Context-aware network introspection in software-defined networking (SDN) environments

1. A method for a first host to perform context-aware network introspection in a software-defined networking (SDN) environment that includes the first host, a second host and a third host, wherein the first host supports a first endpoint and a second endpoint, and the method comprises:

detecting multiple packet flows that include an egress packet flow originating from the first endpoint and destined for the second host, and an ingress packet flow originating from the second host or the third host and destined for the first endpoint or the second endpoint;

in response to detecting the egress packet flow, obtaining first packet flow information identifying the egress packet flow, and first context information identifying a first application or a first user associated with the first endpoint;

in response to detecting the ingress packet flow, obtaining second packet flow information identifying the ingress packet flow, and second context information identifying a second application or a second user associated with the second host or the third host;

generating network map information that identifies the egress packet flow based on the first packet flow information and first context information, and the ingress packet flow based on the second packet flow information and second context information; and

after generating the network map information, generating an encapsulated packet by encapsulating an egress packet from the egress packet flow with an outer header that includes the first context information.

2. The method of claim 1 , wherein the method further comprises:

aggregating the network map information, being first network map information, with at least one of the following: second network map information generated by the second host based on packet flows detected by the second host and third network map information generated by the third host based on packet flows detected by the third host.

3. The method of claim 2 , wherein the method further comprises:

performing verification of the first network map information based on at least one of the following: the second network map information generated by the second host and the third network map information generated by the third host.

4. The method of claim 1 , wherein the method further comprises:

based on the network map information, generating a network map that provides a visualization of the egress packet flow using the first packet flow information and first context information, and the ingress packet flow using the second packet flow information and second context information.

5. The method of claim 1 , wherein the method further comprises:

sending the encapsulated packet to the second host to cause the second host to perform context-aware network mapping based on the first context information.

6. The method of claim 1 , wherein obtaining the first context information comprises:

obtaining, from an agent implemented by the first endpoint, the first context information that includes at least one of the following: application information associated with the first application and user information associated with the first user operating the first application.

7. The method of claim 1 , wherein obtaining the second context information comprises:

obtaining the second context information from an outer header of an ingress packet from the ingress packet flow, wherein the second context information includes at least one of the following: application information associated with the second application and user information associated with the second user operating the second application.

8. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a first host, cause the processor to perform a method of context-aware network introspection in a software-defined networking (SDN) environment that includes the first host, a second host and a third host, wherein the first host supports a first endpoint and a second endpoint, and the method comprises:

detecting multiple packet flows that include an egress packet flow originating from the first endpoint and destined for the second host, and an ingress packet flow originating from the second host or the third host and destined for the first endpoint or the second endpoint;

in response to detecting the egress packet flow, obtaining first packet flow information identifying the egress packet flow, and first context information identifying a first application or a first user associated with the first endpoint;

in response to detecting the ingress packet flow, obtaining second packet flow information identifying the ingress packet flow, and second context information identifying a second application or a second user associated with the second host or the third host;

generating network map information that identifies the egress packet flow based on the first packet flow information and first context information, and the ingress packet flow based on the second packet flow information and second context information; and

after generating the network map information, generating an encapsulated packet by encapsulating an egress packet from the egress packet flow with an outer header that includes the first context information.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:

aggregating the network map information, being first network map information, with at least one of the following: second network map information generated by the second host based on packet flows detected by the second host and third network map information generated by the third host based on packet flows detected by the third host.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises:

performing verification of the first network map information based on at least one of the following: the second network map information generated by the second host and the third network map information generated by the third host.

11. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:

based on the network map information, generating a network map that provides a visualization of the egress packet flow using the first packet flow information and first context information, and the ingress packet flow using the second packet flow information and second context information.

12. The non-transitory computer-readable storage medium of claim 8 , wherein the method further comprises:

sending the encapsulated packet to the second host to cause the second host to perform context-aware network mapping based on the first context information.

13. The non-transitory computer-readable storage medium of claim 8 , wherein obtaining the first context information comprises:

obtaining, from an agent implemented by the first endpoint, the first context information that includes at least one of the following: application information associated with the first application and user information associated with the first user operating the first application.

14. The non-transitory computer-readable storage medium of claim 8 , wherein obtaining the second context information comprises:

obtaining the second context information from an outer header of an ingress packet from the ingress packet flow, wherein the second context information includes at least one of the following: application information associated with the second application and user information associated with the second user operating the second application.

15. A first host configured to perform context-aware network introspection in a software-defined networking (SDN) environment that includes the first host, a second host and a third host, wherein the first host comprises:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that cause the processor to support a first endpoint and a second endpoint and to perform the following:

detect multiple packet flows that include an egress packet flow originating from the first endpoint and destined for the second host, and an ingress packet flow originating from the second host or the third host and destined for the first endpoint or the second endpoint;

in response to detecting the egress packet flow, obtain first packet flow information identifying the egress packet flow, and first context information identifying a first application or a first user associated with the first endpoint;

in response to detecting the ingress packet flow, obtain second packet flow information identifying the ingress packet flow, and second context information identifying a second application or a second user associated with the second host or the third host;

generate network map information that identifies the egress packet flow based on the first packet flow information and first context information, and the ingress packet flow based on the second packet flow information and second context information; and

after generating the network map information, generate an encapsulated packet by encapsulating an egress packet from the egress packet flow with an outer header that includes the first context information.

16. The first host of claim 15 , wherein the instructions further cause the processor to:

aggregate the network map information, being first network map information, with at least one of the following: second network map information generated by the second host based on packet flows detected by the second host and third network map information generated by the third host based on packet flows detected by the third host.

17. The first host of claim 16 , wherein the instructions further cause the processor to:

perform verification of the first network map information based on at least one of the following: the second network map information generated by the second host and the third network map information generated by the third host.

18. The first host of claim 15 , wherein the instructions further cause the processor to:

based on the network map information, generate a network map that provides a visualization of the egress packet flow using the first packet flow information and first context information, and the ingress packet flow using the second packet flow information and second context information.

19. The first host of claim 15 wherein the instructions further cause the processor to:

send the encapsulated packet to the second host to cause the second host to perform context-aware network mapping based on the first context information.

20. The first host of claim 15 , wherein the instructions for obtaining the first context information cause the processor to:

obtain, from an agent implemented by the first endpoint, the first context information that includes at least one of the following: application information associated with the first application and user information associated with the first user operating the first application.

21. The first host of claim 15 , wherein the instructions for obtaining the second context information cause the processor to:

obtain the second context information from an outer header of an ingress packet from the ingress packet flow, wherein the second context information includes at least one of the following: application information associated with the second application and user information associated with the second user operating the second application.