Congestion control enforcement in a virtualized environment

A computer system, comprising:

• a memory;
• a host processor configured to access the memory and to run one or more virtual machines and a hypervisor;;
• network interface hardware, which is configured to transmit and receive data packets over a data network, the hypervisor and the network interface hardware being trusted components;
• wherein the host processor is co-operative with the network interface hardware for performing the steps of:
• communicating data packet flows to and from the virtual machines over the data network via the network interface hardware;
• estimating congestion states in the data network attributable to respective packet flows;
• recognizing a new packet that belongs to one of the data packet flows;
• making a determination based on the congestion states that the new packet belongs to a congestion-producing packet flow;
• and
• applying a congestion-control policy to the new packet responsively to the determination, wherein the steps of making a determination and applying a congestion-control policy are performed by one or more of the trusted components.