Nicira, Inc.

Vmware, Inc.

Niciria, Inc.

Akshay Kumar Sreeramoju

Madhusudhan Ravi

Ricardo Koller

Nithin Bangalore Raju

Benjamin C Basler

Santhosh Sundararaman

Alexander Tessmer

Corentin Derbois

Gopakumar Pillai

Some embodiments of the invention provide a method for assigning a data flow-specific identification value to each packet of a data flow. In some embodiments, a particular source endpoint transmits packets belonging to several different data flows to one or more destination endpoints. When sending packets, the source endpoint inserts a unique flow identification value to a particular field of the Internet Protocol (IP) header of each packet of a data flow. The use of these flow identification values enables intermediate network elements and the destination endpoint to efficiently identify to which data flow each packet belongs. In some embodiments, the source endpoint inserts the flow identification value into the 16-bit Internet Protocol version 4 (IPv4) identification field of the IP header of the packets.

Data flow identifiers

Techniques disclosed herein provide an approach for diagnosing problems in a network connection established between applications running on two endpoints. In one embodiment, upon identification of a potential issue in the network connection, a connection detector is triggered in one of the endpoints and requests a kernel of that endpoint to transmit an on-demand, non-invasive packet to the other endpoint. The connection detector then determines whether the application running on the other endpoint is available via the connection based on whether an acknowledgment packet is received from the other endpoint after the transmission of the non-invasive packet.

On-demand connection ping

Some embodiments provide a method for securing communication of data messages of a particular machine that includes a dynamic first level address. The method identifies a fixed second level address for a particular data. The fixed second level address is associated with an interface of the particular machine. Based on the fixed second level address, the method identifies a set of security policies for securing the communication of the particular data message. The method applies the set of security policies to the particular data message.

Security policy selection for machines with dynamic addresses

An example method is provided for a source device to perform discovery of a path maximum transmission unit (PMTU) of a path between the source device and a destination device in a communications network. The method may comprise configuring and sending a request message to the destination device via an intermediate device on the path. The request message may be configured to have a size of an estimated PMTU of the path, to cause a reply message to be received from the destination device or at least one report message to be received from the intermediate device, and to include a flag that allows fragmentation of the request message. The method may further comprise receiving the reply message from the destination device or the at least one report message from the intermediate device responsive to the request message; and based on the reply message or the at least one report message, determining that fragmentation of the request message has occurred because the estimated PMTU is greater than an actual PMTU and updating the estimated PMTU.

Path maximum transmission unit discovery

The congestion notification system of some embodiments sends congestion notification messages from lower layer (e.g., closer to a network) components to higher layer (e.g., closer to a packet sender) components. When the higher layer components receive the congestion notification messages, the higher layer components reduce the sending rate of packets (in some cases the rate is reduced to zero) to allow the lower layer components to lower congestion (i.e., create more space in their queues by sending more data packets along the series of components). In some embodiments, the higher layer components resume full speed sending of packets after a threshold time elapses without further notification of congestion. In other embodiments, the higher layer components resume full speed sending of packets after receiving a message indicating reduced congestion in the lower layers.

Framework for early congestion notification and recovery in a virtualized environment

Example methods are provided to influence path selection during a multipath connection between a first endpoint and a second endpoint. The method may comprise configuring, for a first subflow of a multipath connection, a first set of tuples and establishing, over a network interface of the first endpoint, the first subflow with the second endpoint. The method may further comprise configuring, for a second subflow of the multipath connection, a second set of tuples based a path selection algorithm learned by the first endpoint; and establishing the second subflow with the second endpoint. The method may further comprise sending first packets having the first set of tuples on the first subflow and second packets having the second set of tuples on the second subflow to the second endpoint via an intermediate device that uses the path selection algorithm.

