Abstract: Some embodiments provide a method for evaluating locations of applications in a multi-cloud network with applications located in different cloud datacenters of one or more cloud providers. The method receives data for flows collected from the cloud datacenters. The data for each flow indicates a source and destination of the flow and applications to which at least one of the source and destination of the flow belong. The method uses network topology data to identify a subset of the flows as egress flows, each of which is charged by a cloud provider at which the flow source is located. Based on data from the cloud providers, the method determines a cost for each of the egress flows and a cost associated with each of the applications. The method provides these costs to users of the network for the users to optimize locations of the applications in the different cloud datacenters.

Abstract: This document describes a network policy evaluation platform that evaluates, validates, and troubleshoots network policy configurations. In one aspect, a method includes obtaining a first network policy applied by a container orchestration platform for managing network traffic for a cluster of container workloads. First network rules are extracted from the first network policy. A canonical rule model is generated for the first network rule(s). A second network policy applied by a network provider plugin configured to run within the cluster and to manage the network traffic for the cluster of container workloads is obtained. Second network rules are extracted from the second network policy. A canonical rule model is generated for the one or more second network rules. One or more conflicts between the first network policy and the second network policy are detected based on an evaluation of each first canonical rule model and each second canonical rule model.

Abstract: An example method of identifying a hybrid connection associated with a network flow in a multi-cloud computing system includes: obtaining, by a network analyzer, network information from a plurality of data centers in the multi-cloud computing system, the plurality of data centers corresponding to a respective plurality of namespaces; identifying Internet Protocol (IP) subnetworks associated with the hybrid connection from the network information; generating connection indexes for the namespaces relating source IP subnetworks of the IP subnetworks, destination IP subnetworks of the IP subnetworks, and an identifier for the hybrid connection; searching a source IP address and a destination IP address of a flow record for the network flow in the connection indexes to obtain the identifier for the hybrid connection; and tagging the flow record with the identifier for the hybrid connection.

Abstract: Embodiments described herein generally involve identifying workloads in a multi-site networking environment. Embodiments include determining that a given network is stretched across a first network segment at a first site and a second network segment at a second site. Embodiments include creating a stretched administrative domain for the given network and mapping an address of the given network to the stretched administrative domain in a lookup table for an administrative domain associated with the first network segment. Embodiments include receiving a flow record from an observation point in the first network segment, the flow record having a source IP address associated with the second network segment and a destination IP address associated with the first network segment. Embodiments include identifying a source workload and destination workload of the flow record using the lookup table and a workload identification table that maps combinations of IP addresses and administrative domains to workloads.