Media access control (MAC) address table protection in a virtualized computing environment

1. A method for a network device to protect a Media Access Control (MAC) address table of a network switch connecting to the network device in a virtualized computing environment, the method comprising:

in response to receiving a packet from a virtual machine with a MAC address supported by the network device:

when the packet includes a request message, wherein the request message is one of an Address Resolution Protocol (ARP) request message, a Dynamic Host Configuration Protocol (DHCP) discover message, or a DHCP request message,

determining a shared MAC address that is usable for the virtual machine and at least one other virtual machine supported by the network device;

modifying a source MAC address of the request message from the MAC address to the shared MAC address before the request message reaches the network switch; and

sending, to the network switch, the request message having the shared MAC address as the modified source MAC address;

when the packet does not include the request message, sending, to the network switch, the packet without modifying a source MAC address associated with the packet; and

in response to receiving a reply message in reply to the request message in a second packet from the network switch, the reply message having the shared MAC address as a destination MAC address, sending, to the virtual machine, the reply message.

2. The method of claim 1 , wherein determining the shared MAC address comprises:

selecting an uplink interface from multiple uplink interfaces of the network device that connect the virtual machine and the at least one other virtual machine to the network switch; and

setting a MAC address associated with the selected uplink interface to be the shared MAC address.

3. The method of claim 2 , wherein sending the request message comprises:

sending, via the selected uplink interface to the network switch, the request message with the MAC address of the selected uplink interface as the modified source address.

4. The method of claim 1 , wherein in response to receiving the packet that includes the request message, the method further comprises:

determining a destination Internet Protocol (IP) address of the request message; and

storing the destination IP address of the request message in association with the MAC address associated with the virtual machine.

5. The method of claim 4 , wherein in response to receiving the reply message, the method further comprises:

matching a source IP address of the reply message with the stored destination IP address of the request message;

modifying a destination MAC address of the reply message from the shared MAC address to the stored MAC address associated with the virtual machine; and

removing the stored destination IP address of the request message and the stored MAC address associated with the virtual machine.

6. The method of claim 5 , wherein sending the reply message to the virtual machine comprises:

sending the reply message as a unicast message to the virtual machine at the MAC address associated with the virtual machine.

7. The method of claim 6 , wherein the request message is the ARP request message having a broadcast MAC address as a destination MAC address, and the reply message is an ARP reply message.

8. The method of claim 3 , wherein the request message is the DHCP discover message or the DHCP request message; and the reply message is a DHCP offer message in reply to the DHCP discover message, or a DHCP acknowledgement (ACK) or negative acknowledgement (NACK) message in reply to the DHCP request message.

9. The method of claim 1 , wherein the network device includes a hypervisor implementing a virtual switch via which the request message and reply message are received and sent, and a protection engine comprising:

a request handler to receive the request message from the virtual machine, to determine the shared MAC address, to modify the source MAC address, and to send the request message with the modified source address to the network switch; and

a reply handler to receive the reply message from the network switch and to send the reply message to the virtual machine.

10. The method of claim 9 , wherein the network switch is an access switch connecting to the network device, or a core switch connecting to the network device via the access switch.

11. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a network device, cause the processor to perform a method of protecting a Media Access Control (MAC) address table of a network switch connecting to the network device in a virtualized computing environment, the method comprising:

in response to receiving a packet from a virtual machine with a MAC address supported by the network device:

when the packet includes a request message, wherein the request message is one of an Address Resolution Protocol (ARP) request message, a Dynamic Host Configuration Protocol (DHCP) discover message, or a DHCP request message,

determining a shared MAC address that is usable for the virtual machine and at least one other virtual machine supported by the network device;

modifying a source MAC address of the request message from the MAC address to the shared MAC address before the request message reaches the network switch; and

sending, to the network switch, the request message having the shared MAC address as the modified source MAC address;

when the packet does not include the request message, sending, to the network switch, the packet without modifying a source MAC address associated with the packet; and

in response to receiving a reply message in reply to the request message from the network switch, the reply message having the shared MAC address as a destination MAC address, sending, to the virtual machine, the reply message.

12. The non-transitory computer-readable storage medium of claim 11 , wherein determining the shared MAC address comprises:

selecting an uplink interface from multiple uplink interfaces of the network device that connect the virtual machine and the at least one other virtual machine to the network switch; and

setting a MAC address associated with the selected uplink interface to be the shared MAC address.

13. The non-transitory computer-readable storage medium of claim 12 , wherein sending the request message comprises:

sending, via the selected uplink interface to the network switch, the request message with the MAC address of the selected uplink interface as the modified source address.

14. The non-transitory computer-readable storage medium of claim 11 , wherein in response to receiving the packet that includes the request message, the method further comprises:

determining a destination Internet Protocol (IP) address of the request message; and

storing the destination IP address of the request message in association with the MAC address associated with the virtual machine.

15. The non-transitory computer-readable storage medium of claim 14 , wherein in response to receiving the reply message, the method further comprises:

matching a source IP address of the reply message with the stored destination IP address of the request message;

modifying a destination MAC address of the reply message from the shared MAC address to the stored MAC address associated with the virtual machine; and

removing the stored destination IP address of the request message and the stored MAC address associated with the virtual machine.

16. The non-transitory computer-readable storage medium of claim 15 , wherein sending the reply message to the virtual machine comprises:

sending the reply message as a unicast message to the virtual machine at the MAC address associated with the virtual machine.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the request message is the ARP request message having a broadcast MAC address as a destination MAC address, and the reply message is an ARP reply message.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the request message is the DHCP discover message or the DHCP request message; and the reply message is a DHCP offer message in reply to the DHCP discover message, or a DHCP acknowledgement (ACK) or negative acknowledgement (NACK) message in reply to the DHCP request message.

19. A network device configured to protect a Media Access Control (MAC) address table of a network switch connecting to the network device in a virtualized computing environment, the network device comprising: a processor, multiple uplink interfaces; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to:

in response to receiving a packet from a virtual machine with a MAC address supported by the network device:

when the packet includes a request message, wherein the request message is one of an Address Resolution Protocol (ARP) request message, a Dynamic Host Configuration Protocol (DHCP) discover message, or a DHCP request message,

determine a shared MAC address that is usable for the virtual machine and at least one other virtual machine supported by the network device;

modify a source MAC address of the request message from the MAC address to the shared MAC address, wherein the shared MAC address is a MAC address associated with a selected uplink interface from the multiple uplink interfaces; and

send, via the selected uplink interface to the network switch, the request message having the shared MAC address as the modified source MAC address;

when the packet does not include the request message, send, to the network switch, the packet without modifying a source MAC address associated with the packet; and

in response to receiving a reply message in reply to the request message from the network switch via the selected uplink interface, the reply message having the shared MAC address as a destination MAC address, send, to the virtual machine, the reply message.

20. The network device of claim 19 , wherein the instructions, when executed by the processor, further cause the processor to implement a hypervisor that includes a virtual switch via which the request message and the reply message are received and sent, and a protection engine comprising:

a request handler to receive the request message from the virtual machine, to determine the shared MAC address, to modify the source MAC address, and to send the request message with the modified source address to the network switch; and

a reply handler to receive the reply message from the network switch and to send the reply message to the virtual machine.