Abstract:
A method is provided for managing a network storm associated with a physical port of a physical switch. The method, performed by a management application, includes receiving a notification of the network storm associated with the physical port, identifying a virtual switch supported by a server host that is coupled to the physical port, identifying a virtual machine coupled to the virtual switch that causes the network storm, and isolating the identified virtual machine while the physical port remains enabled.

Description:
BACKGROUND 
       [0001]    Unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section. 
         [0002]    Various approaches have been proposed to prevent traffic on a local area network (LAN) from being disrupted by a network storm, such as a broadcast, multicast, or unicast storm, on one of the physical interfaces. Such a network storm occurs when packets flood the network, creating excessive traffic and degrading network performance.  FIG. 1  illustrates a block diagram of a system  100  configured to manage a network storm. In this system, host servers  130 ,  132 ,  134 , and  136  are configured to couple to physical ports  104 ,  106 ,  108 , and  110  of a physical switch  102 , respectively. In the event a virtual machine  122 , supported by the server host  134 , is found to cause a network storm, one conventional approach is to disable the physical port  108  of the physical switch  102 , resulting in the disabling of not only the virtual machine  122  but also all other virtual machines supported by the host server  134 , such as a virtual machine  120 . As has been demonstrated, an improved approach to manage network storms without disabling virtual machines unnecessarily is desired. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0003]    The foregoing and other features of the present disclosure will become more fully apparent from the following description and appended claims, taken in conjunction with the accompanying drawings. Understanding that these drawings depict only several embodiments in accordance with the disclosure and are therefore not to be considered limiting of its scope, the disclosure will be described with additional specificity and detail through use of the accompanying drawings. 
           [0004]    In the drawings: 
           [0005]      FIG. 1  illustrates a block diagram of a system configured to manage a network storm; 
           [0006]      FIG. 2  illustrates a block diagram of a system configured to manage a network storm, in accordance with at least some embodiments of the present disclosure; 
           [0007]      FIG. 3  illustrates a block diagram of a server host configured to interact with virtual machines, a physical switch, and a virtual center, in accordance with at least some embodiments of the present disclosure; 
           [0008]      FIG. 4  is a flowchart illustrating an example method for managing a network storm, in accordance with at least some embodiments of the present disclosure; and 
           [0009]      FIG. 5  is a block diagram illustrating a computer program product to implement a method to manage a network storm in accordance with at least some embodiments of the present disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0010]      FIG. 2  illustrates a block diagram of a system  200  configured to manage a network storm, in accordance with at least some embodiments of the present disclosure. The system  200  may include a physical switch  202  having physical ports  204 ,  206 ,  208 , and  210 . The system  200  may also include one or more host servers, such as host servers  230 ,  232 ,  234 , and  236 , where the host servers  230 ,  232 ,  234 , and  236  may be coupled to the physical ports  204 ,  206 ,  208 , and  210 , respectively. In one embodiment, any of the host servers  230 ,  232 ,  234 , and  236  may be a server machine that includes a storage stack with at least a virtual machine file system running on it (e.g., a VMware ESX server). A management application (such as a virtual center (VC)  214 ) may correspond to an application that executes on any of the host servers of the system  200  and may be configured to manage infrastructure, such as virtual machines (VMs)  220  and  222  and host servers  230 ,  232 ,  234 , and  236 . In one embodiment the VC  214  may run on a host server such as the host server  234 . In one embodiment, the VC  214  may communicate with the physical switch  202  via an Application Programming Interface (API)  212 , so that the physical switch  202  may inform the VC  214  when it detects a network storm on any of its physical ports, such as the physical port  208 . The VC  214  may include a network storm monitoring module  216 , which may be configured to identify and isolate a virtual machine supported by a host server, such as the VM  222 , that may contribute to this detected network storm. One isolation approach may involve placing a firewall around this virtual machine. Another isolation approach may involve disconnecting the virtual machine from network. 
         [0011]      FIG. 3  illustrates a block diagram of a server host configured to interact with virtual machines, a physical switch, and a virtual center, in accordance with at least some embodiments of the present disclosure. In particular, a server host  300 , a physical switch  310 , a VC  340 , and a network storm monitoring module  342  of  FIG. 3  may correspond to the server host  234 , the physical switch  202 , the VC  214 , and the network storm monitoring module  216  of  FIG. 2 , respectively. In addition, the server host  300  may include one or more physical network adapters, such as a physical network adapter  301  and a physical network adapter  303 . The physical network adapter  301  and the physical network adapter  303  may be coupled to physical ports  314  and  312  of the physical switch  310 , respectively. The server host  300  may be configured to support virtual switches having virtual ports (e.g., a virtual switch  302  having virtual ports  305  and  307  and a virtual switch  304  having a virtual port  309 ) and virtual machines having virtual network adapters (e.g., a VM  320  having a virtual network adapter  325 , a VM  322  having a virtual network adapter  327 , and a VM  324  having a virtual network adapter  329 ). It should be noted that each virtual machine may be configured to support more than one virtual network adapter. Each virtual machine may also be configured to communicate with the VC  340  via paths that bypass the virtual network adapters, the virtual ports, and the virtual switches, such as the illustrated path  330  between the VM  320  and the VC  340 . 
