Cisco Technology, Inc.

Keith Richard Schomburg

John G White

Robert A Mackie

Thomas R Bakita

Walter Glenn Dixon

Dwight Rodney Frye, Jr

Chris O'Rourke

Frank W Pittenger

David A McGrew

Blake Harrell Anderson

Louis F Menditto

Mark Albert

Constantinos Kleopa

David Mcgrew

Ravi Shankar Jandyala

Michael Scott Dorsey

Dwight R Frye

Chris O'rourke

In one embodiment, a device obtains one or more packets of a traffic session in a network. The device determines, for a particular packet of the one or more packets that match a filter, a fingerprint for the particular packet. The device identifies a plurality of traffic sessions whose packets match the fingerprint, wherein each of the plurality of traffic sessions is associated with at least one process. The device updates a process with the traffic session by applying a classifier to the plurality of traffic sessions.

Multi-protocol / multi-session process identification

In one embodiment, a device obtains telemetry data regarding an encrypted traffic session in a network. The telemetry data includes Transport Layer Security (TLS) features of the traffic session and auxiliary information indicative of a destination address of the traffic session, a destination port of the traffic session, or a server name associated with the traffic session. The device retrieves, using the obtained telemetry data, a plurality of candidate processes from a TLS fingerprint database that relates processes with telemetry data from encrypted traffic sessions initiated by those processes. The device uses a probabilistic model to assign probabilities to each of the plurality of candidate processes. The device identifies one of the plurality of candidate processes as having initiated the encrypted traffic session based on its assigned probability.

TLS fingerprinting for process identification

A configuration management system and related methods are provided to facilitate intersection-based management of configuration information for network devices. In one example, a method includes polling a plurality of network devices to determine address entries stored by address tables of the network devices. The method also includes applying a hash function to the address entries to determine a plurality of key-value associations. The method further includes maintaining a hash table comprising the key-value associations. Each key of the hash table corresponds to an address entry stored by one or more of the address tables. Each value of the hash table identities which of the address tables are storing the address entry corresponding to the associated key.

Intersection-based configuration management

A method for distributing information in a network environment is provided that includes receiving one or more packets from a communication flow initiated by an end user and selectively communicating information associated with the communication flow to a network element so that the network element may correlate a source with the communication flow.

System and method for distributing information in a network environment

A method for monitoring information in a network environment is provided that includes receiving one or more packets from a communication flow initiated by an end user. The information associated with the communication flow is then selectively communicated to a plurality of client-aware network elements.

System and method for monitoring information in a network environment

In a distributed network, a data entry is received. The data entry is stored in a first one of a plurality of nodes and replicated in a second one of the plurality of nodes in order to provide data redundancy in the distributed network. In the event of a failure of the second one of the plurality of nodes, the data entry that was replicated therein is re-replicated into a third one of the plurality of nodes in order to maintain data redundancy despite the failure of the second one of the plurality of nodes. Data redundancy can be retained despite the failure of the second one of the plurality of nodes as long as the overall capacity for the distributed network remains above an initial threshold.

System and method for providing redundant data load sharing in a distributed network

A memory system includes a client device and multiple memory devices. The client device communicates an operation request pertaining to a particular data object to one memory device. Referencing a host table, the memory device identifies multiple memory devices associated with an object key of the data object. The memory device communicates the operation request to the identified memory devices to be completed. If one of the memory devices in the memory system becomes inaccessible, the memory system is capable of replacing the inaccessible memory device in the host table. Furthermore, if a new memory device is added to the memory system, the memory system is capable of modifying the host table to associate some of the possible object keys with the new memory device.

Growing community of inventors

Apex, NC, United States of America

Keith Richard Schomburg