Abstract: Systems and methods are provided for collecting data related to changes to a data store table, which may be used for analyzing problems that occur in the network. The information monitored may include types of changes made to a data store/table, such as insertions and deletions of data store elements. When an anomaly occurs in the statistical data store/table data, an alert is issued. This statistical data of the types of changes to a data store may be suggestive of similar changes in a network. For example, the uptime, inactive time, and stable time of rows of a data store table may be used for estimating or inferring the uptime, inactive time, and stable time for nodes, data paths, or other elements of a network. The system may include a web UI or a command line interface, which may aid in diagnosing problems in the network, and taking corrective action.

Abstract: Examples disclosed herein relate to performing an action based on an advertisement indicator is present in a network packet. In one example, a network packet identified by a network infrastructure device as matching criteria associated with a pre-identified request is received. A parameter within the network packet is identified. A rule is used to determine whether the parameter indicates that an advertisement indicator is present in a flow associated with the network packet. An action is performed based on whether the advertisement indicator is present in the network packet.

Abstract: A method for accessing a computing device including launching a first operating system having a bootloader to boot a second operating system into a random-access memory on the computing device, the first operating system and the second operating system having access to an administrator password contained in an administrator password file located in a persistent file of the computing device and booting the second operating system from the first operating system bootloader to populate a filesystem into the second operating system. Also, executing a login failsafe by the second operating system to read the administrator password contained in the administrator password file located in the persistent file and installing the administrator password file in the filesystem of the second operating system by the login failsafe.

Abstract: An expression evaluation system is provided. During operation, the system can obtain an encoded expression associated with a user group of a network and evaluate the encoded expression for a first switch to determine a first set of commands that the user group is allowed to execute on the first switch. The encoded expression can encode a set of commands. The system can then determine validity of the first set of commands for the user group by determining whether a respective user of the user group should be allowed to execute the first set of commands on the first switch. If the system identifies an issue with the validity of the first set commands, the system can generate a notification indicating the issue.

Abstract: An expression evaluation system is provided. During operation, the system can obtain an encoded expression associated with a user group of a network and evaluate the encoded expression for a first switch to determine a first set of commands that the user group is allowed to execute on the first switch. The encoded expression can encode a set of commands. The system can then determine validity of the first set of commands for the user group by determining whether a respective user of the user group should be allowed to execute the first set of commands on the first switch. If the system identifies an issue with the validity of the first set commands, the system can generate a notification indicating the issue.

Abstract: Embodiments herein relate to transmitting specific traffic along a blocked link. A status of links between switches of a network is monitored. The status of the links is one of blocked and non-blocked. A blocked link is not used by a Spanning Tree Protocol (STP). At least one of the network switches is configured to transmit the specific traffic along the blocked link.

Abstract: A method for accessing a computing device including launching a first operating system having a bootloader to boot a second operating system into a random-access memory on the computing device, the first operating system and the second operating system having access to an administrator password contained in an administrator password file located in a persistent file of the computing device and booting the second operating system from the first operating system bootloader to populate a filesystem into the second operating system. Also, executing a login failsafe by the second operating system to read the administrator password contained in the administrator password file located in the persistent file and installing the administrator password file in the filesystem of the second operating system by the login failsafe.

Abstract: An example of a computing system is described herein. The computing system includes a plurality of network security devices. The computing system also includes a network switch configured to direct network traffic. The computing system further includes a controller coupled to the network switch. The controller is to instruct the network switch in directing network traffic to the plurality of network security devices.

Abstract: In some examples, a method can include monitoring data traffic along an uplink port and along at least a subset of a plurality of host ports, determining whether the uplink port is oversubscribed based on the monitored data traffic, determining whether a given host port of the at least a subset of host ports is receiving excessive data traffic in response to determining that the uplink port is oversubscribed, and flagging a host port that is determined to be receiving excessive data traffic.

