Cisco Technology, Inc.

Splunk Inc.

Khawar Deen

Navindra Yadav

Shashidhar R Gandham

Ashutosh Kulshreshtha

Rohit Chandra Prasad

Abhishek Ranjan Singh

Shih-Chun Chang

Ali Parandehgheibi

Michael Standish Watts

Anubhav Gupta

Sunil Gupta

Hai Trong Vu

Varun Sagar Malhotra

Omid Madani

Jackson Ngoc Ki Pang

Supreeth Hosur Nagesh Rao

Ellen Christine Scheib

Hoang Viet Nguyen

Vimalkumar Jeyakumar

Roberto Fernando Spadaro

Bharathwaj Sankara Viswanathan

Fnu Rachita Agasthy

Duane Thomas Barlow

Andy Sloane

Vimal Jeyakumar

Kai Chang

Supreeth Rao

John Bennett Wundes

Rashmi Kalyani Vasudevan

Umang Agarwal

Jackson Pang

Justin Pearson Smith

Gergely Danyi

Matthew William Pound

Calvin Chan

William Matthew Hoffman

Akila Balasubramanian

Sally Wahba

Nikhil Kasthurirangan

Joshua Johnson

Anusha Konatala

Seerut Sidhu

Nicholas Owen Pierson

Aditya Bhandari

Harnit Singh

Pragati Vyas

Taavo-Taur Tammur

Sunil Kumar Gupta

Described herein are techniques for concurrently visualizing real user's session data with a playback of a user's experience during a session. The disclosed techniques can correlate session data collected in response to interactions with an application during a user's session with session recreation data generated by the application and recorded during the user's session. The correlations between the session data and the recreation data can be used to render and control a recreation of the user's experience during the session concurrently with a visualization of the session data.

Concurrent visualization of session data and session playback

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

This disclosure generally relate to a method and system for network policy simulation in a distributed computing system. The present technology relates techniques that enable simulation of a new network policy with regard to its effects on the network data flow. By enabling a simulation data flow that is parallel and independent from the regular data flow, the present technology can provide optimized network security management with improved efficiency.

System and method for network policy simulation

Techniques, which may be embodied herein as systems, computing devices, methods, algorithms, software, code, computer readable media, or the like, are described herein for comparing a set of metrics generated during a simulated user interaction with a website to metrics generated by observing real user interactions with the website. Simulated user interactions with a website can be used to diagnose a website's performance issues, but it can be difficult to determine whether the simulated interactions reflect the experience of real users. In addition, the simulated user interactions can be challenging to contextualize because the number of observed real user interactions may significantly outnumber the simulated interactions. A graphical user interface can help with the interpretation of these website interactions by using the real user interactions to properly contextualize the simulated results.

Techniques for visualizing browser test metrics

A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

System and method of assigning reputation scores to hosts

An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

Policy utilization analysis

Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.

Identifying bogon address spaces

A performance monitoring system (PMS) displays a list of example URLs that matched a URL grouping rule used to group URLs. For a rule configured for a customer of the PMS, the example matched URLs are selected by the PMS from a candidate set of URLs identified from data associated with that customer. The PMS receives information identifying a Uniform Resource Locator (URL) grouping rule displayed in a graphical user interface (GUI). The PMS identified a list of candidate URLs occurring in the stored data. The PMS then identifies, from the list of candidate URLs, a set of matched URLs, the set of matched URLs including one or more URLs from the list of candidate URLs that matched the URL grouping rule. The PMS then causes at least one URL from the set of matched URLs to be displayed on the GUI.

Techniques for showing matched URLs for a URL grouping rule

A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.

System and method of detecting packet loss in a distributed sensor-collector architecture

A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

System and method of detecting whether a source of a packet flow transmits packets which bypass an operating system stack

An application and network analytics platform can capture telemetry from servers and network devices operating within a network. The application and network analytics platform can determine an application dependency map (ADM) for an application executing in the network. Using the ADM, the application and network analytics platform can resolve flows into flowlets of various granularities, and determine baseline metrics for the flowlets. The baseline metrics can include transmission times, processing times, and/or data sizes for the flowlets. The application and network analytics platform can compare new flowlets against the baselines to assess availability, load, latency, and other performance metrics for the application. In some implementations, the application and network analytics platform can automate remediation of unavailability, load, latency, and other application performance issues.

Application performance monitoring and management platform with anomalous flowlet resolution

Growing community of inventors

Sunnyvale, CA, United States of America

Khawar Deen