Abstract: Systems, methods, and computer-readable media for aggregating and presenting network events in a network environment. In some embodiments, a system can maintain event correlation rules for aggregating \network events occurring in a network based on characteristics of previously occurring network events. Network events occurring in the specific network environment can be identified. The network events can be aggregated to form an aggregated network event using the event correlation rules maintained based on the characteristics of previously occurring network events. The aggregated network event can subsequently be presented to a user.

Abstract: Systems, methods, and computer-readable media for clustering events occurring in a network environment for providing network assurance. In one embodiment, a system can identify event states of network events defined by values of parameters of a network environment. The system can determine a confidence score that at least one of the values of parameters is associated with a specific event state using the network events and the identified event states of the network events. The confidence score can be presented to a user for purposes of providing network assurance for the network environment.

Abstract: Aspects of the technology provide methods for simulating a failure in a tenant network. In some aspects, a monitoring appliance of the disclosed technology can be configured to carry out operations for receiving packets at a virtual device in the monitoring appliance, from a corresponding network device in the tenant network, and instantiating a firewall at the virtual device, wherein the firewall is configured to selectively block traffic routed from the network device to the virtual device in the monitoring appliance. The monitoring appliance can simulate failure of the network device by blocking traffic from the network device to the virtual device using the firewall, and analyze the tenant network to determine a predicted impact a failure of the network device would have on the tenant network. Systems and machine-readable media are also provided.

Abstract: Aspects of the technology provide methods for aggregating error log data between multiple devices in a network monitoring appliance. A method of the technology can include steps for identifying a plurality of operators running in a network monitoring appliance, instantiating a plurality of sensors, wherein each of the plurality of sensors is associated with a respective one of the plurality of operators, and wherein each sensor is configured to capture error log data of its corresponding operator. In some aspects, the method can further include steps for aggregating error log data from two or more of the plurality of sensors. Systems and machine-readable media are also provided.

Abstract: Aspects of the technology provide systems and methods for interleaving a processing task in a network monitoring appliance. A process of the technology could include steps for identifying operators in the network monitoring appliance, wherein the operators are sequentially arranged to form a processing pipeline, determining an epoch for the processing pipeline, wherein the epoch corresponds with a time duration required for a processing task to traverse the pipeline, and determining a time window in which a supplemental processing task can be interleaved into the processing pipeline, wherein the time window is based on the epoch. Machine-readable media are also provided.

Abstract: Systems, methods, and computer-readable media for improving debugging and troubleshooting of datacenter networks, and more particularly improving the speed of forwarding/data path related problems without going into ASIC level debugging. A switch could, for example, have a processor which communicates with an ASIC. The processor can receive flow information and a notification from the ASIC, the notification indicating a predefined error condition has been identified in a packet. The processor can modify the ASIC programming based on the notification, such that the ASIC records additional, more-detailed, flow information for the switch. The processor can then receive, from the modified ASIC, the additional flow information. The additional flow information can then be used (either by the processor or by an operator) to identify the exact reason for the errors in the flow path.

Abstract: Systems, methods, and computer-readable media for improving debugging and troubleshooting of datacenter networks, and more particularly improving the speed of forwarding/data path related problems without going into ASIC level debugging. A switch could, for example, have a processor which communicates with an ASIC. The processor can receive flow information and a notification from the ASIC, the notification indicating a predefined error condition has been identified in a packet. The processor can modify the ASIC programming based on the notification, such that the ASIC records additional, more-detailed, flow information for the switch. The processor can then receive, from the modified ASIC, the additional flow information. The additional flow information can then be used (either by the processor or by an operator) to identify the exact reason for the errors in the flow path.

Abstract: Systems, methods and computer-readable storage devices each provide, for a given flow entry in a flow table associated with a packet flow, a first atomic counter associated with a first color and a second atomic counter associated with a second color. The system, for a first coloring interval, marks traffic in the packet flow from a tenant to a fabric as the first color and increments the first atomic counter. At a conclusion of the first coloring interval and for a second coloring interval, the system marks the traffic in the packet flow from the tenant to the fabric as the second color and increments the second atomic counter. The system compares first packet counts associated with the first color at an ingress point with second packet counts associated with the first color at an egress point to the fabric.