Nicira, Inc.

Vmware, Inc.

Jingchun Jason Jiang

Donghai Han

Caixia Jiang

Xi Cheng

Hua Wang

Qiong Wang

Dongrui Mo

Xiaoyan Jin

Jianjun Shen

Zhenyu Gao

Bo Lin

Wenyi Jiang

Wenfeng Liu

Yi Zeng

Dongping Chen

Wei Zhang

Ganesan Chandrashekhar

Qi Wu

Xiao Bi Liang

Feng Pan

Yonggang Wang

Fei Guo

Liang Cui

Ayyappan Veeraiyan

Wenyu Zhang

Ankur Kumar Sharma

Jianwei Ma

Haoran Chen

Benli Ye

Xinyang Liu

Some embodiments of the invention provide a method of migrating a virtual machine (VM) from a first host computer to a second host computer, the first host computer having a first PNIC, the second host computer having a second PNIC, the first and second PNICs for performing at least one of network forwarding operations and middlebox service operations for the VM. At an RDMA client executing on a set of one or more processors of the second PNIC, the method receives a notification from the second host computer indicating a data migration that is performed to migrate the particular VM from the first host computer to the second host computer has started. Based on the notification, at the RDMA client, the method directs an RDMA server executing on the first PNIC to provide networking state data associated with at least one of network forwarding operations and middlebox service operations that the first PNIC performs for the VM. The provided networking state data resides in a memory of the first PNIC that is accessible to the RDMA server.

Live workload migration for hardware offload capable NICs using RDMA

Some embodiments provide a method for performing data traffic monitoring. The method processes a packet through a packet processing pipeline that includes multiple stages. At a filtering stage, the method tags the packet with a set of monitoring actions for subsequent stages to perform on the packet based on a determination that the packet matches a particular filter. For each stage of a set of packet processing stages subsequent to the filtering stage, the method (i) executes any monitoring actions specified for the stage to perform on the packet and (ii) sends the packet to a next stage in the packet processing pipeline.

Tagging packets for monitoring and analysis

An example method of beacon probing in a computing system includes: sending, by cross-host beacon probing (CHBP) software executing in a first host of the computing system, a first beacon probe from a first network interface controller (NIC) of the first host to NICs on a same layer 2 domain as the first NIC, the NICs including a second NIC of the first host and cross-host NICs of at least one host other than the first host; receiving, at the CHBP software through the first NIC, acknowledgements (ACKs) to the first beacon probe from the cross-host NICs; and determining, in response to the first beacon probe, connectivity statuses of the first NIC and the second NIC by the CHBP software based on the ACKs and on whether the second NIC receives the first beacon probe.

Cross host beacon probing in a virtualized computing system

An example method of distributed load balancing in a virtualized computing system includes: configuring, at a logical load balancer, a traffic detector to detect traffic to a virtual internet protocol address (VIP) of an application having a plurality of instances; detecting, at the traffic detector, a first request to the VIP from a client executing in a virtual machine (VM) supported by a hypervisor executing on a first host; sending, by a configuration distributor of the logical load balancer in response to the detecting, a load balancer configuration to a configuration receiver of a local load balancer executing in the hypervisor for configuring the local load balancer to perform load balancing for the VIP at the hypervisor using the load balancer configuration.

Deploying a distributed load balancer in a virtualized computing system

Example methods and systems for validation-based service request handling are described. In one example, a computer system may obtain, from a management entity, configuration information specifying a unicast service address associated with a service node capable of providing a network service. In response to detecting a service request from the virtualized computing instance, the computer system may generate a modified service request that (a) is destined for the unicast service address and (b) includes a validation identifier (ID) associated with the virtualized computing instance. The modified service request may be forwarded towards the service node to cause the service node to perform validation based on the validation ID to determine whether to provide the network service. In response to detecting a service response from the service node, the service response, or a modified service response, may be forwarded towards the virtualized computing instance.

Validation-based service request handling

Some embodiments provide a method for performing data traffic monitoring. For each packet processing stage of a set of packet processing stages in a packet processing pipeline, the method determines whether a packet received by the packet processing pipeline specifies a set of monitoring actions to be performed on the packet. When the packet specifies a set of monitoring action, the method determines whether the monitoring actions in the set are supported by the packet processing stage. The method executes the supported monitoring actions on the packet in addition to processing the packet according to configuration data for the stage.

Performance of traffic monitoring actions

Some embodiments provide a method of aggregating and providing packet metrics collected during a live packet monitoring session performed for packets matching a specified set of characteristics. The method receives, from one or more computing devices that process packets during the live packet monitoring session, multiple metrics associated with a set of packets matching the specified set of characteristics. Metrics associated with each packet in the set are accompanied by a packet identifier (ID) used to tag the packet by an initial computing device that processed the packet. The method uses the accompanying packet IDs to aggregate the received plurality of metrics. The method provides (i) an aggregated set of session metrics for the set of packets matching the specified set of characteristics during the live packet monitoring session and (ii) individual packet metrics using the packet IDs for at least one packet in the set of packets.

