VTEP Packet Mirroring for SDN Controller Load Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Software Defined Networks (SDNs), monitoring large numbers of Virtual Machines (VMs) can overwhelm the controller's CPU resources, affecting performance due to the need to forward data streams from all monitored VMs for monitoring purposes.
Innovation Solution
The method involves using Ethernet Virtual Private Network (EVPN) technology with Border Gateway Protocol (BGP) for routing information on the control plane and VXLAN encapsulation on the data plane, allowing VTEPs to configure forwarding entries to mirror and forward packets efficiently, reducing the load on the controller by distributing monitoring tasks across VTEPs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the controller forwards data streams from all monitored VMs for monitoring purposes, then complete packet monitoring capability is achieved, but CPU resource occupation increases and performance deteriorates
Solution Approach 1:
The patent segments the monitoring function by introducing VTEP nodes that perform local packet mirroring and filtering operations. Instead of the controller handling all monitoring tasks centrally, the monitoring function is divided into: (1) VTEP performs packet capture and initial filtering, (2) VTEP performs VXLAN encapsulation and forwarding to monitoring server, (3) controller only handles high-level monitoring policy management. This segmentation reduces controller CPU load while maintaining complete monitoring capability.
Solution Approach 2:
The patent introduces VTEP as an intermediary component between the monitored VMs and the controller. The VTEP acts as a mediator that: (1) Captures packets from VMs at the network edge, (2) Performs VXLAN encapsulation to package monitoring data, (3) Forwards encapsulated packets to the monitoring server, (4) Filters out unnecessary traffic before it reaches the controller. This intermediary approach protects the controller from being overwhelmed while ensuring complete packet monitoring.
2Reliability
If the controller monitors all packets from monitored VMs, then comprehensive monitoring coverage is achieved, but network bandwidth is consumed and monitoring efficiency decreases
Solution Approach 1:
The patent applies preliminary action by performing packet filtering and VXLAN encapsulation at the VTEP before packets are forwarded to the monitoring server or controller. The VTEP: (1) Pre-filters packets to remove unnecessary traffic, (2) Pre-encapsulates packets in VXLAN format with monitoring server identifiers, (3) Pre-routes packets to appropriate monitoring servers based on destination IP addresses. This preliminary processing reduces network bandwidth consumption and improves monitoring efficiency while maintaining comprehensive coverage.
3Loss of information
If the controller performs extensive monitoring operations, then detailed monitoring information is obtained, but system complexity and processing overhead increase
Solution Approach 1:
The patent uses copying by creating VXLAN-encapsulated copies of original packets for monitoring purposes. The VTEP: (1) Creates mirror copies of packets from monitored VMs, (2) Encapsulates these copies in VXLAN format with monitoring server identification, (3) Forwards copies to monitoring servers while allowing original packets to continue normal forwarding. This copying approach enables detailed monitoring information collection without adding complexity to the original packet forwarding path or requiring the controller to perform extensive processing operations.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
VTEP receives a packet, VXLAN-encapsulates and sends a mirror packet of the packet to a remote VTEP accessed by a monitoring server, or sends the mirror packet to a local monitoring server according to the execution action of a matching first forwarding entry if the packet is a user packet from a local monitored host; VXLAN-encapsulates and sends the mirror packet to a remote VTEP accessed by the monitoring server, or sends the mirror packet to the local monitoring server according to the execution action of a matching second forwarding entry if the packet is a user packet sent from a local host to the monitored host. If the packet is a VXLAN packet with the identifier of the monitoring server from the remote VTEP, the VXLAN packet is de-encapsulated to be sent to the local monitoring server according to the execution action of a matching third forwarding entry.