         [0012]    In conjunction with  FIG. 3 ,  FIG. 4  is a flowchart illustrating an example method  400  for managing a network storm, in accordance with at least some embodiments of the present disclosure. Method  400  may include one or more operations, functions, or actions illustrated by one or more blocks, such as blocks  402 ,  404 ,  406 ,  408 ,  410 ,  412 ,  414 ,  416 ,  418 , and  420 . Although the blocks are illustrated in sequential orders, these blocks may also be performed in parallel, and/or in a different order than those described herein. Also, the various blocks may be combined into fewer blocks, divided into additional blocks, and/or eliminated based upon the desired implementation. The flowchart shows example operations performed by a virtual center, such as the VC  340 , and a physical switch, such as the physical switch  310  in separate lanes. 
         [0013]    In block  402 , which starts operations of the physical switch  310 , the physical switch  310  may be configured to monitor its physical ports. Block  402  may be followed by block  404 . 
         [0014]    In block  404 , if the physical switch  310  detects network storm in any of its physical ports, such as the physical port  314 , then the physical switch  310  may inform the VC  340  in block  406 . Otherwise, the physical switch  310  may continue to monitor its physical ports. Block  406  may be followed by block  410 . 
         [0015]    In block  410 , the network storm monitoring module  342  of the VC  340  may be configured to check whether any host server is coupled to the physical port that is experiencing the network storm (e.g., the physical port  314 ). If a host server is indeed coupled to the physical port  314  (e.g., the host server  300 ), then the VC  340  may proceed to identify virtual switches supported by the host server (e.g., the virtual switches  302  and  304 ) in block  412 . Otherwise, the VC  340  may inform the physical switch  310  in block  422  that the VC  340  does not manage any virtual machines supported by the host servers that could contribute to the network storm. Block  422  may be followed by block  424 . 
         [0016]    In block  424 , after the physical switch  310  recognizes that the network storm may come from a host, which is not managed by the VC  340 , the physical switch  310  may be configured to take other actions to address the network storm. For example, the physical switch  310  may disable the physical port  314 . 
         [0017]    In block  414 , the network monitoring module  342  may be configured to identify the virtual machine coupled to any of the virtual switches  302  and  304  that generates the network storm. In one embodiment, the network monitoring module  342  may be configured to monitor the network traffic between the virtual ports of the virtual switches (e.g., the virtual ports  305 ,  307 , and  309 ) and the virtual network adapters of the virtual machines (e.g., the virtual network adapters  325 ,  327 , and  329 ). When the network traffic exceeds a certain threshold value (e.g., number of packets transmitted within a certain period of time), a network storm may be deemed to have occurred. In some embodiments, the physical switch  310  may provide the threshold value to the VC  340 . If the network monitoring module  342  determines that the network traffic between the virtual port  305  and the virtual network adapter  325  exceeds the threshold value, then the network monitoring module  342  may designate that VM  320  having the virtual network adapter  325  is the virtual machine generating the network storm. Block  414  may be followed by block  416 . 
         [0018]    In block  416 , the network monitoring module  342  may be configured to disconnect a virtual network adapter from a virtual switch, such as disconnecting the virtual network adapter  325  from the virtual switch  302 . Block  416  may be followed by block  418 . 
         [0019]    In block  418 , after having disconnected the virtual network adapter  325 , the network monitoring module  342  may trigger the execution of utility tools of the VM  320  (e.g., VMware Tools), which may include initiating a scan and/or combating malware. In some embodiments, the utility tools may be configured to communicate the result of scanning and/or combating the malware to the VC  340  in the path  330  that bypasses the virtual network adapter  325 , the virtual port  305 , and the virtual switch  302 . For example, the utility tools may communicate the result to the VC  340  using the Virtual Machine Communication Interface (VMCI). Block  418  may be followed by block  420 . In block  420 , if the result indicates that the network storm associated with the VM  320  has been successfully resolved, then the VC  340  may then be configured to reconnect the VM  320  to the virtual switch  302  by reconfiguring the virtual network adapter  325  and the virtual port  305  in block  426 . 
         [0020]    On the other hand, if the result in block  420  indicates that the network storm has not been resolved, then the VC  340  may inform the physical switch  310  in block  422  that the VM  320  contributing to the network storm is disconnected. Block  422  may be followed by block  424 , wherein, as discussed above, the physical switch  310  may be configured to take actions to address the unresolved network storm. Block  424  may be followed by  408 , wherein the physical switch  310  may be configured to check if the network storm is resolved. If the network storm still has not been resolved, then the process of searching for the virtual machine that generates the network storm may start again from block  402 . 
         [0021]      FIG. 5  is a block diagram illustrating a computer program product  500  to implement a method to manage a network storm in accordance with at least some embodiments of the present disclosure. The computer program product  500  may include one or more sets of executable instructions  502  that, when executed by, for example, a host server, may provide at least the functionality described above with respect to the preceding figures. 
         [0022]    In some embodiments, the computer program product  500  may include a signal bearing medium  504  or another similar communication medium  506 . Computer program product  500  may also include a non-transitory computer readable medium  508  or another similar recordable medium  510 . Some examples of the computer readable medium  508  may include a solid-state drive, a hard disk drive, a Compact Disc (CD), a Digital Video Disk (DVD), a digital tape, memory, and others. Some examples of the recordable medium  510  may include a solid-state drive, a hard disk drive, a Compact Disc (CD), a Digital Video Disk (DVD), a digital tape, memory, and others. 
         [0023]    From the foregoing, it will be appreciated that various embodiments of the present disclosure have been described herein for purposes of illustration, and that various modifications may be made without departing from the scope and spirit of the present disclosure. Accordingly, the various embodiments disclosed herein are not intended to be limiting, with the true scope and spirit being indicated by the following claims.