Methods and apparatus for enabling detection of configuration changes in a network device. One method uses a configuration counter in a system database of the network device. In response to an atomic submission of CLI commands to a configuration agent and the storing of the corresponding configuration in a system database, the configuration counter is incremented. An OpenConfig module maintains an expected value of the configuration counter and, upon completion of its own command submissions, compares the expected value to the value in the configuration counter. If the two values do not match, it indicates that the configuration counter in the system database has been incremented as a result of a configuration change from a source other than the OpenConfig module. A configuration client can then be notified of the configuration change so that it can revert the configuration to a desired configuration.
H04L 41/0869 - Validating the configuration within one network element
H04L 41/0853 - Retrieval of network configuration; Tracking network configuration history by actively collecting configuration information or by backing up configuration information
2.
Reduced Outage Time With Improved Download to Hardware Tables Based on Valid Entries
Software tables in the control plane of a network device are downloaded into the data plane hardware after a reboot of the control plane. Valid entries are identified and downloaded while reducing the downloading invalid or otherwise unused entries to improve download times and reduce disruption of traffic resulting from the download. In some instances, blocks of entries containing a high ratio of valid to invalid entries are identified and downloaded to the hardware. In some instances, entries in the software tables that differ from corresponding entries in the hardware (diff entries) are identified and downloaded. In some instances, chunks containing diff entries and non-diff entries are identified and downloaded.
H04L 41/082 - Configuration setting characterised by the conditions triggering a change of settings the condition being updates or upgrades of network functionality
Systems and methods are disclosed for acknowledgement-based retirement of expired secure association keys (SAK). A new SAK is generated by a key server. The new SAK is transmitted to members of a connectivity association (CA). The new SAK for key server ingress traffic is installed. An ingress SAK installation acknowledgement is received from the members of the CA. The new SAK for key server egress traffic is installed at the key server, based on receiving the ingress SAK installation acknowledgement from the members of the CA. A key server egress SAK installation notification is transmitted to the members of the CA A prior secure association key is retired after a configurable SAK retirement buffer delay in response to an earlier occurrence of either: receipt of an egress SAK installation acknowledgement from the members of the CA and expiration of a SAK retirement buffer delay, or expiration of a SAK retirement timeout.
Software tables in the control plane of a network device are downloaded into the data plane hardware after a reboot of the control plane. Valid entries are identified and downloaded while reducing the downloading invalid or otherwise unused entries to improve download times and reduce disruption of traffic resulting from the download. In some instances, blocks of entries containing a high ratio of valid to invalid entries are identified and downloaded to the hardware. In some instances, entries in the software tables that differ from corresponding entries in the hardware (diff entries) are identified and downloaded. In some instances, chunks containing diff entries and non-diff entries are identified and downloaded.
A method and apparatus of a network element that processes control plane data in a network element is described. In an exemplary embodiment, the network element receives control plane data and determines a class of the control plane data. In addition, the network element marks the control plane data based on at least on an existence of an indication of whether the network element had previously processed other data in the same class as the class of the control plane data. Furthermore, the network element queues the control plane data.
H04L 47/2441 - Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
H04L 49/25 - Routing or path finding in a switch fabric
6.
Detecting duplicate network device identifiers for routing protocols
Embodiments of the present disclosure include techniques for detecting duplicate network device identifiers for routing protocols. A network device may receive a link state packet comprising a first network device identifier for use in a routing protocol. The network device may, upon determining that the link state packet satisfies a set of conditions, start a timer. The network device may, while the timer has not elapsed, maintain a count value of link state packets received that satisfy the set of conditions. The network device may, when the timer has elapsed, determine, based on the count value and a defined threshold value, that a second network device in the network is configured with a second network device identifier for use in the routing protocol that is the same as the first network device identifier.
Systems, methods, and computer-readable media are disclosed for annotating configuration language function evaluation. One or more configuration language expressions may be received by a configuration language development environment. The one or more configuration language expressions may be parsed into one or more atomic configuration language expressions. Based on a particular route at the specified point of execution in an application, the one or more configuration language expressions may be evaluated. The annotations may be rendered to provide an explanation of an underlying control flow.
Embodiments of the present disclosure include multiple DC-DC converters configured to generate multiple voltages based on one or more voltage sources. The DC-DC converters are configured to produce a first voltage and second voltage when a first power source is active, when a second power source is active, or when both the first and second power sources are active. In example embodiments, one voltage is used by a network device to power internal circuitry, and another voltage is coupled to tethered devices.
H02M 3/158 - Conversion of dc power input into dc power output without intermediate conversion into ac by static converters using discharge tubes with control electrode or semiconductor devices with control electrode using devices of a triode or transistor type requiring continuous application of a control signal using semiconductor devices only with automatic control of output voltage or current, e.g. switching regulators including plural semiconductor devices as final control devices for a single load
H02M 3/157 - Conversion of dc power input into dc power output without intermediate conversion into ac by static converters using discharge tubes with control electrode or semiconductor devices with control electrode using devices of a triode or transistor type requiring continuous application of a control signal using semiconductor devices only with automatic control of output voltage or current, e.g. switching regulators with digital control
A proactive energy-saving processing in an access point (AP) device is described. The AP monitors/computes usage/operating parameters (load factors) of the AP, and based on the obtained parameters, adjusts one or more AP operating parameters to reduce power consumption. The process is proactive in the sense that the current conditions in the AP do not require scaling back AP functionality. Nonetheless, the AP can scale back some functionality to reduce its power consumption, proactively, despite the absence of a need to do so.
Methods and devices for distributing routes in a network are disclosed. The methods include identifying priority routes for a plurality of routes in a network device. The method also includes establishing communications with a neighboring network device and sending a first set of routes of the plurality routes to the neighboring network device. The first set of routes is selected based on a relative priority of the first set of routes to non-selected routes of the plurality of routes. The neighboring network device receives the first set of routes, and writes the first set of routes to forwarding hardware of the neighboring network device. The programmed routes are then used to route packets in the network.
The distribution of reachability information between data centers includes receiving routes that are advertised among network devices within a given data center. The received routes are summarized to produce one or more summarized (aggregated) routes which are fewer in number than the received routes. Instead of advertising the received routes among the data centers, the summarized routes are advertised. Advertising the summarized routes as compared to the received routes reduces control plane traffic between data centers, and reduces the requirements for storing advertised routes received by a data center.
H04L 61/103 - Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
14.
