Abstract: Exemplary methods include generating a plurality of prefix entries, wherein each prefix entry includes information for associating incoming traffic to a data structure. In one embodiment, the methods further include generating a plurality of data structures, wherein one or more of the plurality of data structures includes a reference to a master entry. In one embodiment, the methods further include generating the master entry, wherein the master entry includes information for determining how to use the data structures to forward incoming traffic to one or more of the plurality of other network devices.

Abstract: A method implemented for a link aggregation group is disclosed. The link aggregation group contains a local interface and a remote interface. The local interface is a logical interface formed by a plurality of network elements including a local network element and a peer network element. The local network element communicates with the peer network element through an inter-peer link. The method starts with determining that the local network element is active by checking that an aggregate state of the links coupled to the local network element is active. The method continues with detecting an anomaly of the active links and sending a notification to the peer network element about the anomaly. Then method continues with receiving an activation confirmation that the peer network element is ready for switching and switching traffic from the active links to the inter-peer link in response to receiving the activation confirmation.

Abstract: A method implemented for a link aggregation group is disclosed. The link aggregation group contains a local interface and a remote interface. The local interface is a logical interface formed by a plurality of network elements including a local network element and a peer network element. The local network element communicates with the peer network element through an inter-peer link. The method starts with determining that the local network element is active by checking that an aggregate state of the links coupled to the local network element is active. The method continues with detecting an anomaly of the active links and sending a notification to the peer network element about the anomaly. Then method continues with receiving an activation confirmation that the peer network element is ready for switching and switching traffic from the active links to the inter-peer link in response to receiving the activation confirmation.

Abstract: A plurality of flow network elements monitors network flows at the subscriber level for a plurality of subscribers. The flow network elements export flow records to a collector, which organizes the flow records. A policy client correlates the flow records and determines whether any network flows are violating a flow policy definition. If a flow policy definition is violated, the policy client transmits a policy action to a policy server which indicates what action to take for a given violating flow. The policy server assigns a flow policy for the subscriber corresponding with the violating flow. The assigned flow policy is then transmitted to the flow network element having that violating flow, and that flow network element installs the flow policy.

Abstract: An improved network flow sampling apparatus and corresponding method more intelligently selects flows to be reported beyond random flow or packet sampling intervals. Evaluation of flows selects top talkers or heavy hitters as important flows that most impact traffic and therefore should be reported. Top talkers are flows defined based on a customized definition according to, for example, number of packets in a flow, number of bytes in a flow, or bandwidth consumed by a flow. An external collector can thus proceed with traffic profiling or other flow monitoring purposes with a more intelligently determined network flow sample.

Abstract: A plurality of flow network elements monitors network flows at the subscriber level for a plurality of subscribers. The flow network elements export flow records to a collector, which organizes the flow records. A policy client correlates the flow records and determines whether any network flows are violating a flow policy definition. If a flow policy definition is violated, the policy client transmits a policy action to a policy server which indicates what action to take for a given violating flow. The policy server assigns a flow policy for the subscriber corresponding with the violating flow. The assigned flow policy is then transmitted to the flow network element having that violating flow, and that flow network element installs the flow policy.

Abstract: An improved network flow sampling apparatus and corresponding method more intelligently selects flows to be reported beyond random flow or packet sampling intervals. Evaluation of flows selects top talkers or heavy hitters as important flows that most impact traffic and therefore should be reported. Top talkers are flows defined based on a customized definition according to, for example, number of packets in a flow, number of bytes in a flow, or bandwidth consumed by a flow. An external collector can thus proceed with traffic profiling or other flow monitoring purposes with a more intelligently determined network flow sample.

Abstract: A plurality of flow network elements monitors network flows at the subscriber level for a plurality of subscribers. The flow network elements export flow records to a collector, which organizes the flow records. A policy client correlates the flow records and determines whether any network flows are violating a flow policy definition. If a flow policy definition is violated, the policy client transmits a policy action to a policy server which indicates what action to take for a given violating flow. The policy server assigns a flow policy for the subscriber corresponding with the violating flow. The assigned flow policy is then transmitted to the flow network element having that violating flow, and that flow network element installs the flow policy.