Abstract: A platform that may be used to dynamically reallocate resources to support an Internet application is disclosed. In an embodiment, the platform may include two layers of distribution, one at the domain name server (DNS) layer and one at an Internet data center layer. The platform may include a dynamic resource allocation manager that causes instances of applications to be initiated in Internet data centers in response to dynamic conditions and characteristics of the application. A monitoring system module may be provided to keep the dynamic resource allocation manager informed as the health and utilization of instances of the application.

Abstract: A packet trace is received. Transmitted bytes and retransmitted bytes are identified in the packet trace. Upon identifying the transmitted bytes and the retransmitted bytes in the packet trace, one or more time-rate pairs are determined from the packet trace. The time-rate pairs are plotted on a rate tracking graph.

Abstract: A packet trace is received. Inter-arrival times between the multiple packets in the packet trace are determined. An inter-arrival time in the inter-arrival times that is greater than a threshold is identified. An order number of the inter-arrival time is identified. A determination is made as to whether a size of each of at least a portion of the multiple packets is equal to a maximum segment size. When a determination is made that the size of each of at least a portion of the multiple packets is equal to the maximum segment size a size of the ICW as a product of the order number and the maximum segment size is returned.

Abstract: A packet trace is received. The packet trace is transformed into a sequence of pulse signals in a temporal domain. The sequence of pulse signals in the temporal domain is transformed into a sequence of pulse signals in a frequency domain. Peaks are detected within relevant frequency bands in the sequence of pulse signals in the frequency domain. A fundamental frequency is identified within the peaks. The fundamental frequency, which represents the TCP flow clock, is returned.

Abstract: A method of managing a network application includes identifying a network path for the network application, obtaining network performance measurements along the network path, obtaining application performance information for the network application, and extracting infrastructure specific information for the infrastructure supporting the network application. The method further includes correlating the application performance information, network performance measurements, and the infrastructure specific information to identify a performance issue affecting the network application, and modifying the application behavior, the network behavior, or any combination thereof in response to the performance issue.

Abstract: Methods and apparatus to implement scalable routing in network communication systems are disclosed. A disclosed example method involves selecting a plurality of virtual private networks in a communication network and selecting a candidate hub router from a plurality of routers in the communication network. The example method also involves determining a plurality of least memory utilization costs associated with assigning different quantities of spoke routers to the candidate hub router. Each of the least memory utilization costs and corresponding quantity of spoke routers is associated with a corresponding one of the plurality of virtual private networks. For each of the least memory utilization costs, a bandwidth usage of a corresponding one of the quantities of spoke routers is identified.

Abstract: Statistical methods are used to observe packet flow arrival processes and to infer routing changes from those observations. Packet flow arrivals are monitored using NetFlow or another packet flow monitoring arrangement. Packet flow arrivals are quantified by counting arrivals per unit time, or by measuring an inter-arrival time between flows. When a change in packet flow arrivals is determined to be statistically significant, a change in network routing protocol is reported.

Abstract: The preferred embodiments of the present invention can include sampling packets transmitted over a network based on the content of the packets. If a packet is sampled, the sampling unit can add one or more fields to the sampled packet that can include a field for a number of bytes contained in the packet, a packet count, a flow count, a sampling type, and the like. The sampled packets can be analyzed to discern desired information from the packets. The additional fields that are added to the sampled packets can be used during the analysis.

Abstract: A system and method for receiving, from one or more ingress routers, a first set of records including data corresponding to network traffic, receiving, from one or more egress routers, a second set of records including data corresponding to network traffic and creating a multicast traffic matrix using at least a portion of the data included in the first and second sets of records.

Abstract: An Internet service provider includes a cache server and a network aware server. The network aware server is operable to determine an optimization between a cost of retrieving content from a network and a cost of caching content from the network at the first cache server and then send a content identifier to the cache server. The cache server is operable to receive the content identifier, and determine the source of a content item. If the source is the same as the content identifier, then the cache server caches the content item.

