Abstract: An apparatus for optical link fault management includes a processor in a network device with an optical adapter of an optical link, and a memory that stores program code. The program code is executable by the processor to store state parameters from the optical adapter in a data log, input the state parameters from the data log into a failure prediction model, and generate, using the failure prediction model, a probability of failure of the optical adapter based on current state parameters from the data log. In response to the probability of failure reaching a failure threshold, the program code is executable by the processor to decrease data traffic in the optical link and to send an alert comprising the probability of failure. The failure threshold includes a probability of failure indicative of impending failure of the optical adapter.

Abstract: An apparatus includes a message receiver circuit that receives, at a port of a network node, a message from a neighboring network node. The message includes a maximum transmission unit (“MTU”) of the neighboring network node. The network nodes communicate using a layer-2 protocol. The apparatus includes a comparison circuit that determines if the received MTU is larger than an MTU for the port, and an approval circuit that, after determining that the received MTU is larger than the port's MTU, determines if the received MTU is supported by the network node. The method includes an increase circuit that, after determining that the received MTU is supported, changes the MTU of the network node's ports to match the received MTU, and a message circuit that, after determining that the received MTU is supported, sends a message with the MTU to network nodes connected to ports of the network node.

Abstract: An apparatus includes a processor and a memory that stores code executable by the processor to transmit a passenger status message in response to a trigger event indicative of a passenger failing to be picked up at a pickup location by a ride service vehicle. The passenger status message is transmitted to a passenger mobile communication device and a driver. The code is executable to transmit a help message to members of a passenger trusted list in response to receiving a reply to the passenger status message from the passenger indicative of a request for help by the passenger. The code is executable to transmit to a police agency a police request to assist the passenger in response to a trusted list timeout, which is indicative of not receiving a message from a member of the passenger trusted list that indicates the passenger is okay before the trusted list timeout.

Abstract: Methods, apparatuses, and computer program products for telemetry-based network switch configuration validation are disclosed. An analytics engine captures a first network snapshot including telemetry data received from one or more network switches in a first state. Upon receiving a notice indicating that a network configuration change has been applied, the analytics engine initiates a timer in response to receiving the notice. The analytics engine captures, in response to expiration of the timer, a second network snapshot including telemetry data received from the one or more network switches in a second state and compares the first network snapshot and the second network snapshot. In dependence upon the comparison of the first network snapshot to the second network snapshot, the analytics engine validates the network configuration change.

Abstract: Methods, apparatuses, and computer program products for edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks are disclosed. An edge device hosts a virtualized copy of an Internet-of-Things (IoT) device subscribed to one or more publish-subscribe topics. When the edge device receives an indication to activate the virtualized copy of the IoT device, for example, during a DoS attack on the IoT device, the edge device activates the virtualized copy of the IoT device, which receives traffic from the publish-subscribe topic. The virtualized copy of the IoT device applies security policies to incoming traffic received from the subscription topics and transmits to the IoT device sanitized traffic obtained from the received incoming subscription content traffic.

Abstract: A method for link layer authentication includes receiving, at an edge network access node, a link layer authentication packet from a client, seeking network access, using a remote NAS agent running on the edge network access node. The method transmits, using a tunneling connection, the link layer authentication packet to a remote NAS in a link layer authentication process. The link layer authentication process exchanges the link layer authentication packet with an authentication server to authenticate the client. The method includes receiving a link layer authentication packet from the remote NAS over the tunneling connection. The received link layer authentication packet includes a response from the authentication server regarding the transmitted link layer authentication packet.

Abstract: A method for authorization of internet of things (“IoT”) identity bootstrapping includes receiving from a device, at a network access server (“NAS”) of a user and in response to an attestation request sent to the device, a vendor network address of a vendor server of a vendor and a device identifier for the device. The method includes authenticating the vendor using the vendor network address and, in response to authenticating the vendor, sending the device identifier to the vendor server. The method includes communicating device attestation packets between the vendor server and the device. The device attestation packets validate the device to the vendor server. The method includes receiving device attestation from the vendor server. The device attestation indicating validity status of the device to the NAS. The method includes, in response to the device attestation indicating validity of the device, transmitting a new device identity to the device.

