Discovering hosts using multicast listener discovery
Patent Information
- Application Number
- CN202280024812.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Priority Date
- 2021-03-26
- Filing Date
- 2022-03-17
- Publication Date
- 2026-10-27
- Estimated Expiration
- 2042-03-17
Smart Images
Figure CN117083843B_ABST
Abstract
Description
[0001] Related applications This application claims priority to U.S. Patent Application No. 17 / 214,163, filed March 26, 2021, the entire contents of which are incorporated herein by reference. Technical Field
[0002] This disclosure generally relates to techniques for discovering silent hosts in a network architecture by sending unicast messages to the silent hosts instead of broadcast messages. Background Technology
[0003] Computer networks are generally groups of computers or other devices that communicate by interconnecting and using a common set of communication protocols to exchange data and / or share resources. One of the main communication protocols is the Internet Protocol (IP), used to create IP networks where computers are assigned unique IP addresses that allow them to send and receive information from each other. However, as IP networks have developed, they have often experienced problems such as network congestion, reduced network performance and speed, decreased network security, increased management burden, and / or other issues. To help address these problems, IP networks are often divided into two or more IP subnets, where computers belonging to the same subnet are addressed using the same most significant bit group in their IP addresses.
[0004] While IP subnets are useful for a variety of purposes, scaling them can be challenging due to the sheer volume of broadcast messages sent by each node within the subnet, leading to scalability, security, and operational issues. For example, broadcast messages are one of the simplest and most common methods for launching denial-of-service (DoS) attacks, a significant security problem. Building multiple IP subnets is one solution to limit the scope of broadcast messages and improve scalability and security. However, multiple subnets can reduce seamless mobility and require the deployment and synchronization of additional services such as multicast DNS (mDNS), default gateway nodes, Dynamic Host Configuration Protocol (DHCP) servers, and so on.
[0005] To help scale subnets and ensure their security, techniques have emerged that divide subnets into multiple pods, which are connected via overlay networks (e.g., Virtual Extensible LAN (VxLAN) overlays) through a Layer 3 (e.g., routing) layer. Encapsulation protocols such as VxLAN are typically used to extend Layer 2 connectivity and provide connectivity between data centers, campus networks, and other physical networks. To avoid the same scalability and security issues as in subnets, these pod solutions rely on using nodes at the edge of the architecture (or "edge nodes") to discover all host addresses within the pod. These edge nodes provide proxy services, allowing a host in one pod to locate a peer host or service in another pod without broadcasting. However, these proxy services are generally limited to locating hosts that have already started sending network traffic in order to discover them in advance. Thus, these techniques may fail when a host attempts to reach a host that has not yet announced its existence by sending network traffic or announcements (or "silent hosts"). Attached Figure Description
[0006] The following detailed description will be provided with reference to the accompanying drawings. In the drawings, the leftmost digit(s) of the reference numeral(s) identifies the drawing in which that numeral(s) first appears. The same reference numerals are used in different drawings to indicate similar or identical items. The systems depicted in the drawings are not to scale, and the components within the drawings may not be depicted to scale relative to each other.
[0007] Figure 1A The diagram illustrates a system architecture in an environment where edge nodes in the network architecture utilize Multicast Listener Discovery (MLD) messages to identify the multicast addresses of silent host nodes within the network architecture. The edge nodes determine that the silent host nodes are not advertising unicast addresses and then use the multicast addresses to forge unicast addresses for the silent host nodes, which are then injected into the network architecture.
[0008] Figure 1B The diagram illustrates a system architecture in an environment where another edge node in the network architecture receives a forged unicast address and uses the forged unicast address to send a unicast message to a silent host node.
[0009] Figure 2 The diagram illustrates a flowchart of an example method by which edge nodes use MLD messages to identify the multicast address of a silent host node in the network architecture. The edge node uses the multicast address to forge a unicast address for the silent host node, which is then injected into the network architecture.
[0010] Figure 3The diagram illustrates a flowchart of an example method by which edge nodes use entries with forged unicast addresses to identify silent host nodes in a network architecture.
[0011] Figure 4 This is a computer architecture diagram, illustrating an example computer architecture for a device capable of executing program components that can be utilized to implement various aspects of the various techniques proposed in this paper. Detailed Implementation
[0012] Overview The independent claims describe various aspects of the invention, and the dependent claims describe preferred features. A feature of one aspect may be applied individually to each aspect or in combination with other aspects.
[0013] This disclosure generally relates to techniques for discovering silent hosts in a network architecture by sending unicast messages to the silent hosts instead of broadcast messages.
[0014] A method described herein includes sending a Multicast Listener Discovery (MLD) query message from a first edge node in a first network architecture to a host node in the first network architecture. The method may further include receiving an MLD report message at the first edge node indicating an Internet Protocol (IP) multicast address associated with the host node, wherein the IP multicast address at least partially corresponds to an IP unicast address of the host node. Furthermore, the method may include determining at the first edge node that the IP unicast address of the host node is not in a routing table associated with the first edge node, and generating a forged IP unicast address for the host node. Generally, the forged IP unicast address at least partially corresponds to the IP multicast address, for example, the three least significant bits of the two addresses correspond. The method may further include sending the forged IP unicast address to a second edge node in a second network architecture or at least one of a mapping system associated with the first and second network architectures.
[0015] In some cases, the method may also include receiving packets from a second edge node in a second network architecture and identifying the destination address of the packets. Furthermore, the method may include determining that the destination address has no entry in the routing table, determining that the destination address at least partially corresponds to a spoofed IP unicast address, and sending the packets to the host node.
