Abstract:
Techniques are provided for, at an administrative device in a network domain, monitoring a network traffic flow parameter to determine whether a presently applied domain wide policy configured to control a network traffic flow should be removed. In response to determining that the domain wide policy should be removed, a command is generated which causes removal of the domain wide policy at each one of the plurality of network devices, and the command is sent to each one of the plurality of network devices to cause the domain wide policy to be removed at substantially the same time at each network device. Alternatively, the domain wide policy can be automatically removed by the expiry of a timer or in accordance with a timestamp so that the policy is revoked across the network domain without a need for an explicit network wide control message instructing removal of the policy.
Abstract:
System, computer program product, and method to configure an external network based on internal network conditions, by monitoring a load attribute of one or more network flows traversing an ingress port of at least one network element in a software-defined networking (SDN) enabled network, upon determining that the load attribute of a first network element in the SDN enabled network exceeds a predefined threshold, provisioning, by the application, an additional service on the external network, by the application, an additional service on the external network, and extending, by the application, the SDN enabled network to include the additional service on the external network.
Abstract:
Techniques for using Home Addresses, Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to obfuscate server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a Home Address that is mapped to the client device and at least one server IP address of the endpoint device. In this way, IP addresses of servers are obfuscated by a network mapping of the Home Addresses and the server IP addresses. The client device may then communicate data packets to the server using the Home Addresses as the destination address, and a virtual network service that works in conjunction with DNS can encapsulate the data packet with the server IP addresses and forward the data packet onto the server.
Abstract:
Devices, systems, methods, and processes for managing network devices through generated predictions and associated confidence levels are described herein. Networks within a floorplan can be operated at full capacity all day in an inefficient way when not adjusted due to traffic patterns and seasonality changes. Data related to the topology of the network, along with historical data can be utilized to generate predictions of various network needs. For example, the overall network throughput capacity needs may be predicted for a series of points in the future. An associated confidence level can be generated as well including one or more confidence intervals. These can be utilized to select a future need for the network and generate a corresponding sustainable network configuration for the network devices and/or their transceivers that can provide sufficient network needs while minimizing the overall power used. This can be automated over time once trust has been established.
Abstract:
Energy-aware configurations can be utilized to operate a network based on sustainability-related metrics. In many embodiments, a suitable device includes a processor, a memory commutatively coupled to the processor, a plurality of elements, a communication port, and an energy-aware topology logic configured to collect topology data from one or more network devices, wherein each of the one or more network devices include a plurality of elements. The energy-aware topology logic can receive power source data and power usage data related to plurality of elements and generate an element energy coefficient (EEC) for a plurality of elements. Subsequently, the energy-aware topology logic can also generate an energy-aware configuration for at least one of the one or more network devices, and then pass the generated energy-aware configuration to the at least one network device, wherein the energy-aware configuration is configured to steer traffic based on at least one sustainability-related metric.
Abstract:
A method, computer system, and computer program product are provided for performing logging, securing communications, and performing digital forensics tasks based on universal references for hardware and/or software configurations. A universal reference, obtained by a first entity, is included in a request of a second entity, wherein the universal reference identifies one or more components of the second entity using additional universal references assigned to each of the one or more components. It is determined whether the first entity is authorized to receive data from the second entity based on the universal reference. Based on the determining, data is received from the second entity.
Abstract:
An example method for facilitating conflict avoidant traffic routing in a network environment is provided and includes detecting, at a network element, an intent conflict at a peer network element in a network, and changing a forwarding decision at the network element to steer traffic around the conflicted peer network element. The intent conflict refers to an incompatibility between an asserted intent associated with the traffic and an implemented intent associated with the traffic. In specific embodiments, the detecting includes mounting rules from the peer network element into the network element, and analyzing the mounted rules to determine intent conflict. In some embodiments, a central controller in the network deploys one or more intentlets on a plurality of network elements in the network according to corresponding intent deployment parameters.
Abstract:
Techniques are provided by which devices in a network may subscribe to a rapidly changing rules in central threat repository. The policies associated with threats are filtered so that just current attack vectors from within subnets learned via routing and/or forwarding information (at the network level of the network) are installed in the local access control list/policy database of the network devices. As routing changes occur, the list of applied policies are continually refined/revisited and pulled from a central security application. Publish/subscribe mechanisms ensure “zombie” policies are not left over in the device after reboot or routing changes occur.
Abstract:
A method is provided in one example and includes allocating a first queue, allocating at least two default queues, where the at least two default queues depend from the first queue, allocating a plurality of local queues that each depend from one of the at least two defaults queues, receiving data in a data stream, determining a quality of service (QoS) associated with the data, and assigning the data to one of the plurality of local queues based on the determined QoS. In an example, the QoS is a differentiated services code point.
Abstract:
Embodiments described herein use APIs on network devices in a SDN enabled network to monitor the network traffic flowing through the network devices and determine an identity of the client initiating the network traffic. Specifically, the APIs provide a user application with user credentials, IP addresses, MAC addresses, and other identifying information mined from the network flows. Once the identity is found, the application may identify the client's current geographic location. The network devices may continue to monitor the network devices to identify any movement events associated with the client. In response to a movement event, the application may reallocate resources proximate to the new geographic location of the client.