Abstract: Methods, systems and computer readable media for multi-device single network sign-on are described. For example, a method can include authenticating a first device for network access via a first authentication process, the first device being associated with a user account. The method can also include receiving an access request from a second device associated with the user account, and determining whether the second device is within an access perimeter of the first device. The method can further include permitting the second device to access the network without a second authentication process when the second device is within the access perimeter of the first device.

Abstract: Methods, systems and computer readable media for a captive portal having dynamic, context-based whitelisting are described.

Abstract: In virtualized environments a method of determining authorization to a resource cannot use a hardware specific identifier, such as a MAC address. As a result upgrading a virtual host may cause licenses associated with that host to be invalid, even though the upgraded virtual host should be authorized. Authentication methods and systems are disclosed such that a key may be shared with a second host along with a license file and, provided at least the second host has a key associated with its system identifier and a key associated with a license file, access to a licensed resource may be authorized.

Abstract: Embodiments generally relate to enabling encapsulation in networks. In one embodiment, a method includes receiving a message from an edge configuration device, wherein the message contains shortest path bridging (SPB) configuration information. The method also includes performing provider backbone bridge (MAC-in-MAC) encapsulation in response to receiving the message.

Abstract: A computer-implemented method, apparatus and software for debugging auto-attach entities is presented. A Continuity Fault Management (CFM) request for a service is received over a network at an Auto-Attach (AA) server. The AA server responds with a first response regarding the AA server on the service. The AA server also responds to the CFM request with a second response regarding any AA clients and any AA proxies on the service.

Abstract: Session Manager anti-looping creates a model that is an effective barrier to looping, efficiently identifying a loop condition by maintaining temporary individual call counters for header sets within temporal parameters and terminating the loop condition upon detection. The system provides an administrator with adjustable parameters for loop detection count and loop detection interval, thereby allowing protection against loop conditions, both inadvertent and intentional.

Abstract: Systems, mechanisms, apparatuses, and methods are disclosed for forwarding Inter-Switch Connection (ISC) frames in a Network-to-Network Interconnect (NNI) topology, for example, via a network switch which includes a first physical switch port to receive a physical switch link from a second network switch; logic to implement a first logical ISC and a second logical ISC? connection to the second network switch via the physical switch link; a second physical switch port to receive an interface connection from a third network switch; and switch forwarding logic to forward frames received at the first network switch to the second network switch via the logical ISC or logical ISC? based on whether or not the physical switch link is part of an active topology upon which the network switch operates or is not part of the active topology upon which the network switch operates. Other embodiments are disclosed.

Abstract: Implementations generally relate to network services. In some implementations, a method includes providing a network service having a service mode and a service type. The method further includes generating a network service advertisement message including a service identifier, a service mode portion, and a service type portion. The method further includes-forwarding the network service advertisement message from a first system to one or more other systems via a network. The method further includes-incrementing a counter corresponding to a service mode and a service type pair of each network service advertisement message having a same service identifier. The method further includes, when the counter corresponding to a service mode and a service type pair reaches a predetermined value, blocking configuration of another service having the same service identifier value, service mode and service type as that corresponding to the counter that reached the predetermined value.

Abstract: Methods, systems and computer readable media for efficient state change support for hierarchical data models in a virtualized system are described. In some implementations, the method can include determining a system status including a system-level bit masked word having a plurality of bits, each bit corresponding to a status of a different hierarchical level of the system, and receiving a change notification. The method can also include querying an entity at a lower hierarchy level if a cascaded state change is identified for that entity. The method can further include continuing to query one or more entities in successively lower hierarchy levels so long as a cascaded state change is identified for a corresponding entity in a lower hierarchy level. The method can also include determining the current status for one or more entities having a changed status.

Abstract: In one embodiment, a data plane component of the network visibility system can receive a data packet tapped from a source network. The data plane component can further match the data packet with an entry in a rule table, where the entry includes one or more match parameters, and in response to the matching can tag the data packet with a zone identifier defined in the entry. The data plane component can then forward the tagged data packet to an analytic server for analysis.

Abstract: Bandwidth-on-Demand (BoD) as a network service (BoD-as-a-Service) is integrated into applications that end-users can flexibly purchase when and for however long they need it. A centralized Software Defined Networking (SDN) controller and distributed SDN controller agents that may be seen in a Service Provider, Enterprise or distributed computing environment with remote and mobile end-users is provided. The end-user initiates the BoD request using an application via desktop, cloud, smartphone or tablet. The BoD Service Provider, Enterprise, has a controller-based centralized view of the complete SDN service topology. On receiving the request, the BoD provider dynamically computes the optimal end-to-end path through the SDN topology that best suits the end-user requested traffic types and service level requirements. It then translates that optimal path into flow computations that are dynamically pushed down to the controller agents to provision the BoD network path in real-time.

