Filtering and classifying multicast network traffic
Described herein are systems and methods to filter and classify multicast network traffic. In one example, a first computing node may receive a multicast communication from a second computing node and register a for a flow associated with the multicast communication, wherein the context includes at least the multicast port associated with the multicast communication. The first computing node further identifies an outbound communication destined for the second computing node and determines that addressing attributes in the outbound communication match the context for the flow. Once it is determined that the attributes match the context for the flow, the first computing node associates the outbound communication with the flow.
1. A method comprising:
in a first computing node, generating a multicast communication, wherein the multicast communication uses a multicast internet protocol (IP) address as a destination IP address;
in the first computing node, associating the multicast communication with a flow;
in the first computing node, communicating the multicast communication to a second computing node;
in the first computing node, receiving a second communication from the second computing node, wherein the second communication uses a second IP address associated with the second computing node as a source IP address;
in the first computing node, determining whether the second communication is received within a timeout period associated with the multicast communication;
in the first computing node and when the second communication is received within the timeout period associated with the multicast communication, associating the second communication with the flow; and
in the first computing node and when the second communication is not received within the timeout period associated with the multicast communication, associating the second communication with a second flow.
2. The method of claim 1 further comprising, in the first computing node, communicating the multicast communication to one or more additional computing nodes.
3. The method of claim 1 , wherein the first computing node and the second computing node comprise virtual machines.
4. The method of claim 1 , wherein the first computing node and the second computing node comprise containers.
5. The method of claim 1 further comprising:
in the second computing node, obtaining the multicast communication from the first computing node;
in the second computing node, registering a context for a second flow associated with the multicast communication, wherein the context comprises at least the IP address associated with the second computing node that is different than the multicast IP address;
in the second computing node, identifying the second communication destined for the first computing node;
in the second computing node, determining that addressing attributes in the second communication match the context for the second flow; and
in the second computing node and in response to determining that the addressing attributes in the second communication match the context for the second flow, processing the second communication in accordance with one or more policy rules for the second flow.
6. The method of claim 5 , wherein the context further comprises an IP address associated with the first computing node, a multicast port identified in the multicast communication, and a port associated with the first computing node.
7. The method of claim 1 , wherein the multicast communication and the second communication comprise the same ports for the first computing system and the second computing system.
8. A system comprising:
a first computing node; and
a second computing node;
the first computing node configured to:
generate a multicast communication, wherein the multicast communication uses a multicast internet protocol (IP) address as a destination IP address;
associate the multicast communication with a flow;
communicate the multicast communication to the second computing node;
receive a second communication from the second computing node, wherein the second communication uses a second IP address associated with the second computing node as a source IP address;
determine whether the second communication is received within a timeout period associated with the multicast communication;
when the second communication is received within the timeout period associated with the multicast communication, associate the second communication with the flow; and
when the second communication is not received within the timeout period associated with the multicast communication, associate the second communication with a second flow.
9. The system of claim 8 , wherein the first computing node is further configured to:
communicating the multicast communication to one or more additional computing nodes.
10. The system of claim 8 , wherein the second computing node is further configured to:
obtain the multicast communication from the first computing node;
register a context for a second flow associated with the multicast communication, wherein the context comprises at least the IP address associated with the second computing node that is different than the multicast IP address;
identify the second communication destined for the first computing node;
determining that addressing attributes in the second communication match the context for the second flow; and
in response to determining that the addressing attributes in the second communication match the context for the second flow, process the second communication in accordance with one or more policy rules for the second flow.
11. The system of claim 10 , wherein the context further comprises an IP address associated with the first computing node, a multicast port identified in the multicast communication, and a port associated with the first computing node.
12. The system of claim 10 , wherein the second computing node is further configured to communicate the second communication to the first computing node.
13. The system of claim 8 , wherein the multicast communication and the second communication comprise the same ports for the first computing system and the second computing system.
14. A computing apparatus comprising:
a storage system;
a processing system operatively coupled to the storage system; and
program instructions stored on the storage system that, when executed by the processing system, direct the computing apparatus to:
in a first computing node, generate a multicast communication, wherein the multicast communication uses a multicast internet protocol (IP) address as a destination IP address;
in the first computing node, associate the multicast communication with a flow;
in the first computing node, communicate the multicast communication to a second computing node;
in the first computing node, receive a second communication from the second computing node, wherein the second communication uses a second IP address associated with the second computing node as a source IP address;
in the first computing node, determine whether the second communication is received within a timeout period associated with the multicast communication;
in the first computing node and when the second communication is received within the timeout period associated with the multicast communication, associate the second communication with the flow; and
in the first computing node and when the second communication is not received within the timeout period associated with the multicast communication, associating the second communication with a second flow.
15. The computing apparatus of claim 14 , wherein the program instructions further direct the computing apparatus to:
communicate the multicast communication to one or more additional computing nodes.
16. The computing apparatus of claim 14 , wherein the first computing node and the second computing node comprise containers or virtual machines.
17. The computing apparatus of claim 14 , wherein the multicast communication and the second communication comprise the same ports for the first computing system and the second computing system.