Zscaler, Inc.

Pankaj Chhabra

Sandeep Kamath

Chakkaravarthy Periyasamy Balaiah

Srikanth Devarajan

Vikas Mahajan

Vladimir Stepanenko

Chenglong Zheng

Sreedhar Pampati

John A Chanak

Rishabh Gupta

David Creedy

Amandeep Singh

Sandeep Kumar

Satish Kalipatnapu

Khaireddine Mazboudi

Javier Rodriguez Gonzalez

Prasannakumar Jobigenahally Malleshaiah

Gregory Rybinski

Barrett Hostetter-Lewis

Srujan Kotha

Jay Makwana

Techniques for detecting Destination Network Address Translation (DNAT) in network paths. Systems and methods include sending a Hypertext Transfer Protocol Secure (HTTPS) CONNECT request to a proxy in a network path; receiving a response to the HTTP request; monitoring a header of the response to the HTTPS request; and determining that the proxy is a Destination Network Address Translation (DNAT) router based on information in the header. The steps can further include performing a plurality of traces, for a plurality of legs of the network path based on the determining; and aggregating details related to the plurality of legs of the network path to provide a holistic view of the network.

Systems and methods for detecting destination network address translation (DNAT) in network paths

Systems and methods include, responsive to a request to access an application, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user device is remote over the Internet, determining if a user of the user device is permitted to access the application; determining a posture of the user device; and allowing access to the application based on whether the user is permitted to access the application and based on the posture of the user device.

Utilizing endpoint security posture, identification, and remote attestation for restricting private application access

Systems and methods include monitoring user experience of one or more users accessing any of the Internet, cloud applications, and private applications; determining a user experience score for the one or more users; responsive to detecting a low user experience score for a user, performing one or more analyses on the user experience of the user; and determining a root cause of the low user experience score based on the one or more analyses. The systems and methods can include determining a remedial action for the user based on the root cause.

Automatic analysis of user experience issues to reduce resolution time

Techniques for processing web probes for monitoring user experience including use of caching to prevent a surge of web probes on destination servers and for detecting web probe traffic. A method implemented by a connector includes intercepting a Hypertext Transfer Protocol Secure (HTTPS) web probe request to a server, identifying a cache hit associated with the request in a cache, generating a synthetic Hypertext Transfer Protocol (HTTP) response based on information from the identified cache hit, wherein the generated synthetic HTTP response includes an extension header containing collected statistics, and sending the synthetic HTTP response. The method can further include simulating a Secure Socket Layer (SSL) handshake to estimate SSL cost.

Systems and methods for reducing server load with HTTPS cache

The present disclosure relates to systems and methods for egress handling for networks with Public Internet Protocol (IP) address. The disclosure includes identifying if a public Internet Protocol (IP) is used on a private network; performing a traceroute to an originating point of a tunnel; responsive to no reply to the traceroute, making a location call to an end node, wherein the end node identifies the origin of the location call, the identity of the origin being an egress IP; and responsive to a reply to the traceroute, using the IP to show the origin of the tunnel. The disclosure further includes, responsive to no tunnel being present, providing a continuous network path from a client to a destination.

Egress handling for networks with public internet protocol (IP) address

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods provide adaptive probing of a service path in a network, wherein the service path includes a plurality of legs. The systems and methods include, for one or more legs of the plurality of legs, sending a number of probes using one of a plurality of protocols; responsive to receiving a response from the number of probes, determining the one of the plurality of protocols is successful and storing this protocol the one or more legs; and, responsive to failure to receive the response, sending a number of probes using another one of the plurality of protocols and continuing until a successful protocol is determined or all of the plurality of protocols fail.

Adaptive probing to discover a protocol for network tracing

Techniques for determining the path of User Datagram Protocol (UDP) traceroute probes using Transmission Control Protocol (TCP) and Internet Control Message Protocol (ICMP). Various embodiments include sending a plurality of probes to one or more legs in a network path; obtaining measurements from each of the plurality of probes for each of the one or more legs in the network path; and performing one or more actions based on the measurements from each of the plurality of probes. The steps further include overlapping the measurements to determine latency to a destination and identifying throttling of UDP traffic based on the overlapping of measurements from the plurality of probes.

Determining the path of user datagram protocol (UDP) traceroute probes

Techniques for using trace with tunnels and cloud-based systems for determining measures of network performance are presented. In an embodiment, a method includes determining a client application is being executed; determining an endpoint associated with the client application, based on any of monitoring application logs associated with the client application and network flows associated with the client application; and causing one or more probes to the determined endpoint and deriving metrics based on the one or more probes for determining performance of the client application.

Determining endpoint and application behavior for monitoring user experience

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include identifying one or more of a proxy and a tunnel in a network path, determining a relative location of the proxy and the tunnel in the network path, performing a plurality of traces, for a plurality of legs of the network path based on the locations of the proxy and the tunnel, and aggregating details related to the plurality of legs of the network path to provide a holistic view of the network. The different protocols include Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP).

Traceroutes through external proxies

Techniques for using trace with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include obtaining policy information related to a trace; performing a plurality of traces, from a start point to an end point in a network, using the different protocols based on the policy information; evaluating which of the plurality of traces reach the end point, and evaluating any of average latency of the plurality of traces, average loss of the plurality of traces, and a number of hops found, for each of the plurality of traces that reach the end point; and selecting a protocol of the different protocols to use for the trace based on the evaluating. The different protocols include Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP).

Adaptive tracing using one of a plurality of protocols

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include performing a plurality of traces between two nodes in a service path; obtaining latency measurements for each of the plurality of traces for each of one or more hops between the two nodes; and determining average latency between each of the one or more hops based on the latency measurements, adjusted average latency for each hop, and differential average latency for each hop.

Accurate differential traceroute latency calculation between hops

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include receiving a request from a client to perform a reverse trace; requesting a trace to an endpoint that is one of an egress router and a tunnel client, wherein there is a tunnel between i) the destination and ii) the one of the egress router and the tunnel client; receiving a response to the trace; and sending details associated with the response to the client so that the client aggregates these details with details from one or more additional legs to provide an overall view of a service path between the client and the destination.

Detection of latency, packet drops, and network hops through a TCP tunnel using ICMP and UDP probes

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include receiving a request, from a client, for one or more of a first trace of a tunnel and a second trace to a destination; checking a cache at the node for results from previous traces of the first trace and the second trace; responsive to the results not being in the cache, performing one or more of the first trace and the second trace; and providing the results to the client so that the client aggregates the results with details from one or more additional legs to provide an overall view of a service path between the client and the destination.

Growing community of inventors

Surrey, Canada

Pankaj Chhabra