Abstract: Systems and methods for automatically configuring network elements for in-band telemetry are disclosed. A controller of a configuration engine, which includes a flow analyzer and an INT configuration module, receives sampled packets and flow updates from network elements that are not yet configured for INT telemetry. The controller forwards the packets to the flow analyzer that extracts flow properties from the received packets, generates a flow summary along various metrics, and records it in a multi-dimensional matrix. A few metrics from top flows are selected and forwarded to the INT configuration module to identify network elements from whom packets containing the selected metrics were received. The identified network elements are automatically configured with the selected INT configuration such that INT telemetry data can be collected from them. Changes to the flow are dynamically accommodated by reconfiguring the network elements based on the telemetry data received after they have been configured.

Abstract: In general, embodiments described herein relate to methods and systems for automating the configuration of network devices. More specifically, embodiments of the invention relate to using configuration commands that specify protocol-specified relationships in order to generate granular (or specific) filtering rules (also referred to as rules). The rules are subsequently programmed into the network device.

Abstract: Routes in an address group are generally resolved according to a next hop resolution profile that applies across the address group. Individual next hop resolution profiles can be defined and associated with specific routes within the address group. Those specific routes are resolved according to their respective associated next hop resolution profiles, thereby bypassing the next hop resolution profile of the address group to provide control over the resolution behavior at the granularity of individual routes within the address group.

Abstract: In general, embodiments of the invention relate to routing packets between hosts or virtual machines in different layer 2 domains. More specifically, embodiments of the invention relate to using overlay routing mechanisms in an Internet Protocol (IP) fabric to enable communication between hosts or virtual machines in different layer 2 domains to communication. The overlay routing mechanisms may include direct routing, indirect routing, naked routing, or a combination thereof (e.g., hybrid routing).

Abstract: Embodiments of the present disclosure automatically set a maximum burst size in a policer to optimize the flow of traffic in a network. In one embodiment, a method includes receiving a policer rate set by a first policy, a maximum rate corresponding to one or more communications channels, and maximum burst time for performing at data burst. A maximum burst size is determined automatically based on the received policer rate, maximum rate, and maximum burst time. A policer in a network device is configured to limit traffic received at the one or more communications channels based on the maximum burst size.

Abstract: A method for optimizing network device resources that includes receiving, by an optimizer, first resource utilization data, making a first determination, based on the first resource utilization data, that resource utilization exceeds an upper threshold, starting, based on the first determination, an optimization process, that includes identifying a resource optimization entry of a resource class optimization queue, and initiating optimization of a resource fragment specified by the resource optimization entry. After initiating optimization of the region of the memory, the method additionally includes receiving second resource utilization data, making a second determination, based on the second resource utilization data, that the resource utilization is below a lower threshold, and halting, based on the second determination, the optimization process.

Abstract: Systems and methods for power distribution by an ethernet controller are disclosed. A first input port receives a first power carried by a first ethernet cable and sourced by a first source PoE device. A second input port receives a second power carried by a second ethernet cable and sourced by a second source PoE device. The first input port is at a first voltage lower than a minimum voltage of a specified input voltage range and the second input port is at a second voltage lower than the minimum voltage of the specified input voltage range. A controller, coupled to the first and second input ports, substantially equalizes current flowing across a first output port and a second output port, coupled to the downstream PoE devices, such that a load, caused by the downstream PoE devices, between the first output port and the second output port is shared.

Abstract: A network device includes a switching system for directing packets between ingress ports and egress ports of the network device. The network device also includes a switching system manager that makes an identification of a state change of a virtual output queue of the switching system; and performs an action set, based on the state change, to modify a latency of the virtual output queue to meet a predetermined latency in response to the identification.

Abstract: Peer devices in a peer group of provider edge devices to which a customer edge device is multi-homed, advertise Selective Multicast Ethernet Tag (SMET) routes to other peer devices on a core to receive traffic addressed to a multicast group. The peer devices in the peer group advertise the SMET routes irrespective of whether they are the designated forwarder or not. A peer device receiving traffic for the multicast group will drop the packet if it is not the designated forwarder and will forward the packet if it is the designated forwarder.

Abstract: Systems and methods are provided herein for an improved method of Zero-Touch Provisioning (ZTP) where a first switch receives a virtual local area network (VLAN) identifier from a second switch, allowing the first switch to reach a dynamic host configuration protocol (DHCP) server. This may be accomplished by a first switch receiving a VLAN identifier from a second switch. The first switch then transmits a DHCP discover message using the VLAN identifier. The first switch then receives reachability information for a ZTP server from the DHCP server. The first switch uses the reachability information to establish a provisioning session between the first switch and the ZTP server.

