Anue Systems, Inc.

Keysight Technologies, Inc.

Keysight Technologies Singapore (holdings) Pte. Ltd.

Other

Keysight Technologies Singapore (sales) Pte. Ltd.

Stefan Jan Johansson

Shardendu Pandey

David W McGhee

Robin Lee O'Connor

Keith E Cheney

Jonathan Lee Harrod

Charles Albert Webb, Iii

Jonathan Glenn Stroud

Gregory S Hilton

Patricia A Abkowitz

Scott Walker Register

Cary J Wright

Deep Datta

Jeffrey L Pochop, Jr

Gregory Lane Singleton

Marc Owen Magnuson

Salomon Noubieli Tatang

George Lache

Ethan Paul Spurlock

Jason Chia-Suan Wang

Mattias Johansson

Fred Strelzoff

Keith E Chaney

Methods, systems, and computer readable media for detecting network service anomalies. An example method includes, during a learning phase, detecting a client initiating a first network interaction with an application and recording a start time for the first network interaction with the application; determining that the first network interaction with the application has ceased and recording an end time for the first network interaction; and determining, based on the start time and the end time, an application interaction rate for the first network interaction with the application. The method includes, during a detection phase, detecting the client initiating a second network interaction with the application; determining a second application interaction rate for the second network interaction; and determining that a network service anomaly occurred during the second network interaction based on the first application interaction rate and the second application interaction rate.

Methods, systems, and computer readable media for detecting network service anomalies

A method for selectively processing a packet flow using a flow inspection engine is disclosed. The method includes receiving, by at least one hardware data plane processor component in a network packet broker, a plurality of packets associated with a packet flow, and forwarding, by the at least one hardware data plane processor component to at least one flow inspection engine, a copy of at least a portion of one or more of the initial packets of the packet flow. The method further includes providing, by the at least one hardware data plane processor component to the at least one flow inspection engine, packet flow statistical data resulting from a high throughput processing of the plurality of packets by the at least one hardware data plane processor component and generating, by the at least one flow inspection engine, metadata records using the copy at least a portion of the of the one or more of the initial packets and the packet flow statistical data, wherein the at least one hardware data plane processor component generates the statistical data from the plurality of packets independent of any instruction from the at least one flow inspection engine.

Methods, systems, and computer readable media for selectively processing a packet flow using a flow inspection engine

A method for network flow metadata processing at a network packet broker is described herein. The method includes, receiving, as input at a network packet broker, network traffic flow data, aggregating the network traffic flow data over a predefined time period to generate Internet protocol (IP) flow feature vectors containing metadata parameters associated with one or more particular endpoint devices, and providing the IP flow feature vectors to a machine learning element in the network packet broker. The method further includes identifying, by the machine learning element, anomalies existing in the metadata parameters included in the IP flow feature vectors, and automatically configuring one or more filter elements in the network packet broker in response to detecting the identified anomalies of the IP flow feature vectors.

Methods, systems, and computer readable media for utilizing machine learning to automatically configure filters at a network packet broker

According to one method for control plane traffic filtering in a control and user plane separation (CUPS) environment, the method occurs at a network node implemented using at least one processor and at least one memory. The method includes receiving, from one or more sources, network location information associated with a first network location; receiving control plane messages for different network locations; filtering the control plane messages based on the network location information; and sending traffic including data from the filtered control plane messages to at least one network tool.

Methods, systems, and computer readable media for control plane traffic filtering in a control and user plane separation (CUPS) environment

Systems and methods are disclosed for hash-based selection of network packets for packet flow sampling in network communication systems. Input packets associated with packet flows within a network communication system are received by a hash-based sampler. The hash-based sampler then generates hash values for the input packets based upon fields within the input packets. These fields are selected to identify packet flows for the input packets. The hash values for the input packets are then compared to a mask. The mask is configured to determine a subset of packet flows for which to forward packets. Based upon this comparison, certain input packets are selected to be forwarded for further processing, and non-selected packets are discarded. The further processing can include processing the selected input packets to generate flow statistics data (e.g., IPFIX) for the selected input packets.

Hash-based selection of network packets for packet flow sampling in network communication systems

Traffic differentiator systems for network devices and related methods are disclosed that include automatic port order determination. The disclosed embodiments includes input ports that receive a first stream of packets and a second stream of packets and a packet difference processor that operates in a learning mode and a normal mode. In the learning mode of operation, the packet difference processor automatically determines a port order representing whether the first stream of packets for the first port or the second stream of packets for the second port represents a first in time version of received packets. In the normal mode of operation, the packet difference processor uses the port order determination to facilitate determination of difference packets between the first stream of packets and the second stream of packets.