[0016] Furthermore, the techniques of this method, as well as any other techniques described herein, can be executed by a system and / or device having a non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors, perform one or more of the methods described above.
[0017] Example Implementation This disclosure generally relates to utilizing multicast listener discovery (MLD) capabilities at edge nodes of a network architecture (e.g., routers, switches, etc.) to receive Solicited-Node multicast addresses (SNMAs) from silent hosts and create unicast addresses for the silent nodes based on the SNMAs. These unicast addresses are used as secondary matches in the network overlay when a primary unicast address lookup fails. The edge node described herein can act as a snooper of MLD reports to identify the SNMAs of silent hosts. The edge node then matches the SNMAs it observes from a specific media-access control (MAC) address of the silent host and forges a unicast address for the silent host that matches at least the last three bytes of the SNMA. The forged unicast address is then presented in the architecture overlay as a unicast MAC / IP mapping. In cases where a primary IP address lookup fails (e.g., no match in the Border Gateway Protocol (BGP) table), the edge node (or other lookup device) performs a secondary lookup that searches for a mapping address with the last three bytes of the IP address. If a mapping with the last three bytes of an IP address is found, the lookup is sent as a unicast message to the matching MAC address in the mapping. In this way, the SNMA of a silent host can be used to forge unicast addresses injected into the network architecture, and these forged unicast addresses can be used to locate silent hosts without sending broadcast messages.
[0018] Generally, the IPv6 protocol requires that when a host generates an IP version 6 (IPv6) address, it must send an MLD report and respond to an MLD query for the SNMA derived from its IPv6 address. Typically, the host's SNMA encoding includes the last three bytes of the IPv6 address and operates within the link scope (e.g., FF02, and the last three bytes of the IPv6 address). However, because collisions of the last three octets are rare, there is generally a one-to-one relationship between the SNMA and the unicast address.
[0019] This disclosure utilizes this approach to create unicast mappings for silent hosts or hosts that have not yet advertised their IPv6 addresses (e.g., are not sending traffic into the network architecture). Generally, edge nodes in a network architecture are responsible for discovering all host addresses within their architecture or equipment room. However, problems arise when silent hosts have not yet advertised their IP addresses within the architecture for edge nodes to discover. This disclosure envisions configuring edge nodes with MLD capabilities, whereby the edge node listens for or snoops on MLD reports from hosts to discover the host's SNMA. In this invention, the edge node matches the SNMA it observes from the host node's MAC address with the binding the edge node has for that MAC address. However, a node with an SNMA but no associated binding represents a silent node that has not yet advertised itself, and for silent nodes, the unicast address is unknown. However, the last three bytes of the silent node's SNMA will match the last three bytes of the silent node's unknown unicast address.
[0020] Therefore, for each SNMA, the edge node can perform a lookup in the matching table to find a matching IPv6 address. However, if no matching IPv6 address is found for the SNMA, the edge node can create a forged unicast address for that node. To create a forged unicast address, the edge node can change the multicast header to a unicast header. As an example, the edge node can change "ff02:ab:cdef" to "ff00::ab:cdef" for a forged unicast address. Generally, for each forged unicast address, the edge node can, for example, change the header "0xFF02" to "0xFCXX", where "XX" is known in the architecture, does not overlap with the unique-local prefix (ULA) used in the architecture, and defaults to zero. In this way, SNMAs are used to create forged ULA unicast addresses that are not advertised outside the Layer 2 architecture and do not conflict with other addresses.
[0021] After generating a forged unicast address for a silent node, the edge node can inject this address into the network architecture, such as through a Locator / ID Separation Protocol (LISP) mapping server (MS) or in an Ethernet VPN (eVPN) or RIFT architecture. Since the SNMA has been mapped to the forged ULA unicast address, existing mechanisms in the overlapping mapping system can function as is under normal operation.
[0022] When a node wants to reach an address owned by a silent node, that address is unknown and unavailable in the eVPN control plane by definition of a silent node. Prior to the techniques described herein, the lookup would fail, and a broadcast operation would be performed, which, as mentioned above, increases congestion and leaves the architecture vulnerable to DoS attacks. However, with the techniques described herein, if the primary lookup fails, the node performing the lookup (e.g., an edge switch, edge, router, etc.) can perform a second lookup on the spoofed unicast address. As a concrete example, suppose "0xabcdef" is the last three octets of the address, and the lookup for the spoofed address might be "fc::ab:cdef".
[0023] If the secondary lookup fails, the edge node may discard the lookup. However, if the secondary lookup succeeds, the identified unicast address belongs to the silent host and is a forged unicast address. In this case, the edge node forwards the unicast to the silent node, and the unicast may be a neighbor solicitation (NS) requesting the silent node to verify that the address belongs to it. If the silent node matches, it will respond with a neighbor acknowledgment (NA), and the edge node will then learn the silent node's actual unicast IP address and inject it into the network architecture (e.g., BGP route advertisement).
[0024] This invention allows the discovery of silent nodes, or nodes in a network architecture that have not yet advertised themselves (e.g., have not yet sent traffic indicating their unicast IP address into the architecture). Unlike methods that require sending broadcast messages to identify nodes, the techniques described herein involve configuring edge nodes (or other nodes managing mapping tables) to snoop on MLD reports and / or send MLD queries to identify the multicast address (e.g., SNMA) of silent nodes. Edge nodes can discover these nodes are silent by creating a forged unicast address using at least the last three bytes of the SNMA and injecting the forged unicast address into the network architecture. The forged unicast IP address can then be used to reach the silent node (using a unicast message), confirm its existence, and ultimately determine the actual unicast IP address without sending a broadcast message.
