Abstract: A network device includes match filters to be applied to packets transiting two or more network interfaces. In one example, a network device includes a filtering unit configured to apply one or more filters to a first packet transiting a first network interface to determine a first rule the first packet matches, send the first packet and data representing the first network interface to a first accounting filter associated with the first rule, apply the filters to a second packet transiting a second network interface to determine a second rule that the second packet matches, the second packet being different than the first packet, and the second network interface being different than the first network interface, and send the second packet and second data representing the second network interface to a second accounting filter associated with the second rule.

Abstract: A device receives border gateway protocol (BGP) data associated with links provided in a segment routing network. The segment routing network includes a first autonomous system (AS) with first network devices interconnected by a first portion of the links, a second AS with second network devices interconnected by a second portion of the links, and an inter-AS link provided between one of the first network devices and one of the second network devices. The device filters prefixes of the BGP data to identify BGP data associated with the inter-AS link, where the BGP data associated with the inter-AS link includes data identifying state information associated with the inter-AS link. The device determines an operational state of the inter-AS link based on the BGP data associated with the inter-AS link, and performs one or more actions based on the operational state of the inter-AS link.

Abstract: A method may include obtaining a printed circuit board (PCB) that includes a set of vias that include a set of stub regions. The PCB may include a set of layers perpendicular to the set of vias. The set of layers may include a signal layer and a ground layer. The ground layer may be located between the set of stub regions and the signal layer. The method may include drilling to remove at least a portion of a stub region of a via of the set of vias. The method may include performing an electrical test to determine whether a sliver of conductive material is included within the via after drilling to remove the at least a portion of the stub region of the via.

Abstract: This disclosure describes techniques that include presenting a visual information that conveys information about health data associated with a large number of network devices or a large number of attributes of one or more network devices. In one example, this disclosure describes a method that includes collecting performance indicator data and determining a plurality of health status values based on a health status rule; grouping the health status values, based on how many health status values are in the plurality of health status values, into a plurality of health status groups, wherein each of the health status groups includes a subset of the health status values, and wherein each of the health status values within each subset are related to each of the other health status values in the subset; and determining, for each of the health status groups, a group health status value.

Abstract: A network device obtains information, associated with blacklisted domains, that includes blacklisted domain identifiers, and sinkhole server identifiers associated with the blacklisted domain identifiers. The network device obtains a set of rules that specify match criteria, associated with the blacklisted domains, that include source network addresses and/or destination network addresses for comparison to packet source network addresses and/or packet destination network addresses associated with incoming packets. The set of rules specify actions to perform based on a result of comparing the match criteria and the packet source network addresses and/or the packet destination network addresses for the incoming packets.

Abstract: In integrated optical structures (e.g., silicon-to-silicon-nitride mode converters) implemented in semiconductor-on-insulator substrates, wire waveguides whose sidewalls substantially consist of portions coinciding with crystallographic planes and do not extend laterally beyond the top surface of the wire waveguide may provide benefits in performance and/or manufacturing needs. Such wire waveguides may be manufactured, e.g., using a dry-etch of the semiconductor device layer down to the insulator layer to form a wire waveguide with exposed sidewalls, followed by a smoothing crystallographic wet etch.

Abstract: Techniques are described for providing targeted selection of cascade ports of an aggregation device. In one example, the disclosed techniques enable dynamic assignment of active and backup cascade ports of an aggregation device for each extended port of satellite devices. In this example, rather than allocating resources for each of the extended ports of the satellite devices on all of the cascade ports of the aggregation device, the aggregation device instead allocates resources for each of the extended port only on the assigned active and backup cascade ports for the respective one of the extended ports of the satellite devices. The techniques are also described for providing traffic steering to a backup cascade port in the event the assigned active cascade port is unreachable, and, if the cascade port remains unreachable for a specified duration, the aggregation device may assign new active and backup cascade ports for the extended port.

Abstract: The techniques describe a network device comprising one or more processors configured to: receive configuration data configuring a plurality of virtual network nodes, wherein the configuration data configures a virtual client node including a corresponding line card having a port connected to a first customer network device, and configures a virtual core node including a corresponding line card having a port connected to a core network; provision a layer-2 (L2) circuit that includes, as an access interface, an interface logically connecting the virtual client node and virtual core node, wherein the L2 circuit provides connectivity between the virtual client node and a remote virtual client node; and forward, via the L2 circuit, packets between the virtual client node and the remote virtual client node to realize a logical network between the first customer network device and a second customer network device connected to the remote virtual PE node.

Abstract: A disclosed method may include (1) collecting telemetry data that represents a state of a network device during a live operating session, (2) deriving, from the telemetry data, a set of steps for reproducing the state of the network device during the live operating session based at least in part on a set of rules, (3) generating, based at least in part on the set of steps, a playback decision tree that, upon execution, facilitates (A) reproducing the state of the network device during the live operating session and (B) debugging the state of the network device, and then (4) performing a debug operation that executes the playback decision tree via a network diagnostic tool such as a healthbot. Various other systems, methods, and computer-readable media are also disclosed.

Abstract: A method includes modulating a digital signal via pulse amplitude modulation (PAM) and applying Nyquist shaping to the digital signal to generate a filtered digital signal. The method also includes converting the filtered digital signal into an analog signal and transmitting the analog signal in an optical communication channel via a dense wavelength division multiplexing (DWDM) scheme.

