Cisco Technology, Inc.

Juniper Networks, Inc.

Diheng Qu

Atul Bhaskarrao Patil

Chi Fung Michael Chan

Samar Sharma

Chao Feng

Pramod Cherukumilli

Nitesh G Soni

Serene H Fan

Ilia Kharin

Suresh Kumar Nalluru

Tzong-Fen Fuh

Rajeev Menon Kadekuzhi

Aleksandr Gordeev

Roman Bogorodskiy

Aleksei Goditskii

Sami Boutros

Ronak K Desai

Aleksandar Luka Ratkovic

Xun Wang

Nicholas Leavy

Steve H Truong

Raunak Banthia

Ilya Kharin

Kevin Li

Seren Fan

J P Senior

Jp Senior

Richard Fox

Georgy Savostyanov

Aleksei Slutckii

Nathaniel Scott Ray

Manish Kumar Mathukumilli

A method includes storing, by one or more processors, a plurality of intent graphs for a network and receiving, the by one or more processors, a query indicating a time. The method further includes determining, by the one or more processors, a subset of telemetry data that corresponds to the time range using the time indicated by the query. The method further includes generating, by the one or more processors and based on an intent graph of the plurality of intent graphs that is associated with a time range that includes the time indicated by the query and based on the subset of the telemetry data, one or more metrics and outputting, by the one or more processors, an indication of the one or more metrics.

Replay of analytics for a network management system

A system comprising one or more processors configured to receive a query indicating one or more of filtering information, sorting information, or joining information and retrieve, from a first datastore, an intent graph for a network, wherein the intent graph comprises nodes representing components of the network and edges representing connections between the components. The one or more processors being further configured to select a subset of a plurality of network devices of the network based on the query and the intent graph retrieved from the first datastore and retrieve, from a second datastore, data received from the plurality of network devices of the network. The one or more processors being further configured to determine a response to the query based on the selected subset of the plurality of network devices and the data retrieved from the second datastore and output the response to the query.

Query mechanism for a network management system

A controller device includes one or more processors and a memory for storing instructions that, when executed, cause the one or more processors to receive, from a set of network devices in a network, a time series of telemetry data; determine, using telemetry data, a threshold for a parameter of a network device of the set of network devices; in response to reception of an indication that an instant value for the parameter does not satisfy the determined threshold for the parameter, determine that an anomaly has occurred at the network device; in response to the determination, generate a user interface having first data for a first time period that occurs before the anomaly, second data for a second time period corresponding to when the anomaly occurs in the network, and third data for a third time period that occurs after the anomaly.

Anomaly detection for network devices using intent-based analytics

A system includes computer-readable media configured to store a plurality of objects representing intent graph models of a network, and processing circuitry coupled to the computer-readable media. The processing circuitry is configured to receive a request indicating a requested time, determine one or more first objects of the plurality of objects, the first objects storing an intent graph model associated with a first time, the first time different from the requested time, determine one or more second objects of the plurality of objects, the second objects storing difference information indicating one or more changes to the intent graph model associated with the first time that occurred after the first time, apply the changes to the intent graph model associated with the first time to generate an intent graph model associated with the requested time, and output an indication of the intent graph model associated with the requested time.

Intent graph model generation using difference information

A method for managing a plurality of network devices of a network includes determining, by one or more processors, a causality map for the plurality of network devices according to an intent. The method further includes receiving, by the one or more processors, an indication of a network service impact and determining, by the one or more processors, a relevant portion of the causality map based on the network service impact. The method further includes determining, by the one or more processors, one or more candidate root cause faults based on the relevant portion of the causality map and outputting, by the one or more processors, an indication of the one or more candidate root cause faults.

