Abstract: Systems, methods, and computer-readable media for updating configurations in sensors deployed in multi-layer virtualized environments. In some examples, a system can track information of sensors and collectors in the network. In response to determining that a specific collector becomes unavailable (e.g., the specific collector is down, offline or becomes unsupported), the system can determine affected sensors corresponding to the specific collector, determine a new collector among active collectors of the network for each of the affected sensors, and dynamically update configuration and settings of the affected sensors to maintain proper collector-to-sensor mappings and other settings on the affected sensors.

Abstract: This disclosure describes techniques and mechanisms for managing congestion within a network with a controller. The techniques include identifying a first designated memory location from which a first destination device reads first data, identifying a second designated memory location from which a second destination device reads second data, writing the first data to the first designated memory location, incrementing, based at least in part on writing the first data, a write index; sending a first indication to the first destination device that the first data is ready to be consumed, determining that the first destination device retrieved the first data from the first designated memory location, and decrementing the write index.

Abstract: A method includes generating a first shortest path tree for traffic routing in a network, the first shortest path tree identifying a corresponding shortest path from the network node to other nodes in the network and generating a second shortest path tree for traffic routing after removing an element from the network. The second shortest path tree identifies a corresponding shortest path from the network node to the other nodes in the network with the element removed. A third shortest path tree is generated, which is a weighted version of the second shortest path tree with a weight value added to any node or link in the network sharing a SRLG value with the element removed from the network. Network traffic is enforced based on a comparison of the third shortest path tree with at least one of the first shortest path tree and the second shortest path tree.

Abstract: Multi-AP Coordination (MAPC) configuration protocol may be provided. MAPC modes supported by a plurality of Access Points (APs) may be discovered. A MAPC group of a sub-set of APs of the plurality of APs may be formed. Each AP of the sub-set of APs of the MAPC group may support at least one common MAPC mode. Roles including a leader and followers of the MAPC group may be advertised. A first AP of the MAPC group may be assigned as the leader and remaining APs of the MAPC group may be assigned as the followers.

Abstract: Symmetric networking techniques disclosed herein can be applied by gateway routers in cloud networks. The techniques can ensure that both outbound traffic received at a cloud from a branch device and return traffic directed from the cloud back to the branch device are processed by a same gateway router. The gateway router can use network address translation to insert IP addresses from an inside pool and an outside pool assigned to the router.

Abstract: Energy-aware configurations can be utilized to operate a network based on sustainability-related metrics. In many embodiments, a suitable device includes a processor, a memory commutatively coupled to the processor, a plurality of elements, a communication port, and an energy-aware topology logic configured to collect topology data from one or more network devices, wherein each of the one or more network devices include a plurality of elements. The energy-aware topology logic can receive power source data and power usage data related to plurality of elements and generate an element energy coefficient (EEC) for a plurality of elements. Subsequently, the energy-aware topology logic can also generate an energy-aware configuration for at least one of the one or more network devices, and then pass the generated energy-aware configuration to the at least one network device, wherein the energy-aware configuration is configured to steer traffic based on at least one sustainability-related metric.

Abstract: In one embodiment, network node-to-node connectivity verification is performed in a network including data path processing of packets within a packet switching device. In one embodiment, an echo request connectivity test packet, emulating an echo request connectivity test packet received from a first connected network node, is inserted by the packet switching device prior in its data processing path prior to ingress processing performed for packets received from the first connected network node. A correspondingly received echo reply connectivity test packet is intercepted by the packet switching device during data path egress processing performed for packets to be forwarded to the first connected network node.

Abstract: A method includes, at a media bridge configured to distribute a plurality of media streams among a plurality of client devices connected to the media bridge over a network during a real-time communication (RTC) instance, receiving a plurality of quality of experience (QoE) preferences from the plurality of client devices via the media bridge, the plurality of QoE preferences being transmitted as a real-time transport protocol (RTP) control protocol (RTCP) extension header of a transmitted data packet. The method also includes receiving a plurality of QoE metrics at the media bridge, and in response to a determination that a degradation in network conditions of the network has occurred, downgrading at least one of the plurality of media streams based on the plurality of QoE preferences.

Abstract: Novel techniques and mechanisms enable processing of heavy deep learning workloads on standard edge network devices to optimize the overall inference throughput of the network while meeting Service Level Agreement(s) (SLAs). The techniques can include receiving a deep learning model, determining a graph structure of the deep learning model including neurons organized in layers (the layers including an input layer, a plurality of hidden layers, and an output layer), assigning to a first IP subnet, at least a part of a first hidden layer of the plurality of hidden layers, assigning to a second IP subnet, at least a part of a second hidden layer of the plurality of hidden layers, and deploying the parts of the first and second hidden layers to edge devices as containerized applications with assigned IP addresses, which may be hidden from the user and/or third party application.

