Cisco Technology, Inc.

Pensando Systems Inc.

Cisco Systems Inc.

Varagur Chandrasekaran

Maurilio Cometto

Arindam Paul

Murali Basavaiah

Jeevan Madhu Kamisetty

Thomas James Edsall

Silvano Gai

Vipin Jain

Srinivas Pitta

Swaminathan Narayanan

Balakrishnan Raman

Ramesh Sivakolundu

Shrikant Jay Vaidya

Raghavendra J Rao

Allen Hubbe

Urshit Parikh

Dennis Kai-Fat Fong

Dinesh Ganapathy Dutt

Raghava Kodigenahalli Sivaramu

Sachin Jain

Pirabhu Raman

Sanjaya Kumar

Hua Zhong

Venkatesh Srinivasan

Ashok Ganesan

Murty Subba Rama Chandra Kotha

Shrawan Chittoor Surender

Ramkumar Sankar

Valentina Alaria

Naoshad Mehta

Vijay Sampath

Sameer Kittur Subrahmanya

Akshaya Nadahalli

Tuyen Van Quoc

Maruthi Ram Namburu

John Cruz

Srinivas Avasarala

Magesh Sampath Iyengar

Satish Ambati

Giridhar Rajaram

Chandrasekaran Swaminathan

Deep Chand Patel

Tenants in data centers may want access to high precision clocks without having to run their own PTP stacks or reference clocks. Furthermore, different tenants may want their workloads synchronized to their own secured clock domain. PTP, the currently dominant synchronization protocol, allows for only 256 clock domains (CDs). Virtual CDs (vCDs) virtualize the concept of clock domains by maintaining a hardware clock within a host computer, receiving a network clock domain packet that includes a clock domain identifier and an origin timestamp produced by a reference clock, using the network clock domain packet to synchronize the hardware clock to the reference clock, and using the hardware clock to provide a hardware timestamp value to a virtual machine (VM) running on the host computer or to a process running on the host computer, wherein the hardware clock is secured from manipulation by the VM or by the process.

Methods and systems for providing a distributed clock as a service

Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

Methods and systems for distributed high speed state synchronization

Methods and systems for implementing traffic mirroring for network telemetry are disclosed. An embodiment of a method for implementing traffic mirroring for network telemetry involves identifying network traffic at a network appliance that is to be subjected to traffic mirroring for network telemetry, and selecting from available options of transmitting enhanced mirrored network traffic from the network appliance to a collector, wherein the enhanced mirrored network traffic is generated at the network appliance by at least one of compressing and encrypting the network traffic, and transmitting mirrored network traffic from the network appliance to the collector without compressing or encrypting the network traffic.

Methods and systems for implementing traffic mirroring for network telemetry

Inbound packets can be received by a network device that determines a receive pipeline latency metric based on a plurality of receive pipeline residency times of the inbound packets and determines a receive queue latency metric based on a plurality of receive queue residency times of the inbound packets. The receive queue latency metric and the receive pipeline latency metric can be reported to a data collector. The network appliance may also receive a plurality of outbound packets on a transmit queue, determine a transmit queue latency metric based on the transmit queue residency times of the outbound packets, and determine a transmit pipeline latency metric based on the transmit pipeline residency times of the outbound packets. The outbound packets may be transmitted toward their destination. The transmit queue latency metric and the transmit pipeline latency metric can be reported to the data collector.

Methods and systems for queue and pipeline latency metrology in network devices and smart NICs

A network appliance having a control plane and a data plane can process substantially every input packet at wire speed in a programmable packet processing pipeline of the data plane. Sensors, which can be processes implemented within the pipeline, can measure parameters of the network traffic flows and of the network appliance in accordance with monitoring policies. Reporting policies can be triggered when any one of many criteria are met by the parameters. The reporting policy can result in a report being sent to an outside recipient. Alternatively, the reporting policy can result in the network appliance implementing additional monitoring or reporting policies.

Methods and systems for smart sensor implementation within a network appliance data plane

Methods and systems for exporting network information from an exporter to a collector are disclosed. Embodiments of the present technology may include updating a non-key field of a flow entry in a flow cache that corresponds to a flow, setting a field in a context-bitmap of the flow entry in response to updating the non-key field of the flow entry, identifying an export policy using the context-bitmap, and exporting information related to the flow to a collector according to the export policy.

