Patent ID: 9059965
Filing Date: 2015-06-16
Classification: H04L

Abstract:
1. A non-transitory computer readable medium comprising computer readable program code embodied therein for causing a computer system to: receive, by a virtual network interface card (VNIC) located in a media access control (MAC) layer of a host, a packet generated by a virtual machine comprising a network stack, wherein the VNIC and the virtual machine are both located on the host and the VNIC is external to the virtual machine, and wherein the packet is directed to a packet destination external to the host and connected to the host via a network; obtain a data link rule applying to a data link, wherein the data link is operatively connected to the virtual machine, and wherein the data link rule is a rule requiring an internet protocol (IP) address of the virtual machine that generated the packet to match a source IP address specified in the packet; determine, by the VNIC located on the host comprising the virtual machine that generated the packet, whether the packet complies with the data link rule before the packet is placed on the network connecting the host and the packet destination; and drop, by the VNIC located on the host comprising the virtual machine that generated the packet, the packet when the packet fails to comply with the data link rule before the packet is placed on the network.