Abstract: In one example, a method comprises receiving, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, one or more packet processing operations from a control unit of the network device; generating, by the forwarding manager based on the one or more packet processing operations, a plurality of nodes each comprising a unique token, wherein a first node of the plurality of nodes includes a token reference set to a value for the token of a second node of the plurality of nodes; configuring, by the forwarding manager based on the nodes, the forwarding path to include respective forwarding path elements for the plurality of nodes; and processing, by the packet processor, a packet received by the forwarding unit by executing the forwarding path elements.

Abstract: In general, the disclosure describes techniques for dynamic application service level agreement (SLA) metric generation, distribution, and intent-based Software-Defined Wide Area Network (SD-WAN) link selection. For instance, a network device may determine a metric associated with an application or application-group. The network device may send the metric to a controller, and in response may receive from the controller a recommended SLA metric associated with the application or application-group. The network device may also compute an intent-based SLA metric based on the recommended SLA metric, one or more characteristics of one or more links connected to the network device, and a user configured intent model that defines a tolerance level to apply the recommended SLA metric. The network device may select, based on the intent-based SLA metric, a path to send traffic from the application or application-group.

Abstract: In some embodiments, a system includes a super-channel multiplexer (SCM) and an optical cross connect (OXC) switch. The SCM is configured to multiplex a set of optical signals into a super-channel optical signal with a wavelength band. The OXC switch is configured to be operatively coupled to the SCM and a reconfigurable optical add-drop multiplexer (ROADM) degree. The OXC switch is configured to be located between the SCM and the ROADM degree and the OXC switch, the SCM, and the ROADM degree are configured to be included in a colorless, directionless, and contentionless (CDC) optical network. The OXC switch is configured to switch, based on the wavelength band, the super-channel optical signal to an output port from a set of output ports of the OXC switch. The OXC switch is configured to transmit the super-channel optical signal from the output port to the ROADM degree.

Abstract: Disclosed are embodiments for determining a location of a wireless terminal. The wireless terminal measures signal strength of a plurality of wireless transmitters. Based on this information, a plurality of location probability surfaces are generated. Each location probability surface indicates a plurality of probabilities that the wireless terminal is in each of a corresponding plurality of geographic regions. These probability surfaces are then averaged to determine a composite location probability surface. A motion probability surface is also determined, which stores a plurality of probabilities indicating variations of motion of the wireless terminal. The composite location probability surface is then updated based on the motion probability surface. A location estimate of the wireless terminal is then determined based on the updated composite location probability surface.

Abstract: An access point, which is a Power over Ethernet (PoE) Powered Device (PD) measures input voltage and input current. The access point determines a power requirement of the access point based on the measured current, measured voltage, and information about power requirements of access point components or devices coupled to the access point a power requirement of the access point. The access point communicates the determined power request to a power sourcing equipment (PSE), e.g., a network switch. In some embodiments, the access point further communicates one of: measured input current and measured input voltage to the PSE. The PSE uses the information received from the access point, e.g., power request and power measurements to determine an amount of power to be granted to the access point. If the access point does not receive the requested power level the access point selects internal components and/or external devices to de-power.

Abstract: Techniques within a network device to execute periodic packet management (PPM) used to determine the health of a network. The inline mode of periodic packet management may be more efficient than other modes of periodic packet management such as centralized mode or distributed mode. The number of inline entries for a given hardware table may be limited, which means that once the number of inline entries in the table has reached the size limit, then any new entries must be managed in the distributed mode or the centralized mode. The techniques of this disclosure may improve the efficiency of a network device by replacing inline entries handled at a lower frequency in the hardware table with entries for periodic packets that are handled with a higher frequency (shorter periodic interval). In this manner, the entries with shorter periodic intervals may be managed using the more efficient inline mode.

Abstract: A device receives information identifying malicious behavior by a compromised endpoint device associated with a network and traffic associated with the compromised endpoint device after the malicious behavior is identified. The device receives endpoint device information identifying other endpoint devices associated with the network, wherein the compromised endpoint device is not one of the other endpoint devices. The device receives network device information identifying network devices associated with the network, and processes the traffic, the endpoint device information, and the network device information, with a machine learning model, to generate a security policy to isolate the malicious behavior. The device performs one or more actions based on the security policy to isolate the malicious behavior.

Abstract: Techniques are disclosed for scalable virtualization of tenants and subtenants on a virtualized computing infrastructure. In one example, a first controller for the virtualized computing infrastructure configures underlay network segments in the virtualized computing infrastructure by configuring respective Virtual Extensible Local Area Network (VXLAN) segments of a plurality of VXLAN segments of a VXLAN in a switch fabric comprising network switches. Each VXLAN segment provides underlay network connectivity among a different subset of host computing devices of the virtualized computing infrastructure to enable orchestration of multiple tenants in the VXLAN. A second controller for a first subset of the host computing devices has underlay network connectivity through operation of a first VXLAN segment. The second controller configures overlay networks in the first subset of the host computing devices to enable orchestration of multiple subtenants in the first subset of the host computing devices.

Abstract: A first line card of a first network device may receive packets to be transmitted to a second line card of a second network device. The first line card may predict an earliest satisfaction time for satisfaction of a first packet quantity threshold of one or more packet quantity thresholds. The first line card may transmit the packets to the second line card. The first line card may determine whether a quantity of transmitted packets transmitted by the first line card satisfies the first packet quantity threshold. Based on whether the quantity of transmitted packets satisfies the one or more of the one or more packet quantity thresholds, the first line card may perform one or more actions related to modifying a security key, or may perform one or more other actions related to monitoring transmission of the packets.