Network devices with hardware accelerated table updates
A network device can include a main processor and a packet processor. A method is provided that includes storing a table of values in the packet processor, using the packet processor to receive from the main processor a value that can be used to update the table of values, and using acceleration hardware in the packet processor to update the table of values based on the value received from the main processor without any additional interaction with the software running on the main processor.
A routing policy includes policy directives and policy functions. Execution of the routing policy includes invoking a policy function at a point of application in a policy directive. Execution of the invoked policy function can include making any number of nested function calls. When an EXIT statement is encountered in a nested policy function, execution of the policy function terminates and execution of the routing policy continues immediately with the policy directive following the point of application, irrespective of how deeply nested in the invocation hierarchy the policy function is.
A method of operating a network device is provided. In response to an unplanned reboot, the network device can determine whether an unplanned reboot expedited recovery feature has been enabled on the network device. After determining that the unplanned reboot expedited recovery feature is enabled, the network device can identify a cause of the unplanned reboot. If the cause of the unplanned reboot is from a first set of events, a first bootup sequence can be performed. If the cause of the unplanned reboot is from a second set of events, a second bootup sequence that is expedited relative to the first bootup sequence can be performed.
A method for reverse path forwarding (RPF) selection by a network device connected to a network includes receiving an advertisement message from each of a plurality of neighbor devices within the network, parsing the advertisement message to determine a color identification (ID) of each of the neighbor devices, and selecting, from among the neighbor devices, a RPF device based on the color ID of each of the neighbor devices.
Methods, computer-readable media, and systems are disclosed for coordinating host link status and installation of egress filters in coordination with a multi-chassis link aggregation group (MLAG) peer. In response to receiving a request from an MLAG peer to install an egress filter, a local network device provides an indication that the local device has entered a local egress filter installed state. Next, a filter-installed watermark value associated with the local network device is incremented. The local network device provides an indication that the egress filter has been installed. Finally, in response to determining that the MLAG peer network device is not indicating a request peer to install filter status, a local network device indicates a link down status and uninstalls its local egress filter. Alternatively, in response to determining that the local network device is in a link up status, the local device indicates that an MLAG peer should install an egress filter. In response to determining that the peer network device is in a filter request status, installing a local egress filter.
Hitless migration of network devices for communication between two data centers using a dual IP stack mode is provided herein. In a first data center, a first gateway receives first routing information from an edge device regarding a first set of routes associated with a first host device in the first data center. The first gateway device generates a second set of routes that include a first address of the edge device formatted according to a first communication protocol. The second set of routes is exported to a second gateway device in a second data center. The first gateway device receives an encapsulated data packet having a first overlay that includes the first address from the second gateway device. The first gateway device decapsulates and re-encapsulates the data packet and a re-encapsulated data packet is sent to the edge device, the re-encapsulated data packet having a second overlay that includes the second address. The first address is formatted according to a first communication protocol and the second address is formatted according to a second communication protocol.
A method of operating a network device is provided. The method may include updating a software forwarding table in response to a link between the network device and one or more next hops device being disconnected or connected. The software forwarding table may list next hop devices currently available or connected to the network device for a given destination prefix. The method may include determining whether to update a hardware forwarding table also associated with the given destination prefix depending on whether one or more criteria have been satisfied. The hardware forwarding table may be updated in accordance with a resilient mode or an ordered mode. The resilient mode takes into account history information associated with the hardware forwarding table, whereas the ordered mode does not take into account the history information associated with the hardware forwarding table.
A network device may receive a packet from a virtual tunnel end point. The packet may be configured to have a transmission control protocol (TCP) maximum segment size (MSS) data field containing a value. The network device may be configured to determine a minimum Maximum Transmission Unit (MTU) value to the virtual tunnel end point. The network device may be configured to replace the value with a replacement value based on the minimum MTU value.
In general, embodiments relate to a method for establishing trust between supervisors in a network device, the method including obtaining, by a first supervisor, signed platform configuration register (PCR) values from a second supervisor, wherein the first supervisor and the second supervisor are located in the network device, comparing the signed PCR values with stored PCR values, where the stored PCR values were previously obtained by the first supervisor from the second supervisor, and establishing, based on the comparison, trust with the second supervisor.
H04L 9/32 - Arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system
In general, embodiments relate to a method for establishing trust between supervisors in a network device, the method including obtaining, by a first supervisor, signed platform configuration register (PCR) values from a second supervisor, wherein the first supervisor and the second supervisor are located in the network device, comparing the signed PCR values with stored PCR values, where the stored PCR values were previously obtained by the first supervisor from the second supervisor, and establishing, based on the comparison, trust with the second supervisor.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
H04L 9/32 - Arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system
24.
SYSTEMS AND METHODS FOR PROCESSING HEARTBEAT PACKETS IN SWITCHING HARDWARE
Systems and methods for increasing the speed with which a network device can process “heartbeat” packets that are transmitted between the network device and its peers to verify that the communication links between them are active, or to detect when the communication links go down (i.e., are inactive). Received heartbeat packets are processed primarily by a switching application specific integrated circuit (ASIC) rather than a CPU of the network device. The switching ASIC identifies heartbeat sessions corresponding to received heartbeat packets and resets aging timers for these sessions if the timers have not already expired. The reduced processing and faster timing mechanism of the switching ASIC enables the network device to accommodate spikes in the received packet rate.
H04L 67/145 - Termination or inactivation of sessions, e.g. event-controlled end of session avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
H04L 67/62 - Establishing a time schedule for servicing the requests
25.
Interlocking Border Gateway Protocol and Multi-Chassis Link Aggregation Group Processes for Network Devices
Embodiments of the present disclosure include techniques for interlocking border gateway protocol and multi-chassis link aggregation group processes for network devices. A first process for configuring a link aggregation group with a second network device is performed. Whether an option to use a media access control (MAC) address shared with the second network device is active is determined. Upon determining that the option to use the MAC address shared with the second network device is active, a second process for configuring the first network device to transmit inter-subnet connectivity information using the shared MAC address is performed.
Starting a spanning tree protocol (STP) process in a network device excludes performing a root bridge election sequence. The network device receives and learns the STP roles and STP states of its ports based on the received bridge protocol data units (BPDUs) during a quiescent period of time subsequent to starting STP processing. Port role and port state learning occur absent the generation and transmission of BPDUs during the quiescent period of time. Subsequent to the end of the quiescent period, the network device commences generating and transmitting BPDUs.
