# US 11,444,883 B2 · Signature based management of packets in a software defined networking environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,883 B2 - Document ID: US11444883B2 - Status: Granted - Kind: B2 - Application number: 16/746,043 - Filed: 2020-01-17 - Published: 2021-07-22 - Granted: 2022-09-13 - Earliest claimed: 2020-01-17 - Assignees: VMware, Inc. - Applicants: VMware Inc. - Inventors: Senthilkumar Karunakaran; Chidambareswaran Raman; Neha Repal - Web page: https://patentgrep.com/patent/US11444883B2 ## CPC - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 41/0803: Configuration setting - H04L 41/342: between virtual entities, e.g. orchestrators, SDN or NFV entities - H04L 47/33: using forward notification - H04L 49/70: {Virtual switches} - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Certain embodiments described herein are generally directed to a method for managing packets at a virtual forwarding element of a hypervisor. In one example, the method includes receiving a first plurality of packets at a virtual port of the virtual forwarding element. The method further includes detecting the first plurality of packets correspond to a signature configured at the virtual port. The method also includes dropping at least one packet of the first plurality of packets at the virtual port based on detecting the first plurality corresponds to the signature. The method further includes receiving a second plurality of packets at the virtual port of the virtual forwarding element, wherein the second plurality of packets do not correspond to the signature. The method also includes forwarding the second plurality of packets to one or more destinations by the virtual forwarding element. ## Claims ### Claim 1 A method for managing packets at a virtual forwarding element of a hypervisor, the virtual forwarding element being one of a virtual switch or a virtual router, the method comprising: receiving a first plurality of packets from a first virtual machine at a first virtual port of the virtual forwarding element, the first virtual machine and virtual forwarding element running on a host machine; detetecting that the first plurality of packets correspond to a signature, wherein the virtual forwarding element is assaociated with a port-specific configuration to drop packets recieved at the first virtual port that correspond to the signature; dropping at least one packet of the first plurality of packets at the first virtual port based on the detecting that the first plurality of packets correspond to the signature; receiving a second plurality of packets at the first virtual port of the virtual forwarding element, wherein the second plurality of packets do not correspond to the signature; forwarding the second plurality of packets to one or more first destinations by the virtual forwarding element; receiving a third plurality of packets from a second virtual machine at a second virtual port of the virtual forwarding element, the second virtual machine running on the host machine, wherein the third plurality of packets correspond to the signature; and forwarding the third plurality of packets to one or more second destinations by the virtual forwarding element. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving a fourth plurality of packets at the first virtual port; detecting the fourth plurality of packets correspond to the signature; causing a notification to be transmitted to a management plane, the notification including information indicative of the signature; and receiving instructions from the management plane, wherein: the instructions configure the virtual forwarding element to drop at least one packet of a subsequent plurality of packets received at the first virtual port that satisfy the signature; and the subsequent plurality of packets include the first plurality of packets. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving a fourth plurality of packets at the second virtual port; detecting the fourth plurality of packets correspond to the signature; causing a notification to be transmitted to a management plane, the notification including information indicative of the signature; and receiving instructions from the management plane, wherein: the instructions configure the virtual forwarding element to forward a subsequent plurality of packets received at the second virtual port that satisfy the signature; and the subsequent plurality of packets include the third plurality of packets. ### Claim 4 (depends on 1) The method of claim 1, wherein the signature is based on one or more characteristics of the first plurality of packets, the one or more characteristics comprising one or more of: an Internet Protocol (IP) address associated with the first plurality of packets, a number of packets in the first plurality of packets received during a defined time frame, and a time period in which the first plurality of packets are received. ### Claim 5 (depends on 1) The method of claim 1, wherein multiple different signatures are configured at the first virtual port including the signature. ### Claim 6 (depends on 1) The method of claim 1, wherein the at least one packet of the first plurality of packets is a last packet of the first plurality of packets received at the first virtual port. ### Claim 7 A computer system, comprising: a memory comprising executable instructions; and a processor in data communication with the memory and configured to execute the instructions to cause the computer system to perform a method of managing packets at a virtual forwarding element of a hypervisor of the computer system, the virtual forwarding element being one of a virtual switch or a virtual router, the method comprising: receiving a first plurality of packets from a first virtual machine at a first virtual port of the virtual forwarding element, the first virtual machine and virtual forwarding element running on a host machine; detecting that the first plurality of packets correspond to a signature, wherein the virtual forwarding element is associated with a port-specific configuration to drop packets recieved at the first virtual port that correspond to the signature; dropping at least one packet of the first plurality of packets at the fisrt virtual port based on the detecting that the first plurality of packets correspond to the signature; receiving a second plurality of packets at the first virtual port of the virtual forwarding element, wherein the second plurality of packets do not correspond