Abstract: A method for changing network configuration parameters that includes generating a request to change a network configuration parameter, where the request is generated by a virtual machine, sending the request to a virtual network interface card (VNIC) associated with the virtual machine, sending the request to a VNIC configuration database associated with the VNIC, determining whether the virtual machine is allowed to change the network configuration parameter, if the virtual machine is allowed to change the network configuration parameter, updating the VNIC configuration database and VNIC to reflect the change in the network configuration parameter, and notifying the virtual machine that the change in network configuration parameter is allowed, and if the virtual machine is not allowed to change the network configuration parameter, dropping the request.

Abstract: A system and method for providing network connectivity to a host, involving creating a virtual switch on the host, specifying at least one data link attribute of the virtual switch, creating a plurality of virtual network interface cards (VNICs) on the host, associating each of the plurality of VNICs with the virtual switch, and assigning the at least one data link attribute of the virtual switch to each of the plurality of VNICs, where the virtual switch is connected to a physical network interface card (NIC) associated with the host, where each of the plurality of VNICs is associated with a different one of a plurality of execution environments, where the plurality of execution environments is located on the host, and where the plurality of VNICs is located on the host.

Abstract: A system including a first physical network interface card (NIC) include a number of rings, where at least one of the rings is an active ring. The system further includes a host, operatively connected to the first NIC, and including Media Access Control (MAC) layer. The MAC layer is configured to obtain a power management policy, obtain a load associated with the active ring, determine, using the power management policy and the load, that the state associated with at least one of the rings must be changed, and change, in response to the determining, the state of at least one of the of rings.

Abstract: A method for processing packets that includes receiving a packet from a network, analyzing the packet to obtain packet information used to determine to which temporary data structure to forward the packet, if a first list includes the packet information forwarding the packet to a first temporary data structure, and processing the packet from the first temporary data structure, and if the first list does not include the packet information forwarding the packet to a second temporary data structure, processing the packet, wherein processing the packet comprises: sending a first test to a source of the packet using the packet information, placing the packet information on the first list, if a successful response to the first test is received, and placing the packet information on a second list, if an unsuccessful response to the first test is received.

Abstract: A method for configuring a packet destination, that includes creating the packet destination on a host, obtaining a network configuration for the packet destination, determining whether the host comprises a virtual network stack, where the virtual network stack includes the network configuration, and assigning the packet destination to the virtual network stack.

Abstract: A method for notifying a packet destination that includes receiving a packet by a network interface card (NIC), where the packet destination is a destination of the packet, classifying the packet, forwarding the packet to one of a plurality of receive rings on the NIC, determining whether the one of the plurality of receive rings comprises space to store the packet, dropping the packet if the receive ring does not comprise the space to store the packet, and sending a notification message to the packet destination, where the notification message indicates that the packet was dropped by the receive ring.

Abstract: A method for managing a guest OS executing on a host. The method includes receiving, from the guest OS associated with a first MAC address, a second MAC address, wherein the first MAC address is associated with a first guest VNIC, wherein the second MAC address is associated with a second guest VNIC; configuring an intermediate VNIC executing on the host OS to forward packets associated with the second MAC address to the guest OS, wherein packets associated with the first MAC address and received by the intermediate VNIC are forwarded to the guest OS; and forwarding the second MAC address from the intermediate VNIC to a device driver associated with a physical NIC, wherein the device driver configures a classifier on the physical NIC to forward packets associated with the second MAC address to a first HRR located on the physical NIC associated with the intermediate VNIC.

Abstract: A computer readable medium comprising software instructions for: obtaining an allocation policy by a MAC layer executing on a host; receiving, a request for a transmit kernel buffer (TxKB) by a sending application executing on at least one processor of the host; obtaining a location of a plurality of available TxKBs on the host; obtaining a location of at least one available network interface on the host; obtaining a location of the sending application; allocating one of the plurality of available TxKBs to obtain an allocated TxKB, wherein the one of the plurality of available TxKBs is selected according to the allocation policy using the location of the plurality of available TxKB, the location of the at least one available network interface, and the location of the sending application, to obtain an allocated TxKB; and providing, to the sending application, the location of the allocated TxKB.

