Google Inc.

Cisco Technology, Inc.

Gargi Adhav

Hui Liu

Vishal I Gupta

Kan Cai

Vikas Aggarwal

Hongkun Yang

Lakshmi Sharma

Xiaoyu Zhang

Parthasarathy Ranganathan

Shrikant S Kelkar

Rajendra Yavatkar

Parveen Patel

Ning Zhao

Tianqiong Luo

Manoj Jayadevan

Shishir Kumar Agrawal

Steffen Julif Smolka

Raj Yavatkar

Leslie Choong

Alan Tang

Alok Kumar

Ammar Rayes

Aspi Siganporia

Jiabin Zhao

Manasa Chalasani

Pavlin Radoslavov

Erin Lynne Brown

Aakash Bhushan Arora

Shijeesh Nharappadath Sankaranathan

Marco Leogrande

Salomon Sonny Ben-Shimon

Mukta Gupta

Anantanarayanan Govindarajan Iyengar

Yihan Zhang

Vineet Goel

Rob Enns

Analysis of a root cause of errors within a cloud network is manually complex and computationally intensive. Methods and systems are provided to determine a subset of elements of the cloud network to analyze, and to identify a subset of analyzers for analyzing the subset of elements to determine the root cause for the error. Thus, when configuring a network, a user may be provided with an identification of the root cause of error, enabling the user to quickly identify and correct the error.

Cloud network failure auto-correlator

The present disclosure includes systems, methods, and computer-readable mediums for discovering capabilities of local and remote hardware (HW) accelerator cards. A local hardware (HW) accelerator card may provide, via a communication interface, a listing of acceleration services from the local HW accelerator card. The listing of acceleration services may include a first set of acceleration services provided by one or more accelerators of the local HW accelerator card and a second set of acceleration services provided by one or more accelerators of a remote HW accelerator card. A workload instruction defining a workload for processing by at least one of the acceleration services of the second set of acceleration services may be received from a processor of a computing device. The workload instruction may be forwarded to the remote HW accelerator card.

Hardware accelerator service aggregation

The present disclosure provides for automatic peering between virtual networks, such as virtual private clouds (VPCs). A VPC may be configured to operate in an 'auto-peering' mode, allowing for automatic peering to be turned on or off. When auto-peering is turned on, that VPC may seek connections with other VPCs, such as other VPCs matching one or more predefined policies. In addition, the particular VPC with auto-peering turned on may be open to accept connection requests from other VPCs matching one or more predefined policies. The policies for requesting connection may be the same as or different than the policies for accepting connection requests. According to some examples, the VPC may be set to a “listening” mode, in which it is open to peering with any other VPC that matches a predefined policy, but is not actively seeking to establish other connections.

VPC auto-peering

The present disclosure includes systems, methods, and computer-readable mediums for discovering capabilities of a hardware (HW) accelerator card. A processor may communicate a request for a listing of acceleration services to a HW accelerator card connected to the processor via the communication interface. The HW accelerator card may retrieve the listing from memory and provide a response to the processor that includes a listing of the HW acceleration services provided by the HW accelerator card.

Hardware accelerator service discovery

A firewall intelligence system, includes a data storage storing a set of firewall rules for a network; a recommendation engine that receives, from a log service, traffic logs detailing traffic for the network and firewall logs detailing the usage of firewall rules in response to the traffic for the network, accesses, from the data storage, the set of firewall rules for the network; processes the set of firewall rules to evaluate the firewall rules against a set of quantitative evaluation rules to determine one or more firewall rule recommendations, wherein each firewall rule recommendation is a recommendation to change at least one of the firewall rules in the set of firewall rules; and a front end API that provides data describing the one or more firewall rule recommendations to a user device.

Firewall rules intelligence

A method for scalable event driven auto-diagnosis systems includes obtaining a data packet configured for transmission across a network from a source address to a destination address. The method includes obtaining a list of changes to the network. The method also includes analyzing, based on a network model, the data packet using a plurality of analyzers. The method includes correlating the list of changes to the network and the analysis of the data packet. The method further includes determining, based on the correlation between the list of changes to the network and the analysis of the data packet, a configuration status of the network. The method also includes reporting the configuration status to a user.

