Dynamic Flow Entry Generation for Virtualized Network Stateful Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized networks, distributing logical middleboxes for packet processing is inefficient due to the need for state sharing between distributed elements, leading to conflicts and inefficiencies in handling bi-directional stateful traffic.
Innovation Solution
Dynamic generation of flow entries at managed forwarding elements to resolve conflicts and forward reverse-direction traffic, allowing initial processing at the first hop and subsequent processing by different elements, while maintaining connection state information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If logical middleboxes are distributed across multiple host machines, then processing capacity and network scalability are improved, but state sharing complexity and conflict management increase
Solution Approach 1:
The patent segments the middlebox functionality by separating stateful processing (performed by a single designated middlebox element) from stateless forwarding (performed by multiple distributed elements). This allows packet processing capacity to be distributed while avoiding the complexity of sharing connection state across all elements.
Solution Approach 2:
The patent introduces a control plane intermediary that dynamically generates flow entries to route packets appropriately. This intermediary manages the complexity of state sharing by automatically directing packets to the correct middlebox element that holds the relevant connection state, eliminating manual state synchronization requirements.
2Productivity
If all logical processing is performed at the first hop, then processing efficiency is improved, but reverse-direction traffic cannot be processed by the original middlebox
Solution Approach 1:
The patent performs preliminary action by having the first-hop element dynamically generate flow entries that pre-establish the routing path for reverse-direction traffic. This ensures that when reverse traffic arrives, it is automatically routed to the correct middlebox element that maintains the connection state, maintaining both efficiency and reliability.
Solution Approach 2:
The system implements feedback through dynamically generated flow entries that encode routing information based on connection state. The flow entries provide feedback mechanisms to redirect reverse-direction traffic back to the appropriate middlebox element, ensuring connection state consistency while maintaining processing efficiency.
3Reliability
If dynamic flow entry generation is implemented, then conflict resolution between connections is improved, but control plane processing overhead increases
Solution Approach 1:
The patent changes parameters by using hash-based connection identification and dynamic flow entry generation with specific match criteria. This allows efficient conflict resolution through parameter-based routing decisions that can be implemented with minimal control plane overhead, as the flow entries use standardized packet header fields for matching.
Data Source
AI summary
Some embodiments provide a method for a first managed forwarding element that implements logical forwarding elements of a logical network. The method receives a first packet from a second managed forwarding element. The first packet includes context information that indicates a logical network destination that maps to a physical destination connected to the first managed forwarding element. At the first managed forwarding element, the method dynamically generates a flow entry for processing subsequent packets received by the first managed forwarding element from the physical destination and sent to a source of the first packet. The method processes a second packet received by the first managed forwarding element from the physical destination with the dynamically generated flow entry. The dynamically generated flow entry specifies to send the second packet to the second managed forwarding element before logically forwarding the second packet through the logical network.