Abstract: Techniques for performing near-uniform load balancing in a visibility network based on usage prediction are provided. According to one embodiment, a packet broker of the visibility network can receive a control packet replicated from a core network, where the control packet includes a user or device identifier and a request to create a user session for a user identified by the user/device identifier. The packet broker can further determine, based on the user/device identifier and one or more other parameters, a rank value for the user session, where the rank value indicates an amount of network traffic that the user is likely to generate in the core network during the user session. The packet broker can then select an egress port for the user session based on the rank value and forward subsequent control and data traffic for the user session through the selected egress port.

Abstract: Techniques for performing anomaly detection and prediction in a packet broker of a visibility network are provided. According to one embodiment, the packet broker can apply one or more machine learning models to network traffic that is replicated from a core network. The packet broker can further detect or predict, based on the application of the one or more machine learning models, the occurrence of a network traffic anomaly in the core network. The packet broker can then take one or more predefined actions in response to the detection/prediction of the anomaly.