# US 12,764,024 B2 · Identifying network device uplinks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,024 B2 - Document ID: US12764024B2 - Status: Granted - Kind: B2 - Application number: 18/641,665 - Filed: 2024-04-22 - Published: 2025-08-07 - Granted: 2026-10-13 - Earliest claimed: 2024-02-01 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Krishna Mohan Elluru; Suresh Rukmangathan - Web page: https://patentgrep.com/patent/US12764024B2 ## CPC - H04L 41/12: Discovery or management of network topologies - H04L 43/0852: Delays - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A process includes determining, by an uplink identification engine, temporal usages of respective network interfaces of a plurality of network interfaces of a network device. The process includes, based on the temporal usages, identifying, by the uplink identification engine, a plurality of uplink candidates corresponding to respective network interfaces of the plurality of network devices. The process includes classifying, by the uplink identification engine, each uplink candidate as belonging to either a first group that is associated with a data link layer or a second group that is associated with a network layer. The process includes evaluating, by the uplink identification engine, the plurality of uplink candidates based on the respective classifications. The process includes identifying, by the uplink identification engine and based on the evaluation, a given network interface as being an uplink. ## Claims ### Claim 1 A method comprising: receiving, by a central server, network telemetry metrics provided by a network device and logging, by the central server, the network telemetry metrics; responsive to the logging, applying, by an uplink identification engine of the central server, a time series analysis to link states indicated by the network telemetry metrics to determine temporal usages of respective network interfaces of a plurality of network interfaces of the network device; based on the temporal usages, identifying, by the uplink identification engine, a plurality of uplink candidates corresponding to respective network interfaces of the plurality of network devices; classifying, by the uplink identification engine, each uplink candidate of the plurality of uplink candidates as belonging to either a first group associated with a data link layer or a second group associated with a network layer; evaluating, by the uplink identification engine, the plurality of uplink candidates based on the classifying, wherein the evaluating comprises accessing, by the uplink identification engine, the network device; and identifying, by the uplink identification engine and based on the evaluation, a given network interface of the plurality of network interfaces as being an uplink. ### Claim 2 (depends on 1) The method of claim 1, wherein: evaluating the plurality of uplink candidates further comprises determining a score for each uplink candidate of the plurality of uplink candidates; and determining the scores comprises selecting scoring criteria for each uplink candidate of the plurality of uplink candidates based on whether the uplink candidate belongs to the first group or the second group. ### Claim 3 (depends on 2) The method of claim 2, wherein: classifying a given uplink candidate of the plurality of uplink candidates corresponding to the given network interface comprises determining that the given uplink candidate belongs to the first group; and determining the score for the given uplink candidate comprises determining a contribution to the score for the given uplink candidate based on whether the given network interface is part of an uplink virtual area network (VLAN). ### Claim 4 (depends on 2) The method of claim 2, wherein: classifying a given uplink candidate of the plurality of uplink candidates corresponding to the given network interface comprises determining that the given uplink candidate belongs to the first group; and determining the score for the given uplink candidate comprises determining a contribution to the score for the given uplink candidate based on whether the given network interface is associated with a tunnel. ### Claim 5 (depends on 2) The method of claim 2, wherein: the uplink candidates of the plurality of uplink candidates are associated with respective latencies of a plurality latencies; classifying a given uplink candidate of the plurality of uplink candidates corresponding to the given network interface comprises determining that the given uplink candidate belongs to the second group; and determining the score for the given uplink candidate comprises determining a contribution to the score for the given uplink candidate based on a ranking of the latency associated with the given uplink candidate against the remaining latencies of the plurality of latencies. ### Claim 6 (depends on 5) The method of claim 5, wherein determining the score for the given uplink candidate further comprises determining the contribution based on whether the latency associated with the given uplink candidate is within a lowest predetermined number of latencies of the plurality of latencies. ### Claim 7 (depends on 1) The method of claim 1, wherein: evaluating the plurality of uplink candidates further comprises selecting a group of uplink candidates of the plurality of candidates likely to be uplinks; and the group of likely uplink candidates includes the given uplink candidate. ### Claim 8 (depends on 7) The method of claim 7, further comprising: determining, by the uplink identification engine, uplink probabilities for respective uplink candidates of the group of uplink candidates. ### Claim 9 (depends on 1) The method of claim 1, further comprising: responsive to the identification, setting a usage threshold for the given network interface; comparing a usage of the given network interface to the threshold; and selectively generating an alert based on a result of the comparison. ### Claim 10 (depends on 1) The method of claim 1, further comprising: sending, by the uplink identification engine and to an administrative graphical user interface, data representing identification of the given network interface as an uplink. ### Claim 11 (depends on 1) The method of claim 1, wherein the classifying comprising classifying, by the uplink identification engine, a given uplink candidate of the plurality of uplink candidates as belonging to the second group; and the evaluating comprises: accessing, by the uplink identification engine, the network device, to determine a latency associated with a next hop of a routing path between the given uplink candidate and a predetermined destination; ranking, by the uplink identification engine, the latency relative to latencies determined for other uplink candidates of the plurality of uplink candidates; and determining a score for the given uplink candidate, wherein determining the score comprises determining a contribution to the score based on the ranking. ### Claim 12 (depends on 1) The method of claim 1, further comprising: causing, by the uplink identification engine, the network device to execute a traceroute command to send, from the given uplink candidate, a traceroute probe from the given uplink candidate and receive, by the given uplink candidate, a result of the traceroute probe; and determining the latency based on the result.