Traffic flow classification

• US 9,426,072 B2
• Filed: 03/21/2014
• Issued: 08/23/2016
• Est. Priority Date: 09/10/2013
• Status: Active Grant

• Current Assignee: Rakuten Symphony Incorporated (Rakuten Group, Inc.), Wal Mart Stores Inc (WalMart Inc.)
• Original Assignee: Robin Systems, Inc. (Rakuten Group, Inc.)
• Inventors: Ratzin, Rafit Izhak, Yeddanapudi, Krishna Satyasai, Venkatesan, Dhanashankar
• Primary Examiner(s): MATTIS, JASON E
• Application Number:
  US14/222,370
• Publication Number:
  US 20150071072A1
• Time in Patent Office: 886 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/815 Virtual
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/5038 considering the execution order of a plurality of tasks, e.g. taking priority or time dependency constraints into consideration scheduling strategies G06F9/4881 and subgroups
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]

Abstract

Systems and methods are disclosed for classifying traffic flows. A traffic agent operable to collect classification information for one or more traffic flows may be deployed at an end host communicatively coupled to a data-center network. The traffic agent, deployed in a user space independent of the operating system, may compare the classification information for a given traffic flow to a metric value. Where the classification information achieves a certain threshold indicated by the metric value, the traffic agent may classify the traffic flow as an elephant flow. In some examples, a library may be included with the traffic agent that may include a modified send function. The modified send function may provide classification information to the traffic agent indexed to the traffic flow for which it is called so that the traffic agent may analyze the classification information to potentially provide a classification for the traffic flow.

Claims

1. A system for classifying traffic flows comprising:

a traffic agent operable to be deployed at an end host within a user space in physical memory independent of a kernel space of the physical memory, the traffic agent running on the end host comprising the physical memory and a processor, the end host communicatively coupled to a data-center network comprising multiple end hosts and an intermediate network device, the traffic agent further operable to utilize a library within the traffic agent to monitor traffic flows originating at the end host;

a send function provided with the library operable to send at least one frame/packet pertaining to the individual traffic flow from a socket at the end host;

a collection module within the traffic agent and operable to collect classification information for at least one traffic flow originating at the end host;

a classification module within the traffic agent and operable to classify an individual traffic flow from the at least one traffic flow as an elephant flow where at least one value of the classification information for the individual traffic flow exceeds a corresponding threshold value for a flow metric; and

the collection module comprising a portion of the send function operable to copy the classification information from a call to the send function for classification analysis by the classification module.

2. The system of claim 1, wherein:

the traffic agent is further operable to monitor multiple virtual computing instances supported by the end host;

the collection module is further operable to collect classification information for individual traffic flows from the multiple virtual computing instances; and

the classification module is further operable to compare the classification information collected for the individual traffic flows from the multiple virtual computing instances to the threshold value for the flow metric for individual determinations with respect to the individual traffic flows to classify a subset of the individual traffic flows as at least one elephant flow.

3. The system of claim 1, further comprising an aggregation module within the traffic agent, the aggregation module operable to aggregate multiple sets of classification information for a common traffic flow for analysis by the classification module.

4. The system of claim 1, further comprising a timing module within the traffic agent and communicatively coupled to at least one of the collection module and the classification module, the timing module operable to:

track a timing interval over which classification information is collected by the collection module for the individual traffic flow; and

insure that the classification module only considers classification information for the individual traffic flow collected by the collection module during the timing interval.

5. The system of claim 1, further comprising an application interface module within the traffic agent,

the application interface module operable to:

extract classification information for a subject traffic flow from a request made to at least one of the end host and a virtual computing instance running on the end host to generate the subject traffic flow; and

communicate the classification information to the classification module.

6. The system of claim 1, further comprising a socket intercept module within the collection module, the socket interface module operable to intercept function calls pertaining to a pre-existing socket application programming interface to allow the collection module to copy classification information relevant to the at least one traffic flow.

7. The system of claim 1, wherein the traffic agent is operable to interface with a range of socket types provided by a range of operating systems.

8. A method for detecting large flows in a data-center network comprising:

provisioning a library to an end host communicatively coupled to a data-center network, the library comprising a send function operable to send frames/packets from a socket at the end host and to capture classification information related to the frames/packets;

collecting, from within a user space at the end host, classification information collected by the send function for a traffic flow;

comparing the classification information for the traffic flow to a flow metric value; and

classifying the traffic flow as a large flow where a value in the classification information achieves the flow metric value.

9. The method of claim 8, further comprising limiting collection of classification information for the traffic flow for classification relative to the flow metric value to a time period.

10. The method of claim 9, further comprising dynamically changing the time period in response to conditions in the data-center network.

11. The method of claim 8, further comprising acquiring classification information from a call to a send function to send frames/packets from the end host over the data-center network.

12. The method of claim 8, further comprising:

collecting a set of classification information for each traffic flow of a plurality of traffic flows generated by a plurality of virtual computing instances residing at the end host;

comparing at least one value of the set of classification information for each traffic flow of the plurality of traffic flows individually to the flow metric value; and

classifying a large flow achieving the flow metric value in the at least one value.

13. The method of claim 8, further comprising informing classification of the traffic flow originating at the end host based on information about the traffic flow from an application generating the traffic flow.

14. The method of claim 8, further comprising aggregating classification information pertaining to a common traffic flow for classification analysis.

15. A system for classifying traffic flows comprising:

an end host communicatively coupled to a data-center network;

an operating system residing at the end host;

a traffic agent residing within a user space at the end host independent of a kernel space of the operating system, a library within the traffic agent;

an altered send function, within the library, the altered send function altered to copy classification information from a call of the send function enabling the traffic agent to;

monitor a traffic flow generated at the end host for a period of time;

compile classification information for the traffic flow;

the traffic agent further operable to;

compare the classification information to a metric value; and

classify the traffic flow as an elephant flow where the classification information achieves a predetermined level relative to the metric value.

16. The system of claim 15, further comprising:

multiple virtual computing instances supported at the end host by the operating system; and

the traffic agent further operable to monitor a plurality of traffic flows from the multiple virtual computing instances.

17. The system of claim 15, wherein the traffic agent is operable to interface with different operating systems.