Supporting programmability for arbitrary events in a software defined networking environment

• US 10,397,073 B2
• Filed: 03/15/2013
• Issued: 08/27/2019
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pfeifer, Jason, Pruss, Richard M., McDowall, John E.
• Primary Examiner(s): Winder, Patrice L
• Assistant Examiner(s): Widhalm De Rodrig, Angela M
• Application Number:
  US13/838,719
• Publication Number:
  US 20140280893A1
• Time in Patent Office: 2,356 Days
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Techniques are disclosed for using arbitrary criteria to define events occurring within a network infrastructure, as well and techniques for detecting and responding to the occurrence of such custom events. Doing so allows a collection of networking elements (switches, routers, etc.) to perform a variety of distributed functions from within the network itself to respond to custom events. Further, because custom events are published across the network, multiple network elements can communicate and respond to the same event. Thus, unlike currently available event management systems, custom events (and responding applications) can be used to create and coordinate software defined networking within a common network infrastructure.

Claims

1. A network device on which network events are processed in a software-defined networking (SDN)-enabled network, the network device comprising:

one or more computer processors;

a traffic management component comprising forwarding logic and a network control plane of a shared network infrastructure;

an event monitor component; and

a memory storing a container, independent from the traffic management component and the event monitor component, the container providing an execution space on the network device for hosting a first custom SDN application of a user of the network device;

wherein the event monitor component, when executed by the one or more computer processors, performs an operation comprising;

identifying a definition for a custom network event that is defined by the user of the network device, wherein the definition specifies;

(i) an identifier of the custom network event;

(ii) an event type of the custom network event; and

(iii) one or more functions to execute in the execution space of the container in response to occurrences of the custom network event;

wherein the custom network event comprises a compound of distinct network events;

registering a callback function of the first custom SDN application, whereby the first custom SDN application is notified of occurrences of the custom network event;

upon detecting an occurrence of the custom network event, invoking the registered callback function of the first custom SDN application, whereupon the first custom SDN application is configured to cause execution of the one or more functions specified in the definition of the custom network event, wherein invoking the registered callback function includes transmitting the identifier and event type of the custom network event to the first custom SDN application, wherein the network device comprises a first network device; and

propagating the custom network event from the first custom SDN application to a second custom SDN application in an absence of any registered callback function of the second custom SDN application, by publishing the custom network event via the network control plane of the shared network infrastructure to a second network device executing the second custom SDN application;

wherein the first network device is one of a switch and a router.

2. The network device of claim 1, wherein the forwarding logic makes forwarding decisions based on forwarding data.

3. The network device of claim 1, wherein the custom network event is generated in response to a service monitoring component executing on the network device determining that a monitored service metric has passed a threshold value.

4. The network device of claim 1, wherein the custom network event is generated in response to network traffic managed by the traffic management component being processed on the network device.

5. The network device of claim 1, wherein the event monitor component of the network device comprises an event monitor component of an operating system executing on the network device.

6. The network device of claim 1, wherein the one or more custom network events are defined based on evaluating network flows.

7. The network device of claim 1, wherein the first network device further includes a service monitoring component and an embedded event manager applet, wherein the container is independent from the service monitoring component and the embedded event manager applet;

wherein the service monitoring component is configured to monitoring a latency of a target host and, upon determining that a maximum allowable latency specified in an Internet Protocol (IP) service level agreement for the target host has been exceeded, publish a custom network event specifying that the maximum allowable latency has been exceeded; and

wherein the embedded event manager applet is registered to receive custom network events specifying that the maximum allowable latency has been exceeded, wherein the embedded event manager applet is configured to, upon receiving the custom network event specifying that the maximum allowable latency has been exceeded, propagate the custom network event to the second custom SDN application by publishing the custom network event via the network control plane of the shared network infrastructure, whereupon the second custom SDN application performs a remedial action in order to bring the latency of the target host back into compliance with the IP service level agreement.

