Abstract:
Some embodiments provide a method of aggregating and providing packet metrics collected during a live packet monitoring session performed for packets matching a specified set of characteristics. The method receives, from one or more computing devices that process packets during the live packet monitoring session, multiple metrics associated with a set of packets matching the specified set of characteristics. Metrics associated with each packet in the set are accompanied by a packet identifier (ID) used to tag the packet by an initial computing device that processed the packet. The method uses the accompanying packet IDs to aggregate the received plurality of metrics. The method provides (i) an aggregated set of session metrics for the set of packets matching the specified set of characteristics during the live packet monitoring session and (ii) individual packet metrics using the packet IDs for at least one packet in the set of packets.
Abstract:
Some embodiments provide a method for performing data traffic monitoring. The method processes a packet through a packet processing pipeline that includes multiple stages. At a filtering stage, the method tags the packet with a set of monitoring actions for subsequent stages to perform on the packet based on a determination that the packet matches a particular filter. For each stage of a set of packet processing stages subsequent to the filtering stage, the method (i) executes any monitoring actions specified for the stage to perform on the packet and (ii) sends the packet to a next stage in the packet processing pipeline.
Abstract:
Embodiments perform end-to-end virtual network flow monitoring in a virtual datacenter and provide differentiated views to users based on user role. A target flow pattern describing data packets of interest is distributed to a plurality of applications managing VMs in the virtual datacenter, such as hosts, virtual gateways, and other virtual network applications. Each of the applications monitors data packets routed by the application by comparing the data packets to the flow pattern and selectively collecting context data describing the data packets. The context data collected by the applications is aggregated at a remote server for analysis and reporting.
Abstract:
Some embodiments use proxies on host devices to suppress broadcast traffic in a network. Each host in some embodiments executes one or more virtual machines (VMs). In some embodiments, a proxy operates on each host between each VM and the underlying network. For instance, in some of these embodiments, a VM's proxy operates between the VM and a physical forwarding element executing on the VM's host. The proxy monitors the VM's traffic, and intercepts broadcast packets when it knows how to deal with them. The proxy connects to a set of one or more controllers that provides a directory service that collects and maintains global information of the network. By connecting to the controller cluster, the proxy can obtain information that it can use to resolve broadcast requests. In some embodiments, the connection between the proxy and the controller cluster is encrypted and authenticated, to enhance the security. Also, in some embodiments, the connection is an indirect connection through an agent that executes on the host device and connects the proxies of the host device with the controller cluster.
Abstract:
Some embodiments provide a method for performing data traffic monitoring. The method processes a packet through a packet processing pipeline that includes multiple stages. At a filtering stage, the method tags the packet with a set of monitoring actions for subsequent stages to perform on the packet based on a determination that the packet matches a particular filter. For each stage of a set of packet processing stages subsequent to the filtering stage, the method (i) executes any monitoring actions specified for the stage to perform on the packet and (ii) sends the packet to a next stage in the packet processing pipeline.
Abstract:
Some embodiments of the invention provide a method for processing data messages for routable subnets of a logical network, the logical network implemented by a software-defined network (SDN) and connecting multiple machines. The method receives an inbound data message. The method performs a DNAT (destination network address translation) operation on the received data message to identify a record associated with a destination IP (Internet protocol) address of the data message. From the record, the method identifies a VLAN (virtual local area network) identifier, an LNI (logical network identifier), and a destination host computer IP address for the data message. The method encapsulates the data message with an outer header containing the destination host computer IP address and the VLAN identifier. The method forwards the encapsulated data message to the destination host computer.
Abstract:
Some embodiments provide a method for performing data traffic monitoring. For each packet processing stage of a set of packet processing stages in a packet processing pipeline, the method determines whether a packet received by the packet processing pipeline specifies a set of monitoring actions to be performed on the packet. When the packet specifies a set of monitoring action, the method determines whether the monitoring actions in the set are supported by the packet processing stage. The method executes the supported monitoring actions on the packet in addition to processing the packet according to configuration data for the stage.
Abstract:
Example methods and systems to perform flow cache information update(s) for packet processing are described. In one example, a network element may configure flow cache information specifying a set of actions based on a sequence of stages that is executable during slow-path packet processing. The network element may configure dependency information specifying execution dependence or independence among the set of actions during fast-path packet processing. In response to detecting a configuration change associated with stage(s) from the sequence of stages, the network element may identify first action(s) affected by the configuration change and second action(s) not affected by the configuration change. This way, a granular update may be performed to the flow cache information by updating the at least one first action, but not the at least one second action.
Abstract:
Some embodiments provide a method for performing data traffic monitoring. For each packet processing stage of a set of packet processing stages in a packet processing pipeline, the method determines whether a packet received by the packet processing pipeline specifies a set of monitoring actions to be performed on the packet. When the packet specifies a set of monitoring action, the method determines whether the monitoring actions in the set are supported by the packet processing stage. The method executes the supported monitoring actions on the packet in addition to processing the packet according to configuration data for the stage.
Abstract:
Example methods and systems for flow-based latency measurement for logical overlay network traffic are described. In one example, in response to detecting a first inner data packet associated with a packet flow, a first computer system may generate and send a first encapsulated packet via a logical overlay tunnel towards a second computer system. The first encapsulated packet may be generated by encapsulating the first inner data packet with a first outer header that includes first time information associated with the first inner data packet at the first computer system. In response to detecting a second encapsulated packet from the second computer system via the logical overlay tunnel, the first computer system may determine a flow-based latency measurement associated with the packet flow based on the first time information, and second time information identified from a second outer header of the second encapsulated packet.