Emulating packet flows to assess network links for SD-WAN

Abstract

Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Description

BACKGROUND

In recent years, several companies have brought to market solutions for deploying software defined (SD) wide-area networks (WANs) for enterprises. Some such SD-WAN solutions use external third-party private or public cloud datacenters (clouds) to define different virtual WANs for different enterprises. These solutions typically have edge forwarding elements (called edge devices) at edge nodes of an enterprise that connect with one or more gateway forwarding elements (called gateway devices or gateways) that are deployed in the third-party clouds.

In such a deployment, an edge device connects through one or more secure connections with a gateway, with these connections traversing one or more network links that connect the edge device with an external network. Examples of such network links include MPLS links, 5G LTE links, commercial broadband Internet links (e.g., cable modem links or fiber optic links), etc. The edge nodes include branch offices (called branches) of the enterprise, and these offices are often spread across geographies with network links to the gateways of various different network connectivity types.

BRIEF SUMMARY

Some embodiments of the invention provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments performs this assessment to evaluate network links used to connect different sites in an SD-WAN. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows.

The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites). The assessment is performed in some embodiments to determine whether the second network link should be used for a subset of future flows between the first and second sites. In some embodiments, the second network link is less expensive and has a lower performance than the first network link. For instance, in some embodiments, the first network link is an MPLS link, while the second network link is a commercial Internet link (e.g., a cable modem).

The method of some embodiments computes attributes of predicted packets by first identifying one or more predicted packets between sampled packets of each flow in the set of flows, and identifying attributes of the predicted packets. In some embodiments, the identified and computed attributes include packet delay attributes. The method of some of these embodiments uses the identified and computed attributes for its emulation by first normalizing the identified and computed delays by removing predicted delays for packets traversing between the first and second compute sites through the first network link, and then using these normalized delays to perform its emulation.

In some embodiments, the normalized delays represent communication delays between processes that exchange the flows in the set of flows (e.g., between applications that execute on devices at the first and second sites) after the removal of the delays associated with the packet passing through the first network. In other words, the normalizing is performed in some embodiments to render the assessment regarding the use of the second network link agnostic (i.e., independent) of operating conditions of the first network link. To perform the normalizing, the method in some embodiments identifies sets of request flows and response flows between the first and second sites, computes the delay between a request flow and a response flow associated with the request flow (i.e., the request flow's corresponding response flow), and removes communication delay through the first network from each computed delay.

To perform its emulation, the method of some embodiments also monitors a set of operating conditions associated with the second network link, and uses the monitored set of operating conditions in the emulation. The emulation in some embodiments generates predicted attributes for the set of flows if the set of flows had been exchanged through the second network link. It then compares the generated predicted attributes for the packet flows through the second link with the identified and computed attributes associated with packet flows through the first link to compare the quality of the second network link with the quality of the first network link.

The preceding Summary is intended to serve as a brief introduction to some embodiments of the invention. It is not meant to be an introduction or overview of all inventive subject matter disclosed in this document. The Detailed Description that follows and the Drawings that are referred to in the Detailed Description will further describe the embodiments described in the Summary as well as other embodiments. Accordingly, to understand all the embodiments described by this document, a full review of the Summary, Detailed Description, the Drawings and the Claims is needed. Moreover, the claimed subject matters are not to be limited by the illustrative details in the Summary, Detailed Description and the Drawing.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features of the invention are set forth in the appended claims. However, for purposes of explanation, several embodiments of the invention are set forth in the following figures.

FIG. 1 illustrates process performed by a network analytics tool in some embodiments to implement the method of some embodiments.

FIG. 2 illustrates sampling of packets along their egress paths from one SD-WAN site to another SD-WAN site.

FIG. 3 conceptually illustrates the components of a network analyzing server of some embodiments.

FIG. 4 illustrates examples of tables created by the network analyzing server in some embodiments.

FIG. 5 presents an example that illustrates a typical TCP communication between two sites in an SD-WAN.

