International Business Machines Corporation

Katherine Barabash

Rami Cohen

Eran Raichstein

Anna Levin

Liane Lewin-Eytan

Yaniv Ben-Itzhak

Renato John Recio

Benny Rochwerger

Liran Schour

Vinit Jain

Hani Talal Jamjoom

Shriram Rajagopalan

Irit Loy

Yaron Wolfsthal

Eric Richard Kern

Dean Har'el Lorenz

Etai Lev Ran

Alexey Roytman

James W Arendt

Matthew J Sheard

Erez Petrank

Dean Lorenz

Yoav Ossia

William John Vanca

James F Boland, Iv

Sergey Guenender

Dean Har′el Lorenz

Thomas R Parker

Various embodiments are directed to receiving, at a receiving device, a packet from a node in a first network. determining a version identifier for the packet, encoding the version identifier into the packet, and transmitting the packet containing the encoded version identifier to a load balancing device in a second network. The version identifier may be encoded into a destination port field of the packet. The receiving device may be a perimeter network address translation device. The packet is received at the load balancing device, where the version identifier is extracted and a hash of source address information is performed. The version and hash are used to select a back-end device in the second network. The packet is transmitted to the selected back-end device.

In-packet version tagging utilizing a perimeter NAT

Methods, systems and software products for configuring a virtual port for a physical server to support packets transfer between the physical server and other network nodes over a virtual network, comprising transmitting one or more configuration Protocol Data Units (PDU) of an extended Link Layer Data Protocol (LLDP) to a Network Interface Card (NIC) of a physical server connected to a network, the configuration PDU(s) comprising one or more extension Type Length Values (TLV) defining one or more virtual network settings for a virtual network port mapping the physical server in a virtual network. The NIC is configured to deploy the virtual network port to support exchange of packets between the physical server and one or more of a plurality of nodes of the virtual network by processing outgoing and incoming packets according to one or more virtual network virtualization protocols using one or more of the virtual network settings.

Link layer method of configuring a bare-metal server in a virtual network

Machines, systems and methods for managing quality of service (QoS) in a multi-tenant virtualized computing environment, the method comprising: collecting transmission rate statistics associated with data communicated in a virtual network, wherein at least one virtual switch monitors communications initiated by at least a virtual machine (VM) executed on a host machine serviced by the virtual switch; determining, by way of the virtual switch, profile parameters associated with a first communication initiated by the VM belonging to at least a first group, wherein a connection request is submitted by the virtual switch to a traffic controller to assist in establishing the first communication; classifying the connection request for establishing the first communication according to the profile parameters associated with the first communication; determining a first aggregated transmission rate associated with the VM that initiated the first communication based on the classifying.

Bandwidth control in multi-tenant virtual networks

Embodiments of the present communications systems and methods may provide the capability for fast and reliable transitioning between the different versions of the service of the multi-node service deployed in the utility computing system. For example, in an embodiment, a computer-implemented method for data traffic distribution may comprise allocating a plurality of data traffic service network addresses to a load balancer service, wherein each data traffic service network address is associated with a different version of the load balancer service, receiving a plurality of data traffic flows, and distributing each data traffic flow to a version of the load balancer service based on a data traffic service network address of each data traffic flow.

DNS-based in-packet service version tagging

Methods, systems and software program products for configuring a virtual network port for a physical server to support packets transfer between the physical server and other network nodes in a virtual network, comprising transmitting one or more configuration Protocol Data Units (PDU) comprising extension configuration message(s) of a network management protocol to a network circuitry connecting a physical server to a network. One or more of the extension configuration message comprise one or more virtual network settings for a virtual network port mapping the physical server in a virtual network. The network circuitry is configured to deploy the virtual network port to support exchange of packets between the physical server and one or more of a plurality of nodes of the virtual network by encapsulating and de-capsulating outgoing and incoming packets according to one or more virtual network encapsulation protocols using one or more of the virtual network settings.

Network layer method of configuration of a bare-metal server in a virtual network

A method, system and computer program product, the method comprising: in response to receiving a packet from a stream of packets transmitted to a computing platform, determining, based on a meta-data of the packet, whether to capture the packet or avoid capturing thereof, said determining comprising: subject to the meta-data indicating that a sequence number of the packet is within a first range or within a second range, wherein a distance between an end of the first range and a beginning of the second range is at least of a predetermined size, wherein a distance, through a wraparound, between an end of the second range and a beginning of the first range is at least of the predetermined size, thereby a wraparound situation is identifiable within the stream of packets; and in response to determining to capture the packet: capturing the packet; and transmitting the packet to analysis.

Method and system for monitoring communication in a network

A learning-based computer network security system may include a service delivery controller executing on one or more of hardware processors that receives requests for transmitting network flows to one or more destination machines via a communication network. The service delivery controller may group the network flows into one or more similarity groups, and direct the network flows in a particular similarity group to a learning-based security appliance instance designated for the particular similarity group. Based on receiving feedback from the security appliance instance, the service delivery controller may regroup the similarity groups, and/or redirect the network flows, and/or redistribute the training results between the appliances, and/or modify assignment of appliances to similarity groups.

Service delivery controller for learning network security services

Systems and methods for managing mirroring communication between virtual network clients in a distributed overlay virtual network are provided. The method comprises utilization of controlled overlay virtualization infrastructure to facilitate communication between mirrored network clients. The system comprises a source mirrored network client hosted on a first physical port, a target mirrored network client hosted on a second physical port, a first overlay termination point, a second overlay termination point and a network controller. For a set of mirrored network clients, a logical mirror virtual network address is reserved. The controller is extended to contain mapping between the logical mirror network address and a set of virtual network addresses of mirrored clients. The network controller translates the logical mirror virtual network address to a set of destination virtual network addresses of mirrored clients and allows the modified packets to be sent to a set of second virtual network clients.

Application level mirroring in distributed overlay virtual networks

A method includes converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context, and conveying, to the data forwarding devices, the set of network configuration forwarding rules. Upon detecting a change in the dynamic context of the network, the set of network configuration forwarding rules ae updated based on the set of context-aware data forwarding policies and the change in the dynamic context, and the updated set of network configuration forwarding rules are conveyed to the data forwarding devices.

Context-aware network service policy management

Machines, systems and methods for data transmission in a data communications network are provided. The method comprises receiving a data packet for transmission, the data packet having a first header portion and a second header portion, wherein the first header portion comprises an identifier indicating that any information in the first header portion is not to be used; and determining destination information comprising at least a physical address of a destination in the data communications network to which the data packet is to be transmitted based on information included in the second header portion.

Efficient data transmission in an overlay virtualized network

Machines, systems and methods for efficient data communication are provided. The method comprises receiving a data packet to be transmitted to a destination node in a overlay-based communications network, wherein the destination information is included in a virtual header that includes a virtual address of the destination node; determining a physical address of the destination node based on the virtual address of the destination node; replacing the virtual header for the received data packet with a physical header that includes the physical address; and transmitting the data packet over the communications network to a destination host based on the physical address included in the physical header.

Reducing encapsulation overhead in overlay-based networks

Systems and methods for forwarding data packets in a communications network, the method comprising: providing information included in a first portion of a data packet to a network policy unit, in response to a forwarding device receiving a data packet to be forwarded over one or more network routes; forwarding the data packet according to a flow policy, in response to the forwarding device receiving the flow policy from the network policy unit, wherein the flow policy applied to the data packet by the forwarding device is determined by the network policy unit based on the network policy unit performing an analysis of the information included in the first portion of the data packet in view of policy information provided to the network policy unit.

Growing community of inventors

Haifa, Israel

Katherine Barabash