Correcting packet timestamps in virtualized environments
View Patent ↗A network capture element is embodied on a virtual machine, and a utility function is embodied on the actual device, preferably within the virtual machine manager. Both the utility function and the traffic capture element are configured to monitor communication events. To minimize the overhead imposed, the utility function is configured to merely store the time that the event occurred on the actual machine, corresponding to an identifier of the event. The network capture element, on the other hand, performs the time consuming tasks of filtering the communications, selectively storing some or all of the data content of the communications, characterizing the data content, and so on. Instead of storing the virtual time that the communication event occurred at the virtual machine, the network capture element uses the identifier of the communication event to retrieve the actual time that the communication event occurred on the actual machine.
1. A non-transitory computer-readable medium comprising a program that, when executed by a processor, causes the processor to:
receive a packet from a virtual machine manager, the packet including an associated virtual time of arrival,
retrieve an actual time of arrival of the packet from a storage element in which the virtual machine manager recorded the actual time of arrival, and
replacing the virtual time of arrival with the actual time of arrival;
wherein the processor retrieves the actual time of arrival by one of:
submitting a request to, and receiving a response from the virtual machine manager; and
accessing the storage element directly.
2. The medium of claim 1 , wherein the program causes the processor to maintain a pointer to a buffer in the storage element, and to retrieve the actual time of arrival from the buffer based on the pointer.
3. The medium of claim 2 , wherein the buffer is a circular buffer that is managed by the virtual machine manager.
4. The medium of claim 1 , wherein the program causes the processor to determine a packet identifier corresponding to the packet, and to retrieve the actual time of arrival based on the packet identifier.
5. The medium of claim 4 , wherein the packet identifier includes a hash value corresponding to some or all of the packet.
6. The medium of claim 5 , wherein the hash value corresponds to some or all of a header of the packet.
7. The medium of claim 1 , wherein the program causes the processor to submit a request to the virtual machine manager for the actual time of arrival.
8. The medium of claim 7 , wherein the request includes a packet identifier of the packet.
9. The medium of claim 8 , wherein the packet identifier includes at least a portion of the packet.
10. The medium of claim 9 , wherein the packet identifier includes at least a portion of a header of the packet.
11. The medium of claim 9 , wherein the packet identifier includes a hash value of at least a portion of the packet.
12. A computer-implemented method, comprising:
a computer receiving a packet from a virtual machine manager, the packet including an associated virtual time of arrival,
the computer retrieving an actual time of arrival of the packet from a storage element in which the virtual machine manager recorded the actual time of arrival, and
the computer replacing the virtual time of arrival with the actual time of arrival;
wherein the computer retrieves the actual time of arrival by one of:
submitting a request to, and receiving a response from the virtual machine manager; and
accessing the storage element directly.
13. The computer-implemented method of claim 12 , wherein the method further comprises maintaining a pointer to a buffer in the storage element, and to retrieve the actual time of arrival from the buffer based on the pointer.
14. The computer-implemented method of claim 13 , wherein the buffer is a circular buffer that is managed by the virtual machine manager.
15. The computer-implemented method of claim 12 , wherein the method further comprises determining a packet identifier corresponding to the packet, and to retrieve the actual time of arrival based on the packet identifier.
16. The computer-implemented method of claim 15 , wherein the packet identifier includes a hash value corresponding to some or all of the packet.
17. An apparatus, comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the apparatus to perform a method, comprising:
receiving a packet from a virtual machine manager, the packet including an associated virtual time of arrival,
retrieving an actual time of arrival of the packet from a storage element in which the virtual machine manager recorded the actual time of arrival, and
replacing the virtual time of arrival with the actual time of arrival;
wherein retrieving the actual time of arrival comprises performing one of:
submitting a request to, and receiving a response from the virtual machine manager; and
accessing the storage element directly.
18. The apparatus of claim 17 , wherein the method further comprises maintaining a pointer to a buffer in the storage element, and to retrieve the actual time of arrival from the buffer based on the pointer.
19. The apparatus of claim 18 , wherein the buffer is a circular buffer that is managed by the virtual machine manager.
20. The apparatus of claim 17 , wherein the method further comprises determining a packet identifier corresponding to the packet, and to retrieve the actual time of arrival based on the packet identifier.