Abstract: A method for network tapping and packet brokering in wireless networks includes tapping a signal in a wireless network and determining whether the signal is a valid signal according to a wireless network protocol. In response to determining that the signal is a valid signal according to the wireless network protocol, the signal is demodulated into a sequence of bits arranged according to the wireless network protocol. In response to determining that the signal is not a valid signal according to the wireless network protocol, an indication that the signal is not a valid signal according to the wireless network protocol is generated. A packet in a format compatible with a network tapping and packet brokering system is generated. At least some of the bits or the indication is inserted in the packet. The packet is transmitted to the network tapping and packet brokering system.

Abstract: The subject matter described herein includes methods, systems, and computer readable media for correlating, load balancing and filtering tapped GTP and non-GTP packets. One method for correlating, load balancing and filtering tapped GTP and non-GTP packets includes receiving GTP packets tapped from a plurality of GTP network tap points. The method further includes receiving non-GTP packets tapped from at least one non-GTP network tap point. The method further includes correlating GTP packets with non-GTP packets for a particular subscriber. The method further includes forwarding the GTP packets and non-GTP packets correlated for the particular subscriber to a network monitoring tool.

Abstract: Methods, systems, and computer readable media for providing high availability support at a bypass switch are disclosed. One method occurs at a bypass switch. The method includes determining that an inline tool associated with a bypass switch is unavailable. The method also includes determining whether the inline tool is required or optional. The method further includes in response to determining that the inline tool is required, disabling at least one link associated with the bypass switch so as to trigger a switchover involving a second bypass switch.

Abstract: Pre-sorter systems and methods are disclosed for distributing GTP packets. The pre-sorter forwards GTP packets based upon entries within one or more pre-sort tables, and the entries associate F-TEIDs with output ports that can be coupled to GTP sessions controllers and/or other external systems. The F-TEIDs represent a combination of a destination IP address and a tunnel endpoint identifier (TEID) for each GTP packet. For some embodiments, GTP session controllers analyze the GTP packets and determine F-TEIDs that are created, modified, and/or dropped for user sessions, and the GTP session controllers send control messages to the pre-sorter to determine the entries stored within the pre-sort table(s). For other embodiments, other external systems such as network monitoring tools are coupled to the GTP packet pre-sorter rather than GTP session controllers. Pre-sorters having multiple pre-sort modules with local pre-sort tables, as well as two-stage pre-sort architectures, can also be used.

Abstract: Methods, systems, and computer readable media for balancing incoming connections across multiple cores are disclosed. According to one method, the method occurs at a first processor of a multi-core connection server. The first processor is one of multiple processors of the multi-core connection server configured to receive notification of incoming connection requests associated with a socket and to request the connection requests from a queue. The method includes accepting a first connection request from a queue. The method also includes determining whether a connection quota has been reached. The method further includes in response to determining that the connection quota has been reached, performing an appropriate action based on state information associated with other processors.

Abstract: The subject matter described herein relates to methods, systems, and computer readable media for testing network equipment devices using connection-oriented protocols. In some examples, a method for testing a network equipment device under test (DUT) includes executing, by a network equipment test device, a test script to test the network equipment DUT using a connection-oriented protocol. The method includes inserting, during a connection establishment process of the connection-oriented protocol for a network flow to the network equipment DUT, a flow-identifying sequence number into a sequence number field of a first message of the network flow. The flow-identifying sequence number is a number uniquely identifying the network flow from other network flows. The method includes receiving a second message from the network equipment DUT and determining that the second message belongs to the network flow by extracting the flow-identifying sequence number from the second message.

Abstract: Methods, systems, and computer readable media for monitoring and/or testing network communications are disclosed. A method for monitoring network communications includes receiving packets from a network connected device, determining features associated with either the network connected device or a communications network to which the network connected device is connected by actively or passively monitoring or testing the packets, and automatically switching between passively monitoring or testing the packets and actively monitoring or testing the packets in response to receiving a packet carrying instructions.

Abstract: Methods and systems for reducing the size of a cryptographic key in a test simulation environment are disclosed. In one example, a method includes determining a minimum key size value and maximum key size value for a private cryptographic key for each of a plurality of key exchange value pairs and deriving, for each of the plurality of key exchange value pairs, a key sizing constant based on the minimum key size value and the maximum key size value. The method further includes storing each of the plurality of selected key exchange value pairs and associated key sizing constant in a data store, selecting a key exchange value pair to be applied to a test simulation session conducted between a first test simulation endpoint and a second test simulation endpoint, and generating a private cryptographic key based on the key sizing constant associated with the selected key exchange value pair.

Abstract: A method for distributed network packet statistics collection includes instantiating first and second operations that implement different portions of a network packet statistics collection task on processing nodes implemented on different processors in a network packet statistics collection system. The method includes utilizing an auto-discovery mechanism for the second operation to subscribe to a set of capabilities and identify the first operation as a matching operation. The method further includes establishing a channel between the first and second operations. The method further includes executing the network packet statistics collection task, where the first and second operations perform the different portions of the network packet statistics collection task.

Abstract: Methods, systems, and computer readable media for providing an anticipated data integrity check are disclosed. According to one method, the method includes generating a test message including an anticipated data integrity check value (ADICV), wherein the ADICV is computed using at least one value based on at least one expected modification to message data in the test message by at least one system under test (SUT), and sending the test message to the at least one SUT.

