Abstract: Techniques for synchronizing a network device to selectively operate according to a selectable operation policy. A system utilizing such techniques can a self-configuring network device operation coordination system and a self-configuring network device operation management system. A method utilizing such techniques can include synchronizing a network device to selectively operate according to a first operation policy and a second operation policy in providing network service access.

Abstract: Disclosed is a system comprising: an authentication datastore; a device presence engine; a traffic monitor engine; an authentication presence monitor engine; an authentication server selection engine; and a traffic routing engine. In operation: the device presence engine is configured to detect presence of a user device on a trusted network; the traffic monitor engine is configured to monitor, in response to the detection, traffic on the trusted network from the device; the authentication presence monitor engine is configured to evaluate onboarding characteristics of the user device in response to the monitoring; the authentication server selection engine is configured to select one of a plurality of authentication servers to authenticate the user device to the trusted network, the selecting based on the onboarding characteristics; and the traffic routing engine is configured to route traffic from the user device to the selected authentication server.

Abstract: Aspects of the present disclosure provide a suitable architecture for a router controller which configures forwarding rules in a packet router of a network visibility system. In an embodiment, the router controller contains multiple controller blocks, with each controller block to examine a corresponding set of packets and to generate a respective set of forwarding rules for configuring the packet router. The router controller may also contain a switch to receive multiple packets and to forward to each controller block the corresponding set of packets. Each controller block may forward the respective set of forwarding rules to the switch, with the switch in turn configuring the packet router with the respective set of forwarding rules.

Abstract: A technique for deploying proximity beacons involves coupling proximity beacon transmitters and/or hubs to an enterprise network device. The coupling can be by way of physically connecting communication interfaces of the network device and the proximity beacon transmitter or hub. In some implementations, the communication interface can be implemented as a USB interface. In some implementations, the communication interface can be embedded within the network device, such that the communication interface can provide the physical connection in the form of an embedded or internal connection.

Abstract: The present invention provides method and systems for dynamically mirroring network traffic. The mirroring of network traffic may comprise data that may be considered of particular interest. The network traffic may be mirrored by a mirror service portal from a mirror sender, referred to as a mirror source, to a mirror receiver, referred to as a mirror destination, locally or remotely over various network segments, such as private and public networks and the Internet. The network traffic may be mirrored to locations not involved in the network communications being mirrored. The present invention provides various techniques for dynamically mirroring data contained in the network traffic from a mirror source to a mirror destination.

Abstract: Techniques for performing near-uniform load balancing in a visibility network based on usage prediction are provided. According to one embodiment, a packet broker of the visibility network can receive a control packet replicated from a core network, where the control packet includes a user or device identifier and a request to create a user session for a user identified by the user/device identifier. The packet broker can further determine, based on the user/device identifier and one or more other parameters, a rank value for the user session, where the rank value indicates an amount of network traffic that the user is likely to generate in the core network during the user session. The packet broker can then select an egress port for the user session based on the rank value and forward subsequent control and data traffic for the user session through the selected egress port.

Abstract: Wireless access points detect neighboring wireless access points in different subnets. Upon connecting with a wireless client, a wireless access point determines predictive roaming information for the wireless client. Predictive roaming information identifies the wireless client; its home network subnet; and includes connection information associated with the wireless client. The wireless access point forwards the predictive roaming information associated with a wireless client to neighboring wireless access points while the wireless client is still connected with the wireless access point. Neighboring wireless access points store received predictive roaming information. Upon connecting with a wireless client, a neighboring wireless access point determines if the wireless client matches the stored predictive roaming information.

Abstract: Systems, methods, and apparatuses are disclosed herein for providing an Individual Service Instance identifier (“I-SID”) translation service for accessing services on different networks. Packets designated for specific services via an I-SID Tag may be received at an edge network device and a lookup may be performed to locate the service on another network via the I-SID corresponding to the service, the I-SID being mapped at another network. The I-SID may be updated with the newly-located I-SID in order for the packet to reach an appropriate service on the other network.

Abstract: Techniques for implementing traffic deduplication in a visibility network are provided. According to one embodiment, a packet broker of the visibility network can receive a control or data packet replicated from a core network. The packet broker can then apply a first stage deduplication process in which the packet broker attempts to deduplicate the control or data packet based on one or more interfaces of the core network from which the control or data packet originated, and apply a second stage deduplication process in which the packet broker attempts to deduplicate the control or data packet based on the content (e.g., payload) of the control or data packet.

Abstract: A plug-in network device is disclosed. The plug-in network device can be used in association with a network management system and an infrastructure network device. The plug-in network device includes two antenna arrays, one of which is up-facing and one of which is front-facing. The plug-in network device can achieve wireless communication with the infrastructure network device via the up-facing antenna array and provide network services to wireless stations through the front-facing antenna array. The network management system can manage both the infrastructure network device and the plug-in network device.

