDP-MED endpoint device belongs to one of the following three classes:
• Class 1 (Generic Endpoint Devices): These devices offer the basic LLDP discovery services,
network policy advertisement (VLAN ID, Layer 2/802.1p priority, and Layer 3/DSCP priority), and
PoE management. This class includes such devices as IP call controllers and communication-related
servers.
• Class 2 (Media Endpoint Devices): These devices offer all Class 1 features plus media streaming
capability, and include such devices as voice/media gateways, conference bridges, and media
servers.
• Class 3 (Communication Devices): These devices are typically IP phones or end-user devices that
otherwise support IP media and offer all Class 1 and Class 2 features, plus location identification
and emergency 911 capability, Layer 2 switch support, and device information management.
Appendix F: Virus Throttle security
Virus Throttle is based on the detection of anomalous behavior of network traffic that differs from a
normal activity. Under normal activity, a computer will make fairly few outgoing connections to new
computers, but instead is more likely to regularly connect to the same set of computers. This is in
contrast to the fundamental behavior of a rapidly spreading worm, which will attempt many outgoing
connections to new computers. For example, while computers normally make approximately one
connection per second, the SQL Slammer virus tries to infect more than 800 computers per second.
