Managed Forwarding Element Packet Conflict Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized networks, distributing logical middleboxes creates inefficiencies due to the need for state sharing between distributed elements, leading to conflicts and inefficiencies in packet processing, particularly when connections appear identical but are received via different tunnels.
Innovation Solution
Dynamic generation of flow entries at managed forwarding elements to resolve conflicts and automatically forward reverse-direction traffic, allowing initial processing at the source side with maintained state information, and implementing conflict resolution by modifying source IP addresses or port numbers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If logical middleboxes are distributed across multiple host machines, then processing efficiency is improved by performing first-hop processing locally, but conflicts arise when two separate transport connections have similar or identical connection identification data
Solution Approach 1:
The patent introduces tunnel identification as an additional dimension to distinguish connections that have identical connection identification data (source IP, destination IP, source port, destination port, protocol). By incorporating the tunnel ID where connections are received, the system can differentiate between connections from different tunnels, resolving the conflict while maintaining distributed processing efficiency.
Solution Approach 2:
The patent introduces a tunnel identifier as an intermediary element that mediates between the distributed middlebox elements and the connection state. This tunnel ID acts as a unique identifier that allows middlebox elements to correlate packets from the same tunnel while maintaining local state, enabling accurate connection tracking without centralized state sharing.
2Reliability
If flow entries are dynamically generated to resolve connection conflicts, then connection identification accuracy is improved, but device complexity increases due to dynamic flow entry management
Solution Approach 1:
The patent performs preliminary actions by pre-establishing tunnel identifiers and pre-configuring the framework for dynamic flow entry generation. When a connection conflict is detected, the system dynamically generates flow entries that incorporate tunnel identification, allowing accurate connection differentiation without requiring complex real-time analysis during packet processing.
Solution Approach 2:
The patent implements dynamic flow entry generation that adapts to connection patterns. Flow entries are created dynamically based on observed connections and tunnel identifiers, allowing the system to maintain simplicity for common cases while providing accurate conflict resolution when needed. The flow entries are dynamically updated as new connections are established.
Data Source
AI summary
Some embodiments provide a method for a first managed forwarding element that implements a logical network. The method receives a packet from a second managed forwarding element. The first packet has an initial set of characteristics defining a first connection between a source machine connected to the second managed forwarding element and a destination machine connected to the first managed forwarding element. The method determines whether a second connection exists with the initial set of characteristics between a different machine connected to a third managed forwarding element and the destination machine. When a second connection exists with the initial set of characteristics, the method modifies at least one characteristic of the packet such that the modified packet does not have the same set of characteristics. The method delivers the modified packet to the destination machine.