Cisco Technology, Inc.

Subhasri Dhesikan

James Martin Polk

Martin W Wu

John K Restrick, Jr

Rongxuan V Chen

Scott Allen Henning

David Sheldon Stephenson

Keith A Lantz

Sape Jurriën Mullender

Paul Edwin Jones

Ijsbrand Wijnands

Hendrikus G P Bosch

Pradeep Kumar Kathail

Alessandro Duminuco

Jeffrey Michael Napper

Neil Robert Diener

Yaron Sella

Raghuram S Sudhaakar

Rajneesh Kumar

Michael McBride

Kevin Holcomb

Kevin E Miller

Satyam Tyagi

David Delano Ward

Clarence Filsfils

Eric Albin Voit

David R Oran

Mankamana Prasad Mishra

Allan Thomson

Christopher Edwin Pearce

Toerless Eckert

Shree N Murthy

Andre Surcouf

Francois Le Faucheur

Stig Ingvar Venaas

Reshad Rahman

Bruce Stuart Davie

Sape Jurrien Mullender

Rishi Chhibber

Roshan Lal

John Monaghan

Vijayaraghavan Doraiswami

Ashok Narayanan

Denise G Caballero-McCann

Manish Mittal

Rahul Savarapu Parameswaran

Michael V DiBiasio

Sachin Vijay Vishwarupe

Hendrikus Gp Bosch

Kevin Roy McMenamy

Rajeev Madan

William R Foster

David Andrew Sauerhaft

Michael A Dews

Michael G Harttree

Jeffrey A Hewett

John K Restrick

David Sauerhaft

James M Stormes

In one embodiment, an apparatus includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the apparatus to perform operations including determining a path through a plurality of provider nodes within a provider network and determining that the path through the plurality of provider nodes within the provider network is secure. The operations also include receiving, from a customer node, a Resource Reservation Protocol (RSVP) path message comprising an attribute for a security request. The operations further include routing the RSVP path message along the path of the plurality of provider nodes.

Systems and methods for determining secure network paths

In one embodiment, methods, systems, and apparatus are described in which data to be used by a processor is stored in a memory. Network communications with a data center are enabled via a network interface. The processor maintains a reporting policy for reporting anomalous events to the data center, the reporting policy having at least one rule for determining a reporting action to be taken by the processor in response to an anomalous event. The processor further monitors the IoT device for a report of an occurrence of the anomalous event. The processor performs the reporting action according to the at least one rule, in response to the report of the occurrence of the anomalous event. An episodic update to the reporting policy from the data center may be received at the processor, which modifies the reporting policy in accordance with the update. Related methods, systems, and apparatus are also described.

Alert throttling

Techniques for provisioning multicast chains in a cloud-based environment are described herein. In an embodiment, an orchestration system sends a particular model of a distributed computer program application comprising one or more sources, destinations, and virtualized appliances for initiation by one or more host computers to a software-defined networking (SDN) controller. The SDN controller determines one or more locations for the virtualized appliances and generates a particular updated model of the distributed computer program application, the updated model comprising the one or more locations for the virtualized appliances. The SDN controller sends the updated model of the distributed computer program application to the orchestration system. The orchestration system uses the particular updated model to generate a mapping of virtualized appliances to available host computers of the one or more host computers based, at least in part, on the particular updated model of the distributed computer program application. Using the mapping of virtualized appliances to available host computers, the orchestration system sends instructions for initiating the virtualized appliances on the available host computers to one or more cloud management systems.

Managing multicast service chains in a cloud environment

In one illustrative example, a multicast traceroute facility for a plurality of interconnected router nodes which are configured to communicate IP multicast traffic amongst hosts is described. The multicast traceroute facility may be for use in processing a multicast traceroute batch query packet which indicates a batch of multicast traceroute queries of a batch query, for identifying a plurality of traced paths for a batch of IP multicast traffic flows. Each identified traced path may be associated with one or more links, each of which has a link metric that satisfies a requested link metric (e.g. a link bandwidth). Resources for satisfying the requested link metric may be reserved for a predetermined or specified time period. The batch of IP multicast traffic flows may be established via at least some of the interconnected router nodes according to the plurality of traced paths identified from the query packet processing.

Multicast traceroute facility with batch query processing for multiple flows and reservation of resources for requested link metrics

Many modern devices and machines (e.g., Internet of Things (IoT) devices and connected vehicles (CV)) include wireless interfaces that permit external devices to communicate with the devices and machines. These wireless interfaces can be attacked by malicious actors who can affect the operation of the devices or machines. Embodiments herein describe a user controlled actuator (e.g., a knob, set of buttons, switches, etc.) for responding to a wireless attack. Using the actuator, the user can set a response level depending on the threat. Each threat level can elicit a predefined action or set of actions from a control system in the device or machine.

