Cisco Technology, Inc.

Jeffrey Cai

Yu Jiang

Yuefeng Jiang

Yuchen Zhou

Yibin Yang

Peng Wang

Liqin Dong

Chia Alex Tsai

Saravanan Radhakrishnan

Fang Yang

Bo Sun

Xiaopu Zhang

Weng Hong Chan

Systems and methods for causation analysis of network anomalies in a network include detecting an alarm condition at a network device, the alarm condition pertaining to an anomaly or increase in a traffic condition such as packet loss. A dominant key is identified in each of one or more key types which contributed to the alarm condition, the key types including dimensions of traffic flow. Two or more dominant keys of two or more key types are aggregated and clustered to determine a combination of dominant keys which contributed to the alarm condition. A dominant traffic flow comprising the combination of dominant keys which contributed to the alarm condition is identified based on the aggregation and clustering. Malware or security threats can be identified from detecting a dominant source IP address or host which contributed to a predominant number of packet drops or retransmissions at ports of the network.

Systems and methods for causation analysis of network traffic anomalies and security threats

In one embodiment, a method includes identifying at a first edge device, a failure at a second edge device, the first and second edge devices located in a local network site in communication with remote network sites in an overlay network, changing a state of a routing locator address at the first edge device from down to up in response to the failure at the second edge device, the routing locator address initially associated with the second edge device, and advertising the routing locator address at the first edge device in an underlay network so that packets from the remote network sites are forwarded to the first edge device upon convergence in the underlay network. An apparatus and logic are also disclosed herein.

Fast convergence for redundant edge devices

Techniques provided herein use aggregate endpoints in a virtual overlay network. In general, aggregate endpoints operate as a single receiving entity for certain packets/frames sent between different physical proximities of the virtual overlay network.

Scalable network virtualization with aggregate endpoints

Growing community of inventors

Shanghai, China

Jeffrey Cai