Abstract: Filter synchronization across a restart of a firewall filter application for converting filter information for filters into corresponding iptables filter table rules, is ensured by (1) computing a hash value for filter information derived from a filter using the filter or information derived from the filter, (2) determining an iptables filter table rule using the filter information for the filter, (3) associating the hash value with the corresponding iptables filter table rule, and (4) adding the determined iptables filter table rule and the hash value to iptables filter table rules in a Linux kernel.

Abstract: A network device may forward fragments of an IPv4 network packet to an IPv6 network without reassembling the IPv4 network packet. The network device may receive and buffer one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the destination port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the destination port of the IPv4 network packet, the network device may encapsulate each fragment of the fragment flow that it has received into respective IPv6 network packets to the IPv6 network.

Abstract: A network device may assign, to a port of a plurality of ports on the network device, a precision timing protocol (PTP) port priority for PTP communications between the network device and another network device. The network device and the other network device may be communicatively connected via a plurality of links in a link aggregation group (LAG). Each port, of the plurality of ports, may be associated with a respective link, of the plurality of links, in the LAG. The network device may generate a link layer discovery protocol (LLDP) frame that includes information identifying the PTP port priority assigned to the port. The network device may transmit the LLDP frame to the other network device to identify, to the other network device, the PTP port priority.

Abstract: In some embodiments, a non-transitory processor-readable medium stores code representing instructions configured to cause a processor to receive, from an access switch, a first signal including forwarding state information associated with a first peripheral processing device from a set of peripheral processing devices. The code can further represent instructions configured to cause the processor to receive, from the first peripheral processing device, a second signal including a data packet. The code can further represent instructions configured to cause the processor to send, to a replication engine associated with the set of peripheral processing devices, a third signal such that the replication engine (1) defines a copy of the data packet, which is included within the third signal, and (2) sends, to a second peripheral processing device from the set of peripheral processing devices, a fourth signal including the copy of the data packet.

Abstract: A device receives information identifying a specific host threat to a network, where the information includes a list of network addresses associated with the specific host threat. The device identifies network elements, of the network, associated with the specific host threat to the network, and determines a network control system associated with the identified network elements. The device determines a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat, where the network control system is associated with the policy enforcement group of network elements. The device determines a threat policy action to enforce for the specific host threat, and causes, via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements.

Abstract: A device receives network data associated with a network that includes network devices interconnected by links at an Internet protocol (IP) layer and an optical layer of the network. The device receives constraints associated with determining a network plan for the network, where the constraints include a constraint indicating a particular time period associated with determining potential network plans for the network. The device identifies variables and values of the variables for the network plan based on the network data, and determines, within the particular time period, the potential network plans for the network based on the constraints and the values of the variables. The device identifies a potential network plan, of the potential network plans, that minimizes costs associated with operating the network, and causes the identified potential network plan to be implemented in the network by the network devices.

Abstract: The use and processing of update messages (e.g., BGP UPDATEs) that bind (e.g., MPLS) labels to address prefixes is improved such that labels are used more efficiently, and/or such that such update messages can be processed more efficiently. A distance vector control signaling protocol (e.g., BGP) peer device receives a control plane message (e.g., BGP Update) from a downstream peer device, the control plane message including (1) a network address of the downstream device as a next hop value, (2) a prefix value, and (3) at least one label associated with the prefix value. Responsive to receiving the control plane message, the peer device generates a new control plane message including (1) a network address of the peer device as a next hop value, (2) the prefix value from the control plane message, and (3) a label stack including (i) the at least one label from the control plane message, and (ii) a local label associated with the peer device.

Abstract: A provider edge device, capable of accessing a first type of memory and a second type of memory, may determine a network address associated with a customer edge device. The provider edge device may determine whether the customer edge device is categorized as a leaf device in an Ethernet Tree service provided by the provider edge device. The provider edge device may selectively store the network address in the first type of memory or the second type of memory based on determining whether the customer edge device is categorized as a leaf device in the Ethernet Tree service.