Abstract: The disclosed apparatus may include (1) a heatsink that includes a first vapor chamber that (A) contains fluid that dissipates heat and (B) is at least partially encompassed by a plate that contains at least one slot extending from a top surface of the plate to the first vapor chamber and (2) at least one fin that (A) encompasses a second vapor chamber (B) is secured within the slot in the plate of the heatsink such that (i) the fin extends from the heatsink and (ii) the fluid within the first vapor chamber is capable of flowing into the second vapor chamber. Various other apparatuses, systems, and methods are also disclosed.

Abstract: A controller device manages a plurality of network devices. The controller device is configured to receive, for a data structure, a configlet specifying a set of configuration changes to be applied to a resource of a plurality of resources of the plurality of network devices. A low level configuration for each respective owned resource of a set of owned resources of the plurality of resources includes a pointer indicating an owner for the respective owned resources. The one or more processing units are further configured to determine the set of configuration changes does not conflict in response to determining the low level configuration for the resource does not include a pointer indicating the owner for the resource is not the configlet and apply the set of configuration changes to the resource in response to determining the set of configuration changes does not conflict with the set of owned resources.

Abstract: An example data center system includes server devices hosting data of a first tenant and a second tenant of the data center, network devices of an interconnected topology coupling the server devices including respective service virtual routing and forwarding (VRF) tables, and one or more service devices that communicatively couple the network devices, wherein the service devices include respective service VRF tables for the first set of server devices and the second set of server devices, and wherein the service devices apply services to network traffic flowing between the first set of server devices and the second set of server devices using the first service VRF table and the second service VRF table.

Abstract: A controller device manages a plurality of network devices. The controller device includes one or more processing units implemented in circuitry and configured to determine that one or more stateless intents of a deployed graph model including a first set of stateless intents used to manage the plurality of network devices have changed, wherein stateless intents comprise fully declarative descriptions of an intended state of a network including the network devices, state of one or more of the network devices, or state of storage for the network; maintain both the deployed graph model and an undeployed graph model including a second set of stateless intents including the one or more changed stateless intents; compile the changed stateless intents of the undeployed graph model to generate low-level configuration data for the network devices; and configure the network devices using the low-level configuration data.

Abstract: An example controller device manages a plurality of network devices. The controller device includes one or more processing units, implemented using digital logic circuitry, configured to receive data representing a modification to unified intent model represented by a graph model, determine one or more vertices of the graph model affected by the data representing the modification and one or more vertices to be added to the graph model to extend the unified intent model, update the one or more vertices of the graph model affected by the data representing the modification and add the one or more vertices to be added to the graph model, compile the updated one or more vertices and the added one or more vertices to generate low level configuration data for the plurality of network devices, and configure one or more of the plurality of network devices with the low level configuration data.

Abstract: Filter synchronization across a restart of a firewall filter application for converting filter information for filters into corresponding iptables filter table rules, is ensured by (1) computing a hash value for filter information derived from a filter using the filter or information derived from the filter, (2) determining an iptables filter table rule using the filter information for the filter, (3) associating the hash value with the corresponding iptables filter table rule, and (4) adding the determined iptables filter table rule and the hash value to iptables filter table rules in a Linux kernel.

Abstract: A network device may forward fragments of an IPv4 network packet to an IPv6 network without reassembling the IPv4 network packet. The network device may receive and buffer one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the destination port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the destination port of the IPv4 network packet, the network device may encapsulate each fragment of the fragment flow that it has received into respective IPv6 network packets to the IPv6 network.

Abstract: A network device may assign, to a port of a plurality of ports on the network device, a precision timing protocol (PTP) port priority for PTP communications between the network device and another network device. The network device and the other network device may be communicatively connected via a plurality of links in a link aggregation group (LAG). Each port, of the plurality of ports, may be associated with a respective link, of the plurality of links, in the LAG. The network device may generate a link layer discovery protocol (LLDP) frame that includes information identifying the PTP port priority assigned to the port. The network device may transmit the LLDP frame to the other network device to identify, to the other network device, the PTP port priority.

Abstract: In general, techniques are described for communicating state information in distribute operating system. A network device comprises a first hardware node and a second hardware node. The first hardware node may execute a first instance of a distributed operating system, and maintain a first data structure that stores a plurality of objects defining a portion of state information. The second hardware node may execute a second instance of the distributed operating system, and maintain a second data structure that stores synchronized versions of the plurality of objects. The first hardware node may further receive updated state information, update the first data structure to include the updated state information, and synchronize the updated first data structure with the second data structure. The second hardware node may synchronize the second data structure with the updated first data structure.

Abstract: In some embodiments, a non-transitory processor-readable medium stores code representing instructions configured to cause a processor to receive, from an access switch, a first signal including forwarding state information associated with a first peripheral processing device from a set of peripheral processing devices. The code can further represent instructions configured to cause the processor to receive, from the first peripheral processing device, a second signal including a data packet. The code can further represent instructions configured to cause the processor to send, to a replication engine associated with the set of peripheral processing devices, a third signal such that the replication engine (1) defines a copy of the data packet, which is included within the third signal, and (2) sends, to a second peripheral processing device from the set of peripheral processing devices, a fourth signal including the copy of the data packet.