Back to results
US 11,082,338 B1Granted
Distributed connection state tracking for large-volume network flows
AssigneeAmazon Technologies, Inc.
InventorAvik Kumar Saha
Life of this patent
Estimating the term…
Abstract
A respective plurality of state tracking nodes is selected at a flow management service for each direction of a bi-directional network flow's traffic prior to routing a first packet of the flow, and state tracking entries for the flow are stored at the nodes. The state tracking entries include a transformation descriptor for the packets of the flow. When a packet of the flow is received, at least one transformed packet corresponding to the received packet is generated and transmitted to a destination indicated by the transformation descriptor.
Claims20
A method, comprising:
- performing, by one or more computing devices:
- obtaining a representation of a first flow management requirement of a first client of a network-accessible service, wherein the requirement comprises one or more of:
- (a) a set of source addresses of network packets, (b) a set of destination addresses, (c) a packet transformation descriptor, or (d) a flow intervention descriptor indicating a first action to be implemented in response to a detection that a network flow satisfies a first condition;
- in response to detecting that a state tracking entry for a particular bi-directional network flow is not stored at a flow management service comprising a plurality of nodes, wherein the particular bi-directional network flow is distinguishable from other network flows by a combination of one or more of:
- a network protocol, a source network address, a source network port, a destination network address or a destination network port,
- designating, prior to routing a first packet of the particular bi-directional network flow, at least (a) a first plurality of state tracking nodes comprising a first direction primary node and a first direction secondary node, for a first direction of the particular bi-directional network flow and (b) a second plurality of state tracking nodes comprising a second direction primary node and a second direction secondary node for a second direction of the particular bi-directional network flow;
- and
- storing, prior to routing the first packet, at individual nodes including the first direction primary node and the first direction secondary node of the first plurality and at individual nodes including the second direction primary node and the second direction secondary node of the second plurality, a respective state tracking entry for the particular bi-directional network flow, wherein the respective state tracking entry comprises at least an indication of (a) a transformation to be implemented in accordance with the packet transformation descriptor and (b) the first action;
- in response to determining that (a) a particular packet of the particular bi-directional network flow has been received at the flow management service and (b) the first condition is not satisfied by the particular bi-directional network flow, transmitting at least one transformed packet corresponding to the particular packet to a destination selected based at least in part on the packet transformation descriptor, wherein the first direction primary node performs state tracking for the particular packet and the first direction secondary node is configured to take over responsibilities of the first direction primary node responsive to the first direction primary node being unreachable or failing, and the second direction secondary node is configured to take over responsibilities of the second direction primary node responsive to the second direction primary node being unreachable or failing;
- and
- in response to determining that the first condition is satisfied by the particular bi-directional network flow, initiating the first action.
8 more elements
A system, comprising:
- one or more computing devices of a flow management service;
- wherein the one or more computing devices include instructions that when executed on one or more processors cause the one or more computing devices to:
- designate, prior to routing a first packet of a bi-directional network flow, at least (a) a first plurality of state tracking nodes comprising a first direction primary node and a first direction secondary node, for a first direction of the bi-directional network flow and (b) a second plurality of state tracking nodes comprising a second direction primary node and a second direction secondary node for a second direction of the bi-directional network flow;
- and
- store, prior to routing the first packet, at individual nodes including the first direction primary node and the first direction secondary node of the first plurality and at individual nodes including the second direction primary node and the second direction secondary node of the second plurality, a respective state tracking entry for the bi-directional network flow, wherein the respective state tracking entry comprises at least an indication of a packet transformation descriptor;
- and
- in response to determining that a packet of the bi-directional network flow has been received at the flow management service, perform, by the primary node, state tracking for the packet and transmit at least one transformed packet corresponding to the received packet to a destination selected based at least in part on the packet transformation descriptor, wherein the first direction secondary node is configured to take over responsibilities of the first direction primary node responsive to the first direction primary node being unreachable or failing, and the second direction secondary node is configured to take over responsibilities of the second direction primary node responsive to the second direction primary node being unreachable or failing.
4 more elements
One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to:
- identify, prior to routing a first packet of a bi-directional network flow, at least (a) a first plurality of state tracking nodes comprising a first direction primary node and a first direction secondary node for a first direction of the bi-directional network flow and (b) a second plurality of state tracking nodes comprising a second direction primary node and a second direction secondary node for a second direction of the bi-directional network flow;
- and
- store, prior to routing the first packet, at individual nodes including the first direction primary node and the first direction secondary node of the first plurality and at individual nodes including the second direction primary node and the second direction secondary node of the second plurality, a respective state tracking entry for the bi-directional network flow, wherein the respective state tracking entry comprises at least an indication of a packet transformation descriptor;
- and
- in response to determining that a packet of the bi-directional network flow has been received at the flow management service, perform, by the first direction primary node, state tracking for the packet and transmit at least one transformed packet corresponding to the received packet to a destination selected based at least in part on the packet transformation descriptor, wherein the first direction secondary node is configured to take over responsibilities of the first direction primary node responsive to the primary node being unreachable or failing, and the second direction secondary node is configured to take over responsibilities of the second direction primary node responsive to the second direction primary node being unreachable or failing.
2 more elements
Dependencies are inferred from the claim text.