Intelligent export of network information

Control plane analytics and policing may be provided. First, packets that traverse a port may be parsed. Next, based on the parsed packets, metrics for each of a plurality of hosts on a per-protocol basis may be created. The created metrics may then be analyzed and at least one restriction on at least one of the plurality of hosts may be applied based on the analysis.

Control plane analytics and policing

In one example, a security application that interfaces one or more cloud application clients in an enterprise network and one or more cloud applications detects a request made by one of the one or more cloud application clients to access a cloud application. The security application sends one or more prompts to the cloud application for one or more responses reflecting current empirical data obtained from the cloud application. The security application receives, from the cloud application, the one or more responses, and generates an application fingerprint that includes the one or more responses.

Cloud application fingerprint

Methods and apparatus for managing exchanges in a network device of a storage area network are disclosed. In a first 'host-side' exchange initiated by an initiator and between the initiator and the network device, one or more frames are received from an initiator and/or sent to the initiator. At least one of the frames pertains to access of a virtual storage location of a virtual storage unit representing one or more physical storage locations on one or more physical storage units of the storage area network. One or more 'disk-side' exchanges between the network device and one or more targets (i.e., physical storage units) are initiated in response to the first exchange. In the disk-side exchanges, one or more frames are sent from the network device to one of the targets and/or received from the target. Exchange information for the host-side exchange and the associated disk-side exchanges are updated throughout the exchanges.

Methods and apparatus for implementing exchange management for virtualization of storage within a storage area network

In one embodiment, the processing by a packet switching device of a received network-to-link-layer address resolution request message (e.g., Address Resolution Protocol [ARP] Request message, Neighbor Discovery Protocol [NDP] Neighbor Solicitation message) is dependent upon whether or not its target IP address corresponds to a network gateway packet switching device. When the target IP address of a received ARP Request/NDP Neighbor Solicitation message corresponds to a network gateway, then the packet switching device responds effectively on behalf of the network gateway, rather than forwarding the message to the network gateway. When the target IP address of a received ARP Request/NDP Neighbor Solicitation message does not correspond to a network gateway and the Media Access Control (MAC) address corresponding to the target IP address is known, then the packet switching device transforms then sends the broadcast or multicast frame into a unicast frame.

Reducing proliferation of network-to-link-layer address resolution messages

In one embodiment, a method includes receiving at a network device, resource information comprising attributes for compute and storage resources in a network, identifying a need for provisioning a virtual element, and selecting one of the compute and storage resources for use in provisioning the virtual element. Selection of the compute or storage resource includes analyzing the resource information for the compute resources and the storage resources in the network. An apparatus is also disclosed.

Compute and storage provisioning in a cloud environment

Fine granularity exchange level load balancing may be performed in a device in a storage area network in order to ensure that processors in a multi-core environment are not overloaded. This may be accomplished by assigning input/outputs relating to a particular exchange to a specific processor, and maintaining that association so that subsequent related input/outputs are handled by the same processor. In this process, the system may first determine if a received IO is new. If so, then it may assign the IO to a particular data path processor and create a context corresponding to the IO and the processor, as well as to the type of the non-command frame. Subsequently, an event may be received corresponding to the IO, which may then be forwarded to the processor assigned to the IO.

Fine granularity exchange level load balancing in a multiprocessor storage area network

A metric measurement mechanism is used to determine network characteristics such as latency and round trip time with more precision than that available from layer three metric measurement mechanisms. The metric measurement mechanism can use the same architecture used by layer three metric measurement mechanisms while more accurately measuring network latency and isolating network device processing delays.

Methods and apparatus for improved determination of network metrics

In one embodiment, a solution is provided wherein a minimum and/or maximum bandwidth may be guaranteed for specific flows. These guarantees can be associated to various levels of granularity, such as target (T), target-Logical Unit Number (LUN) coupling (TL), initiator-target-LUN coupling (ITL), and initiator-target coupling (IT). This may be accomplished by rate limiting frames in the storage area network based upon quality of service information provided by a user. As such, the traffic can be shaped in a way that guarantees requested levels of service without dropping frames.

Quality of service in a storage area network

Growing community of inventors

Fremont, CA, United States of America

Varagur Chandrasekaran