Nicira, Inc.

Frank Guo

Yonggang Wang

Keyong Sun

Liang Li

Zikang Chen

Dousheng Zhao

Lele Zhang

Some embodiments of the invention provide a method for a first security controller that performs security operations on the packets that are transmitted within a network. The method of some embodiments receives a packet from a forwarding element in the network based on a decision made by a security agent that operates along with the forwarding element. When the first security controller stores a security rule for the packet, the method processes the packet according to the stored security rule. When the first security controller does not store a security rule for the packet, the method (i) determines that a second security controller stores a security rule for the packet based on a set of header values of the packet, and (ii) sends the packet to the second security controller for security processing according to the security rule for the packet stored on the second security controller.

Security cluster for performing security check

This application relates generally to logging information, and more particularly to techniques for configuring a software product to have each log call in source code controllable at runtime. The source code can be preprocessed so that individual log calls in the source code can be identified and tracked. Information specifying locations of the log calls can be used to generate a bitmap indicating whether to write log messages (corresponding to the log calls) to a log file. The preprocessed source code can then be compiled into executable code, which can be packaged with the bitmap into an executable product such that the executable code can run based on the bitmap. While the executable code is executing, examples described herein can also allow the bitmap to be updated, allowing control during execution.

Techniques for logging information

Aspects of the present disclosure provide a method for processing address resolution protocol (ARP) packets in a computing environment. The method includes the steps of maintaining a table mapping internet protocol (IP) addresses to port identifiers (port IDs), receiving a packet, determining a type of the received packet, based on the type of the received packet being a first type, checking whether a destination IP address in the received packet matches an entry in the table, and if the destination IP address in the received packet matches an entry in the table: determining a port ID associated with the matching entry, and forwarding the received packet over a port associated with the determined port ID.

Suppressing ARP broadcasting in a hypervisor

Distributed network security controller cluster for performing security operations

Some embodiments of the invention provide a method that performs security operations for packets that are processed by a forwarding element. The method of some embodiments receives, at a security agent operating on a physical machine, a packet from a forwarding element that also operates on the physical machine. The method then determines whether a security rule is stored for the packet at the security agent. When no security rule is stored for the packet, the method transmits the packet to a default security controller of several security controllers that store security rules for a network and process packets according to the stored security rules. When the security rule is stored for the packet, the method processes the packet according to the stored security rule for the packet.

Growing community of inventors

Beijing, China

Frank Guo