Vmware, Inc.

Google Inc.

Microsoft Technology Licensing, LLC

Xi Cheng

Caixia Jiang

Qiong Wang

Xiaoyan Jin

Jingchun Jason Jiang

Donghai Han

Haoran Chen

Dongrui Mo

Feng Pan

Neelakantan Sundaresan

Qi Wu

Amir H Hormati

Ming Shu

Mingge Deng

Mingwei Tang

Yonggang Wang

Umar Syed

Xiaoming Wang

Lisa Yin

Jorge Banuelos

Cenzhuo Yao

Kexin Xu

Some embodiments provide a method for performing data traffic monitoring. The method processes a packet through a packet processing pipeline that includes multiple stages. At a filtering stage, the method tags the packet with a set of monitoring actions for subsequent stages to perform on the packet based on a determination that the packet matches a particular filter. For each stage of a set of packet processing stages subsequent to the filtering stage, the method (i) executes any monitoring actions specified for the stage to perform on the packet and (ii) sends the packet to a next stage in the packet processing pipeline.

Tagging packets for monitoring and analysis

An example method of beacon probing in a computing system includes: sending, by cross-host beacon probing (CHBP) software executing in a first host of the computing system, a first beacon probe from a first network interface controller (NIC) of the first host to NICs on a same layer 2 domain as the first NIC, the NICs including a second NIC of the first host and cross-host NICs of at least one host other than the first host; receiving, at the CHBP software through the first NIC, acknowledgements (ACKs) to the first beacon probe from the cross-host NICs; and determining, in response to the first beacon probe, connectivity statuses of the first NIC and the second NIC by the CHBP software based on the ACKs and on whether the second NIC receives the first beacon probe.

Cross host beacon probing in a virtualized computing system

Some embodiments provide a method of identifying packet latency in a software defined datacenter (SDDC) that includes a network and multiple host computers executing multiple machines. At a first host computer, the method identifies and stores (i) multiple time values associated with several packet processing operations performed on a particular packet sent by a first machine executing on the first host computer, and (ii) a time value associated with packet transmission through the SDDC network from the first host computer to a second host computer that is a destination of the particular packet. The method provides the stored time values to a set of one or more controllers to process to identify multiple latencies experienced by multiple packets processed in the SDDC.

Practical overlay network latency measurement in datacenter

Example methods and systems to perform flow cache information update(s) for packet processing are described. In one example, a network element may configure flow cache information specifying a set of actions based on a sequence of stages that is executable during slow-path packet processing. The network element may configure dependency information specifying execution dependence or independence among the set of actions during fast-path packet processing. In response to detecting a configuration change associated with stage(s) from the sequence of stages, the network element may identify first action(s) affected by the configuration change and second action(s) not affected by the configuration change. This way, a granular update may be performed to the flow cache information by updating the at least one first action, but not the at least one second action.

Updating flow cache information for packet processing

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, that creates a machine learning model with k-means clustering. In some implementations, an instruction to create a model is obtained. A data set including geographic data and non-geographic data is received. The data set includes multiple data entries. Geographic centroids are determined from the geographic data. The data set is analyzed to obtain statistics of the data set. Transformed data is generated from the data set, the statistics, and the geographic centroids. A model is generated with the transformed data, the model indicating multiple data groupings.

Creating a machine learning model with k-means clustering

Some embodiments provide a method for performing data traffic monitoring. For each packet processing stage of a set of packet processing stages in a packet processing pipeline, the method determines whether a packet received by the packet processing pipeline specifies a set of monitoring actions to be performed on the packet. When the packet specifies a set of monitoring action, the method determines whether the monitoring actions in the set are supported by the packet processing stage. The method executes the supported monitoring actions on the packet in addition to processing the packet according to configuration data for the stage.

Performance of traffic monitoring actions

A method for time series forecasting includes receiving a time series forecasting query from a user requesting the data processing hardware to perform a plurality of time series forecasts. Each time series forecast is a forecast of future data based on respective current data Simultaneously, for each time series forecast of the plurality of time series forecasts requested by the time series forecasting query, the method includes training a plurality of models for the respective time series forecast. The method also includes determining which model of the plurality of models best fits the respective time series forecast and forecasting the future data based on the determined best fitting model and the respective current data. The method also includes returning, to the user, the forecasted future data for each of the plurality of time series forecasts request by the timer series forecasting query.

Time series forecasting

Some embodiments provide a method of aggregating and providing packet metrics collected during a live packet monitoring session performed for packets matching a specified set of characteristics. The method receives, from one or more computing devices that process packets during the live packet monitoring session, multiple metrics associated with a set of packets matching the specified set of characteristics. Metrics associated with each packet in the set are accompanied by a packet identifier (ID) used to tag the packet by an initial computing device that processed the packet. The method uses the accompanying packet IDs to aggregate the received plurality of metrics. The method provides (i) an aggregated set of session metrics for the set of packets matching the specified set of characteristics during the live packet monitoring session and (ii) individual packet metrics using the packet IDs for at least one packet in the set of packets.

Traffic monitoring

Example methods and systems for logical overlay tunnel monitoring are described. One example may involve a first computer system obtaining control information identifying a list of multiple logical overlay tunnels to be monitored, including a first logical overlay tunnel between a first virtual tunnel endpoint (VTEP) and a second VTEP. Based on the control information, a first monitoring agent may configure and inject a probe packet at the first VTEP to cause the first VTEP to perform encapsulation and send an encapsulated probe packet over the first logical overlay tunnel. In response, an encapsulated response packet that includes a response packet may be received from the second monitoring agent over the first logical overlay tunnel. Based on the response packet, a tunnel performance metric associated with the first logical overlay tunnel may be determined.

Logical overlay tunnel monitoring

Example methods and systems for flow-based latency measurement for logical overlay network traffic are described. In one example, in response to detecting a first inner data packet associated with a packet flow, a first computer system may generate and send a first encapsulated packet via a logical overlay tunnel towards a second computer system. The first encapsulated packet may be generated by encapsulating the first inner data packet with a first outer header that includes first time information associated with the first inner data packet at the first computer system. In response to detecting a second encapsulated packet from the second computer system via the logical overlay tunnel, the first computer system may determine a flow-based latency measurement associated with the packet flow based on the first time information, and second time information identified from a second outer header of the second encapsulated packet.

Flow-based latency measurement for logical overlay network traffic

Some embodiments provide a method of identifying packet latency in a software defined datacenter (SDDC) that includes a network, several host computers executing several machines, and a set of one or more controllers. At the set of controllers, the method o receives, from a set of host computers, (i) a first set of time values associated with multiple packet processing operations performed on packets sent by a set of machines executing on the set of host computers and (ii) a second set of time values associated with packet transmission between host computers through the SDDC network. The method processes the first and second sets of time values to identify a set of latencies experienced by multiple packets processed and transmitted in the SDDC.

A classification machine learning model is trained to predict the likelihood that a software program is likely to have a software bug in the future. The model is based on features from different source code files having changes made to fix a software bug and source code files having changes that were not made for a bug fix. The features include a time-weighted bug density, a time-weighted addition factor, and a time-weighted deletion factor for a source code file and its dependent code, a page rank, and complexity features representing a number of different types of code elements in the source code file.

Growing community of inventors

Beijing, China

Xi Cheng