Systems and methods of determining a network performance property in at least one computer network, including: sampling traffic in active communication with the at least one computer network, analyzing the sampled traffic to group communication packets to flows, and predicting at least one network property of the at least one network based on the grouped communication packets and based on at least one traffic parameter in the at least one network, where the at least one traffic parameter is selected from the group consisting of: union of packet streams, intersection of packet streams, and differences of packet streams, and where the predicted at least one network property is selected from the group consisting of: total number of flows, number of flows with a predefined characteristic, number of packets, and volume of packets.

In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) obtains telemetry data from one or more edge devices in the SD-WAN. The service trains, using the telemetry data as training data, a machine learning-based model to predict tunnel failures in the SD-WAN. The service receives feedback from the one or more edge devices regarding failure predictions made by the trained machine learning-based model. The service retrains the machine learning-based model, based on the received feedback.

A stream processing system in a first zone of a telecommunication network may obtain at least one policy for processing trace data of virtual network functions (VNFs) in the first zone, and obtain the trace data of the VNFs from a data distribution platform of the telecommunication network, where the trace data is published in accordance with a topic to the data distribution platform by the VNFs, and where the stream processing system comprises a subscriber to the topic. The first stream processing system may additionally forward at least a first portion of the trace data to a second stream processing system of the telecommunication network in accordance with the at least one policy, where the first portion comprises less than all of the trace data, and where the second stream processing system is for a region of the telecommunication network that includes the first zone and a second zone.

Systems and methods that adaptively model network traffic to predict network capacity utilization and quality of experience into the future. The adaptive model of network traffic may be used to recommend capacity upgrades based on a score expressed in a QoE space.

Some embodiments provide a novel method for dynamically adjusting sampling rates of a middlebox service. In some embodiments, the method is performed by the controller. The method configures the forwarding element to collect samples from packets processed by the forwarding element at a first sampling rate. The method analyzes the samples in order to collect information regarding the packets processed by the forwarding element. Based on the analysis, the method detects a new traffic pattern in the packets processed by the forwarding element. The method then configures the forwarding element to collect samples from packets processed by the forwarding element at a second sampling rate different than the first sampling rate.

Some embodiments provide a novel method for dynamically adjusting sampling rates of a middlebox service. In some embodiments, the method is performed by the controller. The method configures the forwarding element to collect samples from packets processed by the forwarding element at a first sampling rate. The method analyzes the samples in order to collect information regarding the packets processed by the forwarding element. Based on the analysis, the method detects a new traffic pattern in the packets processed by the forwarding element. The method then configures the forwarding element to collect samples from packets processed by the forwarding element at a second sampling rate different than the first sampling rate.

A method of optimizing network traffic visibility resources comprises receiving, by a controller associated with a network traffic visibility system, information indicative of operation of the network traffic visibility system. The method further comprises facilitating, by the controller, control of resources in the network traffic visibility system, according to a configured resource control policy. The facilitating can include providing, by the controller, control signaling to cause maximization of network traffic monitoring fidelity for a plurality of Quality of Service (QoS) classes of network traffic, based on a specified fixed amount of one or more network resources associated with the network traffic visibility system. Alternatively or additionally, the facilitating can include providing, by the controller, control signaling to cause minimization of use of the one or more network resources, based on a specified fixed level of traffic monitoring fidelity associated with the plurality of QoS classes.

A data processing system implements adaptive telemetry sampling by obtaining first telemetry data from a plurality of telemetry data sources, analyzing the first telemetry data to identify a subset of telemetry data sources for which a reduced sampling rate may be implemented, determining a reduced sampling rate for each event type of the plurality of event types, selecting a subset of the event types for which the reduced sampling rate is to be applied, obtaining second telemetry data from the subset of telemetry data sources at the reduced sampling rate associated with each event type of the subset of event types, analyzing the second telemetry data to determine one or more estimated metric values for one or more metrics, and generating a report comprising the one or more estimated metric values and an estimated total cost saving based on an estimated cost saving associated with each event type.

Systems and methods are provided herein for using a network device's software (e.g., programs executed on a CPU) to maintain and export flow data while offloading network resource intensive tasks to the network device's hardware. This may be accomplished by a network device determining whether a new flow should be tracked using only the software table (e.g., table stored only on the CPU) of the network device or whether certain flow tracking tasks (e.g., counting/parsing) can be offloaded to a hardware table (e.g., counter table in a hardware flow cache) of the network device. The network device may use one or more conditions to determine whether the new flow should be tracked using the software table or by both the software and the hardware table. The conditions can relate to the characteristics of the new flow, resource information, prioritization of the new flow, etc.

A method samples a stream of data items. Each data item has an associated timestamp. The method assigns a priority value to each data item. Each data item is represented as a point on a two-dimensional graph whose axes are time and priority. A sliding window covers a predetermined length of time t.sub.span and uses a backward probability decay curve to specify what priority values are included in the sliding window. This defines, for a current time t.sub.c, a current data sample consisting of data items whose timestamps t fall within the time span t.sub.c−t.sub.span≤t≤t.sub.c and have priority values below the decay curve. The data sample is stored in a buffer. The process iteratively moves the sliding window forward by a time increment, creating a provisional data sample. When the size of the provisional data sample is too large or too small, the process scales the decay curve.