Microsoft Technology Licensing, LLC

Lihua Yuan

David A Maltz

Albert Gordon Greenberg

Ming Zhang

Guohan Lu

Deepak Bansal

Yongguang Zhang

Parveen Kumar Patel

Haitao Wu

Chuanxiong Guo

Thekkthalackal Varugis Kurien

Kevin T Damour

Gerald Roy Degrace

Jitendra Dattatraya Padhye

Sharad Agarwal

Rishabh Tewari

Xin Wu

Daniel Max Firestone

Thomas Keane

Shachar Raindel

Parvez Anandam

Pradeep Ayyappan Nair

Ramnath Prasad

Geoffrey Hugh Outhred

Ratul Mahajan

Xinyan Zan

Anil K Ruia

Randall Kern

Pradeepkumar Mani

Gerald Roy De Grace

Rohan Gandhi

Daniel Joseph Turner

Chao-Chih Chen

Michal Czeslaw Zygmunt

Yawei Yin

Saurabh Mahajan

Xin Liu

Avijit Gupta

Yibo Zhu

Jamie Dorea Gaudette

Pranjal Shrivastava

Deven Jagasia

Ashok Kumar Nandoori

Sushant Sharma

Vladimir A Shubin

Sheng Lu

Rashid Michael Aga

Sandeep Koushik Sheshadri

Prince Sunny

Shikhar Suri

Sharda Murthi

Percy Fitter

Mark Hennessy

Mohammad Qudeisat

Deepal Jayasinghe

George Chen

Peng Sun

Wok Suk Yoo

Randy Kern

Leiwen Deng

Nan Ge

Kristina E Moore

James Allen Grantham

Tamer Ahmed

Bidirectional flows of a communication session in a software defined network (SDN) are efficiently managed. A smart switch comprises a digital processing unit (DPU) complex comprising one or more DPUs, and a switching complex comprising one or more network processing units (NPUs). The DPU complex is configured to disaggregate enforcement of policies of the SDN from hosts of the SDN. The switching complex is configured to perform network routing of packets in the SDN. The hosts are implemented on servers communicatively coupled to network interfaces of the SDN. The switching complex is configured to perform policy enforcement of data flows for communication sessions that are offloaded from the DPU complex to the switching complex.

Smart switch for offloading high bandwidth flows in a software defined network

Techniques are disclosed for processing data packets and implementing policies in a software defined network (SDN) of a virtual computing environment. At least one network device is configured to disaggregate enforcement of policies of the SDN from hosts of the virtual computing environment. Tier-0 devices are communicatively coupled to network interfaces of the network device. The network device comprises a plurality of data processing units that are configured to implement functionality of the network device.

Disaggregation of TIER1 devices in an SDN using SmartSwitches

An environment includes at least two network devices and a plurality of downstream devices or networks. The downstream devices or networks are communicatively coupled to network interfaces of the network devices using a plurality of data cables. The data cables each comprise a switch device configured to switch communication paths to the coupled network devices. Each of the data cables communicatively couple each of the network devices to one of the plurality of downstream devices or networks so that each of the downstream devices or networks has a communications path to each of the network devices and a switchable communications path from each of the network devices. The network devices do not arbitrate active/passive status via direct communication. Based on data contained in a reply packet indicating that a request packet sent by the first network device was acknowledged, the first network device determines that the first network device is an active network device.

Packet routing with redundant network devices

Techniques are disclosed for processing data packets by a hardware-based networking device configured to disaggregate processing of data packets from hosts of a virtualized computing environment. The hardware-based networking device includes a hardware-based component implementing a plurality of behavioral models indicative of packet processing graphs for data flows in the virtualized computing environment. A data packet having a source from or destination to an endpoint in a virtual network of the virtualized computing environment is received. Based on determining that the data packet is a first packet of a data flow to or from the endpoint, one of the behavioral models is mapped to the data flow. The packet is modified in accordance with the mapped behavioral model. A state of the data flow is stored. Subsequent data packets of the data flow are processed based on the stored state.

Hardware-based packet flow processing

In a rack comprising a group of servers and at least two top-of-rack switches, a link fault is detected. A smart data cable connects each of the servers to both top-of-rack switches. A control signal indicates an active communication path from one of the top-of-rack switches to the servers. In response to detecting a failure of the active communication path, the control signal indicates a switch to the second of the top-of-rack switches. In response to the updated control signal, a switching mechanism of the data cable changes the active communication path to the second of the top-of-rack switches.

Smart cable for redundant ToR's

Techniques are described for balancing traffic load for networks configured in multi-rooted tree topologies, in the presence of link failures. Maximum flows (through minimum cuts) are calculated for subgraphs that incorporate effective link capacities on links between source and destination nodes. Effective link capacities may be determined that take into account link failures, as well as sharing of current available link capacities by multiple nodes. Traffic is balanced while simultaneously fully utilizing available link capacities, even available link capacities on partially failed links (e.g., partially failed Link Aggregation Groups (LAGs)).

