Abstract: In one embodiment, an access point of an overhead mesh of access points in an area selects a range of client identifiers. The access point sends, via a beam cone transmitted in a substantially downward direction towards a floor of the area, a trigger signal that includes the range of client identifiers and prompts client devices having identifiers in that range to send best effort transmissions towards the overhead mesh. The access point detects a collision between the best effort transmissions of the client devices. The access point adjusts the range of client identifiers so as to avoid future collisions between the best effort transmissions of the client devices.

Abstract: In one embodiment, a device obtains one or more packets of a traffic session in a network. The device determines, for a particular packet of the one or more packets that match a filter, a fingerprint for the particular packet. The device identifies a plurality of traffic sessions whose packets match the fingerprint, wherein each of the plurality of traffic sessions is associated with at least one process. The device updates a process with the traffic session by applying a classifier to the plurality of traffic sessions.

Abstract: In one embodiment, a method comprises: registering, by a root network device in a low power and lossy network, a constrained network device that is reachable within the low power and lossy network; obtaining, by the root network device, executable code associated with execution of a network service operation by the constrained network device; receiving a data packet from a source device and destined for the constrained network device; and causing execution on the data packet, by the root network device, of the network service operation on behalf of the constrained network device in response to reception of the data packet.

Abstract: Disclosed are systems, computer-readable media and methods for monitoring performance data across microservices. One example method includes establishing a service policy configured on a centralized switch controller, applying the service profile to a virtual interface associated with a microservice, mapping a microservice name for the microservice to an IP address and a port number, tracking a protocol flow for the microservice, wherein the protocol flow is associated with a virtual switch, to yield data, aggregating the data to yield aggregated data and presenting the aggregated data on a user interface.

Abstract: A set of alert records stored in a shared alert data store that is shared amongst a cluster of processing nodes are presented in an interface. From the interface, a request is received to delete an identified alert record from the set of alert records. A delete alert record matching the identified alert record is added to the shared alert data store. The identified alert record is deleted from the shared alert data store responsive to the request. The delete alert record is transmitted to a processing node of the cluster of processing nodes, wherein the processing node deletes a local copy of the identified alert record according to the delete alert record.

Abstract: This disclosure describes techniques for performing multi-factor authentication (MFA) by utilizing user generated authenticating gestures. The techniques may include establishing and monitoring peer-to-peer communication links between user devices. The techniques may include monitoring channel properties for fluctuations in the channel properties associated with the user generated authenticating gesture passing through signals of the communication links. The techniques may further include comparing a gesture performed by a user to a predefined authenticating gesture. The techniques may include determining a pattern of fluctuations in the channel properties associated with the predefined authenticating gesture. The techniques may include determining a confidence score associated with comparing the gesture performed and the predefined authenticating gesture. The techniques may further include determining a proximity of the user and/or the gesture to the user device.

Abstract: Techniques are disclosed for placing content in and applying layers to an extended reality environment. An extended reality (XR) system determines an identifier that is associated with an object viewable within an extended reality environment. The XR system determines a plurality of data structures associated with the identifier, each data structure including a workspace and a dashboard. The XR system generates, using the plurality of data structures, a plurality of extended reality objects for display in the extended reality environment, each extended reality object including a dashboard from the plurality of data structures, where, in the extended reality environment, a first dashboard is visible. The XR system receives an input associated with the extended reality environment. The XR system causes, in response to the input, the second dashboard to be visible.

Abstract: Disclosed herein are systems, methods, and computer-readable media for upgrading vSmart controllers. In one aspect, a method includes an edge router receiving a notification from a vSmart controller that an upgrade to the controller will occur. The notification can be dynamically triggered by a centralized network management system. In some embodiments, the vSmart controller can run as a virtual machine (VM) and maintains a control plane connection with one or more edge routers in an overlay network. In response to the notification, a length of time of an expiry timer in which the edge router attempts to connect to the vSmart controller can be increased, and the edge router can connect to the vSmart controller once the increased length of time has passed.

Abstract: This disclosure describes techniques and mechanisms for authenticating user device(s) by ensuring that two user devices accessing the same online service are co-located, while protecting private information associated with a user's network landscape and/or Bluetooth device(s). The techniques may ensure that a second factor authentication device is in the same location as a first factor access device, and that a first factor access device is in the same location as it was during previous access attempts).

Abstract: Techniques for memory access management in a distributed computing system are described herein. In some aspects, the techniques described herein relate to a method for memory access management in a distributed computing system, where the method includes: receiving a first request to execute a first operation using a distributed architecture and in a uniform memory access (UMA) mode, wherein the distributed architecture comprises a first processor, a first memory that is local to the first processor, and a second memory that is remote to the first processor; subsequent to receiving the first request and a first delay period, transmitting first data associated with the first operation to the first processor, wherein the first data is stored in the first memory; and subsequent to receiving the first request, transmitting second data associated with the first operation to the first processor, wherein the second data is stored in the second memory.

