Defining network traffic processing flows between virtual machines
View Patent ↗Network devices include hosted virtual machines and virtual machine applications. Hosted virtual machines and their applications implement additional functions and services in network devices. Network devices include data taps for directing network traffic to hosted virtual machines and allowing hosted virtual machines to inject network traffic. Network devices include unidirectional data flow specifications, referred to as hyperswitches. Each hyperswitch is associated with a hosted virtual machine and receives network traffic received by the network device from a single direction. Each hyperswitch processes network traffic according to rules and rule criteria. A hosted virtual machine can be associated with multiple hyperswitches, thereby independently specifying the data flow of network traffic to and from the hosted virtual machine from multiple networks. The network device architecture also enables the communication of additional information between the network device and one or more virtual machine applications using an extended non-standard network protocol.
1. A network device including a data flow topology adapted to direct network traffic within the network device, the network device comprising:
a plurality of hyperswitch interfaces;
wherein a first hyperswitch interface in the plurality of hyperswitch interfaces is adapted to direct data associated with a hosted virtual machine, the first hyperswitch comprising:
a first network traffic tap connection adapted to receive first network traffic, wherein the first network traffic was received by the network device from a first network;
a second network traffic tap connection adapted to output at least a first portion of the first network traffic towards a second network via one or more hyperswitch interfaces;
a virtual machine interface adapted to output at least a second portion of the first network traffic and metadata of the second portion of the network traffic to a hosted virtual machine, wherein the metadata includes additional information describing the second portion of the first network traffic, and wherein the metadata is communicated to a virtual machine application executing on at least the hosted virtual machine by using an extended non-standard protocol that provides functionality similar to an application programming interface;
network traffic rule criteria based on at least one attribute of the first network traffic, wherein the first hyperswitch interface is adapted to determine the first and second portions of the first network traffic based on the network traffic rule criteria; and
network traffic rules corresponding with the network traffic rule criteria, wherein the first hyperswitch interface is adapted to direct the first and second portions of the first network traffic to the second network traffic tap and the virtual machine interface, respectively, based on the network traffic rules; and
wherein a second hyperswitch interface in the plurality of hyperswitch interfaces is adapted to direct data associated with the hosted virtual machine, the second hyperswitch comprising:
a third network traffic tap connection adapted to receive third network traffic, wherein third network traffic was received by the network device from a second network; and
a fourth network traffic tap connection adapted to output at least a first portion of the third network traffic towards the first network via one or more hyperswitch interfaces and the first network traffic tap.
2. The network device of claim 1 , wherein the virtual machine interface is further adapted to receive second network traffic directed to the first network from the hosted virtual machine, wherein the first hyperswitch interface is adapted to output the second network traffic via the first network traffic tap connection.
3. The network device of claim 1 , wherein the first hyperswitch interface is adapted to modify the second portion of the first network traffic matching at least a portion of the network traffic rule criteria.
4. The network device of claim 3 , wherein the first hyperswitch interface is adapted to output the modified second portion of the first network traffic via the virtual machine interface, wherein the modified second portion of the first network traffic is directed to the hosted virtual machine.
5. The network device of claim 4 , wherein the modified second portion of the first network traffic includes a modified network address directed to the hosted virtual machine.
6. The network device of claim 5 , wherein the modified network address includes a layer 2 network address.
7. The network device of claim 5 , wherein the modified network address includes a layer 3 network address.
8. The network device of claim 1 , wherein the second portion of the first network traffic is a copy of the first portion of the first network traffic.
9. The network device of claim 1 , wherein the second portion of the first network traffic is different than the first portion of the first network traffic.
10. The network device of claim 1 , wherein the first hyperswitch interface is adapted to drop a third portion of the first network traffic.
11. The network device of claim 1 , wherein the attribute includes a layer 2 network attribute.
12. The network device of claim 1 , wherein the attribute includes a layer 3 network attribute.
13. The network device of claim 1 , wherein the attribute includes a data payload included in the network traffic.
14. The network device of claim 1 , wherein the attribute includes a layer 4 network attribute.
15. The network device of claim 1 , wherein the attribute includes a layer 5 network attribute.
16. The network device of claim 1 , wherein the attribute includes a layer 6 network attribute.
17. The network device of claim 1 , wherein the attribute includes a layer 7 network attribute.
18. The network device of claim 1 , wherein the first hyperswitch interface includes a bypass connection adapted to direct all of the first network traffic from the first network traffic tap to the second network traffic tap without processing by the rule criteria and rules when the bypass connection is in an activated state.
