Abstract: A network device that provides packet forwarding services includes: a command line interface and a route manager. The command line interface is programmed to: obtain a command, for updating a routing control function, that specifies positional information; identify a portion of the routing control function based on the positional information; identify a syntactic style associated with the portion of the routing control function; make a modification to the routing control function to obtain a modified routing control function; and update operation of the network device based on the modified routing control function. The route manager is programmed to process a route for forwarding packets of the network device based on the modified routing control function, after the operation of the network device is updated, to obtain a processed route for forwarding the packets.

Abstract: In general, in one aspect, embodiments relate to a method for managing network devices in a network. The method includes making, by a network device, a determination that there are no established sessions between the network device and any of a plurality of network devices, wherein the network comprises the network device and the plurality of network devices, and in response to the determination, disabling, by the network device, an interface associated with a link between the network device and a second network device, wherein the second network device is external to the network.

Abstract: Power management includes receiving power supply unit (PSU) power capacity data and PSU power consumption data from each PSU in a set of PSUs. A priority table is updated with controlled device power consumption data received from a set of controlled devices. If the PSU power consumption data of any PSU exceeds an associated threshold calculated based on the PSU power capacity data for the PSU, then one or more controlled devices are selected based on the controlled device power consumption data in the priority table. When power consumption data of any PSU exceeds the associated threshold, a power response procedure powers off at least one of the selected one or more controlled devices, reduces power supplied to at least one of the selected one or more controlled devices, or reduces an output voltage of any of the PSU for which the PSU power consumption data exceeds the associated threshold.

Abstract: Techniques for operating a networking switch in two broadcast networks are provided. In some embodiments, the switch may instantiate a first controller client and a second controller client in a control plane of the switch; register the first controller client with a first broadcast controller associated with a first broadcast network; and register the second controller client with a second broadcast controller associated with a second broadcast network. The switch may further receive a first multicast route through the first controller client; receive a second multicast route through the second controller client; and program at least one of the first multicast route and the second multicast route into a multicast routing information base.

Abstract: A method and system for emulating physical layer (L1) connectivity between distant computing devices. Existing solutions require that the computing devices or end points directly connect to a same interconnecting (or network) device and/or employ network devices requiring awareness of the communication protocol used between the end points. Further, existing solutions typically fail to match the ingress and egress clock rates. These restrictions limit scaling of the solutions, confine the end points to a physical co-location, and/or fail to transport or replicate the physical properties (e.g., errors, proprietary signaling, clock frequency, etc.) of the data stream transmitted between the end points. The disclosed method and system overcome these limitations through implementation of a L1 connectivity abstraction between computing devices across a network, and through clock rate reconstruction using a data buffer state controlled phase lock loop (PLL) mechanism.

Abstract: In some embodiments, a method processes a first packet and generates a first copy of the first packet as a second packet. The method sends second copies of the first packet to a first group of multiple destinations defined by a first address. Also, the method sends the second packet to an interface with a loopback function. The interface recirculates the second packet for further processing. The second packet is processed where the second packet is assigned a destination of a second address. Then, the method sends copies of the second packet to a second group of multiple destinations defined by the second address.

Abstract: Systems and methods for allocating a per-interface access control list (ACL) counter are disclosed. An ACL is applied to a data packet received at an interface of the network element. In response to matching the highest priority ACL rule, a counter value is obtained based on a combination of a base index and an expansion index value. The base index, expansion index, and counter values are stored in their respective tables. The counter value is uniquely associated with the specific ACL rule hit and the interface used to receive the data packet. Systems and methods also allocate a next set of expansion and counter tables when their storage capacity is exceeded. When the next set of tables are allocated, the older set of tables along with their index mappings and entries are preserved.

Abstract: A system administrator can specify NAT mappings to perform NAT translations in a switch. The administrator can specify an ACL to filter packets to be translated. Filter rules generated from the ACL are stored in a first memory store in a switch and NAT rules generated from the NAT mappings are stored in a second memory store separate from the first memory store. When a packet matches one of the filter rules a tag that identifies the ACL is associated with the packet. When the tagged packet matches one of the NAT rules, the packet is translated according to the matched NAT rule.

Abstract: A method and system for exported flow tracking information is disclosed. The method includes receiving, by a network device, a network traffic flow comprising a data packet, and transmitting, by the network device, a message comprising a network device identifier (NDID), a template set, and an options template set using a traffic analysis protocol. The message is received by a flow collector, and a template record comprising a flow template identifier (FTID) and at least one flow key is extracted from the template set. An options template record comprising a metadata template identifier (MTID) and at least one metadata key is extracted from the options template set. The method includes generating a new repository entry using the NDID, the FTID, the at least one flow key, the MTID, and the at least one metadata key, and storing, by the flow collector, the new repository entry in the Flow Tracking Repository (FTR).

