Abstract: Some embodiments provide a method for identifying root causes of incidents within a network. The method receives a graph of a portion of the network related to a particular network entity for which an incident is reported. The graph specifies dependencies between neighboring network entities in the network. The method uses probabilistic analysis to determine, for each network entity of a set of network entities represented in the graph, whether adjusting a set of metrics of the entity affects one or more metrics of the particular network entity that have been diagnosed as indicative of a problem. The method reports a subset of the network entities with metrics that affect the one or more metrics of the particular network entity as potential root causes of the incident.

Abstract: Some embodiments provide a method for evaluating incidents within a network. The method receives notification of a first incident related to a first network entity and a second incident related to a second network entity. In response to the respective notifications of the first and second incidents, the method uses network monitoring data to generate a first component graph of a first portion of the network that includes the first network entity and a second component graph of a second portion of the network that includes the second network entity. The first and second component graphs respectively include first and second sets of network entities related to the first and second network entities according to the network monitoring data. The method uses the first and second component graphs to respectively identify root causes of the first and second incidents.

Abstract: Some embodiments provide a method for reporting potential root causes of incidents within a network. The method identifies a first network entity as a potential root cause of an incident affecting a second network entity. For each network entity of a set of network entities in a dependency chain beginning with the first network entity and ending with the second network entity, the method assigns a label to the network entity based on measured metrics of the network entity. The method uses a state machine that encodes causality between different network entity labels to generate a human-readable explanation for the first network entity causing the incident affecting the second network entity.

Abstract: In some implementations, a method includes conducting, by a network device, a query associated with a network function chain comprising a plurality of switches and middleboxes to verify whether a service performed by the network function chain complies with a Service Level Agreement (SLA); computing, by the network device, based on a result of the query, a difference in metric value between an actual performance metric of a packet passing through a path in the network function chain and an expected performance metric of the packet passing through the path; deriving, by the network device, a probability of SLA violation associated with the path based on the difference in metric value; and selectively monitoring, by the network device, a network of network function chains by monitoring the path for passive performance measurements based on the probability of SLA violation.

Abstract: The disclosure provides an approach for enabling network functions to be executed in serverless computing environments. One embodiment employs a per-packet architecture, in which the trigger for launching a serverless computing instance is receipt of a packet. In such a case, each received packet is packaged into a request to invoke network function(s) required to process the packet, and a serverless computing environment in turn executes the requested network function(s) as serverless computing instance(s) that process the packet and return a response. Another embodiment employs a per-flow architecture in which the trigger for launching a serverless computing instance is receipt of a packet belonging to a new traffic flow. In such a case, a coordinator identifies (or receives notification of) a received packet that belongs to a new sub-flow and launches a serverless computing instance to process packets of the sub-flow that are redirected to the serverless computing instance.

Abstract: Example implementations disclosed herein can be used to generate composite network policy graphs based on multiple network policy graphs input by network users that may have different goals for the network. The resulting composite network policy graph can be used to program a network so that it meets the requirements necessary to achieve the goals of at least some of the network users. In one example implementation, a method can include receiving multiple network policy graphs, generating composite endpoint groups based on relationships between endpoint groups and policy graph sources, generating composite paths based on the relationships between the endpoints and the network policy graphs, generating a composite network policy graph based on the composite endpoint groups and the composite paths, and analyzing the composite network policy graph to determine conflicts or errors.

Abstract: In some examples, a system can verify a network function by inquiring a model using a query language is described. In some examples, the system can include at least a memory and a processor coupled to the memory. The processor can execute instructions stored in the memory to transmit a plurality of packets into at least one network function that is unverifiable; describe the at least one network function using a model comprising a set of match action rules and a state machine; inquire the model using a query language comprising a temporal logic to obtain a query result indicating an expected behavior of the plurality of packets; and verify the at least one network function based on the query result and the expected behavior of the plurality of packets.

Abstract: A method for containerized workload scheduling can include monitoring network traffic between a first containerized workload deployed on a node in a virtual computing environment to determine affinities between the first containerized workload and other containerized workloads in the virtual computing environment. The method can further include scheduling, based, at least in part, on the determined affinities between the first containerized workload and the other containerized workloads, execution of a second containerized workload on the node on which the first containerized workload is deployed.

Abstract: Example method includes: receiving, by a network device in a network, a first network policy and a second network policy configured by a network administrator, wherein the first network policy comprises a first metric and the second network policy comprises a second and different metric; detecting, by the network device, a conflict between the first network policy and the second network policy; determining, by the network device, a relationship between the first metric and the second metric; modifying, by the network device, at least one of the first network policy and the second network policy to resolve the conflict based on the relationship between the first metric and the second metric; and combining, by the network device, the first network policy and the second network policy to generate a composite network policy that is represented on a single policy graph.

Abstract: In some examples, a method includes parsing, by a network device, a section of source code associated with a network function provided by a middlebox in a network; extracting, by the network device, a packet processing slice and a state transition slice from the section of source code; generating, by the network device, a plurality of execution paths from the packet processing slice and the state transition slice; and modeling the middlebox by inserting, by the network device, the plurality of execution paths to a match-action table that describes a packet processing model for the middlebox.