FIG. 6 illustrates four examples of how the trace builder identifies the predicted missing packets (i.e., how it fills-in the missing packets).

FIG. 7 illustrates five sequences of request and response flow.

FIG. 8 illustrates an example of a table produced by an emulator to summarize the Internet network conditions associated with two flows, which could be between the same pair of sites or between two different pairs of sites.

FIG. 9 illustrates how the emulator replays the client requests/responses through the commercial Internet connections of the first and second sites.

FIG. 10 illustrates an example of a report generated through a user interface.

FIG. 11 illustrates an example of an SD-WAN of some embodiments.

FIG. 12 conceptually illustrates a computer system with which some embodiments of the invention are implemented.

DETAILED DESCRIPTION

In the following detailed description of the invention, numerous details, examples, and embodiments of the invention are set forth and described. However, it will be clear and apparent to one skilled in the art that the invention is not limited to the embodiments set forth and that the invention may be practiced without some of the specific details and examples discussed.

Some embodiments of the invention provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified sample packets in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether the second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

As used in this document, a packet refers to a collection of bits in a particular format sent across a network. One of ordinary skill in the art will recognize that the term packet is used in this document to refer to various formatted collections of bits that are sent across a network. The formatting of these bits can be specified by standardized protocols or non-standardized protocols. Examples of packets following standardized protocols include Ethernet frames, IP packets, TCP segments, UDP datagrams, etc. Also, as used in this document, references to L2, L3, L4, and L7 layers (or layer 2, layer 3, layer 4, and layer 7) are references respectively to the second data link layer, the third network layer, the fourth transport layer, and the seventh application layer of the OSI (Open System Interconnection) layer model.

FIG. 1 illustrates a process 100 performed by a network analytics tool in some embodiments to implement the method of some embodiments. This process is performed in some embodiments to evaluate network links used to connect different sites in an SD-WAN. For instance, some embodiments perform this assessment to determine whether a less expensive, secondary network link should be used for a subset of future flows between the first and second sites in the SD-WAN, instead of a more expensive primary network link. One example of a less-expensive, secondary network link in some embodiments is a commercial Internet connection (e.g., a cable modem connection) that has a lower quality of service (QoS) performance than an MPLS link, which is often used as a primary connection to connect different geographic sites to a WAN.

The process 100 initially (at 105) identifies sample packets from a set of flows exchanged between first and second compute sites through a first network link (e.g., an MPLS link), and identifies attributes of the sampled packets (e.g., the packet headers, metadata regarding the packets, etc.). FIG. 2 illustrates that in some embodiments, the sample packets are collected by sFlow packet samplers 205 (which can be software engines or hardware appliances) that are deployed in the egress path of the packets from the first site 210 to the second site 212, and from the second site to the first site. In this example, each packet sampler 205 is deployed at the egress path between gateways 220 at the sites and the MPLS forwarding element 225 at these sites. In this example, the gateways 220 can also route packets to each other through commercial Internet routers 255.

The packet sampler 205 selects a subset sample of egress packets going from the gateways 220 to the MPLS forwarding element 225, and forwards copies of the selected subset of sample egress packets to a network analysis server 250 that the performs much of the analysis of the process 100. Instead of sending a copy of the sampled subset of egress packets, the packet sampler 205 sends attributes of the sampled subset of egress packets in some embodiments. As further described below, these attributes in some embodiments include a timestamp (e.g., the time when the packet was sampled or the time the packet was sent along the egress path), the flow identifier of the packet (i.e., the packet's five tuple identifier, which includes the source and destination IP address, source and destination port and protocol), and the packet size.

The network analysis server 250 executes on a computer at the first site 210 or the second site 212 in some embodiments, while it executes on a computer in a different datacenter (e.g., a public or private cloud datacenter) in other embodiments. The packet samplers 205 send the sampled packets or attributes of the sample packets to the network analyzer 250 through an intervening network (e.g., a local area network of the sampler's site and/or an external network, such as the Internet).