Abstract: A method for processing network communications, the method including receiving a network packet at a network device and performing at least one lookup for the packet in one or more first lookup tables in which the one or more first lookup tables are programmed to include at least one of an exact match or longest prefix match (LPM) table entry. The method includes obtaining a security source segment and a security destination segment based upon the result of the at least one lookup for the packet in the one or more first lookup tables. The method further includes performing a lookup in a second lookup table based upon the security source segment and security destination segment in which the second lookup table is programmed in a content addressable memory. Based upon the result of the lookup in the second lookup table, processing a forwarding decision for the packet according to the security source segment and security destination segment.

Abstract: In some embodiments, a method sets a threshold for utilization of a first table, wherein the utilization is based on layer 3 addresses and layer 2 addresses being stored in the first table. When a utilization of the first table does not meet the threshold, the method stores a layer 3 address in the first table. The first table uses a first type of lookup to determine a next hop address for the layer 3 addresses or the layer 2 addresses, and the first table also stores one or more layer 2 addresses. When the utilization of the first table meets the threshold, the method stores the layer 3 address in a second table where the second table uses a second type of lookup to determine the next hop address for layer 3 addresses.

Abstract: Techniques for configuring a logical network switch in label-switched networks are provided. In some embodiments, a first network device in a label-switched network is configured with a network address. A second network device in the label-switched network is configured with the same network address. The first network device is configured to use a set of labels for a set of virtual local area networks (VLANs). The second network device is configured to use the same set of labels for the same set of VLANs. The configured first and second network devices appear as a logical network device from the perspective of other network devices in the label-switched network.

Abstract: A thermal management system is provided. The system includes a temperature sensor, a fan, an electronic circuit breaker (ECB) coupled to the fan to provide electric power to the fan. The system includes a controller coupled to the temperature sensor and the ECB, to direct the ECB to turn off the electric power to the fan responsive to detecting a temperature, from the temperature sensor less than a temperature threshold based on a temperature rating of the fan.

Abstract: Transmission thresholds for IEEE 802.11ax Spatial Reuse (SR) opportunities are set adaptively. A group retry rate is defined and used to quantify the level of interference in a Spatial Reuse Group (SRG). Access points in the SRG update their OBSS-PDmax thresholds so as to keep the group retry rate value acceptably low. Access points transmit during an SR opportunity subject to the constraints imposed by the updated OBSS-PDmax.

Abstract: A system and method for provisionally authenticating a host moving from a source port of a switch device to a destination port of the switch device is disclosed. The host is initially authenticated at the source port and blocked from forwarding network traffic at the destination port. During a provisional authentication session, an authentication agent executing on the switch intercepts one or more authentication packets sourced by the host and headed for the destination port of the switch device and redirects the authentication packets to an authentication server for validating the host at the destination port of the switch device. The switch device removes the block at the destination port in response to receiving an acknowledgment of successful authentication at the destination port from the authentication server.

Abstract: The precision time protocol (PTP) runs on the peer switches in an MLAG domain. PTP messages received by one peer switch on an MLAG interface is selectively peer-forwarded to the other peer switch on the same MLAG interface in order to coordinate a synchronization session with a PTP node. The peer-forwarded messages inform one peer switch to be an active peer and the other peer switch to be an inactive peer so that timestamped messages during the synchronization session are exchanged only between the PTP node and the active peer, and hence take the same data path.

Abstract: Network identifiers are extracted from route advertisements. A table associates virtual network identifiers with provider edge devices. When a virtual network identifier extracted from a route advertisement matches a virtual network identifier in the table, the route advertisement is propagated to the provider edge devices associated with that virtual network identifier in the table. The route advertisement is not propagated to provider edge devices not associated with that virtual network identifier in the table.

Abstract: Embodiments of the invention relate to methods and systems for processing network traffic data units. The methods and systems may include functionality for receiving a first network traffic data unit at a first edge device at a first time, and appending a first ingress timestamp to the first network traffic data unit based on the first time. The methods and systems also include functionality to receive a second network traffic data unit at a second edge device at a second time and appending a second ingress timestamp to the second network traffic data unit based on the second time. The first network traffic data unit and second network traffic data unit are transmitted, via a network, to a data processing device.

Abstract: Synchronization of clocks among computing devices in a network includes determining master/slave relations among the computing devices. Some computing devices (e.g., switches) include trunk ports configured to carry traffic for several logical networks; e.g., virtual local area networks, VLANs. A trunk port can be associated with a master/slave setting for each logical network that it is configured for. Synchronization of clocks among the computing devices further includes running a synchronization sequence between a trunk port and each computing device on each of the logical networks configured on the trunk port.