Abstract: Ping or traceroute functionality is supported in a path spanning multiple autonomous systems (ASes) having segment routing (SR) enabled, the path including an ingress node in a first autonomous system (AS) and an egress node in an AS other than the first AS, using a reverse path label pair including (1) a node segment identifier (SID) corresponding to an AS Border Router (ASBR) of the second AS (second ASBR), and (2) an egress peer engineering (EPE) SID corresponding to a segment between the second ASBR to an ASBR of the first AS (first ASBR). Responsive to receiving a ping or traceroute request by a router in the second AS, the router generates a ping or traceroute reply including the reverse path label pair. The ping or traceroute reply is forwarded to the second ASBR using the node SID of the reverse path label pair. The ping or traceroute reply is then forwarded from the second ASBR to the first ASBR using the EPE SID of the reverse path label pair.

Abstract: A method includes receiving, by a network analyzer implemented in circuitry, from a network device of a plurality of network devices, a sensor message for telemetry flow data. The sensor message indicates an interface index for a network interface, a virtual network identifier associated with a virtual network, and an IP address. The method further includes receiving, by the network analyzer, from the network device, a telemetry flow message for the telemetry flow data. The method further includes, in response to determining that the telemetry flow message includes an indication of an interface index that matches the interface index of the sensor message and that the telemetry flow message includes an indication of a virtual network identifier that matches the virtual network identifier of the sensor message, setting, by the network analyzer, the IP address as the source of the telemetry flow data.

Abstract: A technique for implementing an untethered access point (UAP) mesh involves enabling AP-local switching at one or more UAPs of the mesh. A system constructed according to the technique may include an untethered access point (UAP), including: a radio; a backhaul service set identifier (SSID) stored in a computer-readable medium; an anchor access point (AAP) selection engine embodied in a computer-readable medium. In operation, the AAP selection engine may use the radio to attempt to associate with the AAP if a beaconed backhaul SSID matches the stored backhaul SSID. A method according to the technique may include beaconing with a backhaul SSID, acting in concert with an upstream switch as an authenticator for a downstream station that responds to the beacon; providing limited local switching functionality for the downstream station.

Abstract: A first device may establish a connection with a second device, and may provide a connection check RPC message to the second device. The first device may receive a verification RPC message from the second device, and may provide, to the second device, a sync domains RPC request that includes a first list of active domains with associated address pools. The first device may receive, from the second device, a sync domains RPC response that includes threshold values for the active domains included in the first list of active domains, and may provide, to the second device, a sync pools RPC request that includes a first list of address pools associated with the active domains. The first device may receive, from the second device, a sync pools RPC response that includes confirmation of the first list of address pools, and may allocate addresses of an address pool to a CPE.

Abstract: The disclosure describes techniques for detecting network measurement inaccuracies through the detection of sender delays or packet drops. For example, a sender device of a test packet may determine whether the sender device is experiencing any issues in sending the test packet to a receiver device and notify a controller of the issues such that the controller may generate an indication that one or more Key Performance Indicator (KPI) measurements based on the test packets from the sender device are inaccurate and/or untrustworthy, remove the inaccurate KPI measurements, and/or adjust the inaccurate KPI measurements.

Abstract: An example computing device is configured to receive an instance of a customer service model representative of a plurality of customer services. Each of the plurality of customer services associated with a corresponding at least one requirement and a corresponding at least one constraint. The computing device is configured to receive an instance of a resource model representative of a plurality of resources and map the instance of the customer service model and the instance of the resource model to an internal placement model. The computing device is configured to allocate the plurality of resources to the plurality of customer services such that the at least one requirement and the at least one constraint for each of the plurality of customer services are satisfied and inverse map data indicating how the plurality of resources are allocated to a format consumable by the customer device and output the inverse mapped data.

Abstract: A device may determine internet protocol (IP) traffic monitoring criteria and may monitor IP traffic based on the IP traffic monitoring criteria. The device may update, based on monitoring the IP traffic, a table of currently active IP traffic flows and may update, based on the table of currently active IP traffic flows, an address resolution protocol (ARP) packet filter. The device may receive one or more ARP packets from a different device and may determine whether to accept or discard the one or more ARP packets based on the ARP packet filter. The device may update an ARP table based on determining to accept the one or more ARP packets.

Abstract: A method and network device for detecting a TCP socket failure is described. A network device may be configured to detect a failure of a link between a first node and a second node, determine one or more transmission control protocol (TCP) sockets of a plurality of TCP sockets on the first node that are communicating over the link between the first node and the second node, write information to a TCP stack for the determined one or more TCP sockets, the information indicating that the determined one or more TCP sockets have an error, and remediate the determined one or more TCP sockets in response to the information.

Abstract: A method includes subscribing, by an agent, to telemetry flow data from each network device of a plurality of network devices and receiving, by the agent, a plurality of streams of telemetry flow data from the plurality of the network devices. Each of the plurality of streams corresponds to a different one of the plurality of network devices. The method further includes aggregating, by the agent, data from at least one stream of the plurality of streams of the telemetry flow data received over a period of time and, at the end of the period of time and/or when the data from the at least one stream exceeds a data threshold, sending, by the agent, the aggregated telemetry flow data to a network analyzer device.

