Abstract: The distribution of reachability information between data centers includes receiving routes that are advertised among network devices within a given data center. The received routes are summarized to produce one or more summarized (aggregated) routes which are fewer in number than the received routes. Instead of advertising the received routes among the data centers, the summarized routes are advertised. Advertising the summarized routes as compared to the received routes reduces control plane traffic between data centers, and reduces the requirements for storing advertised routes received by a data center.

Abstract: A central controller in a data network can maintain a set of access control list (ACL) rules that represent traffic and data policies of the data network. The controller can autonomously propagate the set of ACL rules to switches in the data network. Each switch that receives the set of ACL rules can selectively install rules from the set based on criteria such as whether or not a given rule in the set is close to the source and device class.

Abstract: A central controller in a data network can maintain a set of access control list (ACL) rules that represent traffic and data policies of the data network. The controller can autonomously propagate the set of ACL rules to switches in the data network. Each switch that receives the set of ACL rules can selectively install rules from the set based on criteria such as whether or not a given rule in the set is close to the source and device class.

Abstract: A device-management system performs processing, such as audio processing, in an instance of a virtual machine corresponding to a functionally limited (local) device. To register the local device, the device-management system receives a registration request that includes device information, encryption data, and an indication of an associated user account. The device-management system then sends this registration data to a service-provider system, which returns a shared encryption key. The device-management system and the local device may use this shared encryption key to securely communicate. The device-management system may de-allocate the instance upon detecting a period of inactivity of the local device and may re-allocate the instance when new activity is detected. The device-management system may further determine when and if audio data to be sent to the local device is encoded using a codec not implemented by the local device.

Abstract: Systems and methods for INT telemetry are disclosed. The system selects a subset of flows from a plurality of flows to monitor. Parameters of the selected flows are sent by the management controller to an INT source for creating a watchlist. The INT source analyses an incoming packet against the parameters in the watchlist to determine if the packet belongs to a flow selected for monitoring. If the packet matches any one of the parameters, then the INT source embeds the packet with an IP address of a designated tenant collector and the INT instructions. A designated collector is allocated for each flow, set of flows, or tenant. Regardless of the path taken by the packet, the embedded INT packet contains all the information needed for a downstream network element to send telemetry data without the need for configuring the network element for telemetry.

Abstract: The disclosure describes processing packets in connection with a traceroute session in an overlay network that includes detecting traceroute probes using static and dynamic rules and using the time to live (TTL) value in a received traceroute probe to compute an outer TTL value. The TTL value (inner TTL) of the received probe is updated based on the number of underlay routers (hops) comprising the underlay network that are detected during the traceroute session. The received probe with its updated TTL value is encapsulated in an outer frame that includes the computed outer TTL value. The number of hops is updated each time an underlay router sends an ICMP time exceeded message.

Abstract: A device-management system performs processing, such as audio processing, in an instance of a virtual machine corresponding to a functionally limited (local) device. To register the user device, the device-management system receives a registration request that includes device information, encryption data, and an indication of an associated user account. The device-management system then sends this registration data to a service-provider system, which returns a shared encryption key. The device-management system and the user device may use this shared encryption key to securely communicate. The device-management system may de-allocate the instance upon detecting a period of inactivity of the user device and may re-allocate the instance when new activity is detected. The device-management system may further determine when and if audio data to be sent to the user device is encoded using a codec not implemented by the user device.

Abstract: Systems and methods for managing a data packet's maximum transmission unit (MTU) limit in an in-band telemetry (INT) network are disclosed. The methods include a downstream network element receiving a packet with INT instructions and in response to determining that adding its own metadata would exceed the allowed MTU limit at its egress interface, generating and forwarding a telemetry report containing existing and new metadata to the designated collector, and forwarding the received packet without any metadata to the next hop. The methods forward the telemetry report to the collector when the packet's MTU limit is exceeded and thereby avoids uncontrolled growth of the packet size.

