Abstract: Access points can be mounted in a variety of locations or orientations and can support multiple communications protocols. In some embodiments, an access point includes a main housing and a front housing. The main and front housing are connected by a hinge. A Wi-Fi antenna is included in the front housing in some embodiments. The access point is configured for use in either an open or closed position. When mounted in a vertical position, the front housing can be lowered into a horizontal position, which facilitates a preferred orientation of an antenna with respect to the ground. A first set of cooling fins serves to maintain components of the access point offset from a wall to which the access point is mounted. This facilitates airflow. Additional fins act as a spacer between the main housing and the front housing when the access point is used in a closed position. This facilitates air flow around both sides of the main housing.

Abstract: Embodiments provide for guided alignment of the orientation of two wireless devices. A first wireless device is at a known position and a known orientation. A signal from a second wireless device is received via a plurality of receive elements of the first wireless device. The first wireless device measures phase differences of the signal at the plurality of receive elements, and determines locations of each of the second wireless device's transmit elements based on the differences. Based on the transmit element locations, and a known antenna layout of the second wireless device, an orientation of the second wireless device is determined. Based on differences between the determined orientation and the known orientation of the first wireless device, instructions for aligning the devices are generated. Once the devices are aligned, location estimates of a third wireless device are made by both the first wireless device and the second wireless device.

Abstract: In general, techniques are described for automatic intent provisioning and management in computer networks. A device comprising a processor, a memory, and an interface may perform the techniques. The processor may obtain a policy that includes high-level configuration data defining a service to be deployed within a network, the high-level configuration data including resource selector criteria that identifies one or more criteria for selecting a resource to support the service from a plurality of potential resources. The processor may also determine, based on the resource selector criteria, the resource to support the service from the plurality of potential resources, and translate the high-level configuration data to low-level configuration data specific to the determined resource. The memory may store the low-level configuration data specific to the determined resource.

Abstract: A controller device includes a memory and one or more processors coupled to the memory. The memory stores instructions that, when executed, cause the one or more processors to receive a query indicating a first time and a network service, determine a first set of configuration elements using telemetry data associated with the first time and the network service, and determine a second set of configuration elements using an intent model. The instructions further cause the one or more processors to determine one or more first metrics that occur at the first time using the first set of configuration elements and the second set of configuration elements, determine one or more second metrics at a second time using telemetry data received from the plurality of network devices, and generate data representing a user interface presenting the one or more first metrics and the one or more second metrics.

Abstract: A device receives network data associated with a network that includes network devices interconnected by links at an Internet protocol (IP) layer and an optical layer of the network. The device receives constraints associated with determining a network plan for the network, where the constraints include a constraint indicating a particular time period associated with determining potential network plans for the network. The device identifies variables and values of the variables for the network plan based on the network data, and determines, within the particular time period, the potential network plans for the network based on the constraints and the values of the variables. The device identifies a potential network plan, of the potential network plans, that minimizes costs associated with operating the network, and causes the identified potential network plan to be implemented in the network by the network devices.

Abstract: Methods and apparatus relating to the detection of one or more devices in zones, e.g., non-overlapping areas, are described. Individual device locations are made based on RSSI information. Whether a user is determined to be in a zone or not is determined based on location determinations corresponding to the device. Thresholds used to determine whether a device is to be considered as being within a zone differs depending on whether the device is newly detected in the zone or is already determined to be in the zone. In some embodiments it is easier to be determined to be in a zone than to be determined to have left a zone. A device may be determined to be in two non-overlapping zones at the same time thereby increasing the chance that devices in edge areas will be counted with regard to the number of devices for which resources should be provided.