Abstract: Example embodiments disclosed herein relate to determining whether a device exhibits anomalous behavior based on a set of rules, address usage information, and address range information. Address usage information for a device communicating on a data plane of a network implemented using switches is received via a control plane. Address range information for the network is maintained. Whether the device exhibits anomalous behavior is determined based on the set of rules, address usage information, and address range information.

Abstract: Systems and methods associated with service insertion forwarding are disclosed. One example method includes building a service insertion address table. The service insertion address table may associate service insertion tunnels with device addresses based on payload source addresses retrieved from packets received via the service insertion tunnels. The method also includes forwarding a packet received from a source device to a destination device. The packet may be received from the source device via a source service insertion tunnel. The packet may be forwarded to the destination device via a destination service insertion tunnel. The destination service insertion tunnel may be associated with the destination device in the service insertion address table.

Abstract: Examples include a network device to filter a packet for a packet type. The network device includes a filter to receive the packet and to determine whether the packet is a defined packet type. The network device also includes a Bloom filter to receive the packet from the filter based on the determination that the packet is a defined packet type and to determine whether the packet is a matched packet or an unmatched packet. A processing resource of the network device may receive the packet from the Bloom filter based on the determination that the packet is a matched packet and to determine whether the packet is an exact match.

Abstract: Examples disclose a system comprising an integrated circuit to determine whether a data packet should be processed by a shared security engine associated with a secure link. Additionally, the examples disclose a first media access control (MAC), associated with the shared security engine, to receive the data packet for transmission on the secure link based on the determination the data packet should be processed by the shared security engine.

Abstract: In some examples, a method can include monitoring data traffic along an uplink port and along at least a subset of a plurality of host ports, determining whether the uplink port is oversubscribed based on the monitored data traffic, determining whether a given host port of the at least a subset of host ports is receiving excessive data traffic in response to determining that the uplink port is oversubscribed, and flagging a host port that is determined to be receiving excessive data traffic.

Abstract: Example embodiments disclosed herein relate to determining whether a device exhibits anomalous behavior based on a set of rules, address usage information, and address range information. Address usage information for a device communicating on a data plane of a network implemented using switches is received via a control plane. Address range information for the network is maintained. Whether the device exhibits anomalous behavior is determined based on the set of rules, address usage information, and address range information.

Abstract: Examples include a network device to filter a packet for a packet type. The network device includes a filter to receive the packet and to determine whether the packet is a defined packet type. The network device also includes a Bloom filter to receive the packet from the filter based on the determination that the packet is a defined packet type and to determine whether the packet is a matched packet or an unmatched packet. A processing resource of the network device may receive the packet from the Bloom filter based on the determination that the packet is a matched packet and to determine whether the packet is an exact match.

Abstract: Methods, network controllers, and machine-readable and executable instructions are provided to determine a secure path between a source device and a destination device. The secure path may be via a plurality of network devices. The secure path may be determined based on a security capability of each of the plurality of network devices in the secure path. Data may be forwarded between the source device and the destination device, via the plurality of network devices, based on the determined path.

Abstract: Example embodiments disclosed herein relate to monitoring Dynamic Device Configuration Protocol offers via a control plane. In one example, an address range or multiple address ranges for sources of the Dynamic Device Configuration Protocol offers can be tracked. In this example, an anomaly can be determined based on one of the Dynamic Device Configuration Protocol offers and the address range(s).

Abstract: Systems and methods associated with service insertion forwarding are disclosed. One example method includes building a service insertion address table. The service insertion address table may associate service insertion tunnels with device addresses based on payload source addresses retrieved from packets received via the service insertion tunnels. The method also includes forwarding a packet received from a source device to a destination device. The packet may be received from the source device via a source service insertion tunnel. The packet may be forwarded to the destination device via a destination service insertion tunnel. The destination service insertion tunnel may be associated with the destination device in the service insertion address table.

Abstract: An example of a computing system is described herein. The computing system includes a network switch configured to direct network traffic. The computing system also includes a network device to receive the network traffic. The computing system further includes a controller coupled to the network switch. The controller is to monitor network traffic in the network switch and generate a policy to instruct the network switch in selecting a portion of the network traffic to direct to the network device.