Abstract: Techniques are described for detecting that a client device physically connected to a network device is “stuck,” that is, the client device is not sending or receiving network packets with the network device. A network management system (NMS) receives current network statistics of ports of network devices with respect to client devices physically connected to the ports. The NMS identifies a candidate client device connected to a particular port of a particular network device for which the current network statistics indicate an issue. The NMS detects anomalous behavior of the candidate client device based on one or more features of the current network statistics, historical baseline statistics associated with the candidate client device, and peer statistics associated with one or more peer client devices of a same device type as the candidate client device. The NMS outputs a notification of the anomalous behavior.

Abstract: Techniques are disclosed for a network management system (NMS) that performs quality of service (QOS) monitoring and troubleshooting of user experience issues occurring outside of a network managed by the NMS using data obtained from third-party sources. For example, an NMS obtains third-party data of a third-party application server or third-party service provider server from a third-party monitoring vendor. The NMS identifies a user experience issue indicated by the third-party data and stitches the third-party data to network data received from network devices. The NMS determines a root cause or a remedial action of the user experience issue based at least on the network data received from the one or more network devices. The NMS generates a notification for presentation to an administrator device which identifies the root cause or the remedial action of the user experience issue.

Abstract: A method includes receiving, by a network management system, network data from a plurality of network devices configured to provide a network at a site; receiving, by the processing circuitry, user impact data from a plurality of client devices that access the network at the site; determining, based on the network data, a pattern of one or more network events occurring over time; correlating in time the pattern of the one or more network events to an adverse user impact event indicated by the user impact data received from the plurality of client devices; and determining, in response to the correlating, an instance of overwhelming network traffic having an adverse user impact. In some examples, the network data includes network traffic impact data, such as a number of packets dropped at a switch port due to congestion.

Abstract: A state-based continuous detection and monitoring systems detects a fraud ring over time. The present system may perform modular detection (at the state level) and hierarchical detection (at the sequence level) covering different approaches of fraudulent activities, both separately and jointly. Once a fraudulent event is detected in a state or sequence, a severity score is determined using a machine learning. A complete fraud investigation platform is implemented which uses out-of-the-box detection mechanisms while allowing users to define their own event detection as well. The state-based detection and continuous monitoring with visibility into the details of API activity allow the present system to detect fraudulent rings perpetrated by one or more users.

Abstract: Disclosed are methods for detecting misconfigured VLANs. In some embodiments, traffic on a VLAN across multiple access points is categorized. Traffic on the VLAN at a single access point is then also categorized. The categorization of the VLAN traffic at the single access point can be in response to, for example, communication errors or other conditions. The two categorizations are then compared to determine if the VLAN traffic at the AP is consistent with the VLAN traffic across a network (e.g., an enterprise network). If the VLAN traffic at the AP is generally consistent with that across the network, this may indicate that a downstream network component, such as a switch or router, is misconfigured. Thus, some embodiments programmatically reconfigure the downstream component to forward traffic for the VLAN.

Abstract: An example system includes network devices at a site; and a network management system (NMS) that is configured to: identify a first network device of the plurality of network devices with which a network connection has been lost; identify, based on a network topology graph generated from the network data, one or more neighbor network devices of the plurality of network devices that are connected to the first network device; perform root cause analysis of the lost connection with the first network device based on the network data to identify a root cause of the lost connection; and send, to a neighbor network device selected from the one or more neighbor network devices and based on the identified root cause, instructions for the first network device to perform an action to remediate the lost connection, wherein the neighbor network device communicates the instructions to the first network device.

Abstract: An example method includes receiving, by a software-defined networking in a wide area network (SD-WAN) system having a first WAN link and a second WAN link for an SD-WAN service, WAN link characterization data for the first WAN link over a time period; determining, by the SD-WAN system based on processing the WAN link characterization data for the first WAN link using a machine learning model trained with historical WAN link characterization data for one or more WAN links, an indicator of a predicted performance metric of the first WAN link at a future time; and reassigning, by the SD-WAN system based on the indicator, an application from the first WAN link to the second WAN link.

Abstract: Disclosed are embodiments for automatically resolving faults in a complex network system. Some embodiments monitor one or more of system operational parameter values and message exchanges between network components. A machine learning model detects a fault in the complex network system, and an action is selected based on a cause of the fault. After the action is applied to the complex network system, additional monitoring is performed to either determine the fault has been resolved or additional actions are to be applied to further resolve the fault.

Abstract: The network management system (NMS) assesses behavior data such as Ethernet error, speed flapping, cold restart, and/or cloud disconnect collected from a respective one of access points (APs) or other wired client-side devices at an edge of a wired network, and determines whether features of the behavior data are indicative of a bad cable issue at a particular port of a particular network device of the wired network to which the respective AP is connected via a cable. The particular network device may be a third-party network device from which the NMS does not receive behavior data. In the case of a bad cable issue being detected, the NMS outputs a bad cable notification including identification information of the particular port and the particular network device. The NMS enables client-side only, behavior-based bad cable detection at network devices that avoids network traffic disruptions caused by conventional cable tests.