Abstract: A computer readable medium including instructions executable by a processor to perform a method, the method including obtaining a packet by a load balancer, obtaining queued packet information for a plurality of target hosts operatively connected to the load balancer, selecting the one of the plurality of target hosts using the queued packet information, and sending the packet to the selected target host using a first communication channel between the load balancer and the selected target host.

Abstract: A method for processing a packet that includes receiving a packet for a target, classifying the packet, and sending the packet to a receive ring based on the classification. The method also includes obtaining an identifier (ID) associated with the target based on the classification, and sending a request for virtual memory that includes the ID. Furthermore, the method includes determining, using the ID, whether the target has exceeded a virtual memory allocation associated with the target. In addition, the method includes allocating the virtual memory, storing the packet in the virtual memory, and updating the virtual memory allocation associated with the target to reflect the allocation of the virtual memory, all if the target does not exceed the virtual memory allocation. The method further includes waiting until the target is not exceeding the virtual memory allocation if the target exceeds the virtual memory allocation.

Abstract: A system for distributing network traffic among direct hardware access datapaths, comprising: a processor; one or more activated PNICs; a host operating system; and a virtual machine (VM). Each activated PNIC sends and receives data packets over a network. Each activated PNIC is configured with a virtual function. The VM includes a VNIC and a virtual link aggregator configured to maintain a list identifying each activated PNIC. Virtual function mappings for the VM associate the VM with virtual functions for the activated PNICs. The virtual link aggregator selects the first activated PNIC for servicing a network connection and determines a virtual function for the first activated PNIC. The VNIC for the first activated PNIC uses the virtual function to directly transfer network traffic for the network connection between the VM and the first activated PNIC.

Abstract: A system for distributing network traffic among direct hardware access datapaths, comprising: a processor; one or more activated PNICs; a host operating system; and a virtual machine (VM). Each activated PNIC sends and receives data packets over a network. Each activated PNIC is configured with a virtual function. The VM includes a VNIC and a virtual link aggregator configured to maintain a list identifying each activated PNIC. Virtual function mappings for the VM associate the VM with virtual functions for the activated PNICs. The virtual link aggregator selects the first activated PNIC for servicing a network connection and determines a virtual function for the first activated PNIC. The VNIC for the first activated PNIC uses the virtual function to directly transfer network traffic for the network connection between the VM and the first activated PNIC.

Abstract: A method for controlling a denial of service attack involves receiving a plurality of packets from a network, identifying an attacking host based on a severity level of the denial of service attack from the network, wherein the attacking host is identified by an identifying attack characteristic associated with one of the plurality of packets associated with the attacking host, analyzing each of the plurality of packets by a classifier to determine to which of a plurality of temporary data structures each of the plurality of packet is forwarded, forwarding each of the plurality of packets associated with the identifying attack characteristic to one of the plurality of temporary data structures matching the severity level of the denial of service attack as determined by the classifier, requesting a number of packets from the one of the plurality of temporary data structures matching the severity level by the virtual serialization queue, and forwarding the number of packets to the virtual serialization queue.

Abstract: In general, the invention relates to a creating a network model on a host. The invention includes: gathering first component properties associated with a first physical network device on a target network; creating a first container using first component properties; determining that a second physical network device is operatively connected to the first physical network device via a physical network link; gathering second component properties associated with the physical network link; creating a first VNIC associated with the first container; determining that at least one virtual network device is executing on the second physical network device; gathering third component properties associated with the at least one virtual network device; creating a second container, wherein the second container is configured using the third component properties; and creating a second VNIC associated with the second container.

