Abstract: An approach is provided in which a hardware accelerated bridge executing on a network adapter receives an ingress data packet. The data packet includes a destination MAC address that corresponds to a virtual machine, which interfaces to a software bridge executing on a hypervisor. The hardware accelerated bridge identifies a software bridge table entry that includes the destination MAC address and a virtual function identifier, which identifies a virtual function corresponding to the software bridge. In turn, the hardware accelerated bridge sends the data packet from the hardware accelerated bridge to the software bridge through the identified virtual function.

Abstract: A method, apparatus and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.

Abstract: An approach is provided in which a local module receives a data frame initiated by a first virtual machine and has a target destination at a second virtual machine, which executes on a destination host system. The local module identifies a destination local port ID and a destination global queue pair number corresponding to the second virtual machine. In one embodiment, the destination local port ID corresponds to the destination host, but the destination global queue pair number is independent of the destination host. The local module includes the destination global queue pair number and the destination local port ID in an overlay header and encapsulates the data frame with the overlay header, which results in an encapsulated frame. In turn, the local module sends the encapsulated frame through a computer network to the second virtual machine.

Abstract: A method, computer program product, and data processing system for efficiently discovering and storing path MTU information in a sending host are disclosed. In a preferred embodiment, two path MTU tables are maintained. One path MTU table contains MTU values corresponding to the first-hop routers associated with the sending host. The other path MTU table contains MTU values corresponding to individual destination hosts. When the sending host needs to send information to a destination, it first consults the MTU table associated with individual destination hosts. If an entry for that destination host is found in the table, the sending host uses that MTU value. If not, the sending host consults the MTU table for the first-hop router on the path to the destination host and uses that MTU value. If that MTU value is too high, a new entry is made in the host-specific MTU table for the destination host.

Abstract: An approach is provided in which a computer system selects a virtual domain from multiple virtual domains, which are each overlayed onto a physical network and are independent of physical topology constraints of the physical network. The computer system selects, from the selected virtual domain, a first virtual group that includes one or more first virtual network endpoints. Next, the computer system selects, from the selected virtual domain, a second virtual group that includes one or more second virtual network endpoints. In turn, the computer system creates a logical link policy that includes one or more actions corresponding to sending data between the first virtual group and the second virtual group.

Abstract: An approach is provided in which a computer system selects a virtual domain from multiple virtual domains, which are each overlayed onto a physical network and are independent of physical topology constraints of the physical network. The computer system selects, from the selected virtual domain, a first virtual group that includes one or more first virtual network endpoints. Next, the computer system selects, from the selected virtual domain, a second virtual group that includes one or more second virtual network endpoints. In turn, the computer system creates a logical link policy that includes one or more actions corresponding to sending data between the first virtual group and the second virtual group.

Abstract: An approach is provided in which a discovery system receives a migration request to move a virtual machine that executes on a first system. The discovery system identifies a first network adapter corresponding to the first system, and identifies hardware state data used by the first network adapter to process data packets generated by the virtual machine. In turn, the discovery system identifies a second network adapter that is compatible with a native format of the hardware state data, and migrates the virtual machine to a second system corresponding to the identified second network adapter.

Abstract: An approach is provided in which a discovery system receives a migration request to move a virtual machine that executes on a first system. The discovery system identifies a first network adapter corresponding to the first system, and identifies hardware state data used by the first network adapter to process data packets generated by the virtual machine. In turn, the discovery system identifies a second network adapter that is compatible with a native format of the hardware state data, and migrates the virtual machine to a second system corresponding to the identified second network adapter.

Abstract: An approach is provided in which a virtual function, which executes on a network adapter, receives a data packet from a first virtual machine. A translation entry is identified that corresponds to sending the data packet from the first virtual machine to a second virtual machine, and a determination is made as to whether an onboard memory partition assigned to the virtual function includes the identified translation. If the onboard memory location includes the translation entry, the data packet is sent to the destination virtual machine using the translation entry retrieved from the onboard memory partition. Otherwise, if the translation entry is not located in the onboard memory partition, the data packet is sent to the destination virtual machine using a translation entry retrieved from an off board memory location.

Abstract: An approach is provided which a system selects a first virtual function from a plurality of virtual functions executing on a network adapter that includes a memory area. Next, the system allocates, in the memory area, a memory corresponding to the first virtual function. The system then stores one or more translation entries in the allocated memory partition, which are utilized to send data traversing through the first virtual function. As such, the system sends, utilizing one or more of the translation entries, the data packets from the network adapter to one or more destinations. In turn, the system dynamically resizes the memory partition based upon an amount of the memory partition that is utilized to store the one or more translation entries.

