Amazon Technologies, Inc.

Eric Andrew Rubin-Smith

Shovan Kumar Das

Jonathan Paul Kramer

Masood Karimi

Samuel Lough

John Jeffrey Schlachtenhaufen

Leonid Valentinovich Nikolayev

Joshua D Leaverton

Michael Erik Untereiner

Thomas Bradley Scholl

Kushal Mall

Michael W Palladino

Bobby Brown

Anderson Osagie

Jonathan Phillibert

Jason Goelitz

Neha Mohan Tilak

Adam Gregory Cogen

Raunak Tibrewal

Nam Quy Nguyen

Joseph Anthony Raccio

Daniel Lawrence Iannuzzi

Michael Marano

Mario Souza

Benjamin Kaiwen Ng

Lee Alan Wildes

Arushi Gupta

Technologies are disclosed for mitigating attempts to capture traffic on a network using unauthorized advertisements. Responsive to detecting an authorized advertisement for a path to a service on the network, a mitigation/orchestration service may determine a synthetic route advertisement that is configured to win back the captured traffic (e.g., by providing a route specificity that is at least equal to the unauthorized advertisement) and propagate the synthetic route advertisement from routers in the network. The won back traffic may be directed through a backbone of the network to the service.

Route hijack mitigation

Disclosed are various embodiments for self-service management of network address allocations using hierarchical allocation pools. A first network address pool is created for a customer of a cloud provider network. The first network address pool is divided into a second network address pool for a cloud resource of the customer. A first network address block from the second network address pool is assigned to the cloud resource.

Self-service management of network address allocations using hierarchical allocation pools

Techniques and technologies for an Internet Protocol (IP) address management (IPAM) system to track and manage IP address workflows in a network. The IPAM system can be used to define and enforce management policies or rules regarding IP address management, such as allocation policies, refill policies, and so forth. For instance, the IPAM system can enforce allocation policies that define rules to allow or deny allocation of IP addresses based on types of resources for which the IP addresses are requested, registered user accounts that are requesting the IP addresses, the purpose of the resources receiving the IP addresses, and so forth. Additionally, the IPAM system can enforce refill policies that define rules for replenishing inventories of IP addresses that have been allocated for different domains in the network. The IPAM system can improve the management of IP address workflows by enforcing policy and tracking IP address workflows in networks.

Managing the allocations and assignments of internet protocol (IP) addresses for computing resource networks

Disclosed are various embodiments for asynchronously generating consistent snapshots in a distributed system. In one embodiment, a snapshotting agent receives a respective local snapshot for individual processes in a distributed system. The respective local snapshot for a corresponding process includes a corresponding vector clock that comprises respective values indicating respective state changes in the corresponding process and other processes. The snapshotting agent determines whether a collection of the respective local snapshots for the individual processes represents a global consistent snapshot for the distributed system based at least in part on a comparison of the respective values of the corresponding vector clocks.

Asynchronous consistent snapshots in a distributed system

Techniques and technologies for an IP address management (IPAM) system to monitor the usage of IP addresses across regions in one or more networks of resources. The IPAM system may be used to allocate IP addresses to resources in networks and track what IP addresses are being used by resources or available for allocation. The IPAM system may periodically obtain usage information that indicates actual, current IP address usage by the resources in the networks, identify differences between the current IP address usage and an inventory maintained by the IPAM service, and reconcile the differences. Additionally, the IPAM system may further respond to network administrator queries about their resource and IP address usage. Further, the IPAM system may emit various utilization metrics to the network administrators which may be tied to alarms or alerts around non-compliant resources or IP addresses.

Managing the usage of internet protocol (IP) addresses for computing resource networks

Techniques implemented by an IP address management (IPAM) system for monitoring the usage of IP addresses in networks of computing resources and automatically notifying networking devices when IP address usage has changed. The IPAM system may create pools of IP addresses (e.g., address groups), and map those pools to prefix lists that are distributed to the networking devices. The IPAM system may monitor changes in IP address usage by resources in the networks (e.g., allocations and releases of IP addresses), update the pools that are affected by the changes, carry those changes through to the appropriate prefix lists, and propagate updated prefix lists to the networking devices (e.g., firewall devices, routing devices, etc.). In this way, the IPAM system may automatically identify and apply IP address changes to prefix lists that are used for networking operations in the networks.

Monitoring internet protocol address utilization to apply unified network policy

Disclosed are various embodiments for managing network address allocations using prefix allocation trees. In one embodiment, a request is received to allocate a particular network address block. The request specifies one or more attributes and at least one of a prefix or a size for the particular network address block. A prefix allocation tree is updated to indicate that the particular network address block corresponding to the prefix is allocated instead of free and to associate the attribute(s) with the particular network address block. An identification of an allocation of the network address block is returned in response to the request to allocate the particular network address block. An attribute index of the prefix allocation tree is updated asynchronously to index the attribute(s) in association with the particular network address block.

Network address allocation management using prefix allocation trees with asynchronous workflows

Disclosed are various embodiments for distributed network address allocation management. In one embodiment, a first instance of a plurality of instances of an allocation management service assigns a first portion of a network address space to the first instance and a second portion of the network address space to a second instance of the plurality of instances. The second instance receives a request to allocate a particular network address block. The second instance allocates the particular network address block from the second portion of the network address space by updating an allocation data structure. An allocation of the particular network address block is returned in response to the request. A copy of the allocation data structure maintained by the first instance is updated asynchronously based at least in part on the allocation of the particular network address block.

Distributed network address allocation management

Disclosed are various embodiments for managing network address allocations using prefix allocation trees. In one embodiment, a request is received to allocate a network address block. The request specifying a prefix size for the network address block. A particular network address block having the prefix size that is allocatable is determined based at least in part on a prefix allocation tree representing the available and allocated network address space. The prefix allocation tree is updated to indicate that the particular network address block is allocated. An identification of the particular network address block is returned in response to the request to allocate the network address block.

Network address allocation management using prefix allocation trees

Growing community of inventors

Fairfax Station, VA, United States of America

Eric Andrew Rubin-Smith