Juniper Networks, Inc.

Dmitry A Shokarev

Sunanda L Kommula

Alex Baban

Nitin Kumar

Raveendra Torvi

Eswaran Srinivasan

Sri Karthik Goud Gadela

Manikandan Musuvathi Poornachary

Jamsheed R Wania

Kurt J Windisch

Nandan Paramashiva

Venkata Naga Chaitanya Munukutla

Shivam Vaid

Vishnu Pavan Beeram

Nayan S Patel

John Delmar Johnson

Vishnu Pavan Kumar Beeram

Vyasraj Satyanarayana

Scott A Gigandet

Sunanda Kommula

Parag Dubey

An example network device includes one or more hardware resources; a physical interface for receiving a hardware component; a memory; and one or more processors implemented in circuitry and configured to: receive the hardware component that has been coupled to the physical interface of the network device; receive data for an application programming interface (API) for the hardware component; store the data for the API to the memory; and execute the data for the API to grant the hardware component secure access to the hardware resources of the network device via the API. The hardware component may be an optical network interface. The resources may be raw registers of the network device. The processors may further tune the hardware component according to configuration for the network device, such as power management configuration for the network device, or the network device itself.

Adding third party hardware to network devices

In general, this disclosure describes a network device to determine a cause of packets being dropped within a network. An example method includes generating, by a traffic monitor operating on a network device, an exception packet that includes a unique exception code that identifies a cause for a component in the network device to discard a transit packet, and a nexthop index identifying a forwarding path being taken by the transit packet experiencing the exception. The method also includes forwarding the exception packet to a collector to be processed.

Dropped packet detection and classification for networked devices

A network device is configured to receive an inbound packet from a first server device via a network tunnel, the first inbound packet including an outer header, a virtual private network (VPN) label, an inner header, and a data payload, the inner header including an inner source IP address of a source virtual machine. The processors are also configured to determine a first tunnel identifier, determine, based on the inner source IP address, a second tunnel identifier associated with a second server device hosting the source virtual machine, compare the second tunnel identifier with the first tunnel identifier to determine whether the tunnel on which the first inbound packet was received is the same as a tunnel used for forwarding traffic to the source virtual machine, and drop the inbound packet when the second tunnel identifier does not match the first tunnel identifier.

Anti-spoofing techniques for overlay networks

A device receives network information associated with a network and server information associated with one or more server devices, wherein the network is associated with a network device and the one or more server devices. The device generates, based on the network information and the server information, an encapsulation profile for a tunnel encapsulation path and a route profile for the tunnel encapsulation path. The device provides, to the network device, the encapsulation profile for the tunnel encapsulation path and the route profile for the tunnel encapsulation path, and provides, to the one or more server devices, the encapsulation profile for the tunnel encapsulation path. The tunnel encapsulation path is provided between the network device and the one or more server devices, via the network, based on the encapsulation profile for the tunnel encapsulation path and the route profile for the tunnel encapsulation path.

Generating flexible, programmable, and scalable network tunnels on demand

A first network device may receive packets as part of a traffic flow of an internet protocol session, select a packet based on a rule, and add, to a packet replica of the selected packet, routing information capable of being used to generate performance indicators associated with the IP session. The first network device may modify a portion of the packet replica to include values that will cause the packet replica to fail to reach a destination device associated with the IP session, and provide the packet replica to other network devices to cause a second network device to perform a validation procedure to determine that the packet replica is unable to be validated based on the values, to generate the performance indicators using the packet replica or a group of packet replicas that have been modified, and to provide the performance indicators to a particular device.

Systems and methods for non-intrusive network performance monitoring

The disclosed system may include (1) a modular port concentrator that connects as a modular line card within a router to forward network packets, (2) a profile module, stored in memory, that stores an allowed port configuration profile that defines supported port configurations for the modular port concentrator, (3) a configuration module, stored in memory, that receives an attempted port configuration for the modular line card, (4) an enforcement module, stored in memory, that enforces the allowed port configuration profile by taking remedial action in response to determining that the allowed port configuration profile does not allow the attempted port configuration, and (5) at least one physical processor configured to execute the modular port concentrator, the profile module, the configuration module, and the enforcement module. Various other systems and methods are also disclosed.

System and method for customized port configuration

Growing community of inventors

Mountain View, CA, United States of America

Dmitry A Shokarev