Abstract: A method for optimizing telemetry packet for in-band telemetry includes receiving a telemetry packet at a network node in a communication pathway between a sending host sending data packets to a receiving host and determining telemetry data for the network node. The telemetry data includes latency information for data packet processing of the network node. The method includes adding metadata to the telemetry packet, where the metadata is added after a header and a telemetry packet header and after any metadata added by any upstream network nodes. The metadata includes the telemetry data and the metadata overwrites a portion of a payload of the telemetry packet. The method includes, in response to adding the metadata to the telemetry packet, transmitting the telemetry packet to a next destination.

Abstract: An apparatus for in-band telemetry includes a node type identifier circuit that, in response to receiving an ingress/egress ID command, determines that the network node is an ingress node in response to the network node having a direct connection to a source and determines that the network node is an egress node in response to the network node having a direct connection to a destination. The apparatus includes a telemetry packet circuit that creates a telemetry packet in response to the node type identifier circuit determining that the network node is an ingress node. The apparatus includes a telemetry transmission circuit that transmits the telemetry packet in response to the telemetry packet circuit creating the telemetry packet and a packet re-router circuit that, in response to the node type identifier circuit determining that the network node is an egress node, routes a received telemetry packet to a network controller.

Abstract: An apparatus includes a controller adds telemetry data to a telemetry packet transmitted along a communication pathway for data packets being transmitted from a sending host to a receiving host. The controller determines, from the telemetry packet, a number of network nodes in the communication pathway that have added telemetry data to the telemetry packet. The controller transmits the telemetry packet to a next destination along the communication pathway and to a network controller in response to determining that the number of network nodes in the communication pathway that have added telemetry data to the telemetry packet is equal to or greater than a network node threshold. The controller just transmits the telemetry packet to the next destination in response to determining that the number of network nodes in the communication pathway that have added telemetry data to the telemetry packet is less than the network node threshold.

Abstract: An apparatus for reporting node congestion of a queue of an egress port and changing to a different queue is disclosed. The apparatus includes a network node that includes a controller. The controller is configured to determine a level of congestion of a designated queue of an egress port of the network node in a communication pathway between a sending host sending data packets to a receiving host in response to receiving a telemetry packet seeking telemetry data for packets being transmitted between the sending host and the receiving host. The designated queue is designated for queuing data packets for the egress port. The controller is configured to add the level of congestion to the telemetry packet in response to determining that the level of congestion indicates that the designated queue is congested and to transmit the telemetry packet to a next destination on the communication pathway.

Abstract: Methods, apparatuses, and computer programs products for connection parameter awareness in an authenticated link-layer network session are disclosed. A client sends, to a network access server (NAS), an initiation packet announcing the initiation of an authentication session. The client establishes an authenticated link-layer session with the NAS. The client receives, from the NAS, a network policy packet including a network policy defined by one or more connection parameters for the link-layer session. The client then enforces the network policy.

Abstract: Methods, apparatuses, and computer program products for fast resumption of dormant sessions on a client device are disclosed. A client device receives a push notification from a push notification server, the push notification having a payload that includes a datagram packet from an application server that initiated the push notification. A push notification process on the client device extracts the datagram packet from the push notification and injects the datagram packet into a communications protocol stack for at least one application on the client device. The application is awakened from a dormant state and reads the datagram packet. The application may then send a response to the datagram packet to the application server.