Abstract: In some implementations, a method includes conducting, by a network device, a query associated with a network function chain comprising a plurality of switches and middleboxes to verify whether a service performed by the network function chain complies with a Service Level Agreement (SLA); computing, by the network device, based on a result of the query, a difference in metric value between an actual performance metric of a packet passing through a path in the network function chain and an expected performance metric of the packet passing through the path; deriving, by the network device, a probability of SLA violation associated with the path based on the difference in metric value; and selectively monitoring, by the network device, a network of network function chains by monitoring the path for passive performance measurements based on the probability of SLA violation.

Abstract: Example method includes: receiving, by a network device, a plurality of input policy graphs and a composed policy graph associated with the input policy graphs; dividing the composed policy graph into a plurality of sub-graphs, each sub-graph comprising a plurality of edges and a plurality of source nodes and destination nodes that the edges are connected to; selecting a first subset of sub-graphs that include, as a source node, a disjoint part of an original source EPG for each input policy graph; identifying a second subset within the first subset of sub-graphs that include, as a destination node, a disjoint part of an original destination EPG for the each input policy graph; and verifying whether connectivity in the composed policy graph reflects a corresponding policy in the plurality of input policy graphs for each sub-graph in the second subset.

Abstract: In some implementations, a method includes conducting, by a network device, a query associated with a network function chain comprising a plurality of switches and middleboxes to verify whether a service performed by the network function chain complies with a Service Level Agreement (SLA); computing, by the network device, based on a result of the query, a difference in metric value between an actual performance metric of a packet passing through a path in the network function chain and an expected performance metric of the packet passing through the path; deriving, by the network device, a probability of SLA violation associated with the path based on the difference in metric value; and selectively monitoring, by the network device, a network of network function chains by monitoring the path for passive performance measurements based on the probability of SLA violation.

Abstract: Example implementations disclosed herein can be used to allocate network resources in a software defined network (SDN). In one example implementation, a method can include receiving a plurality of resource allocation proposals from a plurality of controller modules, instructing the controller modules to generate votes for the plurality of resource allocation proposals, and selecting one of the plurality of resource allocation proposals based on the votes to instantiate the selected resource allocation proposal in the SDN.

Abstract: Systems, methods, and computer-readable executable instructions are provided for implementing an energy proportional network architecture. Implementing an energy proportional network architecture can include determining a number of desired network criteria and a desired number of access ports. A number of switches for the energy proportional network architecture can be calculated from the desired number of access ports and the number of desired network criteria. Implementing an energy proportional network architecture can also include using the number of calculated switches to form the energy proportional network.

Abstract: The disclosure provides an approach for enabling network functions to be executed in serverless computing environments. One embodiment employs a per-packet architecture, in which the trigger for launching a serverless computing instance is receipt of a packet. In such a case, each received packet is packaged into a request to invoke network function(s) required to process the packet, and a serverless computing environment in turn executes the requested network function(s) as serverless computing instance(s) that process the packet and return a response. Another embodiment employs a per-flow architecture in which the trigger for launching a serverless computing instance is receipt of a packet belonging to a new traffic flow. In such a case, a coordinator identifies (or receives notification of) a received packet that belongs to a new sub-flow and launches a serverless computing instance to process packets of the sub-flow that are redirected to the serverless computing instance.

Abstract: Example method includes: receiving, by a network device, a plurality of input policy graphs and a composed policy graph associated with the input policy graphs; dividing the composed policy graph into a plurality of sub-graphs, each sub-graph comprising a plurality of edges and a plurality of source nodes and destination nodes that the edges are connected to; selecting a first subset of sub-graphs that include, as a source node, a disjoint part of an original source EPG for each input policy graph; identifying a second subset within the first subset of sub-graphs that include, as a destination node, a disjoint part of an original destination EPG for the each input policy graph; and verifying whether connectivity in the composed policy graph reflects a corresponding policy in the plurality of input policy graphs for each sub-graph in the second subset.

Abstract: An electronic device has a plurality of environments including respective communication stacks. The environments correspond to respective different user personas. Data associated with the different user personas are communicated in corresponding separate transport flows over the network.

Abstract: Example method includes: receiving, by a network device in a network, a first network policy and a second network policy configured by a network administrator, wherein the first network policy comprises a first metric and the second network policy comprises a second and different metric; detecting, by the network device, a conflict between the first network policy and the second network policy; determining, by the network device, a relationship between the first metric and the second metric; modifying, by the network device, at least one of the first network policy and the second network policy to resolve the conflict based on the relationship between the first metric and the second metric; and combining, by the network device, the first network policy and the second network policy to generate a composite network policy that is represented on a single policy graph.

Abstract: Example method includes: negotiating, by a network device, a location of a data source for a particular network infrastructure manager; inferring, by the network device, a meta label namespace by analyzing the data source, wherein the meta label namespaces comprises at least a relationship between a plurality of meta labels; inferring, by the network device, a label namespace that is specific to the particular network infrastructure manager from the meta label namespace; converting, by the network device, the label namespace to an abstract label namespace; and aggregating, by the network device, the abstract label namespace into a global label namespace that is applicable across diverse network infrastructures.