Abstract: Aspects of the disclosure are directed to monitoring, alerting, and/or root causing network problems based on current network behavior and network events at any instant in time using a network behavior model. The network behavior model can learn and be updated with network states and events to correlate network problems and determine root causes of the network problems for alerting and/or automatic correction.

Abstract: Implementations are provided for building a service function chain in a network that can remove the requirement to encapsulate packet level metadata or other packet levels in a service function chain. The approach allows for implementing service function chains while separating chain metadata from the service function so that service functions are not required to support handling service function chaining metadata. The approach can map a tunnel identifier of an encapsulated data packet to an attachment circuit of a service function and can rewrite the destination media access control (MAC) address of the data packet to the MAC address of the service function.