Abstract: A transport network employs dual homing to an access network to provide connectivity from multiple network switches. Dual homing is a mechanism by which an access network employs pair of switches in the transport network as if it were connecting to a single device. Conventional arrangements for defining multiple paths from a transport network to an access network suffer from the shortcomings of potential routing loops, increased hops to the access network, and inability or inconsistency with forwarding to different types of access networks, and may involve redirecting traffic absent faults in the access network. The dual homed network switches identify the type of access network and perform switching logic corresponding to the access network type to provide comprehensive dual-homed support to the access network independently of the type of transport employed in the access network, and employ redirection only if there is a fault in the access network.

Abstract: Methods, systems and computer readable media for optimizing (or improving) network discovery using supplemental information published by devices and available on their neighbor devices are described. In some implementations, the method can include obtaining, at a network management computer system, a list of one or more seed devices. The method can also include retrieving a device identifier of a corresponding seed device from the list of one or more seed devices. The method can further include querying, at the network management computer system, the corresponding seed device to obtain neighboring device connectivity information of the seed device and supplemental information for each neighboring device.

Abstract: Techniques for implementing a smart filter generator in a visibility network are provided. In one set of embodiments, the smart filter generator can maintain at least one mapping between (1) a first-order parameter found in network traffic replicated from a core network monitored by the visibility network, and (2) a second-order parameter related to the first-order parameter, where the second-order parameter is not found in the network traffic replicated from the core network. The smart filter generator can further receive, from a user, a user-defined packet filter definition comprising a filtering criterion that makes use of the second-order parameter. The smart filter generator can then translate, based on the at least one mapping, the filtering criterion into a version that makes use of the first-order parameter, and can generate a new packet filter comprising the translated version of the filtering criterion.

Abstract: A network visibility system includes a packet router and a router controller. The router controller programs respective forwarding rules in each of a set of load-sharing components of the packet router. Each load-sharing component in the set is designed to forward communication packets according to the respective programmed packet-forwarding rules. The router controller receives, from the packet router, information indicating an update to the availability status of components in the set of components. The router controller updates the respective forwarding rules to reflect the update to the availability status.

Abstract: A technique allows stations to utilize an equal share of resources (e.g., airtime or throughput). This prevents slow stations from consuming too many resources (e.g., using up too much air time). Fairness is ensured by selective dropping after a multicast packet is converted to unicast. This prevents slow stations from using more than their share of buffer resources. Multicast conversion aware back-pressure into the network layer can be used to prevent unnecessary dropping of packets after multicast to unicast (1:n) conversion by considering duplicated transmit buffers. This technique helps achieve airtime/resource fairness among stations.

Abstract: In some implementations, a method can include determining a virtual machine (VM) inventory baseline of a system, including identifying VMs in a baseline configuration and generating a VM fingerprint for each VM in the inventory baseline, and detecting a user onboarded VM and moving the user onboarded VM to a quarantine operating area for a period of time. The operational posture of the user onboarded VM can be compared to an operational posture policy of the system. When the operational posture of the user onboarded VM meets the operational posture policy of the system, the user onboarded VM is moved from the quarantine area to an operational area, and, when the operational posture of the user onboarded system does not meet the operational policy posture of the system and the period of time has expired, the user onboarded VM is terminated.

Abstract: Systems and methods are disclosed herein for determining that a diagnostic mode is enabled for a port of a switch, the port being part of a VLAN, and responsively designating a port of the plurality of ports as a loopback port, where a packet transmitted on the loopback port is forwarded according to an entry of a forwarding database. The disclosure further describes generating a layer 2 multicast index comprising an entry for the port and an entry for the loopback port, programming the forwarding database with an entry for a destination address of the switch pointing to the layer 2 multicast index, generating a diagnostic packet, and transmitting the diagnostic packet on the loopback port. Additionally, the disclosure describes determining that the diagnostic packet is received by any port of the plurality of ports, and responsively determining a network problem exists and causing a diagnostic protocol to be executed.

Abstract: Techniques for correlating and load balancing IMS traffic in a visibility network are provided. According to one set of embodiments, a packet broker of the visibility network can receive IMS traffic replicated from an IMS core network and identify control/data packets in the IMS traffic that are part of the same IMS session based on FROM and TO user identities included in the packets. The packet broker can then generate a unique session identifier for the IMS session and add the generated session identifier to the packets. In certain embodiments, the packet broker can further provide the generated session identifier as input to a load balancing algorithm or rule set. The load balancing algorithm or rule set can output an egress port of the packet broker through which the control/data packets should be forwarded based on the session identifier.

Abstract: Embodiments disclosed herein provide redundant connectivity between an Ethernet Automatic Protection Switching (EAPS) access network and a Virtual Private LAN Service (VPLS) network. A first VPLS node is provided to function as an EAPS controller node. A second VPLS node is provided to function as an EAPS partner node. The first and second VPLS nodes are linked by a pseudowire and an EAPS shared-link. Additional EAPS nodes are also provided. The additional EAPS nodes are linked to each other and one of the additional EAPS nodes is designated as a master node. Links are also established between the VPLS nodes and the EAPS nodes such that one or more EAPS rings are formed. Each EAPS ring includes the shared-link between the first and second VPLS nodes. The EAPS rings are monitored to detect link failures.