User interface for responding to wireless attacks

An IP multicast group may include a plurality of group members corresponding to a plurality of host receivers that are connected to router nodes of a multicast distribution tree and joined in the multicast group. At least some of the router nodes may store a plurality of group member indicator bits associated with the multicast group. Each group member indicator bit may be assigned to a respective one of the group members and indicate whether the respective group member is reachable downstream from the router node. During IP multicast, the router node may receive an IP multicast message having a destination address field, a source address field, and a payload field. The payload field may include one or more data items of a multicast data stream. The destination address field may include a multicast group address for addressing communications to the multicast group.

Methods and apparatus for selectively filtering an IP multicast data stream for selected group members of a multicast group

In one example embodiment, a server generates a candidate instantiation of virtual applications among a plurality of hosts in a data center to support a multicast stream. The server provides, to a first set of agents corresponding to a first set of the plurality of hosts, a command to initiate a test multicast stream. The server provides, to a second set of agents corresponding to a second set of the plurality of hosts, a command to join the test multicast stream. The server obtains, from the second set of agents, a message indicating whether the second set of agents received the test multicast stream. If the message indicates that the second set of agents received the test multicast stream, the server causes the virtual applications to be instantiated in accordance with the candidate instantiation of the virtual applications.

Multicast flow scheduling in a data center

Described in an example embodiment is an end-to-end admission control system that allows any rich media application to secure admission control in an environment where there are mixed wireless and wired segments in the network. In particular embodiments, the system includes the integration of Add Traffic Stream (ADDTS) and Resource Reservation Protocol (RSVP) admission control mechanisms, the mapping of parameters between these two mechanisms, the admission control policies, and failure handling for the end-to-end resource control.

Resource reservation on networks comprising wireless and wired segments

In one embodiment, a method includes determining a first node as a current termination node of a first multicast flow; determining whether a link between the first node and a downstream next-hop node has available bandwidth to accommodate the first multicast flow, where the downstream next-hop node is not currently associated with the first multicast flow; and transmitting the first multicast flow to the downstream next-hop node according to a determination that the link between the first node and a downstream next-hop node has available bandwidth to accommodate the first multicast flow. According to some implementations, the method is performed by a controller with one or more processors and non-transitory memory, where the controller is communicatively coupled to a plurality of network nodes in a network.

Method and device for reducing multicast flow joint latency

In one embodiment, a method includes discovering at a network controller, a topology and link capacities for a network, the network controller in communication with a plurality of spine nodes and leaf nodes, the link capacities comprising capacities for links between the spine nodes and the leaf nodes, identifying at the network controller, a flow received from a source at one of the leaf nodes, selecting at the network controller, one of the spine nodes to receive the flow from the leaf node based, at least in part, on the link capacities, and programming the network to transmit the flow from the spine node to one of the leaf nodes in communication with a receiver requesting the flow. An apparatus and logic are also disclosed herein.

Bandwidth management in a non-blocking network fabric

In one embodiment, a method includes obtaining a first message from an application associated with a variable bit-rate (VBR) media flow, the first message including information that has at least an approximately minimum bandwidth at which the VBR media flow may operate and an amount by which a bandwidth of the VBR media flow may be trimmed. The method also includes determining an amount of available bandwidth in a network, and identifying the approximately minimum bandwidth at which the VBR media flow may operate and the amount by which the bandwidth of the VBR media flow may be trimmed. Finally, the method includes identifying a bandwidth allocation identified based on the amount of available bandwidth in the network, the approximately minimum bandwidth at which the VBR media flow may operate, and the amount by which the bandwidth of the VBR media flow may be trimmed.

Method and apparatus for supporting variable bit-rate reservations

In one embodiment, an illustrative technique determines when an end-user is within a specified proximity of a client device configured to provide an interface to a virtual machine. In response to the end-user being within the specified proximity of the client device, the technique may then allocate data center resources for the virtual machine.

Location-based power management for virtual desktop environments

In one embodiment, a method includes obtaining a request from a first endpoint to establish a session, determining whether a resource reservation may be established post-ring, and identifying a second endpoint to establish the resource reservation post-ring when it is determined that the resource reservation may be established post-ring. The method also includes notifying the second endpoint of the request and ringing the second endpoint. Notifying the second endpoint of the request includes notifying the second endpoint that the resource reservation may be established post-ring.

Method and apparatus for signaling post-ring reservations

In one embodiment, a method includes obtaining a message associated with a data flow that includes a first indicator that identifies an amount of requested pool bandwidth and a second indicator that identifies a pool with which the data flow is associated. The pool is associated with a plurality of data flows that includes the data flow. The method also includes determining whether the pool has an overall bandwidth allocation, and, if so, determining whether reserving the amount of requested bandwidth would cause the overall bandwidth allocation to exceed a maximum pool bandwidth allocation. Finally, the method includes reserving approximately the amount of requested bandwidth when it is determined that reserving the amount of requested bandwidth would not cause the overall bandwidth allocation to exceed the maximum pool bandwidth allocation. Reserving approximately the amount of requested bandwidth includes increasing the overall bandwidth allocation by the amount of requested bandwidth.

Method and apparatus for pooling bandwidth across disparate bandwidth reservations

Growing community of inventors

San Jose, CA, United States of America

Subhasri Dhesikan