Abstract: An approach is provided in which a virtual function, which executes on a network adapter, receives a data packet from a first virtual machine. A translation entry is identified that corresponds to sending the data packet from the first virtual machine to a second virtual machine, and a determination is made as to whether an onboard memory partition assigned to the virtual function includes the identified translation. If the onboard memory location includes the translation entry, the data packet is sent to the destination virtual machine using the translation entry retrieved from the onboard memory partition. Otherwise, if the translation entry is not located in the onboard memory partition, the data packet is sent to the destination virtual machine using a translation entry retrieved from an off board memory location.

Abstract: An approach is provided which a system selects a first virtual function from a plurality of virtual functions executing on a network adapter that includes a memory area. Next, the system allocates, in the memory area, a memory corresponding to the first virtual function. The system then stores one or more translation entries in the allocated memory partition, which are utilized to send data traversing through the first virtual function. As such, the system sends, utilizing one or more of the translation entries, the data packets from the network adapter to one or more destinations. In turn, the system dynamically resizes the memory partition based upon an amount of the memory partition that is utilized to store the one or more translation entries.

Abstract: An approach is provided in which a hypervisor provisions switch resources on a network interface card, which includes a virtual switch and a physical port. The hypervisor invokes a switch control module on a virtual machine, which provides control information to one or more of the switch resources. In turn, one or more of the switch resources utilize the control information to direct data packets between a source virtual machine and a destination virtual machine over one or more virtual networks that are independent of physical topology constraints of a physical network.

Abstract: An approach is provided in which a data traffic module executing on a network interface card receives a data packet initiated by a first virtual machine with a destination at a second virtual machine. The data traffic module identifies one or more physical path translations corresponding to a logical connectivity that is independent of physical topology constraints of a physical network. In turn, the data traffic module encapsulates the data packet with the one or more physical path translations and sends the encapsulated data packet to the second virtual machine over the physical network.

Abstract: An approach is provided in which a data traffic module executing on a network interface card receives a data packet initiated by a first virtual machine with a destination at a second virtual machine. The data traffic module identifies one or more physical path translations corresponding to a logical connectivity that is independent of physical topology constraints of a physical network. In turn, the data traffic module encapsulates the data packet with the one or more physical path translations and sends the encapsulated data packet to the second virtual machine over the physical network.

Abstract: According to one embodiment of the present disclosure, an approach is provided in which a policy module receives data that is initiated by a first virtual machine and has a destination at a second virtual machine. The policy module selects a policy that corresponds to sending the data from the first virtual machine to the second virtual machine. The policy includes one or more logical references to one or more virtual networks, and does not include a physical reference to a physical entity located on a physical network. In turn, the policy module encapsulates the data with a physical path translation that is based upon the selected policy, and sends the encapsulated data over the physical network to a second policy module that corresponds to the second virtual machine.

Abstract: According to one embodiment of the present disclosure, an approach is provided in which a policy server receives a request for a policy from a requestor. The policy server identifies an initiating virtual machine; the initial virtual machine's corresponding virtual network; and a destination virtual machine. Next, a policy corresponding to sending data from the first virtual machine to the second virtual machine is selected. The policy includes one or more logical references to the virtual network and does not include a physical reference to a physical entity located on a physical network. In turn, a physical path translation corresponding to the selected policy is identified and sent to the requestor.

Abstract: According to one embodiment of the present disclosure, an approach is provided in which a policy server receives a request for a policy from a requestor. The policy server identifies an initiating virtual machine; the initial virtual machine's corresponding virtual network; and a destination virtual machine. Next, a policy corresponding to sending data from the first virtual machine to the second virtual machine is selected. The policy includes one or more logical references to the virtual network and does not include a physical reference to a physical entity located on a physical network. In turn, a physical path translation corresponding to the selected policy is identified and sent to the requestor.

Abstract: According to one embodiment of the present disclosure, an approach is provided in which a policy module receives data that is initiated by a first virtual machine and has a destination at a second virtual machine. The policy module selects a policy that corresponds to sending the data from the first virtual machine to the second virtual machine. The policy includes one or more logical references to one or more virtual networks, and does not include a physical reference to a physical entity located on a physical network. In turn, the policy module encapsulates the data with a physical path translation that is based upon the selected policy, and sends the encapsulated data over the physical network to a second policy module that corresponds to the second virtual machine.

Abstract: A network switch, in response to receipt from a source station of a Layer 2 reservation request, establishes a reservation for capacity of an ingress queue of the network switch for a data flow of the source station. In response to a queue overrun condition on the ingress queue of the network switch while the reservation is active, the network switch preserves data frames in the data flow of the source station transmitted pursuant to the reservation and discards other data frames.