US 11,870,649 B2
Multi-access edge computing based visibility network
Shubharanjan Dasgupta, Bangalore (IN); Mythil Raman, San Jose, CA (US); Prasanna Kumar Acharya, Bangalore (IN); Ram Gopal Singh, Bangalore (IN); and Pranesh Kulkarni, Bangalore (IN)
Assigned to Extreme Networks, Inc., San Jose, CA (US)
Filed by Extreme Networks, Inc., San Jose, CA (US)
Filed on Feb. 21, 2020, as Appl. No. 16/798,210.
Claims priority of provisional application 62/809,231, filed on Feb. 22, 2019.
Prior Publication US 2020/0274787 A1, Aug. 27, 2020
Int. Cl. H04L 41/0823 (2022.01); H04L 9/06 (2006.01); H04L 47/36 (2022.01); H04L 43/0888 (2022.01); H04L 45/745 (2022.01); H04L 47/24 (2022.01); H04L 47/32 (2022.01); H04L 61/5007 (2022.01); H04L 67/53 (2022.01); H04L 9/00 (2022.01)
CPC H04L 41/0823 (2013.01) [H04L 9/0643 (2013.01); H04L 43/0888 (2013.01); H04L 45/745 (2013.01); H04L 47/24 (2013.01); H04L 47/32 (2013.01); H04L 47/36 (2013.01); H04L 61/5007 (2022.05); H04L 67/53 (2022.05); H04L 9/50 (2022.05)] 20 Claims
OG exemplary drawing
 
1. A method for providing traffic visibility in a network, comprising:
maintaining, by a computing device in communication with a network component, a rule table comprising a first rule with a first plurality of identifiers and a first action for generating a first characteristic relating to a flow of packets, wherein the computing device and the network component are located at an edge of the network;
receiving, by the computing device from the network component, during a first period of time, a copy of a first network packet with a second plurality of identifiers;
determining, by the computing device, that the second plurality of identifiers matches the first plurality of identifiers;
in response to the second plurality of identifiers matching the first plurality of identifiers, performing the first action of the first rule to generate the first characteristic associated with the first period of time, based on the copy of the first network packet;
receiving, by the computing device from the network component, a copy of a second network packet during the first period of time, and determining a predicted baseline of normalcy for a first network parameter during a second period of time based on the copy of the second network packet and the first characteristic associated with the first period of time; and
determining, by the computing device, that a second network parameter associated with the second period of time is an anomaly based on the predicted baseline of normalcy for the first network parameter, wherein the second network parameter is generated from a third packet received during the second period of time.