Abstract: A device may include one or more processors to identify a first bandwidth of a first link and a second bandwidth of a second link that include a first plurality of interfaces and a second plurality of interfaces, respectively. The one or more processors may store a first and a second link bandwidth extended community value identifying the first bandwidth and the second bandwidth, respectively. The one or more processors may determine that the first bandwidth has increased or decreased. The one or more processors may store a modified first link bandwidth extended community value identifying the first bandwidth as increased or decreased. The one or more processors may perform load balancing of network traffic on the first link and the second link based on the modified first link bandwidth extended community value and the second link bandwidth extended community value.

Abstract: In an example of this disclosure, a method may include receiving, by a first network device, a plurality of heartbeat response messages from one or more network devices of a plurality of network devices. Each heartbeat response message of the plurality of heartbeat response messages may respectively correspond to one network device of the plurality of network devices. The method may include processing, by the first network device, the plurality of heartbeat response messages in a kernel space of the first network device. The method may include updating, by the first network device in the kernel space, one or more values corresponding to a data structure based on processing the plurality of heartbeat response messages in the kernel space. The method may include processing, by the first network device, the one or more values in a user space of the first network device.

Abstract: The disclosed apparatus may include an encryption device that signs information exchanged between network devices to ensure the integrity of the information. The disclosed apparatus may also include a network device communicatively coupled to the encryption device, wherein the network device (1) obtains geo-location information that identifies the location of the network device, (2) directs the encryption device to sign the geo-location information to ensure the integrity of the geo-location information, (3) provides the signed geo-location information to a remote management system that manages the configuration of the network device based at least in part on the geo-location information, and (4) receives a configuration profile that modifies the configuration of the network device to account for the current location of the network device from the remote management system. Various other apparatuses, systems, and methods are also disclosed.

Abstract: In some embodiments, an apparatus comprises an optical transponder which includes a processor, an electrical interface and an optical interface. The processor is operatively coupled to the electrical interface and the optical interface. The optical interface is configured to be operatively coupled to a plurality of optical links and the electrical interface is configured to be operatively coupled to a router such that the optical transponder is configured to be operatively coupled between the plurality of optical links and the router. The processor is configured to perform pre-forward error correction (FEC) bit error rate (BER) detection to identify a degradation of an optical link from the plurality of optical links. The processor is configured to make modifications to packets designated to be transmitted via the optical link in response to the degradation being identified such that the router is notified of the degradation of the optical link.

Abstract: In some examples, a method includes selecting, by a first virtual routing node of a single-chassis network device having a plurality of forwarding components and a plurality of fabric links coupling respective pairs of the plurality of forwarding components at respective fabric interfaces of the plurality of forwarding components, a fabric interface of a forwarding component having an egress interface toward a network destination and that is associated with the first virtual routing node; advertising, to the second virtual routing node, the fabric interface as a next hop for the network destination; storing, by the second virtual routing node to a context data structure of the second virtual node, the fabric interface as a next hop for the network destination; selecting the fabric interface from among a plurality of fabric interfaces as a next hop for the network destination; and forwarding network traffic destined for the network destination to the selected fabric interface.

Abstract: A device receives a new rule construct that includes a source address or a destination address, and at least one parameter, where the new rule construct includes a new rule to be provided to a network. The device identifies network devices, of the network, to which the new rule is to be provided based on the new rule construct, and determines a proper position for the new rule, in a list of existing rules provided in each network device, based on the new rule construct and information associated with the network devices. The device causes the new rule to be provided to and stored in the network devices, at the proper position, in the list of existing rules, determined for each network device.

Abstract: A device may include one or more processors to detect an issue in a universal customer premises equipment (uCPE) platform; select a traffic flow to migrate from the uCPE platform to a virtual customer premises equipment (vCPE) platform, the traffic flow may be selected based on a characteristic of the traffic flow; determine a traffic path of the traffic flow through the vCPE platform; select a point of presence (PoP) of the vCPE platform to host a virtual network function (VNF) associated with the traffic flow based on the PoP being situated along the traffic path; and perform an action associated with the PoP or the traffic flow to resolve the issue.

Abstract: A first processing device may receive, from a first network device, a tunneling protocol message associated with a tunnel to be established between the first network device and a second network device. The first processing device may determine, based on the tunneling protocol message, a device identifier of the second network device. The first processing device may determine that a second processing device is to process a flow associated with the first network device and the second network device based on the device identifier of the second network device. The first processing device may provide information that identifies that the second processing device is to process the flow to permit the second processing device to process the flow associated with the first network device and the second network device.

Abstract: A device may receive a trigger to determine whether a malicious file is operating on a client device. The device may determine a network activity profile associated with the malicious file based on receiving the trigger to determine whether the malicious file is operating on the client device. The network activity profile may include information regarding network activity associated with the malicious file when the malicious file is executed in a testing environment. The device may monitor network activity associated with the client device. The device may determine that the network activity associated with the client device matches the network activity profile associated with the malicious file based on monitoring the network activity associated with the client device. The device may provide information indicating that the network activity associated with the client device matches the network activity profile associated with the malicious file.

Abstract: An apparatus includes a first communication interface configured to be communicatively coupled, via an optical line, to a network device that is disposed in an optical network using wavelength division multiplexing (WDM). The apparatus also includes a second communication interface configured to be communicatively coupled to a router via an Ethernet connection. The apparatus also includes a signal generator operatively coupled to the first communication interface and the second communication interface. The signal generator is configured to generate an Ethernet signal representing at least one attribute of the optical line between the first communication interface and the network device. The second communication interface is configured to transmit the Ethernet signal to the router.