Methods and network devices for applying access-control lists (ACL) to hosts are disclosed. An ACL to apply to a host is determined and an ACL identifier is associated with this determined ACL. The ACL identifier is associated with a media access control (MAC) address of the host. An ACL entry, including the ACL and the ACL identifier for the ACL, is created in a special purpose memory. When a packet is received from the host, the MAC of the host is determined from the packet and the ACL identifier for the ACL is determined from the association between the ACL identifier and the MAC address. Based on the ACL identifier, a lookup is performed in the special purpose memory to determine the ACL from the ACL entry in the special purpose memory such that the ACL is applied to the packet received from the host.
Embodiments described herein relate to techniques for route control. The techniques may include obtaining, by a routing information base (RIB) agent, a route policy for performing a route action; receiving, by the RIB agent, a route from a routing protocol; analyzing, by the RIB agent, the route using to make a determination about whether to perform the route action; and performing, by the RIB agent, the route action based on the determination. Route actions may include actions relating to route modification, route redistribution, modifications of various attributes of a route, etc.
42 - Scientific, technological and industrial services, research and design
Goods & Services
Software as a service (SAAS) services featuring software for
interconnecting computers, servers, and storage devices;
software as a service (SAAS) services featuring software for
use in monitoring, managing, configuring, connecting,
controlling, provisioning, securing, and operating local
area networks, data centers, routers, switches, servers and
storage devices, wireless devices, wireless access point
devices, and network infrastructure; software as a service
(SAAS) services featuring software for use in connecting
local area networks, public networks, cloud networks, and
hybrid networks and systems.
In general, the disclosure relates to a method for redirecting a user to a captive portal. The method includes trapping an incoming frame originating from a host, where the incoming frame comprises a L2 header and a payload, wherein the payload specifies information associated with an external server, wherein the user of the host has not been authenticated by the captive portal at a time when the incoming frame is trapped, extracting the L2 header, an L3 header, and the payload from the incoming frame, forwarding the L3 header and the payload towards a redirection server executing on the network device, wherein the redirection server is configured to generate a redirection response based on the payload; encapsulating the redirection response to obtain an L3 response packet, encapsulating the L3 response packet using information from the L2 header to obtain an output frame, and transmitting the output frame towards the host.
A method for managing a network includes obtaining network flow data corresponding to a network device in the network, determining, based on the network flow data, configuration coverage associated with forwarding control configuration of the network device, identifying, using the configuration coverage and the forwarding control configuration, non-coverage, generating a plurality of synthetic packets based on the non-coverage, transmitting the plurality of synthetic packets to the network device, obtaining a set of results associated with the plurality of synthetic packets, making a determination, based on the set of results, that the network device is not implementing at least a portion of the non-coverage correctly, and based on the determination, performing a remediation action on the network device.
H04L 41/0816 - Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
H04L 41/0654 - Management of faults, events, alarms or notifications using network fault recovery
H04L 47/2441 - Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
33.
SUPPORTING DIFFERENT SECURITY SCHEMES WITH DIFFERENT BOOT PERSONALITIES FOR NETWORK DEVICES
Devices and methods for managing boot personalities in a network device are disclosed. The method includes, after powering on the network device, a programmable component of the network device outputting a first signal unique to a first boot personality. One or more switches are toggled based on the first signal. The toggling results in connecting at least one of one or more first components in the network device associated with the first boot personality and disconnecting at least one of one or more second components in the network device associated with a second boot personality.
A method and system for multicast flow restoration following network failure detection. Specifically, in addressing the aftermath following a network failure, one or more embodiments disclosed herein propose a solution through which failure-impacted network multicast(s) may be identified and, subsequently, restored with or without third-party intervention. To that end, one or more embodiments disclosed herein employ(s) a centralized network controller configured to obtain aggregated network state, including network topology information, through numerous logical agents interspersed across a network. Thereafter, the aggregated network state may be leveraged to ascertain and remedy any network multicast disruptions.
H04L 41/0604 - Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
H04L 41/0659 - Management of faults, events, alarms or notifications using network fault recovery by isolating or reconfiguring faulty entities
H04L 47/2483 - Traffic characterised by specific attributes, e.g. priority or QoS involving identification of individual flows
H04L 41/12 - Discovery or management of network topologies
H04L 43/0817 - Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
A method and system for deterministic network bandwidth aware multicast flow provisioning. In addressing network bandwidth oversubscription, embodiments disclosed herein propose a solution through which an intelligent and deterministic methodology may be implemented for provisioning network multicast traffic flows in order to minimize, if not eliminate, network bandwidth oversubscription. To that end, embodiments disclosed herein employ a centralized network controller configured to obtain a range of aggregated network state pertinent to deterministic, network bandwidth aware multicast traffic flow programming. Said aggregated network state may be collected through a number of logical agents dispersed throughout a network, and may include network device connectivity, network path or link bandwidth capacity, and network multicast status information. The aggregated network state may be leveraged to identify available network path(s) across the network whereon network multicasts can be provisioned without oversubscribing the network bandwidth available on those network path(s).
Devices and methods for managing boot personalities in a network device are disclosed. The method includes, after powering on the network device, a programmable component of the network device outputting a first signal unique to a first boot personality. One or more switches are toggled based on the first signal. The toggling results in connecting at least one of one or more first components in the network device associated with the first boot personality and disconnecting at least one of one or more second components in the network device associated with a second boot personality.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
42 - Scientific, technological and industrial services, research and design
Goods & Services
software as a service (SAAS) services featuring computer software using artificial intelligence and machine learning for computer network security and managing computer networks; software as a service (SAAS) services featuring computer software using artificial intelligence and machine learning for threat investigations and predictive incident response, namely, for detecting and removing network vulnerabilities for computer security and for protecting private information on enterprise networks; software as a service (SAAS) services featuring software using machine learning, data analytics, and artificial intelligence in the field of network security, computer security and data security compliance risk identification and diagnosis, decision making, management, pre-emptive risk planning and mitigation, threat investigations, and network security incident responses; software as a service (SAAS) services featuring online non-downloadable chatbot software using artificial intelligence for troubleshooting of computer networks, computer network security, and computer software problems
A networking system may disrupt an unauthorized wireless connection to the network. In particular, the networking system may detect a wireless connection between a client device and an unauthorized wireless access point. The networking system may receive a probe request management frame from the client device. The network system may, responsive to the detection of the wireless connection, send a probe response management frame to the client device.
