Abstract: In one embodiment, periodic round-trip probes are executed in a network, whereby a packet is transmitted along a particular communication path from a source to a destination and back to the source. Statistical information relating to the round-trip probes is gathered, and a transmission delay of the round-trip probes is calculated based on the gathered statistical information. Also, an end-to-end transmission delay along an arbitrary communication path in the network is estimated based on the calculated transmission delay of the round-trip probes.

Abstract: In one embodiment, information relating to network metrics in a computer network is collected. A packet delay for a packet to be transmitted along a particular communication path is predicted based on the network metrics. Then, an optimal packet size for optimizing a transmission experience of the packet to be transmitted along the particular communication path is calculated based on the predicted packet delay. Also, a size of the packet to be transmitted along the particular communication path is dynamically adjusted based on the calculated optimal packet size.

Abstract: In one embodiment, a routing topology of a network including nodes interconnected by communication links is determined. Important nodes in the network which are of relative importance are determined based on their location in the determined routing topology. Also, one or more request messages are sent causing the important nodes to gather local network metrics. Then, in response to the one or more request messages, one or more response messages including the network metrics gathered by each important node are received.

Abstract: In one embodiment, a request is received from a requesting node in a network to assist in distributing a task of the requesting node. Upon receiving the message, a capability to perform the task of one or more helping nodes in the network is evaluated, and a helping node of the one or more helping nodes is selected to perform the task based on the evaluated capability of the selected helping node. The distribution of the task is then authorized from the requesting node to the selected helping node.

Abstract: In one embodiment, variables maintained by each of a plurality of Learning Machines (LMs) are determined. The LMs are hosted on a plurality of Field Area Routers (FARs) in a network, and the variables are sharable between the FARs. A plurality of correlation values defining a correlation between the variables is calculated. Then, a cluster of FARs is computed based on the plurality of correlation values, such that the clustered FARs are associated with correlated variables, and the cluster allows the clustered FARs to share their respective variables.

Abstract: In one embodiment, a message is received at a node in a network indicating that the node is classified as a critical node, and requesting the node to proactively time-stamp data packets. Data packets are received from one or more child nodes of the node, and the node selects a data packet of the received data packets to time-stamp. Then, the node proactively inserts a time-stamp in the selected data packet. The time-stamped data packet is sent toward a central management node.

Abstract: In one embodiment, a device (e.g., learning machine) determines a plurality of fate-sharing group (FSG) nodes in a computer network that are prone to simultaneously send an alarm upon detecting an event. As such, the device may elect one or more FSG owner nodes as a subset of the FSG nodes, and instructs the FSG group such that only FSG owner nodes send an alarm upon event detection.

Abstract: Statistical and historical values of performance metrics are actively used to influence routing decisions for optimum topologies in a constrained network. Traffic service level is constantly monitored and compared with a service level agreement. If deviation exists between the monitored traffic service level and the terms of the service level agreement, stability metrics are used to maintain paths through the network that meet the terms of the traffic service level agreement or that improve the traffic flow through the network. Backup parent selection for a node in the network is performed based on previous performance of backup parents for the node.

Abstract: In one embodiment, a routing topology of a network including nodes interconnected by communication links is determined, and activity in the network is monitored to determine a normal behavior of the communication links. Weak communication links in the network that deviate from the determined normal behavior are detected, and it is then determined whether the weak communication links are spatially correlated based on the determined topology of the network. In response to the weak communication links being spatially correlated, a region of the network affected by the weak communication links is identified as a dark zone that is to be avoided when routing data packets in the network.

Abstract: In one embodiment, a particular node in a shared-media communication network determines a resource level and in response to determining a trigger condition (e.g., that the resource level is below a threshold), the particular node enters a selective forwarding mode. In the selective forwarding mode, the particular node does not forward non-critical messages. The particular node also notifies one or more neighboring nodes in the shared-media communication network of the entered selective forwarding mode. In another embodiment, a node may receive from a neighboring node, an indication of having entered a selective forwarding mode, and in response the node may forward only critical messages to the neighboring node.

