Systems and methods for flow configuration syncing between network infrastructure devices

Patent metadata

Field	Value
Publication number	US-12381709-B2
Application number	US-202318092851-A
Country	US
Kind code	B2
Filing date	Jan 3, 2023
Priority date	Jan 3, 2023
Publication date	Aug 5, 2025
Grant date	Aug 5, 2025

Abstract

A networking device can use sync request packets to synchronize connection objects with a peer. Real or virtual flow misses occurring in the data plane while processing a network packet indicate that synchronization is needed. A virtual flow miss occurs when a data plane connection object is obsolete. A sync request packet containing connection metadata and the network packets is sent to the peer. The peer uses the connection metadata to create or update its version of the connection object then returns a sync ack packet that contains the network packet. Receiving a sync ack packet can indicate that the locally stored version of the connection object and the peer's version of the connection object are consistent. The network packet may be processed normally when the locally stored version of the connection object and the peer's version of the connection object are consistent.

First claim

What is claimed is:

1. A system comprising:
an ingress port that receives a network packet sent to a network destination;
a memory storing a configuration object that includes a plurality of rules for processing a plurality of network flows;
a central processing unit (CPU) that is configured to use the configuration object to create or update a connection object for processing a one of the network flows that includes the network packet; and
a packet processing pipeline circuit that is configured to use the connection object to process the network packet,
wherein a connection metadata is produced and the connection object is created or updated because the packet processing pipeline circuit determines that the connection object is nonexistent or is obsolete while processing the network packet,
wherein a sync request packet that includes the network packet and the connection metadata for the one of the network flows is generated and sent to a peer,
wherein a sync ack packet that includes the network packet and that is responsive to the sync request packet is received,
wherein the network packet is unpacked from the sync ack packet and then processed by the packet processing pipeline circuit using the connection object.

2. The system of claim 1 , wherein:
the network packet has a packet header that includes a 5-tuple;
the 5-tuple indicates a source internet protocol (IP) address, a destination IP address, a source port, a destination port, and a protocol; and
the packet processing pipeline circuit uses the 5-tuple to identify the connection object.

3. The system of claim 1 , wherein:
the packet processing pipeline circuit uses the connection object to process the one of the network flows; and
the packet processing pipeline circuit uses a second connection object to process a second one of the network flows.

4. The system of claim 1 , wherein:
the packet processing pipeline circuit uses the connection object to process a first one of the network flows;
the packet processing pipeline circuit uses a second connection object to process a second one of the network flows;
the connection object has an object configuration version number; and
the second connection object has a different object configuration version number that is different from the object configuration version number.

5. The system of claim 1 wherein the network packet is a layer 2 packet.

6. The system of claim 1 , wherein:
a second sync request packet is received from the peer;
the second sync request packet includes a second network packet and a second connection metadata for the second network packet;
the second connection metadata is used to create or update a second connection object that can be used for processing the second network packet; and
a second sync ack packet that includes the second network packet is generated and sent to the peer.

7. The system of claim 1 , wherein:
a second network packet of the one of the network flows is received by the ingress port before the sync ack packet is received; and
sending the second network packet to the network destination is delayed until after the sync ack packet is received.

8. The system of claim 7 , wherein the second network packet is sent to the network destination after the sync ack packet is received because the packet processing pipeline circuit determines that the connection object is nonexistent or is obsolete in the peer.

9. The system of claim 1 , wherein:
a second network packet of the one of the network flows is received by the ingress port before the sync ack packet is received; and
a second sync request packet that includes the second network packet is generated and sent to the peer.

10. The system of claim 1 , wherein:
the configuration object includes a configuration version number;
the connection object includes an object configuration version number; and
the connection object is obsolete because the object configuration version number is not equal to the configuration version number.

11. The system of claim 1 , wherein:
the peer stores a second connection object for the network packet; and
the sync ack packet indicates an object configuration version of the second connection object.

12. The system of claim 1 , wherein:
a configuration change is received; and
the connection object for the one of the network flows is obsolete because the configuration object is updated based on the configuration change.

13. The system of claim 1 , wherein:
the packet processing pipeline circuit updates the connection object because the network packet indicates a connection state change; and
a second sync packet is sent to the peer because the packet processing pipeline circuit updated the connection object.

14. A method comprising:
storing a configuration object that includes a plurality of rules for processing a plurality of network flows;
receiving a network packet of one of the network flows;
determining that a connection object that a packet processing pipeline uses to process the one of the network flows is nonexistent or is obsolete;
using the configuration object to produce a connection metadata and to create or update the connection object because the connection object is nonexistent or is obsolete;
producing a sync request packet that includes the network packet and the connection metadata;
sending the sync request packet to a peer;
receiving a sync ack packet that includes the network packet and that is responsive to the sync request packet;
producing, by the packet processing pipeline, a processed packet by using the connection object to process the network packet after the network packet is unpacked from the sync ack packet; and
sending the processed packet to a network destination.

15. The method of claim 14 , further including:
receiving a second sync request packet that includes a second network packet and a second connection metadata for the second network packet;
using the second connection metadata to create or update a second connection object;
generating a second sync ack packet that includes the second network packet; and
sending the second sync ack packet in response to the second sync request packet.

16. The method of claim 14 , wherein:
a second network packet of the one of the network flows is received before the sync ack packet is received; and
sending the second network packet to the network destination is delayed until after the sync ack packet is received.

17. The method of claim 14 , further including:
receiving a configuration change; and
updating the connection object based on the configuration change,
wherein the connection object is obsolete because the configuration object is updated based on the configuration change.

18. The method of claim 14 , wherein:
a match-action processing stage of a packet processing pipeline circuit updates the connection object because the network packet indicates a connection state change; and
a second sync packet is sent to the peer because the packet processing pipeline circuit updated the connection object.

19. The method of claim 14 , further including:
receiving, by the peer, the sync request packet;
using the connection metadata in the sync request packet to create or update a version of the connection object in the peer;
generating the sync ack packet; and
sending the sync ack packet in response to the sync request packet.

20. A system comprising:
a memory configured to store a configuration object that includes rules for processing n

Assignees

• Pensando Systems Inc

Inventors

• Raman Balakrishnan
• Ganesh Dontula Venkata Ratnananda
• Doddapaneni Krishna
• Kamisetty Sarat
• Nadahalli Akshaya
• Sabesan Rathina Sabapathy
• Thayalan Prabu
• Selvarajan Arun

Classifications

• H04L49/3063 Primary

  Pipelined operation · CPC title

• H04L7/10 Primary

  Arrangements for initial synchronisation · CPC title