Cisco Technology, Inc.

Roberto Fernando Spadaro

Navindra Yadav

Shashidhar R Gandham

Vimalkumar Jeyakumar

Abhishek Ranjan Singh

Jackson Ngoc Ki Pang

Varun Sagar Malhotra

Rohit Chandra Prasad

Hoang Viet Nguyen

Bharathwaj Sankara Viswanathan

Shih-Chun Chang

Ashutosh Kulshreshtha

Hai Trong Vu

Mohammadreza Alizadeh Attar

Anubhav Gupta

Khawar Deen

Ali Parandehgheibi

Omid Madani

Sunil Gupta

Michael Standish Watts

Supreeth Hosur Nagesh Rao

Ellen Christine Scheib

Fnu Rachita Agasthy

Duane Thomas Barlow

Sunil Kumar Gupta

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

Systems, methods, and computer-readable media are provided for determining a packet's round trip time (RTT) in a network. A system can receive information of a packet sent by a component of the network and further determine an expected acknowledgement (ACK) sequence number associated with the packet based upon received information of the packet. The system can receive information of a subsequent packet received by the component and determine an ACK sequence number and a receiving time of the subsequent packet. In response to determining that the ACK sequence number of the subsequent TCP packet matches the expected ACK sequence number, the system can determine a round trip time (RTT) of the packet based upon the received information of the packet and the received information of the subsequent packet.

Round trip time (RTT) measurement based upon sequence number

An example method can include choosing a pattern or patterns of network traffic. This pattern can be representative of a certain type of traffic such as an attack. The pattern can be associated with various components of a network and can describe expected behavior of these various components. A system performing this method can then choose a nodes or nodes to generate traffic according to the pattern and send an instruction accordingly. After this synthetic traffic is generated, the system can compare the behavior of the components with the expected behavior. An alert can then be created to notify an administrator or otherwise remedy any problems.

Synthetic data for determining health of a network security system

An approach for detecting anomalous flows in a network using header field entropy. This can be useful in detecting anomalous or malicious traffic that may attempt to 'hide' or inject itself into legitimate flows. A malicious endpoint might attempt to send a control message in underutilized header fields or might try to inject illegitimate data into a legitimate flow. These illegitimate flows will likely demonstrate header field entropy that is higher than legitimate flows. Detecting anomalous flows using header field entropy can help detect malicious endpoints.

Anomaly detection through header field entropy

Systems, methods, and computer-readable media are provided for automatically downloading and launching a new version of software package on components in a network environment. In some examples, an upgrade server of a network environment keeps a copy of all versions of software packages running on nodes or sensors of the network environment, identifications of corresponding nodes or sensors, and public keys associated with the software packages. The upgrade server can authenticate a new version of a software package using a two-step process.

Automatic software upgrade

Growing community of inventors

Milpitas, CA, United States of America

Roberto Fernando Spadaro