8. A computer-implemented method for processing network events on a network device in a software-defined networking (SDN)-enabled network, the computer-implemented method comprising:

launching, in a container independent from a traffic management component and an event monitor component of the network device, a first custom SDN application of a user of the network device, wherein the container provides an execution space on the network device, wherein the network device is one of a switch and a router, wherein the traffic management component comprises forwarding logic and a network control plane of a shared network infrastructure;

identifying a definition of a custom network event that is defined by the user of the network device, wherein the definition specifies;

(i) an identifier of the custom network event;

(ii) an event type of the custom network event; and

(iii) one or more functions to execute in the execution space of the container in response to occurrences of the custom network event;

wherein the custom network event comprises a compound of distinct network events;

registering, by the event monitor component, a callback function of the first custom SDN application, whereby the application is notified of occurrences of the custom network event;

upon detecting an occurrence of the custom network event by the event monitor component, invoking, by one or more computer processors when executing the event monitor component, the registered callback function of the first custom SDN application, whereupon the first custom SDN application is configured to cause execution of the one or more functions specified in the definition of the custom network event, wherein invoking the registered callback function includes transmitting the identifier and event type of the custom network event to the first custom SDN application, wherein the network device comprises a first network device; and

propagating the custom network event from the first custom SDN application to a second custom SDN application in an absence of any registered callback function of the second custom SDN application, by publishing the custom network event via the network control plane of the shared network infrastructure to a second network device executing the second custom SDN application.

9. The computer-implemented method of claim 8, wherein the forwarding logic makes forwarding decisions based on forwarding data.

10. The computer-implemented method of claim 8, wherein the custom network event is generated in response to a service monitoring component executing on the network device determining that a monitored service metric has passed a threshold value.

11. The computer-implemented method of claim 8, wherein the custom network event is generated in response to network traffic managed by the traffic management component being processed on the network device.

12. The computer-implemented method of claim 8, wherein the event monitor component of the network device comprises an event monitor component of an operating system executing on the network device, wherein the forwarding logic makes forwarding decisions based on forwarding data, wherein the custom network event comprises a first custom network event.

13. The computer-implemented method of claim 12, wherein the network device comprises an aggregation switch connected to a network via an edge router and further connected to a plurality of hosts via a plurality of network switches, wherein the event monitor is configured to detect each custom network event type selected from:

(i) a first custom network event in which filtered metric data is sent on a periodic basis containing summary information of other events that have occurred within a specified time period; and

(ii) a second custom network event characterized by interface statistics changing over a specified time period correlated with associated interface configuration changes.

14. The computer-implemented method of claim 13, wherein the one or more custom network events are defined based on evaluating network flows and include a respective, custom network event for each network event type selected from:

(i) network events corresponding to switch functionality;

(ii) network events triggered using deep packet inspection;

(iii) network events related to quality of service;

(iv) network events related to service level agreements;

(v) network events triggered by entries in a system log;

(vi) network events triggered by interface states;

(vii) network events triggered by application of a specified forwarding rule;

(viii) network events to monitor changes in one or more link states of one or more interfaces on the network device; and

(ix) network events triggered upon detection of monitored latency of Internet Control Message Protocol (ICMP) responses satisfying a predefined latency threshold.

15. The computer-implemented method of claim 14, wherein the first custom network event is generated in response to, in respective instances:

(i) a service monitoring component executing on the network device determining that a monitored service metric has passed a threshold value; and

(ii) network traffic managed by the traffic management component being processed on the network device;

wherein the one or more custom network events further include a respective, custom network event pertaining to each network aspect selected from;

Online Insertion and Removal (OIR), Command Line Interface (CLI), a Syslog protocol, a remote procedure call (RPC) protocol, a NetFlow protocol, application-specific events, configuration changes, interface counters, a redundancy framework, a Simple Network Management Protocol (SNMP) notification, resource usage, timers, operating system processes, counters, diagnostics, temperature, routing, and object tracking;

wherein the one or more custom network events further include an insecure-email event that is defined to trigger upon detection of;

a message being sent via a Simple Mail Transfer Protocol (SMTP) connection with a recipient outside of a specified organization, the message including an attachment that includes a string “

confidential”

or a string “

secret”

.

16. The computer-implemented method of claim 15,

wherein the event monitor is configured to publish one or more custom network events to one or more other connected devices of each device type selected from switches, routers, and servers, wherein each custom network event is specifiable via a two-integer identification mechanism that includes an application identifier and an event type;

wherein the first network device further includes an embedded event manager applet, wherein the container is independent from the service monitoring component and the embedded event manager applet;

wherein the service monitoring component is configured to monitoring a latency of a target host and, upon determining that a maximum allowable latency specified in an Internet Protocol (IP) service level agreement for the target host has been exceeded, publish a custom network event specifying that the maximum allowable latency has been exceeded; and

wherein the embedded event manager applet is registered to receive custom network events specifying that the maximum allowable latency has been exceeded, wherein the embedded event manager applet is configured to, upon receiving the custom network event specifying that the maximum allowable latency has been exceeded, propagate the custom network event to the second custom SDN application by publishing the custom network event via the network control plane of the shared network infrastructure, whereupon the second custom SDN application performs a remedial action in order to bring the latency of the target host back into compliance with the IP service level agreement.