Abstract: Example scalable multi-protocol label switching (MPLS) based virtual private networks (VPNs) and methods to implement the same are disclosed. A disclosed example spoke provider edge (PE) router for an MPLS-based VPN includes a truncated virtual routing and forwarding (VRF) table containing a first value referencing a hub PE router and a second value referencing a first customer edge (CE) router coupled to the VPN via the PE router, and a forwarding module to forward a packet received from the first CE router to the hub PE router when the packet contains an address referencing a second CE router coupled to the VPN via a second spoke PE router.

Abstract: A system and method for receiving, from one or more ingress routers, a first set of records including data corresponding to network traffic, receiving, from one or more egress routers, a second set of records including data corresponding to network traffic and creating a multicast traffic matrix using at least a portion of the data included in the first and second sets of records.

Abstract: A method that measures ratio, relative to a peering network, of traffic burden of incoming traffic to traffic burden of outgoing traffic, where traffic burden takes into account traffic volume and distance that the traffic traverses through the network. A determination is made from this ratio as to whether an imbalance exists with the peering network. With the assistance of a simulation of changes in routing policy and their effects, an existing or impending imbalance is remedied by changing the routing policy relative to particular customers, for example from a “hot potato” routing policy to a “best exit” routing policy.

Abstract: Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a plurality of flow records, calculating a hash for each flow record based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, and sampling flow records having a quasi-random number below a probability P. Invariant parts of flow records include destination IP address, source IP address, TCP/UDP port numbers, TCP flags, and network protocol. A plurality of routers can uniformly calculate hashes for flow records. Each router in a plurality of routers can generate a same quasi-random number for each respective flow record and uses different values for probability P. The probability P can depend on a flow size. The method can divide the quasi-random number by a maximum possible hash value.

Abstract: A device includes a processor configured to determine a number of users in each of a plurality of wireless telephone cells of a trajectory in a wireless telephone network. The processor is also configured to determine handoff data between each adjacent pair of the wireless telephone cells, and to determine a first number of users traveling along the trajectory in the wireless telephone network while on a telephone call. The processor also calculates a total number of users associated with the trajectory in the wireless telephone network based on the handoff data between each adjacent pair of the wireless telephone cells, and based on the first number of users traveling along the trajectory while on the telephone call.

Abstract: A method and apparatus for inferring if an IP address allocation in a remote network is static or dynamic are disclosed. For example, the method contacts at least one remote peer to peer endpoint using a peer to peer application to obtain an IP address of the at least one remote peer to peer endpoint. The method then analyzes characteristics of the at least one remote peer to peer endpoint over a predefined period of time to infer whether the presence of static IP address allocation exists for the at least one remote peer to peer endpoint.

Abstract: Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a desired quantity of flow record to sample, receiving a plurality of network flow record each summarizing a network flow of packets, calculating a hash for each flow record of based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, generating a priority from the calculated hash for each respective flow record, and sampling exactly the desired quantity of flow records, selecting flow records having a highest priority first. In one aspect, the method further partitions the plurality of flow records into groups based on flow origin and destination, generates an individual priority for each partitioned group, and separately samples exactly the desired quantity of flow records from each partitioned group, selecting flows having a highest individual priority first.

Abstract: A system and method to use network flow records to generate information about changes in network routing and to understand the impact of these changes on network traffic. The inferences made can be determinative, if sufficient information is available. If sufficient information is not available to make determinative inferences, inferences may be made that narrow the range of possible changes that may have occurred to network traffic and the underlying network.

Abstract: A system includes an information storage module and an inspection module. The information storage module is configured to store a plurality of tags. Each tag is associated with a known set of traffic types of a plurality of known sets of traffic types. The inspection module is configured to compare a traffic flow to a set of traffic types to determine a matching set of traffic types, request a tag from the information storage module, and mark the traffic flow with the tag. The tag corresponds to the matching set of traffic types.

Abstract: A method includes identifying shared content by inspecting a peer-to-peer traffic flow and identifying source peers providing the shared content, and requesting the shared content from the source peers. The method further includes receiving requests for the shared content from requesting peers, identifying requesting peers based on the requests for the shared content, and providing the shared content to a local subset of the requesting peers.