Cisco Technology, Inc.

Cumulus Networks Inc.

Akitra, Inc.

Sameer Merchant

Navindra Yadav

Thomas James Edsall

Krishna Doddapaneni

Kit Chiu Chu

Satyam Sinha

Francisco M Matus

Pirabhu Raman

Dhananjaya Rao

Hasmit S Grover

Michael R Smith

Victor Manuel Moreno

Sanjay Sane

Ayan Banerjee

Murali Basavaiah

Umamaheswararao Karyampudi

Amit Jain

Ramana Mellacheruvu

Srinivasan Ramabadran

Murukanandam Kamalam Panchalingam

Wilson Kok

Ramesh V N Ponnapalli

Shrijeet Subhabrata Mukherjee

Roopa Prabhu

Samar Sharma

Anand Girish Parthasarathy

Chandan Mishra

Praveen Jain

Chandramouli Radhakrishnan

Sarang M Dharmapurikar

Kiron Haltore

Saurabh Jain

Ramkumar Sankar

Naveen S Bisht

Sreeram Parameswara Iyer

Xuanming Dong

Ravi Someshwar

Naveen Pethandlahally Narayan Gowda

Srinivas Sastry

Vijaya Kulkarni

Dhanamjaya Rao

Ramesh VN Ponnapalli

Disclosed herein are methods of forwarding data over an IP network. The methods may include receiving a packet from a source host connected to the IP network, identifying the IP address of a destination host designated in the packet, determining the location on the IP network where the destination host designated by the packet is connected, without reference to the MAC address specified in the packet, by using location-identification information stored on the IP network, and forwarding the packet to the location on the IP network where the destination host is connected without reference to the MAC address specified in the packet. Also disclosed herein are related network devices implementing such techniques and operations, as well as IP networks which include such network devices.

IP-based forwarding of bridged and routed IP packets and unicast ARP

The subject technology addresses a need for improving utilization of network bandwidth in a multicast network environment. More specifically, the disclosed technology provides solutions for extending multipathing to tenant multicast traffic in an overlay network, which enables greater bandwidth utilization for multicast traffic. In some aspects, nodes in the overlay network can be connected by virtual or logical links, each of which corresponds to a path, perhaps through many physical links, in the underlying network.

Multicast multipathing in an overlay network

Identity information is decoupled from reachability information in packets transferred between hosts of a computer network by replacing forwarding information within said packets with an identifier having a format of the forwarding information, and applying forwarding labels, derived from the identifiers, which are then used in lieu of the forwarding information for conveying the packets within the network. During such conveyance, the packets are treated according to one or more policies prescribed on a basis of the identifier, which may be an IPv6 address. The forwarding labels may be MPLS labels.

Methods and systems for flow virtualization and visibility

A system comprises an enterprise network system and engine that could be inside an enterprise or hosted on a public and/or private cloud infrastructure. The engine has a discovery module coupled to a switch device, an AI and machine learning based monitoring and detection module coupled to the switch device and end point devices or assets including laptops, workstations and servers, and a remediation module coupled to the switch device. The system provides processes for building a network endpoint state transition model. The system can be unsupervised and is completely based on artificial intelligence processes. The network endpoint model is constructed by using a network identity and network behavior observed through data traffic flow to capture co-occurrence of data communications or connections in at least two consecutive observation windows or time frames. This network endpoint connection state transition model is used for detecting behavior anomalies.

Apparatus having engine using artificial intelligence for detecting behavior anomalies in a computer network

Disclosed are systems, methods, and computer-readable storage media for guaranteeing symmetric bi-directional policy based redirect of traffic flows. A first switch connected to a first endpoint can receive a first data packet transmitted by the first endpoint to a second endpoint connected to a second switch. The first switch can enforce an ingress data policy to the first data packet by applying a hashing algorithm to a Source Internet Protocol (SIP) value and a Destination Internet Protocol (DIP) value of the first data packet, resulting in a hash value of the first data packet. The first switch can then route the first data packet to a first service node based on the hash value of the first data packet.

Symmetric bi-directional policy based redirect of traffic flows

Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Network fabric overlay

Techniques for providing a reflexive access control list (ACL) on a virtual switch are provided. Embodiments receive a first packet corresponding to a first network flow and a second packet corresponding to a second network flow. Upon determining that a SYN flag is set within the first packet, a first entry is created in the reflexive ACL for the first network flow. Upon determining that the first packet was received over a client port of the first physical switch, the first packet is forwarded to a second physical switch within virtual switch. Upon determining that the second packet has a SYN flag enabled, a second entry is created in the reflexive ACL. Finally, upon determining that the second packet was received from the second physical switch, the second packet is forwarded over an uplink port to a destination defined by the second packet.

Handling reflexive ACLs with virtual port-channel

Systems, methods, and non-transitory computer-readable storage media for forwarding tables for virtual networking devices. The system first identifies local virtual machines hosted on a local host connected to the system, the system having virtual tunneling capabilities. The system then generates a forwarding table for the system. Next, the system populates the forwarding table with local entries including bindings for the local virtual machines hosted on the local host and adds a default route in the forwarding table pointing to a default forwarder function, wherein the default route is configured to handle all non-local traffic relative to the system and the local host.

Forwarding tables for virtual networking devices

Various embodiments are disclosed for increasing Layer-3 LPM (longest prefix match) routing database in a network platform. In some embodiments, chipsets in fabric modules (FMs) can be partitioned into multiple banks. Network traffic can be directed towards a corresponding bank in the FMs by using a LPM table on a line card (LC). Entries in the LPM table on the LC can be programmed either statically or dynamically based upon LPM routes that are dynamically learned.

Method for increasing layer-3 longest prefix match scale

An administrator can define or modify one or more service graphs. Next, the administrator can register service appliances along with their device package files with a controller. Then, the controller can establish the capabilities of the service devices, and classify the service devices as legacy or service tag switching (STS) capable devices. Then, the controller can create one or more instances of the service graph, by populating the service nodes into the service graph. Then, the application owner can attach their endpoint groups (EPGs) to the service graphs created by the administrator. Then, a service in the network can be automatically provisioned using the service graph to configure one or more nodes in an associated service chain of the service according to information in the service graph.

Provisioning services in legacy mode in a data center network

Growing community of inventors

Sunnyvale, CA, United States of America

Sameer Merchant