Detecting an elephant flow based on the size of a packet

Patent metadata

Field	Value
Publication number	US-9838276-B2
Application number	US-201715397676-A
Country	US
Kind code	B2
Filing date	Jan 3, 2017
Priority date	Dec 9, 2013
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

Some embodiments provide a forwarding element that inspects the size of each of several packets in a data flow to determine whether the data flow is an elephant flow. The forwarding element inspects the size because, in order for the packet to be of a certain size, the data flow had to already have gone through a slow start in which smaller packets are transferred and by definition be an elephant flow. When the forwarding element receives a packet in a data flow, the forwarding element identifies the size of the packet. The forwarding element then determines if the size of the packet is greater than a threshold size. If the size is greater, the forwarding element specifies that the packet's data flow is an elephant flow.

First claim

What is claimed is:

1. A method for detecting elephant flows at a forwarding element, the method comprising:
prior to receiving any data packets above a threshold size belonging to a particular data flow, processing the data packets belonging to the particular data flow in a datapath of the forwarding element;
upon receiving a first data packet above the threshold size belonging to the particular data flow, sending the first data packet to a module of the forwarding element outside the datapath that processes the particular data flow as an elephant flow; and
processing subsequent data packets belonging to the particular data flow in the datapath of the forwarding element as elephant flow packets irrespective of the size of the subsequent data packets.

2. The method of claim 1 , wherein the data packets belonging to the particular data flow are associated with a protocol that utilizes a slow start algorithm in which the size of each data packet increases with each successful transmission until one of (i) the data packet size reaches a particular size and (ii) packet loss occurs.

3. The method of claim 1 , wherein processing the data packets belonging to the particular data flow in the datapath prior to receiving any data packets above the threshold size comprises sending said data packets to a first port of the forwarding element.

4. The method of claim 1 , wherein processing the data packets belonging to the particular flow in the datapath comprises processing the packets using cached forwarding data.

5. The method of claim 1 , wherein the module outside the datapath is a user space module for processing packets that the datapath is unable to handle.

6. The method of claim 5 , wherein the datapath is a kernel datapath.

7. The method of claim 1 , wherein (i) processing the data packets in the datapath prior to receiving any data packets above a threshold size comprises processing the data packets according to a first flow entry and (ii) processing the subsequent packets in the datapath as elephant flow packets comprises processing the data packets according to a second flow entry that replaces the first flow entry.

8. The method of claim 7 , wherein the first flow entry specifies sending the first data packet above the threshold size to the module outside the datapath.

9. The method of claim 1 , wherein sending the first data packet to the module outside the datapath comprises sending identifying information associated with the first data packet that identifies all packets in the data flow.

10. The method of claim 9 , wherein the identifying information comprises at least one of tunnel information, an ingress port, a transport layer protocol port number, an Ethertype, a MAC address, and an IP address.

11. A non-transitory machine readable medium storing a program which when executed by at least one processing unit detects elephant flows at a forwarding element, the program comprising sets of instructions for:
prior to receiving any data packets above a threshold size belonging to a particular data flow, processing the data packets belonging to the particular data flow in a datapath of the forwarding element;
upon receiving a first data packet above the threshold size belonging to the particular data flow, sending the first data packet to a module of the forwarding element outside the datapath that processes the particular data flow as an elephant flow; and
processing subsequent data packets belonging to the particular data flow in the datapath of the forwarding element as elephant flow packets irrespective of the size of the subsequent data packets.

12. The non-transitory machine readable medium of claim 11 , wherein the data packets belonging to the particular data flow are associated with a protocol that utilizes a slow start algorithm in which the size of each data packet increases with each successful transmission until one of (i) the data packet size reaches a particular size and (ii) packet loss occurs.

13. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for processing the data packets belonging to the particular data flow in the datapath prior to receiving any data packets above the threshold size comprises a set of instructions for sending said data packets to a first port of the forwarding element.

14. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for processing the data packets belonging to the particular flow in the datapath comprises a set of instructions for processing the packets using cached forwarding data.

15. The non-transitory machine readable medium of claim 11 , wherein the module outside the datapath is a user space module for processing packets that the datapath is unable to handle.

16. The non-transitory machine readable medium of claim 15 , wherein the datapath is a kernel datapath.

17. The non-transitory machine readable medium of claim 11 , wherein (i) the set of instructions for processing the data packets in the datapath prior to receiving any data packets above a threshold size comprises a set of instructions for processing the data packets according to a first flow entry and (ii) the set of instructions for processing the subsequent packets in the datapath as elephant flow packets comprises a set of instructions for processing the data packets according to a second flow entry that replaces the first flow entry.

18. The non-transitory machine readable medium of claim 17 , wherein the first flow entry specifies sending the first data packet above the threshold size to the module outside the datapath.

19. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for sending the first data packet to the module outside the datapath comprises a set of instructions for sending identifying information associated with the first data packet that identifies all packets in the data flow.

20. The non-transitory machine readable medium of claim 19 , wherein the identifying information comprises at least one of tunnel information, an ingress port, a transport layer protocol port number, an Ethertype, a MAC address, and an IP address.

Assignees

• Nicira Inc

Inventors

• Pettit Justin
• Casado Martin
• Koponen Teemu
• Davie Bruce
• Lambeth W Andrew

Classifications

• H04L43/026 Primary

  using flow identification · CPC title

• H04L49/3018

  Input queuing · CPC title

• H04L43/16

  Threshold monitoring · CPC title

• H04L49/252

  Store and forward routing · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title