Scalable event driven auto-diagnosis system

A system for simulating network configurations includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations. The operation includes receiving one or more parameter changes for a production network model of a network. The operations also include generating a simulation network model including the one or more parameter changes. Another operation includes analyzing the simulated network flow within the simulation network model. The operations also include generating a report including an impact of the parameter changes on the network. The operations may also include receiving a production network log including a recorded workflow for the production network model and simulating the production workflow of the production network log within the simulation network model to generate a simulated network log.

Change impact simulation analysis

A method includes obtaining a stream of consecutive network configuration snapshots each including network configuration information. The method also includes determining that first network configuration information is the same as second network configuration information. After determining that the first network configuration information is the same as the second network configuration information, the method includes determining that the second network configuration information is not the same as third network configuration information. The method also includes determining a net change in reachability for a network based on a difference in packet reachability. The method also includes determining a policy violation based on the net change in reachability for the network and generating a reachability differentiation report including the policy violation. The method also includes reverting a configuration of the network to a state corresponding to the first network configuration information and implementing the network using the reverted configuration.

Network reachability impact analysis

A method for providing cloud network reachability analysis includes receiving a reachability query requesting a reachability status of a target including a packet header associated with a data packet. The packet header includes a source IP address and a destination IP address. The method also includes generating one or more simulated forwarding paths for the data packet based on the packet header using a data plane model. Each simulated forwarding path includes corresponding network configuration information. The method includes determining the reachability status of the target based on the one or more simulated forwarding paths and providing the determined reachability status and the one or more simulated forwarding paths to a user device associated with the reachability query which causes the user device to present the network configuration information for each simulated forwarding path.

Cloud network reachability analysis for virtual private clouds

Aspects of the disclosure provide for a proxyless NAT infrastructure with dynamic port allocation. A proxyless NAT infrastructure is configured to perform NAT between a network of virtual machines (VMs) and a device external to the network, without a device, such as a NAT server or a router, acting as a proxy. A system can include a control plane for provisioning VMs of a network, including configuring each VM to perform NAT and initially assigning a number of ports for communicating with other devices. The control plane maintains a feedback loop-receiving data characterizing port usage and network traffic at ports allocated to the various VMs and scaling the port allocation for each VM based on the received data. The control plane can allocate additional ports as determined to be needed by a VM, and later retrieve the ports to be reused for other VMs.

Proxyless network address translation with dynamic port allocation

A system for simulating network configurations includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations. The operations includes receiving one or more parameter changes for a production network model of a network. The operations also include generating a simulation network model including the one or more parameter changes. Another operation includes analyzing the simulated network flow within the simulation network model. The operations also include generating a report including an impact of the parameter changes on the network. The operations may also include receiving a production network log including a recorded workflow for the production network model and simulating the production workflow of the production network log within the simulation network model to generate a simulated network log.

Aspects of the disclosed technology comprise generating firewall rules based on traffic, outputting the generated firewall rules to an output file, and using the output file to set firewall rules in a network. The firewall rules may be generated without a priori knowledge of the network; alternatively no firewall rules are required. Generated rules may be tuned for user preferences to adjust for the number of generated firewall rules, and their over or under inclusiveness to non-historic traffic data.

Inferring firewall rules from network traffic

Presented herein are methodologies for implementing a system and apparatus to estimate a network disruption index and undertake a mitigation action accordingly. A method includes calculating a network disruption index based on at least a disruption score associated with a service request measure, an end-of-life measure, a security incident response measure and a return material authorization measure for respective hardware devices in a network, comparing the network disruption index to a predetermined threshold, and when the network disruption index is above the predetermined threshold, identifying one or more of the hardware devices in the network for a mitigation action and implementing the mitigation action.

Growing community of inventors

San Jose, CA, United States of America

Gargi Adhav