# US 10,871,981 B2 · Performing logical network functionality within data compute nodes

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,871,981 B2
- Document ID: US10871981B2
- Status: Granted
- Kind: B2
- Application number: 14/954,489
- Filed: 2015-11-30
- Published: 2017-05-04
- Granted: 2020-12-22
- Earliest claimed: 2015-11-01
- Assignees: Nicira, Inc.
- Applicants: Nicira, Inc.
- Inventors: Donghai Han; Meiwen Li
- Web page: https://patentgrep.com/patent/US10871981B2

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/45537: {Provision of facilities of other operating environments, e.g. WINE (I/O emulation G06F13/105)}
- G06F 12/1009: using page tables, e.g. page table structures
- G06F 12/109: for multiple virtual address spaces, e.g. segmentation (G06F12/1036 takes precedence)
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 45/745: Address table lookup; Address filtering
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/126: {the source of the received data}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 69/22: Parsing or analysis of headers
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F 2212/151: Emulated environment, e.g. virtual machine
- G06F 2212/651: Multi-level translation tables
- H04L 45/74: Address processing for routing
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments provide a method for a managed forwarding element (MFE) operating within a first data compute node (DCN) that executes on a first host machine. The MFE is for implementing a logical network that logically connects the first DCN to a plurality of other DCNs. At the MFE, the method receives several packets generated within the first DCN to be forwarded to a second DCN that is logically connected to the first DCN. The method determines whether the second DCN executes on the first host machine or on a second, different host machine. When the second DCN executes on the first host machine, the method stores the packets in a memory space of the first host machine that is shared between the first and second DCNs.

## Claims

### Claim 1

A method of forwarding packets from a first data compute node (DCN) of a set of DCNs that execute on a virtualization application executing on a first host machine, the method comprising:
at a first managed forwarding element (MFE) operating within the first DCN to implement a logical network that logically connects the first DCN to a plurality of other DCNs via a set of logical forwarding elements,
receiving a packet generated by a first application executing on the first DCN;
performing logical network processing on the packet to determine that the packet is to be forwarded to a second DCN that is logically connected to the first DCN via the set of logical forwarding elements of the logical network;
determining whether the second DCN executes on the first host machine or on a second, different host machine; and
when the second DCN executes on the first host machine, storing the received packet in a memory space of the first host machine that is shared between the first and second DCNs by (i) writing the packet to a first virtual memory page of the first DCN that maps to a particular physical memory page of the first host machine that is shared between the first and second DCNs and maps to a second virtual memory page of the second DCN and (ii) notifying the virtualization application executing on the first host machine that the packet is available in the particular physical memory page, wherein the virtualization application notifies a second MFE, operating within said second DCN to implement the logical network along with the first MFE, that the packet is stored in the particular physical memory page, wherein the second MFE reads the packet from the second virtual memory page of the second DCN, performs network processing on the packet, and provides the packet to a second application executing on the second DCN,
wherein when the second DCN executes on a second, different host machine, the first MFE encapsulates the received packet before transmitting the encapsulated packet to a third MFE, operating on the second host machine to implement the logical network along with the first and second MFEs, via a physical network interface controller (PNIC) of the first host machine.

### Claim 2 (depends on 1)

The method of claim 1, wherein the particular physical memory page is managed by the virtualization application.

### Claim 3 (depends on 1)

The method of claim 1, wherein the virtualization application, after receiving the notification from the first MFE operating within the first DCN, further passes control over the particular physical memory page from the first DCN to the second DCN.

### Claim 4 (depends on 1)

The method of claim 1, wherein when the second DCN executes on a second, different host machine, the first MFE encapsulates the packet and transmits the encapsulated packet to the third MFE by:
identifying tunnel endpoint addresses associated with the first and second DCNs;
encapsulating the packet with the tunnel endpoint addresses using a particular tunnel protocol; and
sending the encapsulated packet to the PNIC.

