Tracing network packets through logical and physical networks
View Patent ↗Some embodiments provide a method for a first network controller that manages a set of logical forwarding elements implemented in several managed forwarding elements. The method receives a request to trace a specified packet having a particular source on a logical forwarding element. The method generates the packet according to the packet specification. The generated packet includes an indicator that the packet is for a trace operation. The method sends the packet to a second network controller that manages a managed forwarding element associated with the particular source. The method receives a first set of messages regarding operations performed on the packet from a set of network controllers that receives a second set of messages regarding operations performed on the packet from a set of managed forwarding elements that process the packet.
1. For a managed forwarding element (MFE) that implements a logical forwarding element (LFE) of a logical network along with a plurality of other MFEs, a method comprising:
receiving a packet comprising an indicator that the packet is used for a trace operation;
performing a logical forwarding operation on the packet;
generating a first set of trace-observation data relating to the logical forwarding operation;
performing a physical forwarding operation;
generating a second set of trace-observation data relating to the physical forwarding operation;
sending, to a network controller, the first and second trace-observation data sets.
2. The method of claim 1 , wherein receiving the packet comprises receiving a command from a network controller that provides the packet to the first MFE to treat the packet as if the first MFE received the packet through an ingress port connected to a virtual machine of the logical network, wherein a source address associated with the packet corresponds to the ingress port.
3. The method of claim 1 , wherein the packet is a first packet, wherein generating the first and second trace-observation data sets is based on the trace indicator, the method further comprising:
receiving a second packet that does not comprise an indicator that the second packet is used for a trace operation;
performing logical and physical forwarding operations on the second packet without generating any trace-observation data sets.
4. The method of claim 1 , wherein performing the logical forwarding operation comprises using a first set of logical forwarding rules to process the packet in order to identify an LFE egress port for the packet.
5. The method of claim 4 , wherein the first trace-observation data set comprises (i) an identifier for the LFE and (ii) a port identifier for the LFE egress port.
6. The method of claim 5 , wherein the LFE is a logical router, wherein the first trace-observation data set further comprises a routing entry matched by the packet.
7. The method of claim 1 , wherein the LFE is a logical switch, wherein the MFE further implements a logical router of the logical network, wherein the logical forwarding operation is a first logical forwarding operation, the method further comprising:
performing, on the packet, a second logical forwarding operation for the logical router;
generating a third set of trace observation data relating to the second logical forwarding operation; and
sending, to the network controller, the third trace-observation data set.
8. The method of claim 1 , wherein performing the physical forwarding operation comprises encapsulating the packet with a tunnel header and sending the packet out a port of the MFE, wherein the second trace-observation data set comprises a tunnel identifier.
9. The method of claim 1 , wherein performing the physical forwarding operation comprises delivering the packet to a virtual machine via a port of the MFE, wherein the second trace-observation data set comprises an MFE identifier and a port identifier.
10. The method of claim 1 , wherein performing the physical forwarding operation comprises forwarding the packet to a second MFE, wherein the second MFE generates and sends a third trace-observation data set for the packet to a second network controller.
11. A non-transitory machine-readable medium storing a managed forwarding element (MFE) which when executed by at least one processing unit implements a logical forwarding element (LFE) of a logical network along with a plurality of other MFEs, the MFE comprising sets of instructions for:
receiving a packet comprising an indicator that the packet is used for a trace operation;
performing a logical forwarding operation on the packet;
generating a first set of trace observation data relating to the logical forwarding operation;
performing a physical forwarding operation;
generating a second set of trace observation data relating to the physical forwarding operation;
sending, to a network controller, the first and second trace-observation data sets.
12. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for receiving the packet comprises a set of instructions for receiving a command from a network controller that provides the packet to the first MFE to treat the packet as if the first MFE received the packet through an ingress port connected to a virtual machine of the logical network, wherein a source address associated with the packet corresponds to the ingress port.
13. The non-transitory machine-readable medium of claim 11 , wherein the packet is a first packet, wherein generating the first and second trace-observation data sets is based on the trace indicator, the MFE further comprising sets of instructions for:
receiving a second packet that does not comprise an indicator that the second packet is used for a trace operation;
performing logical and physical forwarding operations on the second packet without generating any trace-observation data sets.
14. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for performing the logical forwarding operation comprises a set of instructions for using a first set of logical forwarding rules to process the packet in order to identify an LFE egress port for the packet.
15. The non-transitory machine-readable medium of claim 14 , wherein the first trace-observation data set comprises (i) an identifier for the LFE and (ii) a port identifier for the LFE egress port.
16. The non-transitory machine-readable medium of claim 15 , wherein the LFE is a logical router, wherein the first trace-observation data set further comprises a routing entry matched by the packet.
17. The non-transitory machine-readable medium of claim 11 , wherein the LFE is a logical switch, wherein the MFE further implements a logical router of the logical network, wherein the logical forwarding operation is a first logical forwarding operation, the MFE further comprising sets of instructions for:
performing, on the packet, a second logical forwarding operation for the logical router;
generating a third set of trace observation data relating to the second logical forwarding operation; and
sending, to the network controller, the third trace-observation data set.
18. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for performing the physical forwarding operation comprises a set of instructions for encapsulating the packet with a tunnel header and sending the packet out a port of the MFE, wherein the second trace-observation data set comprises a tunnel identifier.
19. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for performing the physical forwarding operation comprises a set of instructions for delivering the packet to a virtual machine via a port of the MFE, wherein the second trace-observation data set comprises an MFE identifier and a port identifier.
20. The non-transitory machine-readable medium of claim 11 , wherein the set of instructions for performing the physical forwarding operation comprises a set of instructions for forwarding the packet to a second MFE, wherein the second MFE generates and sends a third trace-observation data set for the packet to a second network controller.