Abstract: Systems and methods are provided for self-tuning networks using distributed analytics for network devices. In some embodiments, the method includes instantiating, in a network device, an agent for a network protocol, wherein the agent: monitors a performance parameter for a resource of the network protocol, and responsive to a value of the performance parameter exceeding a threshold value, reports an anomaly for the network protocol to a remote management server, receives a new threshold value from the remote management server, the new threshold value being based on the anomaly reported by the network device, and anomalies reported by other network devices according to respective thresholds employed by the network devices for the performance parameter for the resource of the network protocol, and replaces the threshold value of the performance parameter for the resource of the network protocol with the new threshold value received from the remote management server.

Abstract: Systems and methods are provided for self-tuning networks using distributed analytics for network devices. In some embodiments, the method includes instantiating, in a network device, an agent for a network protocol, wherein the agent: monitors a performance parameter for a resource of the network protocol, and responsive to a value of the performance parameter exceeding a threshold value, reports an anomaly for the network protocol to a remote management server, receives a new threshold value from the remote management server, the new threshold value being based on the anomaly reported by the network device, and anomalies reported by other network devices according to respective thresholds employed by the network devices for the performance parameter for the resource of the network protocol, and replaces the threshold value of the performance parameter for the resource of the network protocol with the new threshold value received from the remote management server.

Abstract: Examples disclosed herein relate to a method comprising monitoring a first condition corresponding to a first parameter in a first database. The first database is configured to operate a first switch operating traffic on a network and the first database periodically synching with a second database. The method may also include monitoring a second parameter, corresponding to the first parameter, on the second database. The second database may be configured to operate a second switch on the network and the first switch and the second switch configured to operate traffic on the network. The method may also include determining that there is a deviation between the first and second that exceeds a threshold amount and transmitting an alert containing the deviation.

Abstract: A network communication device executes both a service function related to processing network traffic and a lower priority monitoring function. The network device performs an event ingestion throttling method to process events while deferring to the higher priority function. The method includes obtaining an event for a first queue from a plurality queues the event responsive to a change in a local database of the network communication device. Determining if an event queue entry is available or if the event queue is full. Determining if a total of in-use queue entries is higher than a threshold. Using an event scheduler monitor function to determine whether or not to initiate throttling of events for the monitor function in favor of the service function based on a combination of either individual queues becoming full or a backlog across all queues representing a reason to initiate throttling.

Abstract: Disclosed are a non-transitory computer readable medium, system, and method to provide a network analytics engine (NAE) and corresponding NAE infrastructure. The NAE infrastructure may determine functions to be offloaded from a high-level interpreted scripting language agent script to specialized executables. The specialized executables may execute and perform functions on behalf of portions of the agent script while the agent script and the interpreter of the agent script are not loaded on the network communication device executing the specialized executables. Callbacks may be provided to invoke portions of the agent script as needed. A plurality of different specialized executables may monitor data values and event evaluation rules on behalf of a set of agent scripts and provide feedback via the NAE.

Abstract: Disclosed is a method, system, and computer readable medium to provide an implementation to provide proxy style support for multiple virtual routing and forwarding (VRF) instances on a single network communication device. The proxy style support includes instantiating a plurality of pairs of namespaces and instances of a Unix service, each of the plurality of pairs representing a pair to support a single instance of a VRF. The network communication device may receive a network request associated with a network address mapped to a first VRF from a client device. The network request may be proxied from the pair of namespace/service supporting the first VRF to a backend single instance of a proxy server. Communication across independent namespaces may be supported by using a local communication mechanism (e.g., Unix sockets, Winsock) to provide support for the multiple VRFs concurrently.

Abstract: Disclosed is a method, system, and computer readable medium to provide an implementation to provide proxy style support for multiple virtual routing and forwarding (VRF) instances on a single network communication device. The proxy style support includes instantiating a plurality of pairs of namespaces and instances of a Unix service, each of the plurality of pairs representing a pair to support a single instance of a VRF. The network communication device may receive a network request associated with a network address mapped to a first VRF from a client device. The network request may be proxied from the pair of namespace/service supporting the first VRF to a backend single instance of a proxy server. Communication across independent namespaces may be supported by using a local communication mechanism (e.g., Unix sockets, Winsock) to provide support for the multiple VRFs concurrently.

Abstract: Disclosed are a non-transitory computer readable medium, system, and method to provide a network analytics engine (NAE) and corresponding NAE infrastructure. The NAE infrastructure may determine functions to be offloaded from a high-level interpreted scripting language agent script to specialized executables. The specialized executables may execute and perform functions on behalf of portions of the agent script while the agent script and the interpreter of the agent script are not loaded on the network communication device executing the specialized executables. Callbacks may be provided to invoke portions of the agent script as needed. A plurality of different specialized executables may monitor data values and event evaluation rules on behalf of a set of agent scripts and provide feedback via the NAE.

Abstract: Examples disclosed herein relate to a method comprising monitoring a first condition corresponding to a first parameter in a first database. The first database is configured to operate a first switch operating traffic on a network and the first database periodically synching with a second database. The method may also include monitoring a second parameter, corresponding to the first parameter, on the second database. The second database may be configured to operate a second switch on the network and the first switch and the second switch configured to operate traffic on the network. The method may also include determining that there is a deviation between the first and second that exceeds a threshold amount and transmitting an alert containing the deviation.

Abstract: In some examples, a method is described. The method can, for example be performed by a network switch and can include receiving instructions to monitor a switch resource, monitoring time-series data for traffic received and transmitted by the switch, identifying peaks for the switch resource in a specified time period for the monitored data, comparing the identified peaks with data provided during a training phase to identify whether the monitored data includes an anomaly, and generating an alert when the data is identified as containing an anomaly.