Cisco Technology, Inc.

Michael Standish Watts

Navindra Yadav

Ali Parandehgheibi

Ashutosh Kulshreshtha

Khawar Deen

Sunil Gupta

Shashidhar R Gandham

Hai Trong Vu

Jackson Ngoc Ki Pang

Shih-Chun Chang

Abhishek Ranjan Singh

Rohit Chandra Prasad

Hoang Viet Nguyen

Varun Sagar Malhotra

Shashi Gandham

Anubhav Gupta

Omid Madani

Vimalkumar Jeyakumar

Supreeth Hosur Nagesh Rao

Ellen Christine Scheib

Roberto Fernando Spadaro

Bharathwaj Sankara Viswanathan

Fnu Rachita Agasthy

Duane Thomas Barlow

Supreeth Rao

Umamaheswaran Arumugam

Aiyesha Ma

Paul Mach

Jothi Prakash Prabakaran

Ravi Prasad

Kai Zhu

Rachita Agasthy

Duy Nguyen

Darshan Shrinath Purandare

Prasannakumar Jobigenahally Malleshaiah

Tapan Shrikrishna Patwardhan

Vimal Jeyakumar

Xuan Zou

Sunil Kumar Gupta

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

This disclosure generally relate to a method and system for network policy simulation in a distributed computing system. The present technology relates techniques that enable simulation of a new network policy with regard to its effects on the network data flow. By enabling a simulation data flow that is parallel and independent from the regular data flow, the present technology can provide optimized network security management with improved efficiency.

System and method for network policy simulation

A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

System and method of assigning reputation scores to hosts

An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

Policy utilization analysis

The disclosed technology relates to intent driven network management. A system is configured to maintain an inventory store comprising records for a set of network entities in a network, wherein each network entity in the set of network entities is associated with a record in the inventory store. The system receives a user intent statement comprising an action and a flow filter representing network data flows on which the action is to be applied and queries, based on the flow filter, the inventory store to identify a plurality of network entities in the set of network entities to which the user intent statement applies. The system generates a plurality of network policies that implement the user intent statement based on the plurality of network entities and the action and enforces the plurality network policies.

Intent driven network policy platform

Aspects of the disclosed technology provide methods for automatically tuning load-balancer configurations in a network environment. In some implementations, a process of the disclosed technology includes steps for collecting flow records of traffic flow segments at a middle box in a network environment, the traffic flow segments corresponding to one or more traffic flows passing through the middle box, analyzing the flow records to identify one or more traffic patterns in the network environment, and automatically updating a load balancer configuration based on the one or more traffic patterns, wherein updating the load balancer configuration improves at least one traffic flow parameter for at least one of the traffic flows passing through the middle box. Systems and machine-readable media are also provided.

Load balancing configuration based on traffic flow telemetry

The disclosed technology relates to assisting with the migration of networked entities. A system may be configured to collect operations data for a service from at least one endpoint host in a network, calculate at least one metric for the service based on the operations data, retrieve a migration configuration and platform data for a target platform, generate a predicted cost for the migration configuration based on the migration configuration, the at least one metric, and the platform data, and provide the predicted cost for the migration configuration to a user.

Network migration assistant

Systems, methods, and computer-readable media for flow stitching network traffic flow segments at a middlebox in a network environment. In some embodiments, flow records of traffic flow segments at a middlebox in a network environment are collected. The flow records can include transaction identifiers assigned to the traffic flow segments. Sources and destinations of the traffic flow segments with respect to the middlebox can be identified using the flow records. Further, the traffic flow segments can be stitched together to form a plurality of stitched traffic flows at the middlebox based on the transaction identifiers and the sources and destinations of the traffic flow segments in the network environment with respect to the middlebox. A configuration of the middlebox operating in the network environment can be identified based on the stitched traffic flows at the middlebox in the network environment.

Automatic configuration discovery based on traffic flow data

A monitoring device/module monitors a plurality of nodes in a data center network, and determines one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes. The network monitoring device determines a network topology, including one or more communication links interconnecting nodes of the plurality of nodes, consistent with the one or more latency distributions. The network monitoring device also determines a representative response time for each communication link based on the one or more latency distributions, and compares a current response time a message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes. The network monitoring device identifies a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount.

Techniques for determining network anomalies in data center networks

Growing community of inventors

Los Altos, CA, United States of America

Michael Standish Watts