[0025] Certain implementations and embodiments of this disclosure will now be described more fully below with reference to the accompanying drawings, in which various aspects are illustrated. However, these various aspects may be implemented in many different forms and should not be construed as limited to the implementations described herein. This disclosure covers variations of the embodiments as described herein. Similar numerals always refer to similar elements.
[0026] Figure 1AThe diagram illustrates a system architecture for an environment 100 in which edge nodes in the network architecture utilize Multicast Listener Discovery (MLD) messages to identify the multicast addresses of silent host nodes within the network architecture. The edge nodes determine that the silent host nodes are not advertising unicast addresses and use the multicast addresses to forge unicast addresses for the silent host nodes, which are then injected into the network architecture.
[0027] As shown in the figure, environment 100 includes network architecture 102, which comprises multiple components, devices, and / or nodes that transmit data to each other via interconnecting devices such as switches and routers. Network architecture 102 can be a Layer 2 architecture, a Layer 3 architecture, and / or a combination thereof. Network architecture 102 can be an Ethernet network architecture, including Ethernet switches (e.g., shortest path bridging, transparent interconnection of a large number of links, etc.). In some cases, network architecture 102 can be an IP architecture using Border Gateway Protocol (BGP) and Ethernet Virtual Private Network (eVPN). Network architecture 102 can be used to interconnect resources or devices, such as different data centers, different networks (e.g., different campus networks), and / or other groups of devices.
[0028] As shown in the figure, network architecture 102 can interconnect at least a first network domain 104 and a second network domain 106, wherein the two domains 104 / 106 include packets of devices. In this illustrated example, network architecture 102 can be at least partially a Layer 3 architecture, where devices are assigned IP addresses so that all devices in the network architecture can communicate with each other. In this example, the first network domain 104 and the second network domain 106 can each be a separate IP subnet, or they can each be a separate data center within the same subnet. In either case, a separate IP address is assigned or allocated to each domain 104 / 106 from a given range of IP addresses. For example, each of domains 104 / 106 can be assigned a range of IP addresses from a Classless Inter-Domain Routing (CIDR) block assigned to the IP subnet that includes domains 104 / 106.
[0029] As shown in the figure, the first network domain 104 may include multiple host nodes 108A-108N (where "N" is an integer greater than "0"), such as host node H11 and host node H12. Host nodes can be any type of physical or virtual computer node that has joined the first network domain 104. Additionally, the first network domain 104 may include an edge node 110 (E1), which generally acts as a portal for communication with other nodes in the first network domain 104, and / or a portal for devices attempting to reach other domains (e.g., the second network domain 106). Similarly, the second network domain 106 may include an edge node 112, as well as host nodes 114 (H21) and silent host nodes 116 (H22).
[0030] Generally, host nodes 108, 114, and silent host node 116 can be any type of computing device, such as a desktop computer, laptop or other portable computer, tablet device, e-reader, smartphone, wearable device, or other computing device. In some cases, client device 104 can be an Internet of Things (IoT) device, such as connected appliances, smart home devices, autonomous vehicles or machines, factory equipment, sensors, and / or other IoT devices configured to communicate over one or more networks. In various examples, client device 104 can be various types of networking devices, such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, and / or any other type of computing device capable of running any type of software and / or virtualization technology.
[0031] Edge nodes 110 and 112 typically include nodes that act as portals for communication between host nodes and other devices, and edge nodes 110 and 112 may include or be gateways, hubs, routers, switches, bridges, access points, and / or other types of network communication devices. Generally, edge nodes 110 and 112 may store and maintain routing tables (or mapping tables) that list routes to different network destinations. For devices in the first network domain 104 and the second network domain 106 to communicate with each other, they need to know where to find the devices they want to reach. That is, devices in domain 104 need to know where to send data for a specific IP address, and if that IP address is in the second network domain 104, devices in the first network domain 104 must know the location of the target device.
[0032] Therefore, edge nodes 110 and 112 can each maintain and / or store one or more mapping databases 120 (e.g., routing tables, mapping tables, etc.) that indicate routes to different network endpoints and the IP addresses mapped to those endpoints. For a packet to be sent from one IP address to another, the source device needs a route to the destination device. Edge nodes 110 and 112, serving network domains 104 and 106, will track and advertise lists of addresses within their respective domains 104 / 106. Thus, edge nodes 110 / 112 track what devices are in their respective domains 104 / 106 and periodically or intermittently advertise lists of IP addresses to other interconnected edge nodes.
[0033] Generally, the IPv6 protocol requires host nodes that generate IPv6 addresses to send MLD reports to edge nodes (e.g., routers, switches, etc.) and respond to MLD queries for their SNMA derived from the IPv6 address. The SNMA is encoded with the last three bytes of IPv6 and operates link-wide (e.g., FF02 along with the last three bytes). Because the last three octets of an IP address rarely collide, there is usually a one-to-one relationship between the SNMA and the node's unicast address.
[0034] When a host node creates an IPv6 address, it typically sends traffic at some point, and edge nodes 110 / 112 use this traffic to identify the unicast address of these nodes. However, some nodes do not "advertise" themselves after generating an IPv6 address, or do not send traffic, and are referred to as silent host nodes 116 as described herein. Silent host node 116 is illustrated as a printer in this case, but it could be any type of computing device. Therefore, edge nodes 110 / 112 may not have a MAC entry or mapping for silent host node 116 because the unicast address has not yet been advertised. Consequently, when another host node 108 wants to communicate with silent host node 116, edge nodes 110 / 112 do not know the route to silent host node 116's IP address because there is no mapping in its mapping database(s)120. In this example, edge nodes 110 / 112 could send broadcast messages to locate silent host node 116. However, these broadcast messages increase congestion in network architecture 102 and reduce scalability and security in these deployments.
