# US 10,771,363 B2 · Devices for analyzing and mitigating dropped packets > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,363 B2 - Document ID: US10771363B2 - Status: Granted - Kind: B2 - Application number: 15/994,778 - Filed: 2018-05-31 - Published: 2019-12-05 - Granted: 2020-09-08 - Earliest claimed: 2018-05-31 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Vishnu Pavan Beeram; Devang Patel; Raveendra Torvi - Web page: https://patentgrep.com/patent/US10771363B2 ## CPC - H04L 43/0829: Packet loss - H04L 47/2483: involving identification of individual flows - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/0654: using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) - H04L 45/28: using route fault recovery - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A control device may subscribe to receive data from a network device. The data may be associated with a plurality of packets that have been dropped by the network device and include a first descriptor based on a type of packet drop associated with a packet of the plurality of packets that have been dropped by the network device, and one or more second descriptors based on a packet flow associated with the plurality of packets that have been dropped by the network device. The control device may determine a dropped packet profile associated with the network device, based on the first descriptor and the one or more second descriptors. The control device may generate a first notification based on the dropped packet profile associated with the network device and transmit the first notification to cause an action to be performed based on the first notification. ## Claims ### Claim 1 A method, comprising: subscribing, by a control device, to receive data from a network device based on an occurrence of an event, wherein the event includes a packet being dropped by the network device; receiving, by the control device, the data from the network device based on subscribing to receive the data from the network device and based on the occurrence of the event, wherein the data is associated with a plurality of packets that have been dropped by the network device, wherein the packet is one of the plurality of packets, and wherein the data includes: a first descriptor based on a type of packet drop associated with the packet dropped by the network device, and one or more second descriptors based on a packet flow associated with the plurality of packets dropped by the network device; inputting, by the control device, the first descriptor and the one or more second descriptors into a model; comparing, by the control device and using the model, the first descriptor and the one or more second descriptors; determining, by the control device and based on comparing the first descriptor and the one or more second descriptors, a dropped packet profile associated with the network device; generating, by the control device, a first notification based on the dropped packet profile associated with the network device; and transmitting, by the control device, the first notification to cause an action to be performed based on the first notification. ### Claim 2 (depends on 1) The method of claim 1, wherein the first descriptor indicates whether the type of packet drop is attributed to at least one of a network error, a network outage, a routing error, a policy error, a firewall error, a transmission error, a cable deficiency, a deficiency in hardware, a deficiency in software, a deficiency in binding, a deficiency in packet labeling, or a deficiency in packet encapsulation. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more second descriptors include one or more of a source identifier, a source port identifier, a destination identifier, a destination port identifier, a next hop identifier, or a protocol identifier. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining that additional data is needed based on analyzing the dropped packet profile; querying the network device to obtain the additional data; and receiving the additional data. ### Claim 5 (depends on 4) The method of claim 4, wherein determining that the additional data is needed based on analyzing the dropped packet profile comprises: performing a lookup in a rules repository to determine a type of the additional data that is needed. ### Claim 6 (depends on 4) The method of claim 4, wherein the additional data includes at least one of: a first list of network devices routing the plurality of packets dropped by the network device to the network device, a second list of network devices implementing the packet flow associated with the plurality of packets dropped by the network device, or a third list of network devices inserting labels, headers, or identifiers associated with the plurality of packets dropped by the network device. ### Claim 7 (depends on 6) The method of claim 6, further comprising: correlating the first list of network devices, the second list of network devices, or the third list of network devices and the dropped packet profile to determine a cause for dropping of the plurality of packets dropped by the network device; generating a second notification identifying the cause for the dropping of the plurality of packets dropped by the network device, wherein the second notification includes a corrective action to be performed to address the cause for the dropping of the plurality of packets dropped by the network device; and transmitting the second notification to permit the corrective action to be performed. ### Claim 8 A device, comprising: one or more memories; and one or more processors to: subscribe to receive data from a network device based on an occurrence of an event, wherein the event includes a packet being dropped by the network device; receive, based on the occurrence of the event, the data from the network device, wherein the data is associated with a