Abstract: Examples disclosed herein relate to a system comprising a request transmitter to transmit a plurality of transaction requests from a first daemon to a central database, wherein the first daemon belongs to a plurality of daemons using the central database to communicate with each other to perform networking related functions. The system may include a baseline determiner to determine a baseline response time for receiving a response to the plurality of transaction requests, a transaction request transmitter to transmit a transaction request, belonging to the plurality of daemons, to the central database and a transaction requester determiner to determine that the central database is processing more requests that it can handle. The system may include a delay time generator to generate a delay time for a subsequent transaction request to the central database and a subsequent request transmitter to transmit the subsequent transaction request to central database.

Abstract: One embodiment of the present invention provides a switch. The switch includes a storage device, a processing module, and a database module. The storage device can maintain a database storing configuration information for the switch. During operation, the processing module produces a piece of data associated with operations of the switch based on the configuration information. The database module then stores the piece of data in a database table of the database without caching the piece of data in a memory of the switch after the piece of data is stored in the database. In this way, the database module can reduce the memory occupancy of the processing module in comparison with the storage occupancy of a schema corresponding to the database table. Subsequently, the processing module can program a hardware module of the switch with the piece of data prior to receiving an acknowledgment from the database module.

Abstract: Examples relate to detection of anomalies in a network. Some examples determine a dictionary including a set of keys for a set of packet length values for a selected sequence of packets associated with a traffic flow over a network, each key represents a combination of two or more successive packet length values from the set of packet length values. An aggregated set of statistical features is determined based in part on the set of statistical features using a machine learning algorithm. Upon determining another set of packet length values for another selected sequence of packets, another set of statistical features for the other set of packet length values is determined. The other set of statistical features is compared with the aggregated set of statistical features. Based on the comparison, an indication that an anomaly has occurred in the traffic flow is transmitted to an administrator.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: An example method can include tracking, by a network device, a plurality of database operations performed and a plurality of expected database operations for an event that executes for a time period, generating, by the network device, a plurality of clusters based on a ratio of the database operations performed compared to the plurality of expected database operations and the time period for the event, classifying, by the network device, the clusters based on performance, and evaluating, by the network device, a system performance metric based on a classification of real time data into the clusters.

Abstract: A device may determine sample points associated with network routes within a network during a time interval, wherein each sample point that is associated with a respective network route comprises an amount of uptime for the respective network route during the time interval and a total frequency of state changes for the respective network route during the time interval. The device may generate, using an unsupervised machine learning mechanism, clusters of the sample points and may label the network routes with route stability labels based at least in part on the clusters. The device may generate, using a supervised machine learning mechanism, a route stability classifier based at least in part on the route stability labels for the network routes, and may determine, using the route stability classifier, a route stability of a new network route within the network.

Abstract: Systems and methods are provided for a light-weight model for traffic classification within a network fabric. A classification model is deployed onto an edge switch within a network fabric, the model enabling traffic classification using a set of statistical features derived from packet length information extracted from the IP header for a plurality of data packets within a received traffic flow. The statistical features comprise a number of unique packet lengths, a minimum packet length, a maximum packet length, a mean packet length, a standard deviation of the packet length, a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length. Based on the calculated values for the statistical features, the edge switch determines a traffic class for the received traffic flow and tags the traffic flow with an indication of the determined traffic class.

Abstract: An example method can include tracking, by a network device, a plurality of database operations performed and a plurality of expected database operations for an event that executes for a time period, generating, by the network device, a plurality of clusters based on a ratio of the database operations performed compared to the plurality of expected database operations and the time period for the event, classifying, by the network device, the clusters based on performance, and evaluating, by the network device, a system performance metric based on a classification of real time data into the clusters.

Abstract: Examples include detection of unclassified traffic in a network. Some examples use an unsupervised machine learning mechanism for generating a first set of clusters of a first set of samples associated with a first set of time intervals, based at least in part on network traffic over a network, in a first predetermined period of time. Each sample associated with the respective time interval includes distribution of packets based on their packet lengths. In response to retrieving a second set of samples associated with a second set of time intervals, based at least in part on network traffic, a second set of clusters of the second set of samples is generated. It is determined whether one or more features of the second set of clusters vary as compared to one or more features of the first set of clusters of the first set of samples to detect unclassified traffic in the second set of samples.

Abstract: A device may determine sample points associated with network routes within a network during a time interval, wherein each sample point that is associated with a respective network route comprises an amount of uptime for the respective network route during the time interval and a total frequency of state changes for the respective network route during the time interval. The device may generate, using an unsupervised machine learning mechanism, clusters of the sample points and may label the network routes with route stability labels based at least in part on the clusters. The device may generate, using a supervised machine learning mechanism, a route stability classifier based at least in part on the route stability labels for the network routes, and may determine, using the route stability classifier, a route stability of a new network route within the network.

