Inspecting operations of a machine to detect elephant flows

• US 9,967,199 B2
• Filed: 09/30/2014
• Issued: 05/08/2018
• Est. Priority Date: 12/09/2013
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Lambeth, W. Andrew, Patil, Amit Vasant, Dabak, Prasad Sharad, Gunda, Laxmikant Vithal, Dhanasekar, Vasantha Kumar, Pettit, Justin
• Primary Examiner(s): Hussain, Tauqir
• Application Number:
  US14/502,102
• Publication Number:
  US 20150163117A1
• Time in Patent Office: 1,316 Days
• Field of Search: 709224
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]

Abstract

Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Claims

1. A method of inspecting the operations of a first machine, that operates on a physical host, to detect an elephant flow, the method comprising:

receiving, at a detector operating on the physical host and outside of the first machine, an indication from an agent operating within the first machine of a new data flow, wherein the new data flow is one of (i) an outbound data flow from the first machine to a second machine with the first machine as the source of the data flow and (ii) an inbound data flow from the second machine to the first machine with the first machine as the destination of the data flow;

receiving, from the agent operating within the first machine, an indicator of an amount of data being transferred by the first machine in the data flow;

at the detector operating on the physical host and outside of the first machine, determining whether the data flow is an elephant flow based on the indicated amount of data being transferred in the data flow; and

if the detector determines that the data flow is an elephant flow, reporting that the data flow is an elephant flow, wherein a managed forwarding element processes the data associated with the detected elephant flow differently from other flows not detected as elephant flows based on the report.

2. The method of claim 1, wherein the first machine is a first virtual machine (VM) and the detector operates within a second virtual machine that operates on the physical host.

3. The method of claim 1, wherein the agent operating within the first machine provides the indication after intercepting a network connection that is being opened on the first machine.

4. The method of claim 1, wherein the agent operating within the first machine performs a network introspection operation on the first machine to intercept a socket call being made to open the network connection, in order to provide the indication of the new data flow.

5. The method of claim 1, wherein the determining comprises (i) comparing the amount of data transferred with a threshold value and (ii) specifying, if the amount of data being transferred is greater than a threshold value, that the data flow is an elephant flow.

6. The method of claim 1 further comprising sending a message regarding a determined elephant flow to the agent operating within the first machine, wherein the agent receives the message and processes each packet in the elephant flow differently from other flows not detected as elephant flows.

7. The method of claim 6, wherein the indication of the new data flow comprises context information, wherein the context information includes at least one of a name of the first machine, an address associated with the first machine, an address associated with the second machine, a port number, an identification of an application that initiated the new data flow, and user data.

8. A physical host device comprising:

a set of processing units;

a set of non-transitory machine readable media storing;

a first machine which when executed by the set of processing units sends and receives packets belonging to data flows;

a data flow interception agent which when executed by the set of processing units operates on the first machine to detect an initiation of a new data flow and to identify amounts of the data being transferred by the machine in the data flow, wherein the new data flow is one of (i) an outbound data flow from the first machine to a second machine with the first machine as the source of the data flow and (ii) an inbound data flow from the second machine to the first machine with the first machine as the destination of the data flow; and

an elephant detector, which when executed by the set of processing units, operates outside of the first machine to determine whether the amount of data transferred in the data flow is over a threshold size and, if the amount of data transferred is over the threshold size, that the data flow is an elephant flow, based on information received from the data flow interception agent; and

a forwarding element, which when executed by the set of processing units, receives a report regarding the detected elephant flow and processes the data associated with the detected elephant flow differently from other flows not detected as elephant flows.

9. The physical host device of claim 8, wherein the first machine is a virtual machine (VM) that operates on the physical host device and the elephant detector operates within virtualization software of the physical host device.

10. The physical host device of claim 8, wherein the data flow interception agent detects the initiation of the new data flow by intercepting a file transfer request.

11. The physical host device of claim 8, wherein the data flow interception agent identifies one or more pieces of information that provide context regarding the new data flow and provides the pieces of information to the elephant detector.

12. The physical host device of claim 11, wherein the context information includes at least one of a name of the first machine, an address associated with the first machine, an address associated with the second machine, a port number, an identification of an application that initiated the new data flow, and user data.

13. A non-transitory machine readable medium storing a program that when executed by at least one processing unit inspects the operations of a first machine, that operates on a physical host, to detect an elephant flow, the program comprising sets of instructions for:

receiving, at a detector operating on the physical host and outside of the first machine, an indication from an agent operating within the first machine of a new data flow, wherein the new data flow is one of (i) an outbound data flow from the first machine to a second machine with the first machine as the source of the data flow and (ii) an inbound data flow from the second machine to the first machine with the first machine as the destination of the data flow;

receiving, from the agent operating within the first machine, an indicator of an amount of data being transferred by the first machine in the data flow;

at the detector operating on the physical host and outside of the first machine, determining whether the data flow is an elephant flow based on the indicated amount of data being transferred in the data flow; and

if the detector determines that the data flow is an elephant flow, reporting that the data flow is an elephant flow, wherein a managed forwarding element processes the data associated with detected elephant flow differently from other flows not detected as elephant flows based on the report.

14. The non-transitory machine readable medium of claim 13, wherein the first machine is a first virtual machine (VM) and the detector operates within virtualization software of the physical host.

15. The non-transitory machine readable medium of claim 13, wherein the agent operating within the machine provides the indication after intercepting a network connection that is being opened on the first machine.

16. The non-transitory machine readable medium of claim 13, wherein the agent operating within the first machine performs a network introspection operation on the first machine to intercept a socket call being made to open the network connection in order to provide the indication of the new data flow.

17. The non-transitory machine readable medium of claim 13, wherein the set of instructions for determining comprises sets of instructions for (i) comparing the amount of data transferred with a threshold value and (ii) specifying, if the amount of data being transferred is greater than a threshold value, that the data flow is an elephant flow.