Abstract: A Low Power Indoor (LPI) Access Point (AP) that punctures its channel while respecting incumbents may be provided. First, a computing device may determine a relaxation value. Then an energy detection Clear Channel Assessment (CCA) threshold may be changed by the relaxation value for a punctured subchannel. Next, the punctured subchannel may be reported as busy when energy is detected in the punctured subchannel above the changed energy detection CCA threshold.

Abstract: This disclosure describes various methods, systems, and devices related to identifying path changes of data flows in a network. An example method includes receiving, at a node, a packet including a first signature. The method further includes generating a second signature by inputting the first signature and one or more node details into a hash function. The method includes replacing the first signature with the second signature in the packet. The packet including the second value is forwarded by the node.

Abstract: A first address resolution request may be received by a first access switch from a first device and the address resolution request may be resolved by the first access switch with a central database of a network. Then a second address resolution request may be sent to a sensor by the first access switch in response to resolving the first address resolution request. An address resolution response may then be sent by the sensor to the first device in response to the sensor determining that the first device is a bad endpoint. A session may then be established between the sensor and the first device in response to the sensor sending the address resolution response. The first device may then be prompted by the sensor via the established session to resolve issues that lead the sensor to determine that the first device is a bad endpoint.

Abstract: Systems, methods, and computer-readable media for assessing reliability and trustworthiness of devices operating within a network. An ARP responder can receive an ARP request from an ARP requestor for performing address resolution between the ARP requestor and the ARP responder in a network environment. The ARP responder can build an ARP response including attestation information of the ARP responder. Further, the ARP responder can provide, to the ARP requestor, the attestation information for verifying the ARP responder using the ARP response and the attestation information of the ARP responder.

Abstract: Techniques for using more-specific routing to perform scalable Layer-2 (L2) stretching of subnets across hybrid-cloud environments. Routing tables in a public cloud may allow for routes that are more specific than the default local route, and the more-specific routes may be used to send all traffic to a dedicated, cloud router. The more-specific routes are set up for a VPC where a subnet resides such that the more specific-routes cover at least a portion of subnet range. The next hop for the more-specific routes point to the cloud router which is capable of doing host routing and segmentation extension. Thus, traffic originating from endpoints in a VPC is routed to the cloud router, and the cloud router determines whether the traffic is to be re-routed back to a destination endpoint in the VPC (or another cloud location), or sent to a destination endpoint residing in the on-premises site.

Abstract: Enhanced network level information for power control is described. The enhanced network level information enables network connected electronic devices to enter and exit standby modes based on system level information. The network level information also enables the use of a respective network connected device in a seamless manner from the perspective of the user, while decreasing the amount of energy consumed by the device when not in active operation. In some examples, a Network Monitoring Application (NMA) classifies electronic devices into power control categories, monitors a physical environment associated with the plurality of connected electronic devices, and provides a power control signal to the various electronic devices upon detection of a change in the physical environment.

Abstract: A method includes determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes within a mesh network. Based at least in part on the number of drops of the plurality of messages exceeding a threshold number of drops for a time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node. Based at least in part on the second rating being below a rating threshold, determining that the first node is a potentially malicious node. Based at least in part on a first distance to the first node being larger than a distance threshold, identifying that the first node is a malicious node. The method may further include ending communications with the first node.

Abstract: Techniques for group-based classification and policy enforcement at a network fabric edge for traffic that is being sent to external network destinations are disclosed herein. The techniques may include receiving, at a control plane of a network and from an edge node of the network, a request to provide mapping data associated with sending a packet to a destination. Based at least in part on an address prefix value associated with the destination, the control plane may determine that the destination is located in an external network. Additionally, a group identifier that is associated with the destination may be determined. In this way, an indication of the group identifier may be sent to the edge node such that the edge node may determine, based at least in part on the group identifier, a policy decision for routing the packet to the external network.

Abstract: Methods and systems enable internal and external verification of computations performed by a code signing server according to hash-based signature techniques using unique state, and further for a code signing server to expose parts of a hash-based signature log without negating the security of the one-time signature key pairs generated by the code signing server. A signing module of a code signing server receives a signing request from a client computing system. The signing module configures the code signing server to generate a one-time signature key pair based on a Merkle tree state. The signing module configures the code signing server to issue a hash-based signature to the client computing system. The code signing server is configured to record the Merkle tree state and the issued HBS in an immutably ordered log at a logging server.

Abstract: The present technology is directed to visualizing a Wi-Fi access point (AP) signal propagation pattern through multiple floors. The present technology can execute a Wi-Fi signal propagation model corresponding to a first AP on a first floor of a building plan and a second AP on a second floor of the building plan. The Wi-Fi signal propagation model calculates a Wi-Fi signal propagation pattern for a plurality of APs including the first AP and the second AP. The present technology can further present a visualization of the Wi-Fi signal propagation pattern for the plurality of APs, wherein the Wi-Fi signal propagation pattern for the first AP on the first floor of the building plan projects onto the second floor of the building plan.