Field of the Invention
The present invention generally relates to network control, and, more specifically, to techniques for sending notifications to network control software with advance source media access control (MAC) address learning.
Description of Related Art
Server virtualization permits a physical computer system's hardware resources to be shared between virtual machines (VMs). Multiple VMs, each with its own operating system, run in parallel on a single physical machine, without being aware of the virtualization environment. A software entity called the hypervisor (or virtual machine monitor) monitors execution of the VMs and distributes hardware resources between the VMs.
Software exists for controlling networks and, in particular, configuring network settings for VMs. IBM VMReady® is one network control program that permits, among other things: discovery of VM MAC and IP addresses and hypervisor management interfaces for MAC and IP address and how they are connected to a physical switch; VMs to be grouped together to provide VM isolation at the layer 2 (data link layer) of the Open Systems Interconnection (OSI) model, and the same networking policies assigned to VMs in a given group; virtual networks to be configured using application programming interfaces (APIs) provided by the virtual environment; and detecting VM migration from one location to another and automatically moving network attributes such that VMs maintain their network policies as they migrate. To accomplish these and other tasks, the network control software may need to be notified of packets being received from new VMs and VMs that have moved. For example, to move network attributes in response to VM migration, network control software may need to receive notification from the switch whenever the switch detects VM migration. As another example, network control software may need to be notified by the switch in order to validate new and moved VMs. To validate new and moved VMs, the network control software may communicate with the hypervisor to determine if the VM source MAC address and source port are valid. If the hypervisor does not validate the information that is contained in the network control software notification, then the network control software will not validate the forwarding database entry for the VM and will set up an access control list (ACL) rule to discard all frames with that source MAC address. VM validation ensures that only known, registered VMs are sending traffic on the network, thereby protecting the network from unknown or malicious traffic. VM validation also allows the network control software to set up ACL rules for validated VMs. Without receiving a notification about new or moved VMs, the network control software would not know to set up such ACL rules.
One traditional technique for notifying network control software of new and moved VMs uses ACL rules on received packets to determine when a notification to the network control software is needed. Notifications then pass through a packet rate limiter which limits the rate at which notifications are sent to the network control software to not overwhelm it. However, the packet rate limiter only controls the rate of notifications and has no knowledge of the contents of the notifications. As a result, some notifications may be sent at a higher rate than desired, which wastes bandwidth, while others may be sent at a lower rate than desired, which increases the time it takes for the notification to reach the network control software. For example, assume the switch receives packets from two new VMs and decides to redirect these packets (as notifications) to the network control software. In such a case, the rate limiter may allow the packet from the first VM to be sent, but discard the packet from the second VM. As more packets are received from the second VM, probability suggests that one of those packets will eventually be sent to the network control software. However, the inability to control how often the packets are sent means that, e.g., packets from the second VM may take a long time to reach the network control software, while packets from the first VM may be sent to the network control software at a higher rate than desired.