[0035] According to the techniques described herein, edge nodes 110 / 112 can be configured to utilize MLD capabilities to receive SNMAs from silent host nodes 116 and create forged unicast addresses for silent host nodes 116 based on the SNMAs. If a primary unicast address lookup fails, these forged unicast addresses are used as secondary matches in network coverage. Edge nodes 110 / 112, as described herein, can act as snoopers on MLD reports to identify the SNMAs of silent host nodes 116. Edge nodes 110 / 112 then match the SNMAs they observe from a specific MAC address of silent host nodes 116 and forge unicast addresses for silent host nodes 116 that match at least the last three bytes of the SNMA.
[0036] For example, at "1", edge node 112 can send an MLD report message to silent host node 116. The MLD report message is used by edge node 112 to discover multicast snoops, similar to how the Internet Group Management Protocol (IGMP) is used in IPv4. The MLD report message can be a general query message to find out which multicast addresses are being listened to on the link by silent host node 116, and / or it can be a multicast address-specific query to find out if a specific multicast address is being listened to on the attached link.
[0037] At point "2", the silent host node 116 can send a response to edge node 112 indicating the multicast address (e.g., SNMA) on which the silent host node 116 is listening. In this case, for illustration, the multicast address is "FF02::AA:BBCC". In some cases, the message sent at "2" may simply be the initial MLD report sent by the silent host node 116 when it forms an IPv6 address and sends an MLD report. In other cases, the MLD report message may be sent as a response to an MLD query for the SNMA derived from the IPv6 address. The last three bytes of the sent SNMA are identical to the IPv6 created by the silent host node 116, and edge node 112 can receive the SNMA from the silent host node 116.
[0038] As described above, silent host node 116 has an SNMA but no associated bindings because it has not yet advertised itself, and the unicast address is unknown for silent host node 116. However, the last three bytes of the SNMA of silent host node 116 will match the last three bytes of the unknown unicast address of silent host node 116. Thus, for the received SNMA, edge node 112 can perform a lookup in the matching tables of mapping database(s)120 to find a matching IPv6 address.
[0039] However, if no matching IPv6 address is found for SNMA, edge node 112 can create a forged unicast address for silent host node 116. To create a forged unicast address, edge node 112 can change the multicast header to a unicast header. As an example, edge node 112 can change “ff02:ab:cdef” to “ff00::ab:cdef” for the forged unicast address. Generally, for each forged unicast address, edge node 112 can, for example, change the header “0xFF02” to “0xFCXX”, where “XX” is known in architecture 102, does not overlap with the Unique Local Prefix (ULA) used in architecture 102, and defaults to zero. In this way, SNMA is used to create forged ULA unicast addresses that are not advertised outside the Layer 2 architecture and do not conflict with other addresses.
[0040] After generating a forged unicast address for silent host node 116, edge node 112 can inject the address into network architecture 102 at "3", for example, via LISP MS 118 or in an Ethernet VPN (eVPN) architecture. Since the SNMA has been mapped to the forged ULA unicast address, existing mechanisms in the overlapping mapping system can function as is under normal operation. As shown, a mapping may exist between the MAC address and multicast address (SNMA) of silent host node 116, indicating that silent host node 116 can be reached via edge node 112 (E2).
[0041] Figure 1B The diagram illustrates the system architecture of environment 100, in which edge node 110 in network architecture 102 receives a forged unicast address and uses the forged unicast address to send a unicast message to silent host node 116.
[0042] At point "4", host node 108N can send a request to edge node 110 to look up the address of silent host node 116 (H22). However, in this case where host node 108N wants to reach an address owned by silent host node 116, that address is unknown and unavailable in the eVPN control plane according to the definition of a silent node. As shown at point "5", edge node 110 can perform a lookup (e.g., a primary lookup) on the unicast address of silent host node 116 provided by host node 108N, but in this case, the primary lookup fails.
[0043] Prior to the technique described in this paper, when the primary lookup failed, a broadcast operation was performed, which increased congestion and made the architecture vulnerable to DoS attacks. However, according to the technique described in this paper, if the primary lookup fails, edge node 110 can perform a secondary lookup on the forged unicast address. As a concrete example, suppose "0xabcdef" is the last 3 octets of the address, and the lookup for the forged address might be "fc::ab:cdef". If the secondary lookup fails, edge node 110 can discard the lookup.
[0044] However, if the secondary lookup is successful, the identified unicast address may belong to silent host node 116 and be a forged unicast address. In this case, edge node 110 forwards the unicast to silent host node 116 at "6", and the unicast may be a Neighbor Solicitation (NS) message asking the silent node to verify that the address belongs to it. If silent host node 116 matches, silent host node 116 will respond with a Neighbor Acknowledgment (NA), and edge nodes 110 / 112 will then learn the actual unicast IP address of silent host node 116 and inject it into network architecture 102 (e.g., BGP route advertisement).
[0045] Thus, this invention allows the discovery of silent host node 116, or nodes in the network architecture that have not yet advertised themselves (e.g., have not yet sent traffic indicating their unicast IP address to the architecture). Unlike requiring broadcast messages to identify silent host node 116, the technique described herein involves configuring edge nodes 110 / 112 (or other nodes managing mapping table 120) to snoop on MLD reports and / or send MLD queries to identify the multicast address (e.g., SNMA) of silent host node 116. Edge nodes 110 / 112 can discover that these nodes are silent host node 116, create a forged unicast address using at least the last three bytes of the SNMA, and inject the forged unicast address into network architecture 102. The forged unicast IP address can then be used to reach silent host node 116 (using unicast messages), confirm its existence, and ultimately determine the actual unicast IP address without sending broadcast messages.