Fault tolerant and load balanced routing

Techniques are described for securely managing computing resources in a computing environment comprising a computing service provider and a remote computing network. The remote computing network includes computing and network devices configured to extend computing resources of the computing service provider to remote users of the computing service provider. The network devices include a trusted network device that includes a root of trust. The trusted network device detects that a new device is communicatively coupled to a port on the trusted network device. The trusted network device determines that the new device is not authorized to access computing resources at the remote computing network. The port is isolated at the trusted network device.

Securing network access at edge sites using trusted network devices

In some cases, a network monitoring system may determine an operating or health condition of a node or connection link in a network (e.g., a datacenter network) by preparing an encapsulated data packet according to a tunneling protocol. Depending on a result of routing the encapsulated data packet, the network monitoring system determines whether the node or connection link is functioning normally or is experiencing an issue such as overloading or malfunctioning.

Fine-grained network monitoring

In an environment comprising a group of servers and at least two network devices, a link fault is detected. A data cable connects each of the servers to both network devices. An active communication path from one of the network devices to the servers is determined. In response to detecting a failure of the active communication path, a second of the network devices is indicated as the active network device. The configuration is detected by the network devices based on packets received at the network devices.

Software emulated switching of dual network devices

Techniques for facilitating load balancing in distributed computing systems are disclosed herein. In one embodiment, a method includes receiving, at a destination server, a request packet from a load balancer via the computer network requesting a remote direct memory access ('RDMA') connection between an originating server and one or more other servers selectable by the load balancer. The method can also include configuring, at the destination server, a rule for processing additional packets transmittable to the originating server via the RDMA connection based on the received reply packet. The rule is configured to encapsulate an outgoing packet transmittable to the originating server with an outer header having a destination field containing a network address of the originating server and a source field containing another network address of the destination server.

Load balancing in distributed computing systems

In an optical communications network, the supervisory control signal is duplicating at the OSI layer 2 or layer 3 level to generate a primary supervisory control signal and a secondary supervisory control signal. Access to the primary supervisory control signal is enabled at a network interface of a network device. In response to detecting a failure of the optical communications network or the device, access to the primary supervisory control signal is disabled and access to the secondary supervisory control signal is enabled.

Control plane redundancy for optical networks

SONiC (Software for Open Networking in the Cloud) is instantiated in a chassis-based networking switch device to enable control plane functionality for the line cards and backplane. The SONiC platform may be configured with a routing table and BGP (border gateway protocol) to provide routing capabilities for the application-specific integrated circuits (ASICs) operating on each respective line card. Ethernet ports are utilized within the chassis to enable the utilization of standardized networking protocols, such as protocols on the data link layer (layer 2) within the OSI (Open Systems Interconnection) model. The implementation of SONiC and standardized networking techniques creates a simplified and more proficient routing system in the chassis framework.

Distributed sonic fabric chassis

Remote direct memory access (RDMA) enables access to a memory resource on a computing device without involving the device's CPU (central processing unit). Data packets traversing a NIC (network interface controller/card) on a server in a network are efficiently captured by adapting an ASIC (application-specific circuit) in a programmable TOR (top of rack) switch to modify headers of incoming data packets to indicate to the NIC that the packets are RDMA packets. Such modification enables the packets to be written directly to the server memory while bypassing the server's CPU which can typically act as a bottleneck when attempting full packet capture.

Leveraging remote direct memory access (RDMA) for packet capture

Techniques are disclosed for capturing network traffic in a virtualized computing environment. A packet to be captured in the virtualized environment is identified. The packet is tagged using a pattern of one or more bits in a header of the packet. The pattern indicates that the packet is to be traced. The pattern is propagated to an outer layer during encapsulation of the packet. A header of the encapsulated packet includes the pattern of one or more bits. At least one network device is caused to mirror identified packets based on the reserved bit.

Packet capture via packet tagging

A Top of Rack (TOR) switch operating with a Software for Open Networking in the Cloud (SONiC) platform is implemented using commodity switch hardware and is configured to maintain or retrieve flow state information for incoming data flows in a load balancer. In one embodiment, an application-specific integrated circuit (ASIC) informs a user mode container flow state information for each incoming data flow. The user mode container informs the ASIC of any affected flows that may result pursuant to a modified distributed system (e.g., added, updated, or removed servers). In other embodiments, the ASIC may utilize remote direct memory access (RDMA) to retrieve flow state information maintained by a remote device or may utilize the RDMA to retrieve network address translation (NAT) information for incoming traffic. In each of the implementations, the integrity of the load balancing system is maintained when the distributed system of servers changes.

Hardware load balancer gateway on commodity switch hardware

Growing community of inventors

Redmond, WA, United States of America

Lihua Yuan