In other embodiments, the packet sampler 205 is only deployed at one of the two sites (e.g., the first site 210), but it samples both ingress and egress packets between its site (e.g., the first site) and the other site (e.g., the second site). Irrespective of how the sample packets are captured, the process 100 in some embodiments captures one or more attributes of the packets (e.g., the sizes of the packets, the transmission times of the packets, etc.), as further described below by FIGS. 3-4.

After identifying a sampled subset of the packets from the flows being exchanged between the first and second sites, the process 100 (at 110) identifies predicted packets that are part of the sampled flows between the sites, and identifies attributes for these predicted packets, in order to identify attributes of each sampled flow. In some embodiments, the network analysis server 250 identifies these predicted packets and their attributes to produce predicted complete flows that are exchanged between the first and second sites, so that it can perform its analysis of the suitability of the second network link (e.g., the commercial Internet connection link) based on complete flow descriptions. The generation of the predicted packets and the identification of their attributes will be further described below by reference to FIGS. 3-4.

Before using the identified and computed attributes of the sampled and predicted packets, the process 100 normalizes (at 115) these attributes to remove one or more conditions associated with the first network link. In some embodiments, the identified and computed attributes include packet delay attributes. To normalize the identified and computed delay attributes, the network analyzing server 250 in some of these embodiments removes the predicted delays for packets traversing between the first and second compute sites through the first network link from the identified and computed delay attributes of the packets, so that it can use these normalized delays to perform its emulation.

In some embodiments, the normalized delays represent communication delays between processes that exchange the flows in the set of flows (e.g., between processes that execute on devices at the first and second sites) after the removal of the delays associated with the packet passing through the first network. In other words, the normalizing is performed in some embodiments to render the assessment regarding the use of the second network link agnostic (i.e., independent) of operating conditions of the first network link. In some embodiments, the process 100 identifies and normalizes other packet-traversal attributes for packets traversing between the two sites. For instance, in some embodiments, the process 100 identifies packet jitter (which in some embodiments is computed as the derivative of the packet delay) for the packets exchanged between the first and second sites through the first network link, and then normalizes the identified packet jitter to remove the jitter due to the first network link.

To perform its normalizing operation, the process 100 in some embodiments identifies sets of request flows and response flows between the first and second sites, computes the delay between each request flow and the response flow associated with the request flow (i.e., between each request flow and its corresponding response flow), and removes communication delay through the first network from each computed delay, as further described below by reference to FIG. 7.

To perform its emulation, some embodiments monitor a set of operating conditions associated with the second network link, and then use the monitored set of operating conditions in the packet flow emulation of the network analyzing server 250. Accordingly, after normalizing the identified and computed attributes of the sampled and predicted packets, the process 100 uses (at 120) the normalized, identified and computed attributes of each sampled flow to emulate the flow passing between the first and second sites through the second network link (e.g., the cable modem Internet link) in order to assess whether the second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites). This emulation will be further described below by reference to FIG. 9.

After generating the emulated packet flow results (specifying the predicted traversal of the sampled flows through the second network link), the network analyzing server 250 generates (at 125) a report that compares the traversal of the sampled flows through the second link with the traversal of the sampled flows through the first link. This report is then used to compare the quality of the second network link to the quality of the first network link on a per flow or per category of flow basis (e.g., for VoIP calls, for video conferencing, for VPN access, etc.). This generation and assessment of such reports will be further described below by reference to FIG. 10.

One of ordinary skill will realize that other embodiments perform their comparison of the first and second network links differently than the process 100. For instance, instead of sampling some of the packets of some or all of the flows exchanged between two sites through the first network link, other embodiments copy all of the packets, or capture attributes of all of the packets, of a subset of flows (e.g., all of the VoIP packets) exchanged between the two sites. To copy these packets or capture their attributes, some embodiments utilize packet mirroring software engines or hardware appliances deployed in the egress paths of the packets (e.g., between gateways 220 and MPLS forwarding elements 225).

