Abstract: An example system includes network devices at a site; and a network management system (NMS) that is configured to: identify a first network device of the plurality of network devices with which a network connection has been lost; identify, based on a network topology graph generated from the network data, one or more neighbor network devices of the plurality of network devices that are connected to the first network device; perform root cause analysis of the lost connection with the first network device based on the network data to identify a root cause of the lost connection; and send, to a neighbor network device selected from the one or more neighbor network devices and based on the identified root cause, instructions for the first network device to perform an action to remediate the lost connection, wherein the neighbor network device communicates the instructions to the first network device.

Abstract: A network management system (NMS) initiates, for each of a plurality of wireless and/or wired client devices, a wireless/wired stateful machine configured to continuously monitor at least one pre-connection state and at least one post-connection state of a corresponding wireless/wired connection session, and determines one or more network connection assessments for the plurality of wireless/wired client devices based on success or failure of the pre-connection states and/or the post-connection states. The NMS may also output a notification including identification of a root cause of any network connection failure(s) and/or automatically invoke remedial action intended to address or mitigate the root cause of the network connection failure(s).

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Techniques are disclosed for the identification of applications from communication sessions of network traffic between client devices and the generation of application-specific metrics for network traffic associated with the applications. In one example, a router obtains metrics for a plurality of packets. The router determines a session of a plurality of sessions associated with each packet. For each determined session, the router generates metrics for the session from the metrics of the packets associated with the session and determines an application of a plurality of applications associated with the session. For each determined application, the router generates metrics for the application from the metrics of the sessions associated with the application and transmits, to a device, the metrics for the application. In some examples, the router generates the metrics for each application on a per-client, per-next-hop, or per-traffic class basis.

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: A network management system (NMS) comprises one or more processors coupled to memory. The one or more processors of are configured to determine a list of network devices from the plurality of network devices based on an entity type and determine a suggested filter attribute based on the list of network devices and one or more of a user profile, a current state of the plurality of network devices, or a current state of the networking services. The one or more processors are further configured to output, in a user interface, an indication of the suggested filter attribute and, in response to receiving user input representative of a selection of the indication of the suggested filter attribute, determine a filtered list of network devices from the list of network devices using the suggested filter attribute and output, in the user interface, an indication of the filtered list of network devices.

Abstract: A network management system (NMS) is described that provides a granular troubleshooting workflow at an application session level using an application session-specific topology from a client device to a cloud-based application server. During an application session of a cloud-based application, a client device running the application exchanges data through one or more access point (AP) devices, one or more switches at a wired network edge, and one or more network nodes, e.g., switches, routers, and/or gateway devices, to reach a cloud-based application server. For a particular application session, the NMS generates a topology based on network data received from a subset of network devices, e.g., client devices, AP devices, switches, routers, and/or gateways, that were involved in the particular application session over a duration of the particular application session. In this way, the NMS enables backward-looking troubleshooting of the particular application session.

Abstract: Disclosed are embodiments for automatically resolving faults in a complex network system. Some embodiments monitor one or more of system operational parameter values and message exchanges between network components. A machine learning model detects a fault in the complex network system, and an action is selected based on a cause of the fault. After the action is applied to the complex network system, additional monitoring is performed to either determine the fault has been resolved or additional actions are to be applied to further resolve the fault.

