Abstract: A method of identifying differences between activity data files includes determining a difference between the activity data files. Causal analysis may be performed to identify a cause of the difference. The difference and/or the cause of the difference may be rendered based on a rendering template. Tier pairs between the activity data files may be matched and a user may be queried to confirm the tier pair match. Statistical and/or protocol differences between each of the activity files may be presented. Transactions between each of the activity data files may be matched including comparing the content files in each of the activity data files that account for the transactions. Client side differences between each of the activity data files may be identified. A categorization may be assigned to each of the determined differences. Determined differences may be excluded from the rendering.

Abstract: Apparatus for routing requests from a plurality of connected clients to a plurality of connected servers comprises a processor, memory and a network interface. The processor is configured to run a plurality of identical processes, each being for receiving requests and connecting each received request to a server. For each process, the processor is configured to maintain a queue of requests in memory, determine a number of queued requests that may be connected to a server, and attempt to connect this number of queued requests. The processor then accepts further requests, and if the queue is not empty, places the further requests in the queue, and if the queue is empty, attempts to connect the further requests. The processor determines the number of queued requests that may be connected to a server in dependence upon the length of the queues of all the processes and the number of available connections.

Abstract: A user interface of a device for displaying a representation of a network of objects wherein a plurality of selectable objects are rendered, and each of the plurality of selectable objects are rendered having a given positioning relative to each other of the plurality of selectable objects. One or more edges are rendered interconnecting the plurality of selectable objects within a first region of the user interface. A second region is rendered in response to one or more of the selectable objects of the first region being selected. Objects corresponding to the selected objects are depicted in the second region while maintaining the given relative positioning. A number of additional objects may be retrieved from a database that indicates objects that are adjoining the corresponding objects. The adjoining objects are positioned in the second region and are interconnected to the corresponding objects by one or more additional edges.

Abstract: Embodiments provide systems, methods, and computer program products for inferring the switch port connectivity of discovered but unmanaged devices in a network without direct access to the devices. Embodiments operate by generating a physical address-to-port map based on collected operational data and then pruning the generated map based on switch port connectivity information and/or inferred link connectivity information. The switch port connectivity of discovered unmanaged devices is then generated or updated based on the pruned map. The switch port connectivity information can be used by various other tools to enable diagramming, asset inventory, and network planning, design, and optimization workflows.

Abstract: A security policy database identifies the intended security policies within a network, a traffic generator provides test traffic that is configured to test each defined security policy, and a simulator simulates the propagation of this traffic on a model of the network. The model of the network includes the configuration data associated with each device, and thus, if devices are properly configured to enforce the intended security policies, the success/failure of the simulated test traffic will conform to the intended permit/deny policy of each connection. Differences between the simulated message propagation and the intended security policies are reported to the user, and diagnostic tools are provided to facilitate identification of the device configuration data that accounts for the observed difference. Additionally, if a network's current security policy is unknown, test traffic is generated to reveal the actual policy in effect, to construct a baseline intended security policy.

Abstract: Traffic flow between each pair of nodes in a network may be modeled based on loads measured at each link and based on gravity measures associated with each node. Gravity measures correspond to a relative likelihood of the node being a source or a sink of traffic. Gravity objectives are assigned to nodes to serve as an objective for a node's performance. These gravity objectives may be based on qualitative characteristics associated with each node. Because the assigned gravity objectives may be subjective, the gravity measures are used to generate a quantitative function for determining whether a network can achieve these gravity objectives. In one embodiment, link loads are allocated to traffic flows between nodes and current gravity measures are determined. Changes to link loads and traffic flows may then be modeled to minimize a difference between the assigned gravity measures and the gravity measures.

Abstract: Embodiments provide systems, methods, and computer program products for network management application to automatically determine a session prompt for a network device and perform error handling. After logging in to a network device, the network management application records the first session prompt response. The network management application sends a series of empty carriage returns and random characters and records the session prompt responses. The network management application compares the responses and determines whether the prompt is a static or a dynamic prompt based on the results. The network management application elicits error responses from the network device by sending additional random characters and records the results in an error handling dictionary. The error handling dictionary is used later when running user-provided commands, enabling a determination of whether a command executed successfully.

Abstract: Self-discovering transaction accelerators improve communications between a client and a server. A client directs a message to a server. A client-side transaction accelerator intercepts the message, terminates the connection with the client, and accelerates the request by replacing segments of data with references. The accelerated request is forwarded to a server-side transaction accelerator through a new connection. The server-side transaction accelerator reconstructs the message by replacing the reference with segment data in a persistent segment store accessible to the server-side transaction accelerator. The reconstructed request is then provided to the server. Accelerations may occur in any direction of communication. Persistent segment stores can be pre-populated with segment data from other transaction accelerators and anticipated transactions.

Abstract: Methods are provided for efficiently storing data to a data storage device or subsystem. The data storage device may be a Solid-State Device (SSD), and may be implemented as part of a RAID (Redundant Array of Independent Disks) or other subsystem. When existing data is read and updated, and must be re-stored, the data is assembled and stored as if it were new data, and is written in a sequential manner, instead of being written to the same storage location. A newer generation number distinguishes it from the previous version. If the storage subsystem employs data striping, stripe size may be matched with the size of a logical collection of data (e.g., an extent), so that each such logical collection of data is wholly stored on just device in the storage subsystem. Concurrent device access may be supported by concurrently writing substripes of data to each device/extent.