Abstract: Disclosed are methods and systems for improved wireless terminal roaming. In some embodiments, a management module determines access point density metrics for a plurality of centrally managed access points of a communications site. The density metric considers an average RSSI of access point signals received by other access points of the site, and each access point's contribution to the average. A determination of whether a particular wireless terminal roams is based on the density metrics of the source and target access point, as well as statistics relating to a current capacity of each of the access points. The disclosed embodiments may determine that a wireless terminal should transition/roam away from an access point even when that access point's RSSI value at the wireless terminal is above a threshold that would cause traditional methods to inhibit roaming.

Abstract: A first network device may receive a flow of unicast packets with a loop prevention bit set. The flow of unicast packets may be received from a second network device associated with a non-operational link provided between the second network device and a destination device. The second network device may be a peer of the first network device. The first network device may determine whether a link provided between the first network device and the destination device is operational, and may forgo returning the flow of unicast packets to the second network device when the link provided between the first network device and the destination device is non-operational and based on the loop prevention bit.

Abstract: Devices, systems, and techniques for global network state management are described herein. In one example, the present disclosure describes an example method performed by a software-defined network (SDN) controller that manages a network of a plurality of devices. The method include maintaining, by processing circuitry of the SDN controller, global network state information, configuring, by the processing circuitry, a notification service with a subscription for updates to a portion of the global network state information, wherein the notification service is configured to arrange the updates to the portion of the global network state information into a plurality of events, and distributing, by the notification service and via a plurality of interfaces, the plurality of events as event notifications to a plurality of subscriber micro-services of the SDN controller.

Abstract: This disclosure describes techniques relating to assigning unique segment identifiers (SIDs) in a segment routing network. In one example, this disclosure describes a method that includes receiving, by a computing system and from a node on a network, a request to allocate a segment identifier for use in a segment routing network; allocating, by the computing system and from a block of addresses, an assigned segment identifier; responding to the request by outputting, by the computing system and over the network to the node, information about the assigned segment identifier; and maintaining the assigned segment identifier.

Abstract: A network device may identify an application signature associated with a web application, and may determine, based on an application-based policy associated with the web application, an access method to be used to transmit traffic associated with the web application. The network device may generate a proxy auto configuration (PAC) file using the application signature associated with the web application, and the access method to be used to transmit the traffic associated with the web application. The network device may provide the PAC file to a client device to permit the client device to transmit the traffic associated with the web application based on the PAC file.

Abstract: Techniques are described for provisioning non-colored segment routing label switched paths (LSPs) via segment routing policies in border gateway protocol (BGP). For example, an ingress router receives a segment routing policy advertisement specifying an endpoint of one or more paths, and a policy color field of the one or more paths, wherein the policy color field is specified with a designated value that causes the network device to store the one or more paths in a data structure that stores non-colored paths. The ingress router determines that the policy color is specified with the designated value. The ingress router, in response to determining that the policy color is specified with the designated value, stores the one or more paths in the data structure that stores non-colored paths.

Abstract: In general, techniques are described for a computing device including a virtual router, a pod comprising a container, and a network plugin. The virtual router includes a virtual router agent. The network plugin includes processing circuitry configured to receive, from the virtual router agent, an indication of an interface type for a virtual network for the pod and to configure, for the pod, a virtual network interface having the interface type, the virtual network interface for communicating on the virtual network.

Abstract: Techniques are described in which a network management system processes network event data received from the AP devices. The NMS is configured to dynamically determine, in real-time, a minimum (MIN) threshold and a maximum (MAX) threshold for expected occurrences for each event type, wherein the MIN thresholds and MAX thresholds define ranges of expected occurrences for the network events of the corresponding event types. The NMS applies an unsupervised machine learning model to the network event data to determine predicted counts of occurrences of the network events for each of the event types and identify, based on the predicted counts of occurrences and the dynamically-determined minimum threshold values and maximum threshold values for each event type, one or more of the network events as indicative of abnormal network behavior.

Abstract: In general, the disclosure describes techniques for configuring a forwarding path of a network device. For example, a network device system includes a compiler. The compiler is configured to receive text comprising syntax elements in an arrangement that indicates a topology for a plurality of nodes. Additionally, the compiler is configured to generate, based on the text, code for instantiating the plurality of and compile the code to generate a software image. The network device system includes a network device comprising a forwarding manager configured to execute the software image to configure a forwarding path to include the corresponding forwarding path elements for each of the plurality of nodes. Additionally, the network device system includes at least one packet processor operably coupled to a memory, wherein the at least one packet processor is configured to process packets received by the forwarding unit by executing the forwarding path elements.

Abstract: A first network device may determine to transition to a maintenance mode. The first network device may transmit, to a second network device, a bidirectional forwarding detection (BFD) control packet that includes an indication that the first network device is in the maintenance mode.

Abstract: A network device may forward fragments of an IPv4 network packet encapsulated in IPv6 network packets from an IPv6 network to an IPv4 network without reassembling the IPv4 network packet. The network device may receive and buffer the one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the source port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the source port of the IPv4 network packet, the network device may dispatch each fragment of the fragment flow that it has received to the IPv4 network.