Inspecting operations of a machine to detect elephant flows

A method for detecting an elephant flow by inspecting the operations of a virtual machine (VM) that operates on a physical host computer, the method comprising:

• at a detector executing within virtualization software of the physical host computer;
• receiving information from an agent executing on the VM regarding a file transfer initiated by an application executing on the VM, the information comprising a size of the file to be transferred and a data flow associated with the file transfer;
• determining that the file size exceeds a threshold value;
• in response to the determination, specifying the data flow associated with the file transfer as an elephant flow;
• and
• reporting that the data flow is an elephant flow, wherein a managed forwarding element that forwards data packets for the VM is configured to process the data associated with the detected elephant flow differently from other flows not detected as elephant flows.

A method for detecting an elephant flow by inspecting the operations of a machine that operates on a physical host computer, the method comprising:

• at a detector operating on the physical host computer:
• receiving information from an agent executing on the machine via a multiplexer module, the information regarding a file transfer initiated by an application executing on the machine and comprising a size of the file to be transferred and a data flow associated with the file transfer, wherein the detector registers with the multiplexer module to receive a notification each time the agent provides information regarding initiation of a file transfer on the machine;
• determining that the file size exceeds a threshold value;
• in response to the determination, specifying the data flow associated with the file transfer as an elephant flow;
• and
• reporting that the data flow is an elephant flow, wherein a managed forwarding element that forwards data packets for the machine is configured to process the data associated with the detected elephant flow differently from other flows not detected as elephant flows.

A non-transitory machine-readable medium storing a detector program that when executed by at least one processing unit of a physical host computer detects an elephant flow by inspecting the operations of a first virtual machine (VM) that operates on the physical host computer, the detector program executing within a second VM operating on the physical host computer and comprising sets of instructions for:

• receiving information from an agent executing on the first VM regarding a file transfer initiated by an application executing on the first VM, the information comprising a size of the file to be transferred and a data flow associated with the file transfer:
• determining that the file size exceeds a threshold value;
• in response to the determination, specifying the data flow associated with the file transfer as an elephant flow;
• and
• reporting that the data flow is an elephant flow, wherein a managed forwarding element that forwards data packets for the first VM is configured to process the data associated with the detected elephant flow differently from other flows not detected as elephant flows.

A non-transitory machine-readable medium storing a detector program that when executed by at least one processing unit of a physical host computer detects an elephant flow by inspecting the operations of a machine that operates on the physical host computer, the detector program comprising sets of instructions for:

• receiving information from an agent executing on the machine via a multiplexer module, the information regarding a file transfer initiated by an application executing on the machine and comprising a size of the file to be transferred and a data flow associated with the file transfer, wherein the detector registers with the multiplexer module to receive a notification each time the agent provides information regarding initiation of a file transfer on the machine;
• determining that the file size exceeds a threshold value;
• in response to the determination, specifying the data flow associated with the file transfer as an elephant flow;
• and
• reporting that the data flow is an elephant flow, wherein a managed forwarding element that forwards data packets for the machine is configured to process the data associated with the detected elephant flow differently from other flows not detected as elephant flows.