[0046] Generally, network architecture 102 may include devices and / or be composed of devices located in or situated in one or more data centers connected by various networks. Network architecture 102 may include one or more networks implemented using any feasible communication technology, such as wired and / or wireless methods and / or technologies. Network architecture 102 may include any combination of Personal Area Network (PAN), Local Area Network (LAN), Campus Area Network (CAN), Metropolitan Area Network (MAN), Extranet, Intranet, Internet, Short-Range Wireless Communication Network (e.g., ZigBee, Bluetooth, etc.), Wide Area Network (WAN)—including centralized and / or distributed—and / or any combination, permutation, and / or aggregation thereof. Network architecture 102 may include devices, virtual resources, or other nodes that transmit packets from one network segment to another through nodes in a computer network. Network architecture 102 may include multiple devices that utilize the network layer (and / or session layer, transport layer, etc.) in the OSI model for packet forwarding and / or utilize other layers. Network architecture 102 may include various hardware devices, such as routers, switches, gateways, smart NICs, NICs, ASICs, FPGAs, servers, and / or any other type of device. Additionally, network architecture 102 may include virtual resources, such as VMs, containers, and / or other virtual resources.
[0047] In some cases, network architecture 102 may include one or more data centers. One or more data centers may be physical facilities or buildings located in various geographic areas, designated for storing networked devices as part of network architecture 102. Data centers may include a variety of networked devices, as well as redundant or backup components and infrastructure for power supply, data communication connectivity, environmental control, and various security equipment. In some examples, data centers may include one or more virtual data centers, which are pools or collections of cloud infrastructure resources specifically designed for enterprise needs and / or the needs of cloud-based service providers. Generally, data centers (physical and / or virtual) can provide basic resources such as processors (CPUs), memory (RAM), storage devices (disks), and networking (bandwidth). However, in some examples, the devices in network architecture 102 may not be located in a explicitly defined data center, but may be located in other locations or buildings.
[0048] Figure 2 and Figure 3 The flowcharts for example methods 200 and 300 are illustrated, and these flowcharts illustrate at least part of the... Figure 1A and1B This document describes various aspects of the functions performed by the devices (e.g., edge node 110, edge node 112, MS / MR 118, etc.) described herein. (References) Figure 1A and 1B The described logical operations can be (1) implemented as a sequence of computer-implemented actions or program modules running on a computing system and / or (2) implemented as interconnected machine logic circuits or circuit modules within the computing system.
[0049] The implementation of the various components described herein depends on the choice of computing system performance and other requirements. Therefore, the logical operations described herein are referred to differently as operations, structural devices, actions, or modules. These operations, structural devices, actions, and modules can be implemented using software, firmware, special-purpose digital logic, and any combination thereof. It should also be understood that it is possible to perform operations that are more complex than... Figure 2 and Figure 3 The operations shown and described herein may be more or fewer. These operations may also be performed in parallel or in a different order than those described herein. Some or all of these operations may also be performed by components other than those specifically identified. While the techniques described in this disclosure are referenced to specific components, in other examples, these techniques may be implemented by fewer components, more components, different components, or components of any configuration.
[0050] In some cases, the steps of methods 200 and 300 may be performed by a device and / or a system of the device, the device and / or the system of the device including one or more processors and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform the operations of methods 200 and 300.
[0051] Figure 2 The diagram illustrates a flowchart of an example method 200 where an edge node uses MLD messages to identify the multicast address of a silent host node in the network architecture. The edge node uses the multicast address to forge a unicast address for the silent host node, which is then injected into the network architecture.
[0052] At 202, edge node 112 may send a multicast listener discovery (MLD) query message to a host node in the first network architecture. For example, edge node 112 may send an MLD query message to a silent host node 116 in network domain 106, wherein the MLD query message includes a request for a multicast address (e.g., SNMA) that the silent host node 116 is listening on.
[0053] At position 204, edge node 112 may receive an MLD report (as a response) message indicating the IP multicast address associated with the host node. For example, edge node 112 may receive the SNMA of silent host node 116 from silent host node 116. The SNMA may at least partially correspond to the IP unicast address of silent host node 116. For example, the last three bytes of the SNMA may match the last three bytes of the IP unicast address of silent host node 116.
[0054] At point 206, edge node 112 can determine that the host node's IP unicast address is not in the routing table associated with the first edge node. For example, edge node 112 can determine that the routing table in mapping database 120 does not include a binding for the unicast IP address of silent host node 116, indicating that silent host node 116 has not yet advertised itself.
[0055] At position 208, edge node 112 can generate a forged IP unicast address to a host node. For example, edge node 112 can generate a forged IP unicast address for a silent host node 116, wherein the forged IP unicast address at least partially corresponds to the IP multicast of the silent host node 116. For example, the forged IP unicast address may have the same last three bytes as the SNMA of the silent host device 116 (or a different number of bytes).
[0056] At 210, edge node 112 can send a spoofed IP unicast address to a second edge node in the second network architecture or to at least one of the mapping systems associated with the first and second network architectures. As an example, edge node 112 can advertise an updated routing table, for example via BGP, including the binding of the MAC address of silent host node 116 to the spoofed IP unicast address. The updated routing table can indicate that silent host node 116 can be reached via a route path sent to edge node 112. As another example, where a software-defined network (SDN) controller performs various control plane operations for network architecture 102, edge node 112 can send updated routing information to the controller associated with network architecture 102. For example, a mapping resolver-mapping server 118 can maintain and distribute an updated mapping database 120 based on information received from various edge nodes in network architecture 102 (e.g., an updated mapping database holding routing / mapping tables). Ultimately, other edge nodes (e.g., edge node 110) can access the updated routing table or information.
