US 10,944,811 B2 · Hybrid cloud network monitoring system for tenant use

Abstract

Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first tenant organization. An encapsulated port mirroring session from the tenant port of the first VM to the first network interface of the decapsulating VM is then established. A plurality of packets comprising captured network traffic received via the encapsulated port mirroring session are decapsulated, and the captured network traffic is forwarded via the second network interface of the decapsulating VM to a sniffer VM.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims14

Dependent claims

A method for monitoring network traffic in a cloud computing system, the method comprising:

receiving the network traffic at a first port of a distributed virtual switch associated with a target virtual machine (VM) executing in a first host computer in the cloud computing system, wherein the distributed virtual switch includes the first port and a second port, wherein the first port of the distributed virtual switch is located in the first host computer connected to the target VM executing in the first host computer and the second port of the distributed virtual switch is located in a second host computer connected to an intermediate VM executing in the second host computer;
transmitting the network traffic from the first port of the distributed virtual switch to the target VM executing in the first host computer and a copy of the network traffic from the first port associated with the target VM to a first network interface of the intermediate VM executing in the second host computer in the cloud computing system through the second port of the distributed switch associated with the intermediate VM via an encapsulated port mirroring session;
processing the copy of the network traffic at the intermediate VM to be routed to a traffic monitoring device, including decapsulating packets of the network traffic received via the encapsulated port mirroring session by the intermediate VM;
and
forwarding the decapsulated packets of the network traffic from a second network interface of the intermediate VM to the traffic monitoring device through a second distributed virtual switch that connects the second host computer to a third host computer, which includes the traffic monitoring device, wherein the second network interface of the intermediate VM is not configured to receive any network traffic over the second distributed virtual switch.

2 more elements

A non-transitory computer-readable medium containing program instructions for monitoring network traffic in a cloud computing system, wherein execution of the program instructions by one or more processors of at least one computer systems causes the one or more processors to perform steps comprising:

receiving the network traffic at a first port of a distributed virtual switch associated with a target virtual machine (VM) executing in a first host computer in the cloud computing system, wherein the distributed virtual switch includes the first port and a second port, wherein the first port of the distributed virtual switch is located in the first host computer connected to the target VM executing in the first host computer and the second port of the distributed virtual switch is located in a second host computer connected to an intermediate VM executing in the second host computer;
transmitting the network traffic from the first port of the distributed virtual switch to the target VM executing in the first host computer and a copy of the network traffic from the first port associated with the target VM to a first network interface of the intermediate VM executing in the second host computer in the cloud computing system through the second port of the distributed virtual switch associated with the intermediate VM via an encapsulated port mirroring session;
processing the copy of the network traffic at the intermediate VM to be routed to a traffic monitoring device, including decapsulating packets of the network traffic received via the encapsulated port mirroring session by the intermediate VM;
and
forwarding the decapsulated packets of the network traffic from a second network interface of the intermediate VM to the traffic monitoring device through a second distributed virtual switch that connects the second host computer to a third host computer, which includes the traffic monitoring device, wherein the second network interface of the intermediate VM is not configured to receive any network traffic over the second distributed virtual switch.

2 more elements

A cloud computing system, comprising:

a plurality of host computers with hardware resources;
a target virtual machine (VM) executing on a first host computer and an intermediate VM with first and second network interfaces executing on a second host computer;
a traffic monitoring device;
and
a distributed virtual switch supported by the plurality of host computers, wherein the distributed virtual switch includes a first port and a second port, wherein the first port of the distributed virtual switch is located in the first host computer connected to the target VM executing in the first host computer and the second port of the distributed virtual switch is located in the second host computer connected to the intermediate VM executing in the second host computer, the distributed virtual switch being configured to receive network traffic at the first port associated with the target virtual machine (VM), and transmit the network traffic from the first port of the distributed virtual switch to the target VM executing in the first host computer and a copy of the network traffic from the first port associated with the target VM to the first network interface of the intermediate VM executing in the second host computer through the second port of the distributed switch associated with the intermediate VM via an encapsulated port mirroring session,
wherein the intermediate VM is configured to process the received copy of the network traffic to be routed to the traffic monitoring device that includes decapsulating packets of the network traffic received via the encapsulated port mirroring session and to forward the decapsulated packets of the network traffic through the second network interface of the intermediate VM to the traffic monitoring device through a second distributed virtual switch that connects the second host computer to a third host computer, which includes the traffic monitoring device, wherein the second network interface of the intermediate VM is not configured to receive any network traffic over the second distributed virtual switch.

