Microsoft Technology Licensing, LLC

David A Maltz

Albert Gordon Greenberg

Parveen Kumar Patel

Lihua Yuan

Ming Zhang

Sudipta Sengupta

Srikanth Kandula

Thomas Keane

Parvez Anandam

Pradeep Ayyappan Nair

Paramvir Bahl

Ranveer Chandra

Jie Jerry Liu

Deepak Bansal

Daniel Ron Simon

Sharad Agarwal

Jonathan David Goldstein

Murari Sridharan

Ashley Flavel

Douglas Christopher Burger

Xin Wu

Emre Mehmet Kiciman

David Tennyson Harper, Iii

Narasimhan Agrahara Venkataramaiah

Jin Li

Galen Clyde Hunt

John Carlton Platt

Jitendra Dattatraya Padhye

Navendu Jain

Yongguang Zhang

Edmund Bernard Nightingale

Cheng Huang

Alireza Dabagh

Jonathan Ryan Howell

Yousef A Khalidi

Jeremy Eric Elson

Haitao Wu

Ricardo Gouvea Bianchini

Balaji Satyanarayana Prabhakar

Chuanxiong Guo

Xinyan Zan

Abhishek Kumar Singh

Parantap Lahiri

Nick Holt

Changhoon Kim

Keith W Ross

Behnaz Arzani

Ramnath Prasad

Charles Loboz

Pradeepkumar Mani

Oleg Surmachev

Yu-Shun Wang

Romain Thibaux

Daniel Joseph Turner

Chao-Chih Chen

Chao Zhang

Srinivas Krishnan

Sheng Lu

Rashid Michael Aga

Henry Lee

Sandeep Koushik Sheshadri

Felipe Vieira Frujeri

Shikhar Suri

Sharda Murthi

Percy Fitter

Mark Hennessy

Mohammad Qudeisat

Deepal Jayasinghe

George Chen

Leiwen Deng

Mohammedreza Alizadeh Attar

Randy Kern

Lun Li

Jie Liu

Jiaqi Gao

Xiaohang Wang

David T Iii Harper

Narasimhan A Venkataramaiah

In some cases, a network monitoring system may determine an operating or health condition of a node or connection link in a network (e.g., a datacenter network) by preparing an encapsulated data packet according to a tunneling protocol. Depending on a result of routing the encapsulated data packet, the network monitoring system determines whether the node or connection link is functioning normally or is experiencing an issue such as overloading or malfunctioning.

Fine-grained network monitoring

Network management of cloud computing environments subject to different data control policies is standardized in a manner that ensures compliance with the data control policies. An execution service remote from a cloud computing environment being managed implements workflows to manage different aspects of the cloud computing environment, including monitoring, incident management, deployment, and/or buildout. The execution service issues requests to perform management actions for network devices in the cloud computing environment. A device access service in the cloud computing environments receives the requests, and, in response to the requests, the device access service obtains access control data to access the network devices and perform the requested management actions for the network devices.

Standardization of network management across cloud computing environments and data control policies

Described is a server monitoring technology that is scalable to large numbers of servers, e.g., in a datacenter. Agents on servers run queries to monitor data sources for that server, such as performance counters and other events. The agents monitor their resource usage and those of monitored events to stay within an administrator-specified resource budget (policy), e.g., by modifying the running queries and/or monitoring parameters. A controller receives results of the monitoring, analyzes the results, and takes action as needed with respect to server operation and monitoring. The controller may dynamically update an agent's queries, monitoring parameters and/or monitored data post-processing operations. The controller may issue alerts and reports, including alerts indicative of inter-server problems between two or more servers.

Flexible and safe monitoring of computers

Techniques are disclosed for capturing network traffic in a virtualized computing environment. A packet to be captured in the virtualized environment is identified. The packet is tagged using a pattern of one or more bits in a header of the packet. The pattern indicates that the packet is to be traced. The pattern is propagated to an outer layer during encapsulation of the packet. A header of the encapsulated packet includes the pattern of one or more bits. At least one network device is caused to mirror identified packets based on the reserved bit.

Packet capture via packet tagging

N nodes are assigned to a first layer of nodes having a first domain name server (DNS) anycast Internet Protocol (IP) address and a first fully qualified domain name (FQDN). M nodes are assigned to a second layer of nodes having a second DNS anycast IP address and a second FQDN. When a request to resolve the first FQDN for the first layer of nodes is received by a DNS of a node of the first layer and a load on the ES of the node is less than a threshold, the DNS handles the request by returning an edge server (ES) anycast IP address for the ES of the node. When the load on the ES is greater than the threshold, the DNS offloads the request by returning the second FQDN so that the second FQDN of the second layer is resolved to the second DNS anycast IP address.

