Gateway Datapath Rate Limiting via ACL Tables

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current datacenter QoS mechanisms aggregate all tenants at the hardware level, making it difficult to disaggregate traffic and apply rate limiting effectively, especially for control traffic which should not be subject to rate limiting.

Innovation Solution

A gateway datapath on a gateway device manages QoS for multiple logical networks by using ACL tables to determine rate limiting controls for each tenant, with separate tables for ingress and egress traffic and different protocols, and applies rate limiting mechanisms based on token bucket values.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If rate limiting is performed at the hardware level aggregating all tenants, then QoS can be guaranteed for contracted performance, but traffic cannot be disaggregated to apply rate limiting selectively to specific tenants or traffic types

Engineering Contradiction:

Improveability to apply rate limiting selectively to specific tenants and traffic typesVSAvoidcomplexity of disaggregating traffic at hardware level

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments the aggregated tenant traffic into separate processing streams by implementing logical routers for different tenant logical networks. Each logical router processes traffic from specific tenants independently, allowing selective application of rate limiting policies to different tenants and traffic types while maintaining overall QoS guarantees.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The gateway datapath acts as an intermediary between the hardware level aggregation and software level tenant-specific processing. It receives aggregated traffic from the network interface controller, disaggregates it using logical routing tables, and applies tenant-specific rate limiting controls before forwarding to destinations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If rate limiting is applied to all traffic at the gateway level, then selective QoS control for each tenant is achieved, but control traffic may be inadvertently rate limited

Engineering Contradiction:

Improveselective QoS control for each tenantVSAvoidrisk of inadvertently rate limiting control traffic

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies different quality characteristics to different types of traffic through separate processing paths. Control traffic is identified by its logical network associations and routing patterns, then routed through logical routers that have rate limiting disabled or configured with higher thresholds, while regular tenant traffic receives standard rate limiting controls.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system uses routing table lookups and logical network association tracking to identify control traffic patterns. By monitoring which logical networks generate control traffic and which logical routers handle such traffic, the system dynamically adjusts rate limiting application to prevent control traffic from being inadvertently limited.

Inventive Principle:

Principle #23Feedback

3Manufacturing precision

If multiple ACL tables are stored for different protocols and traffic directions, then precise rate limiting configuration is achieved, but memory usage and table lookup complexity increase

Engineering Contradiction:

Improveprecision of rate limiting policy configurationVSAvoidnumber of ACL tables and lookup operations

Core Design Contradiction:

Manufacturing precisionVSDevice complexity

Solution Approach 1:

The patent organizes ACL tables in a multi-dimensional structure where tables are differentiated by protocol type (IPv4/IPv6) and traffic direction (ingress/egress). This dimensional organization allows precise matching of traffic characteristics to appropriate rate limiting policies while enabling efficient lookup by first determining protocol and direction, then consulting the corresponding specialized table.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Solution Approach 2:

The system performs preliminary classification of incoming traffic by protocol type and direction before consulting ACL tables. By pre-determining which category the traffic belongs to, the system can directly access the appropriate specialized ACL table without searching through all possible tables, reducing lookup complexity while maintaining precise policy application.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12095668B2Determining whether to rate limit traffic

Publication Date: 2024.09.17 VMWARE INC

AI summary

Some embodiments provide a method for a gateway datapath that executes on a gateway device to implement logical routers for a set of logical networks and process traffic between the logical networks and an external network. The method receives a data message at the gateway device. To process the data message, the method executes a set of processing stages that includes a processing stage for a particular logical router. As part of the processing stage for the particular logical router, the method (i) uses an access control list (ACL) table to determine whether the data message is subject to rate limiting controls defined for the particular logical router and (ii) only when the data message is subject to rate limiting controls, determines whether to allow the data message according to a rate limiting mechanism for the particular logical router.