Abstract: A network device may store domain name system (DNS) information in a DNS file in a first DNS store of a first control plane component included in the network device, the DNS information being associated with a plurality of DNS entries stored in a first DNS memory of the first control plane component; may transfer, based on storing the DNS information in the DNS file in the first DNS store, a copy of the DNS file from the first DNS store to a second DNS store of a second control plane component included in the network device, the copy of the DNS file including the DNS information associated with the plurality of DNS entries; and may transfer, based on detecting an event associated with the first control plane component, the DNS information from the copy of the DNS file to a second DNS memory of the second control plane component.

Abstract: In general, techniques are described for managing, with a network controller for a computer network, the configuration of network devices within the computer network using one or more message buses. In some examples, a controller includes processing circuitry coupled to memory. The processing circuitry is configured to generate data for implementing a configuration change for a network device and store, to a configuration database, the data for implementing the configuration change for the network device. The processing circuitry is further configured to add, to a message queue of a message bus executed by one or more or more computing devices separate from the controller, an indication of the configuration change for the network device to cause the network device to obtain, from the configuration database, the data for implementing the configuration change for the network device.

Abstract: An example network device determines to assign a number of global Internet protocol (IP) addresses to respective network interfaces, determines a subnetwork for the network interfaces, determines a prefix corresponding to the subnetwork, determines a first global IP address having the prefix, determines a range value that is equal to or greater than the number of global IP addresses, generates a message according to Duplicate Address Detection Protocol (DAD) including data indicating that the message includes a range of addresses, the data further indicating the first global IP address and the range value, and sends the message according to DAD to one or more host network devices to determine whether any global IP address in a range starting with the first global IP address and through the range value is in use by the one or more host network devices.

Abstract: Photonically integrated normal incidence photodetectors (NIPDs) and associated in-plane waveguide structures optically coupled to the NIPDs can be configured to allow for both in-plane and normal-incidence detection. In photonic circuits with light-generation capabilities, such as integrated optical transceivers, the ability of the NIPDs to detect in-plane light is used, in accordance with some embodiments, to provide self-test functionality.

Abstract: Techniques are described in which a centralized controller constructs a service chain between a bare metal server (BMS) and a virtual execution element (e.g., virtual machine or container), or in some instances a remote BMS, across a plurality of networks. In some examples, the controller may construct a service chain between a BMS and a virtual execution element or remote BMS using Ethernet Virtual Private Network (EVPN)—Virtual Extensible Local Area Network (VXLAN) and Internet Protocol Virtual Private Networks (IP VPNs) such as BGP/Multiprotocol Label Switching (BGP/MPLS) IP VPNs.

Abstract: A wireless access point system includes a processor configured to tap event data and process the event data using a plurality of event filters. Each event filter of the plurality of event filters applies event criteria to detect one or more types of events. The wireless access point system includes a memory configured to store the tapped event data. A communication interface configured to report a report of a detected event type. At least a portion of the report is correlated to analyze a performance of a wireless network.

Abstract: The disclosed apparatus may include (1) a plenum that (A) interfaces with a panel of a telecommunications system that facilitates traffic within a network and (B) reduces a gap between the panel of the telecommunications system and a removable telecommunications module that is installed into the telecommunications system and (2) an air channel that is incorporated in the plenum, wherein the air channel directs airflow into a vent hole of the panel of the telecommunications system. Various other apparatuses, systems, and methods are also disclosed.

Abstract: In some embodiments, an apparatus includes an optical transmitter module that can be electrically coupled to an electrical serializer/deserializer and a controller. The optical transmitter module can include an electrical detector that can receive an in-band signal. The electrical detector can send to the controller a first power error signal and a second power error signal based on the in-band signal. The controller can send a correction control signal to the electrical serializer/deserializer based on the first power error signal and the second power error signal such that the electrical serializer/deserializer sends a pre-emphasized signal to the optical transmitter module based on the correction control signal. In such embodiments, the first power error signal, the second power signal and the correction control signal are out-of-band signals.

Abstract: Multiple Register State Machines on a rendezvous point router (“RP”) in a Protocol Independent Multicast-Sparse Mode (“PIM-SM”) domain per (S,G) is supported, thereby increasing the Register state consistency and faster convergence in case of a first hop router (“FHR”) failure. Such example embodiments may advantageously eliminate the limitation of a single Register State Machine on RP for a given (S,G), in the presence of multiple FHRs connected to the same source. At least some such example embodiments provide the capability of maintaining multiple Register State Machines on RP for a given (S,G), in a way, that maps one Register State Machine to each FHR. In this way, the RP can avoid the inconsistent FHR states and traffic losses caused due to FHR failures.

Abstract: In general, the disclosure describes techniques for evaluating application quality of experience metrics over a software-defined wide area network. For instance, a network device may receive an application data packet of a data flow for an application and send a first set of probe packets, configured according to an initial probing profile, over each of one or more links. The network device may monitor the data flow to determine one or more characteristics of the data flow and generate an updated probing profile based on the one or more characteristics of the data flow. The network device may then send a second set of one or more probe packets, configured according to the updated probing profile, over each of the one or more links.