Abstract: Techniques are described herein for providing bi-directional path selection based on indicated path preferences in policy data. Such techniques may be performed by a network node and may comprise generating a set of paths to a destination, a first path of the set of paths being labeled as a direct path and a second path of the set of paths being labeled as an indirect path. Such techniques may subsequently comprise receiving a communication from a source and directed to the destination, determining, based on a first indicated path preference for the destination and a second indicated path preference for the source, a path category, selecting a forwarding path as one of the first path or the second path based on the determined path category, and routing the communication to a next hop in the selected forwarding path.

Abstract: Techniques described herein can perform per-queue network performance measurement mapping, in which per-queue network performance measurements are determined and then mapped back to service level agreement (SLA) classes assigned to use the queues. Network traffic associated with an SLA class can be processed through an assigned router queue. Wide area network (WAN) as well as local performance measurements from the assigned queue can be combined to determine a combined performance measurement associated with the assigned queue. The combined performance measurement can then be mapped or otherwise associated with the SLA class. Similarly, combined performance measurements can be determined for other router queues and mapped or otherwise associated with other SLA classes.

Abstract: In some aspects, a method for managing policies on a mobile client device within a Software-Defined Wide Area Network (SD-WAN) is disclosed. The method can include receiving, at a controller, a policy based on knowledge of a route the mobile client device. The controller transmits this policy to the mobile client device. The policy specifies the transition to base stations in the policy area to provide connectivity for the mobile client device based on its position along the route. As the mobile client device enters a policy area defined by the received policy, it signals its entry to the controller. In response to a request, the buffer is increased upon its entry into the policy area. Once the mobile client device is predicted to exit the policy area, it is prompted to resume normal operation. If normal operation is not detected, the system smoothly transitions into a GR mode.

Abstract: Techniques described herein can perform per-queue network performance measurement mapping, in which per-queue network performance measurements are determined and then mapped back to service level agreement (SLA) classes assigned to use the queues. Network traffic associated with an SLA class can be processed through an assigned router queue. Wide area network (WAN) as well as local performance measurements from the assigned queue can be combined to determine a combined performance measurement associated with the assigned queue. The combined performance measurement can then be mapped or otherwise associated with the SLA class. Similarly, combined performance measurements can be determined for other router queues and mapped or otherwise associated with other SLA classes.

Abstract: In one aspect, a method for managing traffic in an SD-WAN controller is disclosed. The method involves receiving a policy from an SD-WAN controller at an edge network device in an SD-WAN. This policy specifies a NAT method for DIA action and includes configurations for selecting the NAT method. The method includes receiving data traffic at the edge network device, where the traffic is matched with the configurations in the policy to identify a supporting NAT method. The NAT method is selected based on the data traffic matching a configuration in the policy. An available DIA path corresponding to the configuration is chosen, and an IP address consistent with the NAT method specified by the policy is applied to the data traffic. The data traffic is routed along the available DIA path based on the configurations and the IP address applied during the NAT method in accordance with the policy.

Abstract: This disclosure describes techniques and mechanisms for enabling intent-based application traffic steering in a network. The techniques may enable a controller to resolve affinity in data policies with TLOC lists and user intent. The techniques may enable branches to apply local affinity preference orders and data policies when routing traffic. The techniques enable network administrators to create and apply a single data policy across branches of a network, such that regardless of the number of hubs or the number of branches, the techniques described herein create just one data policy (e.g., a centralized data policy), resulting in significant simplification of the network configuration to be created, managed, and/or deployed.

Abstract: Techniques are described herein for providing bi-directional path selection based on indicated path preferences in policy data. Such techniques may be performed by a network node and may comprise generating a set of paths to a destination, a first path of the set of paths being labeled as a direct path and a second path of the set of paths being labeled as an indirect path. Such techniques may subsequently comprise receiving a communication from a source and directed to the destination, determining, based on a first indicated path preference for the destination and a second indicated path preference for the source, a path category, selecting a forwarding path as one of the first path or the second path based on the determined path category, and routing the communication to a next hop in the selected forwarding path.

Abstract: Techniques described herein can perform per-queue network performance measurement mapping, in which per-queue network performance measurements are determined and then mapped back to service level agreement (SLA) classes assigned to use the queues. Network traffic associated with an SLA class can be processed through an assigned router queue. Wide area network (WAN) as well as local performance measurements from the assigned queue can be combined to determine a combined performance measurement associated with the assigned queue. The combined performance measurement can then be mapped or otherwise associated with the SLA class. Similarly, combined performance measurements can be determined for other router queues and mapped or otherwise associated with other SLA classes.

Abstract: In one embodiment, a method includes receiving, by a network node, traffic within a hierarchical software-defined wide area network (SD-WAN) network. The method also includes determining, by the network node, a destination region of the traffic. The destination region is within the hierarchical SD-WAN network. The method further includes classifying, by the network node, the traffic based on a destination match condition. The destination match condition is associated with two or more destination regions.