Abstract: In one embodiment, a controller identifies access points forming an overhead mesh of access points in an area, each access point comprising one or more directional transmitters each configured to transmit a beam cone in a substantially downward direction towards a floor of the area. The controller determines coverage areas on the floor of the area for the one or more directional transmitters of the access points in the overhead mesh. The controller generates, based on the coverage areas, alternating communication schedules for the access points such that a client device at any given location on the floor of the area is within range of a plurality of receiving access points in the overhead mesh and at least one transmitting access point in the overhead mesh at a certain point in time. The controller sends the communication schedules to the access points.

Abstract: A method for file system destinations includes obtaining events for storage on one or more of the storage systems. For each event, the method includes extracting at least one field value from the event, comparing the at least one field value to configurations of the storage systems to identify at least one storage system of the plurality of storage systems having a matching configuration, transmitting the event to an ingest module queue for the at least one storage system, selecting a partition for the event based on the at least one field value to obtain a selected partition, mapping the selected partition to a file using a partition mapping, and appending the event to the file on the at least one storage system.

Abstract: Disclosed are systems, methods, and computer-readable media for assuring tenant forwarding in a network environment. Network assurance can be determined in layer 1, layer 2 and layer 3 of the networked environment including, internal-internal (e.g., inter-fabric) forwarding and internal-external (e.g., outside the fabric) forwarding in the networked environment.

Abstract: Techniques for traffic steering are disclosed. A first signal characteristic of a first connection between an electronic device and a first wireless communications network is determined. A second signal characteristic of a second connection between the electronic device and a second wireless communications network is also determined. Based on the first signal characteristic and the second signal characteristic, the electronic device is prevented from attempting to establish the second connection until one or more establishment criteria are met.

Abstract: In one embodiment, a method may comprise: instrumenting, by a process, runtime of a software application; detecting, by the process, a reflection call made within the runtime of the software application; determining, by the process and from the reflection call, a reflection target and a reflection caller; comparing, by the process, the reflection target, the reflection caller, and the reflection call against a security policy; and performing, by the process, one or more mitigation actions on the reflection call in response to a violation of the security policy. In another embodiment, a secure audit process first generates the security policy based on approving reflection calls, reflection targets, and reflection callers seen during a runtime of the software application in a secure environment, and then shares the security policy with local instrumentors of the software application to cause enforcement of the security policy against a local runtime of the software application.

Abstract: An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

Abstract: A method may include receiving a domain name system (DNS) query at a network device, where the DNS query may be associated with a traffic flow identified for rerouting through an alternative path utilizing an alternative network device instead of a default path. The method may also include rewriting the DNS query such that the DNS query is routed through the alternative network device along the alternative path and to a DNS server associated with the alternative path. The method may additionally include receiving a DNS response from the DNS server, where a resource identified in the DNS response may be based on the DNS query coming through the alternative network device.

Abstract: In one embodiment, an edge device of a network maintains intermediate certificates derived from root certificates of different cloud services that identify the edge device to those different cloud services. The edge device receives identity information for a particular device in the network. The edge device generates, using at least one of its intermediate certificates and the identity information for the particular device, one or more local digital identity certificates for the particular device. The edge device causes the particular device to be onboarded to a target cloud service from among the different cloud services, in part by providing the one or more local digital identity certificates to the particular device and to the target cloud service.

Abstract: In one embodiment, a gateway to a Layer-3 network forms a first Layer-2 tunnel between the gateway and a first wireless access point (AP) that communicates wirelessly with a first mobile node of a mobile system (MS) via a first wireless connection. The gateway generates a mapping that associates an onboard device of the MS with the first AP and an identifier for the MS, based on traffic conveyed via the first Layer-2 tunnel and associated with the onboard device, the traffic comprising a header that indicates the identifier for the MS. The gateway receives, from a second AP, an indication that the MS is roaming from the first wireless connection to a second wireless connection, the indication including the identifier for the MS. The gateway updates the mapping to associate the onboard device of the MS with a second AP, based on the indication that the MS is roaming.

Abstract: The present technology is directed to providing a 3-D visualization of a Wi-Fi signal propagation pattern based on telemetry data. The present technology can receive telemetry data for a Wi-Fi access point located at a location of a building plan in a Wi-Fi visualization system, store the telemetry data with a timestamp, determine a change in a Wi-Fi coverage for the Wi-Fi access point based on the telemetry data, and present a visualization illustrating the change in the Wi-Fi coverage for the Wi-Fi access point. The present technology can further present an animation of the change in the Wi-Fi coverage for the Wi-Fi access point based on the stored telemetry data.