Detecting and preventing network loops

Patent metadata

Field	Value
Publication number	US-10079752-B2
Application number	US-201615232655-A
Country	US
Kind code	B2
Filing date	Aug 9, 2016
Priority date	Jul 21, 2016
Publication date	Sep 18, 2018
Grant date	Sep 18, 2018

Abstract

Systems, methods, and computer-readable storage media for detecting network loops. A system can identify, for each virtual tunnel endpoint (VTEP) from multiple VTEPs in a network, respective media access control address data including the respective local interface media access control addresses of the respective VTEP and respective media access control addresses learned by the respective VTEP. The system can determine whether the VTEPs are running spanning tree protocol (STP), and whether a media access control address learned by a first VTEP matches a respective local interface media access control address of a second VTEP. The system can detect a loop when the media access control address learned by the first VTEP matches the respective local interface media access control address of the second VTEP. The system can also detect a loop when the VTEPs are running STP and the first and second VTEPs see the same STP root bridge.

First claim

What is claimed is:

1. A method comprising:
identifying, for each virtual tunnel endpoint from a plurality of virtual tunnel endpoints in a network, respective media access control address data comprising at least one of respective local interface media access control addresses of the respective virtual tunnel endpoint and respective media access control addresses learned by the respective virtual tunnel endpoint;
determining whether the plurality of virtual tunnel endpoints are running spanning tree protocol;
based on the respective media access control address data, determining whether a media access control address learned by a first virtual tunnel endpoint from the plurality of virtual tunnel endpoints matches a respective local interface media access control address of a second virtual tunnel endpoint from the plurality of virtual tunnel endpoints;
detecting a first network loop when the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint; and
detecting a second network loop when:
the plurality of virtual tunnel endpoints is running spanning tree protocol; and
the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge.

2. The method of claim 1 , wherein the respective media access control address data is identified based on respective advertisements transmitted by each of the plurality of virtual tunnel endpoints in the network.

3. The method of claim 2 , wherein the respective media access control address data comprises a respective media access control table of the respective media access control addresses.

4. The method of claim 1 , further comprising:
determining whether the first virtual tunnel endpoint and the second virtual tunnel endpoint are virtual portchannel peers or multihoming peers; and
wherein detecting the first network loop and detecting the second network loop comprise determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are not virtual portchannel peers or multihoming peers.

5. The method of claim 1 , further comprising:
identifying a respective spanning tree protocol root bridge identifier for each virtual local area network associated with the respective virtual tunnel endpoint;
determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with a same spanning tree protocol root bridge identifier; and
when the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge identifier, determining that the first virtual tunnel endpoint and the second virtual tunnel endpoint are associated with the same spanning tree protocol root bridge.

6. The method of claim 5 , further comprising:
based on the respective spanning tree protocol root bridge identifier, determining that a first one of the first virtual tunnel endpoint and the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the first network loop or the second network loop, suspending, based on the root bridge determination, an associated virtual local area network on a second one of the first virtual tunnel endpoint and the second virtual tunnel endpoint.

7. The method of claim 5 , further comprising:
based on the respective spanning tree protocol root bridge identifier, determining that neither the first virtual tunnel endpoint nor the second virtual tunnel endpoint is a root bridge, to yield a root bridge determination; and
in response to detecting the first network loop or the second network loop, suspending, based on the root bridge determination, an associated virtual local area network on a root port of a particular virtual tunnel endpoint comprising either the first virtual tunnel endpoint or the second virtual tunnel endpoint.

8. The method of claim 5 , further comprising:
based on the respective media access control address data, determining that the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint; and
in response to determining that the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint, detecting the first network loop.

9. The method of claim 8 , further comprising:
determining that the plurality of virtual tunnel endpoints are not running spanning tree protocol; and
in response to detecting the first network loop and determining that the plurality of virtual tunnel endpoints are not running spanning tree protocol suspending a virtual local area network associated with a particular interface of the first virtual tunnel endpoint, on which the first virtual tunnel endpoint learned the media access control address that matches the respective local interface media access control address of the second virtual tunnel endpoint.

10. The method of claim 9 , further comprising:
selecting, based on respective internet protocol addresses of the first virtual tunnel endpoint and the second virtual tunnel endpoint, a specific virtual tunnel endpoint from the first virtual tunnel endpoint and the second virtual tunnel endpoint on which to suspend the virtual local area network, the specific virtual tunnel endpoint being selected based on a determination that the specific virtual tunnel endpoint is associated with a lowest internet protocol address from the respective internet protocol addresses; and
suspending the virtual local area network on one or more interfaces associated with the specific virtual tunnel endpoint selected.

11. The method of claim 1 , further comprising:
obtaining, via a controller on the network, the respective media access control address data from respective media access control address advertisements flooded on the network by each respective virtual tunnel endpoint from the plurality of virtual tunnel endpoints; and
wherein the advertisements are flooded on the network via Ethernet virtual private network.

12. A system comprising:
one or more processors; and
a computer-readable medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying, for each virtual tunnel endpoint from a plurality of virtual tunnel endpoints in a network, respective media access control address data comprising at least one of respective local interface media access control addresses of the respective virtual tunnel endpoint and respective media access control addresses learned by the respective virtual tunnel endpoint;
determining whether the plurality of virtual tunnel endpoints are running spanning tree protocol;
based on the respective media access control address data, determining whether a media access control address learned by a first virtual tunnel endpoint from the plurality of virtual tunnel endpoints matches a respective local interface media access control address of a second virtual tunnel endpoint from the plurality of virtual tunnel endpoints;
detecting a first network loop when the media access control address learned by the first virtual tunnel endpoint matches the respective local interface media access control address of the second virtual tunnel endpoint; and
detecting a second network loop when:
the plurality of virtual tunnel endpoints is running spanning tree protocol

Assignees

• Cisco Tech Inc

Inventors

• Manthiramoorthy Natarajan
• Srinivasan Venkatesh
• Narayanan Swaminathan
• Mehta Ambrish Niranjan
• Singh Anand Kumar
• Chodey Anulekha

Classifications

• H04L49/354

  for supporting virtual local area networks [VLAN] · CPC title

• H04L69/324

  in the data link layer [OSI layer 2], e.g. HDLC · CPC title

• H04L45/28

  using route fault recovery · CPC title

• H04L12/437

  Ring fault isolation or reconfiguration {(for SDH/SONET ring networks H04J3/085)} · CPC title

• H04L45/32

  Flooding (denial of service attacks H04L63/1458) · CPC title