Abstract: Some embodiments of the present invention provide a system for packet classification and spreading in a virtualized system. The system can use information in a packet's header to determine a destination system-image in the virtualized system, and a packet-spreading policy for the destination system-image. The system can determine a key using the information in a packet's header. Alternatively, the system can hash the information in the packet's header to obtain an index value. Next, the system can use the key or the index value to perform a lookup in a table which associates keys or index values with system images and/or packet-spreading policies. Once the destination system-image and the packet-spreading policy are determined, the system can deliver the packet to a thread on the destination system-image according to the packet-spreading policy.

Abstract: Some embodiments of the present invention provide a system for packet classification and spreading in a virtualized system. The system can use information in a packet's header to determine a destination system-image in the virtualized system, and a packet-spreading policy for the destination system-image. The system can determine a key using the information in a packet's header. Alternatively, the system can hash the information in the packet's header to obtain an index value. Next, the system can use the key or the index value to perform a lookup in a table which associates keys or index values with system images and/or packet-spreading policies. Once the destination system-image and the packet-spreading policy are determined, the system can deliver the packet to a thread on the destination system-image according to the packet-spreading policy.

Abstract: A flow manager may receive prioritized packet flow rules from one or more network services where each rule may include a packet filter and prioritized actions. Each action of a packet flow rule may be either terminating or non-terminating. A flow manager may generate a unified rule set according to the received packet flow rules and may additionally validate the unified rule set to identity errors. When validating the unified rule set, a flow manager may compare the unified rule set against one or more defined policies. Alternatively, a flow manager may apply the unified rule set to either captured or manually specified simulated network packets. A flow manager may also identity extraneous rules or actions. Further, a flow manager may present the unified rule set for manual verification and may receive input identifying errors and specifying modification to correct the errors.

Abstract: A datacenter system including a plurality of nodes configured to send and receive a service request, a service table on the plurality of nodes configured to store route information extracted from a signaling mechanism, and a forwarding engine configured to route the service request to at least one of the plurality of nodes using route information from the service table.

Abstract: A flow manager may receive packet flow rules from one or more network services and may generate a unified rule set according to the received packet flow rules. A flow manager may additionally split the unified rule set into subsets for enforcement by one or more flow enforcement devices and may install the rule subsets onto the flow enforcement devices. When splitting the unified rule set into subsets, a flow manager may analyze a network topology connecting the flow enforcement devices. A flow manager may also receive additional packet flow rules, integrate them into the unified rule set, update the rule subsets according to the additional rules, and install the updated subsets onto the flow enforcement devices.

Abstract: One embodiment of the present invention provides a system that resolves conflicts between network service rules for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes. The system operates by receiving a set of network service rules for network data traffic from multiple network services, wherein network service rules from different network services can possibly conflict. Each of these network service rules specifies: a filter that defines a prefix for a set of packets in the packet flow, and an action list that specifies one or more actions to be applied to the set of packets. Next, the system identifies a conflict between a higher priority rule and a lower priority rule in the set of network service rules. The system resolves this conflict by prepending an action list of the higher priority rule to an action list of a rule with a filter that defines a longer prefix.

Abstract: One embodiment of the present invention provides a system that resolves conflicts between rules for network services. During operation, the system receives a set of network service rules for network data traffic from multiple network services, wherein network service rules from different network services can possibly conflict. Next, the system identifies conflicts between pairs of network service rules in the set of network service rules. The system then determines a priority relationship between each pair of conflicting network service rules, and assigns priorities to the network service rules in a manner consistent with the determined priority relationships. This allows conflicts between network service rules to be subsequently resolved based on the assigned priorities.

Abstract: One embodiment of the present invention provides a system that facilitates managing network data traffic for multiple network services. During operation, the system receives flow rules for network data traffic from multiple network services, wherein the flow rules can possibly conflict. Next, the system collapses the flow rules from the multiple network services into a consistent set of flow rules in a low-level form that can be efficiently applied to a packet flow. The system subsequently installs the consistent set of flow rules into a flow enforcement device, which applies the consistent set of flow rules to a packet flow received from a high-speed network connection. In this way, the flow rules from the multiple network services can be simultaneously applied to packet flow, instead of being applied separately by each network service.