DETECTING AN ELEPHANT FLOW BASED ON THE SIZE OF A PACKET

• US 20150163142A1
• Filed: 03/31/2014
• Published: 06/11/2015
• Est. Priority Date: 12/09/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Pettit, Justin, Casado, Martin, Koponen, Teemu, Davie, Bruce, Lamberth, W. Andrew
• Granted Patent: US 9,548,924 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 49/252 Store and forward routing
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/3018 Input queuing
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Some embodiments provide a forwarding element that inspects the size of each of several packets in a data flow to determine whether the data flow is an elephant flow. The forwarding element inspects the size because, in order for the packet to be of a certain size, the data flow had to already have gone through a slow start in which smaller packets are transferred and by definition be an elephant flow. When the forwarding element receives a packet in a data flow, the forwarding element identifies the size of the packet. The forwarding element then determines if the size of the packet is greater than a threshold size. If the size is greater, the forwarding element specifies that the packet'"'"'s data flow is an elephant flow.

Claims

1. A non-transitory machine readable medium storing a program that when executed by at least one processing unit detects elephant flows, the program comprising sets of instructions for:

receiving a packet associated with a data flow;

determining whether the size of the packet is over a threshold size;

if the size is over, specifying the data flow associated with the packet as an elephant flow; and

processing the packet.

2. The non-transitory machine readable medium of claim 1, wherein the packet is associated with a protocol that utilizes a slow start algorithm in which the size of each packet increase with each successful transmission until the size of the packet reaches a particular size or until a packet loss occurs.

3. The non-transitory machine readable medium of claim 2, wherein the protocol is Transmission Control Protocol (TCP).

4. The non-transitory machine readable medium of claim 1, wherein the program does not perform any additional processing if the size of the packet is not over the threshold size.

5. The non-transitory machine readable medium of claim 1, wherein the program does not examine the sizes of all packets but only examine the sizes of certain packets associated with one or more network hosts.

6. The non-transitory machine readable medium of claim 5, wherein the packet is associated with a flow entry in a flow table cache to forward packets for a network host, wherein the program further comprises a set of instructions for performing the determination based on the flow entry.

7. The non-transitory machine readable medium of claim 6, wherein the flow entry comprises a conditional action to examine the size of the packet.

8. The non-transitory machine medium of claim 1, wherein the program further comprises a set of instructions for sending the packet to a network interface controller (NIC), wherein the NIC receives the packet and segments the packet into a set of one or more maximum transmission unit (MTU) sized packets.

9. The non-transitory machine readable medium of claim 8, wherein the MTU size is less than the threshold size.

10. The non-transitory machine readable medium of claim 1, wherein the specifying comprises a set of instructions for identifying one or more pieces of information associated with the packet in order to identify other packets in the same elephant flow.

11. The non-transitory machine readable medium of claim 10, wherein the information includes at least one of tunnel information, the packet'"'"'s ingress port, source transport layer protocol port number, destination transport layer port number, Ethernet type, source Ethernet address, destination Ethernet address, source IP address, and destination IP address.

15. The method of claim 11, wherein the packet is associated with a flow entry in a flow table cache to forward packets for a network host, the method further comprising performing the determination based on the flow entry.

16. The method of claim 15, wherein the flow entry comprises a conditional action to examine the size of the packet.

17. The method claim 11 further comprising sending the packet to a network interface controller (NIC), wherein the NIC receives the packet and segments the packet into a set of one or more maximum transmission unit (MTU) sized packets.

18. The method of claim 1, wherein the specifying comprises identifying one or more pieces of information associated with the packet in order to identify other packets in the same elephant flow.

12. For a forwarding element, a method of detecting elephant flows, the method comprising:

receiving a packet associated with a data flow;

determining whether the size of the packet is over a threshold size;

if the size is over, specifying the data flow associated with the packet as an elephant flow; and

processing the packet.

13. The method of claim 12, wherein the packet is associated with a protocol that utilizes a slow start algorithm in which the size of each packet increase with each successful transmission until the size of the packet reaches a particular size or until a packet loss occurs.

14. The method of claim 13, wherein the protocol is Transmission Control Protocol (TCP).

19. A network comprising:

a plurality of physical forwarding elements configured to examine packet size to detect elephant flows, each forwarding element communicatively coupled to at least one network host;

a network controller configured to establish a tunnel between at first and second network hosts, wherein at least one forwarding element examine the size of each packet sent over the tunnel from the first network host to the second network host, and at least one other forwarding element examines the size of each packet sent over the tunnel from the first network host to the second network host.

20. The network of claim 19, wherein the physical forwarding element collectively implement a number of logical forwarding elements for different entities.