Amazon Technologies, Inc.

Michael W Palladino

Thomas Bradley Scholl

Bobby Brown

Eric Charles Briffa

Fiachra John Groarke

Yao Liu

Harvo Reyzell Jones

Eric Andrew Rubin-Smith

Dennis Marinus

Kushal Mall

Julien Ridoux

Seyed Arash Sadrieh

Bradford Sachin Chatterjee

Jonathan Phillibert

Ali Khayam

Tahir Azim

Michael Marano

Mario Souza

Joan Barcelo Llado

Valentin Iulian Neacsu

Kenan Yang

Rajat Chaudhary

Keerthi Krishnan

Nikhil Ashok Arjunagi

Suresh Ambalavanan

Robert Louis Mosher

Christopher Jason Brown

Ahmed Negm

Sasha Robbins

Blake Hoelzel

Ibn Wendell Archer

Christine Estefania Morales Hernandez

Cheng-Jia Lai

Madhura Kale

Matt Chung

Technologies are disclosed for mitigating attempts to capture traffic on a network using unauthorized advertisements. Responsive to detecting an authorized advertisement for a path to a service on the network, a mitigation/orchestration service may determine a synthetic route advertisement that is configured to win back the captured traffic (e.g., by providing a route specificity that is at least equal to the unauthorized advertisement) and propagate the synthetic route advertisement from routers in the network. The won back traffic may be directed through a backbone of the network to the service.

Route hijack mitigation

A system can determine by which path/tunnel an Internet destination can be best reached for a user with an IP address from a static BGP range. The system looks up the destination address in an egress map. This map can either specify a tunnel that should be used for encapsulation for static BGP, or (when tunnel is not present) cause the system to send out unencapsulated traffic, in which the traffic follows normal BGP routing on a border network.

Routing for static border gateway protocol

Technologies are disclosed for performing context-aware routing of traffic based on an application of a series of filters and/or selectors to determine an optimal group of interfaces for servicing traffic relating to a prefix. A traffic management control plane processes input data corresponding to aggregated telemetry data for a network by determining candidate groups of interfaces to service a network prefix and applies tunable filters and/or selectors to the candidate groups to determine a targeted group to use for servicing traffic corresponding to the prefix. The determined targeted group is mapped to the prefix in a mapping result, which is then provided to an actuator interface to control network devices to inject the new mapping into the network to control traffic according to the mapping.

Network traffic management

A detection mechanism is disclosed for identifying peers transmitting network traffic towards a cloud provider using routing prefixes that were not advertised for that peer. Once detected, an alarm condition can occur and the peer notified to remove any static route configurations. In one embodiment, a collector server computer can be used to acquire routing prefixes advertised to a peer. A second server computer can be used to obtain network traffic received from the peer. A comparison can then be made between the advertised prefixes and the network traffic being received. If network traffic is being received for unadvertised prefixes, then an alarm condition can occur. The detection mechanism can regularly inspect active traffic flows against BGP route advertisements at fixed intervals. For peers that are identified that are not in compliance with route advertisements, the alarm condition can occur for follow-up remediation.

Detecting static routes in a network

Growing community of inventors

Renton, WA, United States of America

Michael W Palladino