Abstract: A system for providing test receive port resiliency includes a network equipment test device including a port module for transmitting test packets to and receiving packets from a device under test (DUT). The system further includes a port central processing unit (CPU) associated with the port module for processing packets that the CPU receives from the DUT. The system further includes a configurable pre-filter associated with the port module for pre-filtering the packets to prevent at least some of the packets from being forwarded to the port CPU. The system further includes a pre-filter rules generator for analyzing the packets forwarded to the port CPU and for automatically generating a pre-filtering rule to be used by the pre-filter for filtering subsequent packets received from the DUT.

Abstract: Methods, systems, and computer readable media for token based message capture are disclosed. One method includes generating a test message including a token indicative of message data and a data integrity check value (DICV) computed based on at least a portion of the message data. The method also includes sending the test message to a system under test (SUT). The method further includes receiving, from the SUT, a version of the test message, wherein the version of the test message includes the token and the DICV. The method also includes storing a representation of the version of the test message using the token and the DICV.

Abstract: Metadata associated with client application instances running in virtual machine (VM) platforms within virtual processing environments is collected by monitor applications also running within the VM platforms. The instance metadata is transmitted to and received by a monitor control platform which in turn stores the instance metadata within a monitor instance registry. The instance metadata is updated through solicited or unsolicited updates. The instance metadata is used to identify groups of application instances, and these groups are used to determine targets instances for monitoring or management actions based upon later detected network events such as network security or threat events. Further, trust scores can be determined for components of the metadata stored in the instance registry, and composite trust scores can be generated and used to identify on or more groups of application instances.

Abstract: The subject matter described herein relates to methods, systems, and computer readable media for testing network equipment devices using connectionless protocols. In some examples, a method for testing a network equipment device under test (DUT) includes transmitting a first message using a connectionless protocol for a network flow to the network equipment DUT according to a test script. The method includes storing a record for the network flow including a first flow identifier for the flow based on a first payload of the first message. The method includes receiving a second message from the network equipment DUT and determining that the second message belongs to the network flow by determining a second flow identifier based on a second payload of the second message and matching the second flow identifier to the first flow identifier.

Abstract: Methods and systems are disclosed that provide active firewall control for network traffic sessions within virtual processing platforms. Client agent instances run within virtual machine (VM) platforms (e.g., hypervisor, container, etc.) within virtual processing environments and enforce access, proxy, and/or other firewall rules with respect to network traffic sessions for application instances also running within the VM platforms. For certain embodiments, the agent instances collect information about applications and services running within the VM platforms and use this collected information to automatically enforce firewall rules. Additional disclosed embodiments redirect packets from “bad” network sources to a proxied application instance that interacts with the “bad” network source. This proxied interaction allows an agent instance monitoring the proxied session to analyze and assess the actual activity by the “bad” network source without putting the original data or network service at risk.

Abstract: Systems and methods are disclosed for packet deduplication for network packet monitoring in virtual processing environments. Tap agents are installed and run with respect to network applications operating with virtual processing environments. These tap agents capture packet traffic associated within these network applications, and deduplication rules are applied so that duplicate packet capture is avoided at the tap agents themselves. In particular, deduplication rules are applied to tap agents where two network applications for which packets are being captured are talking to each other so that one of the tap agents is set to the designated agent for packet capture. Without this designation, packets captured at by the two associated packet agents would represent the same packet flow from both ends thereby leading to duplicate packet capture.

Abstract: Systems and methods are disclosed to provide on demand packet traffic monitoring for packet communications within virtual packet processing environments. Virtual TAPs (test access ports) within virtualization layers for VM (virtual machine) host hardware systems are controlled by external controllers to configure watch filters for VM platforms operating within the virtualization layer based upon trigger events determined within packet flow data and/or based upon other external trigger events. The virtual TAP controller then periodically receives watch filter packet data updates from the virtual TAP and further controls the virtual TAP to configure more detailed focus filters for the VM platforms based upon watch filter trigger events. The virtual TAP controller can further communicate one or more VM action commands (e.g., stop VM, stop application, etc.) to the virtual TAP for application to the VM platforms based upon trigger events associated with this more detailed focus filter data.

Abstract: Methods, systems, and computer readable media for testing network function virtualization (NFV) are disclosed. According to one method, the method occurs at a network test controller implemented using at least one processor. The method includes determining, using network configuration information, a first insertion point for inserting a first network function tester (NFT) into a service chain comprising a plurality of virtualized network functions (VNFs). The method also includes configuring the first NFT to analyze or ignore traffic matching filtering information, wherein the traffic traverses the first NFT from at least one VNF of the plurality of VNFs. The method further includes inserting, at the first insertion point, the first NFT into the service chain.

Abstract: Multi-layer configurable timing switch fabrics and related methods are disclosed for selectively distributing multiple timing sources to multiple timing consumers. Configurable timing switches are used at central and multiple local levels within the housing for a network-connected processing system to selectively distribute the timing sources to the timing consumers. As such, significant flexibility is provided with respect to what timing sources can be received within the system and how these timing sources are distributed to different timing consumers. Further, timing information can be generated within the network-connected processing system based upon network communications received from timing consumers, and this generated timing information can also be used as timing sources for the multi-layer configurable timing switch fabric.

Abstract: Methods, systems, and computer readable media for processing data units are disclosed. According to one method, the method occurs at a network interface of a computing platform having per data unit processing overhead that limits throughput of the network interface. The method includes concatenating multiple individual data units into a concatenated data unit (CDU), wherein the CDU includes a header portion for at least one of the multiple data units, processing the CDU as a single data unit rather than as multiple individual data units such that the CDU incurs processing overhead of a single data unit rather than that of multiple individual data units, and de-concatenating the CDU into the multiple individual data units.