Abstract: A facility to determine if performance issues between two host computers in a data network includes a central controller identifying endpoints of a flow path between the two hosts. The central controller communicates with endpoint network devices to initiate telemetry tagging traffic on the flow path. A collector receives telemetry communicated in a packet from network devices on the flow path. A network operator can view the collected telemetry to assess whether the performance issue is in the network or not.

Abstract: Systems and methods for INT telemetry are disclosed. The system selects a subset of flows from a plurality of flows to monitor. Parameters of the selected flows are sent by the management controller to an INT source for creating a watchlist. The INT source analyses an incoming packet against the parameters in the watchlist to determine if the packet belongs to a flow selected for monitoring. If the packet matches any one of the parameters, then the INT source embeds the packet with an IP address of a designated tenant collector and the INT instructions. A designated collector is allocated for each flow, set of flows, or tenant. Regardless of the path taken by the packet, the embedded INT packet contains all the information needed for a downstream network element to send telemetry data without the need for configuring the network element for telemetry.

Abstract: A facility to determine if performance issues between two host computers in a data network includes a central controller identifying endpoints of a flow path between the two hosts. The central controller communicates with endpoint network devices to initiate telemetry tagging traffic on the flow path. A collector receives telemetry communicated in a packet from network devices on the flow path. A network operator can view the collected telemetry to assess whether the performance issue is in the network or not.

Abstract: A central controller in a data network can maintain a set of access control list (ACL) rules that represent traffic and data policies of the data network. The controller can autonomously propagate the set of ACL rules to switches in the data network. Each switch that receives the set of ACL rules can selectively install rules from the set based on criteria such as whether or not a given rule in the set is close to the source and device class.

Abstract: The disclosure describes processing packets in connection with a traceroute session in an overlay network that includes detecting traceroute probes using static and dynamic rules and using the time to live (TTL) value in a received traceroute probe to compute an outer TTL value. The TTL value (inner TTL) of the received probe is updated based on the number of underlay routers (hops) comprising the underlay network that are detected during the traceroute session. The received probe with its updated TTL value is encapsulated in an outer frame that includes the computed outer TTL value. The number of hops is updated each time an underlay router sends an ICMP time exceeded message.

Abstract: A packet loop runs between two participating endpoint network devices, and in particular runs in the respective data planes of the endpoint devices. A probe packet is provided to the data plane of an initiating device and is forwarded to the other device to initiate the packet loop. The source and destination addresses in the probe packet are set equal to a common address. Based on the common address, entries in the respective forwarding tables of the endpoint devices are established to point to each other so that the probe packet is forwarded back and forth between the two devices thus sustaining the packet loop. A broken loop indicates a forwarding path failure at which time corrective action to be taken.

Abstract: In general, embodiments of the invention relate to providing a scalable network configuration to enable hosts for different tenants to communicate with each other. More specifically, embodiments of the invention relate to using a combination of per-tenant virtual routing and forwarding (VRF) tables, encapsulation, and stateless access control lists (ACLs) to enable intra-tenant and inter-tenant communication and segmentation.

Abstract: A packet loop runs between two participating endpoint network devices, and in particular runs in the respective data planes of the endpoint devices. A probe packet is provided to the data plane of an initiating device and is forwarded to the other device to initiate the packet loop. The source and destination addresses in the probe packet are set equal to a common address. Based on the common address, entries in the respective forwarding tables of the endpoint devices are established to point to each other so that the probe packet is forwarded back and forth between the two devices thus sustaining the packet loop. A broken loop indicates a forwarding path failure at which time corrective action to be taken.

Abstract: A device-management system performs audio processing, such as acoustic echo cancellation or beamforming, in a computing-resource allocation corresponding to a functionally limited device. The device-management system may be a locally-connected network device that is in communication with one or more user devices; the device-management system may also or instead be a remote device that communicates with the user devices using the locally-connected network device. The device-management system may receive audio data from one or more microphones of one or more user devices. To perform acoustic echo cancellation, the device-management system may receive and process time data corresponding to a time of output of audio by the user device.