Abstract: Some embodiments provide a forwarding element that parses a packet to selectively extract a set of header field values for a flow key. The forwarding element then uses the flow key to find a matching flow to process the packet. In some embodiments, the forwarding element chooses the set of header values following the match pattern of a set of one or more flows. The forwarding element of some embodiments chooses the set of header values based on a wildcard mask that is associated with a flow entry or a flow table mask that is associated with a flow table.

Abstract: Some embodiments provide a method for a managed forwarding element that processes packets through a set of packet processing tables by matching rules in the tables. The method receives an update that requires modification to at least one of the packet processing tables. Each rule in the packet processing tables is assigned a range of packet processing table versions in which the rule is valid for processing packets. The method modifies the packet processing tables according to the received update by at least one of (i) modifying the range of packet processing table versions in which an existing rule is valid to end after a current packet processing table version and (ii) adding a new rule with a range of valid packet processing table versions that begins with a next packet processing table version. The method increments the current version of the packet processing tables to commit the modifications.

Abstract: A method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE) is provided. The method sends a first packet from the MFE to a connection tracker that stores headers of a set of original direction packets that each established a new connection. The method receives, from the connection tracker, the first packet with the header of an original direction packet associated with the first packet appended to the first packet. The header of the original direction packet includes (i) a second set of IP addresses different than a first set of IP addresses of the first packet and (ii) stateful connection status information. The method replaces a first set of IP addresses of the first packet with the second set of IP addresses and performs a matching operation on the packet based on the second set of IP addresses and the stateful connection status information.

Abstract: Some embodiments provide a method for a forwarding element that forwards packets. The method receives a packet. The method performs a first stage lookup of a hash table for a first hash of a first set of header fields and un-wildcards bits of a wildcard mask that corresponds to the first set of header fields. If a matching hash is found in the first stage lookup, the method performs a second stage lookup of the hash table for a second hash of a second set of header fields and un-wildcards bits of the wildcard mask that corresponds to the second set of header fields. The method identifies a matching rule for the packet. The method generates a flow based on the matching rule and the wildcard mask, wherein the flow is used to process each other packets that match each bit which is un-wildcarded.

Abstract: Some embodiments provide a method for a managed forwarding element that processes packets through a set of packet processing tables by matching rules in the tables. The method receives an update that requires modification to at least one of the packet processing tables. Each rule in the packet processing tables is assigned a range of packet processing table versions in which the rule is valid for processing packets. The method modifies the packet processing tables according to the received update by at least one of (i) modifying the range of packet processing table versions in which an existing rule is valid to end after a current packet processing table version and (ii) adding a new rule with a range of valid packet processing table versions that begins with a next packet processing table version. The method increments the current version of the packet processing tables to commit the modifications.

Abstract: Some embodiments provide a method for a managed forwarding element that processes packets through a set of packet processing tables by matching rules in the tables. The method receives an update that requires modification to at least one of the packet processing tables. Each rule in the packet processing tables is assigned a range of packet processing table versions in which the rule is valid for processing packets. The method modifies the packet processing tables according to the received update by at least one of (i) modifying the range of packet processing table versions in which an existing rule is valid to end after a current packet processing table version and (ii) adding a new rule with a range of valid packet processing table versions that begins with a next packet processing table version. The method increments the current version of the packet processing tables to commit the modifications.

Abstract: A method for performing stateful processing of a packet at a flow-based managed forwarding element (MFE) is provided. The method sends a first packet from the MFE to a connection tracker that stores headers of a set of original direction packets that each established a new connection. The method receives, from the connection tracker, the first packet with the header of an original direction packet associated with the first packet appended to the first packet. The header of the original direction packet includes (i) a second set of IP addresses different than a first set of IP addresses of the first packet and (ii) stateful connection status information. The method replaces a first set of IP addresses of the first packet with the second set of IP addresses and performs a matching operation on the packet based on the second set of IP addresses and the stateful connection status information.

Abstract: Some embodiments provide a physical forwarding element that hashes portions of packet headers using several novel hashing techniques. The techniques include a novel set of finishing operations that improve the quality of resulting hashes by increasing their distribution and improving their apparent-randomness. In some embodiments, the finishing operation includes at least one of multiplying the hash by a prime number to increase distribution of the bits of the hash, accumulating a length of the portion into the hash, and combining higher bits of the hash with lower bits of the hash in order to increase the entropy of the lower bits of the hash.

Abstract: Some embodiments provide a method for a managed forwarding element. The method receives a set of packets for processing by the managed forwarding element. For each of several packets in the set, the method associates the packet with one of several groups of other packets in the set. Each group of packets shares a set of characteristics. For each group of packets the method identifies a set of actions to perform and executes the specified set of actions on all of the packets in the group together.

