Cisco Technology, Inc.

Chuanwei Li

Lele Zhang

Huimin She

Li Zhao

Feiliang Wang

Yajun Xia

Pascal Thubert

Nan Yi

Akram Ismail Sheriff

Yinfang Wang

Wenjia Wu

Haibo Dong

Jianzhou Chen

Hui Li

Xiaoguang Jason Chen

Ling Wei

Shiwei Gao

Wenchuan Ji

A method includes determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes within a mesh network. Based at least in part on the number of drops of the plurality of messages exceeding a threshold number of drops for a time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node. Based at least in part on the second rating being below a rating threshold, determining that the first node is a potentially malicious node. Based at least in part on a first distance to the first node being larger than a distance threshold, identifying that the first node is a malicious node. The method may further include ending communications with the first node.

Malicious black hole node detection and circumvention

The present disclosure provides a hierarchical method of identifying unauthorized network traffic in a network by applying, at one of a first plurality of nodes of a network, a first level of network traffic analysis to identify received network traffic as one of authorized or suspicious network traffic, the one of the first plurality of nodes having a first path for traffic routing and a second path to one of a second plurality of nodes of the network, the second path being used for forwarding the suspicious network traffic to the one of the second plurality of nodes; tagging the received network traffic as the suspicious network traffic; and sending the suspicious network traffic to the one of the second plurality of nodes over the second path, the second network node applying a second level of network analysis to determine if the received network traffic is authorized, unauthorized or remains suspicious.

SASE based method of preventing exhausting attack in wireless mesh networks

In one embodiment, a method comprises: identifying, by a low power and lossy network (LLN) device in a low power and lossy network, a minimum distance value and a distance limit value for limiting multicast propagation, initiated at the LLN device, of a multicast data message in the LLN; and multicast transmitting, by the LLN device, the multicast data message with a current distance field specifying the minimum distance value and a distance limit field specifying the distance limit value, the multicast transmitting causing a receiving LLN device having a corresponding rank in the LLN to respond to the multicast data message by: (1) determining an updated distance based on adding to the current distance field a rank difference between the receiving LLN device and the LLN device, and (2) selectively retransmitting the multicast data message if the updated distance is less than the distance limit value.

Localized multicast in a low power and lossy network based on rank-based distance

Techniques for distributed sub-controller permission for control of data-traffic flow within software-defined networking (SDN) mesh networks to limit control plane traffic of the network are described herein. A technique described herein includes a network node of a data-traffic path of an SDN mesh network obtaining SDN sub-controller permission from a border controller of the SDN mesh network. Further, the technique includes suppression of data traffic from sibling and children nodes of data-traffic path allied nodes to the data-traffic path allied nodes. The data-traffic path allied nodes include network nodes that are part of the data-traffic path of the SDN mesh network. Further still, the technique includes the transmission of data across the data-traffic path.

Distributed sub-controller permission for control of data-traffic flow within software-defined networking (SDN) mesh network

In one embodiment, a technique comprises monitoring data transfer over a radio frequency (RF) link between a first device and a second device in a mesh network where the second device is a descendent node and the first device is a parent node. The technique further transfers the data over a power link communication (PLC) when the RF link is inactive. The method also includes broadcasting, by the second device, RF link availability to at least a third device in the mesh network when the RF link with the first device is inactive where the third device has an active link with the second device and the third device is a descendent node of the second device. The method then includes communicating, between the second device and the third device, through the active RF link.

Increasing throughput for multi-PHY networks

In one embodiment, a method comprises: joining, by a network device, a network topology rooted by a root network device in a data network, and in response transmitting an advertisement indicating a position of the network device in the network topology; suppressing a second transmission based on initiating a deferred transmission operation in response to transmitting the advertisement; maintaining the deferred transmission operation to enable a prescribed minimum number of other network devices to join the network topology at respective identified lower positions than the position of the network device; and changing, by the network device, from the deferred transmission operation to an accelerated operation in response to expiration of a prescribed deferral interval or detecting the prescribed minimum number of other network devices having the respective identified lower positions, the accelerated operation enabling the network device to initiate transmission of a data packet before the other network devices.

