Detecting an elephant flow based on the size of a packet

• US 9,548,924 B2
• Filed: 03/31/2014
• Issued: 01/17/2017
• Est. Priority Date: 12/09/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Pettit, Justin, Casado, Martin, Koponen, Teemu, Davie, Bruce, Lambeth, W. Andrew
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Application Number:
  US14/231,652
• Publication Number:
  US 20150163142A1
• Time in Patent Office: 1,023 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 49/252 Store and forward routing
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/3018 Input queuing
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Some embodiments provide a forwarding element that inspects the size of each of several packets in a data flow to determine whether the data flow is an elephant flow. The forwarding element inspects the size because, in order for the packet to be of a certain size, the data flow had to already have gone through a slow start in which smaller packets are transferred and by definition be an elephant flow. When the forwarding element receives a packet in a data flow, the forwarding element identifies the size of the packet. The forwarding element then determines if the size of the packet is greater than a threshold size. If the size is greater, the forwarding element specifies that the packet'"'"'s data flow is an elephant flow.

Claims

1. A non-transitory machine readable medium on which a program is stored, which when executed by at least one processing unit detects elephant flows, the program comprising sets of instructions for:

receiving a packet associated with a data flow;

when the size of the packet is below a threshold size, using a first flow entry to process the packet in a kernel space of the forwarding element; and

when the size of the packet is over the threshold size;

using the first flow entry to send the packet to a daemon;

replacing the first flow entry with a second flow entry based on a response from the daemon, wherein the second flow entry processes subsequent packets of the data flow in the kernel space as packets of an elephant flow; and

processing the packet based on the response from the daemon.

2. The non-transitory machine readable medium of claim 1, wherein the packet is associated with a protocol that utilizes a slow start algorithm in which the size of each packet increases with each successful transmission until the size of the packet size reaches a particular size or until a packet loss occurs.

3. The non-transitory machine readable medium of claim 2, wherein the protocol is Transmission Control Protocol (TCP).

4. The non-transitory machine readable medium of claim 1, wherein the set of instructions for using the first flow entry to process the packet comprises a set of instructions for sending the packet to a first port specified in the first flow entry, and the set of instructions for processing the packet based on the response from the daemon comprises a set of instructions for sending the packet to a second port specified in the response.

5. The non-transitory machine readable medium of claim 1, wherein the program does not examine the sizes of all packets but only examine the sizes of certain packets associated with one or more network hosts.

6. The non-transitory machine readable medium of claim 1, wherein the flow entries are stored in a flow table cache of the forwarding element to forward packets for a network host.

7. The non-transitory machine readable medium of claim 1, wherein the first flow entry comprises a conditional action to examine the size of the packet and the second flow entry does not include a conditional action to examine the size of the packet.

8. The non-transitory machine medium of claim 1, wherein the program further comprises a set of instructions for sending the packet to a network interface controller (NIC), wherein the NIC receives the packet and segments the packet into a set of one or more maximum transmission unit (MTU) sized packets.

9. The non-transitory machine readable medium of claim 8, wherein the MTU size is less than the threshold size.

10. The non-transitory machine readable medium of claim 1, wherein the set of instructions for using the first flow entry to send the packet to the daemon comprises a set of instructions for identifying information associated with the packet in order to identify other packets in the same elephant flow.

11. The non-transitory machine readable medium of claim 10, wherein the information includes at least one of tunnel information, an ingress port of the packet, a source transport layer protocol port number, a destination transport layer port number, an Ethernet type, a source Ethernet address, a destination Ethernet address, a source IP address, and a destination IP address.

12. For a forwarding element, a method of detecting elephant flows, the method comprising:

receiving a packet associated with a data flow;

when the size of the packet is below a threshold size, using a first flow entry to process the packet in a kernel space of the forwarding element; and

when the size of the packet is over the threshold size;

using the first flow entry to send the packet to a daemon;

replacing the first flow entry with a second flow entry based on a response from the daemon, wherein the second flow entry processes subsequent packets of the data flow in the kernel space as packets of an elephant flow; and

processing the packet based on the response from the daemon.

13. The method of claim 12, wherein the packet is associated with a protocol that utilizes a slow start algorithm in which the size of each packet increases with each successful transmission until the packet size reaches a particular size or until a packet loss occurs.

14. The method of claim 13, wherein the protocol is Transmission Control Protocol (TCP).

15. The method of claim 12, wherein the flow entries are stored in a flow table cache of the forwarding element to forward packets for a network host.

16. The method of claim 15, wherein the first flow entry comprises a conditional action to examine the size of the packet and the second flow entry does not include a conditional action to examine the size of the packet.

17. The method of claim 12 further comprising sending the packet to a network interface controller (NIC), wherein the NIC receives the packet and segments the packet into a set of one or more maximum transmission unit (MTU) sized packets.

18. The method of claim 12, wherein using the first flow entry to send the packet to the daemon comprises identifying information associated with the packet in order to identify other packets in the same elephant flow.

19. A network system comprising:

a plurality of edge physical forwarding elements that are each directly coupled to at least one network host and configured to (i) examine packet sizes of packets from the coupled network hosts to detect elephant flows based on a threshold size for the packets, (ii) use a first flow entry to process a particular packet in a kernel space of the edge physical forwarding element when the size of the particular packet is below a threshold size, and (iii) when the particular packet is over the threshold size, use the first flow entry to send the packet to a daemon, replace the first flow entry with a second flow entry based on a response from the daemon, and process the packet based on the response from the daemon, wherein the second flow entry processes subsequent packets of the data flow in the kernel space as packets of an elephant flow; and

a plurality of non-edge physical forwarding elements that are not directly coupled to any network hosts, wherein each non-edge physical forwarding element is configured to forward packets for the network hosts between edge physical forwarding elements.

20. The network of claim 19, wherein the plurality of edge physical forwarding elements and the plurality of non-edge physical forwarding elements collectively implement a number of logical forwarding elements for different entities.