Abstract: A system including first and second virtualized execution environments and a hypervisor for sending packets between virtualized execution environments. The first virtualized execution environment includes a first VNIC associated with a first hardware address (HA), a first proxy VNIC associated with a second HA, and a virtual switch. A Vswitch table for the virtual switch includes entries associating the first HA with the first VNIC and the second HA with the first proxy VNIC. The second virtualized execution environment includes a second proxy VNIC associated with the first HA. The virtual switch receives a first packet associated with the second HA. The virtual switch sends the first packet to the first proxy VNIC when Vswitch table entry associates the second HA with the first proxy VNIC. The first VNIC proxy sends the first packet from the first virtualized execution environment to the second virtualized execution environment using the hypervisor.

Abstract: In general, the invention relates to reclaiming transmit descriptors by configuring a media access control (MAC) to execute a first MAC layer thread to reclaim a first number of transmit descriptors (TDs) from a first hardware transmit ring (HTR) using a first reclaim algorithm, where the first reclaim algorithm is associated with a first transmission pattern and a first TDR status. The invention further includes receiving, by a virtual NIC (VNIC) executing within the MAC layer, a first number of packets, forwarding the first number of packets to a device driver on the host associated with the physical NIC, and forwarding the first number of packets from the device driver to the physical NIC using the first number of TDs, where the first plurality of TDs are reclaimed by the first MAC layer thread according to the first reclaim algorithm.

Abstract: A computer readable medium comprising software instructions for managing resources on a host, wherein the software instructions comprise functionality to: configure a classifier located on a NIC, to forward packets addressed to a first destination address to a first HRR mapped to a first VNIC, wherein packets addressed to the first destination address are associated with a first PFC lane; configure the classifier to forward packets addressed to a second destination address to a second HRR, wherein packets addressed to the second destination address are associated with a second PFC lane; and transmit, by the first VNIC, a pause frame associated with the first PFC lane to a switch operatively connected to the physical NIC, wherein the switch, in response to receiving the pause frame, stores packets associated with the first PFC lane in a buffer without transmitting the packets.

Abstract: A method for sending packets. The method includes determining with which of a plurality of virtual serialization queues (VSQs) a first packet is associated, wherein a first application is attempting to issue the first packet, if a first VSQ of the plurality of VSQs has not exceeded a first bandwidth allocation, wherein the first VSQ is associated with the first packet and is associated with the first bandwidth allocation, then sending the first packet to the first VSQ, processing the first packet by a first virtual network stack (VNS) to obtain a first processed packet, wherein the first VSQ is associated with the first VNS, and sending the first processed packet to a physical network interface card (NIC) operatively connected to the first VNS. Alternatively, if the first VSQ has exceeded the first bandwidth allocation, then blocking the first application from issuing the first packet.

Abstract: A method for binding input/output (I/O) objects to nodes includes an subsystem receiving a request to use an I/O device from a process, determining a first resource to service the request, generating a first I/O object corresponding to the first resource, wherein the first I/O object is unbound, and sending the first I/O object to a Non-Uniform Memory Access (NUMA) I/O Framework. The method further includes the NUMA I/O Framework selecting a first NUMA node of a plurality of NUMA nodes, to which to bind the first I/O object and binding the first I/O object to the first NUMA node. The method further includes servicing the request by processing, on the first NUMA node, the first resource corresponding to the first I/O object.

Abstract: In general, in one aspect, the invention relates to a method for binding input/output (I/O) objects to nodes. The method includes receiving a request to use an I/O device from a process, determining a resource to service the request, generating a first I/O object corresponding to the resource, wherein the first I/O object is unbound, and generating a proc object, wherein the proc object comprises a reference to the process requesting to use the I/O device. The method also includes sending the first I/O object and the proc object to a Non-Uniform Memory Access (NUMA) I/O Framework, determining that the process is executing on a first NUMA node, selecting the first NUMA, binding the first I/O object to the first NUMA node, and servicing the request by processing, on the first NUMA node, the resource corresponding to the first I/O object.