A method and system for centralized network multicast state publication. Specifically, in overcoming the limitation(s) of existing monitoring and/or reporting approaches to ascertaining network multicast state, embodiments disclosed herein deliver a solution for centralized network multicast state publication. To that end, embodiments disclosed herein employ a centralized network controller configured to obtain aggregated network state, including network multicast state, through embedded logical agents interspersed across a network (e.g., on each network device). Thereafter, the network multicast state may be published through one or many notification channel(s) to any number of subscribing consumers interested in the network multicast state. Furthermore, the notification channel(s) may be implemented using an open-source, distributed, in-memory database that also features a message queuing (or messaging) system. Specifically, the network multicast state (or varying contexts thereof) may be packaged as message(s) (or notification(s)) and thus published to any subscribing consumer(s) through the appropriate notification channel(s).
A logical table is configured with a first set of memory banks, where each logical row in the logical table comprises a corresponding memory row from each of the memory banks. Lookup instructions to access a logical row includes a bank set that lists the memory banks associated with that logical row. In response to a range of memory rows of one of the memory banks being reallocated to another logical table, a new memory bank is identified to store the data in the reallocated memory rows. Logical rows associated with the reallocated memory rows are mapped to the new memory bank. Bank sets in the lookup instructions that refer to the remapped logical rows are updated to list the new memory bank in place of the “old” memory bank.
G06F 3/00 - Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
G06F 3/06 - Digital input from, or digital output to, record carriers
41.
STATEFUL MEDIA ACCESS CONTROL SECURITY SWITCHOVER SUPPORT
A method for managing a group of secured network devices. The method includes detecting, by a switchover agent operating in a secured network device of the group of secured network devices, a switchover between two supervisors operating in the secured network device, based on the detecting: generating a modified heartbeat packet, wherein the modified heartbeat packet comprises a suspension time that is significantly larger than a heartbeat interval, and sending the modified heartbeat packet to a second secured network device of the group of secured network devices.
A switch system including a plurality of pluggable modules, a plurality of cages housing the plurality of pluggable modules, and a host printed circuit board (PCB). The system is designed to improve airflow around the host PCB to facilitate cooling. The cages may be designed to have airflow openings on a bottom surface thereof (facing towards the host PCB). The pluggable modules may be designed to have a heat sink on an external lower surface (facing towards the host PCB), which may be in the form of external fins. The host PCB may be designed to have cut-outs in a front portion thereof. The cooperation of the, and the airflow openings, heat sinks, and cut-outs create improved airflow for cooling of the host PCB.
A networking system may disrupt an unauthorized wireless connection to the network. In particular, the networking system may detect a wireless connection between a client device and an unauthorized wireless access point. The networking system may receive a probe request management frame from the client device. The network system may, responsive to the detection of the wireless connection, send a probe response management frame to the client device.
A method and apparatus of a network device that allocates a shared memory buffer for an object is described. In an exemplary embodiment, the network device receives an allocation request for the shared memory buffer for the object. In addition, the network device allocates the shared memory buffer from shared memory of a network device, where the shared memory buffer is accessible by a writer and a plurality of readers. The network device further returns a writer pointer to the writer, where the writer pointer references a base address of the shared memory buffer. Furthermore, the network device stores the object in the shared memory buffer, wherein the writer accesses the shared memory using the writer pointer. The network device further shares the writer pointer with at least a first reader of the plurality of readers. The network device additionally translates the base address of the shared memory buffer to a reader pointer, where the reader pointer is expressed in a memory space of the first reader.
Techniques for operating a network device for increasing the logical multi-path size of a hardware forwarding table are provided. In some embodiments, the network device may determine that a number of data points in a first node is greater than a maximum node capacity; generate second nodes; update the first node to refer to the second nodes; distribute the data points among the second nodes; and program a hardware table with the updated first node and the second nodes.
A switch system including a plurality of pluggable modules, a plurality of cages housing the plurality of pluggable modules, and a host printed circuit board (PCB). The system is designed to improve airflow around the host PCB to facilitate cooling. The cages may be designed to have airflow openings on a bottom surface thereof (facing towards the host PCB). The pluggable modules may be designed to have a heat sink on an external lower surface (facing towards the host PCB), which may be in the form of external fins. The host PCB may be designed to have cut-outs in a front portion thereof. The cooperation of the, and the airflow openings, heat sinks, and cut-outs create improved airflow for cooling of the host PCB.
Some embodiments provide techniques for optimized programming of forwarding data in network device hardware. An operating system executing on the network device receives information associated with a network topology of a network(s) to which the network device belongs. Based on this information, the operating system can generate various data structures that facilitate the routing and forwarding of data through the network device. Based on the generated data structures, the operating system may then program hardware resources in the network device in order to implement routing and forwarding operations stored in the data structures. During generation of the data structures, the operating system may perform some operations to optimize the programing of the hardware resources in a manner that reduces the amount of hardware resources that would otherwise be used without such optimizations.
A method of managing inter-branch communication is a network, including generating an end-to-end path, wherein the end-to-end path starts in a first computing device in a first branch and ends at a second computing device in a second branch, wherein the end-to-end path is generated using a plurality of flow records and a plurality of path records and the end-to-end path includes a wide area network (WAN) segment, and issuing, based on the generating, a notification to a network administrator, wherein the notification specifies the end-to-end path and a latency associated with at least one segment in the end-to-end path.
Management of a plurality of sub-tunnels is disclosed herein. Resource utilization of a plurality of sub-tunnels of a network tunnel implementing a Resource Reservation Protocol is monitored. A resource utilization of a first set of the sub-tunnels exceeding a defined utilization threshold is detected. As a result of the detection, an adjusted resource utilization is determined for a second set of the sub-tunnels. The resource utilization of the second set of sub-tunnels may be less than a defined utilization threshold. The adjusted resource utilization is established for the second set of sub-tunnels for a next measurement interval. The adjusted resource utilization of each sub-tunnel of the second subset of sub-tunnels may be less than a lowest resource utilization among the first set of sub-tunnels.
A networking system may include one or more wireless access points. A wireless access point may monitor, on a channel in a radio-frequency band, for activity of an interference source over a time period. The wireless access point may maintain historical activity information of the interference source for the channel based at least in part on the activity of the interference source over the time period. The wireless access point may perform a channel selection operation based at least in part on the maintained historical activity information of the interference source for the channel.
A method for managing streams includes obtaining, by a state processing module in a coordination point, a notification for a standing query, and in response to the notification: identifying a storage location in the coordination point associated with a stream of the standing query, initiating a subscription to the standing query using the storage location, reserving a data buffer for the standing query, replicating, based on the standing query, data of the data stream using the storage location, updating the data buffer using the replicated data or a reference to the replicated data to obtain an updated data buffer, and servicing the standing query using the updated data buffer.
