Abstract: An anomaly prediction tool is employed on a communication network to monitor systems and/or devices on the network for anomalous behaviors. The anomaly prediction tool can include a machine learning (ML) model to detect anomalous network systems operating on the network based on a data tree derived from network configuration data for the network. In some examples, the ML model is a graph-based convolutional neural network.

Abstract: Transmission Control Protocol (TCP) states of an active device are replicated at a backup device configured to track connections in a software defined network (SDN). The backup device receives, from the active device, a TCP packet with a TCP flag including one or more of SYN, SYN-ACK, ACK, FIN, FIN-ACK, ACK, or RESET. When the TCP packet has a SYN flag, the backup device adds a connection record to a connection table. Otherwise, the backup device derives an updated connection state for the connection record using a TCP state machine. The connection state is updated as future packets are received by the backup device.

Abstract: Flows of a communication session in a software defined network (SDN) are efficiently managed. A network virtual appliance offloads, to a hardware-based network interface device, processing of data packets of a flow in accordance with packet processing rules associated with the flow. After the offload, subsequent data packets for the offloaded flow are processed and forwarded by the hardware-based network interface device without forwarding to the network virtual appliance.

Abstract: Bidirectional flows of a communication session in a software defined network (SDN) are efficiently managed. A smart switch comprises a digital processing unit (DPU) complex comprising one or more DPUs, and a switching complex comprising one or more network processing units (NPUs). The DPU complex is configured to disaggregate enforcement of policies of the SDN from hosts of the SDN. The switching complex is configured to perform network routing of packets in the SDN. The hosts are implemented on servers communicatively coupled to network interfaces of the SDN. The switching complex is configured to perform policy enforcement of data flows for communication sessions that are offloaded from the DPU complex to the switching complex.

Abstract: A disclosed method facilitates bidirectional traffic flows between a multi-tenant service and endpoints with private customer internet protocol (IP) addresses. The method provides for receiving a data packet having a data packet header identifying a first IPv6 address as a destination. The first IPv6 address embeds a first IPv4 address and a virtual network (VNet) identifier uniquely identifying a VNet of a cloud compute platform. The method further provides for routing the data packet to a host node within the cloud compute platform that hosts a virtual machine (VM) within the VNet identified by the VNet identifier and assigned to the first IPv4 address.

Abstract: Data flows in a virtualized computing environment are efficiently updated by a hardware-based networking device configured to disaggregate processing of data packets of the data flows from hosts of the virtualized computing environment. A connection table is accessed that defines connection flows for data packets having a source from an endpoint in a virtual network of the virtualized computing environment or a destination to the endpoint in the virtual network of the virtualized computing environment. The hardware-based networking device re-simulates full packet processing paths for each of the flows in the connection table and updates the flows in the connection table to ensure that the flows in the connection table implement policies of the virtualized computing environment that were updated after corresponding flows in the connection table were added to the connection table.

Abstract: A virtual network provider system supports a virtual network including virtual machines that are each assigned to an underlay address of an underlay addressing scheme. The virtual network provider system further includes multiple routing domains each defined to include a different subset of the virtual machines. Each of the routing domains is assigned to a range of overlay addresses of an overlay addressing scheme. For each routing domain, the assigned range of overlay addresses is allocated among the subset of the virtual machines in the routing domain. The system further includes a virtual network host configured to use addresses of the overlay addressing scheme to selectively route messages between endpoints on select pairs of the virtual machines assigned to a same routing domain of the plurality of routing domains.

Abstract: An enhanced router is described that improves network performance for AI workloads by providing in-network primitives that improve the performance of operations such as Broadcast and Reduce operations. The enhanced router is configured to execute primitives for data payloads in packets associated with the workloads in the network prior to forwarding the packets to hosts. The network device receives, via a control plane, a primitive indicative of an analytical, computational, or transformative operation to be performed on data payloads transmitted by data packets associated with a workload being processed in an SDN. The primitive is associated with a protocol for configuring network devices to perform in-network acceleration of workloads in coordination with source and destination hosts in the SDN.

Abstract: High availability network services are provided in a in a virtual computing environment comprising a plurality of network devices running in a software defined network (SDN) of the virtual computing environment, the network devices comprising a plurality of SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment, the hosts implemented on servers communicatively coupled to network interfaces of the SDN appliances, the servers hosting a plurality of virtual machines, the SDN appliance comprising a plurality of smart network interface cards (fNICs) configured to implement functionality of the SDN appliances.

Abstract: An enhanced router is described that improves network performance for AI workloads by providing in-network primitives that improve the performance of operations such as Broadcast and Reduce operations. The enhanced router leverages the observation that operations such as the Broadcast and Reduce primitives are more performant (e.g., reduced latency and bandwidth) when performed in the network rather than in graphics processing unites (GPUs) or central processing units (CPUs) which are often deployed as leaf nodes in a typical network topology in a datacenter.

