Abstract: A method and system for detecting and preventing data exfiltration attacks is disclosed. The system includes a manager device and an endpoint device, and an attack prevention device. The method includes detecting, at plurality of endpoint devices, downloads made at endpoint devices using Simple Network Management Protocol (SNMP) proxy. Next, the method includes mirroring network traffic associated with the downloads. The method further includes providing the mirrored network traffic as an input to a deep learning model, wherein the deep learning model detects presence of malware in the downloads. Finally, the method involves sending, by the manager device, an alert to one or more devices to prevent, recover, or mitigate data exfiltration attacks.

Abstract: A method and system for streaming management information base data using simple network management protocol is disclosed. The system includes a manager device and an endpoint device, which runs a SNMP agent and SNMP proxy. The SNMP proxy retrieves MIB data from the SNMP Agent associated with the endpoint device, wherein the MIB data comprises a full MIB sub-tree and differential MIB sub-trees. MIB views comprising MIB variables of interest associated with a full MIB sub-tree and differential MIB sub-trees are created based on a predetermined configuration. The SNMP proxy stores the MIB views and corresponding MIB data in a data store and compresses the MIB views and MIB data into files. Compressed file of the MIB view with MIB data associated with full MIB sub-tree are sent to the manager device in an initial stream. Further, the endpoint device streams compressed file of the MIB views with MIB data associated with the differential MIB sub-tree to the manager device on receiving a request.

Abstract: An in-band telemetry congestion notification system includes a source device that generates and transmits packets. Each of a plurality of switch devices receives each of the packets, provides in-band telemetry information in each of the packets, and transmits each of the packets to a destination device. When the destination device receives a first subset of the packets, it uses the in-band telemetry information included in each of the first subset of the packets to determine a telemetry information baseline. Subsequent to determining the telemetry information baseline, when the destination device receives a second subset of the packet, it uses the in-band telemetry information included in each of the second subset of the packets to determine a departure from the telemetry information baseline that indicates congestion and, in response, generates a congestion notification and transmits the congestion notification via the plurality of switch devices to the source device.

Abstract: Embodiments of the present disclosure comprise considering the performance of an application under different candidate physical network topology configurations for a set of virtual machines (VMs) for an application. Given different physical network topologies corresponding to the logical topology for the application, each physical network topology may be analyzed to quantify the performance of the application based upon one or more metrics. In one or more embodiments, the metrics may include throughput, latency, and network resource usage, and these metrics may be formed into a performance set. The set of values provide a means by which the different physical network topology deployments may be compared. Based upon the comparison, a deployment of the VMs on the physical network topology may be selected and implemented; or alternatively, when input expected application performance parameters are satisfied by the metrics, the corresponding physical topology may be chosen.

Abstract: A multicast system includes a networking device. A server subsystem is coupled to the networking device. A source device is coupled to the networking device and is configured to generate a data stream, and transmit the data stream as a unicast communication that is directed through the networking device to the server subsystem. A receiver device is coupled to the networking device and is configured to transmit a request to join the data stream. A management subsystem is coupled to the networking device and is configured to receive the request that was transmitted by the receiver device. Based on the request, the management subsystem configures the networking device to replicate the data steam received as the unicast communication that is directed to the server subsystem to provide a replicated data stream, and transmit the replicated data stream as a unicast communication that is directed to the receiver device.

Abstract: Embodiments of the present disclosure comprise considering the performance of an application under different candidate physical network topology configurations for a set of virtual machines (VMs) for an application. Given different physical network topologies corresponding to the logical topology for the application, each physical network topology may be analyzed to quantify the performance of the application based upon one or more metrics. In one or more embodiments, the metrics may include throughput, latency, and network resource usage, and these metrics may be formed into a performance set. The set of values provide a means by which the different physical network topology deployments may be compared. Based upon the comparison, a deployment of the VMs on the physical network topology may be selected and implemented; or alternatively, when input expected application performance parameters are satisfied by the metrics, the corresponding physical topology may be chosen.