Abstract: A method, apparatus and computer program product for providing multi-homing techniques for SPB networks is presented. A set of UNI nodes that receive multicast packets are determined based on Backbone Media Access Control-Destination Address (BMAC-DA)/I-Tag Service Identifier (I-SID) of received multicast packets for multicast packets within a transport network. A separate Egress Port Mask is determined for each Backbone-Virtual Local Area Network (B-VLAN) of the transport network, wherein the Egress Port Mask is determined such that only one UNI node of the set of UNI nodes forwards said multicast packets. A set of UNI copies of said multicast packets are filtered out by applying the Egress Port Mask, wherein copies that are not in the Egress Port Mask are dropped. Copies of multicast packets that are not dropped are sent out.

Abstract: Methods, systems, and computer readable media for dynamically routing authentication requests are described. An embodiment can include receiving, at one or more computing devices, a network authentication request. An embodiment can also include creating, at the one or more computing devices, an authentication context based on information in the authentication request. An embodiment can also include dynamically routing, using the one or more computing devices, the authentication request to an authentication server.

Abstract: A method, apparatus and computer program product for providing Virtual Routing and Forwarding (VRF) and gateway Media Access Controller (MAC) distribution is presented. At least one subnet associated with a Layer 2 Virtual Switching Network (L2VSN) is provided on a network device. A message is propagated to a distributed Datapath. Network devices install the message as a routable MAC address on the L2VSN for the Layer 3 Virtual Switching Network/Virtual Routing and Forwarding (L3VSN/VRF) associated with the message. Edge devices route packets on the L2VSN addressed to the gateway MAC address.

Abstract: A method, apparatus and computer program product for providing quick designated router transitions in broadcast networks is presented. An Alternate Designated Router (ADR) in a network detects node failure of a Designated Router (DR) prior to other nodes of the network detecting the failure of the DR. In response to the detecting node failure of the DR, the ADR floods the network with a link state packet of a pseudonode within the network. At least one other node of the network detects failure of the DR. The at least one other node computes routes to take into account the failure of the DR by the at least one other node of the network, wherein there is minimal traffic loss since the pseudonodes link state packet is already present before the computing routes takes place.

Abstract: To determine the correct media stream to latch onto, the system and method uses a hashing algorithm to uniquely identify a legitimate media stream. A first invite message is received at a Session Border Controller (SBC) to establish a communication session. For example a Session Initiation Protocol (SIP) INVITE is received. The first invite message comprises a first hash of a fingerprint. For example, the hash may be a hashed session key. A media message is received that contains the fingerprint to establish a media stream for the communication session. A second hash is created using the fingerprint in the media message. The first hash is compared to the second hash. In response to the first hash matching the second hash, a Network Address Translator (NAT) latches to an address and/or a port in the media message. Thus, the correct media stream is associated with the communication session.

Abstract: A function is provided in a network system for adjusting network policies associated with the operation of network infrastructure devices of the network system. Network policies are established on network devices including packet forwarding devices. The network has a capability to identify computer applications associated with traffic running on the network. A network policy controller of the network is arranged to change one or more policies of one or more network devices based on computer application information acquired. The policies changed may be network policies as well as mirroring policies. An example policy to change is direct a network device to mirror traffic to an application identification appliance for the purpose of identifying applications running on the network through a plurality of mechanisms. The function may be provided in one or more devices of the network.

Abstract: A transport network employs dual homing to an access network to provide connectivity from multiple network switches. Dual homing is a mechanism by which an access network employs pair of switches in the transport network as if it were connecting to a single device. Conventional arrangements for defining multiple paths from a transport network to an access network suffer from the shortcomings of potential routing loops, increased hops to the access network, and inability or inconsistency with forwarding to different types of access networks, and may involve redirecting traffic absent faults in the access network. The dual homed network switches identify the type of access network and perform switching logic corresponding to the access network type to provide comprehensive dual-homed support to the access network independently of the type of transport employed in the access network, and employ redirection only if there is a fault in the access network.

Abstract: Implementations relate to configuration of networks using client device access of a remote server. In some implementations, a method includes requesting a management server from an end device for shortest path bridging (SPB) configuration information for the end device to communicate on an SPB network, where the end device communicates with the management server over a non-SPB connection. The SPB configuration information is received from the management server, and the SPB configuration information is sent to an edge configuration device connected to the end device, where the SPB configuration information causes configuration of the edge configuration device to allow communication of the end device on the SPB network.

Abstract: Methods, systems and computer readable media for mDNS support in unified access networks are described.