Abstract: In one example, a method includes receiving a plurality of network probes originating from a first provider edge router in a service provider network, calculating a plurality of network performance metrics, based on the plurality of network probes, and storing the network performance metrics associated with each network probe of the plurality of network probes in a path metric table, wherein an entry in the path metric table for the each network probe includes a path traveled by the each network probe from the first provider edge router to the processing system, the network performance metrics associated with the each network probe, a community value associated with the each network probe, and a traffic classification value associated with the each network probe.

Abstract: A dynamic denial of service (DDoS) mitigation system comprising a BGP address family exchange connected to at least one DDoS mitigation route reflector, and at least one DDoS mitigation route reflector being an address family identifier specific route reflector, where each DDoS mitigation route reflector advertises BGP content in a first address family to the BGP family exchange. The BGP address family exchange translates the BGP content from the first address family to a destination address family and announces the translated content to a destination route reflector, and wherein the destination address family includes a flow specification diversion route.

Abstract: A dynamic denial of service (DDoS) mitigation system comprising a BGP address family exchange connected to at least one DDoS mitigation route reflector, and at least one DDoS mitigation route reflector being an address family identifier specific route reflector, where each DDoS mitigation route reflector advertises BGP content in a first address family to the BGP family exchange. The BGP address family exchange translates the BGP content from the first address family to a destination address family and announces the translated content to a destination route reflector, and wherein the destination address family includes a flow specification diversion route.

Abstract: A system comprising a BAFX adapted to provide a route exchange between dissimilar address family interfaces; wherein the BAFX is a control plane BGP speaker that connects directly to each address family interface specific route reflector and wherein each address family interface specific route reflector advertises its BGP content to the BAFX for translation; and the BAFX translates a received address family interface format into a destination address family interface format and announces a reformatted route address to a destination route reflector.

Abstract: A dynamic denial of service (DDoS) mitigation system comprising a BGP address family exchange connected to at least one DDoS mitigation route reflector, and at least one DDoS mitigation route reflector being an address family identifier specific route reflector, where each DDoS mitigation route reflector advertises BGP content in a first address family to the BGP family exchange. The BGP address family exchange translates the BGP content from the first address family to a destination address family and announces the translated content to a destination route reflector, and wherein the destination address family includes a flow specification diversion route.

Abstract: Methods, computer-readable media and devices are disclosed for generating a security decision for network management traffic for a virtual provider edge router of a network. For example, a processor may receive a security policy of the network, receive an assignment to a virtual provider edge router in the network, receive network management traffic for the virtual provider edge router, generate a security decision for the network management traffic based upon the security policy, and perform a task in response to the security decision.

Abstract: A system comprising a BAFX adapted to provide a route exchange between dissimilar address family interfaces; wherein the BAFX is a control plane BGP speaker that connects directly to each address family interface specific route reflector and wherein each address family interface specific route reflector advertises its BGP content to the BAFX for translation; and the BAFX translates a received address family interface format into a destination address family interface format and announces a reformatted route address to a destination route reflector.

Abstract: Methods, computer-readable media and devices are disclosed for generating a security decision for network management traffic for a virtual provider edge router of a network. For example, a processor may receive a security policy of the network, receive an assignment to a virtual provider edge router in the network, receive network management traffic for the virtual provider edge router, generate a security decision for the network management traffic based upon the security policy, and perform a task in response to the security decision.

Abstract: In a network service provider environment, the service provider infrastructure is protected by separating internet routing from the default context and placing it within a virtual private network context. Packets received from the public internet are encapsulated for transit through the service provider infrastructure based on the packet source being the public internet. MPLS VPN technology may be used in the encapsulation technique. The architecture removes the public part of the underlay network and tunnels it through a new overlay. The result is that internet traffic is contained in a separate routing domain, hiding the network infrastructure from that untrusted service traffic that transits the network.

Abstract: A network routing and service control design enables an internet protocol (“IP”) network to effectively divert, on-demand, a given set of IP traffic flow from its normally followed network path to a network-attached application service processing complex and then enable the IP network to re-inject post-processed (e.g., Distributed Denial of Service scrubbed) traffic back into the network for routing to an originally-intended destination. This design also provides a sophisticated control mechanism for application service providers and/or customers/users for service management purposes. For example, application service providers can manage network and service processing resources and customers/users can manage their service requests.

Abstract: A network routing and service control design enables an internet protocol (“IP”) network to effectively divert, on-demand, a given set of IP traffic flow from its normally followed network path to a network-attached application service processing complex and then enable the IP network to re-inject post-processed (e.g., Distributed Denial of Service scrubbed) traffic back into the network for routing to an originally-intended destination. This design also provides a sophisticated control mechanism for application service providers and/or customers/users for service management purposes. For example, application service providers can manage network and service processing resources and customers/users can manage their service requests.