Abstract: During operation, a layer-3 (L3) router can receive a trace query to trace multicast paths associated with a multicast group. In response to detecting a layer-2 (L2) switch coupled to the L3 router, the L3 router can construct a request packet and send the request packet to the coupled L2 switch. The request packet comprises a first data block indicating that the request packet is an L2 multicast trace request, thereby causing the L2 switch to propagate the request packet to downstream L2 switches until the request packet reaches a last-hop L2 switch. The L3 router can receive, from the last-hop L2 switch, a reply packet responsive to the L2 multicast trace request, the reply packet comprising one or more data blocks, with each data block comprising information about an L2 switch or client device present on a traversed multicast path for the multicast group.

Abstract: A system and a method of preventing generation of duplicate network routes in a Software Defined Wide Area Network (SD-WAN) are described. A network route management service receives network route information from a network device connected to a subnetwork present in the SD-WAN. The network route information is compared with a master network route information for identifying presence of one or more duplicate network routes in the network route information. Upon identification, the duplicate network routes are removed from the network route information, and the network route information excluding the one or more duplicate network routes is transmitted to the network device.

Abstract: In an example implementation consistent with the features disclosed herein, publisher-subscriber message mapping is performed. A message is received from a publisher, with the message including a first topic. The first topic includes a gateway identifier of a gateway for the publisher. The gateway identifier is then mapped to a user identifier. The first topic of the message is modified to a second topic by replacing the gateway identifier with the user identifier. The message is then sent to a subscriber that is subscribed to the second topic.

Abstract: Systems and methods for providing remote network security using a network embeddings model are provided. A method consistent with the present disclosure includes retrieving a corpus of network activity data associated with a first network. The network activity data may be generated from users within the first network submitting network requests for network assets to service the network requests. The method also includes creating a crafted encoded corpus by selecting a subset of the corpus of network activity data and creating a network embeddings model based on the crafted encoded corpus. Lastly, the method includes generating an alert in an event that the network security system identifies an anomaly associated with the crafted encoded corpus of network activity data.

Abstract: Example implementations relate to a role-based autoscaling approach for scaling of nodes of a stateful application in a large scale virtual data processing (LSVDP) environment. Information is received regarding a role performed by the nodes of a virtual cluster of an LSVDP environment on which a stateful application is or will be deployed. Role-based autoscaling policies are maintained defining conditions under which the roles are to be scaled. A policy for a first role upon which a second role is dependent specifies a condition for scaling out the first role by a first step and a second step by which the second role is to be scaled out in tandem. When load information for the first role meets the condition, nodes in the virtual cluster that perform the first role are increased by the first step and nodes that perform the second role are increased by the second step.

Abstract: A network infrastructure management console configures one or more network switch stacks each comprising a plurality of switches. A monitoring component monitors a current conductor switch of the stack. A user interface (UI) backend component comprises a cache memory and receives a user request to configure the stack. The UI backend component receives from the monitoring component notification of the current conductor and stores in a cache memory segment associated with the current conductor the requested configuration changes. If the current conductor switch of the stack has changed due to a failover event, the configuration changes stored in the cache memory segment associated with the previous current conductor are written to a cache memory segment associated with the new current conductor. A configuration push component receives the configuration changes and transmits the configuration changes to the network switch stack.

Abstract: Systems are methods are provided for implementing an intelligent optical transceiver. The intelligent optical transceiver implements dynamic health monitoring and “time to fail” prediction functions to predict a failure of a component before it malfunctions during use. By employing the intelligent optical transceiver, a network can prevent failures in its optical connectivity that can degrade the network performance, such as experiencing outages and data unavailability. For example, the intelligent optical transceiver includes a module health monitor, which monitors, in real-time, health parameters of optical communication components in the intelligent optical transceiver. Also, the intelligent optical transceiver includes a time to fail predictor which predicts a time to fail for the optical communication components of the optical transceiver based on a result of a defined regression function.

Abstract: A system for policy management in a switch is provided. During operation, the system can generate, from a first policy defined for the switch, a second policy. The first policy can indicate whether a type of traffic is allowed from a source role to a destination role via an overlay tunnel. The second policy can indicate a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel. Upon identifying a host associated with a role at a port of the switch, the system can determine whether the role belongs to the plurality of destination roles based on the second policy. If the role belongs to the plurality of allowed destination roles, the system can allow the port to forward a multi-destination packet, which is received via the overlay tunnel and associated with the type of traffic.

Abstract: Examples described herein relate to a security management system to secure a container ecosystem. In some examples, the security management system may protect one or more entities such as container management applications, container images, containers, and/or executable applications within the containers. The security management system may make use of digital cryptography to generate digital signatures corresponding to one or more of these entities and verify them during the execution so that any compromised entities can be blocked from execution and the container ecosystem may be safeguarded from any malicious network attacks.