Abstract: A network device decrypts a record, received from a client device, that is associated with an encrypted session between the client device and an application platform. The network device incorporates decrypted record data, from the decrypted record, into a payload field of a transmission control protocol (TCP) packet to be transmitted to another device, identifies a record header in the record, and determines, based on the record header, a record type associated with the decrypted record. Based on the record type, the network device marks the one or more TCP packets as including urgent data by setting a TCP urgent control bit in a header of the one or more TCP packets, and sets a second field, in the header of the TCP packet, to a second value that identifies an end of the urgent data, which corresponds to an end of the decrypted record data in the payload field.

Abstract: A device may receive, from a first network device, an authentication request that requests authentication of the device, and may provide, to the first network device, an authentication response that includes the authentication of the device. The device may provide, to the first network device and based on the authentication response, a PDU session establishment request that requests establishment of a PDU session for customer premises equipment, and may receive, from the first network device and based on the PDU session establishment request, a PDU session resource setup request that requests a resource to be established for the PDU session. The device may provide, to the first network device and based on the PDU session resource setup request, a PDU session resource setup response indicating that the resource is a GTP tunnel, and may establish the GTP tunnel with a second network device.

Abstract: Methods and apparatus for obtaining status from an isolated AP that cannot connect to a remote management server are described. The status information is obtained from a second device and then provided, via the second device, to the remote management server. At least some of the disclosed embodiments are utilized in a system including a plurality of access points, which can provide alternate pathways to the remote management server. The remote management server determines a remedial action based on the status information.

Abstract: A first plurality of network configuration controllers of a controller may distribute, using a consistent hashing algorithm, a plurality of connection sessions with a plurality of network devices among the plurality of network configuration controllers. The controller may monitor a number of connection sessions maintained by each of the first plurality of network configuration controllers. The controller may add, based on monitoring the number of connection sessions maintained by each of the first plurality of network configuration controllers, an additional network configuration controller to the first plurality of network configuration controllers to form a second plurality of network configuration controllers.

Abstract: Methods, systems, and devices map an arbitrary number of Virtual Routing and Forwarding (VRF) instances to an Ethernet Virtual Private Network (EVPN) instance (EVI) of a leaf and spine network. For example, a spine network device executes a primary EVI to provide an EVPN to a plurality of leaf network devices, each leaf network device executing a secondary EVI to provide a plurality of network virtualization overlays to tenants of the network. The primary EVI is associated with a primary VRF instance, and each secondary EVI of the plurality of secondary EVIs is associated with a secondary VRF instance of a plurality of secondary VRF instances. The spine network device defines mappings between routes within the primary VRF instance and routes within each secondary VRF instance. The spine network device translates, based on the one or more mappings, network traffic between the primary EVI and the plurality of secondary EVIs.

Abstract: A network device may create an encrypted packet and may duplicate the encrypted packet to create a plurality of encrypted packets that includes a first set of encrypted packets that is associated with a first receiving network device and a second set of encrypted packets that is to be associated with a second receiving network device. The network device may modify the second set of encrypted packets by replacing a first virtual destination address in the second set of the plurality of encrypted packets with a second virtual destination address that identifies a virtual tunnel endpoint of the second receiving network device. The network device may encapsulate and may send, based on the first virtual destination address and the second virtual destination address, individual encapsulated encrypted packets to the first receiving network device or the second receiving network device.

Abstract: A device may receive client cipher information, associated with initiating a secure session, identifying at least one key exchange cipher supported by a client device associated with the secure session. The device may determine, based on the client cipher information, that a Diffie-Hellman key exchange is to be used to establish the secure session. The device may determine whether a server device, associated with the secure session, supports use of the Diffie-Hellman key exchange. The device may manage establishment of the secure session using a first decryption technique based on determining that the server device does not support the use of the Diffie-Hellman key exchange, or manage establishment of the secure session using a second decryption technique based on determining that the server device supports the use of the Diffie-Hellman key exchange or being unable to determine whether the server device supports the use of the Diffie-Hellman key exchange.