Load balancing with layered edge servers

Network buildout of cloud computing environments subject to different data control policies is performed in a manner that ensures compliance with the data control policies. A buildout service is located in a remote cloud computing environment separate from the cloud computing environments at which buildout is being performed. The buildout service implements workflows to manage different aspects of network buildout in the cloud computing environments. The buildout service does not have access to restricted data in the cloud computing environments, including access control data, such that the buildout service cannot directly interact with network devices. The buildout service issues requests for device configuration to hardware proxies in the cloud computing environments. In response to the requests, the hardware proxies obtain access control data to access and configure the network devices.

Network buildout for cloud computing environments with data control policies

Network management of cloud computing environments subject to different data control policies is standardized in a manner that ensures compliance with the data control policies. Executions services and source of truth services are located in a remote cloud computing environment separate from the cloud computing environments being managed. The execution services implement workflows to manage different aspects of the cloud computing environments, including monitoring, incident management, deployment, and buildout. The source of truth services provide network configuration information for the cloud computing environments to allow automated operation of the execution services. The execution services issue requests for management operations to device access services in the cloud computing environments. In response to the requests, the device access services obtain access control data to access the network devices and perform the management operations.

Monitoring of cloud computing environments subject to different data control policies is performed in a manner that ensures compliance with the data control policies. A monitoring service is located in a remote cloud computing environment separate from the cloud computing environments being monitored. The monitoring service does not have access to restricted data in the cloud computing environments, including access control data, such that the monitoring service cannot directly interact with network devices. The monitoring service issues requests for monitoring data to device access services in the cloud computing environments. In response to the requests, the device access services obtain access control data to access the network devices and obtain the requested data, which is returned to the monitoring service.

Monitoring cloud computing environments with data control policies

The subject disclosure is directed towards a technology that automatically mitigates datacenter failures, instead of relying on human intervention to diagnose and repair the network. Via a mitigation pipeline, when a network failure is detected, a candidate set of components that are likely to be the cause of the failure is identified, with mitigation actions iteratively targeting each component to attempt to alleviate the problem. The impact to the network is estimated to ensure that the redundancy present in the network will be able to handle the mitigation action without adverse disruption to the network.

Automated datacenter network failure mitigation

Methods and apparatus are provided for controlling communication between a virtualized network and non-virtualized entities using a virtualization gateway. A packet is sent by a virtual machine in the virtualized network to a non-virtualized entity. The packet is routed by the host of the virtual machine to a provider address of the virtualization gateway. The gateway translates the provider address of the gateway to a destination address of the non-virtualized entity and sends the packet to the non-virtualized entity. The non-virtualized entity may be a physical resource, such as a physical server or a storage device. The physical resource may be dedicated to one customer or may be shared among customers.

Virtualization gateway between virtualized and non-virtualized networks

An edge server node comprises an edge server, a DNS, and a load controller. The DNS is assigned to a layer of edge server nodes where each layer of edge server nodes has a DNS anycast IP address for the DNSs of that layer and a FQDN for that layer. The DNS either handles or offloads requests to resolve the FQDN for the assigned layer to balance the load on the edge server. A request is offloaded by returning the FQDN for another layer. The load controller monitors the load on the edge server and directs the DNS to offload requests to reduce the load on the edge server.

In one kind of DoS attack, malicious customers may try to send a large number of filter requests against an innocent customer. In one implementation, a Filter Request Server (FRS) may allow a customer against who a filter request is made to dispute the implicit accusation of the filter request or stop sending malicious traffic. If the customer claims innocence, the FRS may log destination addresses of data packets sent by the customer and identify and ignore false filter requests if these filter requests come from customers who do not correspond to one or more of the destination addresses that have previously been logged by the FRS.

Network accountability among autonomous systems

The transmission of multiple copies of data to other computing devices is optimized by minimizing the number of copies of such data transmitted through an expensive portion of the network. A store-and-forward methodology is utilized to transmit only a single copy through the expensive portion and the data is subsequently forked into multiple copies directed to multiple destination computing devices. Computing devices that are not intended destinations can be conscripted as intermediate computing devices, if appropriate to minimize copies of the data transmitted through an expensive portion. Additionally, accommodation can be made for data that is intolerant of out-of-order delivery by utilizing adaptive protocols that avoid mechanisms that may result in out-of-order delivery for data intolerant of such and by utilizing packet sorting at data convergence points to reorder the data. Different protocol settings can be utilized to transmit data across different portions of the network.

Network routing modifications for distribution of data

Growing community of inventors

Redmond, WA, United States of America

David A Maltz