Abstract: A network management system (NMS) is described that provides a granular troubleshooting workflow at an application session level using an application session-specific topology from a client device to a cloud-based application server. During an application session of a cloud-based application, a client device running the application exchanges data through one or more access point (AP) devices, one or more switches at a wired network edge, and one or more network nodes, e.g., switches, routers, and/or gateway devices, to reach a cloud-based application server. For a particular application session, the NMS generates a topology based on network data received from a subset of network devices, e.g., client devices, AP devices, switches, routers, and/or gateways, that were involved in the particular application session over a duration of the particular application session. In this way, the NMS enables backward-looking troubleshooting of the particular application session.

Abstract: A network management system (NMS) is described that provides a granular troubleshooting workflow at an application session level using an application session-specific topology from a client device to a cloud-based application server. During an application session of a cloud-based application, a client device running the application exchanges data through one or more access point (AP) devices, one or more switches at a wired network edge, and one or more network nodes, e.g., switches, routers, and/or gateway devices, to reach a cloud-based application server. For a particular application session, the NMS generates a topology based on network data received from a subset of network devices, e.g., client devices, AP devices, switches, routers, and/or gateways, that were involved in the particular application session over a duration of the particular application session. In this way, the NMS enables backward-looking troubleshooting of the particular application session.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Techniques are described by which a network management system (NMS) is configured to provide identification of root cause failure through the detection of network scope failures. For example, the NMS comprises one or more processors; and a memory comprising instructions that when executed by the one or more processors cause the one or more processors to: generate a hierarchical attribution graph comprising attributes representing different network scopes at different hierarchical levels; receive network event data, wherein the network event data is indicative of operational behavior of the network, including one or more of successful events or one or more failure events associated with one or more client devices; and apply a machine learning model to the network event data and to a particular network scope in the hierarchical attribution graph to detect whether the particular network scope has failure.

Abstract: Systems, devices and techniques for an adaptive application-specific probing scheme are disclosed. An example network device includes memory configured to store a network address and probe protocol usable for probing a first network device associated with a source of an application, and one or more processors configured to determine a network address and probe protocol usable for probing the first network device, wherein the first network device comprises a server that is responsive to the probing, the server executing the application for the data flow, or a closest network device, to the server, that is responsive to the probing. The one or more processors are also configured to send to a second network device at a location serviced by the application, a message specifying the network address and probe protocol usable for probing the first network device.

Abstract: Disclosed are methods for detecting misconfigured VLANs. In some embodiments, traffic on a VLAN across multiple access points is categorized. Traffic on the VLAN at a single access point is then also categorized. The categorization of the VLAN traffic at the single access point can be in response to, for example, communication errors or other conditions. The two categorizations are then compared to determine if the VLAN traffic at the AP is consistent with the VLAN traffic across a network (e.g., an enterprise network). If the VLAN traffic at the AP is generally consistent with that across the network, this may indicate that a downstream network component, such as a switch or router, is misconfigured. Thus, some embodiments programmatically reconfigure the downstream component to forward traffic for the VLAN.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: An example method includes receiving, from a network device, data indicating characterizations of network traffic on a plurality of ports of the network device; determining, by processing circuitry, for each port of the plurality of ports, an indicator of a port type for the port based on the data indicating the characterizations of network traffic on the plurality of ports, wherein the port type indicates a link type of network traffic exchanged by the port; and outputting, by the processing circuitry, the indicator of the port type to an output device.

Abstract: The disclosed embodiments provide for identification of a remedial action based on analysis of a system log file. In some example embodiments, messages from the system log file are used as input to generate vectors within a vector space. Portions of the log messages may generate vectors that cluster into a region in the vector space. The region of vector space is associated with one or more remedial actions. The disclosed embodiments are configured, in some example embodiments, to perform the one or more remedial actions when activity in the log file maps to the region of vector space associated with the one or more remedial actions. In some example embodiments, a remedial action can include submitting a problem report to a problem tracking database.

Abstract: An example system includes access point (AP) devices configured to provide a wireless network at a site; and a network management system that stores network data received from the AP devices, the network data collected by the AP devices or client devices associated with the wireless network, and one or more processors configured to: receive a time series of SLE metrics based on the network data, determine, based on the time series, whether a network event has occurred, in response to a determination that a network event has occurred, determine a root cause for the network event, and in response to a determination that the root cause of the network event is associated with an AP device, determine a classification of the AP device, and determine a network management action for the AP device based on the network event and the classification of the AP device.

Abstract: Techniques are described by which a network management system (NMS) is configured to provide identification of root cause failure through the detection of network scope failures. For example, the NMS comprises one or more processors; and a memory comprising instructions that when executed by the one or more processors cause the one or more processors to: generate a hierarchical attribution graph comprising attributes representing different network scopes at different hierarchical levels; receive network event data, wherein the network event data is indicative of operational behavior of the network, including one or more of successful events or one or more failure events associated with one or more client devices; and apply a machine learning model to the network event data and to a particular network scope in the hierarchical attribution graph to detect whether the particular network scope has failure.