Cisco Technology, Inc.

Suraj Nellikar

Maithili Narasimha

Anuraag Mittal

Sudarshana Kandachar Sridhara Rao

Udayakumar Srinivasan

Joji Thomas Mekkattuparamban

Fabio Rodolfo Maino

Vina Ermagan

Lawrence Rolfe Kreeger

Sourabh Suresh Patwardhan

Srinivas Sardar

Lilian Sylvia Fernandes

Massimiliano Menarini

Systems, methods, and computer-readable storage media are provided for managing connected data transfer sessions in a computing network. A controller included in the computing network can monitor connected data transfer sessions to determine whether a predetermined threshold has been met or exceeded and, if so, terminate at least one connected data transfer session in the computing network. The threshold can include a threshold number of connected data communication sessions and/or a threshold amount of resources utilized by the connected data communication sessions. The controller can terminate connected data transfer sessions until the total number of connected data communication sessions and/or threshold amount of resources falls below the threshold.

Methods and systems for managing connected data transfer sessions

Systems, methods, and computer-readable media provide for collection of statistics relating to network traffic between virtual machines (VMs) in a network. In an example embodiment, a virtual switch hosted on a physical server provides network address information of VMs deployed on the physical server to a virtual switch controller. The controller collects this network address information from each virtual switch under its control, and distributes the aggregate address information to each switch. In this manner, the controller and each switch within the controller's domain can learn the network address information of each VM deployed on physical servers hosting switches under the controller's control. Each virtual switch can determine a classification of a frame passing through the switch (e.g., intra-server, inter-server and intra-domain, or inter-domain traffic), and statistics relating to the traffic. In an example embodiment, the virtual switch controller can collect the statistics from each switch within its domain.

Method and apparatus for advanced statistics collection

An example method for path optimization in distributed service chains in a network environment is provided and includes receiving information about inter-node latency of a distributed service chain in a network environment comprising a distributed virtual switch (DVS), where the inter-node latency is derived at least from packet headers of respective packets traversing a plurality of service nodes comprising the distributed service chain, and modifying locations of the service nodes in the DVS to reduce the inter-node latency. In specific embodiments, the method further includes storing and time-stamping a path history of each packet in a network service header portion of the respective packet header. A virtual Ethernet Module (VEM) of the DVS stores and time-stamps the path history and a last VEM in the distributed service chain calculates runtime traffic latencies from the path history and sends the calculated runtime traffic latencies to a virtual supervisor module.

Path optimization in distributed service chains in a network environment

An example method is provided and, in an example embodiment, includes receiving a data packet at an ingress switch function, the data packet associated with a data packet flow; obtaining access control information associated with a destination of the data packet flow from a centralized service engine; and performing access filtering on the data packet flow at the ingress switch function using the access control information.

Method and apparatus for ingress filtering

In one embodiment, a method includes identifying at a network device, characteristics of a distributed virtual switch comprising a control plane component and a plurality of data plane components, grouping the data plane components, and adapting operation of the distributed virtual switch for one or more groups of the data plane components based on the characteristics. An apparatus and logic are also disclosed herein.

Adaptive infrastructure for distributed virtual switch

A method is provided in one example embodiment that includes detecting a migration of a virtual machine from an origination host to a destination host and comparing a first root bridge to a second root bridge to verify data link layer continuity of the virtual network on the destination host. The virtual machine is connected to a virtual network, the first root bridge is associated with the virtual network on the origination host and the second root bridge is associated with the virtual network on the destination host. The method may further include blocking the migration if the first root bridge and the second root bridge are not the same.

VM migration based on matching the root bridge of the virtual network of the origination host and the destination host

An example method is provided and may include multicasting a discovery packet in an overlay network, which includes a Layer 2 scheme over a Layer 3 network; and identifying endpoints based on their respective responses to the discovery packet, where the endpoints are coupled across a multicast backbone. In more specific embodiments, the method may include identifying disconnected endpoints in the overlay network based on a lack of responses from the disconnected endpoints.

System and method for discovering multipoint endpoints in a network environment

A method includes determining an application role in a distributed application in a network environment, generating a role profile for the application role from an interaction pattern, mapping the role profile to a virtual machine (VM), and detecting a security breach of the VM. Determining the application role includes obtaining network traces from the distributed application, and analyzing the network traces to extract the application role. In one embodiment, detection of the security breach includes generating an access control policy for the VM from the role profile, and determining an anomaly in traffic based thereon. In another embodiment, detection of the security breach includes inserting the role profile in a port profile of the VM, generating a small state machine from the role profile, running the small state machine on a port associated with the VM, and inspecting, by the small state machine, an application level traffic at the port.

System and method for monitoring application security in a network environment

A method is provided in one example implementation and includes identifying a plurality of exporters that are authorized to communicate data to a collector on behalf of a secure domain; generating secure credentials for the secure domain; communicating the secure credentials to the collector; and authenticating the exporters using the secure credentials. In more particular implementations, the method can include receiving the secure credentials; receiving certain data that includes identifying information, which further includes an Internet protocol (IP) address of a source associated with the certain data; accepting the certain data if the secure credentials validate the identifying information; and rejecting the certain data if the secure credentials do not validate the identifying information.

Growing community of inventors

Santa Clara, CA, United States of America

Suraj Nellikar