The packet mirroring engines/appliances send a copy of each packet of the subset of flows (e.g., of the VoIP flows), or the captured attributes of each of these packets. In some embodiment, the packet mirrors use a deep packet inspection engine to determine that the packet belongs to the subset of flows. In other embodiments, the packet mirrors use tags associated with the packets (or some other commonly known technique to identify a payload of a packet flow) to determine that the packet belongs to the subset of flows. These tags are generated by context capturing engines or deep packet inspection engines executing on host computers that also execute the source machines of the packets. Examples of such engines are described in U.S. Pat. No. 10,802,857, which is incorporated herein by reference.

FIG. 3 conceptually illustrates the components of the network analyzing server 250 of some embodiments. As shown, these components include a trace builder 305, a message exchange builder 310, a network condition monitor 315, a data set normalizer 320, an emulator 325 and a user interface 330. Instead of operating on one server in some embodiments, these components in other embodiments execute on multiple machines (e.g., multiple containers and/or virtual machines).

The trace builder 305 collects the packets forwarded by the packet samplers 205 (or packet mirrors) that are deployed in the first site 210 and/or second site 212 at the packet egress data paths. From the packet sampled for each flow, the trace builder 305 completes each flow's definition by predicting the number of missing packets between the sampled packets and predicting the attributes of the predicted packets. The trace builder 305 builds a list of each sampled or predicted packet of each flow, and the attributes of these packets.

The OSI 7-layer model specifies that the application layer is independent of the networking (TCP/IP) layer. Hence, some embodiments use the application layer (e.g., HTTP) request-responses to build a trace independent of the network conditions. However, due to HTTPS, a significant fraction of the traffic is encrypted. For such flows, it is hard to obtain the exact requests and responses. Additionally, collecting an HTTP request/response can be intrusive (requires agents running on clients and servers). Accordingly, instead of collecting actual packets, some embodiments collect size data regarding the packets. Collecting the request and response packet sizes serves the purpose of eliminating the impact of MPLS network conditions and create a trace independent of the network conditions.

To identify HTTP request/response sizes, some embodiments sample the packets directly from the router connected to MPLS link by using an sFlow sampling tool, as described above. The sFlow sampling tool is versatile and is supported by most of the routers. As mentioned above, some embodiments do not store the entire sampled packet because the content of the packet does not have as much value for the emulation as its size. These embodiments instead store the packet sizes. For instance, for each sampled packet, a packet sampler 205 would store a timestamp, the flow identifier of the packet (i.e., the packet's five tuple identifier), and the packet size.

Table 405 of FIG. 4 illustrates examples of records 402, 404, 406, 408 created for four packets sampled at the first site 210 by the packet sampler 205. These records show the timestamp, five tuple identifier and size of each of the three sampled packets. For the example illustrated in table 405 of FIG. 4, table 410 shows the addition of a record 412 relating to a predicted packet that the trace builder 305 identifies between the records 402 and 404.

To identify the predicted missing packets that are not sampled by the packet samplers 205, the trace builder 305 uses the following characteristics of a TCP flow: (1) TCP sends data with increasing sequence numbers, (2) the TCP acknowledgement for sequence number X indicates packet with sequence number X was previously sent, and (3) TCP sends packets in bursts based on the congestion window (indirectly based on the data transmission rate).

FIG. 5 presents an example that illustrates a typical TCP communication. This example illustrates TCP communication between two sites. When one node sends TCP data packets 505, the other node selectively sends acknowledgements 510. The data packets 505 contain a sequence number indicating the data position relative to the first data byte sent. The acknowledgement 510 contains the sequence number expected by the other end. Due to congestion control, packets are not sent at uniform intervals. Instead, they are sent in burst batches 515 as shown in FIG. 5.

To fill-in the missing packets (the packets not sampled by the packet sampler 205), the trace builder 305 performs the following operations. For each two consecutive sampled packets in a flow, the trace builder identifies the missing sequence numbers and the position for packets with such missing sequence numbers. The benefit of this approach is that it runs in O(n) time (n being the number of packets) with overall space complexity of O(n), and run-time space complexity (i.e., memory to store temporary data) of O(1).

