Abstract: An example controller device that manages a plurality of network devices includes one or more processors implemented in circuitry and configured to: determine that configuration of one or more network devices of the plurality of network devices is to be updated; determine dependencies between types of resources provided by the network devices; construct a directed acyclic graph (DAG) representing the dependencies, the DAG having nodes representing the corresponding types of resources of the network devices of the plurality of network devices; sort the nodes of the DAG according to a grouped topological sort into a plurality of hierarchical levels according to the dependencies; and submit queries for two or more resources of the network devices at a common level of the plurality of hierarchical levels in parallel to determine resources of the determined types of resources of the two or more resources to configure the two or more network devices.

Abstract: A network device may forward fragments of an IPv4 network packet encapsulated in IPv6 network packets from an IPv6 network to an IPv4 network without reassembling the IPv4 network packet. The network device may receive and buffer the one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the source port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the source port of the IPv4 network packet, the network device may dispatch each fragment of the fragment flow that it has received to the IPv4 network.

Abstract: Techniques are described in which a centralized controller constructs a service chain between a bare metal server (BMS) and a virtual execution element (e.g., virtual machine or container), or in some instances a remote BMS, across a plurality of networks. In some examples, the controller may construct a service chain between a BMS and a virtual execution element or remote BMS using Ethernet Virtual Private Network (EVPN)-Virtual Extensible Local Area Network (VXLAN) and Internet Protocol Virtual Private Networks (IP VPNs) such as BGP/Multiprotocol Label Switching (BGP/MPLS) IP VPNs.

Abstract: In some implementations, a first network device may receive an advertisement from a second network device. The advertisement may be associated with indicating that the second network device is configured to support a particular flex-algorithm. The first network device may identify, in the advertisement, an address of the second network device. The first network device may configure a routing table of the first network device to indicate that the second network device is capable of receiving traffic associated with the particular flex-algorithm based on the address. The first network device may perform, using the routing table, an action associated with routing the traffic associated with the particular flex-algorithm.

Abstract: A controller device includes a memory and one or more processors coupled to the memory. The memory stores instructions that, when executed, cause the one or more processors to receive, from a set of sensor devices, first telemetry data indicating a first set of changes for telemetry parameters that occur during a first time range. The instructions further cause the one or more processors to determine, using the first snapshot and the first telemetry data, a second snapshot that specifies a first complete state at an end of the first time range. The instructions further cause the one or more processors to determine a second complete state of the telemetry parameters for the second time range based on the second snapshot and second telemetry data indicating a second set of changes for the set of telemetry parameters that occur during a second time range.

Abstract: A load balancing component may obtain, from a plurality of packet forwarding components of the network device, indications of load balancing metrics associated with a plurality of communication links that the plurality of packet forwarding components use to forward packet data. The load balancing component may determine, based on the load balancing metrics, aggregate load balancing metrics associated with respective communication links of the plurality of communication links. The load balancing component may identify an imbalance in load balancing metrics. The load balancing component may determine, based on the imbalance, a load balancing schedule that indicates traffic distributions for the plurality of packet forwarding components. The load balancing component may provide indications of the traffic distributions to the plurality of packet forwarding components to permit the plurality of packet forwarding components to forward packet data based on the indications of the traffic distributions.

Abstract: A mounting bracket for mounting an electronic device to the T-bar of a drop ceiling provides for self-locking snap-action securing of the mounting bracket to a flange of the T-bar, suspending the mounting bracket from the T-bar. The mounting bracket also provides for self-locking snap-action attachment of the mounted device to the bracket, suspending the device from the suspended mounting bracket. A split adapter allows vertical offsetting of the device from the ceiling, reducing vertical displacement of ceiling tiles resting on the T-bar. The split adapter has two halves the are laterally slid on to the T-bar flange and are then longitudinally slid together to be joined against lateral separation. The composite adapter thus formed presents an adapter flange to which the mounting bracket snap-secures, the mounting bracket locking the adapter halves against longitudinal separation.

Abstract: In some embodiments, an apparatus includes a spectral scanning controller configured to interrupt service at a wireless access point (WAP) such that the WAP performs spectral scanning during service interruption. The spectral scanning controller is configured to interrupt service at the WAP at a first scanning frequency when the spectral scanning controller is in a first configuration. The spectral scanning controller is configured to interrupt service at the WAP at a second scanning frequency different from the first scanning frequency when the spectral scanning controller is in a second configuration. The spectral scanning controller is configured to move from the first configuration to the second configuration in response to a change in at least one of a service demand, a service quality, a spectral scanning demand or a spectral scanning quality.

Abstract: A first network device may communicate, in association with a tunnel establishment network protocol, with a second network device to cause a network tunnel between the first network device and the second network device to be established. The first network device may determine, based on communicating with the second network device to cause the network tunnel to be established, that the network tunnel is to support network micro-tunnel functionality within the network tunnel. The first network device may communicate, based on determining that the network tunnel is to support network micro-tunnel functionality, with the second network device to identify a traffic class, of one or more traffic classes, to which network micro-tunnel functionality within the network tunnel is to be applied. The first network device may cause a network micro-tunnel to be established within the network tunnel for traffic associated with the traffic class.

Abstract: A network device may receive a message. The network device may determine that the message includes return information indicating a path to an initial device that generated the message. The network device may modify the message by adding an upstream device identifier, wherein the upstream device identifier identifies a device from which the message is received. The network device may modify the message by adding an indication of whether the initial device is reachable by the network device using a segment identifier. The network device may provide the modified message to a downstream device.