[0057] Figure 3 The diagram illustrates a flowchart of an example method 300 for edge nodes to identify silent host nodes in a network architecture using entries with forged unicast addresses.
[0058] At 302, the first edge node 110 can receive packets from the second edge node in the second network architecture. For example, edge node 112 can receive NS messages from edge node 110. At 304, the second edge node can identify the destination address of the packet. For example, edge node 112 can identify the unicast IP address of the packet from the packet header.
[0059] At 306, edge node 112 can determine that the destination address has no entry in the routing table. For example, edge node 112 can determine that there is no binding for the MAC address corresponding to the unicast IP address. In this example, edge node 112 can then perform a second lookup to determine whether the destination device is a silent host node 116.
[0060] At 308, edge node 112 can determine that the destination address at least partially corresponds to a spoofed IP unicast address. For example, edge node 112 can determine that the last three bytes of the destination address correspond to a spoofed IP unicast address of silent host node 116. At 310, edge node 112 can send the packet to silent host node 116.
[0061] Figure 4 An example computer architecture is shown that is capable of executing program components for implementing the functions described above. Figure 4 The illustrated computer architecture depicts any type of computer 400, such as a conventional server computer, workstation, desktop computer, laptop, tablet device, network device, e-reader, smartphone, or other computing device, and can be used to execute any of the software components proposed herein. In some examples, computer 400 may correspond to one or more devices described herein, such as edge node 110, edge node 112, host node 108, silent host node 116, MSMR server 118, and / or any other device described herein, and may include personal devices (e.g., smartphones, tablet devices, wearable devices, laptop devices, etc.), networking devices such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, and / or any other computing device capable of running any type of software and / or virtualization technologies.
[0062] Computer 400 includes a baseboard 402, or "motherboard," which is a printed circuit board to which many components or devices can be connected via a system bus or other electrical communication paths. In an illustrative configuration, one or more central processing units (CPUs) 404 operate in conjunction with a chipset 406. The CPU 404 may be a standard programmable processor that performs the arithmetic and logic operations necessary for the operation of computer 400.
[0063] The CPU 404 performs operations by transitioning from one discrete physical state to the next, where state transitions are achieved by manipulating switching elements that distinguish and change these states. Switching elements typically include electronic circuitry, such as flip-flops, that maintains one of two binary states, and electronic circuitry, such as logic gates, that provides the output state based on a logical combination of the states of one or more other switching elements. These basic switching elements can be combined to create more complex logic circuits, including registers, adder-subtractor units, arithmetic logic units, floating-point units, and so on.
[0064] Chipset 406 provides an interface between CPU 404 and the remaining components and devices on substrate 402. Chipset 406 may provide an interface with RAM 408, which is used as main memory in computer 400. Chipset 406 may further provide an interface with computer-readable storage media, such as read-only memory (ROM) 410 or non-volatile RAM (NVRAM), for storing basic routines that facilitate the startup of computer 400 and the transfer of information between various components and devices. ROM 410 or NVRAM may also store other software components necessary for the operation of computer 400 according to the configuration described herein.
[0065] Computer 400 can operate in a networked environment, using logical connections to remote computing devices and computer systems via a network (e.g., network 424). Chipset 406 may include functionality for providing network connectivity via NIC 412 (e.g., a Gigabit Ethernet adapter). NIC 412 enables computer 400 to connect to other computing devices via network 424. It should be understood that multiple NICs 412 may be present in computer 400 to connect the computer to other types of networks and remote computer systems.
[0066] Computer 400 can be connected to storage device 418, which provides non-volatile storage for the computer. Storage device 418 can store operating system 420, programs 422, and data, which have been described in more detail herein. Storage device 418 can be connected to computer 400 via storage controller 414, which is connected to chipset 406. Storage device 418 can consist of one or more physical storage units. Storage controller 414 can be connected to physical storage units via a serial attached SCSI (SAS) interface, a serial advanced technology attachment (SATA) interface, a fiber channel (FC) interface, or other types of interfaces used for physical connection and data transfer between the computer and physical storage units.
[0067] Computer 400 can store data on storage device 418 by changing the physical state of physical storage units to reflect the stored information. In different embodiments of this specification, the specific changes in physical state can depend on various factors. Examples of such factors include, but are not limited to, the technology used to implement the physical storage units, whether storage device 418 is characterized as primary or secondary storage, etc.
[0068] For example, computer 400 may store information in storage device 418 by issuing instructions via storage controller 414 to change the magnetic properties of a specific location within a disk drive unit, the reflection or refraction properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical medium are possible without departing from the scope and spirit of this specification; the foregoing examples are provided merely for convenience. Computer 400 may further read information from storage device 418 by detecting the physical state or characteristics of one or more specific locations within the physical storage unit.
[0069] In addition to the aforementioned high-capacity storage device 418, computer 400 may also access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. Those skilled in the art will understand that computer-readable storage media are any available medium that provides non-transitory storage of data and is accessible by computer 400. In some examples, operations performed by edge node 110, edge node 112, host node 108, silent host node 116, MSMR server 118, and / or any other device described herein may be supported by one or more devices similar to computer 400. In other words, some or all of the operations performed by edge node 110, edge node 112, host node 108, silent host node 116, MSMR server 118, and / or any other device described herein may be performed by one or more computer devices 400.