Abstract: A method and system for detecting and preventing data exfiltration attacks is disclosed. The system includes a manager device and an endpoint device, and an attack prevention device. The method includes detecting, at plurality of endpoint devices, downloads made at endpoint devices using Simple Network Management Protocol (SNMP) proxy. Next, the method includes mirroring network traffic associated with the downloads. The method further includes providing the mirrored network traffic as an input to a deep learning model, wherein the deep learning model detects presence of malware in the downloads. Finally, the method involves sending, by the manager device, an alert to one or more devices to prevent, recover, or mitigate data exfiltration attacks.

Abstract: A multicast system includes a source device and a plurality of receiver devices connected by switches that are also coupled to a switch controller. The switch controller receives source device information for the source device from its connected first switch, and receives receiver device information for each of the receiver devices from their respective connected second switches. The switch controller uses the source device information and receiver device information to construct a multicast tree that includes switches capable of transmitting multicast communications from the source device to each of the receiver devices. The switch controller then programs at least some of the switches so that a multicast data communication from the source device is segment routed to a third switch, and replicated by the third switch to produce replicated multicast data communications that are each segment routed to at least some of the receiver devices through their respective second switches.

Abstract: A method and system for streaming management information base data using simple network management protocol is disclosed. The system includes a manager device and an endpoint device, which runs a SNMP agent and SNMP proxy. The SNMP proxy retrieves MIB data from the SNMP Agent associated with the endpoint device, wherein the MIB data comprises a full MIB sub-tree and differential MIB sub-trees. MIB views comprising MIB variables of interest associated with a full MIB sub-tree and differential MIB sub-trees are created based on a predetermined configuration. The SNMP proxy stores the MIB views and corresponding MIB data in a data store and compresses the MIB views and MIB data into files. Compressed file of the MIB view with MIB data associated with full MIB sub-tree are sent to the manager device in an initial stream. Further, the endpoint device streams compressed file of the MIB views with MIB data associated with the differential MIB sub-tree to the manager device on receiving a request.

Abstract: An inter-datacenter multicast system includes a first datacenter connected to a second datacenter. A first multicast router device is located in the first datacenter and includes at least one first multicast router interface that provides a link to the second datacenter, and a second multicast router device is located in the second datacenter and includes at least one second multicast router interface that provides a link to the first datacenter. The first multicast router device and the second multicast router device sync multicast routes with each other to enable each to act as respective designated routers, and also each remove multicast router interfaces that provides links to the other datacenter from outgoing interface Virtual Local Area Networks (VLANs) that are part of a multicast route, which prevents traffic tromboning and reduces multicast data communications between the first datacenter and the second datacenter.

Abstract: A layer 2 load balancing system includes server devices that provide virtual machines that each share a virtual Media Access Control (MAC) address. A switch device is coupled to each of the server devices via respective ports on the switch device. The switch device receives the virtual MAC address during a time period via each of the respective ports connected to the server devices and, in response, identifies a server device cluster that shares the virtual MAC address. When the switch device receive packets that are part of a packet flow and that are directed to the virtual MAC address, it then directs each of the packets that are part of the packet flow to one of the virtual machines that is provided on one of the server devices in the server device cluster.

Abstract: An in-band telemetry congestion notification system includes a source device that generates and transmits packets. Each of a plurality of switch devices receives each of the packets, provides in-band telemetry information in each of the packets, and transmits each of the packets to a destination device. When the destination device receives a first subset of the packets, it uses the in-band telemetry information included in each of the first subset of the packets to determine a telemetry information baseline. Subsequent to determining the telemetry information baseline, when the destination device receives a second subset of the packet, it uses the in-band telemetry information included in each of the second subset of the packets to determine a departure from the telemetry information baseline that indicates congestion and, in response, generates a congestion notification and transmits the congestion notification via the plurality of switch devices to the source device.