Traffic monitoring

Example methods and systems for logical overlay tunnel monitoring are described. One example may involve a first computer system obtaining control information identifying a list of multiple logical overlay tunnels to be monitored, including a first logical overlay tunnel between a first virtual tunnel endpoint (VTEP) and a second VTEP. Based on the control information, a first monitoring agent may configure and inject a probe packet at the first VTEP to cause the first VTEP to perform encapsulation and send an encapsulated probe packet over the first logical overlay tunnel. In response, an encapsulated response packet that includes a response packet may be received from the second monitoring agent over the first logical overlay tunnel. Based on the response packet, a tunnel performance metric associated with the first logical overlay tunnel may be determined.

Logical overlay tunnel monitoring

Example methods are provided for a host to perform packet handling based on a microprocessor architecture configuration that includes a first node and a second node. One example method may comprise detecting, from a virtualized computing instance supported by the host, an egress packet for transmission to a destination via one of multiple physical network interface controllers (PNICs) of the host. The method may also comprise: identifying the first node assigned to the virtualized computing instance and selecting a first PNIC associated with the first node assigned to the virtualized computing instance. The multiple PNICs may include the first PNIC, and a second PNIC associated with the second node. The method may further comprise sending the egress packet to the destination via the first PNIC associated with the first node.

Packet handling based on multiprocessor architecture configuration

Example methods are provided for first host to perform multicast packet handling in a software-defined networking (SDN) environment. The method may comprise: in response to the first host detecting, from a first virtualized computing instance, a request to join a multicast group address, obtaining control information from a network management entity. The control information may include one or more destination addresses associated with one or more second hosts that have joined the multicast group address on behalf of multiple second virtualized computing instances. The method may also comprise: in response to the first host detecting an egress multicast packet that includes an inner header addressed to the multicast group address, generating one or more encapsulated multicast packets based on the control information and sending the one or more encapsulated multicast packets in a unicast manner or multicast manner, or a combination of both.

Multicast packet handling based on control information in software-defined networking (SDN) environment

Example methods are provided for a host to perform multicast packet handling in a logical network. The method comprise in response to detecting a request to join a multicast group address, a hypervisor modifying the request by replacing a first address associated with a virtualized computing instance with a second address associated with the hypervisor; and sending the modified request to join the multicast group address on behalf of the virtualized computing instance. The method may also comprise: in response to detecting an egress multicast packet, the hypervisor encapsulating the egress multicast packet with an outer header that is addressed from the second address to the multicast group address; and sending the encapsulated egress multicast packet via one or more multicast-enabled network devices that are capable of forwarding, based on the outer header, the encapsulated egress multicast packet to one or more destinations that have joined the multicast group address.

Multicast packet handling in logical networks

Some embodiments provide a method for providing a continuous mirroring session between a monitored data compute node (DCN) and a monitoring DCN. The method provides such uninterrupted mirroring session regardless of relocations of the DCNs during the mirroring session. In some embodiments, the method dynamically switches between local mirroring and remote mirroring based on the positions of the monitored DCN and the monitoring DCN. Upon receiving a data message from a port of a forwarding element (i.e., a monitored port), to which a monitored DCN is coupled, the method duplicates the data message. The method then sends the duplicated data message either to a monitoring DCN that executes on the same host machine, or adds particular tunneling data to the duplicated data message and tunnels the duplicated data message to a remote host machine, on which the monitoring DCN executes.

Adaptive data mirroring in virtual networks

A method of mirroring packets in a network. The method assigns an Internet protocol (IP) multicast address to an overlay network for transmitting mirrored packets. The method connects a set of monitoring data compute nodes (DCNs) to the overlay network for receiving the mirrored packets. The method adds the monitoring DCNs to an IP multicast group for the overlay network. The method associates a port of a mirrored DCN to the overlay network for packet mirroring. The method duplicates each packet received or transmitted at the port as a mirrored packet. The method encapsulates each mirrored packet with the IP multicast address of the overlay network. The method transmits each encapsulated packet on the overlay network.

Port mirroring in overlay networks

A method for a hypervisor supported by a source host to implement a port mirroring session in a virtualized computing environment includes receiving a packet passing through a first virtual port supported by the source host, wherein the packet is destined for a destination virtual machine on a destination host. The method also includes based on a first media access control (MAC) address of a first virtual network interface controller (VNIC) associated with a first monitoring virtual machine (VM), obtaining a first IP address associated with a first host that supports the first VNIC and the first monitoring VM, generating a port mirroring packet with the first IP address and a mirrored copy of the packet, wherein the port mirroring packet comprises a first Generic Network Virtualization Encapsulation (Geneve) base header, which includes the first MAC address, and transmitting the port mirroring packet to the first host.

Growing community of inventors

Beijing, China

Jingchun Jason Jiang