Keysight Technologies, Inc.

Keysight Technologies Singapore (holdings) Pte. Ltd.

Keysight Technologies Singapore (sales) Pte. Ltd.

Anue Systems, Inc.

Breakingpoint Systems, Inc.

Keysight Technologies Singapore (holdings) Ptd Ltd

Doublechecked Credentials LLC

Kristopher Len Raney

Matthew Ryan Bergeron

Dennis James Cox

Brent Cook

Winston Wencheng Liu

Ryan S Clifton

Santanu Paul

Peter Joseph Marsico

Jonathan Glenn Stroud

Michael Moriarty

Mark Veteikis

Eric David Goff

The subject matter described herein includes methods, systems, and computer readable media for providing a declarative network monitoring environment. A method for providing a declarative network monitoring environment includes providing an available tool registry for storing tool information associated with networking monitoring tools that are available for use; providing a potential tool registry for storing tool information associated with networking monitoring tools that are potentially available for use; receiving declarative network monitoring input indicating a desire by a user to perform a monitoring related task; determining, using the declarative network monitoring input and the available tool registry and/or the potential tool registry, at least one set of tool configurations for configuring network monitoring tools to perform the monitoring related task; and providing the at least one set of tool configurations.

Methods, systems and computer readable media for providing a declarative network monitoring environment

A method for dynamic firewall configuration for accessing service hosted in virtual networks includes monitoring, in a virtual network, changes in an Internet protocol (IP) address of a service hosted in a virtual network. The method further includes detecting a change the IP address of the service hosted in the virtual network. The method further includes communicating notification of the change in IP address to a firewall policy management interface. The method further includes, automatically configuring a firewall to allow access to the service hosted in the virtual network.

Dynamic firewall configuration and control for accessing services hosted in virtual networks

A method for network flow metadata processing at a network packet broker includes, receiving, as input at the network packet broker, network flow metadata, the network flow metadata including a network flow statistic generated by a network device regarding packets in the network flow. The method further includes accessing, by the network packet broker, a network flow metadata processing rules database and identifying a network flow metadata processing rule to apply to the network flow metadata. The method further includes processing, by the network packet broker, the network flow metadata using the network flow metadata processing rule. The method further includes forwarding, by the network packet broker and based on results of the processing, egress network flow metadata to a network tool.

Methods, systems, and computer readable media for processing network flow metadata at a network packet broker

Methods and systems are disclosed that provide in-session splitting of network traffic sessions for monitoring of traffic between network clients and network servers. This in-session splitting is based upon monitoring traffic sessions for one or more events and then initiating a proxied session based upon detection of the one or more events. For further embodiments, the creation of the proxied session is implemented based upon detection of a request for a secure link within the session traffic, and the proxied session is then implemented such that original session participants are not aware of the proxied session. The encrypted secure communications between the network client and the network server are split into two connections that decrypted and re-encrypted so that the contents of the secure link can be analyzed to identify network threats and/or other desired network related activities.

In-session splitting of network traffic sessions for server traffic monitoring

A method for managing cloud deployment and maintenance of network tools includes providing a network tool user interface for displaying network tools available for deployment from different network tool providers and for receiving user selection of one or more of the network tools for deployment. A network tool provider interface allows network tool providers to submit network tools for availability via the network tool user interface. A user can select, via the network tool user interface, one or more of the network tools for cloud deployment and, a location for deploying the selected network tool. The method further includes interfacing with a service orchestration system of the location for deploying the selected network tool in the location. User interface elements are provided for monitoring performance of and maintaining deployed network tools.

Methods, systems, and computer readable media for managing deployment and maintenance of network tools

Systems and methods are disclosed for drop detection and protection with respect to packet monitoring in virtual processing environments. Tap agents monitor and capture packets from the network traffic associated with network applications running within these virtual processing environments. Sequence numbers are added in packet encapsulation before tap packets are forwarded to tool agents. The tool agents then use the sequence numbers to detect packet drops within the tap packets. After drop detection, the tool agents send drop detection messages to an agent controller, and the agent controller generates and sends reconfiguration messages to the tap agents based upon the drop detection messages. The tool agents can also send drop detection messages directly to the tap agents. The tap agents adjust their operations based upon the reconfiguration messages and/or the drop detection messages to reduce packet drops within subsequent tap packets communications.

Drop detection and protection for network packet monitoring in virtual processing environments

Methods, systems, and computer readable media for providing intent-driven microapps for execution on communications network testing devices. A method includes receiving a configuration definition specifying a user-declared intent for testing a communications network. The method includes accessing a catalog of intents and determining, based on one or more entries in the catalog of intents matching the configuration definition specifying the user-declared intent, one or more applications from a repository of network testing or visibility applications and at least one configuration file. The method includes installing the one or more applications on a network testing device and configuring the one or more applications using the configuration file, causing the network testing device to test the communications network and to fulfill the user-declared intent specified in the configuration definition.

Methods, systems, and computer readable media for providing intent-driven microapps for execution on communications network testing devices

The subject matter described herein relates to methods, systems, and computer readable media for triggering dynamic, on-demand activation of cloud-based network visibility tools. One method includes steps that occur in a network visibility platform including at least one processor. The method further includes classifying, using a classifier implemented by the at least one processor, packets or network metadata into groups of related packets or network metadata. The method further includes generating, using an event notification generator implemented by the at least one processor, event notifications based on the groups of related packets or network metadata classified by the classifier. The method further includes communicating, by the event notification generator, the event notifications to a cloud network for triggering dynamic on-demand activation of at least one cloud-based network visibility tool to process the groups of related packets or network metadata classified by the classifier.