Abstract: A method for analyzing a pair of domain name system (DNS) packets, the method comprising: extracting a portion of a request DNS packet to obtain extracted request DNS information, wherein the extracted request DNS information comprises a first timestamp generated by the edge network device, obtaining a response DNS packet, extracting at least a portion of the response DNS packet to obtain extracted response DNS information, wherein the extracted response DNS information comprises a second timestamp generated by the edge network device, after the obtaining, processing the extracted request DNS information and extracted response DNS information to obtain processed information, wherein the processed information comprises a roundtrip time derived from the first timestamp and the second timestamp, and transmitting the processed information to a monitoring system, wherein the pair of DNS packets are not transmitted to the monitoring system.

Abstract: A method for distributing network services for a network device through a multi-tenant network service. An identification parameter is associated with the device and is stored in a database by an orders management system after the device is ordered. The method includes establishing a network connection between a network device and a multi-tenant network service and, in response to establishing the network connection, obtaining device-associated identification parameter from the network device. The identification parameter is used to query the database for at least one record associated with the network device identifying a tenant of the multi-tenant network service in which the tenant corresponds to the device. The service maps the network device to the identified tenant of the multi-tenant network service and distributes network services based upon the mapping of the network device to the identified tenant.

Abstract: In some implementations, a method is provided. The method includes determining a physical topology of a network and monitoring network events based, at least in part, on control plane information received from one or more devices in the network. The method also includes monitoring the performance of each of a plurality of applications running on the network based, at least in part, on a set of application calls initiated by each application. When a drop in performance of an application is detected, the drop in performance is correlated with one or more of a plurality of detected network events to determine a cause of the drop in performance.

Abstract: A method for managing optical transceivers includes obtaining laser measurements for a laser operating in an optical transceiver in a network device, obtaining a failure profile for the laser, making a first determination that the laser measurements match the failure profile, and based on the first determination, initiating a remediation action for the optical transceiver.

Abstract: Methods and systems for managing power for a Power over Ethernet (PoE) device are disclosed herein. The method may include obtaining, by a supervisor, power information from a plurality of power supply units (PSUs) to obtain total consumed power; obtaining, by the supervisor, a total system power capacity value associated with the plurality of PSUs; and calculating, by the supervisor, a total available PoE power value using the total consumed power and the total system power capacity value; and making a first determination, by the supervisor, using the total available PoE power value and a PoE power table, whether a powered device should stop receiving power.

Abstract: Techniques for operating a network device for multiple packet encapsulation for different tunnels are provided. In some embodiments, the network device may receive an original packet on an ingress port, the original packet being received from a first host and addressed to a second host; encapsulate the original packet in a first tunnel packet for a first tunnel; recirculate the first packet through a loopback port; encapsulate the recirculated packet in a second tunnel packet for a second tunnel; and egress the packet encapsulated for the second tunnel. The switch may further add a first tunnel header to the original packet to encapsulate the first packet and add a second tunnel header to the recirculated packet to encapsulate the recirculated packet.

Abstract: Systems and methods are provided herein for transitioning a supplicant from one virtual local area network (VLAN) to another using a change of authorization (COA) message. This may be accomplished by an authentication server notifying a network device that a host should be granted access to the network, wherein the authentication server authenticates the host using MAC based authentication. Based on this notification and the MAC address of the host, the network device assigns the host to a first VLAN. If the authentication server determines that the host needs to change from the first VLAN to a second VLAN the authentication server generates a COA message, associated with the host, wherein the COA message comprises a VLAN identifier related to the second VLAN. The authentication server transmits the COA message to the network device causing the network device to route traffic to and from the host using the second VLAN.

Abstract: A system and method for managing network traffic is disclosed. The method includes determining an application domain, network elements associated with the application domain, and roles the network elements in the application domain. A virtual routing and forwarding (VRF) policy is generated for each of the network elements in the application domain based on the application domain and the role of each of the network elements in the application domain.

Abstract: A latch includes a retention portion. The retention portion is configured to prevent a first device, coupled to the latch, from being removed while the retention portion is in a first configuration. The retention portion is configured to allow the first device to be removed while the retention portion is in a second configuration. The latch also includes a spring portion configured to allow the retention portion to transition between the first configuration and the second configuration.

Abstract: Systems and methods are provided herein for using a network device's software (e.g., programs executed on a CPU) to maintain and export flow data while offloading network resource intensive tasks to the network device's hardware. This may be accomplished by a network device determining whether a new flow should be tracked using only the software table (e.g., table stored only on the CPU) of the network device or whether certain flow tracking tasks (e.g., counting/parsing) can be offloaded to a hardware table (e.g., counter table in a hardware flow cache) of the network device. The network device may use one or more conditions to determine whether the new flow should be tracked using the software table or by both the software and the hardware table. The conditions can relate to the characteristics of the new flow, resource information, prioritization of the new flow, etc.