Software tap for traffic monitoring in virtualized environment
AssigneeNicira, Inc.
InventorsZhenyu Gao, Jingchun Jiang
Life of this patent
Estimating the term…
Abstract
Some embodiments provide a system for lossless packet monitoring in a virtualized. The system, using a virtual tap, intercepts packets from a data compute node operating on a host machine, between the data compute node (DCN) and a managed forwarding element on the host. As part of the lossless packet mirroring, the virtual tap forwards data files related to the mirrored packets to a traffic monitoring. The traffic monitoring application stores the data received from the virtual tap and is capable of performing analytics on the stored data. In some embodiments, the system also includes a central controller that communicates with the other elements of the system to manage the traffic monitoring.
Claims20
A system for traffic monitoring in a virtualized environment comprising:
- a controller computer for managing traffic monitoring operations that execute on a set of host machines;
- and
- the set of host machines, each host machine in the set of host machines hosting:
- at least a first compute node for which traffic is monitored;
- a second compute node for monitoring traffic from the first compute node;
- a software managed forwarding element (SMFE);
- and
- a virtual tap for copying packet data sent from the first compute node to a port of the SMFE before the packet data is received at the port of the SMFE and sending the copied packet data to the second compute node of at least one of the host machines in the set of host machines.
A non-transitory machine readable medium storing a program that, when executed by at least one processing unit of a host machine performs traffic monitoring, the program comprising sets of instructions for:
- identifying packet data sent from a first compute node executing on the host machine to a port of a software managed forwarding element (SMFE) executing on the host machine;
- copying the packet data prior to the packet data being received at the port of the SMFE;
- and
- sending the copied packet data to a compute node in a set of compute nodes, said set of compute nodes each executing a traffic monitoring application.
Dependencies are inferred from the claim text.