plurality of packets dropped by the network device, wherein the packet is one of the plurality of packets, and wherein the data includes: a first descriptor based on a type of packet drop associated with one or more of the plurality of packets dropped by the network device, and one or more second descriptors based on a packet flow associated with the plurality of packets dropped by the network device; input the first descriptor and the one or more second descriptors into a model; compare, using the model, the first descriptor and the one or more second descriptors; determine, based on comparing the first descriptor and the one or more second descriptors, a dropped packet profile associated with the network device; analyze the dropped packet profile to determine that additional data is needed; query the network device to obtain the additional data; receive the additional data based on querying the network device; correlate the additional data and the dropped packet profile to determine a cause for dropping of the plurality of packets dropped by the network device; and permit an action to be performed based on the cause for the dropping of the plurality of packets dropped by the network device. ### Claim 9 (depends on 8) The device of claim 8, wherein the first descriptor indicates whether the type of packet drop is attributed to at least one of a network error, a network outage, a routing error, a policy error, a firewall error, a transmission error, a cable deficiency, a deficiency in hardware, a deficiency in software, a deficiency in binding, a deficiency in packet labeling, or a deficiency in packet encapsulation. ### Claim 10 (depends on 8) The device of claim 8, wherein the one or more second descriptors include one or more of a source identifier, a source port identifier, a destination identifier, a destination port identifier, a next hop identifier, or a protocol identifier. ### Claim 11 (depends on 8) The device of claim 8, wherein the additional data includes at least one of: a first list of network devices that routed the plurality of packets dropped by the network device, to the network device, a second list of network devices that implemented the packet flow associated with the plurality of packets dropped by the network device, or a third list of network devices that inserted labels, headers, or identifiers associated with the plurality of packets dropped by the network device. ### Claim 12 (depends on 8) The device of claim 8, wherein the one or more processors are further to: generate a notification identifying the cause for the dropping of the plurality of packets dropped by the network device, wherein the notification includes a corrective action to be performed to address the cause for the dropping of the plurality of packets dropped by the network device; and transmit the notification to cause the corrective action to be performed. ### Claim 13 (depends on 12) The device of claim 12, wherein the corrective action includes disabling or bypassing the network device. ### Claim 14 (depends on 12) The device of claim 12, wherein the corrective action includes identifying a deficient network device and routing traffic to bypass the deficient network device. ### Claim 15 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors, cause the one or more processors to: subscribe to receive data from a network device based on an occurrence of an event, wherein the event includes a packet being dropped by the network device; receive, based on the occurrence of the event, the data from the network device, wherein the data is associated with a plurality of packets dropped by the network device, and wherein the packet is one of a plurality of packets, wherein the data includes: a first descriptor based on a type of packet drop associated with the packet of the plurality of packets dropped by the network device, and one or more second descriptors based on a packet flow associated with the plurality of packets dropped by the network device; input the first descriptor and the one or more second descriptors into a model; compare, using the model, the first descriptor and the one or more second descriptors; determine, based on comparing the first descriptor and the one or more second descriptors, a dropped packet profile associated with the network device; determine that additional data is needed based on analyzing the dropped packet profile; query the network device to obtain the additional data; correlate the additional data and the dropped packet profile to determine a cause for dropping of the plurality of packets dropped by the network device; and cause the network device to perform an action based on the cause for the dropping of the plurality of packets dropped by the network device. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: perform a lookup in a rules repository to determine a type of the additional data that is needed. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: generate a first notification based on the dropped packet profile for the network device; and transmit the first notification to cause a first action to be performed based on the first notification. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: generate a second notification identifying the cause for the dropping of the plurality of packets dropped by the network device, wherein the second notification includes a corrective action to be performed to address the cause for the dropping of the plurality of packets dropped by the network device; and transmit the second notification. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: instruct a network operator device to disable or bypass the network device. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: identify a deficient network device or link; and instruct a network operator device to route traffic to bypass the deficient network device or link.