Abstract: A network device may receive an IPv6 packet that includes an IPv6 source address and an IPv6 destination address. The network device may determine, based on the IPv6 packet including an extension header that includes an address prefix option, whether to translate the IPv6 packet into an IPv4 packet. Additionally, based on a determination to translate the IPv6 packet into the IPv4 packet, the network device generates an IPv4 packet that includes an IPv4 source address and an IPv4 destination address. Because the PLAT unit may make the determination whether to translate the IPv6 packet into an IPv4 packet based on the IPv6 packet including the address prefix option instead of based on the IPv6 source address including a customer-translation (CLAT) source prefix, it may be unnecessary to distribute the CLAT source prefix to the network device.

Abstract: Techniques are disclosed for configuring multiple network devices implementing different protocols or techniques. For example, these techniques allow network devices configured with different protocols to co-exist within the same network, or for the network to seamlessly evolve from one protocol to the other. Techniques described herein provide for an SDN controller that may bridge a network system implementing different protocols, e.g., Open vSwitch Database (OVSDB) and Ethernet Virtual Private Network (EVPN), by translating high-level configuration data (e.g., desired state of the network at a high level of abstraction) that are protocol agnostic to low-level configuration data (e.g., desired state of the network at a low level of abstraction) that are protocol specific. That is, SDN controller may provide management, control, and analytics functions of a virtualized network configured to operate specifically within an OVSDB environment and/or an EVPN environment.

Abstract: Access points which can be mounted in a variety of locations or orientations and can support multiple communications protocols are described. The access point includes a main housing, e.g., main body, and a front housing connected together by a hinge. A Wi-Fi antenna is included in the front housing in some embodiments. The access point can be used in an open or closed position. When mounted in a vertical position the front housing can be lowered into a horizontal position facilitating preferred antenna orientation. A first set of cooling fins serves to keep the internal components of the access point off a wall when the access point is wall mounted facilitating air flow. Additional fins act as a spacer between the main housing and the front housing when the access point is used in a closed position facilitating air flow around both sides of the main housing.

Abstract: In general, techniques are described for provisioning Quality of Service (QoS) behavior on tunnel endpoints. For example, a network device operating as a source tunnel endpoint, e.g., a provider edge (PE) device, may encapsulate a QoS behavior that was derived by the PE device upon receiving the packet from a source network (e.g., a customer or tenant network) and send the encapsulated packet through the tunnel across one or more intermediate networks (such as data center networks) to the destination tunnel endpoint such that the destination tunnel endpoint may apply the same QoS behavior derived by the source tunnel endpoint when injecting the original packet into a destination network (e.g., a second network of the customer or tenant) without having to re-derive the QoS behavior from customer/tenant QoS policies for the destination network.

Abstract: Techniques are described to limit heat transfer from a first electronic component to a second electronic such as by having an aperture in a lid over the second electronic component to form a gap in the conductance of heat from the first electronic component to the second electronic component. A semiconductor electronic package includes a substrate, a first electronic component that is of a first type and that is mounted along a surface of the substrate, a second electronic component that is of a second type different than the first type and that is mounted along the surface of the substrate, and a metallic component that is positioned over the first electronic component and that has an aperture through which the second electronic component is exposed.

Abstract: This disclosure describes techniques for monitoring, scheduling, and performance management for virtualization infrastructures within networks. In one example, a computing system includes a plurality of different cloud-based compute clusters (e.g., different cloud projects), each comprising a set of compute nodes. Policy agents execute on the compute nodes to monitor performance and usage metrics relating to resources of the compute nodes. Policy controllers within each cluster deploy policies to the policy agents and evaluate performance and usage metrics from the policy agents by application of one or more rulesets for infrastructure elements of the compute cluster. Each of the policy controllers outputs data to a multi-cluster dashboard software system indicative of a current health status for the infrastructure elements based on the evaluation of the performance and usage metrics for the cluster.

Abstract: According to various aspects of the present disclosure, an apparatus is provided. In an aspect, the apparatus includes an optical transceiver having a first port, a second port and an optical switch coupled to the first port and the second port. The optical switch is switchable between a unidirectional port operation mode and a bidirectional port operation mode. When the optical switch is in the unidirectional port operation mode, the first port is configured to send a first optical signal, and the second port configured to receive a second optical signal. When the optical switch is in the bidirectional port operation mode, the first port configured to send the first optical signal and receive the second optical signal, and the second port configured to receive a third optical signal and not send the first signal.