At&t Intellectual Property I, L.p.

Cheng Ee

Lee Breslau

Kadangode K Ramakrishnan

Subhabrata Bapi Sen

Alexandre Gerber

Nicholas G Duffield

Carsten Lund

Amogh Dhamdhere

Jia Wang

Zihui Ge

Yin Sheng Zhang

Jennifer Yates

Ajay Mahimkar

Aman M Shaikh

Disclosed example routing methods include accessing a control packet originating from a first internal router, translating the destination address of the control packet from a first value to a second value, and identifying a first one of a plurality of outgoing interfaces of a meta-router based on the second value of the destination address, the outgoing interfaces of the meta-router in communication with respective incoming interfaces of a splitter. Disclosed example methods also include forwarding the control packet to the first one of the outgoing interfaces of the meta-router after translating the destination address of the control packet from the second value back to the first value, and routing the control packet from the splitter to an external router based on which one of the incoming interfaces of the splitter receives the control packet from the meta-router.

Methods and apparatus to route control packets based on address partitioning

Methods and apparatus to route control packets based on address partitioning. A disclosed example method includes receiving a packet in a server, determining the packet is a control packet, forwarding the packet to a processor, identifying via the processor an address prefix of the packet, accessing a forwarding table and determining via the processor at least one of a router or an outgoing interface that corresponds to the identified address prefix, transmitting the packet from the processor to the server via the outgoing interface, and statically forwarding the packet from the server to the router based on an interface that received the packet from the processor.

A system and method to use network flow records to generate information about changes in network routing and to understand the impact of these changes on network traffic. The inferences made can be determinative, if sufficient information is available. If sufficient information is not available to make determinative inferences, inferences may be made that narrow the range of possible changes that may have occurred to network traffic and the underlying network.

System and method for determination of routing information in a network

Methods and apparatus to route packets in a network are disclosed. A disclosed example method includes receiving a packet in a packet aggregator, accessing a forwarding table to determine a router within a router array to which the packet is to be forwarded, transmitting the packet to the determined router via a first interface of the packet aggregator, identifying a second interface within the router to which the packet is to be forwarded, forwarding the packet from the router via the second interface to a virtual interface within the packet aggregator, and statically forwarding the packet from the packet aggregator to a destination based on the virtual interface that received the packet.

Methods and apparatus to route packets in a network

Example methods disclosed herein include, in response to receiving, at a server, a first control packet from a first router, selecting a first auxiliary router to forward the first control packet, and updating a forwarding table in the first router to associate a destination address of the first control packet with a first control path from the first router to the first auxiliary router, the forwarding table initially causing the first control packet to be routed from the physical router to the server, the first control path being determined by routing the first control packet from the first router to the first auxiliary router through the server, the updating of the forwarding table to cause subsequent data packets associated with the first control packet to be forwarded from the first router to the first auxiliary router via the first control path without being routed through the server.

Methods and apparatus to distribute network IP traffic

Example methods and apparatus to distribute network IP traffic are disclosed. A disclosed example method includes receiving a first IP control packet at an input of a first server, the first IP control packet being received from a first router, selecting a second router within a router array associated with the first router to send the first IP control packet, the first server selecting the second router by matching a destination IP address of the first IP control packet to a first IP address subspace associated with the second router, transmitting the first IP control packet to the second router, and updating a forwarding table in the first router by associating the destination IP address of the first IP control packet with a first control path from the first router to the second router.

Statistical methods are used to observe packet flow arrival processes and to infer routing changes from those observations. Packet flow arrivals are monitored using NetFlow or another packet flow monitoring arrangement. Packet flow arrivals are quantified by counting arrivals per unit time, or by measuring an inter-arrival time between flows. When a change in packet flow arrivals is determined to be statistically significant, a change in network routing protocol is reported.

Indirect measurement methodology to infer routing changes using statistics of flow arrival processes

A method and apparatus for providing event correlation in a network are disclosed. For example, the method extracts a plurality of events of interest from a database, and creates one or more event time series from the plurality of events of interest, wherein each of the one or more event time series comprises a set of events of a same type and of a same location that occur within a given time period. The method forms one or more composite events from the one or more event time series, and performs one or more pair-wise correlations for at least one of: the event time-series, or the one or more composite events. The method then identifies one or more pair-wise correlations that are statistically significant.

Method and apparatus for providing statistical event correlation in a network

Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a desired quantity of flow record to sample, receiving a plurality of network flow record each summarizing a network flow of packets, calculating a hash for each flow record of based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, generating a priority from the calculated hash for each respective flow record, and sampling exactly the desired quantity of flow records, selecting flow records having a highest priority first. In one aspect, the method further partitions the plurality of flow records into groups based on flow origin and destination, generates an individual priority for each partitioned group, and separately samples exactly the desired quantity of flow records from each partitioned group, selecting flows having a highest individual priority first.

System and method for spatially consistent sampling of flow records at constrained, content-dependent rates

Example methods and apparatus to deploy and monitor network layer functionalities are disclosed. A disclosed example method includes receiving an Internet Protocol (IP) packet at an input of a server, the IP packet being received from a communicatively coupled router, identifying the IP packet as a production IP packet or a non-production IP packets, when the IP packet is the non-production IP packet, manipulating data within the IP packet to monitor network layer functionality, forwarding the manipulated non-production IP packet to the router, and when the IP packet is the production IP packet, forwarding the production IP packet to the router without manipulating data within the IP packet.

Methods and apparatus to deploy and monitor network layer functionalities

Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a plurality of flow records, calculating a hash for each flow record based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, and sampling flow records having a quasi-random number below a probability P. Invariant parts of flow records include destination IP address, source IP address, TCP/UDP port numbers, TCP flags, and network protocol. A plurality of routers can uniformly calculate hashes for flow records. Each router in a plurality of routers can generate a same quasi-random number for each respective flow record and uses different values for probability P. The probability P can depend on a flow size. The method can divide the quasi-random number by a maximum possible hash value.

System and method for sampling network traffic

Example methods and apparatus to monitor network layer functionalities are disclosed. A disclosed example method includes receiving a first probe packet at an input of a first server, the first probe packet being received from a router, the first probe packet being generated and transmitted from a second server that is one-hop away from the first server in a network, determining if the first server is a final destination of the first probe packet, and if the first server is not the final destination of the first probe packet, generating a second probe packet and transmitting the second probe packet to the router for transmission toward the final destination.

Growing community of inventors

Rockaway, NJ, United States of America

Cheng Ee