Juniper Networks, Inc.

Cisco Technology, Inc.

Jainendra Kumar

Vineet Dixit

Prabhu Seshachellum

Gunes Aybay

Joseph LaSalle White

Quaizar Vohra

Ravi Shekhar

Sandeep Bajaj

Rahul Kasralikar

Apoorva Jindal

Murali Vemula

Ramya Olichandran

Predrag Spasic

Avanindra Godbole

Wen H Huang

Gregory M Waters

Joseph C Harrow

Lucy Chiu

Sami Khan

Raghu Ram Reddy Mavillapally

Rahul S Kasralikar

In one embodiment, a method includes receiving a first identifier and a private key after a network device has been included in a data center switch fabric control plane, authenticating the network device based on the private key, sending a second identifier to the network device, and sending a control signal to the network device based on the second identifier. The first identifier is associated with the network device and unique within a segment of the data center switch fabric control plane. The second identifier is unique within the segment of the data center switch fabric control plane.

Methods and apparatus for dynamic automated configuration within a control plane of a switch fabric

A device may receive an indication to generate a probe packet associated with a tunnel included in a first network. The tunnel may include a first tunnel endpoint and a second tunnel endpoint and may correspond to a path, associated with a second network, between the first tunnel endpoint and the second tunnel endpoint. The device may generate the probe packet including information associated with the tunnel. The device may provide the probe packet, via the first tunnel endpoint, such that the probe packet is received by a network device that lies on the path. The device may receive a response packet, associated with the probe packet and provided by the network device, that includes path information. The path information may include information associated with the network device. The device may store the path information to allow the network device to be identified as lying on the path.

Overlay tunnel and underlay path correlation

A computer-implemented method for increasing the scalability of software-defined networks may include (1) maintaining a set of databases collectively configured to (i) store a set of flow entries that direct network traffic within a software-defined network and (ii) facilitate searching the set of flow entries based at least in part on at least one key whose size remains substantially constant irrespective of the number of flow entries within the set of flow entries, (2) detecting a request to perform an operation in connection with a flow of data packets within the software-defined network, (3) identifying at least one attribute of the flow of data packets in the request, and then (4) searching, using the attribute of the flow of data packets as a database key, at least one database within the set of databases to facilitate performing the operation. Various other methods, systems, and apparatuses are also disclosed.

Systems and methods for increasing the scalability of software-defined networks

An output circuit, included in a device, may determine counter information associated with a packet provided via an output queue managed by the output circuit. The output circuit may determine that a latency event, associated with the output queue, has occurred. The output circuit may provide the counter information and time of day information associated with the counter information. The output circuit may provide a latency event notification associated with the output queue. An input circuit, included in the device, may receive the latency event notification associated with the output queue. The input circuit may determine performance information associated with an input queue. The input queue may correspond to the output queue and may be managed by the input circuit. The input circuit may provide the performance information associated with the input queue and time of day information associated with the performance information.

Monitoring packet residence time and correlating packet residence time to input sources

A device may receive configuration information for generating an application probe. The application probe may be used to request network information, associated with an application, from network devices. The device may determine, based on the configuration information, traffic parameters associated with the application. The device may determine a requested type of network information to be requested from the network devices. The device may generate the application probe by including, in the application probe, the traffic parameters and information identifying the requested type of network information. The device may transmit the application probe to a network device of the network devices. The device may receive, from the network device and based on transmitting the application probe, a value associated with the requested type of network information.

Application visibility in layer 3 networks

An apparatus includes a network management module to store a network configuration file. The network configuration file having a binding association with an identifier of a port from a plurality of ports of a switch fabric when the network management module is in a first configuration. The network management module selects the network configuration file based on the binding association with the identifier if the port in response to an access switch being operatively coupled to the port. The network configuration file having a binding association with an identifier of the access switch when the network management module is in a second configuration. The network management module selects the network configuration file based on the binding association with the identifier of the access switch in response to the access switch being operatively coupled to the port.

Methods and apparatus for configuration binding in a distributed switch

In one embodiment, a method includes receiving a configuration request and a first key from a network device, granting a first class of access to the network device, sending a configuration instruction to the network device, receiving an association request from the network device, and granting a second class of access to the network device. The configuration request and the first key are received at a first time. The network device is outside a secure network segment at a first time. The first class of access is granted based on the first key. The configuration instruction is send in response to granting the first class of access. The association request includes a second key. The granting the second class of access is based on the second key.

Methods and apparatus for accessing a secure network segment

A method and system are disclosed that provide a significant improvement for securely selecting a subset of available cryptographic functionality in a system. This is implemented by using the highest level of cryptography available in a system to encrypt the system initialization data used to select, enable, disable, or configure cryptographic features in a crypto chip. The system decrypts the encrypted data by momentarily fully enabling the crypto chip during the boot process, and using a known, system-unique, and fixed seed to generate the private key to use for decryption. The seed used is the system's MAC address (L2 LAN address&#x2014;medium access control). Alternatively, the system could include a one-time use decryption-only algorithm in the boot strap code itself.

Enabling cryptographic features in a cryptographic device using MAC addresses

A method and apparatus for significantly reducing the number and types of non-volatile memory used on a typical motherboard is disclosed. While there are typically three or more types of non-volatile memory used to support the CPU during system boot and initialization, the present invention uses only one. This allows for a significant savings in materials cost and design effort.

Growing community of inventors

Fremont, CA, United States of America

Jainendra Kumar