Flow-Based ARP Suppression in Virtualized Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized network environments, Address Resolution Protocol (ARP) requests lead to excessive broadcast traffic, consuming resources and being vulnerable to attacks due to the lack of authentication mechanisms, with existing solutions causing latency and being resource-intensive.
Innovation Solution
Implementing a flow-based forwarding element that matches ARP requests and locally converts them to reply packets within the forwarding element, using an address-mapping table to find the target hardware address without broadcasting the request, thereby suppressing ARP broadcasts and generating replies within the forwarding element.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ARP requests are broadcasted to all nodes in the subnet, then all nodes can receive the request and respond, but this consumes excessive CPU resources and bandwidth in the datacenter network
Solution Approach 1:
The patent extracts the ARP request processing function from the traditional broadcast model and relocates it to a controller that maintains an ARP resolution table. Instead of broadcasting to all nodes, the controller directly queries the resolution table and returns the target MAC address to the source VM, eliminating unnecessary broadcast traffic and reducing CPU resource consumption on host machines.
Solution Approach 2:
The patent introduces a controller as an intermediary between the source VM and the ARP resolution process. The controller receives ARP requests from the forwarding element, queries the ARP resolution table, and generates appropriate reply packets. This intermediary approach replaces the traditional broadcast mechanism with a targeted query-response model, reducing network bandwidth consumption and host CPU utilization.
2Ease of manufacture
If ARP requests are broadcasted to all nodes in the subnet, then the protocol is simple to implement, but this makes the protocol vulnerable to ARP poisoning and spoofing attacks
Solution Approach 1:
The patent implements preliminary action by pre-populating an ARP resolution table with MAC address to IP address mappings before ARP requests are generated. The controller maintains this table and performs lookups before generating reply packets, ensuring that only authenticated and pre-verified address mappings are returned. This preliminary verification prevents ARP poisoning attacks by ensuring that the resolution information comes from a trusted source rather than accepting unsolicited ARP replies.
3Reliability
If a local controller process traps and processes ARP requests, then ARP suppression can be achieved, but this creates latency and is resource intensive
Solution Approach 1:
The patent replaces the mechanical system of user-level packet trapping and processing with a kernel-level flow-based processing mechanism. Flow entries are installed in the kernel forwarding element, allowing ARP request matching and reply generation to occur in the fast data path without user-space intervention. This substitution eliminates the latency associated with user-level processing while maintaining effective ARP suppression.
4Reliability
If a controller generates reply packets outside the forwarding element, then ARP resolution can be provided, but this requires complex deployment and is resource intensive from a software engineering perspective
Solution Approach 1:
The patent merges the ARP resolution functionality directly into the kernel forwarding element by installing flow entries that perform matching, table lookup, and reply generation within the same kernel module. This integration eliminates the need for separate user-space controller processes and complex inter-process communication mechanisms, significantly reducing deployment complexity while maintaining accurate ARP resolution through the pre-populated resolution table.
Data Source
AI summary
A method of suppressing ARP packets in a logical network comprising a set of data compute nodes (DCNs). The DCNs are hosted on a set of physical hosts. Each DCN has a protocol address and is connected to a forwarding elements (FE) on the corresponding host. Each FE has a set of flows that specifies a set of conditions to match a set of fields of each received packet and a set of actions to take on a packet that matches the set of conditions. An FE on a physical host receives a packet sent by a first DCN on the physical host and determines that the received packet is an ARP request packet by matching a set of fields in the packet with a set of conditions of a particular flow. The ARP request packet identifies a protocol address of a second DCN on the logical network. The PFE utilizes the actions specified by the particular flow to determine a corresponding hardware address for the target protocol address by searching an address-mapping table that maps the protocol address of each DCN to a corresponding hardware address. The PFE converts the ARP request packet to an ARP reply packet utilizing the set of actions specified by the particular flow, the ARP reply packet comprising the determined target address as a resolution of the ARP request. The PFE sends the ARP reply packet to the first DCN without broadcasting the ARP request to any DCNs on the logical network.