Reclaiming transmission priority following network topology formation

A method includes identifying a potentially malicious node using a rating assigned to nodes within the network and decrementing the rating based on detected dropped messages to identify a potentially malicious node. The malicious node is identified based on location information obtained from the nodes within the network and comparable distances from the potentially malicious node. The method further includes ending communications with the malicious node and selecting a new parent node based on a presumption that any of the plurality of nodes other than the malicious node are non-malicious.

Systems, methods, and computer-readable media for identifying a deployment scheme for forming a wireless mesh network based on environmental characteristics and an optimum deployment scheme. In some examples, a geographical area for deployment of a wireless mesh network is identified. Additionally, environmental information of the geographical area can be collected. Network characteristics of an optimum deployment scheme for forming the wireless mesh network can be defined. As follows, a deployment scheme for forming the wireless mesh network can be identified based on the network characteristics of the optimum deployment scheme and the environmental information of the geographical area.

Cloud-based deployment service in low-power and lossy network

In one embodiment, a method comprises: determining, by a network device that is configured for joining a local directed acyclic graph (DAG) instance in a data network, an unreachability by the network device to any member of the local DAG instance; generating and broadcasting, by the network device, a request message that identifies the network device requesting to join the local DAG instance, the request message causing a neighboring network device in a global DAG instance of the data network to rebroadcast the request message for reception by a member of the local DAG instance, the neighboring network device a non-member of the local DAG instance; and receiving, by the network device, a reply message indicating a member of the local DAG instance is reachable via the neighboring network device in the global DAG instance.

Interconnecting local RPL instance nodes via global RPL instance node as AODV relay

Techniques for utilizing Software-Defined Field-Area Network (SD-FAN) controllers to receive a geographic location and transmission power of individual nodes and generate a geographic location topology of a Field-Area Network (FAN) to provide nodes with location-aware route paths for data transmission. One or more SD-FAN controller(s) may maintain a geographic location database to store the geographic location and transmission power of the individual nodes. Each node may utilize a Destination Address Object to advertise its geographic location and transmission power to the SD-FAN controller. The SD-FAN controller(s) may utilize the geographic location table to generate the geographic location topology of the FAN and determine a location-aware route path for optimized data transmission between nodes in the FAN.

Location-aware routing for east-west data traffic

In one embodiment, a technique for load balancing of throughput for multi-PHY networks using decision trees is provided. A first device of a mesh communication network may collect at least one transmission metric indicative of a primary link and a secondary link between the first device and a second device of the mesh communication network. The first device may provide the at least one transmission metric as input to one or more decision trees comprising one or more attributes that are each indicative of a threshold for a corresponding transmission metric. The first device may obtain an output from the decision tree comprising a selection of either the primary link or the secondary link. The first device may send, based on the output from the decision tree, one or more packets to the second device using the selected link.

Load balancing of throughput for multi-PHY networks using decision trees

In one embodiment, a method comprises: determining, by a network device in a wireless data network, a past throughput of broadcast data packets transmitted at broadcast transmission intervals of a prescribed broadcast schedule over a selected measurement interval, the broadcast transmission intervals each adjacent to unicast transmission intervals allocated in the wireless data network, each of the broadcast transmission intervals in the prescribed broadcast schedule initially set at a prescribed duration; predicting, by the network device, a predicted throughput of a future broadcast transmission interval of the prescribed broadcast schedule, for transmission of at least a future broadcast data packet, based on executing a trendline prediction of the predicted throughput using the past throughput over the selected measurement interval; and adjusting the corresponding prescribed duration of the future broadcast transmission interval, relative to the corresponding adjacent unicast transmission interval following the future broadcast transmission interval, based on the predicted throughput.

Growing community of inventors

Shanghai, China

Chuanwei Li