Abstract: Systems and techniques are described for caching resources. Multiple distinct resource identifiers that correspond to the same resource can be automatically collected, wherein the multiple distinct resource identifiers are included in resource requests that are sent from at least one client to at least one server. Next, a key can be automatically determined that matches the multiple distinct resource identifiers by analyzing the multiple distinct resource identifiers. A resource request can be received from a client that includes a resource identifier, and in response to determining that the resource identifier matches the key, the resource can be sent to the client.

Abstract: Systems and techniques are described for performing proxy auto-discovery in an Internet Protocol version 6 (IPv6) network by using the destination options extension header field in the IPv6 header. Specifically, systems and techniques are described to enable a pair of proxies to transparently intercept connection handshake messages that are carried in IPv6 packets between two network nodes, and to use the destination options extension header field in the IPv6 packets to automatically discover each other.

Abstract: Systems and techniques are described for performing minimally invasive monitoring of path quality in a network. Specifically, path quality requests and measurements can be piggy-backed on the data traffic that is flowing through a secure connection between two network nodes. For example, path quality requests and measurements can be inserted into the TFC padding field of IP/ESP packets that are being communicated between two IPsec devices. The disclosed embodiments ensure that the number/frequency of measurements increases/decreases naturally in proportion to the amount of traffic flowing, and that the measurement data does not get differential treatment in the network as they are intrinsically bound to the data packets being monitored.

Abstract: Embodiments provide systems, methods, and computer program products for inferring node and link information from traceroute data in order to generate topology information. A system receives traceroute data for a data packet that traverses a path from a source to a destination. The system infers port types for the addresses in the traceroute data and groups subsets of the addresses in the traceroute data into logical nodes based on neighbor relationships demonstrated in backward and forward neighbors sets. The system then generates node and link information based on the inferred and grouped information.

Abstract: Systems and techniques are described for path selection. A packet can be transparently intercepted at an intermediary device. Next, the intermediary device may modify one or more bits in the header of the packet. The intermediary device can then forward the packet to the next hop device. In some network configurations, the modifications to the one or more bits in the header of the packet may cause a downstream device to select a path that is different from the path that would have been selected by the downstream device if the one or more bits in the header of the packet had not been modified. A path selection policy can be used to determine whether or not one or more bits in the header of the packet are to be modified.

Abstract: Systems and techniques are described for performing automatic problem diagnosis. Telemetry data of a system can be analyzed to identify a set of time ranges during which the telemetry data exhibits anomalous behavior. Next, a subset of log entries having a timestamp that is in one of the time ranges in set of time ranges can be extracted from a set of log entries generated by the system. The subset of log entries can then be analyzed, by using natural language processing, to identify a subset of the subset of log entries that has a high likelihood to be associated with one or problems in the system. Next, human-readable text can be extracted from the subset of the subset of log entries. A knowledge database can then be searched by using the human-readable text to identify one or more solutions to resolve the one or more problems in the system.

Abstract: Disclosed herein are system, method, and computer program product embodiments for performing distributed correlation to determine a probable cause for a performance problem detected in an application. An embodiment operates by triggering an alert for a performance metric of an application executing on a local-level node. The alert may be sent to a higher-level node. Upon receiving the alert, the higher-level node may send a distributed correlation request, used to determine a root cause of the alert, to the lower-level node. Upon receiving the distributed correlation request, the lower-level node may produce and send a correlation result to the higher-level node. Upon receiving the correlation result, the higher-level node may select the probable cause of triggering the alert based on the correlation result. The probable cause may then be presented to the user.

Abstract: A graphical user interface for constructing rules to run on an intrusion detection system is described. The user interface includes a field that specifies a first set of nodes on a network by Host-Group, a field that specifies a second set of nodes on a network by Host-Group and a field which determines whether to interpret the first and second host-group fields as Client, server, source, destination or any of these.

Abstract: Systems and techniques are described for dynamically influencing route re-distribution between an exterior gateway protocol (EGP) and an interior gateway protocol (IGP). Some embodiments can dynamically influence which routes are re-distributed into the IGP network for use in cases where traffic destined to that particular remote site is desired to be steered on the desired network/border router. Moreover, some embodiments can dynamically influence route re-distribution from the IGP network to the EGP network for particular destinations so that traffic entering the local site is attracted over a particular network/border router.

Abstract: Antenna arrays and access points are disclosed. An antenna array includes first second, third, and fourth antennas formed in a 2×2 grid on a first surface of a planar substrate. Each of the four antennas is linearly polarized in a first direction and provides a roughly cardiod radiation pattern in a plane normal to the first direction. Nulls of the cardiod radiation patterns of the first and second antennas face the third and fourth antennas, respectively, and nulls of the cardiod radiation patterns of the third and fourth antenna face the first and second antennas, respectively.