G06F 16/27 - Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
G06F 16/2458 - Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
52.
DOMAIN NAME SYSTEM ANALYSIS ON EDGE NETWORK DEVICES
A method for analyzing a pair of domain name system (DNS) packets, the method comprising: extracting a portion of a request DNS packet to obtain extracted request DNS information, wherein the extracted request DNS information comprises a first timestamp generated by the edge network device, obtaining a response DNS packet, extracting at least a portion of the response DNS packet to obtain extracted response DNS information, wherein the extracted response DNS information comprises a second timestamp generated by the edge network device, after the obtaining, processing the extracted request DNS information and extracted response DNS information to obtain processed information, wherein the processed information comprises a roundtrip time derived from the first timestamp and the second timestamp, and transmitting the processed information to a monitoring system, wherein the pair of DNS packets are not transmitted to the monitoring system.
In general, embodiments relate to a method for managing a network device, including receiving an incoming frame originating from a host, where the incoming frame includes IP address of the host and a payload specifying information associated with an external server. The further includes determining, using the IP address of the host and an IP address to segment identifier (ID) mapping, that the host is associated with a first segment, in response to the determining, forwarding the incoming frame towards a redirection server executing on the network device, where the first segment is associated with a first policy and where the first policy specifies that the incoming frame is to be forwarded to the redirection server. The method further includes receiving a redirection frame including a uniform resource locator (URL) of a captive portal, transmitting the redirection frame towards the host, wherein the user of the host is authenticated by the captive portal based, at least in part, on the redirection frame, and associating, after the user of the host has been authenticated by the captive portal, the host with a second segment, where the segment second permits the host to access the external server.
H04L 61/5014 - Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
H04L 61/103 - Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
Techniques described herein relate to a method for topology partition detection. Network devices within a network topology often share information to achieve desired network functionality. However, when a network topology becomes partitioned such that not all network devices are directly or indirectly connected to the other network devices, the information sharing may fail. Techniques described herein detect such network topology partitioning by analyzing information that represents the network topology, and the connections therein (e.g., a set of paths).
H04L 41/12 - Discovery or management of network topologies
H04L 43/0811 - Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking connectivity
A method for processing state information updates. The method includes receiving, by a coordination point, a plurality of state information from a plurality of network elements; processing at least one of the plurality of state information to generate a result; and applying the result to at least one of the plurality of network elements in order to modify an operation of the at least one of the plurality of network elements.
H04L 41/0816 - Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
H04L 41/00 - Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
Embodiments of the present disclosure include a switch processor programming agent to establish a logical interface to multiple switch processors in a network device. Feature agents for performing operations on a plurality of switch processors received configuration data. The switch processor programming agents translate the configuration data from a first format to a second format and program multiple switch processors in the second format. Switch processors may be switch ASICs for routing network traffic. In one embodiment, a switch processor and a redundant switch processor are maintained in the same state by the switch processor programming agent for seamless transition to the redundant switch processor when the other switch processor becomes inoperable.
H04L 45/28 - Routing or path finding of packets in data switching networks using route fault recovery
G06F 13/28 - Handling requests for interconnection or transfer for access to input/output bus using burst mode transfer, e.g. direct memory access, cycle steal
H04L 45/00 - Routing or path finding of packets in data switching networks
H04L 47/12 - Avoiding congestion; Recovering from congestion
57.
RESOURCE UNIT PUNCTURING AND ALLOCATION BASED ON QUALITY METRICS
Systems, methods, and computer-readable media are disclosed for applying quality metrics for resource unit (RU) allocation in connection with a wireless access point (AP). In response to detecting threshold utilization of an AP by multiple wireless clients, an RU score is initialized. For each initialized RU score, an updated RU score is periodically computed. To perform this computation several steps are performed. First, RU quality metrics are received. Next, each quality metric is multiplied by an associated weighting coefficient. Finally, the quality products are summed to provide an updated RU score. In response to determining that a puncture candidate RU has a puncture candidate RU score below a predetermined threshold, one or more RUs are punctured or otherwise de-prioritized. A request to assign new RUs is received. In response to the request to assign the new RUs, the new RUs are assigned based on the periodically updated RU scores.
A method for processing packets in a network device, comprising: determining that a packet received by the network device is to be processed using a next hop group, selecting a member of the next hop group, and transmitting the packet to a second network device associated with a second member of the next hop group.
A method and system for network endpoint identification through network fingerprint based entity resolution. Particularly, embodiments disclosed herein may entail receiving a network fingerprint descriptive of at least a network endpoint; obtaining at least two network endpoint label sets each inferred from the network fingerprint by a different network fingerprint parser; reducing, through entity resolution and heuristics, the at least two network endpoint label sets into a de-duplicated network endpoint label set; and resolving, through a voting algorithm, the de-duplicated network endpoint label set to obtain a unified network endpoint label that best identifies the network endpoint.
H04L 9/32 - Arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system
H04L 67/289 - Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
A distributed wireless gateway comprises several switches. Each switch is coupled to a respective set of wireless access points. When a given switch receives a packet from one of its wireless access points, it creates a mapping between that access point and the host that sent the packet to the access point. The given switch advertises to other switches in the distributed wireless gateway reachability information that maps that host to the switch, enabling the other switches to identify the given switch as the next hop when they receive a packet destined for that host.
A central controller in a data network can maintain a set of access control list (ACL) rules that represent traffic and data policies of the data network. The controller can autonomously propagate the set of ACL rules to switches in the data network. Each switch that receives the set of ACL rules can selectively install rules from the set based on criteria such as whether or not a given rule in the set is close to the source and device class.
In general, embodiments relate to a method, for managing a network, that includes determining an occurrence of an operational issue on a network device of the network, based on the determining, executing an encoding phase and a causal feature identification phase on a feature database, wherein the feature database is associated with the operational issue, identifying a plurality of potential root causes using the encoding phase and the causal feature identification phase, and performing an action based on the plurality of potential root causes.
H04L 41/0631 - Management of faults, events, alarms or notifications using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
In general, embodiments relate to a method, obtaining, by a monitoring fabric network device operating in the monitoring fabric, a packet, wherein the packet is a replication of a packet sent to a second network device, applying a classification to the packet, performing, using the classification, a modification on a layer 2 (L2) address of the packet to obtain a modified packet, wherein the modified packet includes a modified L2 address, and transmitting the modified packet to a second monitoring fabric network device based on forwarding policies, wherein the forwarding policies do not utilize the modified L2 address.
