Patent Application
20150304216
The present application claims priority from Japanese Patent Application No. 2012-016109 (filed on Jan. 30, 2012) the content of which is incorporated herein in its entirety by reference thereto. The present invention relates to a control method, control apparatus, communication system, and program, and particularly to a control method, control apparatus, communication system, and program that control the operation of a forwarding apparatus by transmitting a generated forwarding rule to the forwarding apparatus that forwards a packet according to forwarding rules.
In recent years, centralized network architectures have been proposed. As an example of a centrally processed network architecture, there is a technology called OpenFlow.
In OpenFlow, packet forwarding is achieved by providing a node (forwarding apparatus) that processes a packet according to a processing rule and a control apparatus that controls the processing of the packet by sending a processing rule generated for the node in a network system (Non Patent Literatures 1 and 2). In OpenFlow, the node and the control apparatus are called “OpenFlow Switch” (OFS) and “OpenFlow Controller” (OFC), respectively. For instance, details of the OFS and the OFC are described in NPLs 1 and 2. A summary of the OFS and the OFC is given below.
The OFS comprises a flow table that performs a lookup for and forwarding of a packet, and a secure channel for communicating with the OFC. The OFC communicates with the OFS over the secure channel using the OpenFlow protocol, and controls a flow at, for instance, the API (Application Program Interface) level. For example, when a packet arrives at an OFS, this OFS searches the flow table based on the header information of the packet. When a processing rule (entry) matching the packet is found as a result of the search, the OFS processes the packet based on the matching processing rule. Meanwhile, when no processing rule matching the packet is found, the OFS requests a processing rule for processing the packet from the OFC.
In response to the request from the OFS, the OFC generates a processing rule for processing the packet. For instance, the OFC determines a path for forwarding the packet, and generates a processing rule for forwarding the packet based on the determined path. The OFC sends the generated processing rule to at least one OFS. For instance, the OFC sends the processing rule for forwarding the packet to an OFS related to the determined path.
For instance, for each flow, the flow table of the OFS has a rule (Rule) matching a packet header, action (Action) defining the processing for the flow, and flow statistic information (Statistics) as shown in
For the Rule matching the packet header, an exact value (Exact) or wildcard (Wildcard) is used. The Action is processing content applied to a packet matching the Rule. The flow statistic information is also called “activity counter” and includes, for instance, the numbers of active entries, packet lookups, and packet matches, the numbers of received packets and received bytes, and the duration in which the flow is active for each flow, and received packets, transmitted packets, received bytes, transmitted bytes, receive drops, transmit drops, receive errors, transmit errors, receive frame alignment errors, receive overrun errors, receive CRC (Cyclic Redundancy Check) errors, and collisions for each port.
A packet received by the OFS is checked to see if it matches a rule in the flow table, and when an entry matching the packet is found, the action of the matching entry is performed on the packet. When no matching entry is found, this packet is treated as a First Packet and forwarded to the OFC via the secure channel. The OFC transmits a flow entry that determines a packet path to the OFS. The OFS performs addition, changes, and deletion on flow entries thereof.
When the OFS looks for a matching rule in the flow table, a predetermined field of the header of a packet is used. For instance, information to be matched includes MAC DA (Media Access Control Destination Address), MAC SA (MAC Source Address), the Ethernet (registered trademark) type (TPID), VLAN ID (Virtual Local Area Network ID), VLAN TYPE (priority), IP SA (IP Source Address), IP DA (IP Destination Address), IP protocol, Source Port (TCP/UDP source port, or ICMP (Internet Control Message Protocol) Type), and Destination Port (TCP/UDP destination port, or ICMP Code) (refer to
For instance, the OFS forwards a packet to a physical port and virtual port.
The summary of an operation example of the OFS and the OFC has been given above. Further, as a related technology, Patent Literature 1 describes a method for calculating a multicast tree for forwarding packets between nodes.
The following analysis is given by the present inventor.
The control apparatuses described in PTL 1, and NPLs 1 and 2 determine a path for forwarding a packet in response to a request for a processing rule for processing the packet, and send a processing rule for realizing packet forwarding through this path to a node.
