Abstract: Some embodiments provide a method for reporting potential root causes of incidents within a network. The method identifies a first network entity as a potential root cause of an incident affecting a second network entity. For each network entity of a set of network entities in a dependency chain beginning with the first network entity and ending with the second network entity, the method assigns a label to the network entity based on measured metrics of the network entity. The method uses a state machine that encodes causality between different network entity labels to generate a human-readable explanation for the first network entity causing the incident affecting the second network entity.

Abstract: Some embodiments provide a method for evaluating incidents within a network. The method receives notification of a first incident related to a first network entity and a second incident related to a second network entity. In response to the respective notifications of the first and second incidents, the method uses network monitoring data to generate a first component graph of a first portion of the network that includes the first network entity and a second component graph of a second portion of the network that includes the second network entity. The first and second component graphs respectively include first and second sets of network entities related to the first and second network entities according to the network monitoring data. The method uses the first and second component graphs to respectively identify root causes of the first and second incidents.

Abstract: Some embodiments provide a method for identifying root causes of incidents within a network. The method receives a graph of a portion of the network related to a particular network entity for which an incident is reported. The graph specifies dependencies between neighboring network entities in the network. The method uses probabilistic analysis to determine, for each network entity of a set of network entities represented in the graph, whether adjusting a set of metrics of the entity affects one or more metrics of the particular network entity that have been diagnosed as indicative of a problem. The method reports a subset of the network entities with metrics that affect the one or more metrics of the particular network entity as potential root causes of the incident.

Abstract: Some embodiments provide a method for evaluating a network correctness requirement at an evaluation program instance assigned to evaluate a particular network correctness requirement. The method identifies data message properties associated with the particular network correctness requirement. The method evaluates the particular network correctness requirement by (i) determining a path through a set of network devices for a data message having the identified data message properties and (ii) from a data storage that stores data message processing rules for a plurality of network devices including the set of network devices and additional network devices, retrieving and storing in memory data specifying data message processing rules for the set of network devices to use in evaluating the particular network correctness requirement.

Abstract: Some embodiments provide a method for evaluating a network. The method identifies multiple network correctness requirements configured for the network. The method instantiates a separate respective evaluation program instance for each respective identified network correctness requirement to evaluate the respective network correctness requirement. At least two evaluation program instances are instantiated on different machines. Each respective evaluation program instance stores in a respective memory a respective set of network device data to evaluate the respective network correctness requirement. Each set of network device data requires less memory than storing network device data for the entire network.

Abstract: Some embodiments provide a method for an orchestration program instance assigned a particular network device in a network. Each network device of multiple network devices is assigned to a different orchestration program instance in a cluster. The method receives a notification message that a configuration for the particular network device has been modified. In response to the notification message, the method identifies a set of network correctness requirements to be evaluated for the network. The method sends a separate notification message for each identified network correctness requirement specifying that the particular network device configuration has been modified so that a set of evaluation program instances can re-evaluate any network correctness requirements dependent on the particular network device.

Abstract: Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Abstract: Methods and systems for automatically presenting a hierarchical graphical representation of the structure of the computer network are provided. A computer-implemented method includes obtaining network topology data, determining at least one core node at a highest level in a hierarchy from a plurality of nodes based on the network topology data, grouping at least a part of non-core nodes among the nodes into one or more supernodes based on the obtained network topology data, selecting, with respect each of the one or more supernodes, a single supernode or node at a hierarchical level immediately higher than thereof, as a parent node, determining a spatial coordinate of each of the plurality of nodes based on the at least one core node, the one or more supernodes, and the parent node of each of the one or more supernodes, and presenting the hierarchical graphical representation.

Abstract: Methods and systems for automatically presenting a hierarchical graphical representation of the structure of the computer network are provided. A computer-implemented method includes obtaining network topology data, determining at least one core node at a highest level in a hierarchy from a plurality of nodes based on the network topology data, grouping at least a part of non-core nodes among the nodes into one or more supernodes based on the obtained network topology data, selecting, with respect each of the one or more supernodes, a single supernode or node at a hierarchical level immediately higher than thereof, as a parent node, determining a spatial coordinate of each of the plurality of nodes based on the at least one core node, the one or more supernodes, and the parent node of each of the one or more supernodes, and presenting the hierarchical graphical representation.

Abstract: Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Abstract: Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Abstract: Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Abstract: Systems for and methods of modelling, analyzing and managing data networks are provided. In an embodiment, a plurality of network device interfaces are configured to collect state information for a plurality of network devices. A computer-implemented model of the network comprises a data structure, which may be graph-based. The data structure comprises a plurality of snapshots of the network, each snapshot representing the network at a particular point in time, and the data structure comprises a representation of possible data flow and data packet processing within the network. The data structure contains normalized representations of the network devices corresponding to the location. The normalized representation for each device contains a set of packet processing rules. A user-interface is configured to receive queries from a user that request verification of network policies and predictions of network behavior.

Abstract: A system for managing a network using intent inference includes a network interface that is configured to obtain device information regarding a plurality of hardware devices within a data communication network. A processor is configured to infer intended packet handling behavior of a plurality of the devices. A network verification system models packet handling behavior of the devices within the network and compares the inferred intended behavior to the modeled packet handling behavior. The system can take action in response to the results of the comparison, which can include initiating a configuration change to one or more of the hardware devices of the data communication network.

Abstract: A network-wide verification system may be adapted with a data plane verification layer positioned between a set of multiple network devices and a controller in network communication with the devices, where the controller is configured to transmit packet-forwarding rules to the devices. The data plane verification layer monitors network rule modifications, such as monitoring modifications initiated by the network devices and/or by the controller, and verifies the validity of invariants of the monitored network according to multiple stored network invariants. The verification may be executed on parts of the network taking actions that are capable of being influenced by a new rule modification. The network invariants include conditions expected to be upheld in valid network operation as related to packet routing and the packet-forwarding rules.

Abstract: A network-wide verification system may be adapted with a data plane verification layer positioned between a set of multiple network devices and a controller in network communication with the devices, where the controller is configured to transmit packet-forwarding rules to the devices. The data plane verification layer monitors network rule modifications, such as monitoring modifications initiated by the network devices and/or by the controller, and verifies the validity of invariants of the monitored network according to multiple stored network invariants. The verification may be executed on parts of the network taking actions that are capable of being influenced by a new rule modification. The network invariants include conditions expected to be upheld in valid network operation as related to packet routing and the packet-forwarding rules.