Reducing ARP/ND flooding in cloud environment

• US 10,659,283 B2
• Filed: 07/08/2016
• Issued: 05/19/2020
• Est. Priority Date: 07/08/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Nainar, Nagendra Kumar, Asati, Rajiv, Pignataro, Carlos M.
• Primary Examiner(s): Kading, Joshua
• Application Number:
  US15/206,113
• Publication Number:
  US 20180013611A1
• Time in Patent Office: 1,411 Days
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 45/32 Flooding denial of service attacks H04L63/1458
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/66 Layer 2 routing, e.g. in Ethernet based MAN's
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/50 Address allocation

Abstract

Aspects of the embodiments are directed to receiving an address resolution protocol (ARP) request message from a requesting virtual machine, the ARP request message comprising a request for a destination address for a destination virtual machine, wherein the destination address comprises one or both of a destination hardware address or a destination media access control address; augmenting the ARP request message with a network service header (NSH), the NSH identifying an ARP service function; and forwarding the augmented ARP request to the ARP service function.

Claims

1. One or more computer readable, non-transitory storage media encoded with software comprising computer executable instructions and, when the software is executed, operable to:

receive an address resolution protocol (ARP) request message from a requesting virtual machine, the ARP request message comprising a request for a destination address for a destination virtual machine, the destination address comprising a destination hardware address and a destination media access control address;

augment the ARP request message with a network service header (NSH), the NSH identifying an ARP service function;

forward the ARP request message with the NSH to the ARP service function;

when the destination address for the destination virtual machine is not present in an ARP service function database, receive an ARP reply message from the ARP service function with a flag indicating no entry;

when the destination address for the destination virtual machine is present in the ARP service function database and the destination address is not local, receive the ARP reply message from the ARP service function with a flag indicating the destination address; and

determine, from the ARP reply message, whether the destination address for the destination virtual machine is present in the ARP service function database based on the flag indicating no entry or the flag indicating the destination address.

2. The one or more computer readable, non-transitory storage media of claim 1, wherein the software is further operable to:

forward the ARP reply message to the requesting virtual machine if it is determined that the destination virtual machine is present in the ARP service function database, the ARP reply message including the destination address for the destination virtual machine.

3. The one or more computer readable, non-transitory storage media of claim 2, wherein the software is further operable to:

update a forwarding table with the destination address for the destination virtual machine if it is determined that the destination virtual machine is present in the ARP service function database.

4. The one or more computer readable, non-transitory storage media of claim 1, wherein the software is further operable to:

transmit the ARP request message to one or more network elements in a network if it is determined that the destination address for the destination virtual machine is not present in the ARP service function database.

5. The one or more computer readable, non-transitory storage media of claim 1, wherein the flag indicating no entry is an indication in metadata and the flag indicating the destination address is another indication in metadata.

6. A network element for performing address resolution, the network element comprising:

at least one memory element having instruction stored thereon;

a service classifier node; and

at least one processor coupled to the at least one memory element and configured to execute the instructions to cause the service classifier node to;

receive an address resolution protocol (ARP) request message from a requesting virtual machine, the ARP request message comprising a request for a destination address for a destination virtual machine, the destination address comprising a destination hardware address and a destination media access control address;

augment the ARP request message with a network service header (NSH), the NSH identifying an ARP service function;

forward the ARP request message with the NSH to the ARP service function;

when the destination address for the destination virtual machine is not present in an ARP service function database, receive an ARP reply message from the ARP service function with a flag indicating no entry;

when the destination address for the destination virtual machine is present in the ARP service function database and the destination address is not local, receive the ARP reply message from the ARP service function with a flag indicating the destination address; and

determine, from the ARP reply message, whether the destination address for the destination virtual machine is present in the ARP service function database based on the flag indicating no entry or the flag indicating the destination address.

7. The network element of claim 6, wherein the at least one processor is configured to cause the network element to:

forward the ARP reply message to the requesting virtual machine if it is determined that the destination virtual machine is present in the ARP service function database, the ARP reply message including the destination address for the destination virtual machine.

8. The network element of claim 7, wherein the at least one processor is configured to cause the network element to:

update a forwarding table with the destination address for the destination virtual machine if it is determined that the destination virtual machine is present in the ARP service function database.

9. The network element of claim 7, wherein the at least one processor is configured to cause the network element to:

transmit the ARP request message to one or more network elements in a network if it is determined that the destination address for the destination virtual machine is not present in the ARP service function database.