Therefore, for instance, when a failure occurs in a node on the path or a link between nodes making it impossible to forward the packet through this path, the control apparatus needs to determine a new path for forwarding the packet and send a new processing rule for realizing packet forwarding through the new path to a node.
As a result, from the time when packet forwarding is no longer possible on the path that has been used to the time when the control apparatus sends a new processing rule corresponding to a new path, packet forwarding is interrupted.
Therefore, there is a need in the art to reduce the interruption time of packet forwarding in a centralized network architecture when, for instance, a failure occurs in a node or a link between nodes making it impossible to forward a packet using the path that has been used. It is an object of the present invention to provide a control method, control apparatus, communication system, and program that contribute to cope with such need.
A control method relating to a first aspect of the present disclosure comprises:
by a control apparatus, calculating first and second paths that share start and end nodes out of a plurality of nodes;
generating a first rule for forwarding a packet along the first path and a second rule for forwarding a packet along the second path;
sending the first and the second rules to at least one of the plurality of nodes; and
having at least one of the plurality of nodes forward a packet according to either the first rule or the second rule.
A control apparatus relating to a second aspect of the present disclosure comprises:
a path calculation unit that calculates first and second paths sharing start and end nodes out of a plurality of nodes;
a rule generation unit that generates a first rule for forwarding a packet along the first path and a second rule for forwarding a packet along the second path; and
a rule transmission unit that sends the first and the second rules to at least one of the plurality of nodes, and has at least one of the plurality of nodes forward a packet according to either the first rule or the second rule.
A program relating to a third aspect of the present disclosure causes a computer to execute:
calculating first and second paths that share start and end nodes out of a plurality of nodes;
generating a first rule for forwarding a packet along the first path and a second rule for forwarding a packet along the second path; and
sending the first and the second rules to at least one of the plurality of nodes, and having at least one of the plurality of nodes forward a packet according to either the first rule or the second rule.
Further, the program can be provided as a program product stored in a non-transitory computer-readable storage medium.
A communication system relating to a fourth aspect of the present disclosure comprises a plurality of nodes and a control apparatus.
The control apparatus includes: path calculation means that calculates first and second paths that share start and end nodes out of the plurality of nodes;
rule generation means that generates a first rule for forwarding a packet along the first path and a second rule for forwarding a packet along the second path; and
rule transmission means that sends the first and the second rules to at least one of the plurality of nodes.
At least one of the plurality of nodes forwards the packet according to either the first rule or the second rule.
According to the control method, control apparatus, communication system, and program relating to the present disclosure, they contribute to a reduction in the interruption time of packet forwarding in a centralized network architecture when a failure occurs in a node or a link between nodes.
First, a summary of the present disclosure will be given. Note that the drawing reference signs used in the summary are given solely to facilitate understanding and not to limit the present disclosure to the illustrated aspects.
The path calculation unit (43) calculates first and second paths that share the start node (the node 11) and the end node (the node 15) out of the plurality of nodes (11 to 15). In
The rule generation unit (35) generates a first rule for forwarding a packet along the first path and a second rule for forwarding a packet along the second path. The rule transmission unit (23) sends the first and the second rules to at least one of the plurality of nodes (11 to 15) and has at least one of the plurality of nodes (11 to 15) forward a packet according to at least one of the first and the second rules.
With reference to
At this time, a packet having the first identifier included in the packet header is forwarded from the start node to the end node via the first path according to the first rule. Meanwhile, a packet having the second identifier included in the packet header is forwarded from the start node to the end node via the second path according to the second rule.
For instance, if a failure occurs in the node (12) or in the link between the node (11) and the node (12), packet forwarding can be continued by switching the packet forwarding path from the first path to the second path. According to the control apparatus relating to the present disclosure, the first rule for forwarding a packet along the first path and the second rule for forwarding a packet along the second path are set in the nodes associated with each of the paths in advance. Therefore, for instance, the control apparatus (4) can simply switch the rule used for packet forwarding by the nodes (11 to 15) from the first rule to the second rule. In other words, according to the present disclosure, for instance, when a failure occurs, the control apparatus (4) does not need to perform the processing of calculating a new alternative path, generating a rule for forwarding a path along this new path, and setting the rule in at least one of the nodes (11 to 15). At this time, when a failure occurs in a node or a link between the nodes, the interruption time of packet forwarding can be reduced.
