Abstract: A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

Abstract: An example method comprises determining, by an edge services controller, based on a respective predicted resource utilization value for each of a plurality of servers, a corresponding server weight for each of the plurality of servers; the plurality of servers comprising respective network interface cards (NICs), wherein each NIC of the plurality of NICs comprises an embedded switch and a processing unit coupled to the embedded switch; determining, by the edge services controller, based on a respective predicted resource utilization value for each of a plurality of services, a corresponding application weight for each of the plurality of services; and scheduling, by the edge services controller, based on the respective server weight for a server of the plurality of servers and the respective application weight for the service, a service of the plurality of services on the server.

Abstract: A method includes receiving, from a user device, a reachability request requesting a reachability status of network traffic from a first VM of a VPC to a second VM of the VPC. The method also includes obtaining network configuration information defining a configuration of a network connecting the first VM and the second VM, generating, using the network configuration information associated with the VPC, a simulated path between the first VM and the second VM, and, determining, based on the simulated path, that the second VM is unreachable from the first VM. The method further includes, based on determining that the second VM is unreachable from the first VM, generating a reachability report, the reachability report including each hop of the plurality of hops of the simulated path, and a rationale that the second VM is unreachable from the first VM, and providing the reachability report to the user device.

Abstract: A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

Abstract: A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

Abstract: An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which cause the system to obtain telemetry data, the telemetry data being associated with a plurality of applications running on a plurality of hosts. The instructions cause the system to, based on the telemetry data, determine a subset of applications of the plurality of applications that run on a first host of the plurality of hosts. The instructions cause the system to determine a subset of firewall policies of a plurality of firewall polices, each of the subset of firewall policies applying to at least one respective application of the subset of applications. The instructions cause the system to generate an indication of the subset of firewall policies and send the indication to a management plane of a distributed firewall.

Abstract: Example systems, methods, and storage media are described. An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain telemetry data. The instructions cause the network system to determine, based on the telemetry data, that an application running on server processing circuitry does not meet at least one service level agreement (SLA) requirement, the server processing circuitry not including processing circuitry resident on a network interface card (NIC). The instructions cause the network system to, based on the application not meeting the at least one SLA requirement, determine to offload at least one component of the application from the server processing circuitry to the processing circuitry resident on the NIC.

Abstract: An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain first traffic session metrics data and execute a machine learning model to determine a traffic prediction based on the first traffic session metrics data. The instructions cause the network system to obtain second traffic session metrics data and determine an anomaly in traffic based on a comparison of the traffic prediction and the second traffic session metrics data. The instructions cause the network system to, based on the determination of the anomaly, generate an indication of the anomaly.

Abstract: An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to receive connection data related to an egress connection of an application service of an application. The instructions cause the network system to analyze the connection data to determine that the egress connection is an anomalous connection. The instructions cause the network system to generate a notification indicative of the egress connection being an anomalous connection and send the notification to a computing device.

Abstract: Example systems, methods, and storage media are described. An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain telemetry data, the telemetry data comprising indications of creations of instances of a flow. The instructions cause the network system to, based on the indications of the creations of the instances of the flow, determine a pattern of creation of the instances of the flow. The instructions cause the network system to, based on the pattern of creation of the instances of the flow, generate an action entry in a policy table for a particular instance of the flow prior to receiving a first packet of the particular instance of the flow.

Abstract: Example systems, methods, and storage media are described. An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain telemetry data, the telemetry data including flow processing data associated with a plurality of flows. The instructions cause the network system to rank the plurality of flows indicated by the telemetry data according to importance. The instructions cause the network system to send information indicative of a respective rank of at least one of the plurality of flows to at least one of a controller or a network interface card (NIC), the NIC comprising NIC processing circuitry.

Abstract: A method for providing cloud network reachability analysis includes receiving a reachability query requesting a reachability status of a target including a packet header associated with a data packet. The packet header includes a source IP address and a destination IP address. The method also includes generating one or more simulated forwarding paths for the data packet based on the packet header using a data plane model. Each simulated forwarding path includes corresponding network configuration information. The method includes determining the reachability status of the target based on the one or more simulated forwarding paths and providing the determined reachability status and the one or more simulated forwarding paths to a user device associated with the reachability query which causes the user device to present the network configuration information for each simulated forwarding path.