Abstract: A network monitoring system may receive a configuration request to generate a configuration file associated with collecting feature or debug data associated with a feature, hardware, or software associated with a network device. The network monitoring system may determine a command profile associated with the feature, hardware, or software that identifies a set of commands associated with obtaining the feature or debug data from the network device. The network monitoring system may determine respective parameters of one or more commands of the set of commands. The network monitoring system may determine, based on the respective parameters, respective arguments of the one or more commands. The network monitoring system may generate the configuration file based on the respective arguments and may perform an action associated with the configuration file to permit the configuration file to be used to collect the feature or debug data from the network device.

Abstract: A network device may receive, from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, where the network packet includes an extension header that indicates a source port and a destination port for the second network packet. The network device may perform an anti-spoof check on the fragment of the second network packet based at least in part on at least one of: the source port or the destination port for the second network packet that is indicated by the extension header. The network device may, based on the fragment passing the anti-spoof check, forward the fragment of the second network packet to a second network.

Abstract: A device may provide, to a network device, a subscribe request that includes a request for sensor data, and may receive sensor data packets that include the sensor data and header extensions identifying a group identifier for a group of sensor data and final packet information indicating whether the sensor data packet is a final one for the group. The device may store the sensor data packets until the final packet information of one of the sensor data packets indicates that the one of the sensor data packets is a final sensor data packet for the group, and may identify a complete set of the sensor data packets when the final packet information of the one of the sensor data packets indicates that the one of the sensor data packets is the final sensor data packet. The device may perform actions based on the complete set.

Abstract: A provider edge (PE) device may receive traffic associated with one or more services, wherein the traffic includes a plurality of packets, and may determine, based on the plurality of packets, one or more packets respectively associated with each service of the one or more services. The PE device may determine, based on the one or more packets respectively associated with each service of the one or more services, a respective status of each of the one or more services. The PE device may generate type-length-value (TLV) data that indicates the respective status of each of the one or more services and may cause the TLV data to be added to a link layer discovery protocol (LLDP) packet. The PE device may send the LLDP packet that includes the added TLV data to a customer edge (CE) device.

Abstract: A secondary routing device is configured as a backup routing device for a primary routing device. The primary routing device performs asynchronous socket replication with the secondary routing device. The secondary routing device includes a transmission buffer, in memory, for storing replicated socket data transmitted between the primary routing device and the standby routing device and one or more processors implemented in circuitry and configured to execute a replication driver to: determine a threshold value; determine that an amount of data equaling or exceeding the threshold value has been read from the transmission buffer; in response to determining that the amount of data equaling or exceeding the threshold value has been read from the transmission buffer, schedule a window update for the transmission buffer at a scheduled time; and send the window update at the scheduled time.

Abstract: Techniques are described for providing fast reroute for BUM traffic in EVPN. For example, a first provider edge (PE) device, elected as a designated forwarder (DF) of an Ethernet segment, configures a backup path using a label received from a second PE device of the Ethernet segment (e.g., backup DF) that identifies the second PE device as a “protector” of the Ethernet segment. For example, a routing component of the DF configures within a forwarding component a backup path to the second PE device, e.g., installing the label and operation(s) within the forwarding component to cause the forwarding component to add the label to BUM packets received from a core network. Therefore, when an access link to the local CE device has failed, the DF reroutes BUM packets from the core network via the backup path to the second PE device, which sends the BUM packets to the CE device.

Abstract: A disaggregated broadband network gateway (DBNG) control plane system may receive an association setup request message from a DBNG user plane device, wherein the association setup request message is received via a state control interface between the DBNG control plane system and the DBNG user plane device. The DBNG control plane system may determine, based on the association setup request message, one or more capabilities of the DBNG user plane device and may thereby cause one or more additional state control interfaces to be established between the DBNG control plane system and the DBNG user plane device. The DBNG control plane system and the DBNG control plane system may communicate messages associated with a first message type via the state control interface and may communicate messages associated with a second message type via at least one of the one or more additional state control interfaces.