Cisco Technology, Inc.

Qosmos

Jerome Tollet

Yoann Desmouceaux

Gautier Harmel

Eric Horlait

William Mark Townsley

Andre Surcouf

Pierre Pfister

Jacques Olivier Samain

Aloys Augustin

Marcel Paul Sosthène Enguehard

Aloÿs Christophe Augustin

Giles Douglas Yorke Heron

Pascal Thubert

Clarence Filsfils

Ali Sajassi

Kyle Andrew Donald Mestery

Vincent E Parla

Pablo Camarillo Garvia

Hari Shankar

Ian James Wells

Andre Jean-Marie Surcouf

Mohammed Hawari

Stephane Litkowski

Edward Albert Warnicke

Serge Fdida

Andrew Yourtchenko

Keith Burns

Guy Pujolle

Jerome Abela

Nathan Roland Maryan Skrzypczak

Rashmi Garg

Alain Fiocco

Nathan Skrzypczak

Benoit Ganne

Kyle Andrew Mestery

Techniques for utilizing a portion of a communication session identifier (e.g., a Session-ID, an SPI, a CID, a DCID, and/or the like) to indicate a target routing device (e.g., a VPN and/or ZTNA termination device) for establishing control plane session(s) and/or data plane session(s) at wire-speed in a networked computing environment. The routing device(s) of a networked computing environment may generate a communication session identifier and send the communication session identifier to the client device, such that subsequent packets send from the client device may be forwarded to the proper routing device indicated by the communication session identifier for establishment of one or more data plane sessions. Additionally, data plane sessions may be established using a Resumed Handshake rather than a full handshake that is typically required, as Session Resumption utilizes the assigned communication session identifier for mapping.

Using client-hello for intelligent routing and firewalling in multipath secure access systems

Techniques for routing Internet Protocol security (IPsec) data packets. An index is assigned to a Security Parameter Index (SPI) header of the IPsec data packet. The index includes information for routing the data packet to a particular Encapsulating Security Payload (ESP) processor. The data packet can be routed using techniques that are analogous to conventional routing protocols such as IPv4 routing protocol. This allows the data packet to be routed using less expensive routing protocols rather than relying solely on more expensive load balancing techniques to route the data packet. This also advantageously allows the data packet to be routed employing routing techniques developed over decades of routing protocol development.

Internet protocol security and security parameter index summarization and data routing

Systems, methods, and computer-readable media are provided for securely advertising autoconfigured prefixes in a cloud environment. In some examples, a method can include, receiving, by a first router, an indication of an available network address prefix. In some aspects, the method can also include selecting, by the first router, a first network address prefix that is within the available network address prefix, wherein the first network address prefix provides at least one route to one or more network elements associated with the first router. In some cases, the method may further include sending, to a second router, a message including a stub registration option that indicates the first network address prefix.

Secured advertisement of autoconfigured internet protocol prefixes in a cloud environment

Techniques for a hub node, provisioned in a site of a hub and spoke overlay network, to receive, store, and/or forward network routing information associated with a spoke, and send packets directly to spoke(s) that are remote from the hub node. A first hub node may receive a network advertisement including a border gateway protocol (BGP) large community string from a first spoke local to the first hub node. The first hub node may send the BGP large community string to a second hub node remote from the first hub node. The second hub node may decode network routing information from the BGP large community string and store the network routing information locally. The second hub node may send a packet from a second spoke local to the second hub node directly to the first spoke without the data packet being routed via the first hub node.

Asymmetric hub and spoke overlay network

Systems, methods, and computer-readable storage media are provided to populate databases with routing data for containers to eliminate the need for continuously accessing a global discovery service. An example method includes initiating, from a source container operating on a first machine in a first rack, a communication with a destination container operating on a second machine on a second rack, wherein a local database on the first machine does not know an address of the destination container. The method includes accessing a global discovery service to provide the address of the destination container, populating the local database on the first machine with the address of the destination container and routing a packet from the source container to the destination container according to the address of the destination container.