Abstract: In one embodiment, a node receives a request to initiate a shadow joining operation to shadow join a field area router (FAR) of a computer network, and preserves its data structures and soft states. The shadow joining operation may then be initiated to shadow join the FAR, wherein shadow joining comprises preforming join operations without leaving a currently joined-FAR, and the node measures one or more joining metrics of the shadow joining operation, and reports them accordingly. In another embodiment, a FAR (or other management device) determines a set of nodes to participate in a shadow joining operation, and informs the set of nodes of the shadow joining operation to shadow join the FAR. The device (e.g., FAR) participates in the shadow joining operation, and receives reports of one or more joining metrics of the shadow joining operation measured by the set of nodes.

Abstract: In one embodiment, a first device in a network receives traffic flow data from a plurality of devices in the network. The traffic flow data from at least one of the plurality of devices comprises raw packets of a traffic flow. The first device selects a set of reporting devices from among the plurality of devices based on the received traffic flow data. The first device provides traffic flow reporting instructions to the selected set of reporting devices. The traffic flow reporting instructions cause each reporting device to provide sampled traffic flow data to an anomaly detection device.

Abstract: In one embodiment, a device in a network monitors one or more metrics regarding network traffic associated with a particular application. The device detects an application-centric anomaly based on the monitored one or more metrics. The device causes an anomaly mitigation action to be performed in the network, in response to detecting the application-centric anomaly.

Abstract: In one embodiment, a first device in a network identifies an anomalous traffic flow in the network. The first device reports the anomalous traffic flow to a supervisory device in the network. The first device determines a quarantine policy for the anomalous traffic flow. The first device determines an action policy for the anomalous traffic flow. The first device applies the quarantine and action policies to one or more packets of the anomalous traffic flow.

Abstract: In one embodiment, a first device in a network maintains raw traffic flow information for the network. The first device provides a compressed summary of the raw traffic flow information to a second device in the network. The second device is configured to transform the compressed summary for presentation to a user interface. The first device detects an anomalous traffic flow based on an analysis of the raw traffic flow information using a machine learning-based anomaly detector. The first device provides at least a portion of the raw traffic flow information related to the anomalous traffic flow to the second device for presentation to the user interface.

Abstract: In one embodiment, a targeted node in a computer network receives a probe generation request (PGR), and in response, generates a link-local multicast PGR (PGR-Local) carrying instructions for generating probes based on the PGR. The targeted node then transmits the PGR-Local to neighbors of the targeted node to cause one or more of the neighbors to generate and transmit probes to a collection device in the computer network according to the PGR-Local instructions. In another embodiment, a particular node in a computer network receives a link-local multicast probe generation request (PGR-Local) from a targeted node in the computer network, the targeted node having received the PGR-Local from a remote device, and determines how to generate probes based on instructions carried within the PGR-Local before sending one or more probes to a collection device in the computer network according to the PGR-Local instructions.

Abstract: In one embodiment, a packet to be transmitted along a communication path in a network from a source to a destination is determined, the communication path having one or more hops between the source and the destination. An instruction is sent to one or more tracking nodes along the communication path to track a number of local retransmissions required to successfully transmit the packet from each tracking node to a respective next-hop destination. Then, reports indicating the number of local retransmissions are received from the one or more tracking nodes.

Abstract: Statistical and historical values of performance metrics are actively used to influence routing decisions for optimum topologies in a constrained network. Traffic service level is constantly monitored and compared with a service level agreement. If deviation exists between the monitored traffic service level and the terms of the service level agreement, stability metrics are used to maintain paths through the network that meet the terms of the traffic service level agreement or that improve the traffic flow through the network. Backup parent selection for a node in the network is performed based on previous performance of backup parents for the node.

Abstract: In one embodiment, a plurality of communication paths in a second direction in a communication network is determined, based on reversing communication paths established in a first direction in the communication network. Then, a path quality of the communication paths in the second direction is monitored. Based on the monitored path quality, it is then determined whether the communication paths in the second direction satisfy a communication requirement. Finally, a particular communication path of unacceptable quality in the second direction is detected when the particular communication path in the second direction fails to satisfy the communication requirement.

Abstract: In one embodiment, a request to make a prediction regarding one or more service level agreements (SLAs) in a network is received. A network traffic parameter and an SLA requirement associated with the network traffic parameter according to the one or more SLAs are also determined. In addition, a performance metric associated with traffic in the network that corresponds to the determined network traffic parameter is estimated. It may then be predicted whether the SLA requirement would be satisfied based on the estimated performance metric.