Abstract: Examples described herein relate to a management node and a method for managing deployment of a workload. The management node may obtain values of resource labels related to platform characteristics of a plurality of worker nodes. Further, the management node may determine values of one or more custom resource labels for each of the plurality of worker nodes, wherein a value of each custom resource label of the one or more custom resource labels is determined based on values of a respective set of resource labels of the resource labels. Furthermore, the management node may receive a workload deployment request including a workload description of a workload. Moreover, the management node may deploy the workload on a worker node of the plurality of worker nodes based on the workload description and the values of the one or more custom resource labels.

Abstract: Power-over-Ethernet (PoE) powered devices (PD) may be coupled to a PoE power sourcing equipment (PSE). The PDs may send to the PSE a link-layer protocol communication that comprises an alternative-power field indicating whether the sending PD has an alternative power source (e.g., a battery, a local power supply). The PSE may listen for and receive the communications and read the alternative-power fields thereof. The PSE may set respective power priorities for the PDs based at least in part on whether the PDs have respective alternative power sources, as indicated by the respective alternative-power fields of their communications. The PSE may reduce the power priority of those PDs that have alternative power sources, relative to the priority the PD would otherwise have been given.

Abstract: Example implementations relate to optimizing operation of microservice clusters comprising multiple nodes, each executing a common self-sufficient microservice instance. The method includes, at a first node having a database instance comprising a plurality of rows and a plurality of columns, calculating a distinct hash per row to create a hash list, each hash identifying data contained in the respective row; publishing a distinct hash and/or the hash list to one or more of the plurality of nodes, each node having respective database instances and respective hash lists; at a second node, comparing the distinct hash and/the hash list published by the first node to the hash list of the second node to identify any missing rows of data; and, in response to identifying, based on the comparison, a missing row(s) in the second node's database instance, updating the second node's database instance to include the missing row(s) of data.

Abstract: A system determines a first set of policies, wherein at least one policy entry for a destination role comprises a source role, a traffic attribute, and an action to be taken for the packet. The system represents the policies as a matrix, wherein a first entry in the matrix indicates the source and destination role, the traffic attribute, and the action of the at least one policy entry. The system replaces, in the first entry, the action with the destination role if the action indicates to allow the packet, and with a null value if the action indicates to deny the packet, to obtain a first data structure with entries indicating, for a respective source role, traffic attributes and corresponding sets of allowed destination roles. The system resolves an overlapping pair comprising a first and a second traffic attribute to obtain a second set of synthesized policies.

Abstract: Examples described herein provide wake-up of a network device. Examples include receiving, by a network interface of a first network device having a first Media Access Control (MAC) address, a request to wake-up a second network device having a second MAC address that is assigned to a same subnet as the first MAC address, and in response to the request, generating, by the first network device, a first wake-up frame having a destination address of the second MAC address and configured to cause the second network device to transition from operating in the first power mode to operating in the second power mode. Examples include transmitting, by the network interface of the first network device, the first wake-up frame to the second MAC address of the second network device.

Abstract: A system comprising processing circuitry a memory storing instructions that cause the system to detect a code change to source code included in a code repository, identify a relationship between the code change and an associated product feature, determine one or more dependent product features impacted by the code change, select a set of test cases including a subset of test cases related to the associated product feature and a subset of test cases related to the one or more dependent product features, execute the set of test cases, and update the code-to-feature mapping using results of executing the set of test case.

Abstract: The disclosure generally provides for a method of solving a K-SAT problem. The method comprises programming one or more clauses of a Boolean expression for a K-SAT problem written in negated disjunctive normal form (DNF) to a ternary-CAM (TCAM) array comprising columns and rows of TCAM cells. The method further includes applying an interpretation comprising one or more binary variables expected to solve the Boolean expression as an input along the columns to the TCAM array, returning a binary value for each clause, randomly selecting one matched match line, determining a selected clause from one or more violated clause, and altering one or more literals within the interpretation using a break count for each variable of the selected clause.

Abstract: Example implementations relate a system and method for storing configuration files of a host computing device in a secure storage of a Baseboard Management Controller (BMC). The secure storage includes configuration files associated with the host computing device. The BMC is communicatively connected to the host computing device using a communication link. The secure storage is emulated as a storage device to the host computing device. The BMC monitors the secure storage to detect changes in the configuration files. When there is a change in a configuration file, the BMC performs a security action in the host computing device.

Abstract: Secured data access in virtual data processing is described. An example includes instructions to receive a request from an application in a compute node of a compute cluster in a virtual data processing environment to access a secured data source for a user, the virtual data processing environment including a multiple secured data sources that are accessible by compute nodes of the virtual compute cluster; fetch a credential in a current application context and forward the credential for validation; validate the credential with a credential authority; and, upon successfully validating the credential, authenticate the user at the secured data source and establish a connection with the secured data source.