DHCP-communications monitoring by a network controller in software defined network environments
Methods and apparatus to manage a dynamic deployment environment including one or more virtual machines is provided herein. A disclosed example includes involves: scanning, by executing a computer readable instruction with a processor, the virtual machines in the deployment environment to identify a service installed on any of the virtual machines; determining, by executing a computer readable instruction with the processor, the identified service corresponds to a service monitoring rule; determining, by executing a computer readable instruction with the processor, that a monitoring agent identified by the service monitoring rule is installed on the one or more virtual machines on which the service is installed; and configuring the monitoring agent, by executing a computer readable instruction with the processor, to monitor the service in accordance with the service monitoring rule on the at least one of the virtual machines on which the service is installed.
1. A computer-implemented method for DHCP-communications monitoring by a network controller, the method comprising:
detecting that a virtualized compute instance is instantiated on a host computer;
determining an IP address that has been assigned to a port of the virtualized compute instance;
transmitting a SpoofGaurd with the IP address to a port manager;
in response to the transmitting, receiving an indication that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed; and
in response to determining that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed, transmitting, to the port manager, instructions to set a BLOCK-EXCEPT-DHCP status on the port assigned to the virtualized compute instance.
2. The computer-implemented method of claim 1 , wherein setting the BLOCK-EXCEPT-DHCP status on the port causes the port manager of the port to block any traffic to and from the port except DHCP-related traffic.
3. The computer-implemented method of claim 1 , further comprising: determining the IP address has been assigned to the port of the virtualized compute instance by a DHCP service.
4. The computer-implemented method of claim 3 , wherein determining, the IP address has been assigned to the port of the virtualized compute instance by the DHCP service includes receiving, from the DHCP service or a datapath process, an indication that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service and the IP address that has been assigned.
5. The computer-implemented method of claim 3 , further comprising transmitting, by a DHCP client executing on the host computer, a DHCP discovery to the DHCP service; receiving, by the DHCP client, a DHCP offer from the DHCP service; transmitting, by the DHCP client, a DHCP request to the DHCP service; and receiving, by the DHCP client, a DHCP acknowledgment and the IP address from the DHCP services.
6. The computer-implemented method of claim 1 , wherein determining the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed comprises determining one or more of: whether the virtualized compute instance started using an IP address that is different than the IP address assigned to the port of the virtualized compute instance by a DHCP service, whether a lease on the IP address assigned to the port of the virtualized compute instance by the DHCP service has expired, or whether another virtualized compute instance started using the IP address assigned to the port of the virtualized compute instance by the DHCP service.
7. The computer-implemented method of claim 1 , further comprising transmitting, to the port manager, a SpoofGuard configured with the IP address assigned to the port of the virtualized compute instance, the transmitting causing the port manager to install and configure the SpoofGuard to monitor whether the IP address assigned to the virtualized compute instance is misused or spoofed.
8. One or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by one or more processors, cause the one or more processors to perform:
detecting that a virtualized compute instance is instantiated on a host computer;
determining an IP address that has been assigned to a port of the virtualized compute instance;
transmitting a SpoofGaurd with the IP address to a port manager;
in response to the transmitting, receiving an indication that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed; and
in response to determining that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed, transmitting, to the port manager, instructions to set a BLOCK-EXCEPT-DHCP status on the port assigned to the virtualized compute instance.
9. The one or more non-transitory computer-readable storage media of claim 8 , wherein setting the BLOCK-EXCEPT-DHCP status on the port causes the port manager of the port to block any traffic to and from the port except DHCP-related traffic.
10. The one or more non-transitory computer-readable storage media of claim 8 , wherein the one or more computer instructions further cause the one or more processors to perform the following: determining the IP address has been assigned to the port of the virtualized compute instance by a DHCP service.
11. The one or more non-transitory computer-readable storage media of claim 10 , wherein determining, the IP address has been assigned to the port of the virtualized compute instance by the DHCP service includes receiving, from the DHCP service or a datapath process, an indication that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service and the IP address that has been assigned.
12. The one or more non-transitory computer-readable storage media of claim 10 , wherein the one or more computer instructions further cause the one or more processors to perform the following: transmitting, by a DHCP client executing on the host computer, a DHCP discovery to the DHCP service; receiving, by the DHCP client, a DHCP offer from the DHCP service; transmitting, by the DHCP client, a DHCP request to the DHCP service; and receiving, by the DHCP client, a DHCP acknowledgment and the IP address from the DHCP services.
13. The one or more non-transitory computer-readable storage media of claim 8 , wherein determining the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed comprises determining one or more of: whether the virtualized compute instance started using an IP address that is different than the IP address assigned to the port of the virtualized compute instance by a DHCP service, whether a lease on the IP address assigned to the port of the virtualized compute instance by the DHCP service has expired, or whether another virtualized compute instance started using the IP address assigned to the port of the virtualized compute instance by the DHCP service.
14. The one or more non-transitory computer-readable storage media of claim 8 , wherein the one or more computer instructions further cause the one or more processors to perform the following: transmitting, to the port manager, a SpoofGuard configured with the IP address assigned to the port of the virtualized compute instance, the transmitting causing the port manager to install and configure the SpoofGuard to monitor whether the IP address assigned to the virtualized compute instance is misused or spoofed.
15. A network controller configured to implement mechanisms for DHCP-communications monitoring in software defined networks, the network controller comprising:
one or more processors; one or more memory units; and
one or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by the one or more processors, cause the one or more processors to perform:
detecting that a virtualized compute instance is instantiated on a host computer;
determining an IP address that has been assigned to a port of the virtualized compute instance;
transmitting a SpoofGaurd with the IP address to a port manager;
in response to the transmitting, receiving an indication that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed; and
in response to determining that the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed, transmitting, to the port manager, instructions to set a BLOCK-EXCEPT-DHCP status on the port assigned to the virtualized compute instance.
16. The network controller of claim 15 , storing additional instructions for setting the BLOCK-EXCEPT-DHCP status on the port by causing the port manager of the port to block any traffic to and from the port except DHCP-related traffic.
17. The network controller of claim 15 , wherein the one or more computer instructions further cause the one or more processors to perform the following: determining the IP address has been assigned to the port of the virtualized compute instance by a DHCP service.
18. The network controller of claim 17 , wherein determining, the IP address has been assigned to the port of the virtualized compute instance by the DHCP service includes receiving, from the DHCP service or a datapath process, an indication that the IP address has been assigned to the port of the virtualized compute instance by the DHCP service and the IP address that has been assigned.
19. The network controller of claim 17 , wherein the one or more computer instructions further cause the one or more processors to perform the following: transmitting, by a DHCP client executing on the host computer, a DHCP discovery to the DHCP service; receiving, by the DHCP client, a DHCP offer from the DHCP service; transmitting, by the DHCP client, a DHCP request to the DHCP service; and receiving, by the DHCP client, a DHCP acknowledgment and the IP address from the DHCP services.
20. The network controller of claim 15 , wherein determining the IP address assigned to the port of the virtualized compute instance has been misused, expired or spoofed comprises determining one or more of: whether the virtualized compute instance started using an IP address that is different than the IP address assigned to the port of the virtualized compute instance by a DHCP service, whether a lease on the IP address assigned to the port of the virtualized compute instance by the DHCP service has expired, or whether another virtualized compute instance started using the IP address assigned to the port of the virtualized compute instance by the DHCP service.