Juniper Networks, Inc.

Arista Networks, Inc.

Big Switch Networks, Inc.

Vmware, Inc.

Sandip K Shah

James Michael Murphy

Abhijit Kumar Choudhury

Pranay Pogde

Yung-Ching Tseng

Shudong Zhou

Robert Ling

Raghavendra Mallya

Rajagopalan Sivaramakrishnan

Shine-Chu Wang

Ileana J Membreno

Andrew Shaw

Jeffrey L Pochop, Jr

Ryan Izard

Avinash Nigam

Rohan Gandhi

Surinder Singh

Ambarish Prashant Pande

Philip Brighten Godfrey

Shashank Ranjan

Gourab Ghosh

Prashant Jain

Atul Mahamuni

Shunjia Yu

Kanzhe Jiang

Manjunath Jagannatharao

Rudramahesh S Rugge

Sundar Siddaramaiah Bettadahalli

Anand Ammundi

Sameer Mahajan

Kenneth Hsinchao Chiang

Apoorva Jindal

Nipa Kumar

Zhao Dong

Christian Geddings Barrineau

Vlad Serban Hanciuta

Michael Theodore Stolarchuk

Michael T Stolarchuk

Andrii Rykhlivskyi

Pranay Podge

Jing Ai

Anurag Chowdhary

Nagendra Krishna Sundaranathan

A framework for facilitating the capturing and querying of network traffic (packets) is provided. In one set of embodiments, the framework enables the assignment of tags to sets of related network device interfaces. For example, a tag Tmay be assigned to a set of network device interfaces that carry traffic for an application or service A, a tag Tmay be assigned to a set of network device interfaces that carry traffic for an application or service A, and so on. The framework further enables the use of these tags for provisioning packet capture sessions and for querying the resulting captured packets.

Tag-based packet capture and query

A network traffic analysis device may be configured to receive network performance metrics data for network traffic flows. The network traffic analysis device may further be configured to receive application information for an application indicative of a subset of the network traffic flows belonging to the application and to aggregate the network performance metrics data for the subset of the network traffic flows to obtain aggregated network performance metrics data for the application. By analyzing network performance metrics data in this aggregated manner, the network traffic analysis device can provide further insights into patterns of network issues experienced by the application and/or by one or more services of the application.

Per-application network performance analysis

A packet forwarding network may include switches that forward network packets between end hosts. A monitoring network may be coupled to the forwarding network. A controller may control switches in the monitoring network to forward network packets tapped from the forwarding network to one or more packet recorders. The packet recorders may store the tapped packets and the controller may query the stored packets at a later time. The controller may analyze queried packets to monitor the operation of the packet forwarding network and, if desired, to display graphical visualizations associated with the packet forwarding network. If desired, the controller may instruct the packet recorders to replay the tapped packets to network visibility tools through the monitoring network. The controller may coordinate storage and query operations across multiple packet recorders using the monitoring network so that the packet storage capacity and recording rate may be scaled up over time.

Systems and methods for controlling switches to record network packets using a traffic monitoring network

A method for updating a policy by a policy manager, that includes selecting, by the policy manager, a policy entry that includes an input and an implementation, performing a validation on the policy entry, making a first determination, based on the validation, that the implementation was not successful, and updating the policy, based on the first determination, to match the input.

Systems and methods for validating, maintaining, and visualizing security policies

Data taps are provided in a production network to mirror traffic flow through the network. Feeds from the data taps are provided to a monitoring fabric comprising a network of service nodes. A service node receives mirrored traffic and identifies packets in the mirrored traffic for further processing, for example to be forwarded to one or more monitoring/security tools. The packets are identified based on the contents of the packets. For example, packets at the beginning of a TCP session and at the end of the TCP session can be identified based on the TCP flags in the packets. The service node can cause these packets to be sent to one or more monitoring/security tools.

Session slicing of mirrored packets

A method of managing inter-branch communication is a network, including generating an end-to-end path, wherein the end-to-end path starts in a first computing device in a first branch and ends at a second computing device in a second branch, wherein the end-to-end path is generated using a plurality of flow records and a plurality of path records and the end-to-end path includes a wide area network (WAN) segment, and issuing, based on the generating, a notification to a network administrator, wherein the notification specifies the end-to-end path and a latency associated with at least one segment in the end-to-end path.

End-to-end path detection and management for inter-branch communication in a wide area network (WAN)

A method for analyzing a pair of domain name system (DNS) packets, the method comprising: extracting a portion of a request DNS packet to obtain extracted request DNS information, wherein the extracted request DNS information comprises a first timestamp generated by the edge network device, obtaining a response DNS packet, extracting at least a portion of the response DNS packet to obtain extracted response DNS information, wherein the extracted response DNS information comprises a second timestamp generated by the edge network device, after the obtaining, processing the extracted request DNS information and extracted response DNS information to obtain processed information, wherein the processed information comprises a roundtrip time derived from the first timestamp and the second timestamp, and transmitting the processed information to a monitoring system, wherein the pair of DNS packets are not transmitted to the monitoring system.

Domain name system analysis on edge network devices

Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Emulating packet flows to assess network links for SD-WAN

A packet forwarding network may include switches that forward network packets between end hosts. A monitoring network may be coupled to the forwarding network. A controller may control switches in the monitoring network to forward network packets tapped from the forwarding network to network flow information generation circuitry. The controller may provide configuration information such as record description information to the network flow information generation circuitry. Based on the configuration information, the network flow information generation circuitry may dynamically generate instructions that generate network flow information records. A set of network flow information records may be stored in a repository at the network flow information generation circuitry. The repository may include hash values associated with each of the stored network flow information records. By dynamically generating instructions to populate network flow information records, extraneous generalized instructions may be omitted and network flow information may be more efficiently generated.

Systems and methods for generating network flow information

Systems and methods for building a monitoring fabric are described. The system receives a duplicate of a first portion of traffic information from a first network as first traffic information and communicates the first traffic information in the monitoring fabric. The first traffic information is communicated to a controller that configures the monitoring fabric. The system receives a duplicate of a second portion of the traffic information from the first network as second traffic information. The system forwards the second traffic information to at least one tool.

Systems and methods to build a monitoring fabric

Systems and methods to scale a network monitoring fabric are described. The system uploads a virtual tool, over a network, to a monitoring fabric. The monitoring fabric includes a first plurality of switches including a second plurality of switches for monitoring a production network. Next, the system configures the monitoring fabric to receive a first portion of traffic information from the production network and communicate the first portion of traffic information to the virtual tool. Next, the system receives a duplicate of the first portion of the traffic information from the production network as first traffic information. The first traffic information is received at a first ingress interface providing access to the monitoring fabric. Finally, the system forwards the first traffic information in the monitoring fabric to the first instance of the first virtual tool.

Systems and methods to scale a network monitoring fabric

In some embodiments, an apparatus includes a first controller configured to be operatively coupled within a network having a set of network nodes, a forwarding gateway and a configuration entity. The first controller is configured to manage session state and node state associated with the set of network nodes independent of the forwarding gateway. The first controller is configured to fail over to a second controller when the first controller fails, without the forwarding gateway failing over and without the configuration entity failing over.

Methods and apparatus for scalable resilient networks

Growing community of inventors

Milpitas, CA, United States of America

Sandip K Shah