With reference to
At this time, the node (11) rewrites a field included in the packet header of a packet from the first identifier to the second identifier. A packet having the second identifier in the packet header is forwarded via the second path according to the second rule since it matches the matching rule of the second rule. As described, according to the present disclosure, the packet forwarding path can be easily changed from the first forwarding path to the second forwarding path by simply sending the third rule to the node corresponding to the start node.
With reference to
With reference to
At this time, regarding a packet having a field value included in the packet header and rewritten by the node (11) from the first identifier to the second identifier, the node (15) is able to write back this field value from the second identifier to the first identifier.
The control apparatus relating to the present disclosure calculates a path to be used after a failure occurrence, and sets in advance a rule that realizes packet forwarding along the calculated path in a node. It becomes possible to greatly reduce packet loss, compared to the case where the control apparatus is capable of quickly switching the path at the time of a failure and generates and sets a rule in a node after a failure occurrence.
A control apparatus relating to a first exemplary embodiment will be described with reference to the drawings.
The input packet processing unit 21 operates when an input packet to a node is sent to the control apparatus 4 via the secure channel 1. The input packet processing unit 21 determines the type of the packet. When the packet is a normal multicast packet, the input packet processing unit 21 transmits the packet to the sender management unit 32. Meanwhile, when the packet is a packet that indicates participation in a multicast group transmitted by a multicast receiver (multicast receiver terminal), the input packet processing unit 21 transmits the packet to the receiver management unit 31.
For instance, a packet indicating participation in a multicast group transmitted by a multicast receiver (multicast receiver terminal) is a packet of the protocol called IGMP (Internet Group Management Protocol) in IPv4 (IP version 4), and it is a packet of the protocol called MLD (Multicast Listener Discovery) in IPv6 (IP version 6).
When a failure notification from a node is sent to the control apparatus 4 via the secure channel, the failure notification reception unit 22 sends the content of the notified failure to the switching rule generation unit 36.
The rule transmission unit 23 transmits a rule sent from any one of the rule generation unit 35, the switching rule generation unit 36, and the rewriting rule generation unit 37 to each node via the secure channel 1.
The receiver management unit 31 sends a group address in an IGMP or MLD packet sent from the input packet processing unit 21, the ID of the node that has received the packet, and the ID of the receiving port to the rewriting rule generation unit 37 and the rule generation unit 35.
Out of the information sent from the input packet processing unit 21, the sender management unit 32 sends the source address and the group address of the packet, and the IDs of the node that has received the packet and the receiving port to the redundant tree calculation unit 33. Further, out of the information sent from the input packet processing unit 21, the sender management unit 32 sends the source address, the group address, and the source MAC address of the packet to the address management unit 38.
The redundant tree calculation unit 33 calculates a redundant tree comprised of a pair of normal and reserve trees for each pair of the packet source and group addresses and sends it to the rule generation unit 35.
The topology management unit 34 manages the topology information of the network constituted by the nodes managed by the control apparatus 4, and provides the redundant tree calculation unit 33 with the topology information. The topology information includes information regarding the nodes included in the network and information indicating how the nodes are connected to each other. These pieces of information may be manually stored in the topology management unit 34 by the administrator in advance. Further, after autonomously collecting the information using some sort of means, the control apparatus 4 may store it in the topology management unit 34.
The rule generation unit 35 generates a rule for the members of each group address of the multicast sent from the receiver management unit 31 so that the packet from the source will reach along the redundant tree calculated by the redundant tree calculation unit 33, and sends the rule to the rule transmission unit 23.
In
The switching rule generation unit 36 generates a rule for rewriting the source MAC address to switch the forwarding path from the normal tree to the reserve tree when the failure notification reception unit 22 receives a failure notification, and sends the rule to the rule transmission unit 23.