Abstract: According to one aspect, a method includes monitoring traffic between a first network element and a second network element, and determining when no packets have been sent from the first network element towards the second network element within a predetermined amount of time. When it is determined that no packets have been sent from the first network element towards the second network element within the predetermined amount of time, the method includes sending at least one smart probe packet from the first network element to the second network element.

Abstract: In one embodiment, methods are described to measure bandwidth limits through multiple test sites. A testing quantity of network packets is generated, the network packets are sent through a service provider network to a plurality of receivers at a testing transmission rate that exceeds an upstream transmission rate limit of the service provider network, a report indicating a received number of packets is received from each of the plurality of receivers, and an upstream transmission rate limit of the service provider network is determined based on the testing transmission and the reports. By using multiple test sites, potential bottlenecks at any one test site are reduced. A similar method can be used to calculate a downstream transmission rate limit. Once measured, the bandwidth limits may be used to adjust quality of service on an edge router or compared against a known service level agreement of the service provider network.

Abstract: According to one aspect, a method includes monitoring traffic between a first network element and a second network element, and determining when no packets have been sent from the first network element towards the second network element within a predetermined amount of time.

Abstract: In an embodiment, a method comprises receiving a request to obtain network performance data for a plurality of target nodes; determining geo-locations of the plurality of target nodes; based on the geo-locations, determining a set of the plurality of target nodes that are within a specified proximity radius; selecting one particular target node in the set; sending a probe packet, requesting network performance data, to the one particular target node in the set and not to all other target nodes in the set; applying, to all the target nodes in the set, network performance data that is received in response to the probe packet; wherein the method is performed by one or more processors.

Abstract: In one embodiment, methods are described to measure bandwidth limits through multiple test sites. A testing quantity of network packets is generated, the network packets are sent through a service provider network to a plurality of receivers at a testing transmission rate that exceeds an upstream transmission rate limit of the service provider network, a report indicating a received number of packets is received from each of the plurality of receivers, and an upstream transmission rate limit of the service provider network is determined based on the testing transmission and the reports. By using multiple test sites, potential bottlenecks at any one test site are reduced. A similar method can be used to calculate a downstream transmission rate limit. Once measured, the bandwidth limits may be used to adjust quality of service on an edge router or compared against a known service level agreement of the service provider network.

Abstract: In an embodiment, a method comprises receiving a request to obtain network performance data for a plurality of target nodes; determining geo-locations of the plurality of target nodes; based on the geo-locations, determining a set of the plurality of target nodes that are within a specified proximity radius; selecting one particular target node in the set; sending a probe packet, requesting network performance data, to the one particular target node in the set and not to all other target nodes in the set; applying, to all the target nodes in the set, network performance data that is received in response to the probe packet; wherein the method is performed by one or more processors.

Abstract: A method and apparatus for multiple string searching using a ternary content addressable memory. For one embodiment, the method includes selecting character groups from an input text string in a temporal sequence, each character group having more than one character. A first character group of the character groups is compared with a plurality of character fields and a current state of a state machine is compared with a plurality of states of the state machine that correspond to the plurality of character fields to identify information indicative of a subsequent state of the state machine. Comparison of the first character group with the plurality of sets of character fields is repeated if the information indicative of the subsequent state of the state machine indicates that a terminal number of characters of a desired character pattern has been located and that the terminal number of characters is fewer than the number of characters in the first character group.

Abstract: A content search system for determining whether a plurality of input strings each belonging to any one of a number of different process flows matches one or more of a plurality of regular expressions, including a search circuit for searching the input strings for the regular expressions and a data management unit including a control circuit having an input to receive the plurality of input strings, wherein each input string has an associated flow identification (ID) value, a packet queue having a number of storage locations for storing the input strings, and a flow engine that forwards a selected input string from the packet queue to the search circuit.

Abstract: A network system includes a content search system for determining whether an input string matches a regular expression comprising an exact pattern and an inexact pattern, the content search system including a first search circuit dedicated to perform an exact string match operation to determine whether the input string contains a first portion that matches the exact pattern, and a second search circuit dedicated to perform an inexact string match operation to determine whether the input string contains a second portion that matches the inexact pattern.

Abstract: A content search circuit for determining whether an input string matches one or more of a plurality of regular expressions, the content search circuit including an instruction memory for storing a plurality of microprograms, each microprogram embodying a corresponding one of the regular expressions, a control circuit having an input to receive the input string, and having a number of outputs, and a plurality of search engines, each having a first input coupled to a corresponding output of the control circuit and having a second input coupled to the instruction memory, wherein each search engine is selectable to execute any of the microprograms stored in the instruction memory to search the input string for any of the regular expressions embodied in the microprograms.

Abstract: A method of controlling a content addressable memory (CAM) device. A data structure is generated that specifies (i) a prioritized set of rules and (ii) storage locations within the CAM device for one or more match clauses of each of the rules. A new rule having a specified priority is recorded in the data structure. Candidate storage locations within the CAM device are identified within the CAM device for the match clauses of each of the rules having a lower priority than the new rule. The candidate storage locations are compared with the storage locations specified by the data structure. Each match clause for which the candidate storage location does not match the specified storage location is stored in the CAM device.