Abstract: An apparatus for writing an L2 frame type in a VXLAN header includes a VXLAN stripper configured to strip encapsulation headers in layers above a VXLAN packet encapsulating a L2 frame of a data packet in response to receiving the data packet over a VXLAN. The apparatus includes a L2 frame type reader configured to read a L2 frame type stored in the VXLAN header in response to stripping the encapsulation headers, and a VXLAN re-encapsulator configured to re-encapsulate the VXLAN packet in a same format as the layers and associated encapsulation headers stripped from the received data packet in response to the L2 frame type indicating the L2 frame comprises data for transmission.

Abstract: An apparatus for reporting node congestion of a queue of an egress port and changing to a different queue is disclosed. The apparatus includes a network node that includes a controller. The controller is configured to determine a level of congestion of a designated queue of an egress port of the network node in a communication pathway between a sending host sending data packets to a receiving host in response to receiving a telemetry packet seeking telemetry data for packets being transmitted between the sending host and the receiving host. The designated queue is designated for queuing data packets for the egress port. The controller is configured to add the level of congestion to the telemetry packet in response to determining that the level of congestion indicates that the designated queue is congested and to transmit the telemetry packet to a next destination on the communication pathway.

Abstract: An apparatus for in-band telemetry includes a node type identifier circuit that, in response to receiving an ingress/egress ID command, determines that the network node is an ingress node in response to the network node having a direct connection to a source and determines that the network node is an egress node in response to the network node having a direct connection to a destination. The apparatus includes a telemetry packet circuit that creates a telemetry packet in response to the node type identifier circuit determining that the network node is an ingress node. The apparatus includes a telemetry transmission circuit that transmits the telemetry packet in response to the telemetry packet circuit creating the telemetry packet and a packet re-router circuit that, in response to the node type identifier circuit determining that the network node is an egress node, routes a received telemetry packet to a network controller.

Abstract: An apparatus for writing an L2 frame type in a VXLAN header includes a VXLAN stripper configured to strip encapsulation headers in layers above a VXLAN packet encapsulating a L2 frame of a data packet in response to receiving the data packet over a VXLAN. The apparatus includes a L2 frame type reader configured to read a L2 frame type stored in the VXLAN header in response to stripping the encapsulation headers, and a VXLAN re-encapsulator configured to re-encapsulate the VXLAN packet in a same format as the layers and associated encapsulation headers stripped from the received data packet in response to the L2 frame type indicating the L2 frame comprises data for transmission.

Abstract: An apparatus for load balancing based on available bandwidth estimation includes a bandwidth module configured to determine for a networking device a first available bandwidth estimate for a first egress port and a second available bandwidth estimate for a second egress port, a load balancing module configured to select the first egress port as a selected port in response to determining that the first available bandwidth estimate of the first egress port exceeds a predetermined level and to select the second egress port as the selected port in response to determining that the available bandwidth estimate of the first egress port does not exceed the predetermined level and that the second available bandwidth estimate of the second egress port exceeds the predetermined level, and a transmission module configured to transmit a packet from the selected port. A method and network switching device work similarly to the apparatus.

Abstract: An apparatus for load balancing based on available bandwidth estimation includes a bandwidth module configured to determine for a networking device a first available bandwidth estimate for a first egress port and a second available bandwidth estimate for a second egress port, a load balancing module configured to select the first egress port as a selected port in response to determining that the first available bandwidth estimate of the first egress port exceeds a predetermined level and to select the second egress port as the selected port in response to determining that the available bandwidth estimate of the first egress port does not exceed the predetermined level and that the second available bandwidth estimate of the second egress port exceeds the predetermined level, and a transmission module configured to transmit a packet from the selected port. A method and network switching device work similarly to the apparatus.

Abstract: Hardware of a network switching device supports quantized congestion notification (QCN) to notify senders of network packets received at the network switching device that the network switching device is experiencing congestion. The hardware is instead programmed to notify a processor of the network switching device of the congestion at an egress queue of the network switching device. The processor receives a congestion notification message (CNM) from the hardware that the hardware has detected the congestion at the egress queue. Responsive to receiving the CNM from the hardware, the processor detects a microburst of the network packets at the egress queue of the network switching device.