[0070] By way of example, and not limitation, computer-readable storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM (EPROM), electrically-erasable programmable ROM (EEPROM), flash memory or other solid-state storage technologies, compact disc ROM (CD-ROM), digital versatile disk (DVD), high-definition DVD (HD-DVD), Blu-ray or other optical storage, cassette tape, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information in a non-transitory manner.
[0071] As briefly mentioned above, storage device 418 may store operating system 420 used to control the operation of computer 400. According to one embodiment, the operating system includes a LINUX operating system. According to another embodiment, the operating system includes a WINDOWS® SERVER operating system from MICROSOFT Corporation of Redmond, Washington. According to yet another embodiment, the operating system may include a UNIX operating system or one of its variants. It should be understood that other operating systems may also be used. Storage device 418 may store other systems, applications, and data used by computer 400.
[0072] In one embodiment, storage device 418 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into computer 400, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the embodiments described herein. As described above, these computer-executable instructions transform computer 400 by specifying how CPU 404 transitions between states. According to one embodiment, computer 400 has access to a computer-readable storage medium storing computer-executable instructions that, when executed by computer 400, perform the above-described... Figure 1A , Figure 1B , Figure 2 and Figure 3 The various processes described herein. The computer 400 may also include a computer-readable storage medium storing instructions for performing any other computer-implemented operations described herein.
[0073] The computer 400 may also include one or more input / output controllers 416 for receiving and processing input from a number of input devices, such as a keyboard, mouse, touchpad, touchscreen, stylus, or other types of input devices. Similarly, the input / output controllers 416 may provide output to a display, such as a computer monitor, flat panel display, digital projector, printer, or other types of output devices.
[0074] As described herein, computer 400 may include one or more of edge node 110, edge node 112, host node 108, silent host node 116, MSMR server 118, and / or any other device described herein. Computer 400 may include one or more hardware processors 404 (processors) configured to execute one or more stored instructions. The processors 404 may include one or more cores. Additionally, computer 400 may include one or more network interfaces configured to provide communication between computer 400 and other devices, such as those described herein as being performed by edge node 110, edge node 112, host node 108, silent host node 116, MSMR server 118, and / or any other device described herein. The network interfaces may include devices configured to couple to a personal area network (PAN), wired and wireless local area network (LAN), wired and wireless wide area network (WAN), etc. For example, the network interface may include a device compatible with Ethernet, Wi-Fi™, etc. Program 422 may include any type of program or process to perform the techniques described in this disclosure.
[0075] In summary, this paper describes a technique that leverages MLD capabilities at the edge nodes of the network architecture to receive SNMAs from silent hosts and create unicast addresses for the silent nodes based on the SNMAs. These unicast addresses are used as secondary matches in the network overlay when the primary unicast address lookup fails. The edge node described in this paper acts as a snooper of MLD reports to identify the SNMAs of silent hosts. The edge node then forges a unicast address for the silent host that matches the last three bytes of the SNMA. The forged unicast address is presented in the architecture overlay as a unicast MAC / IP mapping. In the case of a failed primary IP address lookup, the lookup device performs a secondary lookup for the mapped address with the last three bytes of the IP address. If a mapping is found, the lookup is sent to the matching MAC address as a unicast message.
[0076] Although the invention has been described with reference to specific examples, it should be understood that the scope of the invention is not limited to these specific examples. Since other modifications and variations made to adapt to specific operational requirements and environments will be apparent to those skilled in the art, the invention is not to be considered limited to the examples chosen for disclosure purposes, and covers all changes and modifications that do not constitute a departure from the true spirit and scope of the invention.
[0077] While this application describes embodiments with specific structural features and / or methodological actions, it should be understood that the claims are not necessarily limited to the specific features or actions described. Rather, the specific features and actions merely illustrate some embodiments that fall within the scope of the claims of this application.
Claims
1. A method for discovering hosts in a network architecture, comprising: A multicast listener discovery MLD query message is sent from the first edge node of the first network architecture to the host node in the first network architecture. At the first edge node, an MLD report message indicating an Internet Protocol IP multicast address associated with the host node is received, wherein the IP multicast address at least partially corresponds to the IP unicast address of the host node. At the first edge node, it is determined that the IP unicast address of the host node is not in the routing table associated with the first edge node; A forged IP unicast address is generated for the host node, wherein at least three least significant bytes of the forged IP unicast address match at least three least significant bytes of the IP multicast address; and The forged IP unicast address is sent to a second edge node in the second network architecture or to at least one of the mapping systems associated with the first network architecture and the second network architecture.
2. The method of claim 1, further comprising: Update the routing table at the first edge node to indicate the IP multicast address to the host node; Receive a packet from the host node, wherein the packet indicates the IP unicast address of the host node in the header of the packet; and The routing table is updated at the first edge node to indicate the IP unicast address of the host node.
3. The method of claim 1 or 2, further comprising: At the first edge node, packets are received from the second edge node in the second network architecture; Identify the destination address of the packet; It was determined that the destination address had no entry in the routing table; It is determined that the destination address at least partially corresponds to the forged IP unicast address; and The packet is sent to the host node.
4. The method of claim 1 or 2, further comprising: At the first edge node, it is determined that the routing table does not contain any entries corresponding to the forged IP unicast address. The generation of the forged IP unicast address is performed in response to determining that the routing table does not contain any entries.
5. The method of claim 1 or 2, further comprising: The forged IP unicast address is received from the first edge node at the mapping system; The global mapping database is updated at the mapping system, indicating the route from the first edge node to the host node associated with the forged IP unicast address; The mapping system receives a lookup message from the second edge node, the lookup message including a request for a route to send a data packet to the IP unicast address of the host node; The global mapping database is used to determine that the forged IP unicast address at least partially corresponds to the IP unicast address; and The data packet is sent to the first edge node at least in part because the first edge node serves the host node.