Abstract: A layer 2 load balancing system includes server devices that provide virtual machines that each share a virtual Media Access Control (MAC) address. A switch device is coupled to each of the server devices via respective ports on the switch device. The switch device receives the virtual MAC address during a time period via each of the respective ports connected to the server devices and, in response, identifies a server device cluster that shares the virtual MAC address. When the switch device receive packets that are part of a packet flow and that are directed to the virtual MAC address, it then directs each of the packets that are part of the packet flow to one of the virtual machines that is provided on one of the server devices in the server device cluster.

Abstract: A multicast system includes a networking device. A server subsystem is coupled to the networking device. A source device is coupled to the networking device and is configured to generate a data stream, and transmit the data stream as a unicast communication that is directed through the networking device to the server subsystem. A receiver device is coupled to the networking device and is configured to transmit a request to join the data stream. A management subsystem is coupled to the networking device and is configured to receive the request that was transmitted by the receiver device. Based on the request, the management subsystem configures the networking device to replicate the data steam received as the unicast communication that is directed to the server subsystem to provide a replicated data stream, and transmit the replicated data stream as a unicast communication that is directed to the receiver device.

Abstract: An inter-datacenter multicast system includes a first datacenter connected to a second datacenter. A first multicast router device is located in the first datacenter and includes at least one first multicast router interface that provides a link to the second datacenter, and a second multicast router device is located in the second datacenter and includes at least one second multicast router interface that provides a link to the first datacenter. The first multicast router device and the second multicast router device sync multicast routes with each other to enable each to act as respective designated routers, and also each remove multicast router interfaces that provides links to the other datacenter from outgoing interface Virtual Local Area Networks (VLANs) that are part of a multicast route, which prevents traffic tromboning and reduces multicast data communications between the first datacenter and the second datacenter.

Abstract: Aspects of the present invention include optimizing selection of a replication data node in a Hadoop Distributed File System. In embodiments of the present invention, optimizing the replication data node selection can be based on a priorities based algorithm. In embodiments of the present invention, optimizing replication data node selection can be based on a relative comparison of parameters.

Abstract: Embodiments of the present invention comprise systems and methods for monitoring communication connectivity between applications remotely separated from each other in a network. The system includes: one or more processors; a memory communicatively coupled to the one or more processors; a network interface communicatively coupled to the one or more processors; and an agent communicatively coupled to the network interface and configured to: receive a registration for an application operating on the information handling system; monitor a liveliness status of a communication session between the agent and a remote agent operating on a remote information handling system, the communication session being enabled via the network interface; and notify the application of a fault in the communication session responsive to detecting that the fault exists.

Abstract: A multicast system includes a source device and a plurality of receiver devices connected by switches that are also coupled to a switch controller. The switch controller receives source device information for the source device from its connected first switch, and receives receiver device information for each of the receiver devices from their respective connected second switches. The switch controller uses the source device information and receiver device information to construct a multicast tree that includes switches capable of transmitting multicast communications from the source device to each of the receiver devices. The switch controller then programs at least some of the switches so that a multicast data communication from the source device is segment routed to a third switch, and replicated by the third switch to produce replicated multicast data communications that are each segment routed to at least some of the receiver devices through their respective second switches.

Abstract: Embodiments of the present invention comprise systems and methods for monitoring communication connectivity between applications remotely separated from each other in a network. The system includes: one or more processors; a memory communicatively coupled to the one or more processors; a network interface communicatively coupled to the one or more processors; and an agent communicatively coupled to the network interface and configured to: receive a registration for an application operating on the information handling system; monitor a liveliness status of a communication session between the agent and a remote agent operating on a remote information handling system, the communication session being enabled via the network interface; and notify the application of a fault in the communication session responsive to detecting that the fault exists.

Abstract: An information handling system is provided. The information handling system includes a first network device that forms at least part of a first set of network devices. The first network device provides an interface between a local first server rack and a cloud and has one or more processors in communication with a memory. The first network device is configured to receive information from a second set of network devices that identifies a default gateway for a virtual machine running on a remote server rack. The first network device is also configured to create a local destination address entry associated with information, to store the entry in an address table in the memory, and to receive a packet having the information identifying the default gateway as a destination address. The first network device is further configured to forward the packet into the cloud on in proxy for the default gateway.