Abstract: Some embodiments provide a novel method for monitoring network requests from a machine. The method captures the network request at various layers of a protocol stack. At a first layer of a protocol stack, the method tags a packet related to the network request with a tag value, maps the tag value to a set of tuples associated with the packet, and sends a first set of data related to the packet to a security engine. At a second layer of the protocol stack, the method determines whether the packet has been modified through the protocol stack, and sends an updated second set of data to the security engine when the packet has been modified.

Abstract: Some embodiments provide a novel method for authorizing network requests for a machine in a network. In some embodiments, the method is performed by security agents that execute on virtual machines operating on a host machine. In some embodiments, the method captures a network request (e.g., network control packets, socket connection request, etc.) from a primary application executing on the machine. The method identifies an extended context for the network request and determines whether the network request is authorized based on the extended context. The method then processes the network request according to the determination. The extended context of some embodiments includes identifications for primary and secondary applications associated with the network request. Alternatively, or conjunctively, some embodiments include identifications for primary and secondary users associated with the network request.

Abstract: A method and system implemented by a network device, where the network device is in a network having a plurality of nodes. The method computes a loop free alternative (LFA) next hop as a backup for a primary path next hop for intermediate system-intermediate system (IS-IS). The method improves LFA computation efficiency by minimizing expansion of prefixes. The method includes expanding all prefixes of the next LFA shortest path first (SPF) destination node and inheriting a next candidate next hop as a current LFA next hop where the next candidate next hop provides link or node protection and better protection than the current LFA next hop.

Abstract: A method and system are provided to install a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables testing of the LFA next hop to ensure proper handling of data forwarding on the LFA. The method includes receiving a trigger message from an administrative module indicating a switch to the LFA next hop the message including a prefix and an interface. A check is made whether a set of primary path next hops of the prefix have been exhausted. A next primary path next hop is selected from the set of primary path next hops of the prefix. A check is made whether the next primary path next hop matches the interface. The next primary path next hop is replaced by installing the LFA next hop into a global routing information base.

Abstract: A method is implemented by a network device in a network having a plurality of nodes. The method computes a remote loop free alternative (RLFA) next hop as a backup for a primary path next hop. The method improves RLFA computation efficiency for a Q-Space list of nodes in a Q-space for an endpoint node by reducing calculations of the loop free condition for a path from a source node to a destination node via a tunnel between the source node and the endpoint node. The method includes adding a neighbor node to a poison list where the candidate node is in the poison list and the neighbor node is not in the candidate list, the poison list indicating that a node is not a candidate for Q-Space, and determining the Q-Space list by removing nodes from poison list from the plurality of nodes.

Abstract: A method and implementing system calculates a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables consideration of the LFA next hop where a link to the next hop has a reverse cost that has a maximum value. The method includes selecting a next candidate next hop from a set of candidate next hops in the network, checking whether a link to the next candidate next hop is an administratively allowable link, and checking whether the link has a maximum forward cost. The method further checks whether the link is bi-directional and computes the LFA using the next candidate next hop where the link is administratively allowable link, where the link does not have a maximum forward cost and where the link is bi-directional without consideration of reverse cost of the link.

Abstract: Some embodiments of the invention provide a method for performing network access filtering and/or categorization through guest introspection (GI) on a device. In some embodiments, this GI method intercepts directly on a device a data message that device is preparing to send, and uses a service appliance to determine whether the data message can be sent. The device in some embodiments is a guest virtual machine (VM) that executes on a multi-VM host computing device along with a service VM (SVM) that is the service appliance that determines whether the data message can be sent based on a set of filtering rules. In some embodiments, the method uses one or more introspectors (e.g., network introspector and/or file introspector) to capture introspection data from the guest VM (GVM) about the data message that the GVM is preparing to send. To perform the network access filtering, the GI method in some embodiments captures contextual information, such as user and application information (e.g.

Abstract: Some embodiments of the invention provide a method for performing network access filtering and/or categorization through guest introspection (GI) on a device. In some embodiments, this GI method intercepts directly on a device a data message that device is preparing to send, and uses a service appliance to determine whether the data message can be sent. The device in some embodiments is a guest virtual machine (VM) that executes on a multi-VM host computing device along with a service VM (SVM) that is the service appliance that determines whether the data message can be sent based on a set of filtering rules. In some embodiments, the method uses one or more introspectors (e.g., network introspector and/or file introspector) to capture introspection data from the guest VM (GVM) about the data message that the GVM is preparing to send. To perform the network access filtering, the GI method in some embodiments captures contextual information, such as user and application information (e.g.

Abstract: The method and system to computes an LFA next hop as a backup for a primary path next hop that enables an administrator to control LFA selection for a given destination node using a tag and a weight. The method includes checking whether an interface of a next candidate node has a tag with a tag value matching a tag value of a primary SPF path for the destination node. The method further includes checking whether the destination node has any LFA, checking whether a stored tag differs from the tag value of the primary SPF path, and checking whether the interface of the next candidate node is preferred based on a comparison of a weight values, and replacing a stored LFA for the destination node with the next candidate node. Where conditions are met a stored LFA is replaced with the next candidate node.