Abstract: A method for implementing auto attach for a shortest path bridging (SPB) network comprises determining, on an access point, that an auto attach device communicating in a SPB network is enabled for auto attach, and an advertisement is transmitted to a mobile station. The access point acts a proxy between the mobile station and the auto-attach device by communicably coupling the auto attach device and the mobile station via the access point. A virtual local area network (VLAN) identification and service instance identifier (I-SID) is received from the mobile station, when is then transmitted to the auto-attach device. A VLAN (independent of any static VLAN associated with the WLAN) is created off of the VLAN identification and an indication that the I-SID and the VLAN have been accepted. Data communications are then provided between the mobile station and the auto attach device via the VLAN and the access point.

Abstract: Implementations generally relate to synchronizing peer nodes in networks. In one embodiment, a method includes generating a data sequence number. The method also includes associating the data sequence number with a data item. The method also includes sending the data item and the data sequence number to each peer node of a plurality of peer nodes. The method also includes determining if an acknowledgment has been received from each peer node, wherein each acknowledgment indicates the peer node that sent the acknowledgment and indicates the data sequence number. The method also includes resending the data item and the data sequence number to one or more peer nodes based on a predetermined policy.

Abstract: Methods, systems and computer readable media for securing mDNS in enterprise networks are described. In some implementations, the method can include authorizing one or more service advertisements and validating one or more service advertisements. The method can also include adding one or more information details to a record associated with an advertised service.

Abstract: Techniques for performing near-uniform load balancing in a visibility network based on usage prediction are provided. According to one embodiment, a packet broker of the visibility network can receive a control packet replicated from a core network, where the control packet includes a user or device identifier and a request to create a user session for a user identified by the user/device identifier. The packet broker can further determine, based on the user/device identifier and one or more other parameters, a rank value for the user session, where the rank value indicates an amount of network traffic that the user is likely to generate in the core network during the user session. The packet broker can then select an egress port for the user session based on the rank value and forward subsequent control and data traffic for the user session through the selected egress port.

Abstract: Systems and methods are presented herewith for automatically assigning a Multicast Backbone Media Access Control (“BMAC”) address to a switch (or a similar network device) newly-added to a network. Media Access Control (“MAC”) addresses (unicast addresses) that are assigned by default to the switch may be used in a process to generate a multicast BMAC address and assign the multicast BMAC address to the switch, thereby, automatically enabling communications with other network devices over the SPB network. The process involves modifying a bit of a selected unicast address to transform the address into a multicast address. The system may use the modified MAC address as the multicast BMAC address.

Abstract: Methods and systems for mitigating the impact of beamforming on the accuracy of Wi-Fi based location tracking of client devices. An embodiment takes the form of a process that includes (a) obtaining a plurality of received signal strength indicator (RSSI) values respectively associated with frames in a plurality of frames that were (i) received by various access points in a plurality of access points and (ii) transmitted by a client device that is connected to a first access point in the plurality of access points; (b) segmenting the access points in the plurality of access points into (i) a beamforming-path set of one or more access points and (ii) a non-beamforming-path set of one or more access points; (c) identifying a location-determination subset of the obtained RSSI values; and (d) determining a location of the client device using the identified location-determination subset of the obtained RSSI values.

Abstract: Access point cloud controller auto-discovery is provided. An access point, in communication with other access points, receives data indicative of whether each of other access points are managed using a cloud controller or a local controller. When the data is indicative that at least one of the other access points is managed using the cloud controller, the access point is configured to be cloud-controller-managed. When the data is indicative that none of the other access points is managed using the cloud controller, and when the data is further indicative that at least one of the other access points is managed using the local controller, the access point is configured to be local-controller-managed.

Abstract: Disclosed herein are system, method, and computer program product embodiments for representing a forwarding information base (FIB) in a database. An embodiment operates by determining that a first routing prefix of a first forwarding entry in the FIB is a less specific routing prefix than a second routing prefix in a second forwarding entry in the FIB. The embodiment determines that a first next hop of the first routing prefix is equal to a second next hop of the second routing prefix. The embodiment removes the second forwarding entry from the FIB. The embodiment then inserts the first forwarding entry into a database (e.g., a longest exact match (LEM) database or a longest prefix match (LPM) database) based on a prefix length of the first routing prefix of the first forwarding entry.

Abstract: Methods and apparatuses enable a network of traffic control devices to be viewed as a network of services. A web client sends a query compatible with an open API to a traffic control device. The traffic control device responds to the request by providing the requested service, and indicating an additional, related service that is available externally to the responding traffic control device. Thus, the traffic control device provides network information to the web client, which is traditionally only available via a network management system. The web client can then access the external service.

Abstract: One or more implementations can include methods, systems and computer readable media for elastic wireless control planes. In some implementations, the method can include evaluating one or more elastic wireless control plane mode factors, and partitioning each of a plurality of access points into one of an active mode group and a sleep mode group based on the evaluating. The method can also include determining a number of wireless control plane instances needed based on the partitioning. The method can further include activating the number of wireless control plane instances and shutting down any excess wireless control plane instances beyond the number.

Abstract: Techniques for implementing traffic deduplication in a visibility network are provided. According to one embodiment, a packet broker of the visibility network can receive a control or data packet replicated from a core network. The packet broker can then apply a first stage deduplication process in which the packet broker attempts to deduplicate the control or data packet based on one or more interfaces of the core network from which the control ot data packet originated, and apply a second stage deduplication process in which the packet broker attempts to deduplicate the control or data packet based on the content (e.g., payload) of the control or data packet.