Abstract: Authenticating a client device coupled to an authenticator network device for a network. A service request is received from the client device at the authenticator network device. User credentials, including a user ID, a user key, and a nonce for a user are received at the authenticator network device. A token is generated using the received user credentials. The service request is modified to include the token and a user ID parameter that is the user ID to generate a modified service request. The modified service request is used to provide single sign-on access to a service that is the subject of the service request.

Abstract: A security event that is associated with one or more communication devices is detected. For example, the security event may be an unexpected change in data being sent from a communication device outside an enterprise. In response to detecting the security event, a Virtual Service Network (VSN) is created that isolates one or more communication devices that may pose a security risk. A corrective action to mitigate the security event is then implemented. For example, the corrective action may be to dynamically instantiate a firewall on the VSN that blocks the transfer of data from the communication device outside the enterprise. This allows an administrator to review the security event and take further action if necessary. Because the VSN with the firewall is created dynamically, the network remains secure while the security event is investigated.

Abstract: Methods and apparatus are described for implementing service discovery protocols on subnetted zero configuration networks. A process for managing service advertisement across a plurality of subnets may comprise: collecting service advertisements on a local network level by designated network devices; sending listings of services from each of the designated devices to a master network device; sending a table of services for the plurality of subnets from the master device to all of the designated devices on the plurality of subnets; creating by each of the designated network devices for the corresponding subnet a service discovery proxy table listing the service advertisements on the subnets of the plurality of subnets beyond the subnet corresponding to the designated device; and periodically transmitting by each of the designated devices on the corresponding subnets service advertisements for the services of the corresponding service discovery proxy table.

Abstract: Techniques and systems for performing a network activity within a network. The technique includes assigning one or a plurality of network devices subnets with network devices for performing network activities. Network devices within the assigned network device subnets can be assigned to act as a primary network device and a backup network device. The primary network device can perform the network activity. The backup network devices can monitor the primary network device and continue performing the network activities if the primary network device fails or is rogue.

Abstract: A method and apparatus for automated mirroring is presented. A network device running as a Fabric Attach (FA) server configured to mirror traffic to a Remote Switch Port Analyzer (RSPAN) Virtual Local Area Network (VLAN), issues an FA Type Length Value (TLV) on its uplink to the FA server. The TLV includes a request to associate said RSPAN VLAN with a Service Identifier (I-SID) used to carry mirror traffic in a network. The network device sends the mirrored traffic on the RSPAN VLAN on its uplink to the FA server. The network device signals the I-SID into the network, and detects receive interest in the I-SID. The network device delivers the mirrored traffic to devices that expressed a receive interest in the mirrored traffic.

Abstract: A method and system for selecting a route in a wireless network for the transmission of a data packet between wireless nodes in the network using a modified link-state routing algorithm. A subset of nodes called portal nodes within the network are elected to do the broadcasting for the entire network. A wireless node identifies a unicast route back to its root portal node, and sends a link-state register message to this portal node. These link-state register messages received by each portal node are aggregated by them and are broadcast to each of the wireless nodes for storage. When a data packet is thereafter received by a wireless node from a neighboring node, it detects if the data packet satisfies one of a plurality of predetermined conditions and rebroadcasts the data packet to neighboring wireless nodes if none of the conditions is satisfied.

Abstract: Implementing auto attach for a shortest path bridging (SPB) network comprises determining, on an access point, that an auto attach device communicating in a SPB network is enabled for auto attach, and an advertisement is transmitted to a mobile station. The access point acts a proxy between the mobile station and the auto-attach device by communicably coupling the auto attach device and the mobile station via the access point. A virtual local area network (VLAN) identification and service instance identifier (I-SID) is received from the mobile station, when is then transmitted to the auto-attach device. A VLAN (independent of any static VLAN associated with the WLAN) is created off of the VLAN identification and an indication that the I-SID and the VLAN have been accepted. Data communications are then provided between the mobile station and the auto attach device via the VLAN and the access point.

Abstract: A technique for improving wireless communication characteristics involving matching transmitter antenna patterns to receiver antenna patterns. In a specific implementation, the transmitter antenna pattern adapts to changing parameters, such as when a smartphone is initially held in a first orientation and is later held in a second orientation. Because the transmitter antenna pattern matches receiver antenna patterns, signal quality between stations improves. In some implementations, antennas are organized and mounted to maximize spatial diversity to cause peak gains in different directions.

Abstract: Systems and methods for steering clients based on network service access characteristics. Systems can include a network service access characteristics specific network device client steering system and a network service access characteristics specific radio client steering system. Methods can include steering clients to network devices in accessing network services based on network service access characteristics and steering clients to radios in accessing network services based on network service access characteristics.

Abstract: Techniques for exchanging control and configuration information in a network visibility system are provided. In one embodiment, a control plane component of the network visibility system can receive one or more first messages from a data plane component of the network visibility system, where the one or more first messages define one or more forwarding resources available on the data plane component. The control plane component can further retrieve configuration information stored on the control plane component that comprises one or more network prefixes to be monitored by the network visibility system, and can determine one or more mappings between the network prefixes and the forwarding resources. Upon determining the one or more mappings, the control plane component can generate one or more packet forwarding rules based on the mappings.