Traffic differentiator systems and related methods including automatic packet stream order determination

Pre-sorter systems and methods are disclosed for distributing GTP packets. The pre-sorter forwards GTP packets based upon entries within one or more pre-sort tables, and the entries associate F-TEIDs with output ports that can be coupled to GTP sessions controllers and/or other external systems. The F-TEIDs represent a combination of a destination IP address and a tunnel endpoint identifier (TEID) for each GTP packet. For some embodiments, GTP session controllers analyze the GTP packets and determine F-TEIDs that are created, modified, and/or dropped for user sessions, and the GTP session controllers send control messages to the pre-sorter to determine the entries stored within the pre-sort table(s). For other embodiments, other external systems such as network monitoring tools are coupled to the GTP packet pre-sorter rather than GTP session controllers. Pre-sorters having multiple pre-sort modules with local pre-sort tables, as well as two-stage pre-sort architectures, can also be used.

Pre-sorter systems and methods for distributing GTP packets

Systems and methods are disclosed for hash level load balancing for removal of duplicate network packets to form deduplicated packet streams. Hash values for input packets are used in part to select deduplication engines to receive hash data associated with received input packets, and this hash data is then forwarded to the selected deduplication engines for deduplication processing. The hash level load balancing reduces bandwidth requirements within the deduplication processing as compared to prior packet-based load balancing solutions for deduplication systems. Additional embodiments utilize port identifiers in addition to hash values to allow for increased flexibility in deduplication of packets from multiple input ports.

Hash level load balancing for deduplication of network packets

Traffic differentiator systems for network devices and related methods including automatic port order determination

Traffic differentiator systems for network devices and related methods are disclosed that determine difference packets from multiple packet streams. Some embodiments are configured to receive two streams of packets with one stream being a processed version of another stream and then to determine difference packets within a lookup time window that is, for example, associated with a processing time for the second stream to be a processed version of the first stream. Difference packets within a lookup time window can also be determined for packets received within a single combined stream of packets. Difference packets and/or related statistical information is then output for additional processing, as desired. The streams of packets can be associated with ingress and egress packets for a network device, and the difference packets and related statistical information can be used to determine packets that are removed, added, and/or modified by the network device.

Traffic differentiator systems for network devices and related methods

A waste incinerator system is disclosed for incinerating waste in a holding tank. The system comprises a pump in fluid communication with the waste, and which is adapted to pump waste out of the holding tank and into a substantially hollow burning chamber. The burning chamber includes a raised open end and a lowered chimney end. The chimney end is sealed with a selectively removable chamber plate and includes a chimney for venting exhaust fumes from within the burning chamber. A waste tray is adapted to be slid into the burning chamber through the chimney end and holds waste received from the pump. A burner assembly is fixed adjacent with the open end of the burning chamber and adapted to direct a flame into the open end of the burning chamber to heat the waste tray and incinerate the waste therein. A housing is included to enclose the burner assembly and the burning chamber.

Waste combustion chamber

A timepiece, including a main mechanism operable to indicate time, the main mechanism positioned upon or within a face of the timepiece; a first counter including a first operation mechanism, the first counter appearing upon or within the face; a second counter including a second operation mechanism, the second counter appearing upon or within the face; and a third counter including a third operation mechanism, the third counter appearing upon or within the face. When the timepiece is in operation, the first operation mechanism, the second operation mechanism, and the third operation mechanism each have an operation status differing from one another. When the timepiece is in operation, the first operation mechanism, the second operation mechanism, and the third operation mechanism maintain a continuous time loop prior to resetting one or more of the first operation mechanism, the second operation mechanism, and/or the third operation mechanism.

Time counter timepiece

Systems and methods are disclosed for mobile user identification and tracking for load balancing in packet processing systems. Packet processing systems, such as network tool optimizer (NTO) systems, are configured to receive packets associated with multiple mobile users, to extract user identification information from the packets, to store identity binding information for the mobile users, to track changes in identification information for mobile users within a communication system by analyzing control information within packets for the communication system, and to forward packets to one or more tool ports associated with the packet processing system. The packet processing systems disclosed thereby allow for user packets to be identified and sent to the same load-balanced network tool, even though the user identification information changes over time within the communication system. The disclosed embodiments are useful for a wide variety of mobile and/or non-mobile communication systems and related communication protocols.

Mobile user identification and tracking for load balancing in packet processing systems

Systems and methods are disclosed for modifying network packets to use unrecognized headers/fields for packet classification and forwarding in packet processing systems, such as network tool optimizer (NTO) devices. The packet modifications described allow standard switch or routing integrated circuits (ICs) to process, classify, and forward packets based upon data that is not typically recognized by the hardware capabilities of the standard packet routing circuitry for packet processing. Input packets are modified so that unrecognized data becomes recognized data for purposes of packet processing, classification, and forwarding by the packet routing circuitry. These modifications are then removed after packets are processed to reform the original packets. The original packets are then provided to destination devices based upon packet classification and forwarding control information. As such, packet processing, classification, and forwarding is provided in packet processing systems using headers/fields that are not supported for processing by standard switch or routing integrated circuits (ICs).

Growing community of inventors

Round Rock, TX, United States of America

Stefan Jan Johansson