Abstract: A system and method are provided for performing stomp-and-restart techniques in distributed MU-MIMO system. A plurality of radio head devices are provided that are configured to be deployed separated from each other in a coverage region of interest of a wireless network. A central processor subsystem is provided that is in communication with the plurality of radio head devices. The central processor subsystem configured to perform several operations based on downconverted samples received from the plurality of radio head devices.

Abstract: In one embodiment, a method includes identifying at a first edge device, a failure at a second edge device, the first and second edge devices located in a local network site in communication with remote network sites in an overlay network, changing a state of a routing locator address at the first edge device from down to up in response to the failure at the second edge device, the routing locator address initially associated with the second edge device, and advertising the routing locator address at the first edge device in an underlay network so that packets from the remote network sites are forwarded to the first edge device upon convergence in the underlay network. An apparatus and logic are also disclosed herein.

Abstract: In one embodiment, a slot-filler blanking tray includes a vented blanking panel including a vented front panel, the vented blanking panel for fitting over an entrance to one slot of a computer equipment rack including support rails, and a panel arrangement including partition panels to form a slot partition for reversibly inserting into the one slot, supported by the support rails, the slot partition being formed either by unfolding the partition panels or fitting the partition panels together, wherein (a) the vented blanking panel and at least one partition panel of the partition panels are mechanically connected together, or (b) the vented blanking panel includes a first connecting element and the at least one partition panel includes a second connecting element to mechanically connect the vented blanking panel and the at least one partition panel together. Related apparatus and methods are also described.

Abstract: A wireless access point (AP) configured to operate in accordance with both Wi-Fi and Long-Term Evolution (LTE-U) standards/protocols jointly schedules transmit opportunities for Wi-Fi and LTE-U frames. The AP assigns one of multiple, prioritized, Wi-Fi access categories to each Wi-Fi transmit frame based on a type of data in the transmit frame. The AP also assigns to each LTE-U transmit frame an LTE-U access category prioritized relative to the Wi-Fi access categories. The AP schedules Wi-Fi and LTE-U transmit opportunities for the Wi-Fi transmit frames and the LTE-U transmit frames, respectively, in the shared channel bandwidth based on the prioritized Wi-Fi and LTE-U access categories.

Abstract: Location data is obtained from signals transmitted by a first plurality of mobile wireless devices in a wireless network, wherein the first plurality of mobile wireless devices are moving within a predefined space, and wherein the location data comprises a plurality of location data time points, each location data time point including a timestamp, a unique mobile wireless device identifier, and location information indicating where in the predefined space an associated mobile wireless device is located. For each mobile wireless device, location data time points are aggregated to generate a set of aggregated location data for each mobile wireless device, and the set of aggregated location data is analyzed to determine characteristics corresponding to time-dependent behavior and location-specific behavior of the corresponding mobile wireless device. A user of each corresponding mobile wireless device is classified into a category of a plurality of categories based on the determined characteristics.

Abstract: In one embodiment, a method includes receiving a packet from an end node, the packet comprising an authenticated source MAC (Media Access Control) address and a source IP (Internet Protocol) address computed based on the authenticated source MAC address, and verifying the source IP address in the received packet, wherein verifying the source IP address comprises computing an IP address based on the authenticated source MAC address and comparing the computed IP address to the source IP address in the received packet to verify the source IP address. An apparatus is also disclosed herein.

Abstract: An intermediate device (such as a firewall) is disposed between first and second devices (such as a client and a server device, respectively). Communications between the first and second devices are intercepted in both directions by the intermediate device, which spoofs the receiving device by modifying messages sent by the transmitting device. The modified message uses a key held by the intermediate device instead of a key belonging to the sending device.

Abstract: In one embodiment, a device in a network captures a first set of packets based on first packet capture criterion. The captured first set of packets is provided for deep packet inspection and anomaly detection. The device receives a second packet capture criterion that differs from the first packet capture criterion. The device captures a second set of packets based on the second packet capture criterion. The device provides the captured second set of packets for deep packet inspection and anomaly detection. The anomaly detection of the captured first and second sets of packets is performed by a machine learning-based anomaly detector configured to generate anomaly detection results based in part on one or more traffic metrics gathered from the network and based further in part on deep packet inspection results of packets captured in the network.

Abstract: In one embodiment, a method includes receiving a packet associated with a flow at a network device, classifying the packet at the network device based on information received from a policy layer, inserting a Network Address Translation (NAT) indicator for the flow into the packet, and transmitting the packet in a service chain comprising network address translation. The NAT indicator is associated with the flows before and after network address translation to provide symmetry between the service chain and a return traffic service chain. An apparatus and logic are also disclosed herein.