Packet processing in a EVPN L2 MPLS deployment includes performing tag editing operations in the egress pipeline. More particularly, tag manipulation is based on the egress port. Packet processing further includes performing ESI label selection in the egress pipeline, and includes selecting the ESI label based on the ingress port where the ingress port can be a physical port or a subinterface configured on a physical port.
A method for distributing an optimal path to a router using a route reflector, that includes obtaining, by the route reflector, a path location bitmask associated with the optimal path, obtaining a router location bitmask associated with the router, performing a bitwise AND operation on the path location bitmask and the router location bitmask to obtain a result bitmask, identifying a nonzero bit in the result bitmask, and in response to identifying the nonzero bit, sending the optimal path to the router.
Security Association (SA) rekeying between two endpoints of a network, is achieved without resorting to a central entity and a separate key management protocol. A packet sent from a first peer to a second peer is modified to add extra data to signal the rekey procedure, and to include cryptographic material to provide a new common keying material, which will be used to create new SAs. Since the rekey procedure is a multi-stage procedure, the peers are assigned (initiator/responder) roles in order to transition from one stage to another. Rekeying may be initiated by a timer present at one of the peers. Embodiments allow network peers to autonomously rekey without the help of a central controller, and each peer can rekey with only N−1 of its peers.
Systems and methods are provided herein for using a network device's software (e.g., programs executed on a CPU) to maintain and export flow data while offloading network resource intensive tasks to the network device's hardware. This may be accomplished by a network device determining whether a new flow should be tracked using only the software table (e.g., table stored only on the CPU) of the network device or whether certain flow tracking tasks (e.g., counting/parsing) can be offloaded to a hardware table (e.g., counter table in a hardware flow cache) of the network device. The network device may use one or more conditions to determine whether the new flow should be tracked using the software table or by both the software and the hardware table. The conditions can relate to the characteristics of the new flow, resource information, prioritization of the new flow, etc.
Embodiments of the present disclosure include techniques for securing the flow of configuration commands issued to network devices. When an authorized command source, such as an authorized user or program, issues a command, security data for the command is generated and associated with the command. The command and security data may flow across multiple software applications to the network device. The network device receiving the command may use the security data to verify that the command source is an authorized source and to validate that the command was unaltered.
H04L 41/0873 - Checking configuration conflicts between network elements
H04L 9/32 - Arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system
71.
SYSTEMS AND METHODS FOR VALIDATING, MAINTAINING, AND VISUALIZING SECURITY POLICIES
A method for updating a policy by a policy manager, that includes selecting, by the policy manager, a policy entry that includes an input and an implementation, performing a validation on the policy entry, making a first determination, based on the validation, that the implementation was not successful, and updating the policy, based on the first determination, to match the input.
Embodiments of the present disclosure include techniques for securing the flow of configuration commands issued to network devices, such as switches. When an authorized command source (120), such as an authorized user or program, issues a command, security data for the command is generated and associated with the command. The command and security data may flow across multiple software applications (130, 131) to the network device (100). The network device receiving the command may use the security data to verify that the command source is an authorized source and to validate that the command was unaltered. The security data may comprise a signature and a certificate.
In general, embodiments relate to a network device, including network device hardware including a processor; and memory comprising instructions which, when executed by the processor, performs a method for creating segment mapping in a network. The method includes entering a fallback mode in response to detecting a fallback scenario, determining, based on the fallback mode, a segment identification (ID) for a client device of the network, wherein the segment ID identifies a segment of the network including a client device, obtaining an Internet Protocol (IP) address to segment ID mapping, wherein the client device is associated with the IP address, and processing at least one packet from the client device using the IP address to segment ID mapping.
The present disclosure describes a network switch design that includes a vertical switch circuit board that is mounted parallel to the front panel of the network switch. The vertical circuit board supports switch chip(s) to process and forward packets and optical module connectors to receive pluggable optics modules that provide connections to other network switches. The arrangement of the circuit board, switch chip(s) and optical module connectors achieves reduced lengths for the electrical signal traces that connect the switch chip(s) to the optical module connectors. In addition, the design improves cooling by providing separate airflow regions between the switch chip heatsink(s) and the optics modules. The vertical switch card assembly and its components can be made removable from the front panel for ease of servicing.
H04B 10/00 - Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
G02B 6/42 - Coupling light guides with opto-electronic elements
H04B 10/80 - Optical aspects relating to the use of optical transmission for specific applications, not provided for in groups , e.g. optical power feeding or optical transmission through water
75.
HIGH SPEED NETWORK DEVICE WITH ORTHOGONAL PLUGGABLE OPTICS MODULES
The present disclosure describes a network switch design that includes a vertical switch circuit board that is mounted parallel to the front panel of the network switch. The vertical circuit board supports switch chip(s) to process and forward packets and pluggable module connectors to receive pluggable optics modules that provide connections to other network switches. The pluggable module connectors are horizontally oriented to facilitate routing of electrical signal traces. The arrangement of the circuit board, switch chip(s) and pluggable module connectors achieves reduced lengths for the electrical signal traces that connect the switch chip(s) to the pluggable module connectors. The design improves cooling by providing separate airflow regions between the switch chip heatsink(s) and the optics modules.
A method of allocating programmable memory in a network device includes receiving a set of desired features for the network device, and determining a plurality of constraints associated with the set of desired features. The plurality of constraints are converted into a plurality of Boolean representations of the constraints, and a feasibility is evaluated for the desired features based on the plurality of constraints.
H04L 47/762 - Admission control; Resource allocation using dynamic resource allocation, e.g. in-call renegotiation requested by the user or requested by the network in response to changing network conditions triggered by the network
A network device includes multiple interconnected network chips where the packet processing functionality is distributed between ingress and egress pipelines. TCP MSS clamping can be implemented in the egress pipeline. Processing in the egress pipeline can identify the presence of a TCP MSS value in the packet. The egress pipeline can compare the packet TCP MSS value with a user configured TCP MSS value. The egress pipeline can replace the packet TCP MSS value with the user configured TCP MSS value if the former is greater than the latter, and recompute a checksum. The packet with the replaced TCP MSS value and replaced checksum is then forwarded from the switch toward its eventual destination.
Embodiments of the present disclosure include techniques for discovering services across networks based on a multicast domain name system (mDNS) protocol. An mDNS request for available services in a network is received from a client device. The client device belongs to a particular layer 2 (L2) domain. In response to receiving the mDNS request, a storage of the network device configured to store service records is queried to determine a set of available services. The set of available services is provided in a L2 domain different from the particular L2 domain. A response that includes the set of available services is generated. The response is sent to the client device.