Abstract: An example data center system includes server devices hosting data of a first tenant and a second tenant of the data center, network devices of an interconnected topology coupling the server devices including respective service virtual routing and forwarding (VRF) tables, and one or more service devices that communicatively couple the network devices, wherein the service devices include respective service VRF tables for the first set of server devices and the second set of server devices, and wherein the service devices apply services to network traffic flowing between the first set of server devices and the second set of server devices using the first service VRF table and the second service VRF table.

Abstract: In general, the disclosure describes techniques for adaptively determining one or more parameters of a service level agreement of an application. For instance, a network device may monitor round-trip times of a plurality of packets of a data flow of an application being transmitted over a link between an application server and a client device. The network device may determine an amount of retransmission of packets occurring during transmission of the plurality of packets of the data flow. The network device may predict, based at least in part on the round-trip times of the plurality of packets of the data flow and the amount of retransmission of packets occurring during transmission of the plurality of packets of the data flow, a round-trip time parameter for a service level agreement associated with the application.

Abstract: Techniques are described for creating isolated pools of external, failover, and/or floating IP addresses. In one example, this disclosure describes a method including creating a plurality of virtual networks, creating a plurality of pools of external IP addresses, detecting a request to instantiate an object that identifies a specific pool from the plurality of pools of external IP addresses; and instantiating the object and configuring the object with an external IP address drawn from the specific pool. The pools of external IP addresses may be created and isolated on a per-namespace, per-service, or per-ingress basis.

Abstract: A script analysis platform may obtain a script associated with content wherein the script includes one or more functions that include one or more expressions. The script analysis platform may parse the script to generate a data structure and may traverse the data structure to determine the one or more functions and to determine properties of the one or more expressions, wherein traversing the data structure includes evaluating one or more constant sub-expressions of the one or more expressions. The script analysis platform may analyze the properties of the one or more expressions to determine whether the script exhibits malicious behavior. The script analysis platform may cause an action to be performed concerning the script or the content based on determining whether the script exhibits malicious behavior.

Abstract: A network device may receive topology data identifying a spine and leaf topology of network devices, and may set link metrics to a common value to generate modified topology data. The network device may remove data identifying connections from leaf network devices to any devices outside the topology from the modified topology data to generate further modified topology data, and may process the further modified topology data, with a model, to determine path data identifying paths to destinations. The network device may determine particular path data identifying shorter paths and longer paths to corresponding destinations, and may determine hop counts associated with the paths. The network device may determine whether the hop counts are all odd values, all even values, or odd and even values, and may perform actions based on whether the hop counts are all odd values, all even values, or odd and even values.

Abstract: A network monitoring device may receive flow-tap information that identifies a traffic flow characteristic and a signed URL associated with a signed URL platform from a mediation device. The network device may map the traffic flow characteristic to the signed URL in an entry of a flow-tap filter that is maintained within a data structure of the network device. The network device may analyze, using the flow-tap filter, network traffic of the network to detect a traffic flow that is associated with the traffic flow characteristic. The network device may generate, based on detecting the traffic flow in the network traffic, a traffic flow copy that is associated with the traffic flow. The network device may provide, based on the signed URL, the traffic flow copy to the signed URL platform, wherein the traffic flow copy is to be accessible to an authorized user device via the signed URL.

Abstract: In some embodiments, an apparatus includes a flow control module configured to receive a first data packet from an output queue of a stage of a multi-stage switch at a first rate when an available capacity of the output queue crosses a first threshold. The flow control module is configured to receive a second data packet from the output queue of the stage of the multi-stage switch at a second rate when the available capacity of the output queue crosses a second threshold. The flow control module configured to send a flow control signal to an edge device of the multi-stage switch from which the first data packet or the second data packet entered the multi-stage switch.

Abstract: A network device receives an attribute identifying paths associated with an open shortest path first (OSPF) domain of a network and an intermediate system to intermediate system (ISIS) domain of the network, and provides the attribute to other network devices of the network. The network device receives traffic destined for one of the other network devices of the network, and determines that a primary path is unavailable for routing the traffic to the one of the other network devices. The network device selects a secondary path from the paths identified by the attribute. The secondary path is selected based on determining that the primary path is unavailable, and the secondary path is associated with the OSPF domain or the ISIS domain of the network. The network device provides the traffic to the one of the other network devices via the secondary path.

Abstract: Network elements are managed with a server to support client data models from heterogeneous data sources. A server receives a first query for configuration data of a network element to be returned in a first model. The server determines a model type for the configuration data of the network element. When the model type is a second model that is not the first model, the server sends a second query to the network element for the configuration data to be returned in the second model and transforms the configuration data received from the network element into the first model. Additionally, the server returns the configuration data in the first model as a response to the first query.

Abstract: A network device may communicate with another network device via a media access control security (MACsec) key agreement (MKA) communication link, wherein an MKA session has been established between the network device and the other network device. The network device may determine that the other network device is unavailable. The network device may cause, based on determining that the other network device is unavailable, an MKA state of the network device to be placed in a paused state. The network device may receive, after causing the MKA state of the network device to be placed in the paused state, a packet from the other network device via the MKA communication link. The network device may determine, based on the packet, that the MKA session has not ended. The network device may continue, based on the MKA session having not ended, the MKA session by reactivating the MKA state.