Nicira, Inc.

Vmware, Inc.

Justin Pettit

Benjamin L Pfaff

Martin Casado

Teemu Koponen

W Andrew Lambeth

Bruce Davie

Keith Eric Amidon

Daniel J Wendlandt

Jesse Ernest Gross, Iv

Peter J Balland, Iii

Donghai Han

Jianjun Shen

Anupam Chanda

Amar Padmanabhan

Somik Behera

Natasha Gude

Amit Vasant Patil

Prasad Sharad Dabak

Paul Ingram

Vasantha Kumar Dhanasekar

Andy Zhou

Scott J Shenker

Laxmikant Vithal Gunda

Jonathan Stringer

Ethan J Jackson

Jarno Rajahalme

Cheng-Chun Tu

Yi-Hung Wei

Yifeng Sun

Pankaj Thakkar

Ronghua Zhang

Igor Ganichev

Mehak Mahajan

Harold Vinson C Lim

Soner Sevinc

Ben Pfaff

Cheng-Chun Yu

Benjamin Levy Pfaff

Iii Balland Peter J

Peter J Iii Balland

Jesse E Gross Iv

Jesse Gross Iv

Peter Balland

Benjamin Levry Pfaff

Temu Koponen

Peter J Balland Iii

Jesse Gross

Jesse E Iv Gross

Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Inspecting operations of a machine to detect elephant flows

Some embodiments provide a forwarding element that detects and handles elephant flows. In detecting, the forwarding element of some embodiments monitors statistics or measurements relating to a data flow. In handling, the forwarding element marks each packet associated with a detected elephant flow in some manner to differentiate it from a packet associated with a mouse flow. Alternatively, the forwarding element of break elephant flows into a number mouse flow by facilitating in sending packets associated with the detected elephant flow along different paths.

Detecting and handling large flows

Some embodiments provide a method for a forwarding element that receives a packet. The method determines whether the packet matches any flow entries in a first cache that uses a first type of algorithm to identify matching flow entries for packets. When the packet does not match any flow entries in the first cache, the method determines whether the packet matches any flow entries in a second cache that uses a second, different type of algorithm to identify matching flow entries for packets. The method executes a set of actions specified by a flow entry matched by the packet in one of the first and second caches.

Packet classification with multiple classifiers

Some embodiments provide a local network controller that manages a first managed forwarding element (MFE) operating to forward traffic on a host machine for several logical networks and configures the first MFE to forward traffic for a set of containers operating within a container virtual machine (VM) that connects to the first MFE. The local network controller receives, from a centralized network controller, logical network configuration information for a logical network to which the set of containers logically connect. The local network controller receives, from the container VM, a mapping of a tag value used by a second MFE operating on the container VM to a logical forwarding element of the logical network to which the set of containers connect. The local network controller configures the first MFE to apply the logical network configuration information to data messages received from the container VM that are tagged with the tag value.

Logical processing for containers

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Network operating system for managing and securing networks

Some embodiments provide a set of one or more network controllers that communicates with a wide range of devices, ranging from switches to appliances such as firewalls, load balancers, etc. The set of network controllers communicates with such devices to connect them to its managed virtual networks. The set of network controllers can define each virtual network through software switches and/or software appliances. To extend the control beyond software network elements, some embodiments implement a database server on each dedicated hardware. The set of network controllers accesses the database server to send management data. The hardware then translates the management data to connect to a managed virtual network.

Database protocol for exchanging forwarding state with hardware switches

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g, GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

Method and apparatus for implementing and managing virtual switches

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g., GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

A method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE) is provided. The method sends a first packet from the MFE to a connection tracker that stores headers of a set of original direction packets that each established a new connection. The method receives, from the connection tracker, the first packet with the header of an original direction packet associated with the first packet appended to the first packet. The header of the original direction packet includes (i) a second set of IP addresses different than a first set of IP addresses of the first packet and (ii) stateful connection status information. The method replaces a first set of IP addresses of the first packet with the second set of IP addresses and performs a matching operation on the packet based on the second set of IP addresses and the stateful connection status information.

Stateful connection policy filtering

Growing community of inventors

Los Altos Hills, CA, United States of America

Justin Pettit