Abstract: This disclosure describes techniques that include collecting underlay flow data within a network and associating underlay flow data with a source and a destination virtual network to enable insights into network operation and performance. In one example, this disclosure describes a method that includes identifying, for each underlay data flow, a source overlay network and a destination overlay network associated with the underlay data flow, wherein identifying includes retrieving, from one or more Ethernet Virtual Private Network (EVPN) databases, information identifying the source and destination overlay networks.

Abstract: This disclosure describes techniques that include collecting underlay flow data within a network and associating underlay flow data with a source and a destination virtual network to enable insights into network operation and performance. In one example, this disclosure describes a method that includes identifying, for each underlay data flow, a source overlay network and a destination overlay network associated with the underlay data flow, wherein identifying includes retrieving, from one or more Ethernet Virtual Private Network (EVPN) databases, information identifying the source and destination overlay networks.

Abstract: This disclosure describes techniques that include using an automatically trained machine learning system to generate a prediction. In one example, this disclosure describes a method comprising: based on a request for the prediction: training each respective machine learning (ML) model in a plurality of ML models to generate a respective training-phase prediction in a plurality of training-phase predictions; automatically determining a selected ML model in the plurality of ML models based on evaluation metrics for the plurality of ML; and applying the selected ML model to generate the prediction based on data collected from a network that includes a plurality of network devices.

Abstract: This disclosure describes techniques that include using an automatically trained machine learning system to generate a prediction. In one example, this disclosure describes a method comprising: based on a request for the prediction: training each respective machine learning (ML) model in a plurality of ML models to generate a respective training-phase prediction in a plurality of training-phase predictions; automatically determining a selected ML model in the plurality of ML models based on evaluation metrics for the plurality of ML; and applying the selected ML model to generate the prediction based on data collected from a network that includes a plurality of network devices.

Abstract: This disclosure describes techniques that include using an automatically trained machine learning system to generate a prediction. In one example, this disclosure describes a method comprising: based on a request for the prediction: training each respective machine learning (ML) model in a plurality of ML models to generate a respective training-phase prediction in a plurality of training-phase predictions; automatically determining a selected ML model in the plurality of ML models based on evaluation metrics for the plurality of ML; and applying the selected ML model to generate the prediction based on data collected from a network that includes a plurality of network devices.

Abstract: This disclosure describes techniques that determine device connectivity in the absence of a network layer 2 discovery protocol such as Link Layer Discovery Protocol (LLDP). In one example, this disclosure describes a method that includes retrieving, from a bridge data store of a bridge device on a network having one or more host devices, a plurality of first interface indexes, wherein each first interface index corresponds to a network interface of network interfaces of the bridge device; retrieving, from the bridge data store, remote network addresses corresponding to the network interfaces of the bridge device, each remote network address of the remote network addresses corresponding to a second interface index; selecting a remote network address having a second interface index that matches the first interface index; determining a host device having the selected remote network address; and outputting an indication that the bridge device is coupled to the host device.

Abstract: This disclosure describes techniques that determine device connectivity in the absence of a network layer 2 discovery protocol such as Link Layer Discovery Protocol (LLDP). In one example, this disclosure describes a method that includes retrieving, from a bridge data store of a bridge device on a network having one or more host devices, a plurality of first interface indexes, wherein each first interface index corresponds to a network interface of network interfaces of the bridge device; retrieving, from the bridge data store, remote network addresses corresponding to the network interfaces of the bridge device, each remote network address of the remote network addresses corresponding to a second interface index; selecting a remote network address having a second interface index that matches the first interface index; determining a host device having the selected remote network address; and outputting an indication that the bridge device is coupled to the host device.

Abstract: This disclosure describes techniques that include using an automatically trained machine learning system to generate a prediction. In one example, this disclosure describes a method comprising: based on a request for the prediction: training each respective machine learning (ML) model in a plurality of ML models to generate a respective training-phase prediction in a plurality of training-phase predictions; automatically determining a selected ML model in the plurality of ML models based on evaluation metrics for the plurality of ML; and applying the selected ML model to generate the prediction based on data collected from a network that includes a plurality of network devices.

Abstract: A computing system stores rule data for an application. The rule data for the application specifies characteristics of flows that occur within a network and that are associated with the application. The computing system may collect a stream of flow datagrams from the network. Additionally, the computing system may identify, based on the rule data for the application, flow datagrams in the stream of flow datagrams that are associated with the application. The computing system may generate a stream of application-enriched flow datagrams based on the identified flow datagrams. The application-enriched flow datagrams include data indicating the application. Furthermore, the computing system may process a query for results based on the application-enriched flow datagrams.

Abstract: This disclosure describes techniques that include collecting underlay flow data within a network and associating underlay flow data with a source and a destination virtual network to enable insights into network operation and performance. In one example, this disclosure describes a method that includes identifying, for each underlay data flow, a source overlay network and a destination overlay network associated with the underlay data flow, wherein identifying includes retrieving, from one or more Ethernet Virtual Private Network (EVPN) databases, information identifying the source and destination overlay networks.