System and method for transport-layer level identification and isolation of container traffic
AssigneeCisco Technology, Inc.
InventorsSebastian Jeuk, Gonzalo Salgueiro
Life of this patent
Estimating the term…
Abstract
Disclosed is a system and method of providing transport-level identification and isolation of container traffic. The method includes receiving, at a component in a network, a packet having a data field, extracting, at a network layer, container identification data from the data field and applying a policy to the packet at the component based on the container identification data. The data field can include one of a header, an IPv6 extension header, a service function chaining container identification, a network service header, and an optional field of an IPv4 packet.
Claims18
A method comprising:
- receiving, at a component in a network, a packet having a data field;
- extracting, at a network layer, container identification data from the data field, the container identification data identifying a software destination container on the network;
- and
- applying a policy to the packet at the component based on the container identification data;
- wherein the container identification data includes at least a unique container ID and/or a container name;
- wherein the data field comprises one of an IPv6 extension header and an option field of an IPv4 packet.
A system comprising:
- one or more processors;
- and
- a computer-readable medium, storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, at a component in a network, a packet having a data field;
- extracting, at a network layer, container identification data from the data field, the container identification data identifying a software destination container on the network;
- and
- applying a policy to the packet at the component based on the container identification data;
- wherein the container identification data includes at least a unique container ID and/or a container name;
- wherein the data field comprises one of an IPv6 extension header and an option field of an IPv4 packet.
A non-transitory computer-readable storage media storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
- receiving, at a component in a network, a packet having a data field;
- extracting, at a network layer, container identification data from the data field, the container identification data identifying a software destination container on the network;
- and
- applying a policy to the packet at the component based on the container identification data;
- wherein the container identification data includes at least a unique container ID and/or a container name;
- wherein the data field comprises one of an IPv6 extension header and an option field of an IPv4 packet.
Dependencies are inferred from the claim text.