3 more elements

Dependencies are inferred from the claim text.

Description9,512 words

Summary700 words

#This application claims priority to U.S. application Ser. No. 14/579,911, filed Dec. 22, 2014 (now U.S. Pat. No. 9,860,309), which is incorporated by reference herein in its entirety.

#Commercial enterprises are frequently turning to public cloud providers to meet their computing needs. The benefits of cloud computing are numerous. Among the benefits are lower operating costs, due to reduced spending on computing hardware, software, and support. In addition, since public clouds are generally accessible from any network-connected device, applications deployed to the cloud are more easily distributed to a diverse and global workforce.

#Cloud architectures are used in cloud computing and cloud storage systems for offering infrastructure-as-a-service (IaaS) cloud services. Examples of cloud architectures include the VMware vCloud™ Director cloud architecture software, Amazon EC2™ web service, and OpenStack™ open source cloud computing service. IaaS cloud service is a type of cloud service that provides access to physical and/or virtual resources in a cloud environment. These services provide a tenant application programming interface (API) that supports operations for manipulating IaaS constructs such as virtual machines (VMs) and logical networks. However, the use of such public cloud services is typically kept separate from the use of existing computing resources in data centers managed by an enterprise.

Brief description of the drawings4 figures

#FIG. 1 is a block diagram of a hybrid cloud computing system in which one or more embodiments of the present disclosure may be utilized.

#FIG. 2 is a block diagram depicting a public cloud-based computing system, according to one or more embodiments.

#FIG. 3 is a conceptual diagram depicting components that facilitate monitoring of network traffic for public cloud-based tenants, according to one or more embodiments.

Detailed description8,712 words

#To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements disclosed in one embodiment may be beneficially utilized on other embodiments without specific recitation.

#FIG. 1 is a block diagram of a hybrid cloud computing system 100 in which one or more embodiments of the present disclosure may be utilized. Hybrid cloud computing system 100 includes a virtualized computing system 102 and a cloud computing system 150, and is configured to provide a common platform for managing and executing virtual workloads seamlessly between virtualized computing system 102 and cloud computing system 150. In one embodiment, virtualized computing system 102 may be a data center controlled and administrated by a particular enterprise or business organization, while cloud computing system 150 is operated by a cloud computing service provider and exposed as a service available to account holders, such as the particular enterprise in addition to other enterprises. As such, virtualized computing system 102 may sometimes be referred to as an on-premise data center(s), and cloud computing system 150 may be referred to as a “public” cloud service. In some embodiments, virtualized computing system 102 itself may be configured as a private cloud service provided by the enterprise.

#As used herein, an internal cloud or “private” cloud is a cloud in which a tenant and a cloud service provider are part of the same organization, while an external or “public” cloud is a cloud that is provided by an organization that is separate from a tenant that accesses the external cloud. For example, the tenant may be part of an enterprise, and the external cloud may be part of a cloud service provider that is separate from the enterprise of the tenant and that provides cloud services to different enterprises and/or individuals. In embodiments disclosed herein, a hybrid cloud is a cloud architecture in which a tenant is provided with seamless access to both private cloud resources and public cloud resources.

Facts

Application

15/846,133Filed 18 Dec 2017 · continuation

Priority

22 Dec 2014

Published

US 2018/0109602 A119 Apr 2018

Granted

9 Mar 2021

Term ends

6 Feb 2035

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 46 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification6 codes

H04L 67/10
Protocols: in which an application is distributed across nodes in the network
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling
H04L 43/062
Generation of reports: related to network traffic
H04L 43/12
Arrangements for monitoring or testing data switching networks: network monitoring probes

Family

Application14/579,911Parent of this continuation · filed 22 Dec 2014

US 2018/0109602 A1Pre-grant publication · published 19 Apr 2018

US 9,860,309 B2Parent of this continuation

US 2016/0182336 A1Published application

US 10,944,811 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

22 Dec 2014Priority claimedParent application 14/579,911
18 Dec 2017Application filedUS 15/846,133
19 Apr 2018PublishedUS 2018/0109602 A1
9 Mar 2021GrantedUS 10,944,811 B2
15 Apr 2024Assigned to Vmware LLCchange of name
12 Oct 2026TodayWithin its term
6 Feb 2035Term endsEstimated, includes 46 days of adjustment

Hybrid cloud network monitoring system for tenant use

Life of this patent

Hybrid cloud network monitoring system for tenant use

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims14

Description9,512 words

Drawings

Classification6 codes

Life of this patent

Description9,512 words