Virtual Switch MAC Rewriting for Container Network Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The proliferation of software containers in computing systems leads to a significant increase in networking resources, particularly in IP/MAC bindings, which overwhelms traditional Layer 2 and Layer 3 networking solutions, causing scalability issues in network devices.
Innovation Solution
Implementing virtual switches that rewrite MAC addresses and perform IP-based lookups to manage IP/MAC bindings, allowing network devices to scale with the number of hosts rather than containers, and using distributed IP gateways to store container addresses, thereby alleviating the burden on network devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all IP/MAC bindings are stored in every network switch (edge switch), then Layer 2/Layer 3 forwarding can be performed, but the hardware MAC address scale cannot accommodate the storage of all IP/MAC bindings due to the proliferation of containers
Solution Approach 1:
The patent segments the IP/MAC binding storage function by introducing a separate control plane component that maintains a global IP/MAC binding database. Network switches no longer need to store all IP/MAC bindings locally; instead, they perform IP lookups and forward frames to a controller that resolves IP/MAC bindings and distributes them selectively. This segmentation allows the system to scale to large numbers of containers without overwhelming individual switch MAC address tables.
Solution Approach 2:
The patent introduces a controller as an intermediary between network switches and containers. The controller receives frames from switches with IP destination addresses, performs IP lookups to determine the corresponding MAC address, and returns the MAC address to the switch. This intermediary approach eliminates the need for switches to store all IP/MAC bindings locally, resolving the scalability issue while maintaining forwarding capability.
2Quantity of substance
If the same MAC address is assigned to all containers with different IP addresses, then the MAC table explosion is eliminated, but distributing routes and performing Layer 3 forwarding on the host device's operating system kernel places too high a burden to scale adequately
Solution Approach 1:
The patent extracts the Layer 3 routing and forwarding functionality from the host device's operating system kernel and relocates it to specialized hardware network switches. The host device only needs to perform simple Layer 2 frame forwarding based on MAC addresses, while the hardware switches handle IP routing, route distribution, and Layer 3 forwarding. This extraction reduces the processing burden on host devices and allows the system to scale to large numbers of containers.
Solution Approach 2:
The patent replaces software-based Layer 3 forwarding in the host device's operating system kernel with hardware-based forwarding in specialized network switches. The hardware switches use dedicated forwarding engines and ASICs to perform IP routing and Layer 3 forwarding at line rate, eliminating the performance bottleneck of software-based processing and enabling the system to scale efficiently with increasing container workloads.
3Ease of operation
If Layer 3 IP addresses are directly exposed to the physical network, then routing can be performed, but the IP table in network devices does not scale adequately since host addresses must be distributed across the network fabric
Solution Approach 1:
The patent introduces a hierarchical dimension to IP address management by implementing a virtual network layer above the physical network. Containers are assigned IP addresses from virtual subnets managed by the controller, which translates between virtual IP addresses and physical network addresses. This dimensional addition allows routing to be performed in the virtual layer without requiring all physical IP addresses to be distributed across the network fabric, improving scalability.
Data Source
AI summary
A source host device masks the hardware address of a hosted container from a network device to mitigate the use of resources in the network device. A virtual switch on the source host receives a frame from a hosted container. The frame includes a source hardware address of the hardware address corresponding to the hosted container. The frame also includes a source network address of the network address corresponding to the hosted container. The virtual switch replaces the source hardware address of the frame with the hardware address associated with the source host, and send the frame to the network device. The frame sent to the network device includes the host hardware address as the source hardware address and the container network address as the source network address.