Methods, systems and computer readable media for triggering on-demand dynamic activation of cloud-based network visibility tools

Systems and methods are disclosed for location based deployment of test agents in a cloud environment based upon deployment information for previously placed customer processing nodes. The cloud environment is hosted by servers operating to provide cloud services within two or more server zones. A test controller receives deployment information about applications operating with the cloud environment, analyzes the deployment information to determine locations within the cloud environment for deployment of test agents where the locations are associated with a plurality of the applications, sends resource requests to a cloud management controller to deploy the test agents at the locations, and receives test results from the test agents deployed by the cloud management controller at the locations based upon the resource requests. Monitor agents operating along with applications deployed in the cloud can also be used to provide the deployment information to the test controller.

Location based test agent deployment in virtual processing environments

Methods and systems are disclosed that pre-classify network traffic monitored within virtual machine (VM) platforms. Client packet monitor applications operate within client VM platforms to monitor network packets, generate monitored packets representing traffic of interest, determine packet classifications for the monitored packets based upon packet contents, identify tags associated with the packet classifications, encapsulate monitored packets with encapsulation headers including the tags to form encapsulated packets, and forward the encapsulated packets to tool VM platforms. Tool packet monitor applications operate within the tool VM platforms to receive the encapsulated packets, identify packet classifications associated with the tags, remove the encapsulation headers from the encapsulated packets, and forward de-encapsulated packets to network destinations based upon the packet classifications. The tool packet monitor applications can also aggregate de-encapsulated packets having the same packet classification prior to forwarding the aggregated packets to one or more network destinations.

Network traffic pre-classification within VM platforms in virtual processing environments

A method for optimizing placement of virtual network visibility components includes providing a virtual network monitoring tap instance for copying packets in a network. The method further includes providing a virtual network packet broker instance for receiving and distributing the copied packets to at least one network monitoring tool instance. The method further includes analyzing a network performance or utilization parameter associated with transmission of the copied packets among the virtual network tap instance, the virtual network packet broker instance and the network monitoring tool instance. The method further includes modifying, based on results of the analyzing, placement of at least one of the virtual network packet broker instance and the virtual network monitoring tool instance.

Methods, systems and computer readable media for optimizing placement of virtual network visibility components

Network tool optimizers for server cloud networks and related methods are disclosed. In part, master filters are defined to segregate and control user traffic, and user filters are defined to forward the user traffic to cloud-based network tools or tool instances. A master user interface and user interfaces for each user are provided so that the master filters and user filters can be defined and managed. A filter rules compiler within the cloud-based network tool optimizer then combines the master filters with the user filters, resolves conflicts in favor of the master filters, and generates filter engine rules that are applied to filter engines within the network tool optimizer for the cloud network. The filter engines then forward packets received at input ports for the network tool optimizer to output ports for the network tool optimizer that are coupled to network tools or tool instances within the cloud network.

Cloud-based network tool optimizers for server cloud networks

Metadata associated with client application instances running in virtual machine (VM) platforms within virtual processing environments is collected by monitor applications also running within the VM platforms. The instance metadata is transmitted to and received by a monitor control platform which in turn stores the instance metadata within a monitor instance registry. The instance metadata is updated through solicited or unsolicited updates. The instance metadata is used to identify groups of application instances, and these groups are used to determine targets instances for monitoring or management actions based upon later detected network events such as network security or threat events. Further, trust scores can be determined for components of the metadata stored in the instance registry, and composite trust scores can be generated and used to identify on or more groups of application instances.

Instance based management and control for VM platforms in virtual processing environments

Methods and systems are disclosed that provide active firewall control for network traffic sessions within virtual processing platforms. Client agent instances run within virtual machine (VM) platforms (e.g., hypervisor, container, etc.) within virtual processing environments and enforce access, proxy, and/or other firewall rules with respect to network traffic sessions for application instances also running within the VM platforms. For certain embodiments, the agent instances collect information about applications and services running within the VM platforms and use this collected information to automatically enforce firewall rules. Additional disclosed embodiments redirect packets from 'bad' network sources to a proxied application instance that interacts with the 'bad' network source. This proxied interaction allows an agent instance monitoring the proxied session to analyze and assess the actual activity by the &#x201c;bad&#x201d; network source without putting the original data or network service at risk. Other features and variations are also be disclosed.

Active firewall control for network traffic sessions within virtual processing platforms

Systems and methods are disclosed for packet deduplication for network packet monitoring in virtual processing environments. Tap agents are installed and run with respect to network applications operating with virtual processing environments. These tap agents capture packet traffic associated within these network applications, and deduplication rules are applied so that duplicate packet capture is avoided at the tap agents themselves. In particular, deduplication rules are applied to tap agents where two network applications for which packets are being captured are talking to each other so that one of the tap agents is set to the designated agent for packet capture. Without this designation, packets captured at by the two associated packet agents would represent the same packet flow from both ends thereby leading to duplicate packet capture.

Growing community of inventors

Oak Park, CA, United States of America

Kristopher Len Raney