In general, techniques are described for configuring and managing virtual networks. For example, a distributed virtual network controller is described that configures and manages an overlay network within a physical network formed by plurality of switches. A plurality of servers are interconnected by the switch fabric, each of the servers comprising an operating environment executing one or more virtual machines in communication via the overlay networks. The servers comprises a set of virtual switches that extends the overlay network as a virtual network to the operating environment of the virtual machines. The controller may instruct the servers and the virtual switches to perform various operations, such as determining a physical network path taken by packets of a network packet flow, determining latency through the network, re-routing traffic in the virtual network due to network events, replicating traffic for multicasting, providing multi-tenant services to support multiple virtual networks, monitoring and logging traffic characteristics within the virtual networks and other operations.

Physical path determination for virtual network packet flows

An OpenFlow switch controls transmission and reception of a packet according to a flow entry. Each of the flow entries contains a matching condition showing a communication flow of the packet and an action showing processing on the packet. An OpenFlow controller generate a registration flow entry which is stored in a flow table of a specific OpenFlow switch arranged on a route of the communication flow. An encapsulated packet is generated by reflating the registration flow entry and an ordinary packet. The specific OpenFlow switch extracts the registration flow entry from the encapsulated packet in response to the reception of the encapsulated packet to produce a new flow entry and executes the action shown in the new flow entry.

Openflow communication system and openflow communication method

A novel method for logically routing a packet between a source machine that is in a first logical domain and a destination machine that is in a second logical domain is described. The method configures a managed switching element as a second-level managed switching element. The method configures a router in a host that includes the second-level managed switching element. The method communicatively couples the second-level managed switching element with the router. The method causes the router to route a packet when the router receives a packet from the first logical domain that is addressed to the second logical domain.

Distributed logical l3 routing

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g, GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

Method and apparatus for implementing and managing virtual switches

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Network operating system for managing and securing networks

A network router includes a plurality of interfaces configured to send and receive packets, and a routing component comprising: (i) a routing engine that includes a control unit that executes a routing protocol to maintain routing information specifying routes through a network, and (ii) a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information. The forwarding plane comprises a switch fabric to forward the packets to the interfaces based on the selected next hops. The network router also includes a security plane configured to apply security functions to the packets. The security plane is integrated within the network router to share a streamlined forwarding plane of the routing component.

Streamlined packet forwarding using dynamic filters for routing and security in a shared forwarding plane

A network layer device controls provision of data link layer functionality by a data link layer device to provide a requested multimedia service to a subscriber. For example, the network layer device may control the performance of multicast elaboration by the data link layer device, or the queuing and forwarding of packets by the data link layer device to facilitate transmission of packets according to a Quality of Service class. The network layer device may send control messages to the data link layer device to dynamically configure a control object stored by the data link layer device, such as multicast filter information or a Quality of Service profile. The network layer device may be a service edge router, and the data link layer device may be a customer premises equipment device, e.g., a modem or wireless access point, or a switch, e.g., a digital subscriber line access multiplier.

Controlling data link layer elements with network layer elements

Techniques are described for providing session-aware, stateful network services to subscriber packet flows. Devices within a service provider network direct subscriber packets along service chains. Each tunnel is established to direct traffic according a particular ordered set of network services for the corresponding service chain. An ingress device for the tunnels encapsulate the subscriber packets and embed opaque session cookies that each uniquely identifies a collection of packet flows of a subscriber session amongst other packet flows transported by a given service tunnel. Each service node need only identify the tunnel on which a tunnel packet was received and the session cookie embedded within the tunnel packet to uniquely associate the encapsulated subscriber packet with a subscriber session, without needing to further inspect the encapsulated subscriber packet, and to index or otherwise retrieve state and statistics required to enforce the network service the service nod is programmed to deliver.

Session-aware service chaining within computer networks

A network controls provision of access functionality by an access node to provide a network service to a subscriber device. For example, the network device may control the queuing and forwarding of packets by the access node to facilitate packet transmission according to, for example, a Quality of Service class. The network device may send control messages to the access node to dynamically configure a control object stored by the access node, such as a Quality of Service profile. The network device may be a router, and the access node may be a base station that wireless communicates with a subscriber device, e.g., a cellular phone. The access node may then delivery the packets in accordance with the dynamically configured control object.

Controlling access nodes with network transport devices within wireless mobile networks

In general, the invention is directed to techniques for offloading mobile data traffic from a mobile core network to a broadband network. For example, as described herein, a breakout gateway forwards a service request from a mobile device and addressed to a service node. The service node designates an access point name (APN) for offload such that data traffic associated with service requests specifying the designated APN is to be offloaded to an offload network. The service node receives the service requests from the breakout gateway and, if the service request specifies the designated APN, the service node sends a request to the breakout gateway. The breakout gateway receives the request and assigns a routable PDP address to the mobile device. An offload module on the breakout gateway redirects mobile data traffic to the offload network when the source PDP address of the traffic is the previously assigned PDP address.

Jerome P. Moisand

Papers

Streamlined packet forwarding using dynamic filters for routing and security in a shared forwarding plane

Controlling data link layer elements with network layer elements

Session-aware service chaining within computer networks

Controlling access nodes with network transport devices within wireless mobile networks

Offloading mobile traffic from a mobile core network