Nicira, Inc.

Vmware, Inc.

Quova, Inc.

Martin Casado

Teemu Koponen

Pankaj Thakkar

Ronghua Zhang

W Andrew Lambeth

Keith Eric Amidon

Justin Pettit

Daniel J Wendlandt

Jeremy Stribling

Natasha Gude

Amar Padmanabhan

Peter J Balland, Iii

Paul Ingram

Benjamin L Pfaff

Bruce Davie

Jesse Ernest Gross, Iv

Alexander Yip

Timothy L Hinrichs

Pierre-Emmanuel Ettori

Scott J Shenker

Alan Shieh

Michael J Freedman

Mehak Mahajan

Paul Fazzone

Benjamin Levy Pfaff

Peter J Iii Balland

Jesse E Gross Iv

Jesse Gross Iv

Peter Balland

Benjamin Levry Pfaff

Temu Koponen

Peter J Balland Iii

Jesse Gross

Jesse E Iv Gross

A network control system that includes several controllers for managing several switching elements. Each controller includes a network information base (NIB) storage that stores data regarding the switching elements and a secondary storage for facilitating replication of at least a portion of data across the NIB storages of the different controllers. In some embodiments, the primary purpose for one or more of the secondary storage structures is to back up the data in the NIB. In these or other embodiments, one or more of the secondary storage structures serve a purpose other than backing up the data in the NIB. In some embodiments, the NIB is stored in system memory while the system operates for fast access of the NIB records. In some embodiments, one or more of the secondary storage structures are stored on disks which can be slower to access.

Method and apparatus for using a network information base to control a plurality of shared network infrastructure switching elements

Some embodiments provide a forwarding element that detects and handles elephant flows. In detecting, the forwarding element of some embodiments monitors statistics or measurements relating to a data flow. In handling, the forwarding element marks each packet associated with a detected elephant flow in some manner to differentiate it from a packet associated with a mouse flow. Alternatively, the forwarding element of break elephant flows into a number mouse flow by facilitating in sending packets associated with the detected elephant flow along different paths.

Detecting and handling large flows

Some embodiments provide a system that includes a set of network controllers for receiving definitions of first and second logical switching elements. The system includes several managed switching elements. The set of network controllers configure the several managed switching elements to implement the defined first and second logical switching elements. The system includes several network hosts that are each (1) communicatively coupled to one of the several managed switching elements and (2) associated with one of the first and second logical switching elements. Network data communicated between network hosts associated with the first logical switching element are isolated from network data communicated between network hosts associated with the second logical switching element.

Managed switch architectures: software managed switches, hardware managed switches, and heterogeneous managed switches

Some embodiments provide a system for implementing a logical network that includes a set of end machines, a first logical middlebox, and a second logical middlebox connected by a set of logical forwarding elements. The system includes a set of nodes. Each of several nodes includes (i) a virtual machine for implementing an end machine of the logical network, (ii) a managed switching element for implementing the set of logical forwarding elements of the logical network, and (iii) a middlebox element for implementing the first logical middlebox of the logical network. The system includes a physical middlebox appliance for implementing the second logical middlebox.

Architecture of networks with middleboxes

Some embodiments provide a method for configuring a logical middlebox in a hosting system that includes a set of nodes. The logical middlebox is part of a logical network that includes a set of logical forwarding elements that connect a set of end machines. The method receives a set of configuration data for the logical middlebox. The method uses a stored set of tables describing physical locations of the end machines to identify a set of nodes at which to implement the logical middlebox. The method provides the logical middlebox configuration for distribution to the identified nodes.

Network control system for configuring middleboxes

A method for managing a managed forwarding element (MFE) that forwards data in a network. A network controller publishes, to the MFE, a first set of data for configuring the MFE to perform a set of forwarding operations. The network controller collects, from the MFE, a second set of data regarding current operational state of the MFE. The network controller identifies a difference between a desired operational state of the MFE maintained by the network controller and the collected current operational state of the MFE. Based on the identified difference, the network controller publishes a new third set of data for configuring the MFE to adjust the current operational state of the MFE to the desired state.

Distributed network control system with one master controller per logical datapath set

For a network control system that receives, from a user, logical datapath sets that logically express desired forwarding behaviors that are to be implemented by a set of managed switching elements, a controller for managing several managed switching elements that forward data in a network that includes the managed switching elements is described. The controller includes a set of modules for detecting a change in one or more managed switching elements and for updating logical datapath set based on the detected change. The logical datapath set is for subsequent translation into a set of physical forwarding behaviors of the managed switching elements.

Network control apparatus and method for populating logical datapath sets

A control system including several controllers for managing several switching elements. A first controller registers a second controller for receiving a notification when a data tuple changes in a network information base (NIB) storage of the first controller that stores data for managing a set of switching elements. The first controller changes the data tuple in the NIB. The first controller sends the notification to the second controller of the change to the data tuple in the NIB. The first and second controllers operate on two different computing devices. Each controller receives logical control plane data for specifying logical datapath sets and converts the logical control plane data to physical control plane data for enabling the switching elements to implement the logical datapath sets.

Method and apparatus for interacting with a network information base in a distributed network control system with multiple controller instances

A network system that includes a first set of network hosts in a first domain and a second set of network hosts in a second domain. Within each of the domains, the system includes several edge switching elements (SEs) that each couple to the network hosts and forward network data to and from the set of network hosts. Within the first domain, the system includes (i) an interior SE that couples to a particular edge SE in order to receive network data for forwarding from the edge SE when the edge SE does not recognize a destination location of the network data and (ii) an interconnection SE that couples to the interior SE, the edge SE, and the second domain through an external network. When the edge SE receives network data with a destination address in the second domain, it forwards the network data directly to the interconnection SE.

Flow generation from second level controller to first level controller to managed switching element

Some embodiments of the invention provide a a method of processing packets associated with a logical switching element implemented by multiple physical switching elements executing on multiple host computers on which multiple machines execute. At a first physical switching element of a first host computer, the method receives a packet from a first machine associated with the logical switching element. For the packet, the method identifies a logical ingress port of the logical switch that is associated with the packet. For the packet, the method also uses the logical ingress port to identify a logical egress port of the logical switch that is associated with the packet. For the packet, the method also uses the logical egress port to identify a physical egress port of the first host computer to use to send the packet along to a second machine associated with the logical egress port. From the identified physical egress port, the method forwards the packet with an encapsulating header that stores the logical egress port.

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Network operating system for managing and securing networks

Some embodiments provide a method that processes network data through a network. The method receives a packet destined for a network host associated with a logical datapath set implemented by a set of managed edge switching elements and a set of managed non-edge switching elements in the network. The method determines whether the packet is a known packet. When the packet is a known packet, the method forwards the packet to a managed switching element in the set of managed edge switching elements for forwarding to the network host. When the packet is not a known packet, the method forwards the packet to a managed switching element in the set of managed non-edge switching elements for further processing.

Packet processing for logical datapath sets

A method of implementing a logical switching element. The method generates data for programming a set of two or more physical forwarding elements to implement the logical switching element. The method uses a first controller to distribute at least a first portion of the generated data to a first plurality of physical forwarding elements in the set of physical forwarding elements. The first controller serves as the master controller for the first plurality of physical forwarding elements. The method uses a second controller to distribute at least a second portion of the generated data to a second plurality of physical forwarding elements in the set of physical forwarding elements. The second controller serves as the master controller for the second plurality of physical forwarding elements.

Growing community of inventors

Portola Valley, CA, United States of America

Martin Casado