Abstract: Examples include generating a Precision Time Protocol (PTP) packet for a first nexthop in an Equal Cost Multi-Path set and sending the PTP packet to the first nexthop. Examples also include receiving a response from the first nexthop that identifies a time delay associated with a route to the first nexthop and updating the ECMP based on the time delay.

Abstract: Systems and methods are provided for a light-weight model for traffic classification within a network fabric. A classification model is deployed onto an edge switch within a network fabric, the model enabling traffic classification using a set of statistical features derived from packet length information extracted from the IP header for a plurality of data packets within a received traffic flow. The statistical features comprise a number of unique packet lengths, a minimum packet length, a maximum packet length, a mean packet length, a standard deviation of the packet length, a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length. Based on the calculated values for the statistical features, the edge switch determines a traffic class for the received traffic flow and tags the traffic flow with an indication of the determined traffic class.

Abstract: Examples include generating a Precision Time Protocol (PTP) packet for a first nexthop in an Equal Cost Multi-Path set and sending the PTP packet to the first nexthop. Examples also include receiving a response from the first nexthop that identifies a time delay associated with a route to the first nexthop and updating the ECMP based on the time delay.

Abstract: One embodiment of the present invention provides a switch. The switch includes a storage device, a processing module, and a database module. The storage device can maintain a database storing configuration information for the switch. During operation, the processing module produces a piece of data associated with operations of the switch based on the configuration information. The database module then stores the piece of data in a database table of the database without caching the piece of data in a memory of the switch after the piece of data is stored in the database. In this way, the database module can reduce the memory occupancy of the processing module in comparison with the storage occupancy of a schema corresponding to the database table. Subsequently, the processing module can program a hardware module of the switch with the piece of data prior to receiving an acknowledgment from the database module.

Abstract: A device may determine sample points associated with network routes within a network during a time interval, wherein each sample point that is associated with a respective network route comprises an amount of uptime for the respective network route during the time interval and a total frequency of state changes for the respective network route during the time interval. The device may generate, using an unsupervised machine learning mechanism, clusters of the sample points and may label the network routes with route stability labels based at least in part on the clusters. The device may generate, using a supervised machine learning mechanism, a route stability classifier based at least in part on the route stability labels for the network routes, and may determine, using the route stability classifier, a route stability of a new network route within the network.

Abstract: A device may track network traffic and may determine sample points associated with a plurality of time intervals, where each sample point from the plurality of sample points that is associated with a respective time interval from the plurality of time intervals comprises a count of packet lengths associated with a plurality of packets that comprise at least a specified portion of total network volume for the respective time interval and a total number of packet lengths observed during the respective time interval. The device may generate a plurality of clusters of the plurality of sample points and may, in response to determining a plurality of new sample points associated with a plurality of new time intervals based on the network traffic, determine a network traffic trend for the network based at least in part on a distribution of the plurality of new sample points within the plurality of clusters.

Abstract: An example method can include tracking, by a network device, a plurality of database operations performed and a plurality of expected database operations for an event that executes for a time period, generating, by the network device, a plurality of clusters based on a ratio of the database operations performed compared to the plurality of expected database operations and the time period for the event, classifying, by the network device, the clusters based on performance, and evaluating, by the network device, a system performance metric based on a classification of real time data into the clusters.

Abstract: An example method can include classifying a data set based on a plurality of classifiers generated by inputting the data set into a supervised machine learning mechanism and determining a portion of the classified data set comprises unseen data based on the classification. The unseen data can include data having an attribute not seen by the data set prior to inputting the data set into the supervised machine learning mechanism. The example method can include generating an additional rule based on the unseen data portion, adding the additional rule to the plurality of classifiers, and classifying a new received piece of data based on the plurality of classifiers and the additional rule.

Abstract: Examples disclosed herein relate to a system comprising a request transmitter to transmit a plurality of transaction requests from a first daemon to a central database, wherein the first daemon belongs to a plurality of daemons using the central database to communicate with each other to perform networking related functions. The system may include a baseline determiner to determine a baseline response time for receiving a response to the plurality of transaction requests, a transaction request transmitter to transmit a transaction request, belonging to the plurality of daemons, to the central database and a transaction requester determiner to determine that the central database is processing more requests that it can handle. The system may include a delay time generator to generate a delay time for a subsequent transaction request to the central database and a subsequent request transmitter to transmit the subsequent transaction request to central database.

Abstract: An example method can include tracking, by a network device, a plurality of attributes associated with a plurality of unique client device identifiers stored in a tracking table; deriving, by the network device, a training data set based on the plurality of attributes; and generating, by the network device, a plurality of clusters by inputting the derived training data set to an unsupervised machine learning mechanism. The example method can include receiving, by the network device, a labeling of the plurality of unique client device identifiers in the tracking table based at least on the plurality of clusters; generating, by the network device, a plurality of classifiers by inputting the labelled tracking table to a supervised machine learning mechanism; and classifying, by the network device, a new unique client device identifier in the tracking table based at least on the plurality of classifiers.