Abstract: A method is implemented by a network device in a network having a plurality of nodes. The method computes a remote loop free alternative (RLFA) next hop as a backup for a primary path next hop. The method improves RLFA computation efficiency for a Q-Space list of nodes in a Q-space for an endpoint node by reducing calculations of the loop free condition for a path from a source node to a destination node via a tunnel between the source node and the endpoint node. The method includes adding a neighbor node to a poison list where the candidate node is in the poison list and the neighbor node is not in the candidate list, the poison list indicating that a node is not a candidate for Q-Space, and determining the Q-Space list by removing nodes from poison list from the plurality of nodes.

Abstract: A method is implemented by a network device to improve efficiency of computing a node-protecting remote loop-free alternate (LFA) in a network topology graph. The method computes a reverse shortest path first (SPF) algorithm rooted at the primary next hop node, where the reverse SPF algorithm rooted at the primary next hop maintains a reverse path of a shortest path computed by the reverse SPF algorithm rooted at the primary next hop node. The method selects a node that is in both the source node's node-protecting extended P-space that protects the primary next hop node and the primary next hop node's link-protecting Q-space that protects the S-E link.

Abstract: A method and system implemented by a network device, where the network device is in a network having a plurality of nodes. The method computes a loop free alternative (LFA) next hop as a backup for a primary path next hop for intermediate system-intermediate system (IS-IS). The method improves LFA computation efficiency by minimizing expansion of prefixes. The method includes expanding all prefixes of the next LFA shortest path first (SPF) destination node and inheriting a next candidate next hop as a current LFA next hop where the next candidate next hop provides link or node protection and better protection than the current LFA next hop.

Abstract: A method is implemented by a network device to improve efficiency of computing a node-protecting remote loop-free alternate (LFA) in a network topology graph. The method computes a reverse shortest path first (SPF) algorithm rooted at the primary next hop node, where the reverse SPF algorithm rooted at the primary next hop maintains a reverse path of a shortest path computed by the reverse SPF algorithm rooted at the primary next hop node. The method selects a node that is in both the source node's node-protecting extended P-space that protects the primary next hop node and the primary next hop node's link-protecting Q-space that protects the S-E link.

Abstract: The method and system to computes an LFA next hop as a backup for a primary path next hop that enables an administrator to control LFA selection for a given destination node using a tag and a weight. The method includes checking whether an interface of a next candidate node has a tag with a tag value matching a tag value of a primary SPF path for the destination node. The method further includes checking whether the destination node has any LFA, checking whether a stored tag differs from the tag value of the primary SPF path, and checking whether the interface of the next candidate node is preferred based on a comparison of a weight values, and replacing a stored LFA for the destination node with the next candidate node. Where conditions are met a stored LFA is replaced with the next candidate node.

Abstract: A method and implementing system calculates a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables consideration of the LFA next hop where a link to the next hop has a reverse cost that has a maximum value. The method includes selecting a next candidate next hop from a set of candidate next hops in the network, checking whether a link to the next candidate next hop is an administratively allowable link, and checking whether the link has a maximum forward cost. The method further checks whether the link is bi-directional and computes the LFA using the next candidate next hop where the link is administratively allowable link, where the link does not have a maximum forward cost and where the link is bi-directional without consideration of reverse cost of the link.

Abstract: A method and system are provided to install a loop free alternative (LFA) next hop as a backup for a primary path next hop for an interior gateway protocol (IGP). The method enables testing of the LFA next hop to ensure proper handling of data forwarding on the LFA. The method includes receiving a trigger message from an administrative module indicating a switch to the LFA next hop the message including a prefix and an interface. A check is made whether a set of primary path next hops of the prefix have been exhausted. A next primary path next hop is selected from the set of primary path next hops of the prefix. A check is made whether the next primary path next hop matches the interface. The next primary path next hop is replaced by installing the LFA next hop into a global routing information base.

Abstract: Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Abstract: A method is executed by a router for improved Intermediate System to Intermediate System (IS-IS) protocol and Neighbor Discovery (ND) protocol execution to avoid dropped data traffic caused by Media Access Control (MAC) address resolution for next hops of routes determined by the IS-IS protocol. An IS-IS adjacency is established between the router and a neighbor router over a link, where a MAC address for the neighbor router is received from the neighbor router. A routing information base (RIB) is updated to include the neighbor router as a next hop for at least one destination address by the IS-IS process. The MAC address of the neighbor router is provided to an ND process to update the RIB, a forwarding information base (FIB) or L2 forwarding table of at least one line card of the router to include the MAC address of the neighbor router in response to the providing of the MAC address to the ND process.

Abstract: A method and system for providing a connected sales associate service application via a mobile device. The application provides for an integrated platform upon which various tools for providing support to a sales associate are built. The application includes a database of information regarding the sales associates and operational information regarding a retail establishment, and provides a user interface for allowing the sales associate to access a central server for the retail establishment along with multiple additional sales associates on multiple additional mobile devices. The user interface enables the store associate to initialize and conduct VoIP calls with any of the other additional sales associates through each of their respective mobile devices. In addition, stationary user interfaces can be positioned throughout the store to enable customers to request assistance from sales associates.