Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Shaun Wakumoto

Ballard Claude Bare

Cetin Ersoy

Nathan Stanley Jenne

Mark Gooch

Craig Joseph Mills

Bruce E LaVigne

Shaun Wackerly

Bruce Edward LaVigne

Frank A Reichstein

Parvez Syed Mohamed

Robert Lee Faulk, Jr

Mark A Tassinari

Jechun Chiu

Bud A Rojas

Andrew T Bare

Charles F Clark

Duane Edward Mentze

Madhusoodhana Chari Sesha

Wei Lu

Chuck A Black

Joseph A Curcio

Mauricio Sanchez

Sebastien Tandel

Matthew Laswell

Krishna Mohan Elluru

Ted T Nguyen

Sankarlingam Dandabany

Dick T Fong

Freeman Yufei Huang

Sarayu Srinivas Chandrapal

Sagar Bhanagay

Nam Soo Kim

Michael Patmon

Amit Green

Tomas Navarro

Mohamed Kahn

Shawn E Reynolds

Jay G Schudel

Systems and methods are provided for collecting data related to changes to a data store table, which may be used for analyzing problems that occur in the network. The information monitored may include types of changes made to a data store/table, such as insertions and deletions of data store elements. When an anomaly occurs in the statistical data store/table data, an alert is issued. This statistical data of the types of changes to a data store may be suggestive of similar changes in a network. For example, the uptime, inactive time, and stable time of rows of a data store table may be used for estimating or inferring the uptime, inactive time, and stable time for nodes, data paths, or other elements of a network. The system may include a web UI or a command line interface, which may aid in diagnosing problems in the network, and taking corrective action.

Computing network information based on data store changes

Embodiments herein relate to transmitting specific traffic along a blocked link. A status of links between switches of a network is monitored. The status of the links is one of blocked and non-blocked. A blocked link is not used by a Spanning Tree Protocol (STP). At least one of the network switches is configured to transmit the specific traffic along the blocked link.

Transmit specific traffic along blocked link

Examples disclosed herein relate to performing an action based on an advertisement indicator is present in a network packet. In one example, a network packet identified by a network infrastructure device as matching criteria associated with a pre-identified request is received. A parameter within the network packet is identified. A rule is used to determine whether the parameter indicates that an advertisement indicator is present in a flow associated with the network packet. An action is performed based on whether the advertisement indicator is present in the network packet.

Action based on advertisement indicator in network packet

A method for accessing a computing device including launching a first operating system having a bootloader to boot a second operating system into a random-access memory on the computing device, the first operating system and the second operating system having access to an administrator password contained in an administrator password file located in a persistent file of the computing device and booting the second operating system from the first operating system bootloader to populate a filesystem into the second operating system. Also, executing a login failsafe by the second operating system to read the administrator password contained in the administrator password file located in the persistent file and installing the administrator password file in the filesystem of the second operating system by the login failsafe. The method further including failing to complete the booting of the second operating system and allowing access to the computing device through an administrator user account protected by the administrator password when the second operating system fails to complete the booting.

Computing device login failsafe

An expression evaluation system is provided. During operation, the system can obtain an encoded expression associated with a user group of a network and evaluate the encoded expression for a first switch to determine a first set of commands that the user group is allowed to execute on the first switch. The encoded expression can encode a set of commands. The system can then determine validity of the first set of commands for the user group by determining whether a respective user of the user group should be allowed to execute the first set of commands on the first switch. If the system identifies an issue with the validity of the first set commands, the system can generate a notification indicating the issue.

Method and system for enhanced command management in a network

An example of a computing system is described herein. The computing system includes a plurality of network security devices. The computing system also includes a network switch configured to direct network traffic. The computing system further includes a controller coupled to the network switch. The controller is to instruct the network switch in directing network traffic to the plurality of network security devices.

Network security

In some examples, a method can include monitoring data traffic along an uplink port and along at least a subset of a plurality of host ports, determining whether the uplink port is oversubscribed based on the monitored data traffic, determining whether a given host port of the at least a subset of host ports is receiving excessive data traffic in response to determining that the uplink port is oversubscribed, and flagging a host port that is determined to be receiving excessive data traffic.

Uplink port oversubscription determination

Example embodiments disclosed herein relate to determining whether a device exhibits anomalous behavior based on a set of rules, address usage information, and address range information. Address usage information for a device communicating on a data plane of a network implemented using switches is received via a control plane. Address range information for the network is maintained. Whether the device exhibits anomalous behavior is determined based on the set of rules, address usage information, and address range information.

Determine anomalous behavior based on dynamic device configuration address range

Systems and methods associated with service insertion forwarding are disclosed. One example method includes building a service insertion address table. The service insertion address table may associate service insertion tunnels with device addresses based on payload source addresses retrieved from packets received via the service insertion tunnels. The method also includes forwarding a packet received from a source device to a destination device. The packet may be received from the source device via a source service insertion tunnel. The packet may be forwarded to the destination device via a destination service insertion tunnel. The destination service insertion tunnel may be associated with the destination device in the service insertion address table.

Service insertion forwarding

Methods, network controllers, and machine-readable and executable instructions are provided for network controller provisioned MACsec keys. A network controller can provision a first network device with a media access control security (MACsec) key for a MACsec flow. The network controller can provision a second network device with the MACsec key for the MACsec flow.

Network controller provisioned MACsec keys

Examples include a network device to filter a packet for a packet type. The network device includes a filter to receive the packet and to determine whether the packet is a defined packet type. The network device also includes a Bloom filter to receive the packet from the filter based on the determination that the packet is a defined packet type and to determine whether the packet is a matched packet or an unmatched packet. A processing resource of the network device may receive the packet from the Bloom filter based on the determination that the packet is a matched packet and to determine whether the packet is an exact match.

Filtering of packets for packet types at network devices

Examples disclose a system comprising an integrated circuit to determine whether a data packet should be processed by a shared security engine associated with a secure link. Additionally, the examples disclose a first media access control (MAC), associated with the shared security engine, to receive the data packet for transmission on the secure link based on the determination the data packet should be processed by the shared security engine.

Routing a data packet to a shared security engine

Applying an MSTP configuration can include instructing a plurality of network devices to disable non-MSTP links in response to a verification of receipt of the MSTP configuration and instructing the plurality of network devices to apply the MSTP configuration in response to a verification that each of the plurality of network devices disabled the non-MSTP links.

Applying a multi-instance spanning tree protocol (MSTP) configuration

Methods, network controllers, and machine-readable and executable instructions are provided to determine a secure path between a source device and a destination device. The secure path may be via a plurality of network devices. The secure path may be determined based on a security capability of each of the plurality of network devices in the secure path. Data may be forwarded between the source device and the destination device, via the plurality of network devices, based on the determined path.

Secure path determination between devices

In a method of managing access to a network, a MAC based authentication operation is implemented in determining whether to grant a user device access to the network. In addition, a user is enabled to self-register a user device into a database of authorized users in response to the user being denied access through the MAC based authentication operation and being listed as a valid user in a directory of active network users. Moreover, the directory of active network users is monitored for modification of information pertaining to the users listed in the directory of active network users and the database of authorized users is modified in response to a determination that user information pertaining to at least one user listed in the directory of active network users that affects the database of authorized users has been modified.

Growing community of inventors

Roseville, CA, United States of America

Shaun Wakumoto