19. The network device of claim 1 , comprising:
the second hyperswitch further comprising:
a second virtual machine interface adapted to output at least a second portion of the third network traffic and metadata of the second portion of the network traffic to the hosted virtual machine, wherein the metadata includes additional information describing the second portion of the third network traffic, and wherein the metadata is communicated to a virtual machine application executing on at least the hosted virtual machine by using an extended non-standard protocol that provides functionality similar to an application programming interface;
second network traffic rule criteria, wherein the second hyperswitch interface is adapted to determine the first and second portions of the third network traffic based on the second rule criteria; and
second network traffic rules corresponding with the second network traffic rule criteria, wherein the second hyperswitch interface is adapted to direct the first and second portions of the third network traffic to the first network traffic tap via one or more hyperswitch interfaces and the second virtual machine interface, respectively, based on the second network traffic rules.
20. A method of directing data associated with a hosted virtual machine within a network device, the method comprising:
receiving first network traffic from a first network connected with the network device via a first network connection;
in response to receiving the first network traffic, selecting a first hyperswitch interface in a plurality of hyperswitch interfaces and directing at least a first portion of the first network traffic to the hosted virtual machine by evaluating a first rule criteria and first rules associated with the first hyperswitch interface to identify the first portion of the first network traffic to be directed to the hosted virtual machine and a second portion of the first network traffic to be directed towards a second network via one or more hyperswitch interfaces, wherein the first rule criteria are based on at least one attribute of the first network traffic, wherein a virtual machine interface is adapted to output at least the first portion of the first network traffic and metadata of the first portion of the network traffic to the hosted virtual machine, wherein the metadata includes additional information describing the first portion of the first network traffic, and wherein the metadata is communicated to a virtual machine application executing on at least the hosted virtual machine by using an extended non-standard protocol that provides functionality similar to an application programming interface;
receiving second network traffic from the second network connected with the network device via a second network connection; and
in response to receiving the second network traffic, selecting a second hyperswitch interface in the plurality of hyperswitch interfaces and directing at least a first portion of the second network traffic to the hosted virtual machine by evaluating a second rule criteria and second rules associated with the second hyperswitch interface to identify the first portion of the second network traffic to be directed to the hosted virtual machine and a second portion of the second network traffic to be directed towards the first network via one or more hyperswitch interfaces, wherein the second rule criteria are based on at least one attribute of the second network traffic.
21. The method of claim 20 , wherein directing at least the first portion of the first network traffic to the hosted virtual machine based on the first hyperswitch interface further comprises:
directing the first portion of the first network traffic to the hosted virtual machine and the second portion of the first network traffic towards the second network via one or more hyperswitch interfaces.
22. The method of claim 21 , wherein the first portion of the first network traffic is a copy of at least a portion of the second portion of the first network traffic.
23. The method of claim 21 , wherein the second portion of the first network traffic does not include the first portion of the first network traffic.
24. The method of claim 21 , wherein directing at least the first portion of the second network traffic to the hosted virtual machine based on the second hyperswitch interface further comprises:
directing the first portion of the first network traffic to the hosted virtual machine and the second portion of the first network traffic towards the second network via one or more hyperswitch interfaces.
25. The method of claim 24 , wherein the first rule criteria is different than the second rule criteria and the first rules are different than second rules.
26. The method of claim 20 , wherein directing at least the first portion of the first network traffic to the hosted virtual machine based on the first hyperswitch interface comprises:
directing the first portion of the first network traffic to the hosted virtual machine using network address translation.
27. The method of claim 20 , wherein directing at least the first portion of the first network traffic to the hosted virtual machine based on the first hyperswitch interface comprises:
directing the first portion of the first network traffic to the hosted virtual machine using layer 2 network switching.