In the case of the network shown in
For the members of each group address of the multicast sent from the receiver management unit 31, the rewriting rule generation unit 37 generates a rule that writes the source MAC address back to the original address in the edges of the reserve tree in the redundant tree calculated by the redundant tree calculation unit 33, and sends the rule to the rule transmission unit 23.
The address management unit 38 holds on to a set of the source address, the destination address (group address), and the source MAC address of a packet sent from the sender management unit 32, and returns the source MAC address in response to the rewriting rule generation unit 37.
Next, the operation of the control apparatus 4 of the present exemplary embodiment will be described with reference to the drawings.
First, an operation of receiving a packet will be described with reference to a flowchart shown in
The input packet processing unit 21 in the control apparatus 4 checks if the packet sent from the node as a Packet-in message is a packet indicating participation in a multicast group (step A2). More concretely, the input packet processing unit 21 checks if the packet is an IGMP packet in IPv4, and it checks if the packet is an MLD packet in IPv6. When the packet indicates participation in a multicast group (Yes in the step A2), the input packet processing unit 21 sends the packet and the numbers of the node and the port that received the packet to the receiver management unit 31 (step A3).
Meanwhile, when the packet does not indicate participation in a multicast group (No in the step A2), the input packet processing unit 21 sends the packet and the IDs of the node that received the packet and the receiving port to the sender management unit 32 (step A4).
Next, an operation of the sender management unit 32 receiving a packet from the input packet processing unit 21 will be described with reference to a flowchart in
The sender management unit 32 sends the source address, the group address, and the source MAC address of the packet to the address management unit 38 (step B1). Next, the address management unit 38 stores a set of information comprised of the source address, the group address, and the source MAC address of the packet sent from the sender management unit 32 (step B2). Then, the sender management unit 32 sends the source address and the group address of the packet and the IDs of the node and the port that received the packet to the redundant tree calculation unit 33 (step B3).
The redundant tree calculation unit 33 calculates the normal tree whose root is the ID of the node that received the packet sent from the sender management unit 32 (step B4). For instance, the redundant tree calculation unit 33 derives the minimum spanning tree from the root node to all the other nodes by applying Dijkstra's algorithm based on the topology information stored in the topology management unit 34. At this time, the redundant tree calculation unit 33 sets the cost of each link to “1” for example.
Next, the redundant tree calculation unit 33 calculates the reserve tree whose root is the ID of the node that received the packet sent from the sender management unit 32 (step B5). When calculating the reserve tree, the redundant tree calculation unit 33 may use Dijkstra's algorithm as it does when calculating the normal tree. However, the redundant tree calculation unit 33 sets a cost greater than “1” to the links used in the normal tree as a penalty.
A few methods can be used to come up with the cost value as the penalty. For instance, if the cost is infinite, the links used in the normal tree will not be used in the reserve tree. In this case, however, it may not be possible to construct the reserve tree that includes all the nodes, depending on the topology. Therefore, one can conceive a method that uses the total of the weights of all the links as the cost value used in the reserve tree. In this case, the reserve tree is constructed while the links used in the normal tree are avoided as much as possible, but when there is no other choice, the links used in the normal tree are used as well.
Next, the redundant tree calculation unit 33 combines the calculated normal and reserve trees and the source address and the group address of the packet sent from the sender management unit 32, and sends them to the rule generation unit 35 and the rewriting rule generation unit 37 (step B6).
Here, as an example, the calculation method based on Dijkstra's algorithm was described as the method for calculating the redundant tree. However, as an algorithm other than Dijkstra's, the algorithm described in Patent Literature 1 may be used for instance.
Next, an operation of the receiver management unit 31 receiving a packet from the input packet processing unit 21 will be described with reference to a flowchart shown in
The rule generation unit 35 refers to the group address sent from the receiver management unit 31, and searches the redundant tree sent from the redundant tree calculation unit 33 to see if there is a corresponding pair of the normal and reserve trees (step C2). When there is no corresponding redundant tree (No in the step C2), the rule generation unit 35 ends the processing.