FIG. 6 illustrates four examples 605-620 of how the trace builder 305 identifies the predicted missing packets (i.e., how it fills-in the missing packets). Each of these four examples is based on how the two consecutive packets are received for each individual TCP flow from the packet sampler 205. In the first example 605, the two sampled packets are two data packets 602 and 604 (like data packets 505) sent from one site to the other site, and these two data packets have consecutive sequence numbers. For this case, the trace builder 305 does not predict any missing packets between the two sampled packets.

In the second example 610, the two sampled packets 612 and 614 are two data packets 505 with a gap in sequence numbers. Here, the trace builder 305 uses the maximum packet size (e.g., 1000 bytes) to determine number (N) of missing packets, and then assigns N/2 packets after the first packet 612 and N/2 packets before the second packet 614. In this example, the gap has a value of 2000 bytes, while the maximum TCP packet size is 1000 bytes. Hence, the trace builder 305 identifies predicted packets 616 and 618 and places these packets between the two packets 612 and 614.

In the third example 615, the two sampled packets are a data packet 622 (like a data packet 505) and an acknowledgment packet 624 (like an acknowledgment packet 510) with no gap in sequence numbers. For this case, the trace builder 305 does not predict any missing packet between the two sampled packets.

In the fourth example 620, the two sampled packets include one data packet 632 (like a data packet 505) and one acknowledgment packet 634 (like an acknowledgment packet 510) with a gap in sequence numbers between these two packets. Here, the trace builder 305 uses the maximum packet size (e.g., 1000 bytes) to determine number (N) of missing packets, and then assigns all N packets (in this case two packets 636 and 638) after the data packet 632 as an acknowledgment packet is sent right after corresponding sequence number is received. It can happen that the packets are reordered where data packets are received with non-monotonically increasing sequence numbers. In such situations, the trace builder 305 drops packets that are received out-of-order.

Storing packet trace data can have a large overhead. To store the metadata regarding request and response packet sizes, some embodiments use 8 bytes to store a timestamp, 12 bytes to store the five tuple ID, and 2 bytes to store the packet size for a total of 22 bytes. Assuming an average of 1 Gbps total traffic with an average 1 KB packet size, and a 131 K number of packets per second, the total data size to record per second is 2.75MB/s (i.e., 131 K*22 B). This would result in a total data size of 1.6 TB collected in 1 week (2.75 MB/s*7*24*3600). This is a large storage overhead.

To reduce the packet trace size, some embodiments use the following three compression techniques. These compression techniques work as the packet data arrives, and do not need to be performed on a batch of the data. First, instead of storing the five tuple ID for each packet record, all the packets associated with one flow are stored in one storage structure (e.g., one table, one file, etc.) associated with the five tuple. In the above example, this reduces the total size from 22 bytes per packet to about 10 bytes per packet (8 for the timestamp and 2 for the packet size), which, in turn, reduces the total storage size from 1.6 TB to 0.72 TB.

Second, the timestamp is encoded using delta compression where the “delta” value of the timestamp is stored instead of the actual timestamp. Assuming at least one packet is sent in 10 minutes, 20 bits are needed to store the delta values. Instead of storing an 8 byte timestamp, some embodiments use 3 byte values to represent the deltas. This reduces total storage size in the above example from 0.72 TB to about 0.27 TB.

Third, instead of storing absolute packet sizes, some embodiments store quantized packet sizes (i.e., identify the packet-size “bucket” with which the packet should be associated). Instead of storing 2 byte packet sizes, some embodiments store 1 byte packet sizes for 256 packet-size buckets. Additionally, some embodiments use dictionary compression to store the common packet sizes. These packet size compressions reduce the storage size in the above example from 0.27 TB to 0.14 TB. Hence, these three compression techniques have an 11.4 time reduction on the overall storage size in the example above.