### Claim 5 (depends on 4)

The method of claim 4, wherein the tunnel endpoint addresses comprise an Internet Protocol (IP) address of the third MFE as a destination tunnel endpoint address, wherein the third MFE operates within the second DCN.

### Claim 6 (depends on 5)

The method of claim 5, wherein the tunnel endpoint addresses further comprise an IP address of the first MFE as a source tunnel endpoint address.

### Claim 7 (depends on 5)

The method of claim 5, wherein the third MFE, after receiving the encapsulated packet, decapsulates the packet using the particular tunnel protocol and forwards the decapsulated packet to a third application executing on the second DCN.

### Claim 8 (depends on 4)

The method of claim 4, wherein the tunnel endpoint addresses comprise an Internet Protocol (IP) address of the third MFE as a destination tunnel endpoint address, wherein the third MFE operates within a virtualization application that executes on the second host machine.

### Claim 9 (depends on 8)

The method of claim 8, wherein the third MFE performs forwarding processing for network traffic that is sent to and received from the second DCN along with a set of other DCNs executing on the second host machine.

### Claim 10

A non-transitory machine readable medium storing a program executable by at least one processing unit of a first host machine, the program for implementing a first managed forwarding element (MFE) within a first data compute node (DCN) of a set of DCNs that execute on a virtualization application executing on the first host machine, the first MFE implementing a logical network that logically connects the first DCN to a plurality of other DCNs via a set of logical forwarding elements, the program comprising sets of instructions for:
receiving a packet generated by a first application executing on the first DCN;
performing logical network processing on the packet to determine that the packet is to be forwarded to a second DCN that is logically connected to the first DCN via the set of logical forwarding elements of the logical network;
determining whether the second DCN executes on the first host machine or on a second, different host machine;
when the second DCN executes on the first host machine, storing the received packet in a memory space of the first host machine that is shared between the first and second DCNs by (i) writing the packet to a first virtual memory page of the first DCN that maps to a particular physical memory page of the first host machine that is shared between the first and second DCNs and maps to a second virtual memory page of the second DCN and (ii) notifying the virtualization application executing on the first host machine that the packet is available in the particular physical memory page, wherein the virtualization application notifies a second MFE, operating within said second DCN to implement the logical network along with the first MFE, that the packet is stored in the particular physical memory page, wherein the second MFE reds the packet from the second virtual memory page of the second DCN, performs network processing on the packet, and provides the packet to a second application executing on the second DCN; and
when the second DCN executes on a second, different host machine, encapsulating the received packet with a logical network encapsulation header and transmitting the encapsulated packet to a third MFE, operating on the second host machine to implement the logical network along with the first and second MFEs, via a physical network interface controller (PNIC) of the first host machine.

### Claim 11 (depends on 10)

The non-transitory machine readable medium of claim 10, wherein the particular physical memory page is managed by the virtualization application.

### Claim 12 (depends on 10)

The non-transitory machine readable medium of claim 10, wherein the set of instructions for encapsulating the packet and transmitting the encapsulated packet to the third MFE via the PNIC comprises sets of instructions for:
identifying tunnel endpoint addresses associated with the first and second DCNs;
encapsulating the packet with the tunnel endpoint addresses using a particular tunnel protocol; and
sending the encapsulated packet to the PNIC.

### Claim 13 (depends on 12)

The non-transitory machine readable medium of claim 12, wherein the tunnel endpoint addresses comprise (i) an Internet Protocol (IP) address of the first MFE as a source tunnel endpoint address and (ii) an IP address of the third MFE as a destination tunnel endpoint address, wherein the third MFE operates within the second DCN.

### Claim 14 (depends on 10)

The non-transitory machine readable medium of claim 10, wherein the set of instructions for encapsulating the received packet and transmitting the encapsulated packet to the third MFE via the PNIC comprises a set of instructions for forwarding the packet to a fourth MFE that executes on the first host machine, wherein the fourth MFE forwards the packet to the PNIC.