Abstract: Digital certificates are distributed to WAN optimization modules in organization and content delivery networks to securely optimize network traffic. The content delivery network identifies edge WAN optimization modules for use with each combination of organizations and their cloud services and distributes digital certificates accordingly. Peering digital certificates for establishing inner connections between organization and edge WAN optimization modules are exchanged via one or more management portals. Shadow digital certificates for establishing outer connections between WAN optimization modules and clients are generated in the form of certificate signing requests. Configuration information identifies any additional cloud services associated with a given cloud service and generate corresponding additional certificate signing requests.

Abstract: Apparatus for processing requests from a plurality of connected clients for data stored by a plurality of connected servers comprising a processor, memory, storage, a network interface, and a user input device is disclosed. The processor is configured to receive requests from the connected clients via the network interface, select a connected server to route each requests to, thereby defining a selected server per request, create a connection per request to its selected server using the network interface, route the requests to their selected servers using the connections, and monitor the connections while the selected servers service the requests, so as to create monitored connection data for each connection. The monitored connection data is stored in data structures that are referenced by a buffer, and upon creation of a data structure relating to the most recently created connection, reference to the oldest data structure in the buffer is removed.

Abstract: A system and method determines correlations within multi-tier communications based on repeated iterations/episodes of executions of a target application. Content-based correlations are determined by encoding the content using a finite alphabet, then searching for similar sequences among the multiple traces. By encoding the content to a finite alphabet, common pattern matching techniques may be used, including, for example, DNA alignment algorithms. To facilitate alignment of the traces, structural and/or semantic breakpoints are defined, and the encoding in each trace is synchronized to these breakpoints. To facilitate efficient processing, a hierarchy of causality among tier-pairs is identified, and messages at lower levels are ranked and temporally filtered, based on activity intervals at higher levels of the hierarchy.

Abstract: Embodiments provide systems, methods, and computer program products for dynamically hooking multiple levels of application code. A server receives identifying information that identifies a target function of a target application to hook. The server pauses a target process of the target application. The server locates the target function within the target application code based on the received identifying information. The server then hooks the located function outside of the target application, thereby creating hooked code during application runtime.

Abstract: Embodiments provide a data persisting mechanism that allows for efficient, unobtrusive persisting of large volumes of data while optimizing the use of system resources by the persisting process. In an embodiment, the persisting process includes a self-tuning algorithm that constantly monitors persistence performance and that adjusts persistence time to maintain performance within user-defined criteria. From one aspect, this allows the persisting process to seamlessly adapt to changes in system environment (speeding up persistence during times of low processor usage and slowing down persistence during times of high processor usage) and to reduce or eliminate CPU spikes caused by persisting process. From another aspect, the persisting process results in the data being persisted as quickly as possible given the system constraints, thereby minimizing the possibility of data loss.

Abstract: Data units within a de-duplication device are stored in single instances within a database of data units and then referenced as many times as necessary within a referencing dictionary, potentially achieving substantial compaction of the referencing dictionary and thus the storage requirement of the de-duplication device as a whole.

Abstract: A hybrid approach to populating forwarding tables in a virtual network obtains forwarding data both by simulating routing protocol behavior in the virtual network to build forwarding tables, and by importing operational forwarding data from corresponding physical nodes in a physical network. The use of operational forwarding data improves the fidelity of the simulation by closely conforming forwarding behavior in the simulation to that which occurs in the physical network.

Abstract: An access discovery method and system discovers and stores the proper access protocol for each device on a network. The discovery process includes progressively sequencing through state transitions until a successful access protocol sequence is determined, and an access script corresponding to this sequence is stored for subsequent access to the device. Preferably, the protocol-discovery algorithm is modeled as a state table that includes a start state and two possible terminal states: success and failure. A state machine executes the state table until a terminal state is reached; if the terminal state is a failure, the system backtracks to attempt an alternative sequence. The process continues until the success state is reached or until all possible sequences are executed without success. An exemplary state model is provided that has been shown to be effective for modeling network devices from a variety of vendor devices.

Abstract: The locations of nodes in a network are determined relative to the location of monitoring devices that collect trace information on the network. By appropriate sorting, filtering, and characterizing the trace information, nodes are identified as being local to or remote from each monitoring device that detects traffic to or from the node. If the trace information is insufficient to determine the relative location of a node, the node is identified as such. By identifying the nodes whose locations can be determined automatically by this analysis of the trace information, the number of nodes whose locations must be determined by more costly manual methods can be substantially reduced.

Abstract: The connectivity information provided by a variety of inference engines is integrated to provide a set of inferred links within a network. A consolidation is performed among inference engines that operate at a base level of connectivity detail to create a model of the network at this base level. The connectivity information provided by inference engines at each subsequent higher level of connectivity abstraction is then overlaid on the base level connectivity. By separately consolidating the connectivity information at each level of abstraction, the rules for dealing with conflicts can be simplified and/or better focused to resolve the conflict. By assuming that the more detailed lower level information is likely to be more accurate, rules can be developed to modify the connectivity models produced by the higher level techniques to conform to the lower level connectivity details while still maintaining the integrity of the higher level connectivity models.

Abstract: A network analysis system invokes an application specific, or source-destination specific, path discovery process. The application specific path discovery process determines the path(s) used by the application, collects performance data from the nodes along the path, and communicates this performance data to the network analysis system for subsequent performance analysis. The system may also maintain a database of prior network configurations to facilitate the identification of nodes that are off the path that may affect the current performance of the application. The system may also be specifically controlled so as to identify the path between any pair of specified nodes, and to optionally collect performance data associated with the path.