Abstract: One embodiment is associated with dropping or admitting packets to an output queue using occupancy values of virtual destination queues which are updated according to different independent disciplines upon the enqueuing of a packet to an output queue, and the dequeuing of that packet from an output queue. In one embodiment, a virtual destination queue is determined for a packet. A policing decision is made whether to drop the packet or admit the packet to the output queue based on the occupancy level of the determined virtual destination queue, which is updated upon admission. Packets are dequeued in first-in-first-out order from the output queue. For a dequeued one or more packets, one or more of the occupancy values of the virtual destination queues are updated based a scheduling policy that is independent of the particular virtual destination queue(s) associated with the dequeued packets.

Abstract: One embodiment provides a system that facilitates a single interface for file I/O and network communication. During operation, the system receives from a local application a first command to create content. The first command includes a content name and access control information that indicates how the content may be accessed. The content name is a hierarchically structured variable length identifier that includes contiguous name components ordered from a most general level to a most specific level. The system creates a first manifest which is a content object that indicates a set of content objects by a name and a digest. The first manifest name is the content name corresponding to the first command, and access to the manifest is based on the access control information included in the first command. The system transmits to the local application the first manifest and an indicator of success for creating the first manifest.

Abstract: A system is provided to run new code modules safely in a duplicative, protected environment without affecting the code modules that are already trusted to be on the system. The system receives a new code module that validates operational data of a computing device, and instantiates a new, parallel execution engine to run the new code module on the operational data in parallel with another execution engine running the trusted/verified code modules that also validate the same operational data. The new engine runs the new code module with the operational data to produce new code module results. The production engine runs the trusted/verified code modules with the operational data to produce verified code module results. The new code module results are combined with the verified code module results to produce combined results describing the operational status of the computing device.

Abstract: Embodiments herein describe a photonic device that includes a germanium photodetector coupled to multiple silicon waveguides. In one embodiment, the silicon waveguides optically couple to a layer of germanium material. In one embodiment, if the germanium material forms a polygon, then a respective silicon waveguide optically couple to each of the corners of the polygon. Each of the plurality of input silicon waveguides may be arranged to transmit light in a direction under the germanium that is offset relative to both sides of the germanium forming the respective corner. In another example, the germanium material may be a circle or ellipse in which case the silicon waveguides terminate at or close to a non-straight, curved surface of the germanium material. As described below, optically coupling the silicon waveguides at a non-straight surface can reduce the distance charge carriers have to travel in the optical detector which can improve bandwidth.

Abstract: Domain classification based on lexical and semantic processing of target domains is provided. A target domain name or URL may undergo a lexical analysis to identify language indicating a potential association with malware. In response to a positive identification, the system may identify the domain name as potentially malicious and/or perform additional analysis. A semantic analysis of content associated with the target domain name may be performed. A corpus of information for content associated with malware is provided. The content of the webpage associated with the target domain name may be analyzed and compared to the corpus to identify potential similarity with malicious content. If the content for the target domain name meets a threshold similarity with malicious content from the corpus, the domain name may be flagged as malicious and added to a block list, for example.

Abstract: The present disclosure describes approaches for managing computational resources in a network environment. A computational resource may include any resource consumable over a network and available in finite supply. One example is a method comprising receiving a request associated with initiating a communication session in a network. The request may identify a source endpoint and a destination endpoint of the communication session and a value of a computational resource associated with the communication session. A measure of the computational resource may be determined for at least one network element in a path from the source endpoint to the destination endpoint. At least one rule may be applied to determine whether to allow the communication session to be initiated at the value. The at least one rule may identify alternative values for the computational resource. An instruction to initiate the communication session is generated based on the at least one rule.

Abstract: A method and system are disclosed for distributing (advertising) segment identifiers in network functions virtualization and/or software defined networking environments. An exemplary method includes receiving a route advertisement that includes a prefix with a forwarding address for a first network element and receiving a segment identifier (SID) advertisement that includes a prefix SID for the prefix. The route advertisement may be received from a second network element proxying control plane functions for the first network element. Reachability information for the first network element is updated based on the route advertisement and the SID advertisement.

Abstract: A method is provided in one example embodiment and includes receiving a message at a network element configured for routing packets, where the message directs a network device to change its power state; identifying the network device as being associated with a network for which the network element has responsibility; and communicating at least a portion of the message from the network element to the network device.

Abstract: A method and associated apparatus for generating a radial causality visualization including accessing a data store storing a first set of data and a second set of data, the first set of data and the second set of data being in a predetermined hierarchical relationship with each other, plotting the first set of data as nodes disposed on a first shape (e.g., circle, ring, rectangle, etc.) of a plurality of concentric shapes of a displayed visualization, plotting the second set of data as nodes on a second shape of the plurality of concentric shapes of the displayed visualization, wherein the second shape is disposed radially further outward from a center of the plurality of concentric shapes compared to the first shape, and displaying on the displayed visualization respective connecting lines that connect nodes disposed on the first shape with nodes disposed on the second shape.