Abstract: Techniques are described for detecting egress network devices of a point-to-multipoint (P2MP) label switched path (LSP). For example, a network device may include one or more processors configured to identify a P2MP LSP for receiving multicast traffic from a multicast source for a specific multicast group for which the network device has an interested receiver, wherein the network device is to be an egress network device of the P2MP LSP; and send, to an ingress network device of the P2MP LSP, a P2MP egress identification message to add the network device as an egress network device of the P2MP LSP, wherein the one or more processors are further configured to output the P2MP egress identification message into a multipoint-to-point (MP2P) ring LSP for which the ingress network device of the P2MP LSP is a sole egress network device of the MP2P ring LSP.

Abstract: In some examples, an electronic device includes a printed circuit board (PCB) device that includes a first trace electrically connected to a first pad of a first trace via on a first layer and a second trace electrically connected to a second pad of a second trace via on a second layer. In some examples, the PCB device also includes four ground pads on the first layer and an antipad surrounding the two trace vias, where a first ground pad is positioned between the first trace and the second trace, where the first ground pad and the second ground pad are approximately symmetrically positioned about a perpendicular bisector of a line from the first pad to the second pad, and wherein the third ground pad and the fourth ground pad are approximately symmetrically positioned about the perpendicular bisector of the line from the first pad to the second pad.

Abstract: Techniques are described for establishing lower priority LSPs on paths determined to be less likely to include bandwidth constrained links. In one example, a router includes a plurality of physical interfaces each having at least one link interconnecting the router as one of a plurality of routers in a network and a processor. The processor is configured to determine whether a link of one of the plurality of physical interfaces is congested based at least in part on an amount of available bandwidth on the link, and, responsive to determining that the link is congested, set a bandwidth subscription for the link, wherein the bandwidth subscription specifies that the amount of available bandwidth on the link for label switched paths having a lower priority is less than the amount of available bandwidth on the link for label switched paths having a higher priority.

Abstract: Techniques are described for optimizing the placement of automatically generated rules within security policies. An administrator may, for example, interact with the graphical representation of rules rendered by the threat control module and, responsive to the interaction, the system may determine an optimal placement for the created rule in the list of rules for the identified security device based on either the existence of anomalies or threat IP data and/or advanced security parameters. In this way, the system allows administrators to configure rules with the most optimal sequence to detect threats.

Abstract: A system may determine to perform an internal and an external malware detection operation to detect a malware infection associated with a client device. The system may perform the internal operation by modifying an environment, executing on a particular device, to form a modified environment. The system may perform the external operation by performing a communication from the particular device. The system may monitor the modified environment for a first behavior indicative of the malware infection, and may monitor a result of performing the communication for a second behavior indicative of the malware infection. The system may detect that the first or second behavior has occurred. The system may provide a notification that the client device is infected with malware based on detecting that the first or second behavior has occurred. The notification may cause one or more network devices to block network traffic to or from the client device.

Abstract: Techniques are described for forwarding traffic within an Ethernet Virtual Private Network (EVPN) fabric of port-extenders by modeling a port-extender as a port-extender Ethernet segment. For example, a method includes receiving, by a provider edge (PE) device of a plurality of PE devices configured with an EVPN instance reachable by a port-extender Ethernet segment connecting the plurality of PE devices to a port-extender device, an EVPN route including information identifying an extended-port of the port-extender device associated with the port-extender Ethernet segment; storing, by the PE device, the information identifying the extended-port of the port-extender device associated with the port-extender Ethernet segment; and generating, by the PE device, a packet header of a data packet to be forwarded toward the extended-port of the port-extender device, the packet header including the information identifying the extended-port of the port-extender device.

Abstract: An example device includes an interface to receive, from a device management system, a request message that conforms to a network management protocol, a control unit that provides an execution environment for a management agent, and a data repository. The request message includes a set of managed object identifiers and a set of filter operator object identifiers. The management agent is operable to generate at least one filter criterion based on the managed object identifiers and the filter operator object identifiers, to retrieve managed object values stored in the data repository based on the managed object identifiers, each corresponding to a respective managed object identifier specified in the request message, to generate and output to the device management system a response based on the managed object identifiers of the request message and the retrieved managed object values that satisfy one or more of the at least one filter criterion.

Abstract: An apparatus includes a finite impulse response (FIR) filter to receive a digital signal and a transmitter, operatively coupled to the FIR filter, to transmit an analog signal, converted from the digital signal, to a communication channel. The FIR filer is configured to change at least one operating parameter based on a bandwidth of the analog signal after transmission in the communication channel. The bandwidth of the analog signal is estimated, using an estimator, based at least in part on raw sampling data generated by an analog-to-digital converter (ADC) operatively coupled to the transmitter.

Abstract: In some examples, a method includes selecting, by a first virtual routing node of a single-chassis network device having a plurality of forwarding components and a plurality of fabric links coupling respective pairs of the plurality of forwarding components at respective fabric interfaces of the plurality of forwarding components, a fabric interface of a forwarding component of the plurality of forwarding components that has an egress interface toward a network destination and that is associated with the first virtual routing node; in response to receiving a message specifying the fabric interface, storing, by the second virtual routing node to a context forwarding table of the second virtual node, the fabric interface as a next hop for the network destination; selecting, by the second virtual routing node and based on the context forwarding table and a context next hop in a first forwarding table pointing to the context forwarding table, the fabric interface for forwarding network packets destined for the ne