Abstract: A computer system can compress or decompress a type-length-value (TLV) component in a message. During operation, the computer can select a compression table associated with a network interface used to send and/or to receive the message, and can search the compression table for an entry that includes a prefix of a value from type-length-value (TLV) component being compressed or decompressed. If compressing the message, the computer may generate a compressed block that corresponds to a compressed version of the TLV component, such that the compressed block includes the compression encoding in place of the prefix in the TLV component's value. The computer can also generate a compressed message that includes the compressed block in place of the TLV component, without a compression table.

Abstract: A method is provided in one example embodiment that includes measuring a delay between a transmitter and a receiver in a network environment, where the receiver is associated with a buffer. A minimum absorption buffer size for lossless transmission to a queue may be determined based on the delay and a transmission bandwidth, and buffer units for the queue can be allocated based on the minimum absorption buffer size. The transmitter may also be rate-limited if the minimum absorption buffer size exceeds available storage of the buffer. In other embodiments, buffer units can be reclaimed if the available buffer storage exceeds the minimum absorption buffer size.

Abstract: An apparatus and method is disclosed for segment routing (SR). In one embodiment, the method includes a node creating a segment stack that identifies one segment calculated using a first algorithm and a second segment calculated using a second, different algorithm. The node then attaches this header to a packet and sends it to another node.

Abstract: An apparatus includes a first power supply switch, a second power supply switch, and a control circuit. The first power supply switch includes a P-channel Metal Oxide Semiconductor Field Effect Transistor (PMOSFET) having a drain coupled to a first power rail to receive a first power voltage, a source coupled to an output node, and a gate to selectively turn on or off the PMOSFET to supply the first power voltage to the output node or isolate the first power rail. The second power supply switch receives a second power voltage and passes it to the output node if the second power voltage is present. The control circuit cooperates with the first power supply switch to control the gate voltage to turn on the PMOSFET if the first power voltage is present and the second power voltage is absent, and turn off the PMOSFET if the second power voltage is present.

Abstract: One embodiment provides a system that facilitates a content requesting device to handle a potential timeout event. During operation, the system receives, by a content producing device, a packet that corresponds to a first Interest message from a content requesting device, where the first Interest includes a name. Responsive to determining that additional time is required to generate a matching Content Object for the first Interest, the system generates a notification message which indicates a time period after which a second Interest is to be sent out by the content requesting device. The name for the second Interest can be the same as the name for the first Interest or a new name as indicated in the notification message. The system transmits the notification message to the content requesting device, thereby facilitating the content requesting device to handle a potential timeout event.

Abstract: Presented herein are vulnerability assessment techniques for highlighting an organization's information technology (IT) infrastructure security vulnerabilities. For example, a vulnerability assessment system obtains application metadata for each of a plurality of executable applications observed at one or more devices forming part of an organization's IT infrastructure. The application metadata includes unique software identifiers for each of the plurality of executable applications. The vulnerability assessment system obtains global security risk metadata for executable applications observed at the one or more devices. The vulnerability assessment system maps one or more unique software identifiers in the application metadata to global security risk metadata that corresponds to applications identified by the one or more unique software identifiers, thereby generating a vulnerable application dataset.

Abstract: In one method embodiment a method of processing of a bitstream is disclosed.

Abstract: Systems, methods, and computer program products to perform an operation comprising receiving, from a video monitoring system, a count of people detected at a first location, wherein the video monitoring system comprises a camera configured to capture video of the first location, receiving a count of wireless devices detected in a second location, and applying a first correction factor to the count of wireless devices detected at the second location to determine a number of people present in the second location, wherein the first correction factor is based on the count of people detected by the video monitoring system and a count of wireless devices in the first location.

Abstract: An end-to-end secure cloud-hosted collaboration service is provided with a hybrid cloud/on-premise index and search capability. This approach includes on-premise indexing and search handling, while relying on the cloud for persistent storage and search of the index. The on-premise indexer receives a copy of an encrypted message from the cloud-hosted collaboration service. The encrypted message has been encrypted with a conversation key. The indexer receives the conversation key from an on-premise key management service, and decrypts the encrypted message with the conversation key. A set of tokens are extracted from the decrypted message, and subsequently encrypted with a secret key, different than the conversation key, to generate a first set of encrypted tokens. The first set of encrypted tokens is transmitted for storage in a search index on the cloud-hosted collaboration service.

Abstract: In one embodiment, a device in a network receives one or more packets that are part of a traffic flow. The device provides a sample packet to a path computation element (PCE) that includes a signature that uniquely identifies the traffic flow. The device receives a traffic flow policy for the traffic flow from a policy engine and enforces the traffic flow policy for the traffic flow.

Abstract: In one embodiment, a device in a network maintains information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models. The device receives an indication of a planned application deployment in the network. The device adjusts an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications associated with the traffic analyzed by the anomaly detection models.