Abstract: Techniques are described for performing session identifier (“SID”) based two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. According to the techniques, a SID assigned to each data session is used to uniquely identify the data session, instead of a source and destination address/port pairs. A TWAMP server may generate a unique number as a SID of a data session during negotiation of the data session. The disclosed techniques include extending TWAMP control messaging to include a communication mode for the SID-based TWAMP data session provisioning. The disclosed techniques further include extending TWAMP data messaging to include the SID of the data session in each test packet for the data session. In this way, a TWAMP session sender and a TWAMP session reflector may associate received test packets with a certain data session based on the SID included in the received test packets.

Abstract: In general, techniques are described for performing flow timeout control within a network. A device comprising a processor may be configured to perform the techniques. The processor may be configured to, as one example, determine, from a first packet of a packet flow, a minimum timeout value for the packet flow indicative of a time duration during which a first computing device will not send a keep-alive message to prevent the packet flow from timing out. The processor may then determine an intermediate timeout value for the packet flow based on a comparison of the minimum timeout value to a maximum timeout value, and specify the intermediate timeout value in a second packet of the packet flow sent by the second network device to the first network device in response to the first packet.

Abstract: A method may include receiving a first network traffic flow that is associated with a first private network address. The first network traffic flow may be destined to a first external network address. The method may include determining that the first external network address is not identified by a data structure. The data structure may identify external network addresses and private network addresses of network traffic flows to which a single public network address has been assigned. The method may include assigning the single public network address to the first network traffic flow based on determining that the first external network address is not identified by the data structure. The method may include storing the first external network address and the first private network address. The method may include outputting the first network traffic flow with the first external network address and the single public network address.

Abstract: Techniques are described for performing session identifier (“SID”) based two-way active measurement protocol (TWAMP) data session provisioning between two endpoints in a computer network. According to the techniques, a SID assigned to each data session is used to uniquely identify the data session, instead of a source and destination address/port pairs. A TWAMP server may generate a unique number as a SID of a data session during negotiation of the data session. The disclosed techniques include extending TWAMP control messaging to include a communication mode for the SID-based TWAMP data session provisioning. The disclosed techniques further include extending TWAMP data messaging to include the SID of the data session in each test packet for the data session. In this way, a TWAMP session sender and a TWAMP session reflector may associate received test packets with a certain data session based on the SID included in the received test packets.

Abstract: Techniques are described for providing traffic-aware sampling rate adjustment within network devices. As inbound packets are received at an interface, a sampling unit of a forwarding circuit of the network device samples the inbound packets at a current sampling rate and directs a subset of the inbound packets to a service card of the network device. A flow controller within the service card of the network device processes the subset of the inbound packets to generate flow records. When changes in the rate at which the inbound packets are received exceed a defined threshold, the flow controller adjusts the current sampling rate at which the forwarding circuit samples the inbound packets received at the interface. Moreover, the flow controller adaptively adjusts the sampling rate such that the flow sampling resources the device are being utilized in accordance with the utilization thresholds.

Abstract: A computer-implemented method for automatically correcting classification signatures may include (1) identifying at least one classification signature used to classify network traffic, (2) detecting at least one unknown flow of network traffic, (3) determining that the unknown flow of network traffic and the classification signature exceed a threshold level of similarity by comparing the unknown flow with the classification signature, and then in response to determining that the unknown flow and the classification signature exceed the threshold level of similarity, (4) identifying at least one attribute of the unknown flow that differs from the classification signature, and (5) modifying the classification signature based at least in part on the attribute of the unknown flow. Various other systems, methods, and computer-readable media are also disclosed.

Abstract: A method may include receiving a first network traffic flow that is associated with a first private network address. The first network traffic flow may be destined to a first external network address. The method may include determining that the first external network address is not identified by a data structure. The data structure may identify external network addresses and private network addresses of network traffic flows to which a single public network address has been assigned. The method may include assigning the single public network address to the first network traffic flow based on determining that the first external network address is not identified by the data structure. The method may include storing the first external network address and the first private network address. The method may include outputting the first network traffic flow with the first external network address and the single public network address.

Abstract: Techniques are described for providing traffic-aware sampling rate adjustment within network devices. As inbound packets are received at an interface, a sampling unit of a forwarding circuit of the network device samples the inbound packets at a current sampling rate and directs a subset of the inbound packets to a service card of the network device. A flow controller within the service card of the network device processes the subset of the inbound packets to generate flow records. When changes in the rate at which the inbound packets are received exceed a defined threshold, the flow controller adjusts the current sampling rate at which the forwarding circuit samples the inbound packets received at the interface. Moreover, the flow controller adaptively adjusts the sampling rate such that the flow sampling resources the device are being utilized in accordance with the utilization thresholds.