Meanwhile, when there is a corresponding redundant tree (Yes in the step C2), the rule generation unit 35 extracts a path leading to the node (receiving node) that received the packet sent from the receiver management unit 31 from the normal tree sent from the redundant tree calculation unit 33 (step C3).
For instance, the node 15 is assumed to be the receiving node in the network shown in
In the example shown in
Next, the rule generation unit 35 extracts a path leading the receiving node from the reserve tree as in the step C3 (step C5). Further, the rule generation unit 35 generates a rule so that a packet having the source MAC address rewritten is forwarded along the path extracted in the step C5, and sends the rule to the rule transmission unit 23 (step C6).
In the network shown in
Next, the rule generation unit 35 generates a rule that tells the receiving port having the node ID sent from the receiver management unit 31 to send packets sent from the normal tree, and sends the rule to the rule transmission unit 23 (step C7).
Then, the rule generation unit 35 generates a rule that tells the receiving port having the node ID sent from the receiver management unit 31 to send packets sent from the reserve tree after having rewritten the source MAC addresses thereof, and sends the rule to the rule transmission unit 23 (step C8).
In the network shown in
Next, the rule transmission unit 23 forwards the rules generated in the steps above to all the nodes (step C9).
An operation when a failure occurs will be described with reference to a flowchart shown in
For instance, when a notification indicating a change to a link-down state in a Port-status message is received from a node, it is determined that a failure has occurred in the link connected to the port in question. Further, when the secure channel is disconnected, it is determined that a failure has occurred in the node in question. Other than these, Flow-Removed messages can be used. When a failure occurs, packets do not reach the nodes located downstream from the failure location. At this time, a timeout occurs in a flow entry for forwarding a packet along the normal tree, and a Flow-Removed message is transmitted to the control apparatus 4. The failure location may be determined by collecting Flow-Removed messages transmitted by all the nodes and identifying the location between the nodes that have sent Flow-Removed messages and the other nodes. Further, a failure location may be detected based on other methods.
Next, the switching rule generation unit 36 determines whether or not the failure location is included in the normal tree (step D2).
For instance, when a failure occurs in the link between the nodes 14 and 15 in the network shown in
Meanwhile, when a failure occurs in the link between the nodes 12 and 13, the failure location is included in the normal tree since this link is used in the normal tree (Yes in the step D2). When the failure location is included in the normal tree (Yes in the step D2), the switching rule generation unit 36 generates a rewrite rule for switching to the reserve tree and sends the rule to the rule transmission unit 23 (step D3).
In the network shown in
The rule transmission unit 23 sends the rewrite rule generated by the switching rule generation unit 36 to the node connected to the source host of the multicast (step D4).
In the network illustrated in
Further, in the step D4, the rule transmission unit 23 sends the rewrite rule generated by the switching rule generation unit 36 to the node connected to the multicast source host, but it may send the rule to another node. For instance, in the network in
A control apparatus relating to a second exemplary embodiment will be described with reference to the drawings.
The control apparatus 4 of the first exemplary embodiment switches a path in multicast packet forwarding. Meanwhile, the control apparatus 4 of the present exemplary embodiment switches a path in unicast packet forwarding.
Unlike multicast, the destination address is written in the header of a received packet in unicast. This eliminates the need to manage recipients separately, and from which port of which node a packet should be outputted can be determined based on information in the path table 40.
The packet analysis unit 39 refers to the destination address of a packet sent from the input packet processing unit 21, determines the output node and port, which will be the output, from the path table 40, and sends the packet itself to the packet transmission unit 24 along with these pieces of information. Further, the packet analysis unit 39 sends the input node and port number that received the packet, and the packet header to the redundant path calculation unit 41, in addition to the output node and port number. Further, the packet analysis unit 39 sends a set of the packet's source IP address and source MAC address to the address management unit 38.
The path table 40 is a table for managing a set of information comprised of the destination, mask length, output node ID, and output port number. These pieces of information included in the path table 40 are set in advance using some sort of means.
