Detecting an elephant flow based on the size of a packet

• US 9,838,276 B2
• Filed: 01/03/2017
• Issued: 12/05/2017
• Est. Priority Date: 12/09/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Pettit, Justin, Casado, Martin, Koponen, Teemu, Davie, Bruce, Lambeth, W. Andrew
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Application Number:
  US15/397,676
• Publication Number:
  US 20170118090A1
• Time in Patent Office: 336 Days
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 49/252 Store and forward routing
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/3018 Input queuing
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Some embodiments provide a forwarding element that inspects the size of each of several packets in a data flow to determine whether the data flow is an elephant flow. The forwarding element inspects the size because, in order for the packet to be of a certain size, the data flow had to already have gone through a slow start in which smaller packets are transferred and by definition be an elephant flow. When the forwarding element receives a packet in a data flow, the forwarding element identifies the size of the packet. The forwarding element then determines if the size of the packet is greater than a threshold size. If the size is greater, the forwarding element specifies that the packet'"'"'s data flow is an elephant flow.

Claims

1. A method for detecting elephant flows at a forwarding element, the method comprising:

prior to receiving any data packets above a threshold size belonging to a particular data flow, processing the data packets belonging to the particular data flow in a datapath of the forwarding element;

upon receiving a first data packet above the threshold size belonging to the particular data flow, sending the first data packet to a module of the forwarding element outside the datapath that processes the particular data flow as an elephant flow; and

processing subsequent data packets belonging to the particular data flow in the datapath of the forwarding element as elephant flow packets irrespective of the size of the subsequent data packets.

2. The method of claim 1, wherein the data packets belonging to the particular data flow are associated with a protocol that utilizes a slow start algorithm in which the size of each data packet increases with each successful transmission until one of (i) the data packet size reaches a particular size and (ii) packet loss occurs.

3. The method of claim 1, wherein processing the data packets belonging to the particular data flow in the datapath prior to receiving any data packets above the threshold size comprises sending said data packets to a first port of the forwarding element.

4. The method of claim 1, wherein processing the data packets belonging to the particular flow in the datapath comprises processing the packets using cached forwarding data.

5. The method of claim 1, wherein the module outside the datapath is a user space module for processing packets that the datapath is unable to handle.

6. The method of claim 5, wherein the datapath is a kernel datapath.

7. The method of claim 1, wherein (i) processing the data packets in the datapath prior to receiving any data packets above a threshold size comprises processing the data packets according to a first flow entry and (ii) processing the subsequent packets in the datapath as elephant flow packets comprises processing the data packets according to a second flow entry that replaces the first flow entry.

8. The method of claim 7, wherein the first flow entry specifies sending the first data packet above the threshold size to the module outside the datapath.

9. The method of claim 1, wherein sending the first data packet to the module outside the datapath comprises sending identifying information associated with the first data packet that identifies all packets in the data flow.

10. The method of claim 9, wherein the identifying information comprises at least one of tunnel information, an ingress port, a transport layer protocol port number, an Ethertype, a MAC address, and an IP address.

11. A non-transitory machine readable medium storing a program which when executed by at least one processing unit detects elephant flows at a forwarding element, the program comprising sets of instructions for:

prior to receiving any data packets above a threshold size belonging to a particular data flow, processing the data packets belonging to the particular data flow in a datapath of the forwarding element;

upon receiving a first data packet above the threshold size belonging to the particular data flow, sending the first data packet to a module of the forwarding element outside the datapath that processes the particular data flow as an elephant flow; and

processing subsequent data packets belonging to the particular data flow in the datapath of the forwarding element as elephant flow packets irrespective of the size of the subsequent data packets.

12. The non-transitory machine readable medium of claim 11, wherein the data packets belonging to the particular data flow are associated with a protocol that utilizes a slow start algorithm in which the size of each data packet increases with each successful transmission until one of (i) the data packet size reaches a particular size and (ii) packet loss occurs.

13. The non-transitory machine readable medium of claim 11, wherein the set of instructions for processing the data packets belonging to the particular data flow in the datapath prior to receiving any data packets above the threshold size comprises a set of instructions for sending said data packets to a first port of the forwarding element.

14. The non-transitory machine readable medium of claim 11, wherein the set of instructions for processing the data packets belonging to the particular flow in the datapath comprises a set of instructions for processing the packets using cached forwarding data.

15. The non-transitory machine readable medium of claim 11, wherein the module outside the datapath is a user space module for processing packets that the datapath is unable to handle.

16. The non-transitory machine readable medium of claim 15, wherein the datapath is a kernel datapath.

17. The non-transitory machine readable medium of claim 11, wherein (i) the set of instructions for processing the data packets in the datapath prior to receiving any data packets above a threshold size comprises a set of instructions for processing the data packets according to a first flow entry and (ii) the set of instructions for processing the subsequent packets in the datapath as elephant flow packets comprises a set of instructions for processing the data packets according to a second flow entry that replaces the first flow entry.

18. The non-transitory machine readable medium of claim 17, wherein the first flow entry specifies sending the first data packet above the threshold size to the module outside the datapath.

19. The non-transitory machine readable medium of claim 11, wherein the set of instructions for sending the first data packet to the module outside the datapath comprises a set of instructions for sending identifying information associated with the first data packet that identifies all packets in the data flow.

20. The non-transitory machine readable medium of claim 19, wherein the identifying information comprises at least one of tunnel information, an ingress port, a transport layer protocol port number, an Ethertype, a MAC address, and an IP address.