Influencing path selection during a multipath connection

Example methods are provided for a first endpoint to transfer a first data set and a second data set to a second endpoint using a multipath connection. The method may comprise detecting the first data set and the second data set from an application executing on the first endpoint for transfer to the second endpoint. The method may comprise, in response to determination that in-order transfer is not required for the first data set and the second data set, establishing a first subflow of a multipath connection with the second endpoint to send the first data set and establishing a second subflow of the multipath connection to send the second data set. The method may further comprise sending the first data set on the first subflow and the second data set on the second subflow to the second endpoint.

Transferring multiple data sets using a multipath connection

Example methods are provided to perform data transfer between a first endpoint and a second endpoint. The method may comprise detecting an elephant flow of data from an application executing on the first endpoint for transfer to the second endpoint; and splitting the elephant flow to obtain first packets and second packets. The first endpoint may have cognizance of a first path and a second path between a first network interface of the first endpoint and a second network interface of the second endpoint. The method may comprise establishing a first subflow and a second subflow of a multipath connection with the second endpoint; and sending, over the first network interface, the first packets on the first subflow and the second packets on the second subflow to the second network interface.

Data transfer between endpoints using a multipath connection

Techniques disclosed herein provide an approach for providing throughput resilience during link failover when links are aggregated in a link aggregation group (LAG). In one embodiment, failure of a link in the LAG may be detected, and a Transmission Control Protocol/Interact Protocol (TCP/IP) stack notified to ignore packet losses and not perform network congestion avoidance procedure(s) for one round-trip timeout (RTO) period. In a virtualized system in particular, a virtual switch may be configured to generate events in response to detected link failures and notify TCP/IP stacks of a hypervisor and/or virtual machines (VMs) of the link failures. In turn, the notified TCP/IP stacks of the hypervisor and/or VMs may ignore packet losses and not perform network congestion avoidance procedure(s) for one RTO period.

Throughput resilience during link failover

An example method is provided to perform egress network interface selection for a network connection with a second endpoint device. The method may comprise: detecting multiple egress network interfaces of the first endpoint device that are capable of communicating with the second endpoint device via multiple routes, wherein each route involves one of the multiple egress network interfaces; and selecting, from the multiple network egress interfaces, an egress network interface based on multiple maximum transmission unit (MTU) values associated with the multiple routes. The method may further comprise setting a size limit for packets transmitted from the second endpoint device to the first endpoint device during the network connection; configuring a connection establishment packet that includes the size limit to establish the network connection; and sending the connection establishment packet to the second endpoint device via the selected egress network interface.

Network interface selection for network connections

Some embodiments provide a method for reducing congestion in a network stack that includes a series of components that send data packets through the network stack to a network. At a first component of the network stack, the method receives a data packet from a second component of the network stack. The method identifies a usage indicator value for a flow to which the data packet belongs. The usage indicator value is based on a comparison of a size of the flow to a size of a queue for a third component of the network stack. The method determines whether to send the data packet based on a comparison of the usage indicator value to a threshold usage value. The method sends the data packet to a next component of the network stack only when the usage indicator value is less than the threshold usage value.

Reducing network congestion by preferentially dropping packets sent by high-bandwidth sources

Some embodiments of the invention provide a method for assigning a data flow-specific sequential value to each packet of a data flow that is sent from a source endpoint to a destination endpoint in a network. In some embodiments, the source endpoint receives the data flow from a source application while the destination endpoint delivers the data flow to a destination application. The method of some embodiments assigns separate monotonically incrementing values to the packets of each data flow between the same two endpoints by inserting the incremental values into the IPv4 identification field in each packet's IP header. Some embodiments use this sequential value in order to discover any potential error condition in packet transmission. Some embodiments use the IPv4 identification field values to calculate the transmission rate of a data flow at only one observation point.

Flow sequencing

A computer implemented method receives a client request message to initiate a network connection. In response to the client request, the method generates a key to represent the client request. The key is generated independent of information provided in the client request message and is generated to correspond to a desired address in a data structure used to track client request message. The method then enters the generated key at the desired address in the data structure and transmits a response message that includes the key back to the client. The network connection between the client and the computer system is established according to the key.

Growing community of inventors

Hyderabad Telangana, India

Akshay Kumar Sreeramoju