Cisco Technology, Inc.

Anirban Karmakar

Domenico Ficara

Amine Choukir

Thomas Vegas

Jerome Henry

Vincent Cuissard

Robert E Barton

Sudhir Kumar Jain

Roberto Muccifora

Giacomo Trifilo

Carlos M Pignataro

Robert Edgar Barton

Shree N Murthy

Salvatore Valenza

Rohit Mendiratta

Antonio Trifilo

Hamsa Sankaran

Narayana Pai Hosdurg

Maria Carpen Amarie

The present technology pertains to identifying one or more sub-components of one or more network devices in a network environment; disaggregating the one or more sub-components from corresponding network devices of the one or more network devices; monitoring one or more functional flows across the one or more sub-components on a sub-component basis to generate functional flow data associated with the one or more sub-components; and generating analytics of the network environment on a sub-component basis from the functional flow data.

Threat detection of application traffic flows

A method is performed at a mesh access point (MAP) of a mesh network in which MAPs are configured to communicate with each other over wireless backhaul links. The method includes: receiving, from a first wireless client having a first client address, client traffic destined for a second wireless client having a second client address, the client traffic including a first source address that represents the first client address, and a first destination address that represents the second client address; generating a first obfuscated source address that differs from the first client address; replacing the first source address in the client traffic with the first obfuscated source address; and transmitting the client traffic with the first obfuscated source address in place of the first source address to a next MAP of the MAPs over a wireless backhaul link for subsequent forwarding to the second wireless client.

Client mac source address randomization by mesh nodes in wireless mesh networks

This disclosure describes techniques for performing a remote front-drop of data for recovery after a pipeline stall. The techniques include using a receiver-side dropping strategy that is driven from the sender-side. Components of a pipeline determine whether a pipeline is operating within specified latency constraints (e.g., experiencing a pipeline stall). Upon detecting a pipeline stall, the sending device is notified of the stall. Once the sending device is notified of the pipeline stall, the sending device can determine what action(s) to perform to address the pipeline stall. For example, the sending device may instruct one or more components of the pipeline to discard already sent data that has not been processed. This allows the older data to be dropped on the stalled pipeline while keeping the more recently sent data.

Remote front-drop for recovery after pipeline stall

Techniques are provided that rotate a device address used to identify a wireless client device on a wireless network. The wireless client device and at least one network infrastructure component identify a plurality of device addresses associated with the wireless client device. In some embodiments, the plurality of device addresses are generated via a corresponding plurality of invocations of a stateful random number generator, such as a cryptographically secure pseudorandom number generator.

Seamless device address rotation

A user device connected to a wireless network maintains session persistence through a MAC address change of a user device. The user device establishes a multi-path communication session including a first subflow associated with a first MAC address for the user device. When the user device changes from the first MAC address to a second MAC address, the user device establishes a second subflow of the multi-path communication session. The second subflow is associated with the second MAC address. After establishing the second subflow associated with the second MAC address, the user device ends the first subflow associated with the first MAC address.

Application session persistence across dynamic media access control (MAC) address rotations

A first access point of a wireless network minimizes Media Access Control (MAC) address collisions in the wireless network. The first access point receives an association request from a first wireless device. The association request identifies a first MAC address of the first wireless device. The first access point determines whether a second wireless device is associated with the wireless network using the first MAC address. Responsive to a determination that the second wireless device is associated with a second access point of the wireless network, the first access point obtains a virtual MAC address for the first wireless device. The first access point translates between the first MAC address and the virtual MAC address for network traffic of the first wireless device.

Wireless client media access control (MAC) address collision avoidance

A wireless client device communicates, to an access point over a secure channel, a mapping of a dynamic device address to a stable device address. By communicating the mapping, the access point is able to determine that packets received from two different device addresses originate from a common device. The access point is then able to maintain an association between the originating device and other network resources assigned or allocated to the originating device, such as IP addresses or infrastructure station address, which is used to identify the originating device to other devices outside the network in some embodiments.

Facilitating over-the-air address rotation

The use of device context in applying security policies is provided by receiving a Domain Name Service (DNS) query for a network resource from a user device (UD) at a DNS analysis server, the DNS query including a functional label describing a context of the UD; analyzing the DNS query to determine whether the UD is permitted to access the network resource based on the functional label; and in response to the functional label indicating that the UD is not permitted to access the network resource, transmitting a block page to the UD. The functional label can be added to the DNS query by a Mobile Device Management application on the UD, a router associated with the UD, or an enterprise server. Contexts for previously blocked DNS queries can be aggregated to identify UDs sharing at least one value with the previously blocked DNS queries as security compromised devices.

Device context in network security policies

A wireless infrastructure that communicates with a DHCP server and a wireless client that rotates its MAC address performs a method including: upon receiving, from the wireless client, a first request with a first MAC address, creating a session context including the first MAC address and a stable identifier, and relaying the first request to the DHCP server; relaying, from the DHCP server to the wireless client, a first DHCP reply that includes an Internet Protocol (IP) address bound to the stable identifier; upon receiving, from the wireless client, a second request with the IP address and a second MAC address, merging the second MAC address and the IP address into the session context, and relaying, to the DHCP server, the second request including the stable identifier; and relaying, from the DHCP server to the wireless client, a second DHCP reply including the IP address bound to the stable identifier.

DHCP resource optimization for randomized and changing MAC address

Location tracking consent management may be provided. A zone in a network may be configured with a corresponding tracking type. Next a computing device associated with the zone may be enabled to transmit an information element indicating the tracking type configured for the zone. A client device may then be allowed to disallow tracking of the client device based on the tracking type.

Location tracking consent management

In one embodiment, a Management Information Base (MIB) is dynamically loaded on a managed network device that is managed by a managing network device using a management application. Initially, one or more network management objects are identified. The identified one or more network management objects are then included in the MIB. Thereafter, a policy file to be associated with the MIB is defined. Consequently, the MIB is loaded on the managed network device along with the associated policy file.

Growing community of inventors

Ecublens, Switzerland

Anirban Karmakar