Abstract: Some embodiments provide a method for preserving temporary storage values of a packet processed by a managed forwarding element (MFE. While processing a packet at the MFE, the method identifies that the packet is to be recirculated as a new packet for the MFE. A set of packet field values used for processing the packet by the MFE are associated with the packet. The method stores the set of packet field values with an identifier value. The method recirculates the packet with the identifier value attached to the packet. Upon receiving the recirculated packet, the method uses the identifier value to restore the set of packet field values for the recirculated packet.

Abstract: Some embodiments provide a method for a forwarding element that forwards packets. The method receives a packet. The method performs a first stage lookup of a hash table for a first hash of a first set of header fields and un-wildcards bits of a wildcard mask that corresponds to the first set of header fields. If a matching hash is found in the first stage lookup, the method performs a second stage lookup of the hash table for a second hash of a second set of header fields and un-wildcards bits of the wildcard mask that corresponds to the second set of header fields. The method identifies a matching rule for the packet. The method generates a flow based on the matching rule and the wildcard mask, wherein the flow is used to process each other packets that match each bit which is un-wildcarded.

Abstract: Some embodiments provide a method for a forwarding element that forwards packets. The method receives a packet. The method consults a tree structure to generate a wildcard mask. The consulting includes traversing the tree structure by tracing a set of bits from the packet header and un-wildcarding the corresponding set of bits from the wildcard mask. The method identifies a matching rule for the packet. The method generates a flow based on the matching rule and the wildcard mask. The flow is used to process each other packet that matches each un-wildcarded bit of the flow.

Abstract: Some embodiments provide a method for a forwarding element that forwards packets. The method receives a packet and consults a tree structure to identity a prefix length associated with an IP address in the packet header. The method skips lookup of each subtable with a set of IP addresses that have a different prefix length than the identified prefix length. The method identifies a matching rule from a particular subtable. The method generates a flow based on the matching rule. The flow is used to process packets that have the same prefix.

Abstract: Some embodiments provide a method for a forwarding element that forwards packets. The method receives a packet. The method performs a first stage lookup of a hash table for a first hash of a first set of header fields and un-wildcards bits of a wildcard mask that corresponds to the first set of header fields. If a matching hash is found in the first stage lookup, the method performs a second stage lookup of the hash table for a second hash of a second set of header fields and un-wildcards bits of the wildcard mask that corresponds to the second set of header fields. The method identifies a matching rule for the packet. The method generates a flow based on the matching rule and the wildcard mask, wherein the flow is used to process each other packets that match each bit which is un-wildcarded.

Abstract: Some embodiments provide a method for a managed forwarding element. The method receives a set of packets for processing by the managed forwarding element. For each of several packets in the set, the method associates the packet with one of several groups of other packets in the set. Each group of packets shares a set of characteristics. For each group of packets the method identifies a set of actions to perform and executes the specified set of actions on all of the packets in the group together.

Abstract: Some embodiments provide a method for a managed forwarding element that processes packets through a set of packet processing tables by matching rules in the tables. The method receives an update that requires modification to at least one of the packet processing tables. Each rule in the packet processing tables is assigned a range of packet processing table versions in which the rule is valid for processing packets. The method modifies the packet processing tables according to the received update by at least one of (i) modifying the range of packet processing table versions in which an existing rule is valid to end after a current packet processing table version and (ii) adding a new rule with a range of valid packet processing table versions that begins with a next packet processing table version. The method increments the current version of the packet processing tables to commit the modifications.

Abstract: Some embodiments provide a method for preserving temporary storage values of a packet processed by a managed forwarding element (MFE. While processing a packet at the MFE, the method identifies that the packet is to be recirculated as a new packet for the MFE. A set of packet field values used for processing the packet by the MFE are associated with the packet. The method stores the set of packet field values with an identifier value. The method recirculates the packet with the identifier value attached to the packet. Upon receiving the recirculated packet, the method uses the identifier value to restore the set of packet field values for the recirculated packet.

Abstract: Some embodiments provide a method for a managed forwarding element. The method receives a set of packets for processing by the managed forwarding element. For each of several packets in the set, the method associates the packet with one of several groups of other packets in the set. Each group of packets shares a set of characteristics. For each group of packets the method identifies a set of actions to perform and executes the specified set of actions on all of the packets in the group together.

Abstract: Some embodiments provide a physical forwarding element that hashes portions of packet headers using several novel hashing techniques. The techniques include a novel set of finishing operations that improve the quality of resulting hashes by increasing their distribution and improving their apparent-randomness. In addition, the finishing operations virtually guarantee that different length inputs will hash to different results, even when padded to be the same initial values. The techniques also include efficient handling of remainder sections when distributing sections of a hash input across multiple processing units. The remainders are hashed into various previously generated hashes based on how many remainders result. These hashing techniques are useful for many network applications.

Abstract: Some embodiments provide a method for a managed forwarding element. The method receives a set of packets for processing by the managed forwarding element. For each of several packets in the set, the method associates the packet with one of several groups of other packets in the set. Each group of packets shares a set of characteristics. For each group of packets the method identifies a set of actions to perform and executes the specified set of actions on all of the packets in the group together.