After the trace builder 305 identifies the predicted packets, and stores the attributes of the sampled and predicted packets to complete the description of the bi-directional flow between the first and second sites, the message exchange builder 310 transforms the individual packets identified by the trace builder 305 into a series of http requests and responses. To create the client requests/responses, the message exchange builder 310 labels a node (a site) as “client” when it initiates the TCP connection (sends the SYN packet), while labeling the other node (the other site) as the “server” that sends the responses back to client. It identifies an individual request as all of the data packets from the client before the next batch of packets from the server, and identifies an individual response as all server packets before the next request packet.

For the example illustrated in FIG. 4, a third table 415 illustrates two sets of response and request records 422 and 424 for two sets of responses/requests that are identified in the second table 410 of this figure. Each response/request record 422 or 424 stores a timestamp, a five tuple ID, the size of the request packets in this record's sequence of requests, the size of the response packets in this record's sequence of responses, and an app-delay value. The app-delay value in some embodiments is the time delay between the last request in a request/response sequence and the first response in the request/response sequence.

To illustrate the app-delay value, FIG. 7 illustrates five sequences 702-710 of requests and responses. Each sequence has one or more request packets followed by one or more response packets. For instance, the fourth and fifth request/response sequences 708 and 710 have one request packet and one response packet, while the first and second request/response sequences 702 and 704 have more than one request packets and more than one response packets. The third request/response sequence 706 has one request packet and four response packets. In each of these sequences, the app-delay value is the time between the last request packet in the sequence (e.g., the request packet 712 in the first request/response sequence) and the first response packet in the sequence (e.g., the response packet 714).

After the message exchange builder 310 transforms the individual packets identified by the trace builder 305 into a series of http requests and responses, and identifies and stores one or more attributes of each sequence of requests/responses, the data set normalizer 320 normalizes these attributes to remove one or more conditions associated with the first network link (e.g., the MPLS link). For instance, to normalize the identified app-delay attribute of each request/response sequence identified by the message exchange builder 310, the data set normalizer in some of these embodiments removes the predicted delay for packet traversal between the first and second compute sites through the first network link from the app-delay attributes. This normalization is performed in some embodiments to render the assessment regarding the use of the second network link agnostic (i.e., independent) of operating conditions of the first network link.

To identify the predicted delay for the packet traversal between the first and second compute sites, the data set normalizer 320 receives the predicted delay of the first network link from the network condition monitor 315 based on measurements collected at the first and second sites regarding the first network link. In some embodiments, measurement agents at the first and second sites (e.g., measurement agents associated with the SD-WAN gateway 220) repeatedly generate delay measurement for the first network link by repeatedly pinging each other. In these embodiments, multiple different measured delays can be used as the predicted delays of the first network link at different times, and the closest measured delay for each request/response sequence can be subtracted from the sequence's measured app delay.

After the data set normalizer 320 normalizes each request/response sequence's attributes to remove one or more conditions associated with the first network link, the emulator 325 uses the normalized attributes of each request/response sequence of each sampled flow to emulate the passing of each flow between the first and second sites through the second network link. This is done in order to assess whether the second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

To perform its emulation, the emulator 325 needs to have data regarding the characteristics of the second network link. The emulator gets this data from the network condition monitor 315, which in some embodiments obtains this data from measurement agents at the first and second sites (e.g., measurement agents associated with the SD-WAN gateway 220). The network condition monitor 315 produces for each flow one or more sets of network condition metrics, such as Round-Trip-Time (RTT) values, peak bandwidth (BW) values, and packet drop.

As mentioned above, the second network link is a commercial Internet connection (e.g., a cable modem connection) in some embodiments. FIG. 8 illustrates an example of a table 805 used by the emulator 325 to summarize the Internet network conditions associated with two flows, which could be between the same pair of sites or between two different pairs of sites. In this example, the Internet network conditions are expressed in terms of one or more sets of RTT values, peak bandwidth values, and drop rates, with each set associated with a different instance in time.