to the signature; forwarding the second plurality of packets to one or more first destinations by the virtual forwarding element; receiving a third plurality of packets from a second virtual machine at a second virtual port of the virtual forwarding element, the second virtual machine running on the host machine, wherein the third plurality of packets correspond to the signature; and forwarding the third plurality of packets to one or more second destinations by the virtual forwarding element. ### Claim 8 (depends on 7) The computer system of claim 7, wherein the method further comprises: receiving a fourth plurality of packets at the first virtual port; detecting the fourth plurality of packets correspond to the signature; causing a notification to be transmitted to a management plane, the notification including information indicative of the signature; and receiving instructions from the management plane, wherein: the instructions configure the virtual forwarding element to drop at least one packet of a subsequent plurality of packets received at the first virtual port that satisfy the signature; and the subsequent plurality of packets include the first plurality of packets. ### Claim 9 (depends on 7) The computer system of claim 7, wherein the method further comprises: receiving a fourth plurality of packets at the second virtual port; detecting the fourth plurality of packets correspond to the signature; causing a notification to be transmitted to a management plane, the notification including information indicative of the signature; and receiving instructions from the management plane, wherein: the instructions configure the virtual forwarding element to forward a subsequent plurality of packets received at the second virtual port that satisfy the signature; and the subsequent plurality of packets include the third plurality of packets. ### Claim 10 (depends on 7) The computer system of claim 7, wherein the signature is based on one or more characteristics of the first plurality of packets, the one or more characteristics comprising one or more of: an Internet Protocol (IP) address associated with the first plurality of packets, a number of packets in the first plurality of packets received during a defined time frame, and a time period in which the first plurality of packets are received. ### Claim 11 (depends on 7) The computer system of claim 7, wherein multiple different signatures are configured at the first virtual port including the signature. ### Claim 12 (depends on 7) The computer system of claim 7, wherein the at least one packet of the first plurality of packets is a last packet of the first plurality of packets received at the first virtual port. ### Claim 13 A non-transitory computer readable medium having instructions stored thereon that, when executed by a computer system, cause the computer system to perform a method comprising: receiving a first plurality of packets from a first virtual machine at a first virtual port of a virtual forwarding element of a hypervisor of the computer system, the virtual forwarding element being one of a virtual switch or a virtual router, the first virtual machine and the virtual forwarding element running on a host machine; detecting that the first plurality of packets correspond to a signature, wherein the virtual forwarding element is associated with a port-specific configuration to drop packets recieved at the first virtual port that correspond to the signature; dropping at least one packet of the first plurality of packets at the first virtual port based on the detecting that the first plurality of packets correspond to the signature; receiving a second plurality of packets at the first virtual port of the virtual forwarding element, wherein the second plurality of packets do not correspond to the signature; forwarding the second plurality of packets to one or more first destinations by the virtual forwarding element; receiving a third plurality of packets from a second virtual machine at a second virtual port of the virtual forwarding element, the second virtual machine running on the host machine, wherein the third plurality of packets correspond to the signature; and forwarding the third plurality of packets to one or more second destinations by the virtual forwarding element. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the method further comprises: receiving a fourth plurality of packets at the first virtual port; detecting the fourth plurality of packets correspond to the signature; causing a notification to be transmitted to a management plane, the notification including information indicative of the signature; and receiving instructions from the management plane, wherein: the instructions configure the virtual forwarding element to drop at least one packet of a subsequent plurality of packets received at the first virtual port that satisfy the signature; and the subsequent plurality of packets include the first plurality of packets. ### Claim 15 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the method further comprises: receiving a fourth plurality of packets at the second virtual port; detecting the fourth plurality of packets correspond to the signature; causing a notification to be transmitted to a management plane, the notification including information indicative of the signature; and receiving instructions from the management plane, wherein: the instructions configure the virtual forwarding element to forward a subsequent plurality of packets received at the second virtual port that satisfy the signature; and the subsequent plurality of packets include the third plurality of packets. ### Claim 16 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the signature is based on one or more characteristics of the first plurality of packets, the one or more characteristics comprising one or more of: an Internet Protocol (IP) address associated with the first plurality of packets, a number of packets in the first plurality of packets received during a defined time frame, and a time period in which the first plurality of packets are received. ### Claim 17 (depends on 13) The non-transitory computer readable medium of claim 13, wherein multiple different signatures are configured at the first virtual port including the signature. ### Claim 18 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the at least one packet of the first plurality of packets is a last packet of the first plurality of packets received at the first virtual port.