# US 10,313,153 B2 · Adaptive MAC grouping and timeout in EVPN environments using machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,153 B2 - Document ID: US10313153B2 - Status: Granted - Kind: B2 - Application number: 15/443,593 - Filed: 2017-02-27 - Published: 2018-08-30 - Granted: 2019-06-04 - Earliest claimed: 2017-02-27 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Nagendra Kumar Nainar; Carlos M. Pignataro; Alejandro A. Eguiarte Salazar; Rajiv Asati - Web page: https://patentgrep.com/patent/US10313153B2 ## CPC - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a device in a network monitors Ethernet virtual private network (EVPN) traffic in the network for a plurality of media access control (MAC) addresses. The device generates a machine learning-based traffic model for the MAC addresses based on the monitored EVPN traffic. The device determines a timeout for a particular one of the MAC addresses based on traffic predicted by the machine learning-based traffic model for the particular MAC address. The device causes the particular MAC address to be timed out from one or more forwarding tables in the network based on the determined timeout. ## Claims ### Claim 1 A method comprising: monitoring, by a device in a network, Ethernet virtual private network (EVPN) traffic in the network for a plurality of media access control (MAC) addresses; generating, by the device, a machine learning-based traffic model for the MAC addresses based on the monitored EVPN traffic, wherein the machine learning-based traffic model predicts future traffic patterns for a particular one of the MAC addresses; determining, by the device, a timeout for the particular MAC address based on the future traffic patterns predicted by the machine learning-based traffic model for the particular MAC address; and causing, by the device, the particular MAC address to be timed out from one or more forwarding tables in the network based on the determined timeout. ### Claim 2 (depends on 1) The method as in claim 1, further comprising: timing out the particular MAC address from a forwarding table of the device based on the determined timeout. ### Claim 3 (depends on 1) The method as in claim 1, wherein the device comprises a Virtual Extensible LAN (VXLAN) tunnel endpoint (VTEP). ### Claim 4 (depends on 1) The method as in claim 1, wherein causing the particular MAC address to be timed out from one or more forwarding tables in the network comprises: sending, by the device, an indication of the determined timeout to a controller of one or more virtual routers. ### Claim 5 (depends on 1) The method as in claim 1, wherein causing the particular MAC address to be timed out from one or more forwarding tables in the network comprises: sending, by the device, a Border Gateway Protocol (BGP) update in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 6 (depends on 1) The method as in claim 1, wherein causing the particular MAC address to be timed out from one or more forwarding tables in the network comprises: causing, by the device, a Border Gateway Protocol (BGP) update to be sent in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 7 (depends on 1) The method as in claim 1, wherein causing the particular MAC address to be timed out from one or more forwarding tables in the network comprises: causing, by the device, an Intermediate-System-to-Intermediate-System (IS-IS) message to be sent in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 8 (depends on 1) The method as in claim 1, wherein the particular MAC address is associated with a virtual machine (VM) in the network. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute a process; and a memory configured to store the process executable by the processor, the process when executed operable to: monitor Ethernet virtual private network (EVPN) traffic in the network for a plurality of media access control (MAC) addresses; generate a machine learning-based traffic model for the MAC addresses based on the monitored EVPN traffic, wherein the machine learning-based traffic model predicts future traffic patterns for a particular one of the MAC addresses; determine a timeout for the particular MAC address based on the future traffic patterns predicted by the machine learning-based traffic model for the particular MAC address; and cause the particular MAC address to be timed out from one or more forwarding tables in the network based on the determined timeout. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further operable to: time out the particular MAC address from a forwarding table of the device based on the determined timeout. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus comprises a Virtual Extensible LAN (VXLAN) tunnel endpoint (VTEP). ### Claim 12 (depends on 9) The apparatus as in claim 9, wherein the apparatus causes the particular MAC address to be timed out from one or more forwarding tables in the network by: sending an indication of the determined timeout to a controller of one or more virtual routers. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the apparatus causes the particular MAC address to be timed out from one or more forwarding tables in the network by: sending a Border Gateway Protocol (BGP) update in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the apparatus causes the particular MAC address to be timed out from one or more forwarding tables in the network by: causing a Border Gateway Protocol (BGP) update to be sent in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the apparatus causes the particular MAC address to be timed out from one or more forwarding tables in the network by: causing an Intermediate-System-to-Intermediate-System (IS-IS) message to be sent in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the particular MAC address is associated with a virtual machine (VM) in the network. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a network, cause the device to perform a process comprising: monitoring, by the device, Ethernet virtual private network (EVPN) traffic in the network for a plurality of media access control (MAC) addresses; generating, by the device, a machine learning-based traffic model for the MAC addresses based on the monitored EVPN traffic, wherein the machine learning-based traffic model predicts future traffic patterns for a particular one of the MAC addresses; determining, by the device, a timeout for the particular MAC address based on the future traffic patterns predicted by the machine learning-based traffic model for the particular MAC address; and causing, by the device, the particular MAC address to be timed out from one or more forwarding tables in the network based on the determined timeout. ### Claim 18 (depends on 17) The computer-readable medium as in claim 17, wherein causing the particular MAC address to be timed out from one or more forwarding tables in the network comprises: sending, by the device, a Border Gateway Protocol (BGP) update in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 19 (depends on 17) The computer-readable medium as in claim 17, wherein causing the particular MAC address to be timed out from one or more forwarding tables in the network comprises: causing, by the device, a Border Gateway Protocol (BGP) update to be sent in the network that includes an indication of the particular MAC address and the determined timeout for the particular MAC address. ### Claim 20 (depends on 17) The computer-readable medium as in claim 17, wherein the particular MAC address is associated with a virtual machine (VM) in the network.