Network device measurements employing white boxes

Abstract

A system for network device measurements may use a white box to perform measurements that may help determine the likelihood of network anomalies, such as microbursts.

What is claimed is: 
     
         1 . A system comprising:
 one or more processors; and   a memory coupled with the one or more processors, the memory storing executable instructions that when executed by the one or more processors cause the one or more processors to effectuate operations comprising:
 based on received information associated with ingress packets and egress packets of a network device, determining during a period a change in delay between the respective egress packets that match the respective ingress packets; 
 based on the change in delay, determining that a network anomaly occurred; 
 determining that the network anomaly originated from a range of internet protocol (IP) addresses; and 
 based on the determining that the network anomaly originated from the range of IP addresses, sending an indication to take an action, wherein the action comprises rate limiting traffic from the range of IP addresses. 
   
     
     
         2 . The system of  claim 1 , wherein the network anomaly is a microburst network anomaly. 
     
     
         3 . The system of  claim 2 , wherein at least one delay is above 1 millisecond. 
     
     
         4 . The system of  claim 1 , wherein the operations further comprise adjusting a first threshold associated with identifying the network anomaly to a second threshold associated with identifying the network anomaly. 
     
     
         5 . The system of  claim 4 , wherein the adjusting is based on the received information that is associated with the egress packets. 
     
     
         6 . The system of  claim 1 , wherein the determining that the network anomaly has occurred is further based on telemetry information of the ingress packets. 
     
     
         7 . The system of  claim 1 , wherein the received information comprises one or more of packet size, interface utilization, and payload information. 
     
     
         8 . A system comprising:
 one or more processors; and   a memory coupled with the one or more processors, the memory storing executable instructions that when executed by the one or more processors cause the one or more processors to effectuate operations comprising:
 based on received information associated with ingress packets and egress packets of a network device, determining during a period a change in delay between the respective egress packets that match the respective ingress packets; 
 based on the change in delay, determining that a network anomaly occurred; 
 determining that the network anomaly originated from a range of internet protocol (IP) addresses; and 
 based on the determining that the network anomaly originated from the range of IP addresses, sending an indication to take an action to prevent subsequent network anomalies from occurring. 
   
     
     
         9 . The system of  claim 8 , wherein the received information comprises packet size. 
     
     
         10 . The system of  claim 8 , wherein the action comprises deploying a deep buffer when a threshold frequency of the network anomaly has occurred. 
     
     
         11 . The system of  claim 8 , wherein the operations further comprise adjusting a first threshold associated with identifying the network anomaly to a second threshold associated with identifying the network anomaly. 
     
     
         12 . The system of  claim 11 , wherein the adjusting is based on the received information that is associated with the egress packets. 
     
     
         13 . The system of  claim 8 , wherein the determining that the network anomaly has occurred is further based on telemetry information of the ingress packets. 
     
     
         14 . The system of  claim 8 , wherein the received information comprises payload information. 
     
     
         15 . An apparatus comprising:
 a processor; and   a memory coupled with the processor, the memory storing executable instructions that when executed by the processor cause the processor to effectuate operations comprising:
 based on received information associated with ingress packets and egress packets of a network device, determining during a period a change in delay between the respective egress packets that match the respective ingress packets; 
 determining that a microburst network anomaly originated from a range of internet protocol (IP) addresses, wherein determination of an occurrence of the microburst network anomaly is based on the change in delay; and 
 based on the determining that the microburst network anomaly originated from the range of IP addresses, sending an indication to take an action to prevent subsequent microburst network anomalies from occurring. 
   
     
     
         16 . The apparatus of  claim 15 , wherein the apparatus is a white box device. 
     
     
         17 . The apparatus of  claim 15 , wherein the action comprises deploying a deep buffer when a threshold frequency of the microburst network anomaly has occurred. 
     
     
         18 . The apparatus of  claim 15 , wherein the operations further comprise adjusting a first threshold associated with identifying the microburst network anomaly to a second threshold associated with identifying the microburst network anomaly. 
     
     
         19 . The apparatus of  claim 18 , wherein the adjusting is based on the received information that is associated with the egress packets. 
     
     
         20 . The apparatus of  claim 15 , wherein the determination of the occurrence of the microburst network anomaly is further based on telemetry information of the ingress packets.