6. The method as described in claim 1 or 2, wherein, The mapping system includes at least one of the following: Locator / ID Separation Protocol LISP Mapping - Server / Mapping Resolver MSMR Server; or Ethernet Virtual Private Network (eVPN) control plane server.
7. A first edge node in the first network architecture, the first edge node comprising: One or more processors; as well as One or more non-transitory computer-readable media storing computer-executable instructions, which, when executed by the one or more processors, cause the one or more processors to perform operations, the operations including: Send a multicast listener discovery MLD query message to the host nodes in the first network architecture; Receive an MLD report message indicating an Internet Protocol IP multicast address associated with the host node, wherein the IP multicast address at least partially corresponds to the IP unicast address of the host node; It is determined that the IP unicast address of the host node is not in the routing table associated with the first edge node; A forged IP unicast address is generated for the host node, wherein at least three least significant bytes of the forged IP unicast address match at least three least significant bytes of the IP multicast address; and The forged IP unicast address is sent to a second edge node in the second network architecture or to at least one of the mapping systems associated with the first network architecture and the second network architecture.
8. The first edge node as described in claim 7, further comprising: Update the routing table to indicate the IP multicast address to the host node; Receive a packet from the host node, wherein the packet indicates the IP unicast address of the host node in the header of the packet; and Perform at least one of the following operations: update the routing table to indicate the IP unicast address of the host node, or send an indication of the IP unicast address to the mapping system.
9. The first edge node as described in claim 7 or 8, further comprising: Receive packets from the second edge node in the second network architecture; Identify the destination address of the packet; It was determined that the destination address had no entry in the routing table; It is determined that the destination address at least partially corresponds to the forged IP unicast address; and The packet is sent to the host node.
10. The first edge node as described in claim 7 or 8, wherein, The first edge node includes either a router or a switch.
11. The first edge node as described in claim 7 or 8, further comprising: It was determined that the routing table did not contain any entries corresponding to the forged IP unicast address. The generation of the forged IP unicast address is performed in response to determining that the routing table does not contain any entries.
12. A non-transitory computer-readable medium storing computer-executable instructions, said instructions, when executed by one or more processors, causing said one or more processors to perform operations, said operations including: A multicast listener discovery MLD query message is sent from the first edge node of the first network architecture to the host node in the first network architecture. At the first edge node, an MLD report message indicating an Internet Protocol IP multicast address associated with the host node is received, wherein the IP multicast address at least partially corresponds to the IP unicast address of the host node. At the first edge node, it is determined that the IP unicast address of the host node is not in the routing table associated with the first edge node; A forged IP unicast address is generated for the host node, wherein at least three least significant bytes of the forged IP unicast address match at least three least significant bytes of the IP multicast address; and The forged IP unicast address is sent to a second edge node in the second network architecture or to at least one of the mapping systems associated with the first network architecture and the second network architecture.
13. The non-transitory computer-readable medium of claim 12, wherein the operation further comprises: Update the routing table at the first edge node to indicate the IP multicast address to the host node; Receive a packet from the host node, wherein the packet indicates the IP unicast address of the host node in the header of the packet; and The routing table is updated at the first edge node to indicate the IP unicast address of the host node.
14. The non-transitory computer-readable medium of claim 12 or 13, wherein the operation further comprises: At the first edge node, packets are received from the second edge node in the second network architecture; Identify the destination address of the packet; It was determined that the destination address had no entry in the routing table; It is determined that the destination address at least partially corresponds to the forged IP unicast address; and The packet is sent to the host node.
15. The non-transitory computer-readable medium of claim 12 or 13, wherein the operation further comprises: At the first edge node, it is determined that the routing table does not contain any entries corresponding to the forged IP unicast address. The generation of the forged IP unicast address is performed in response to determining that the routing table does not contain any entries.
16. The non-transitory computer-readable medium of claim 12 or 13, wherein the operation further comprises: The forged IP unicast address is received from the first edge node at the mapping system; The global mapping database is updated at the mapping system, indicating the route from the first edge node to the host node associated with the forged IP unicast address; The mapping system receives a lookup message from the second edge node, the lookup message including a request for a route to send a data packet to the IP unicast address of the host node; The global mapping database is used to determine that the forged IP unicast address at least partially corresponds to the IP unicast address; and The data packet is sent to the first edge node at least in part because the first edge node serves the host node.
17. The non-transitory computer-readable medium as claimed in claim 12 or 13, wherein, The mapping system includes at least one of the following: Locator / ID Separation Protocol LISP Mapping - Server / Mapping Resolver MSMR Server; or Ethernet Virtual Private Network (eVPN) control plane server.
18. A first edge node in a first network architecture, the first edge node comprising: A means for sending a multicast listener discovery MLD query message to a host node in the first network architecture; A means for receiving an MLD report message indicating an Internet Protocol IP multicast address associated with the host node, wherein the IP multicast address at least partially corresponds to the IP unicast address of the host node; A means for determining that the IP unicast address of the host node is not in the routing table associated with the first edge node; A means for generating a forged IP unicast address for the host node, wherein at least three least significant bytes of the forged IP unicast address match at least three least significant bytes of the IP multicast address; as well as A means for sending the forged IP unicast address to a second edge node in a second network architecture or to at least one of a mapping system associated with the first network architecture and the second network architecture.
19. The first edge node of claim 18, further comprising means for implementing the method of any one of claims 2 to 6.
20. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method as claimed in any one of claims 1 to 6.