17. The computer-implemented method of claim 8, wherein the event monitor component of the network device comprises an event monitor component of an operating system executing on the network device.

18. The computer-implemented method of claim 8, wherein the first network device further includes a service monitoring component and an embedded event manager applet, wherein the container is independent from the service monitoring component and the embedded event manager applet;

wherein the service monitoring component is configured to monitoring a latency of a target host and, upon determining that a maximum allowable latency specified in an Internet Protocol (IP) service level agreement for the target host has been exceeded, publish a custom network event specifying that the maximum allowable latency has been exceeded; and

wherein the embedded event manager applet is registered to receive custom network events specifying that the maximum allowable latency has been exceeded, wherein the embedded event manager applet is configured to, upon receiving the custom network event specifying that the maximum allowable latency has been exceeded, propagate the custom network event to the second custom SDN application by publishing the custom network event via the network control plane of the shared network infrastructure, whereupon the second custom SDN application performs a remedial action in order to bring the latency of the target host back into compliance with the IP service level agreement.

19. A computer-readable storage medium storing instructions executable to perform an operation for processing network events on a network device in a software-defined networking (SDN)-enabled network, the operation comprising:

launching, in a container independent from a traffic management component and an event monitor component of the network device, a first custom SDN application of a user of the network device, wherein the container provides an execution space on the network device, wherein the network device is one of a switch and a router, wherein the traffic management component comprises forwarding logic and a network control plane of a shared network infrastructure;

identifying a definition of a custom network event that is defined by the user of the network device, wherein the definition specifies;

(i) an identifier of the custom network event;

(ii) an event type of the custom network event; and

(iii) one or more functions to execute in the execution space of the container in response to occurrences of the custom network event;

wherein the custom network event comprises a compound of distinct network events;

registering, by the event monitor component, a callback function of the first custom SDN application, whereby the first custom SDN application is notified of occurrences of the custom network event;

upon detecting an occurrence of the custom network event by the event monitor component, invoking, by one or more computer processors when executing the event monitor component, the registered callback function of the first custom SDN application, whereupon the first custom SDN application is configured to cause execution of the one or more functions specified in the definition of the custom network event, wherein invoking the registered callback function includes transmitting the identifier and event type of the custom network event to the first custom SDN application, wherein the network device comprises a first network device; and

propagating the custom network event from the first custom SDN application to a second custom SDN application in an absence of any registered callback function of the second custom SDN application, by publishing the custom network event via the network control plane of the shared network infrastructure to a second network device executing the second custom SDN application.

20. The computer-readable storage medium of claim 19, wherein the forwarding logic makes forwarding decisions based on forwarding data.

21. The computer-readable storage medium of claim 19, wherein the custom network event is generated in response to a service monitoring component executing on the network device determining that a monitored service metric has passed a threshold value.

22. The computer-readable storage medium of claim 19, wherein the custom network event is generated in response to network traffic managed by the traffic management component being processed on the network device.

23. The computer-readable storage medium of claim 19, wherein the event monitor component of the network device comprises an event monitor component of an operating system executing on the network device.

24. The computer-readable storage medium of claim 19, wherein the first network device further includes a service monitoring component and an embedded event manager applet, wherein the container is independent from the service monitoring component and the embedded event manager applet;

wherein the service monitoring component is configured to monitoring a latency of a target host and, upon determining that a maximum allowable latency specified in an Internet Protocol (IP) service level agreement for the target host has been exceeded, publish a custom network event specifying that the maximum allowable latency has been exceeded; and

wherein the embedded event manager applet is registered to receive custom network events specifying that the maximum allowable latency has been exceeded, wherein the embedded event manager applet is configured to, upon receiving the custom network event specifying that the maximum allowable latency has been exceeded, propagate the custom network event to the second custom SDN application by publishing the custom network event via the network control plane of the shared network infrastructure, whereupon the second custom SDN application performs a remedial action in order to bring the latency of the target host back into compliance with the IP service level agreement.