Embodiments allow a network device whose hardware limits an Association Number (AN) to only {0, 1}, to be part of Media Access Control security (MACsec). Upon detecting a network device as being AN-limited, that device’s priority value is assigned a maximum value, thereby ensuring election of the AN-limited device as the key server. The {0, 1} AN of the key server is used to generate a Secure Association Key (SAK) used for MACsec. Upon subsequent rekeying, the AN-limited key server automatically cycles to a next AN (either 0 or 1) to generate a new SAK, where that next AN is also recognized by other network devices. In this manner, the AN-limited network device can participate in the MACsec without encountering ANs (e.g., {2, 3}) that it does not recognize.
H04L 9/32 - Arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system
80.
EFFICIENT HITLESS UPGRADE OF PACKET PROCESSING FILTERS
Upgrading packet processing rules in a network device with a replacement set of rules includes generating an edit sequence that represents edit operations to transform an already-installed old set of rules into the replacement rules. The edit sequence is used to identify a subsequence of rules that is common to both the old rules and the replacement rules. A merged list is generated by a combination of the old rules, the replacement rules, and the common subsequence of rules. The merged list is downloaded to the network device, overwriting the old rules in bottom-up fashion to allow packet processing to continue concurrently using the old rules.
The present disclosure describes a network switch design that includes a vertical switch circuit board that is mounted parallel to the front panel of the network switch. The vertical circuit board supports switch chip(s) to process and forward packets and optical module connectors to receive pluggable optics modules that provide connections to other network switches. The arrangement of the circuit board, switch chip(s) and optical module connectors achieves reduced lengths for the electrical signal traces that connect the switch chip(s) to the optical module connectors. In addition, the design improves cooling by providing separate airflow regions between the switch chip heatsink(s) and the optics modules. The vertical switch card assembly and its components can be made removable from the front panel for ease of servicing.
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
Goods & Services
downloadable cloud-based software for authentication and identity management; downloadable cloud-based software for use in administering and managing access to and within computer networks and systems; downloadable cloud-based software for monitoring and implementing computer security; downloadable cloud-based software for use in providing secure wireless data transmission and network security. software as a service (SAAS) services featuring cloud-based software for authentication and identity management; software as a service (SAAS) services featuring cloud-based software for use in administering and managing access to and within computer networks and systems; software as a service (SAAS) services featuring cloud-based software for monitoring and implementing computer security; software as a service (SAAS) services featuring cloud-based software for providing secure wireless data transmission and network security.
83.
TRANSACTIONAL DISTRIBUTION OF MODELLED CONFIGURATION FROM A CENTRALIZED SERVER TO A PLURALITY OF SUBSIDIARY DEVICES
Techniques are provided for facilitating network devices to obtain configuration updates from a central configuration repository. Configuration update information is received regarding a configuration update in a configuration repository. A data tree is updated based on the configuration update information. An identifier unique to the update is generated. A determination is performed that network device properties of a network device correspond to a set of network device properties indicated for the configuration update information. A notification indicating the availability of the configuration update is sent over one or more networks to the network device.
H04L 41/0813 - Configuration setting characterised by the conditions triggering a change of settings
H04L 41/0853 - Retrieval of network configuration; Tracking network configuration history by actively collecting configuration information or by backing up configuration information
84.
METHOD AND SYSTEM FOR PROXIMITY-BASED EVENT CLUSTERING IN A NETWORK
Methods and a device for grouping events in a network is disclosed. The method includes receiving notification of a first event that includes attributes of the first event; determining a score between the first event and a second event; and grouping the first event and the second event into a first group based on the score. The method includes determining a first distance in a first dimension between the first event and the second event and calculating the score based on the first distance. The method further includes displaying the first group on a user interface (UI).
Methods, systems and devices for controlling an operating configuration of a network device such as a wireless access point include detecting power supplied to the access point. Operating parameters of the access point, neighboring access points, and client devices wirelessly connected to the access point are determined. The access point is placed in a reduced-capability operating configuration in response to detecting the power supplied is less than a power threshold. The reduced-capability operating configuration is based on the determined operating parameters of the access point, neighboring access points, and client devices.
H04W 52/36 - Transmission power control [TPC] using constraints in the total amount of available transmission power with a discrete range or set of values, e.g. step size, ramping or offsets
A method for obtaining, by a first network device of a pair of network devices, a packet, wherein the packet specifies a source address corresponding to a first client device and a destination address corresponding to a second client device, making a first determination, by the first network device and using the source address and the destination address, that the first network device is not an owner of bidirectional traffic associated with the packet, based on the first determination, transmitting, by the first network device, the packet to a second network device of the pair of network devices, making a second determination, by the second network device, that the second network device is the owner of bidirectional traffic associated with the packet, performing, in response to the second determination and by the second network device, data processing on the packet to generate a processing result.
A method for obtaining, by a first network device of a pair of network devices, a packet, wherein the packet specifies a source address corresponding to a first client device and a destination address corresponding to a second client device, making a first determination, by the first network device and using the source address and the destination address, that the first network device is not an owner of bidirectional traffic associated with the packet, based on the first determination, transmitting, by the first network device, the packet to a second network device of the pair of network devices, making a second determination, by the second network device, that the second network device is the owner of bidirectional traffic associated with the packet, performing, in response to the second determination and by the second network device, data processing on the packet to generate a processing result.
A method of managing inter-branch communication is a network, including generating an end-to-end path, wherein the end-to-end path starts in a first computing device in a first branch and ends at a second computing device in a second branch, wherein the end-to-end path is generated using a plurality of flow records and a plurality of path records and the end-to-end path includes a wide area network (WAN) segment, and issuing, based on the generating, a notification to a network administrator, wherein the notification specifies the end-to-end path and a latency associated with at least one segment in the end-to-end path.
A network switch device includes cooling fans to remove heat generated by its electronic circuitry during operation. Multiple cooling zones are provided in a network switch device to enable reduced cooling fan power consumption. The switch device includes a baffle positioned between a first zone and a second zone and across a circuit board. A first cooling fan provides a first airflow through the first zone and across a first portion of the circuit board positioned within the first zone. A second cooling fan provides a second airflow through a second zone of the housing and across a second portion of the circuit board positioned within the second zone. The baffle directs the first airflow away from the second zone and directs the second airflow away from the first zone. Fan speeds of fans in a cooling zone may be adjusted based on temperature sensors positioned in that zone.