Network graph model and root cause analysis for a network management system

A controller device includes a memory and one or more processors coupled to the memory. The memory stores instructions that, when executed, cause the one or more processors to receive a query indicating a first time and a network service, determine a first set of configuration elements using telemetry data associated with the first time and the network service, and determine a second set of configuration elements using an intent model. The instructions further cause the one or more processors to determine one or more first metrics that occur at the first time using the first set of configuration elements and the second set of configuration elements, determine one or more second metrics at a second time using telemetry data received from the plurality of network devices, and generate data representing a user interface presenting the one or more first metrics and the one or more second metrics.

Predictive pipeline analytics for a network management system

A controller device includes a memory and one or more processors coupled to the memory. The memory stores instructions that, when executed, cause the one or more processors to receive, from a set of sensor devices, first telemetry data indicating a first set of changes for telemetry parameters that occur during a first time range. The instructions further cause the one or more processors to determine, using the first snapshot and the first telemetry data, a second snapshot that specifies a first complete state at an end of the first time range. The instructions further cause the one or more processors to determine a second complete state of the telemetry parameters for the second time range based on the second snapshot and second telemetry data indicating a second set of changes for the set of telemetry parameters that occur during a second time range.

Time series data collection for a network management system

Methods and apparatus for providing one-arm node clustering using a port channel are provided herein. An example application node may be communicatively connected to at least one application node, and the application node may be connected to a network through a port channel. The application node may include: a link included in the port channel for accommodating the network data being communicated between the remote client and server; and a processor configured to send/receive a cluster control packet to/from the at least one application node through the link included in the port channel.

Methods and apparatus for providing one-arm node clustering using a port channel

Methods and apparatus are disclosed for processing data packets using a router and a proxy in order to transparently proxy a connection between a client and a server. One method involves mapping a TCP connection to a connection ID and sending a segment from the TCP connection to a proxy, including the connection ID, a direction value and an identifier of an assigned proxy application, such that the segment appears to be from the connection. The method further involves a proxy creating and reading from an IP socket which corresponds to the segment, the connection ID, direction and assigned proxy application and then spoofing the segment using the connection ID, a second direction value, and an identifier of the assigned proxy application.

Transparently proxying transport protocol connections using an external server

A method is provided in one example and includes receiving a request message from a first network element using an out-of-band control link. The request message includes a request to bundle a first port associated with the first network element into a channel group associated with a cluster. The cluster includes a plurality of clustered network elements. The method further includes determining a status of the first port with respect to the channel group, and sending a reply message to the first network element using the out-of-band control link. The reply message indicates the determined status of the first port of the first network element.

System and method for cluster link aggregation control in a network environment

An example method includes disengaging a target node from a cluster, where the disengaging comprises: selecting an inheritor; migrating flows from the target node to the inheritor; informing a migration manager that the target node is disengaged from the cluster; and broadcasting to peer nodes of the target node that the target node is replaced by the inheritor. In particular implementations of the present disclosure, the cluster can include a first layer of a network topology including a forwarding engine that implements hash-based packet forwarding; a second layer of the network topology comprising the target node and the inheritor, where the target node and the inheritor implement flow-based packet forwarding; and a third layer including service nodes configured for packet processing in a network.

System and method for non-disruptive management of servers in a network environment

A method and apparatus that provide network access control are disclosed. In one embodiment, a network device is configured to intercept network traffic initiated from a client and directed toward a network resource, and to locally authenticate the client. Authentication is carried out by comparing information identifying the client to authentication information stored in the network device. In one embodiment, an authentication cache in the network device stores the authentication information. If the client identifying information is authenticated successfully against the stored authentication information, the network device is dynamically re-configured to allow network traffic initiated by the client to reach the network resource. If local authentication fails, new stored authentication is created for the client, and the network device attempts to authenticate the client using a remote authentication server. If remote authentication is successful, the local authentication information is updated so that subsequent requests can authenticate locally. As a result, a client may be authenticated locally at a router or similar device, reducing network traffic to the authentication server.

Growing community of inventors

Palo Alto, CA, United States of America

Diheng Qu