Abstract: Methods and systems for load balancing of a communication network are described. Examples of the disclosed methods and systems may be topology agnostic (not specific to a particular network topology). Congestion information is obtained for a plurality of paths between two switches in the communication network. A selection probability is obtained for each path using the congestion information. A flowlet is assigned to a path based on the selection probabilities. Each path may be assigned to a path group, where each path group comprises paths of equal length. The selection probabilities may be computed for each path group and for each path within each path group, and the flowlet may be assigned by selecting a path group based on the selection probabilities of the path groups, and selecting a path within the selected path group.

Abstract: A method and a network device are provided for transferring data packets to a port according to the priority of the packets and, when a packet is dropped, providing, to the sender of the packets, an early notification that the packet was dropped. The priority of a packet can be determined according to data contained in the packet, e.g., an operation code of the packet, or according to a marking of the packet by the sender, e.g., a marking resulting from a weighted random early detection template. The early notification that the packet was dropped is in the form of message generated at the network device and sent by the network device to the sender of the packet. The network device obtains, form the packet to be dropped or from a connection table, the information required for the message to arrive at the sender.

Abstract: There is provided a method and apparatus to provide notification of change events for microburst mitigation. The method is used by a sending device and includes tracking changes in scheduled data to be sent in a traffic flow and identifying a positive change in an amount of scheduled data to be sent in the traffic flow. The sending device then marks one or more packets to be sent in the traffic flow with a notification field, and then transmits the one or more packets including the notification field. The notification field can then be used by a recipient device, for example a network element, to identify and mitigate microbursts in a proactive manner.

Abstract: Methods and systems related to construction and implementation of high radix topologies are disclosed. The nodes of the network topology are divided into a number of groups. Intra-group connections are constructed by connecting the nodes of each group according to a first complementary base graph. Inter-group connections are constructed based on a second complementary base graph and a plurality of permutation matrices. Each permutation matrix represents a pattern for selecting source group and destination group for each inter-group connection. One permutation matrix is randomly assigned to each edge of the second complementary base graph. An inter-group connection is constructed by identifying a source node and a destination node corresponding to a selected edge of the second complementary base graph, and identifying a source group and a destination group according to the permutation matrix assigned to the selected edge.

Abstract: Methods and systems for partially or fully distributed network verification are described. In partially distributed network verification, each network device generates a respective device-level binary decision diagram (BDD) representing the logical behavior of the respective network device for a network property of interest. The device-level BDDs from each network device are received by a verification service that performs verification by generating an input BDD representing an input header space, and applies each device-level BDD in a logical path from a source device to a destination device, and reports the output BDD. In fully distributed network verification, each network device is responsible for calculating a device-specific output BDD by applying a device-specific BDD, which represents the logical behavior of the network device, to a device-specific input BDD.

Abstract: Methods and systems for load balancing of a communication network are described. Examples of the disclosed methods and systems may be topology agnostic (not specific to a particular network topology). Congestion information is obtained for a plurality of paths between two switches in the communication network. A selection probability is obtained for each path using the congestion information. A flowlet is assigned to a path based on the selection probabilities. Each path may be assigned to a path group, where each path group comprises paths of equal length. The selection probabilities may be computed for each path group and for each path within each path group, and the flowlet may be assigned by selecting a path group based on the selection probabilities of the path groups, and selecting a path within the selected path group.

Abstract: Methods and systems for partially or fully distributed network verification are described. In partially distributed network verification, each network device generates a respective device-level binary decision diagram (BDD) representing the logical behavior of the respective network device for a network property of interest. The device-level BDDs from each network device are received by a verification service that performs verification by generating an input BDD representing an input header space, and applies each device-level BDD in a logical path from a source device to a destination device, and reports the output BDD. In fully distributed network verification, each network device is responsible for calculating a device-specific output BDD by applying a device-specific BDD, which represents the logical behavior of the network device, to a device-specific input BDD.

Abstract: Methods, systems and media for network model checking using entropy based binary decision diagram (BDD) compression are described. Two related compression techniques are described: bit level reduction to reduce the number of bits required for each network field according to its nature, and field level reduction to reduce the size of the BDD tree by finding a near-optimum ordering of the fields in the BDD space. These two techniques, separately or together, may alleviate the state explosion problem the limits application of BDD based model checking. The two techniques complement each other synergistically, particularly in the domain of computer network checking and verification.

Abstract: Methods and systems for network verification are described. An input binary decision diagram (BDD) is defined to represent an input header space to query for a network property of interest. The input BDD is provided as input to a device-level BDD representing a source device in a logical topology representing connections among devices of the network. Each device in the network is represented by a respective device-level BDD in the logical topology. An output BDD is calculated, representing an output header space outputted by a destination device in the logical topology. The output BDD is calculated by sequentially applying, to the input BDD, each device-level BDD in a logical path from the source device to the destination device. The output BDD is then reported, and the reported output BDD is compared with an expected output BDD, to verify the network property of interest.