Abstract: An example method comprises determining, by an edge services controller, based on a respective predicted resource utilization value for each of a plurality of servers, a corresponding server weight for each of the plurality of servers; the plurality of servers comprising respective network interface cards (NICs), wherein each NIC of the plurality of NICs comprises an embedded switch and a processing unit coupled to the embedded switch; determining, by the edge services controller, based on a respective predicted resource utilization value for each of a plurality of services, a corresponding application weight for each of the plurality of services; and scheduling, by the edge services controller, based on the respective server weight for a server of the plurality of servers and the respective application weight for the service, a service of the plurality of services on the server.

Abstract: A system comprises an edge services controller configured to: compute, based on a physical topology of physical links that connect a plurality of network interface cards (NICs) that comprise embedded switches and processing units coupled to the embedded switches, a virtual topology comprising a strict subset of the physical links; and program the virtual topology into the respective processing units of the NICs to cause the processing units of the NICs to send data packets via physical links in the strict subset of the physical links.

Abstract: Methods and apparatus to cross configure network resources of software defined data centers are disclosed. Example instructions cause one or more processors to monitor a component of a network for a probe packet sent to the component. The example instructions cause the one or more processors to, in response to detecting the probe packet, determine whether the probe packet includes a unique source media access control (MAC) address that is included in a probe access control list (ACL), the unique source MAC address included in the probe ACL set by a decision engine. The example instructions cause the one or more processors to, in response to determining that the probe packet does not include the unique source MAC address, record probe packet receipt information indicating that the probe packet did not pass through a network port of the component and transmit the probe packet receipt information to the decision engine.

Abstract: An example apparatus to manage network resources includes a link aggregator to: aggregate a first plurality of physical network interface cards to create a first link aggregated group, the first link aggregated group corresponding to a first virtual network interface card; and aggregate a second plurality of physical network interface cards to create a second link aggregated group, the second link aggregated group corresponding to a second virtual network interface card; and a link manager to: connect the first link aggregated group between a first distributed virtual port and a first top-of-rack switch; connect the second link aggregated group between a second distributed virtual port and a second top-of-rack switch; and remove an invalid connection between the first plurality of physical network interface cards and the second top-of-rack switch.

Abstract: A computing system comprising a memory and processing circuitry may perform the techniques. The memory may store time series data comprising measurements of one or more performance indicators. The processing circuitry may determine, based on the time series data, an anomaly in the performance of the network system, and create, based on the time series data, a knowledge graph. The processing circuitry may determine, in response to detecting the anomaly, and based on the knowledge graph and a machine learning (ML) model trained with previous time series data, a causality graph. The processing circuitry may determine a weighting for each edge in the causality graph, determine, based on the edges in the causality graph, a candidate root cause associated with the anomalies, and determine a ranking of the candidate root cause based on the weighting. The analysis framework system may output at least a portion of the ranking.

Abstract: Techniques are described for determining the energy usage of a data center and invoking one or more actions to improve the energy usage of the data center. For example, a computing system may obtain energy usage data of a data center. The computing system may also determine, based on a comparison of the energy usage data of the data center to a percentage of energy provided by one or more renewable energy sources to the data center, a green quotient of the data center that specifies a value that indicates whether the data center is energy efficient. The computing system may further invoke, based on the green quotient of the data center that specifies a value that indicates the data center is not energy efficient, an action to improve energy usage of the data center.

Abstract: Methods and apparatus to deploy workload domains in virtual server racks are disclosed. An example apparatus includes a policy manager to determine an availability option and a performance option of the workload domain based on a domain type and determine capacity options based on a user selection of the availability option and a user selection of the performance option by a first user, a deployment manager to identify first ones of a plurality of computing resources to form a placement solution for the workload domain based on the user selection of the availability and performance options, and based on a user selection of one of the determined capacity options by the first user, the plurality of computing resources stored in a resource database accessible by the first user and a second user, and a resource manager to reserve the first ones of the plurality of computing resources to deploy the workload domain for the first user.

Abstract: Techniques are described for determining the energy usage of a data center and invoking one or more actions to improve the energy usage of the data center. For example, a computing system may obtain energy usage data of a data center deploying an application. The computing system may also determine, based on a comparison of the energy usage data of the data center deploying the application to a percentage of energy provided by one or more renewable energy sources to the data center, a green quotient of the application that specifies a value that indicates whether the data center deploying the application is energy efficient. The computing system may further invoke, based on the green quotient of the application that specifies a value that indicates the data center deploying the application is not energy efficient, an action to improve energy usage of the data center deploying the application.