Juniper Networks, Inc.

Sreenivas Voruganti

Balaji Murali

Anil Kaushik

Rahul Jain

Sainath Reddy Cheruvu

Stephen Grau

Ankur Singla

Vedamurthy Joshi

Ashish Pal

Pal Ashish

Atul Mahamuni

Abhishek Kumar

Shankar Ramanathan

Vineet Verma

Ganesh Rajagopalan

A computer-implemented method for detecting cache-poisoning attacks in networks using SDPs may include maintaining a cache of service information that identifies services provided by client devices connected to a network using an SDP. The method may also include detecting a cache-poisoning attack by (1) receiving, from a client device connected to the network, an SDP message related to a service allegedly provided via the network, (2) identifying, within the SDP message, an attribute of the service allegedly provided via the network, and then (3) determining that the client device is attempting to corrupt the cache of service information by determining that the identified attribute of the service suggests that the service is illegitimate. Finally, the method may include performing a security action to mitigate the cache-poisoning attack in response to detecting the cache-poisoning attack. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting cache-poisoning attacks in networks using service discovery protocols

A computer-implemented method for detecting rogue client devices connected to wireless hotspots may include maintaining at least one illegitimate authentication identifier that appears to rogue client devices to facilitate authentication with an external network via a wireless hotspot. The method may also include providing the illegitimate authentication identifier to one or more client devices connected to the wireless hotspot. The method may further include receiving an authentication request to authenticate the client device with at least one external network via the wireless hotspot. The method may additionally include determining that the authentication request includes the illegitimate authentication identifier. Finally, the method may include determining that the client device is a rogue device based at least in part on the illegitimate authentication identifier being included in the authentication request. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting rogue client devices connected to wireless hotspots

A network device receives initial policer limits for a plurality of over-subscribing ingress ports, where the initial policer limits are based on existing bandwidth limits for an over-subscribed egress port associated with the over-subscribing ingress ports. The network device receives a high threshold watermark and a low threshold watermark for bandwidth usage of the over-subscribed egress port, and identifies a queue, associated with the over-subscribed egress port, with values outside the high threshold watermark or the low threshold watermark. The network device reduces the initial policer limits for the plurality of over-subscribing ingress ports when the queue has values above the high threshold watermark, and increases the initial policer limits for the plurality of over-subscribing ingress ports when the queue has values below the low threshold watermark.

Dynamic prioritized fair share scheduling scheme in over-subscribed port scenario

A network device implements automatic configuration of Quality of Service (QoS) parameters in response to operator specification of a relatively few and easily understandable 'high level' parameters such as, for example, latency requirements or an acceptable rate of packet drops. In one implementation, a network device may receive user preference information that relates to a Quality of Service (QoS) for network traffic passing through the network device and may measure traffic patterns through the network device. The device further generates a configuration template based on the measured traffic patterns and on the user preference information transmit the data in an order of transmission that is prioritized according to a bandwidth allocation policy defined by the configuration template.

Quality of service (QoS) configuration for network devices with multiple queues

Methods and systems consistent with the present invention provide dynamic buffer allocation to a plurality of queues of differing priority levels. Each queue is allocated fixed minimum number of buffers that will not be de-allocated during buffer reassignment. The rest of the buffers are intelligently and dynamically assigned to each queue depending on their current need. The system then monitors and learns the incoming traffic pattern and resulting drops in each queue due to traffic bursts. Based on this information, the system readjusts allocation of buffers to each traffic class. If a higher priority queue does not need the buffers, it gradually relinquishes them. These buffers are then assigned to other queues based on the input traffic pattern and resultant drops. These buffers are aggressively reclaimed and reassigned to higher priority queues when needed.

System and method for dynamically allocating buffers based on priority levels

A method includes receiving network information for calculating weighted round-robin (WRR) weights, calculating WRR weights associated with queues based on the network information, and determining whether a highest common factor (HCF) exists in relation to the calculated WRR weights. The method further includes reducing the calculated WRR weights in accordance with the HCF, when it is determined that the HCF exists, and performing a WRR scheduling of packets, stored in the queues, based on the reduced WRR weights.

WRR scheduler configuration for optimized latency, buffer utilization

A network device operating in a cut-through mode receives a current packet of an unknown length and determines if there is a known length value of a previous packet in a processing cycle associated with the current packet. When there is no known length value of the previous packet, the network device applies, to the current packet, an estimated length value for the current packet. When there is a known length value of the previous packet, the network device applies, to the current packet, the known length value of the previous packet. The network device processes the current packet based on one of the estimated length value or the known length value of the previous packet.

Accurate measurement of packet size in cut-through mode

Methods and systems consistent with the present invention provide dynamic buffer allocation to a plurality of queues of differing priority levels. Each queue is allocated fixed minimum number of buffers that will not be de-allocated during buffer reassignment. The rest of the buffers are intelligently and dynamically assigned to each queue depending on their current need. The system then monitors and learns the incoming traffic pattern and resulting drops in each queue due to traffic bursts. Based on this information, the system readjusts allocation of buffers to each traffic class. If a higher priority queue does not need the buffers, it gradually relinquishes them. These buffers are then assigned to other queues based on the input traffic pattern and resultant drops. These buffers are aggressively reclaimed and reassigned to higher priority queues when needed. In this way, methods and systems consistent with the present invention dynamically balance requirements of the higher priority queues versus optimal allocation.

Growing community of inventors

Bengaluru, India

Sreenivas Voruganti