System and method of using a global discovery service to enable routing of packets from a source container to a destination container

Systems, methods, and computer-readable media for load balancing using segment routing and application monitoring. A method can involve receiving a packet including a request from a source device to an application associated with a virtual address in a network, mapping the request to a set of candidate servers hosting the application associated with the virtual address, and encoding the set of candidate servers as a list of segments in a segment routing header associated with the packet. The method can further involve determining that a first candidate server from the set of candidate servers is a next segment in the list of segments, encoding the first candidate server in a destination address field on a header of the packet, and forwarding the packet to the first candidate server.

Reliable load-balancer using segment routing and real-time application monitoring

Systems, methods, and computer-readable media for enabling container networking are disclosed. In one aspect, a method includes receiving a request from a first network container on a source server to establish a data session with a second network container on a destination server; determining a destination switch of the destination server based on the request; identifying a communication tunnel between the source server and the destination server; generating a data stream to be embedded in the pre-established communication tunnel, wherein a communication protocol associated with the request is different from a communication protocol used by the data stream; receiving a data packet to be sent to the destination container; mapping the data packet to the data stream; and sending the data packet to the destination server via the data stream over the communication tunnel.

Container networking using communication tunnels

A method includes, in a constellation of clients including a first client and a second client, receiving, at the first client, a connection request from the second client, retrieving endpoint reachability data associated with the second client and transmitting, to a server, a connection request based on the endpoint reachability data. The first client receives, from the server and based on the connection request, endpoint reachability information associated with the second client and starts a bidirectional connection with the second client. A direct or indirect tunnel is established between the first client and the second client. The tunnel is set up based on a table which maps a first connectivity option associated with the first client to a second connectivity option associated with the second client to determine whether to establish the direct tunnel or the indirect tunnel between the first client and the second client.

Systems and methods providing a multi-cloud microservices gateway using a sidecar proxy

The invention relates to a data collection device for monitoring streams in a data network using a packet transmission mode, including an extractor for extracting data contained in packets belonging to a stream defined by a transmitter, a receiver, and a protocol. The collection device also includes a syntax analyzer which receives data in real time from the extractor and breaks the data down into elements according to the syntactic rules of the protocol, said syntactic rules enabling the elements to be represented as a tree structure. The syntax analyzer combines respective tree state indicators with at least some of the elements, wherein the tree state indicator combined with an element locates said element within the tree structure. An interface transmits the tree state indicators, together with the elements with which the latter have been combined, to a stream analyzer external to the collection device.

Data collection device for monitoring streams in data network

A distributed system for analyzing traffic flow on a communications network architecture where a computer provides information over a data network to a concentrator, which provides a bridge between the computer and the end user terminals. The interface between the terminals and the concentrator is provided through access points for each workstation. The system to analyze the traffic is distributed into three components that perform, respectively, classification of the traffic flow, processing of the results of the classification, and handling of the processed results.

Distributed traffic analysis

The present invention provides a traffic analyzing system on a communications link having analyzer circuits connected to each other by a number of links, where each analyzer circuit has a data rate lower than the data rate of the communications link, and are adapted to perform respective different levels of analysis on packets. The information extracted from the packets analyzed at a first level of analysis by a first analyzer circuit is forwarded to a second level of analysis performed at a second analyzer circuit, where the additional analysis performed by the second analyzer circuit depends on the analysis performed by the first analyzer circuit. Such a system and associated method allows for an efficient, practical, and improved traffic flow analyses for computer networks to evaluate high-speed and heavy traffic flow, as well as for improved protocol analysis for emerging technologies.

Traffic analysis on high-speed networks

A method for protocol identification by recognizing determinative data among data transmitted through a detected connection using lists of explicit and implicit son protocols associated with each protocol. The kernel of an information system associates to each detected connection a data structure arranged so that it comprises an ordered sequence of the protocol names. The kernel builds the data structure by retrieving the son protocol names in the list associated to the last protocol name of said ordered sequence, the son protocol name for which the associated self identification mechanism recognizes determinant data among transmitted data by adding the retrieved son protocol name to the end of the sequence and by restarting to retrieve the son protocol name for which the associated self identification mechanism recognizes determinant data among transmitted data.

Method for protocol recognition and analysis in data networks

Growing community of inventors

Paris, France

Jerome Tollet