The node forwards the second and subsequent packets out of packets constituting a flow according to a rule generated by the rule generation unit 35. Since the first packet is sent to the control apparatus 4 by the Packet-in message, the first packet needs to be sent to the output node, which is the output, from the control apparatus 4. Therefore, the packet transmission unit 24 sends a Packet-out message to the designated output node so that the packet sent from the packet analysis unit 39 is outputted from the designated port. This makes it possible to deliver the first packet of the flow to the destination.
The redundant path calculation unit 41 calculates a redundant path (combination of normal and reserve paths) leading from the input node to the output node sent from the packet analysis unit 39. Here, the redundant path can be calculated by calculating a redundant tree using the method described in the first exemplary embodiment and extracting a path leading to a specific output node from the redundant tree.
Next, an operation of receiving a packet will be described with reference to a flowchart in
A packet received by a node is sent to the control apparatus 4 via the secure channel as a Packet-in message (step E1).
Upon receiving the message sent to the control apparatus 4, the input packet processing unit 21 sends the packet and the input node and port number that received the packet to the packet analysis unit 39 (step E2).
The packet analysis unit 39 refers to the destination address of the packet, and determines the output node and port, which will be the output, from the path table 40 (step E3).
The packet analysis unit 39 sends the results of the step E3 and the packet to the packet transmission unit 24 (step E4). The packet transmission unit 24 sends a Packet-out message to the designated output node so that the packet is outputted from the designated port (step E5).
The packet analysis unit 39 sends a set of the source IP address and the source MAC address to the address management unit 38 (step E6). The address management unit 38 stores the set of information comprised of the packet's source address and source MAC address sent from the packet analysis unit 39 (step E7).
The packet analysis unit 39 sends the input node and port number that received the packet, and the packet header to the redundant path calculation unit 41, in addition to the output node and port number (step E8). The redundant path calculation unit 41 calculates a redundant path leading from the input node to the output node sent from the packet analysis unit 39, and sends the result to the rule generation unit 35, the switching rule generation unit 36, and the rewriting rule generation unit 37 along with the packet (step E9).
The rule generation unit 35 generates a matching rule from the sent packet, generates a rule so that the packet is forwarded along the normal path sent from the redundant path calculation unit 41, and sends the rule to the rule transmission unit 23 (step E10). Further, the rule generation unit 35 generates a matching rule in which the source MAC address of the sent packet is rewritten to be forwarded along the reserve path, generates a rule so that the packet is forwarded along the reserve path sent from the redundant path calculation unit 41, and sends the rule to the rule transmission unit 23 (step E11).
The matching rules included in the rule are the same as the matching rules shown in
Next, the rule generation unit 35 generates a rule that tells the designated port of the output node to send packets sent from the normal tree, and sends the rule to the rule transmission unit 23 (step E12). Further, the rule generation unit 35 generates a rule that tells the designated port of the output node to send packets sent from the reserve tree after having rewritten the source MAC addresses thereof, and sends the rule to the rule transmission unit 23 (step E13).
Then, the rule transmission unit 23 forwards the rules generated in the steps above to all the nodes (step E14).
A switching operation when a failure occurs is nearly the same as the case of multicast in the first exemplary embodiment. In the case of multicast, whether or not the failure location is in the normal tree is determined. Meanwhile, in the case of unicast in the present exemplary embodiment, whether or not the failure location is in the normal path is determined.
For instance, the control apparatus relating to the present invention can be utilized as an OpenFlow Controller (OFC) when a highly reliable network is constructed using OpenFlow.
The disclosure of the above Patent Literatures and Non-Patent Literature is incorporated herein by reference thereto. Modifications and adjustments of the exemplary embodiment are possible within the scope of the overall disclosure (including the claims) of the present invention and based on the basic technical concept of the present invention. Various combinations and selections of various disclosed elements (including each element of each claim, each element of each exemplary embodiment, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the overall disclosure including the claims and the technical concept. Particularly, any numerical range disclosed herein should be interpreted that any intermediate values or subranges falling within the disclosed range are also concretely disclosed even without specific recital thereof.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2012-016109 | Jan 2012 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2012/006990 | 10/31/2012 | WO | 00 |