Abstract: Methods and systems for partially or fully distributed network verification are described. In partially distributed network verification, each network device generates a respective device-level binary decision diagram (BDD) representing the logical behavior of the respective network device for a network property of interest. The device-level BDDs from each network device are received by a verification service that performs verification by generating an input BDD representing an input header space, and applies each device-level BDD in a logical path from a source device to a destination device, and reports the output BDD. In fully distributed network verification, each network device is responsible for calculating a device-specific output BDD by applying a device-specific BDD, which represents the logical behavior of the network device, to a device-specific input BDD.

Abstract: Methods and systems for network verification are described. An input binary decision diagram (BDD) is defined to represent an input header space to query for a network property of interest. The input BDD is provided as input to a device-level BDD representing a source device in a logical topology representing connections among devices of the network. Each device in the network is represented by a respective device-level BDD in the logical topology. An output BDD is calculated, representing an output header space outputted by a destination device in the logical topology. The output BDD is calculated by sequentially applying, to the input BDD, each device-level BDD in a logical path from the source device to the destination device. The output BDD is then reported, and the reported output BDD is compared with an expected output BDD, to verify the network property of interest.

Abstract: Methods, systems and media for network model checking using entropy based binary decision diagram (BDD) compression are described. Two related compression techniques are described: bit level reduction to reduce the number of bits required for each network field according to its nature, and field level reduction to reduce the size of the BDD tree by finding a near-optimum ordering of the fields in the BDD space. These two techniques, separately or together, may alleviate the state explosion problem the limits application of BDD based model checking. The two techniques complement each other synergistically, particularly in the domain of computer network checking and verification.

Abstract: Aspects of the disclosure provide a system and method used for receiving Address Resolution Protocol (ARP) requests from access nodes and returning a designated address to satisfy a service provider' policies. This can include receiving a request from an access node at a provider edge node, and returning a designated Media Access Control (MAC) address in response to a request for a MAC address for a specified destination IP address, the designated MAC address being a MAC address for a node other than the provider edge node. This can effectively route requests to a Policy Enforcement point (PEP), which can be, for example a Broadband Services Router (BSR). A network controller can update ARP tables in the provider edge node to ensure that traffic which require policy enforcement can be routed to the PEP, whereas traffic which does not require policy enforcement can be normally routed towards the traffic's destination.

Abstract: Aspects of the disclosure provide a system and method used for receiving Address Resolution Protocol (ARP) requests from access nodes and returning a designated address to satisfy a service provider' policies. This can include receiving a request from an access node at a provider edge node, and returning a designated Media Access Control (MAC) address in response to a request for a MAC address for a specified destination IP address, the designated MAC address being a MAC address for a node other than the provider edge node. This can effectively route requests to a Policy Enforcement point (PEP), which can be, for example a Broadband Services Router (BSR). A network controller can update ARP tables in the provider edge node to ensure that traffic which require policy enforcement can be routed to the PEP, whereas traffic which does not require policy enforcement can be normally routed towards the traffic's destination.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: A service description may be used in network virtualization in order to specify requirements of an application. In order to provide network virtualization for generic networking components, including legacy networking components, the service description is mapped to a logical network implementation and then subsequently mapped to a physical implementation.

Abstract: A method of routing a packet from a source associated with a first VRF function instantiated on a device to a destination associated with a second VRF function instantiated on the device. The method comprises creating a logical link between a first logical interface on the first VRF function and a second logical interface on the second VRF function. The packet is routed from the source along the first VRF function to the first logical interface. The packet is transferred from the first logical interface to the second logical interface along the logical link. The packet is transferred from the second logical interface along the second VRF function to the destination. The first VRF function can be the same as the second VRF function.

Abstract: A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.

Abstract: An address resolution method, comprising obtaining an Internet Protocol (IP) address for a destination network node, computing a Media Access Control (MAC) address for the destination network node using a mapping function and the IP address for the destination network node, and sending data traffic using the MAC address computed for the destination network node.

Abstract: An embodiment method of loop suppression in a layer-two transit network with multiprotocol label switching (MPLS) encapsulation includes receiving a packet at a provider edge (PE) router for the layer-two transit network. The packet is stored in a non-transitory memory on the PE router. The packet is stored according to a packet data structure having an MPLS label field and a layer-two header. A time-to-live (TTL) attribute is then determined for the packet. The TTL attribute is written to the non-transitory memory in the MPLS label field. The packet is then routed according to information in the layer-two header.