Nicira, Inc.

Google Inc.

Romain F Lenglet

Jun Xiao

Rajiv Ramanathan

Erik David Gustavson

Some embodiments provide a method that generates different network measurements data (e.g., network topology, bandwidth estimation of different paths, etc.) for a pair of endpoints upon receiving a network administrative request (e.g., an application programming interface (API) request) or by other means (e.g., automatically and without intervention of a user). In some embodiments, the method is implemented by a network measurement agent operating on each endpoint and a centralized service component (e.g., web service layer) executing on a network manager machine (e.g., a controller) that responds to measurement requests. The network measurement agent probes the network periodically (i.e., in certain time intervals) or upon an API request that it receives through the network manager machine to gather the measurement data of a particular network topology between a pair of endpoints.

Periodical generation of network measurement data

A method for expiring tokens includes obtaining a list of valid key identifications (IDs) for at least one valid cryptographic key configured to sign authentication tokens. The method also includes receiving an authentication token from a client authenticating and authorizing the client to access a resource and comprising an ID of a cryptographic key used to sign the authentication token. The method also includes determining whether the cryptographic key used to sign the authentication token is valid based on the list of valid key IDs for the at least one valid cryptographic key. When the cryptographic key used to sign the authentication token is valid, the method includes allowing the client access to the resource.

Security token expiration using signing key rotation

Some embodiments of the invention provide a method for gathering data for logical network traffic analysis by sampling flows of packets forwarded through a logical network. Some embodiments are implemented by a set of network virtualization controllers that, on a shared physical infrastructure, can implement two or more sets of logical forwarding elements that define two or more logical networks. In some embodiments, the method (1) defines an identifier for a logical network probe, (2) associates this identifier with one or more logical observation points in the logical network, and (3) distributes logical probe configuration data, including sample-action flow entry data, to one or more managed forwarding elements that implement the logical processing pipeline at the logical observation points associated with the logical network probe identifier. In some embodiments, the sample-action flow entry data specify the packet flows that the forwarding elements should sample and the percentage of packets within these flows that the forwarding elements should sample.

Logical network traffic analysis

Methods and systems for discovering a path of network traffic that travels from a source host to a destination host are disclosed. A method involves, at the source host, generating probe packets that have the same load balancing parameters as packets of an application that generates application packets for transmission from the source host to the destination host and a path discovery signature comprised of bits from at least one of the network layer header and the transport layer header. The method also involves transmitting the probe packets from the source host to the destination host. In some embodiments, the steps of the method are performed when program instructions contained in a computer-readable storage medium are executed by one or more processors.

Method and system for discovering a path of network traffic

Some embodiments provide a method for measuring network characteristics (e.g., bandwidth estimation, path diversity, etc.) without requiring administrative access to intermediate network elements and independent from the specific network fabric. The method measures the bandwidth (e.g., available bandwidth, capacity, etc.) between a given pair of endpoints (e.g., a source forwarding element and a destination forwarding element at the edges of the network) by identifying the routing paths between the endpoints and calculating the bandwidth for each path in order to estimate the network bandwidth between the endpoints.

Multi-path network bandwidth estimation

Some embodiments provide a method that identifies a network topology that is involved in routing of the network traffic between the endpoints in a pair of endpoints. The identified topology covers (1) all the routing paths (e.g., hardware and software-defined paths) between the endpoints and (2) all the forwarding elements (e.g., hardware and software-defined non-edge forwarding elements) along each path that forwards the network traffic (e.g., network packets). The method identifies, and groups together, the receiving interfaces as well as the forwarding interfaces of each forwarding element along different paths between the endpoints. By doing so, the method can identify a real link between a pair of forwarding elements when a set of forwarding interfaces of each one of the forwarding elements in the pair points to the other forwarding element.

Growing community of inventors

Sunnyvale, CA, United States of America

Romain F Lenglet