Abstract: Disclosed are embodiments for improving remote diagnostics of a computer system. Some embodiments obtain operational parameter values and log data from a plurality of network devices, and provide the operational parameter values and log data to a machine learning model. The model is trained to identify a root cause of a degradation of the computer system based on the operational parameter values and log data, and to provide recommendations of log data level settings for the network devices. If the model identifies a root cause of the degradation with sufficient confidence, a remedial action is identified and applied to the computer system. If the confidence level is insufficient, log data level settings of the network devices are modified based on the recommendations of the model. This process may be performed iteratively until a root cause is identified with sufficient confidence.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Techniques are disclosed for the identification of applications from communication sessions of network traffic between client devices and the generation of application-specific metrics for network traffic associated with the applications. In one example, a router obtains metrics for a plurality of packets. The router determines a session of a plurality of sessions associated with each packet. For each determined session, the router generates metrics for the session from the metrics of the packets associated with the session and determines an application of a plurality of applications associated with the session. For each determined application, the router generates metrics for the application from the metrics of the sessions associated with the application and transmits, to a device, the metrics for the application. In some examples, the router generates the metrics for each application on a per-client, per-next-hop, or per-traffic class basis.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Disclosed is a network management system that provides an interface to enable diagnostics and troubleshoot of a remotely managed multi-site network. Some embodiments provide a natural language interface, while other embodiments provide a chatbot type interface that communicates with a technician via traditional text information on a display screen. The diagnostic and troubleshooting capabilities search a central data store that receives device property information from each site of the multi-site network. Based on devices or users that match portions of the entity, queries to the data store are initiated to obtain additional data on the devices. A response to the query is then provided based on the properties of the devices.

Abstract: An example method includes receiving, by a software-defined networking in a wide area network (SD-WAN) system having a first WAN link and a second WAN link for an SD-WAN service, WAN link characterization data for the first WAN link over a time period; determining, by the SD-WAN system based on processing the WAN link characterization data for the first WAN link using a machine learning model trained with historical WAN link characterization data for one or more WAN links, an indicator of a predicted performance metric of the first WAN link at a future time; and reassigning, by the SD-WAN system based on the indicator, an application from the first WAN link to the second WAN link.

Abstract: Techniques are described for monitoring network performance and managing network faults in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system determines, based on the path data, one or more WAN link health assessments, wherein the one or more WAN link health assessments include a success or failure state associated with one or more of service provider reachability, physical interface operation, or logical path performance; and in response to determining the at least one failure state, outputs a notification including identification of a root cause of the at least one failure state.

Abstract: Techniques are described by which a network management system (NMS) is configured to provide identification of root cause failure through the detection of network scope failures. For example, the NMS comprises one or more processors; and a memory comprising instructions that when executed by the one or more processors cause the one or more processors to: generate a hierarchical attribution graph comprising attributes representing different network scopes at different hierarchical levels; receive network event data, wherein the network event data is indicative of operational behavior of the network, including one or more of successful events or one or more failure events associated with one or more client devices; and apply a machine learning model to the network event data and to a particular network scope in the hierarchical attribution graph to detect whether the particular network scope has failure.

Abstract: An example system includes access point (AP) devices configured to provide a wireless network at a site; and a network management system that stores network data received from the AP devices, the network data collected by the AP devices or client devices associated with the wireless network, and one or more processors configured to: receive a time series of SLE metrics based on the network data, determine, based on the time series, whether a network event has occurred, in response to a determination that a network event has occurred, determine a root cause for the network event, and in response to a determination that the root cause of the network event is associated with an AP device, determine a classification of the AP device, and determine a network management action for the AP device based on the network event and the classification of the AP device.

Abstract: Disclosed are embodiments for automatically resolving faults in a complex network system. Some embodiments monitor one or more of system operational parameter values and message exchanges between network components. A machine learning model detects a fault in the complex network system, and an action is selected based on a cause of the fault. After the action is applied to the complex network system, additional monitoring is performed to either determine the fault has been resolved or additional actions are to be applied to further resolve the fault.

Abstract: Systems, devices and techniques for an adaptive application-specific probing scheme are disclosed. An example network device includes memory configured to store a network address and probe protocol usable for probing a first network device associated with a source of an application, and one or more processors configured to determine a network address and probe protocol usable for probing the first network device, wherein the first network device comprises a server that is responsive to the probing, the server executing the application for the data flow, or a closest network device, to the server, that is responsive to the probing. The one or more processors are also configured to send to a second network device at a location serviced by the application, a message specifying the network address and probe protocol usable for probing the first network device.