In general, embodiments relate to a method, for managing a network device, that includes accessing, by a feature agent of the network device, an allocation data structure, wherein the allocation data structure specifies a first portion of memory and a second portion of memory, identifying, using the allocation data structure, the first portion of the memory to be used during an upgrade, wherein the second portion of memory is used for storing a network device table, wherein the network device table is used by a packet transmission component while the upgrade is being performed, and upon completion of the upgrade, updating the allocation data structure to specify that the packet transmission component use a second network device table and stop using the network device table, wherein the second network device table is initially populated during the upgrade.
H04L 47/762 - Admission control; Resource allocation using dynamic resource allocation, e.g. in-call renegotiation requested by the user or requested by the network in response to changing network conditions triggered by the network
Embodiments of the present disclosure include techniques for programming hierarchical schedulers for ports of network devices. A configuration for configuring a hierarchy of a plurality of scheduling nodes of a packet scheduler is received. The packet scheduler is configured to schedule packets for egress out of a port of the network device. The configuration is specified in a human-readable format. Based on the configuration, the packet scheduler of the port is programmed. A plurality of packets are received at a plurality of physical queues communicatively coupled to the packet scheduler. The packet scheduler is used to select a packet in the plurality of packets from a physical queue in the plurality of physical queues. The selected packet is forwarded out the port of the network device.
A method, device, and computer readable medium for managing overheat behavior in a network device. The method includes determining that a first temperature exceeds a threshold by at least one temperature sensor disposed in a network device. The method includes logging a temperature sensor name of the at least one temperature sensor, the first temperature, and actions taken prior to determining that the first temperature exceeds the threshold. The method further includes disabling network device capabilities and enabling a subset of network device capabilities after powering cycling the network device.
G05B 19/406 - Numerical control (NC), i.e. automatically operating machines, in particular machine tools, e.g. in a manufacturing environment, so as to execute positioning, movement or co-ordinated operations by means of programme data in numerical form characterised by monitoring or safety
G06F 1/3287 - Power saving characterised by the action undertaken by switching off individual functional units in the computer system
Systems, methods, and computer-readable media are disclosed for receiving a template made up of various components. Multiple stage rules are provided including action bundles as well as network device specifications. The action bundles include primary actions and stage rule execution orders for generating change controls. Generating change controls involves several steps. The network devices are enumerated based on respective network device specifications. Next, the action bundles are associated with each of the respective network devices. Finally, the change control is provided to a network management backend, and the network management backend applies the change control to the network devices.
H04L 41/082 - Configuration setting characterised by the conditions triggering a change of settings the condition being updates or upgrades of network functionality
A method and system for the post-adjustment (i.e., offline) of event timestamps to implement virtual time synchronization amongst detection node clocks. In existing methodologies with the goal of clock synchronization, clocks (and timestamps generated therefrom) are disciplined or adjusted at the recordation time of the events on a detection node (e.g., a switch/router, an Internet-of-Things (IoT) device, a wireless sensor, etc.). However, there is no particular reason for these clocks or timestamps to be accurate during the recordation time, but rather, should be accurate at their use or interpretation time. Further, through these recordation time adjustments, clock drifts and timing errors may be gradually introduced, leading to runaway inaccuracies. The disclosed method and system intentionally avoids the disciplining of clocks at event recordation times on the detection node and, instead, adjusts timestamps during interpretation times, to overcome the aforementioned issues.
Certain network switch device can use pluggable transceivers to send and receive data. Transceiver may be capable of operating in multiple different operating modes defined by parameters such as speed. Application data indicating one or more operational modes supported by the transceiver may be read from a memory of a transceiver. An interface may be provided by a network switch device that indicates the one or more operational modes and identifiers of the one or more operational modes. The transceiver may be configured by the network switch device to operate in a selected operational mode based on a selection of an identifier corresponding to the selected operational modes. The selected operational mode, which may require multiple parameters to be configured on the transceiver, may be set using a single command based on the identifier.
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
Goods & Services
Network management software for routers, switches, wireless devices, and wireless access point devices; network management computer operating programs for routers, switches, wireless devices, and wireless access point devices; computer software for use in connecting cloud computer networks and systems, servers and storage devices; all aforementioned goods not related to earth observation, geo information and geo data. Software as a service (SAAS) services featuring cloud networking software for routers, switches, wireless devices, and wireless access point devices; platform as a service (PAAS) services featuring cloud networking software for routers, switches, wireless devices, and wireless access point devices; all aforementioned services not related to earth observation, geo information and geo data.
97.
DETERMINING AN EGRESS INTERFACE FOR A PACKET USING A PROCESSOR OF A NETWORK DEVICE
In general, embodiments relate to a method, for managing a network device, that includes obtaining a packet by a network device in the network, making a determination that the packet meets a lifecycle-ending condition, wherein when the packet meets the lifecycle-ending condition the packet is not forwarded from the network device towards a network device associated with a destination internet protocol (IP) address in a header of the packet, based on the determination, performing, by the network device, a packet analysis on the packet to determine an egress interface of the network device associated with the packet, and based on the packet analysis, sending a notification to a network monitoring manager, wherein the notification specifies the egress interface.
Techniques disclosed herein provide a method and systems for installing routes by a route reflect (RR) device when the tunnel RIB of the RR device does not include any tunnel labels definitions. The unicast routing information base (RIB) of route reflector (RR) device is configured to include a next hop associated with a first network device. When the RR device receives a route from the first network device that comprises a tunnel label for reaching the second network device, the RR device resolves the next hop of the received route using the unicast RIB of the RR device. In response to the resolving, the RR device forwards the route to a third network device (e.g., identified by an export route target of the RR device).
Methods, systems and devices for controlling an operating configuration of a network device such as a wireless access point include detecting power supplied to the access point. Operating parameters of the access point, neighboring access points, and client devices wirelessly connected to the access point are determined. The access point is placed in a reduced-capability operating configuration in response to detecting the power supplied is less than a power threshold. The reduced-capability operating configuration is based on the determined operating parameters of the access point, neighboring access points, and client devices.
Embodiments of the present disclosure include techniques for generating hybrid network activity records. A stream of packet data is received. A flow in the stream of packet data is identified. Deep packet inspection operations are performed on a first subset of packets in the flow to extract a first set of data. Flow stat operations are performed on a second subset of packets in the flow to extract a second set of data. Based on the first and second sets of data, a set of network activity records are generated.