Abstract: High availability network services are provided in a in a virtual computing environment comprising a plurality of network devices running in a software defined network (SDN) of the virtual computing environment, the network devices comprising a plurality of SDN appliances configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment, the hosts implemented on servers communicatively coupled to network interfaces of the SDN appliances, the servers hosting a plurality of virtual machines, the SDN appliance comprising a plurality of smart network interface cards (fNICs) configured to implement functionality of the SDN appliances.

Abstract: Bidirectional flows of a communication session in a software defined network (SDN) are efficiently managed. A smart switch comprises a digital processing unit (DPU) complex comprising one or more DPUs, and a switching complex comprising one or more network processing units (NPUs). The DPU complex is configured to disaggregate enforcement of policies of the SDN from hosts of the SDN. The switching complex is configured to perform network routing of packets in the SDN. The hosts are implemented on servers communicatively coupled to network interfaces of the SDN. The switching complex is configured to perform policy enforcement of data flows for communication sessions that are offloaded from the DPU complex to the switching complex.

Abstract: Distributed computing systems, devices, and associated methods of packet processing are disclosed herein. One example method includes receiving a packet having a header with a protocol field, a source address field, a source port field, a destination address field, and a destination port field individually containing a corresponding value. The method also includes extracting the values of the protocol field, the source address field, the source port field, the destination field, and the destination port field, determining whether a first match action table (“MAT”) contains an entry indexed to the extracted values, and in response to determining that the first MAT does not contain an entry indexed to the extracted values, using a subset of the extracted values to identify an entry in a second MAT.

Abstract: Techniques are described for managing connection states at an active network appliance and a backup network appliance. The active network appliance and backup network appliance are configured to process connections in a software defined network (SDN). The active network appliance is configured to actively process connections, and the backup network appliance maintains connection states such that the backup network appliance can actively process connections in response to a failure of the active network appliance.

Abstract: Techniques are disclosed for managing connections or bidirectional flows of a communication session in a software defined network (SDN). A virtual machine determines that the communication session meets a criterion for offloading policy enforcement of the communication session to an acceleration device. The virtual machine sends to the connection processing engine, a request to offload policy enforcement of the communication session from the virtual machine to the acceleration device.

Abstract: Techniques are disclosed for processing data packets and implementing policies in a software defined network (SDN) of a virtual computing environment. A plurality of computing nodes are communicatively coupled to network devices. The network devices are configured to enable communications between virtual machines within a virtual network of the virtual computing environment in accordance with associated policies. The network devices and the processing function are disaggregated from dependencies on particular computing nodes that are hosting the virtual machines. In particular, network security functions are disaggregated from the host servers.

Abstract: Techniques are disclosed for processing data packets and implementing policies in a software defined network (SDN) of a virtual computing environment. A plurality of computing nodes are communicatively coupled to network devices. The network devices are configured to enable communications between virtual machines within a virtual network of the virtual computing environment in accordance with associated policies. The network devices and the processing function are disaggregated from dependencies on particular computing nodes that are hosting the virtual machines.

Abstract: An anomaly prediction tool is employed on a communication network to monitor systems and/or devices on the network for anomalous behaviors. The anomaly prediction tool can include a machine learning (ML) model to detect anomalous network systems operating on the network based on a data tree derived from network configuration data for the network. In some examples, the ML model is a graph-based convolutional neural network.

Abstract: A virtual network provider system supports a virtual network including virtual machines that are each assigned to an underlay address of an underlay addressing scheme. The virtual network provider system further includes multiple routing domains each defined to include a different subset of the virtual machines. Each of the routing domains is assigned to a range of overlay addresses of an overlay addressing scheme. For each routing domain, the assigned range of overlay addresses is allocated among the subset of the virtual machines in the routing domain. The system further includes a virtual network host configured to use addresses of the overlay addressing scheme to selectively route messages between endpoints on select pairs of the virtual machines assigned to a same routing domain of the plurality of routing domains.

Abstract: The disclosed technology is generally directed to virtual machines. In one example of the technology, a network change from a first virtual network to a second virtual network is reconfigured for a first virtual machine that is executing on a first virtual machine host. The reconfiguring includes the following. In the first virtual machine host, a mapping change from the first virtual network to the second virtual network is configured by reprogramming drivers in the first virtual machine host for route mapping for the second virtual network. A Dynamic Host Configuration Protocol (DHCP) retrigger is caused without rebooting the first virtual machine. A configuration file is provided to the first virtual machine. The configuration file includes user-specific networking settings. The first virtual machine is reconfigured in accordance with the user-specific networking settings.