Abstract: Systems and techniques are described for controlling injection of a library into a process. Specifically, some embodiments provide an Advanced Injection Rule Engine (AIRE), which uses a set of rules to selectively inject a library, e.g., a dynamic-link library (DLL), into a process. Some embodiments implement a Domain Specific Language (DSL), called AIRE Script, to define the injection rules that are used by the AIRE at runtime.

Abstract: A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Abstract: Transparent network devices intercept unidirectional network traffic and use bidirectional network protocol messages to discover each other and configure an inner connection. A first transparent network device intercepting unidirectional network traffic between a source and destination will send a bidirectional network protocol message addressed to the destination that includes an indicator of its presence. Additional transparent network devices that intercept this network message each add their own indicator to the message. If no response to the bidirectional network message is received, an error message is received, or a response message is received directly from the destination by one of the transparent network devices, this additional transparent network device deduces that it is the closest transparent network device to the destination and sends a response message addressed to the source that includes an indicator of its presence.

Abstract: Systems and techniques are described for performing proxy auto-discovery in an Internet Protocol version 6 (IPv6) network by using the destination options extension header field in the IPv6 header. Specifically, systems and techniques are described to enable a pair of proxies to transparently intercept connection handshake messages that are carried in IPv6 packets between two network nodes, and to use the destination options extension header field in the IPv6 packets to automatically discover each other.

Abstract: To evaluate a network's performance in processing communications related to a target transaction, a set of “reference” communications corresponding to the target transaction are compared to a larger set of communications in the network in a “production” environment, to identify the occurrence of the target transaction in the production environment. Preferably, the reference communications are recorded in a laboratory environment that models the production environment, or recorded from the production environment during a period of minimal other activities. A variety of filters are used to eliminate communications in the production environment that are apparently unrelated to the target transaction, including filters based on the time-order of communications among the nodes, the size of the packets being communicated, and the content of the communications.

Abstract: Systems and techniques are described for performing minimally invasive monitoring of path quality in a network. Specifically, path quality requests and measurements can be piggy-backed on the data traffic that is flowing through a secure connection between two network nodes. For example, path quality requests and measurements can be inserted into the TFC padding field of IP/ESP packets that are being communicated between two IPsec devices. The disclosed embodiments ensure that the number/frequency of measurements increases/decreases naturally in proportion to the amount of traffic flowing, and that the measurement data does not get differential treatment in the network as they are intrinsically bound to the data packets being monitored.

Abstract: Systems and techniques are described for dynamically influencing route re-distribution between an exterior gateway protocol (EGP) and an interior gateway protocol (IGP). Some embodiments can dynamically influence which routes are re-distributed into the IGP network for use in cases where traffic destined to that particular remote site is desired to be steered on the desired network/border router. Moreover, some embodiments can dynamically influence route re-distribution from the IGP network to the EGP network for particular destinations so that traffic entering the local site is attracted over a particular network/border router.

Abstract: Systems and techniques are described for providing visibility into encrypted traffic without requiring access to the private key. Some embodiments can transparently intercept a secure connection handshake that establishes a secure connection between a client and a server, wherein during said transparently intercepting the secure connection handshake, the embodiments can (1) obtain connection information associated with the secure connection, and (2) obtain a session key that the client and server agree on during the secure connection handshake. The connection information and the session key can then be stored in a database, thereby providing visibility into encrypted traffic without requiring access to the private key.

Abstract: In a network including WAN accelerators and segment-oriented file servers, a method comprises responding to a client request to manipulate a file via a network file protocol by receiving a first request at a first WAN accelerator, wherein the request is a request to open a file located at a file server that is a segment-oriented file server, sending a local request for the file, corresponding to the first request, from the WAN accelerator to the file server, using a segment-aware network request protocol, returning at least a portion of the requested file in the form of a representation of a data map corresponding to the at least a portion of the requested file stored on the file server and using a data map for reconstruction of the requested file.

Abstract: A method and system that takes advantage of processes that are efficient for determining the topology of small to medium size networks to determine individual network topologies for such networks, and then merges these individual topologies into a consolidated topology for the entire network. Each of the processes that determines the topology of the smaller networks provides the determined network topology, as well as a list of factors that may be relevant in the determination of how the given topology might be attached to any other given topology, such as the identification of a node that is not included in the given topology, or other indications of external connections. The merging process is configured to substantially restrict its analysis to these factors, thereby limiting the extent, and therefore the time consumed, by this stitching and merging process.