Embodiments of the present invention relate to a centralized network analytic device, the centralized network analytic device efficiently uses on-chip memory to flexibly perform counting, traffic rate monitoring and flow sampling. The device includes a pool of memory that is shared by all cores and packet processing stages of each core. The counting, the monitoring and the sampling are all defined through software allowing for greater flexibility and efficient analytics in the device. In some embodiments, the device is a network switch.

An activity stream based interaction model is disclosed. To cause a desired application level action to be performed at a remote system, such as automatically retrieving and displaying a document in a viewer or other portion of a user interface at the remote system, a text-based tag, such as a hash tag, is inserted into an activity stream. The activity stream is sent to the remote system, which is configured to respond to the text-based tag by performing, at least in part automatically, the corresponding application level action.

An activity stream based interaction model is disclosed. To cause a desired application level action to be performed at a remote system, such as automatically retrieving and displaying a document in a viewer or other portion of a user interface at the remote system, a text-based tag, such as a hash tag, is inserted into an activity stream. The activity stream is sent to the remote system, which is configured to respond to the text-based tag by performing, at least in part automatically, the corresponding application level action.

Anomalies in network traffic are detected using machine learning. A plurality of machine learning models is employed to determine whether there are anomalies in network traffic of an MPLS (Multiprotocol Label Switching) network that can affect the performance of devices in the network. A first machine learning model is trained on network traffic passed through network tunnels of a plurality of routers in the network. A second machine learning model is trained on router-specific network traffic passed through router-specific network traffic for a subset of the network tunnels associated with a particular router. The first machine learning model is employed to determine a network anomaly, and the second machine learning model is employed to determine a router-specific anomaly. A router error is identified when both a network anomaly and a router-specific anomaly are determined. An indication of the router error is communicated to a computing device.

Anomalies in network traffic are detected using machine learning. A plurality of machine learning models is employed to determine whether there are anomalies in network traffic of an MPLS (Multiprotocol Label Switching) network that can affect the performance of devices in the network. A first machine learning model is trained on network traffic passed through network tunnels of a plurality of routers in the network. A second machine learning model is trained on router-specific network traffic passed through router-specific network traffic for a subset of the network tunnels associated with a particular router. The first machine learning model is employed to determine a network anomaly, and the second machine learning model is employed to determine a router-specific anomaly. A router error is identified when both a network anomaly and a router-specific anomaly are determined. An indication of the router error is communicated to a computing device.

Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

A network node (120), such as a packet marking node, efficiently measures the bitrates of incoming packets on a plurality of timescales (TSs). A throughput-value function (TVF) is then graphed to indicate the throughput-packet value relationship for that TVF. Then, starting from the longest TS and moving towards the shortest TS, the packet marking node determines (88) a distance between the TVFs of different TSs at the measured bitrates. To determine the packet marking, the packet marking node selects a random throughput value between 0 and the bitrate measured on the shortest TS. Depending on how the random value relates to the measured bitrates, a TVF, and the distances to add to the random value, is then selected to determine (92) a packet value (PV) with which to mark the packet. The packet marking node then marks (94) the packet according to the determined PV.

A network node (120), such as a packet marking node, efficiently measures the bitrates of incoming packets on a plurality of timescales (TSs). A throughput-value function (TVF) is then graphed to indicate the throughput-packet value relationship for that TVF. Then, starting from the longest TS and moving towards the shortest TS, the packet marking node determines (88) a distance between the TVFs of different TSs at the measured bitrates. To determine the packet marking, the packet marking node selects a random throughput value between 0 and the bitrate measured on the shortest TS. Depending on how the random value relates to the measured bitrates, a TVF, and the distances to add to the random value, is then selected to determine (92) a packet value (PV) with which to mark the packet. The packet marking node then marks (94) the packet according to the determined PV.

Communication systems may benefit from more accurate information regarding the passage of data through a network. For example, certain wireless communication systems may benefit from throughput guidance based on user plane insight and optional radio channel information. A method can include monitoring the bandwidth available on at least one of a per data bearer, per application or per transmission control protocol flow basis. The method can also include providing throughput guidance to an entity configured to attempt at least one of transmission control protocol or content level optimization. The throughput guidance can be configured to assist the entity in attempting the at least one of the transmission control protocol or content level optimization.