Intelligent devices in a software-defined network

• US 9,917,775 B2
• Filed: 12/22/2015
• Issued: 03/13/2018
• Est. Priority Date: 12/22/2015
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, LLC
• Inventors: Mulka, Shivakrishna Anandam, Nair, Jayakrishnan
• Primary Examiner(s): Chery, Dady
• Application Number:
  US14/978,604
• Publication Number:
  US 20170180237A1
• Time in Patent Office: 812 Days
• Field of Search: 370248, 370254, 370392, 370401, 370252, 370253
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 45/26 Route discovery packet
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering

Abstract

There is disclosed a network device having a network interface; and one or more logic elements comprising a flow table engine operable to: receive a network packet via the network interface; perform a logging action to make the network packet traceable; and notify a software-defined networking (SDN) controller of the logging action via the network interface. There is also disclosed an SDN controller having a network interface; first one or more logic elements comprising a software-defined networking (SDN) controller engine to provide SDN controller services; and second one or more logic elements comprising a route tracing engine, operable to: receive a logging action for a network packet from a network device via the network interface; and update a logging table from the logging action. There is further disclosed a method of providing the foregoing, and computer-readable mediums for providing the foregoing.

Claims

1. A computing apparatus, comprising:

a network interface;

first one or more logic elements comprising a network function engine to provide a network function; and

second one or more logic elements comprising a flow table engine operable to;

receive a network packet via the network interface;

perform a logging action to make the network packet traceable, the logging action comprising;

inspecting a role tag of the packet, and determining that the network function has a role selected from a source device, an intermediate device, or a destination device based at least in part on the role tag; and

notify a software-defined networking (SDN) controller of the role via the network interface.

2. The computing apparatus of claim 1, wherein:

determining that the network function has a role as a source device comprises determining that the role tag is not set; and

the logging action comprises setting the role tag.

3. The computing apparatus of claim 2, wherein the role tag is a one-bit tag.

4. The computing apparatus of claim 1, wherein:

the flow table engine is further configured to inspect a source flow key; and

notifying the SDN controller of the role comprises adding the source flow key to a flow path table.

5. The computing apparatus of claim 4, wherein the source flow key comprises an internet protocol (IP) address or a media access control (MAC) address.

6. The computing apparatus of claim 1, wherein determining that the network function has a role as an intermediate device comprises determining that the role tag is set, and that the network function is not a destination of the network packet.

7. The computing apparatus of claim 1, wherein determining that the network function has a role as a destination device comprises determining that the role tag is set, and that the network function is a destination for the packet, and wherein the flow table engine is further to unset the role tag.

8. A computing apparatus, comprising:

a network interface;

first one or more logic elements comprising a software-defined networking (SDN) controller engine to provide SDN controller services; and

second one or more logic elements comprising a route tracing engine, operable to;

receive a logging action for a network packet from a network function via the network interface, wherein the logging action comprises a notification from the network function that the network function is one of a source device, an intermediate device, or a destination device; and

update a logging table from the logging action.

9. The computing apparatus of claim 8, wherein the route tracing engine is further operable to receive a route tracing request for the network packet, and to generate a route for the network packet.

10. The computing apparatus of claim 9, wherein the logging table comprises a flow path table, and wherein generating a route for the network packet comprises looking up a flow key tuple for the packet, and retrieving a network device list.

11. The computing apparatus of claim 10, wherein the flow key tuple is hashed.

12. The computing apparatus of claim 8, wherein the logging table comprises a flow path table, and wherein populating the flow path table comprises:

populating a source field of a device chain;

receiving a notification of an intermediate device;

adding the intermediate device to the device chain;

determining that a terminal device matches a destination of the network packet; and

terminating the device chain.

13. The computing apparatus of claim 12, wherein terminating the device chain comprises populating a destination field of the device chain.

14. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to instruct a processor to:

receive a network packet via a network interface;

perform a logging action to make the network packet traceable, the logging action comprising;

inspecting a role tag of the packet, and determining that the network function has a role selected from a source device, an intermediate device, or a destination device based at least in part on the role tag; and

notify a software-defined networking (SDN) controller of the role via the network interface.

15. The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the instructions are further to instruct the processor to provide a network function.

16. The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein:

determining that the network function has a role as a source device comprises determining that the role tag is not set; and

the logging action comprises setting the role tag.

17. The one or more tangible, non-transitory computer-readable mediums of claim 16, wherein the role tag is a one-bit tag.

18. The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein:

the flow table engine is further configured to inspect a source flow key; and

notifying the SDN controller of the role comprises adding the source flow key to a flow path table.

19. The one or more tangible, non-transitory computer-readable mediums of claim 18, wherein the source flow key comprises an internet protocol (IP) address or a media access control (MAC) address.

20. The one or more tangible non-transitory computer-readable mediums of claim 19, wherein the logging table comprises a flow path table, and wherein populating the flow path table comprises:

populating a source field of a device chain;

receiving a notification of an intermediate device;

adding the intermediate device to the device chain;

determining that a terminal device matches a destination of the network packet; and

terminating the device chain.

21. The one or more tangible non-transitory computer-readable mediums of claim 20, wherein terminating the device chain comprises populating a destination field of the device chain.

22. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to instruct a processor to:

provide SDN controller services;

receive a logging action for a network packet from a network device via a network interface, the logging action comprising;

inspecting a role tag of the packet, and determining that the network function has a role selected from a source device, an intermediate device, or a destination device based at least in part on the role tag; and

update a logging table from the logging action.

23. The one or more tangible non-transitory computer-readable mediums of claim 22, wherein the instructions are further operable to receive a route tracing request for the network packet, and to generate a route for the network packet.

24. The one or more tangible non-transitory computer-readable mediums of claim 23, wherein the logging table comprises a flow path table, and wherein generating a route for the network packet comprises looking up a flow key tuple for the packet, and retrieving a network device list.

25. The one or more tangible non-transitory computer-readable mediums of claim 23, wherein the flow key tuple is hashed.