Abstract: A name-based content-forwarding system generates an ordered-element name for a content item, and can process an interest to identify and perform an action that satisfies the interest. To generate the ordered-element name, the system generates one or more fixed-length elements for a content item, such that each fixed-length element of the ordered-element name is mapped to the content item or to a context associated with the content item. The system then generates the ordered-element name to include the one or more fixed-length elements so that the name elements are ordered from a highest matching priority to a lowest matching priority. The system can also generate a packet that includes the ordered-element name for the content item, and sends the packet to a target location that corresponds to the ordered-element name.

Abstract: An electromagnetic interference (EMI) gasket is provided that includes a resiliently-flexible and conductive outer shell, a cushioning element disposed in the outer shell, and at least one magnetic component disposed in the outer shell configured to magnetically couple to a conductive surface of an electronic device chassis.

Abstract: An example method for instantiating a network using a network function virtualization infrastructure (NVFI) pod in a network environment is provided and includes receiving a request to instantiate a logical network topology in the NFVI pod that includes a pre-selected set of interconnected pre-configured hardware resources, the abstract network topology including a virtual network function (VNF) forwarding graph (FG), distilling the VNF FG into various interconnected VNFs, deploying various VNFs of the VNF FG to a plurality of virtual machines, and instantiating the network topology on appropriate hardware resources in the NFVI pod. In specific embodiments, the pre-selected set of interconnected pre-configured hardware resources includes a plurality of compute servers, a plurality of controller servers, a set of network resources, and a plurality of storage resources. It may also include a high performance virtual switch operating in a user space of respective memory elements of a plurality of servers.

Abstract: In one embodiment, a device in a network performs a first comparison between observed and expected packet error rates for a first path in the network. The device identifies one or more intersecting paths in the network that intersect the first path. The device performs one or more additional comparisons between observed and expected packet error rates for the intersecting paths that intersect the first path. The device identifies a particular node along the first path as a source of packet drops based on the first comparison between the observed and expected packet error rates for the first path and on the one or more additional comparisons between the observed and expected packet error rates for the intersecting paths that intersect the first path.

Abstract: A method, system, and logic for upgrading mesh points of a wireless mesh network. One method includes maintaining a mesh topology data structure containing information on the tree topology of a wireless mesh network. The method further includes using a tree-walking method to send an upgrade message to the root access point and to each other mesh point in the wireless mesh network until each mesh point has received the upgrade message. Receiving the upgrade message enables the receiving mesh point to upgrade according to the contents of the upgrade message without necessarily disrupting the mesh network.

Abstract: A first network device configured as a first Virtual Local Area Network (VLAN) Tunnel Endpoint (VTEP) may receive a packet from a second network device. The first VTEP may determine that the second network device is a second VTEP and has not been established as a peer VTEP to the first VTEP. The first VTEP may maintain a status for the second network device as authentication pending, receive an authentication packet from the second network device and authenticating the second network device as a peer VTEP using the authentication packet.

Abstract: A first virtual machine is established in a virtual private service chain to provide a first network service to virtual private service chain traffic. A second virtual machine is also established the virtual private service chain to provide a second network service to the virtual private service chain traffic. The virtual private service chain traffic is encrypted for transmission within the virtual private service chain from the first virtual machine to the second virtual machine, wherein the encryption uses a key shared by the first and second virtual machines.

Abstract: In one embodiment, a cloud network provides cloud services to the one or more clients, where data usage of each client is monitored on a per client basis. If the data usage of any client is above a first predetermined threshold, then a WAN optimization platform is automatically implemented within the cloud network for the client having the data usage determined to be above the first predetermined threshold.

Abstract: A system and method are disclosed for generating segment routing (SR) segment lists. In one embodiment, a node receives information that identifies a path from a first node to a second node. Based on the received path, a set of segment identifiers that encodes the path is generated. A packet that is forwarded along the set of segment identifiers travels the received path.

Abstract: An apparatus may be provided. The apparatus may comprise a substrate and a circuit board. A ball grid array structure may be disposed between the substrate and the circuit board. In addition, a stand-off structure may be disposed between the substrate and the circuit board. The stand-off structure may be adjacent to the ball grid array structure.

Abstract: According to one aspect, a method includes identifying at least a first chunk to be obtained, the at least first chunk including at least a first packet, and determining a deadline for the first chunk, the deadline being indicative of an amount of time before the first chunk is needed. The method also includes determining whether the deadline for the first chunk is relatively long, and de-prioritizing the first chunk with respect to obtaining the first chunk for queueing in a buffer when it is determined that the deadline for the first chunk is relatively long. Finally, the method includes obtaining the first chunk for queueing in the buffer, wherein obtaining the first chunk for queueing in the buffer includes obtaining the first chunk after obtaining a second chunk for queueing in the buffer, the second chunk having a shorter deadline than the deadline for the first chunk.