Granted Patent B2

US 12,549,507 · App. 18/415,373 · Granted Feb 10, 2026

Inventors: Kedar Shrikrishna Patwardhan (Urbana, IL); Pratik Vijay Panjwani (San Jose, CA); Rutuja Umesh Madhure (Pune, IN); Sunil Khushal Patil (Pune, IN)

Assignee: Nutanix, Inc.

H04L61/103H04L61/5007H04L69/22

Abstract

Claims (53)

1 . A method, comprising:

determining, by a computing system in a distributed system, that a packet is from a first virtual machine (VM) running on the computing system and destined to a second VM running on a second computing system;

determining a first transit Internet Protocol (IP) address of a first VM and a second transit IP address of the second VM, wherein a transit IP address of a respective VM is distinct from a primary IP address using which the VM participates in routing;

modifying a layer-2 header of the packet to replace source and destination media access control (MAC) addresses in the layer-2 header with a first MAC address of the computing system and a second MAC address of the second computing system, respectively;

modifying a layer-3 header of the packet to replace source and destination IP addresses in the layer-3 header of the packet with the first and second transit IP addresses, respectively; and

determining, for the packet, an egress port corresponding to the second computing system based on the modified layer-2 header.

2 . The method of claim 1 , further comprising:

mapping, at the computing system, the first transit IP address to IP and MAC addresses of a first VM; and

mapping, at the computing system, the second transit IP address to IP and MAC addresses of a second VM.

3 . The method of claim 2 , wherein the first and second VMs belong to a virtual private cloud (VPC) in the distributed system, and wherein the IP addresses of the first and second VMs are allocated from a first IP address space associated with the VPC.

4 . The method of claim 3 , wherein the first and second transit IP addresses are allocated from a second IP address space spanning a respective VPC in the distributed system, and wherein the second IP address space is distinct from the first IP address space.

5 . The method of claim 1 , wherein the computing system and the second computing system are in a same layer-2 forwarding domain.

6 . The method of claim 1 , further comprising:

receiving, from a management device, one or more flow rules instructing the computing system to modify layer-2 and layer-3 headers of an inter-VM packet; and

programming the one or more flow rules at the computing system.

7 . The method of claim 6 , further comprising receiving, from the management device, information indicating allocation of the first and second transit IP addresses to the first and second VMs, respectively.

8 . The method of claim 1 , further comprising:

receiving, from the first VM, an address resolution protocol (ARP) request for an IP address of the second VM;

generating an ARP response comprising a MAC address of the second VM from within the computing system; and

providing the ARP response to the first VM.

9 . A method, comprising:

determining, by a computing system of a distributed system running a first virtual machine (VM), that a packet is received from a second VM running on a second computing system;

obtaining a first transit Internet Protocol (IP) address of the first VM and a second transit IP address of the second VM from a layer-3 header of the packet, wherein a transit IP address of a respective VM is distinct from a primary IP address using which the VM participates in routing;

obtaining a first primary IP address and a first media access control (MAC) address of the first VM based on the first transit IP address;

obtaining a second primary IP address and a second MAC address of the second VM based on the second transit IP address;

modifying the packet to replace destination and source MAC addresses in a layer-2 header with the first and second MAC addresses, respectively;

modifying the packet to replace destination and source IP addresses in the layer-3 header with the first and second primary IP addresses, respectively; and

providing the modified packet to the second VM.

10 . The method of claim 9 , further comprising:

mapping, at the computing system, the first transit IP address to the first primary IP address and the first MAC address; and

mapping, at the computing system, the second transit IP address to the second primary IP address and the second MAC address.

11 . The method of claim 10 , wherein the first and second VMs belong to a virtual private cloud (VPC) in the distributed system, and wherein the first and second primary IP addresses are allocated from a first IP address space associated with the VPC.

12 . The method of claim 11 , wherein the first and second transit IP addresses are allocated from a second IP address space spanning a respective VPC in the distributed system, and wherein the second IP address space is distinct from the first IP address space.

13 . The method of claim 9 , wherein the computing system and the second computing system are in a same layer-2 forwarding domain.

14 . The method of claim 9 , further comprising:

receiving, from a management device, one or more flow rules instructing the computing system to modify layer-2 and layer-3 headers of an ingress inter-VM packet; and

programming the one or more flow rules at the computing system.

15 . The method of claim 14 , further comprising receiving, from the management device, information indicating allocation of the first and second transit IP addresses to the first and second VMs, respectively.

16 . The method of claim 9 , further comprising:

receiving, from the first VM, an address resolution protocol (ARP) request for an IP address of the second VM;

generating an ARP response comprising a MAC address of the second VM from within the computing system; and

providing the ARP response to the first VM.

17 . A computing system, comprising:

a processor; and

a memory coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method, the method comprising:

determining that a packet is from a first virtual machine (VM) running on the computing system and destined to a second VM running on a second computing system;

determining a first transit Internet Protocol (IP) address of a first VM and a second transit IP address of the second VM, wherein a transit IP address of a respective VM is distinct from a primary IP address using which the VM participates in routing;

modifying a layer-2 header of the packet to replace source and destination media access control (MAC) addresses in the layer-2 header with a first MAC address of the computing system and a second MAC address of the second computing system, respectively;

modifying a layer-3 header of the packet to replace source and destination IP addresses in the layer-3 header of the packet with the first and second transit IP addresses, respectively; and

determining, for the packet, an egress port corresponding to the second computing system based on the modified layer-2 header.

18 . The computing system of claim 17 , wherein the first and second VMs belong to a virtual private cloud (VPC) in the distributed system, and wherein the first and second primary IP addresses are allocated from a first IP address space associated with the VPC.

19 . The computing system of claim 18 , wherein the first and second transit IP addresses are allocated from a second IP address space spanning a respective VPC, and wherein the second IP address space is distinct from the first IP address space.

20 . The computing system of claim 17 , wherein the computing system resides in a same layer-2 forwarding domain as the second computing system.

Assignments (2)

Continuity (1)

References Cited (32)