Juniper Networks, Inc.

128 Technology, Inc.

Anna Yungelson

Abilash Menon

Scott A McCulley

Jacob Dionne

Robert F Penfield

Michael Baj

Dennis Gordon Montgomery

Patrick John MeLampy

Patrick Timmons

Hadriel S Kaplan

Kaushik Adesh Agrawal

Thomas E Sullivan

Sarah V Jaffer

Scott Peter Inguagiato

David Gosselin

Francisco Jose Mendez Cirera

Avinash Prakash Bhat

Scott A Mcculley

Techniques are disclosed for session-based load-balancing of network traffic to network service instances. In one example, a network device receives a first packet of a forward packet flow from a network service instance of a plurality of network service instances after application of a network service. The first packet specifies a Media Access Control (MAC) address of the network service instance as a source MAC address. The network device defines a session comprising the forward packet flow and a reverse packet flow and stores an association between the session and the MAC address of the network service instance. The network device determines that a second packet received from a destination device is associated with the reverse packet flow of the session. The network device forwards the second packet to the same network service instance based on the association between the session and the MAC address of the network service instance.

Service function chaining with session-based routing

One function of a communications network, or of nodes in such a network, is to gather data that is useful in assessing network performance, and quantifying metrics of node and/or network performance. Various embodiments disclosed herein improve the ability of nodes and networks to gather such data, and quantify metrics of node and/or network performance by selectively marking existing network traffic, and in preferred embodiments without having to dilute network traffic by generating and transmitting dummy data packets.

In-line performance monitoring

Techniques are disclosed for session-based routing of multipoint Open Systems Interconnection (OSI) Model Layer-2 (L2) frames of an L2 network extended over Layer-3 (L3) networks. In one example, L2 networks connect a source device to an ingress router and receiver devices to egress routers. An L3 network connects the ingress and egress routers. The ingress router receives, from the source device, a multipoint L2 frame destined for the receiver devices. The ingress router forms, for each egress router that is connected to at least one multipoint receiver device, a unicast L3 packet for the L2 frame and forwards the unicast L3 packet to the egress router. Each egress router generates, in response to receiving the unicast L3 packet, the multipoint L2 frame and forwards, to the receiver devices, the multipoint L2 frame.

Point-to-multipoint Layer-2 network extension over Layer-3 network

Point-to-multipoint layer-2 network extension over layer-3 network

Routing packets by a router involves establishing a first flow configured for forwarding the packets from a first ingress interface to a first egress interface of the router; determining a condition to modify the first flow; deactivating the first flow; establishing a second flow configured for forwarding the packets from at least one of (1) the first ingress interface to a second egress interface, (2) a second ingress interface to the first egress interface, or (3) a second ingress interface to a second egress interface; and activating the second flow.

Flow modification including shared context

Techniques are disclosed for inline security key exchanges between network devices. An example network device includes one or more processors and memory coupled to the one or more processors. The memory stores instructions that, upon execution, cause one or more processors to obtain a first payload key and obtain a path key. The instructions cause the one or more processors to encrypt a first payload of a first packet using the first payload key and insert the first payload key into first metadata of the first packet. The instructions cause the one or more processors to encrypt the first metadata using the path key and send the first packet to another network device.

Inline security key exchange

Techniques are disclosed for identifying a maximum segment size (MSS) for a path. For example, a first router includes a routing engine and a packet forwarding engine. The routing engine is configured to identify a path maximum transmission unit (MTU) corresponding to a path between the first router and a second router; and identify a maximum packet overhead size corresponding to a session between a first client device and a second client device over the path between the first router and the second router. Additionally, the routing engine is configured to calculate, based on the path MTU and the maximum packet overhead size, a path maximum segment size (MSS), wherein the path MSS represents a maximum packet payload size corresponding to the path; and control the packet forwarding engine to output information indicative of the path MSS.

Identifying a maximum segment size (MSS) corresponding to a network path

Techniques are disclosed for session-based routing within Open Systems Interconnection (OSI) Model Layer-2 (L2) networks extended over Layer-3 (L3) networks. In one example, L2 networks connect a first client device to a first router and a second client device to a second router. An L3 network connects the first and second routers. The first router receives, from the first client device, an L2 frame destined for the second client device. The first router generates an L3 packet comprising an L3 header specifying L3 addresses of the first and second routers, a first portion of metadata comprising L2 addresses for the first and second client devices, and a second portion of metadata comprising L3 addresses for the first and second client devices, and forwards the L3 packet to the second router. The second router recovers the L2 frame from the metadata and forwards the L2 frame to the second client device.

Layer-2 network extension over layer-3 network using layer-2 metadata

Techniques are disclosed for generating session-specific packet capture records. In one example, a first network device receives a first packet of a session between first and second client devices, the session comprising forward and reverse packet flows. The first network device modifies the first packet to include metadata comprising a packet capture indicator that indicates whether packet capture is to be performed for the session. The first network device stores at least a portion of the first packet and each subsequent packet of the session and forwards the modified first packet. A second network device receives the modified first packet and, based on the packet capture indicator, stores at least a portion of the first packet and each subsequent packet of the session in a session-specific packet capture record. The first and second network devices may generate, from the stored packet data, a packet capture record for the session.

Session-based packet capture

Techniques are disclosed for session-based routing within Open Systems Interconnection (OSI) Model Layer-2 (L2) networks extended over Layer-3 (L3) networks. In one example, L2 networks connect a first client device to a first router and a second client device to a second router. An L3 network connects the first and second routers. The first router receives, from the first client device, an non-session-based L2 frame destined for the second client device. The first router forms an L3 packet comprising an L3 header specifying L3 addresses of the first and second routers and a protocol selected based on an L3 service for the L2 frame, a payload comprising the L2 frame, and metadata comprising a session identifier distinctly identifying the L2 frame, and forwards the L3 packet to the second router. The second router recovers the L2 frame from the payload and forwards the L2 frame to the second client device.

Growing community of inventors

Lexington, MA, United States of America

Anna Yungelson