When an IP address is accessible from Internet, it is straightforward to measure the Internet conditions (e.g., RTT, bandwidth etc.) easily by sending traffic between the first and second sites through the Internet connection of each site. However, the IP addresses can be private (e.g., 10.X.X.X). For example, 10.0.0.1 on the first site can be exchanging packets with 10.0.1.1 at the second site, but this exchange requires indirect routing (e.g., through tunneling) and even there it might require route changes that are not always possible.

To get Internet conditions for private destination IP addresses, some embodiments use one of two possible solutions. The first solution measures the Internet conditions using proximity. Based on the trace, these embodiments collect the IP addresses accessed from each site. For example, the first site (city =Lafayette) accesses 10.0.0.1, 10.0.0.2, and 10.1.0.1. For this site, the network condition monitor uses geo-tag values (e.g., 10.0.0.1, 10.0.0.2: Chicago. 10.1.0.1: New York) associated with the IP addresses to find the public IP addresses near the geo-tagged IP addresses. In some embodiments, the private IP addresses are geo-tagged by each site's network administrator or by the SD-WAN administrator.

The closest IP addresses are identified in some embodiments by using public clouds, CDNs and other publicly available PoPs (point-of-presence). Once the nearby public IP addresses are identified for the private IP addresses, the network condition monitor 315 uses agents to measure the Internet conditions (e.g., RTT (using syn-packets), packet drop by sending burst of packets, etc.) for these nearby public IP addresses. It then uses these measurements as the measurements for the Internet connections to the private IP addresses used by the flows.

The second solution uses the Internet conditions as specified by the users. Specifically, in some embodiments, the users provide the Internet conditions. These conditions can vary over time, e.g., the conditions are different on a weekend compared to a weekday, or the same for black Friday sales or other events. In these embodiments, customers can specify the Internet conditions including the RTT and peak bandwidth.

Based on the Internet network condition parameters, the emulator 325 uses the normalized attributes of each request/response sequence of each sampled flow to compute flow traversal attributes of each flow between the first and second sites through the second network link. In other words, the emulator 325 replays each sampled communication session through the second network link (e.g., through the Internet connection).

FIG. 9 illustrates how the emulator 325 replays the client requests/responses through the commercial Internet connections of the first and second sites 210 and 212. Specifically, it shows the emulator 325 using four machines, which are an orchestrator machine 905, a client machine 910, a network condition machine 920 and a server machine 915. Each of these machines in this example are VMs, but in other embodiments they can be other types of machines or processes, such as containers, etc.

The client and server machines 910 and 915 emulate the first and second site source and destination machines, while the network condition machine 925 emulates the intervening network fabric between these two sites. Through the network condition machine 920, the client machine 910 continually sends the emulated HTTP requests identified by the trace builder 305, while the server 915 continually sends the responses back to the client 910. The client and server machines send these packets based on timing data provided by the orchestrator. Throughout this process, the orchestrator 905 measures the flow completion times (FCT) for each flow.

More specifically, based on the input from orchestrator 905, the client and server machines 910 and 915 (1) establish a TCP connection and transfer data, (2) measure the flow completion time, and (3) report the measured FCTs to the orchestrator 905. In some embodiments, the TCP port numbers from the original trace are changed based on availability, e.g., if port 80 is occupied, then (for that connection) the server runs on the next available port (e.g., 81). Client measures the FCT (flow completion time) for each connection and reports its measurements to the orchestrator machine 905.

In this setup, the network condition machine 920 applies the network conditions received from orchestrator 905 to the packets that it passes from the client to the server or the server to the client. FIG. 9 presents a table 950 that expresses the network conditions for the different request/response sequences produced by the trace builder 305. As shown, these network conditions in some embodiments can be different for different connections. Based on the above input, the orchestrator 905 passes the request size and time to send the request to the client 910. Similarly, it passes the response size and time to the server 915. Additionally, the orchestrator 905 passes the network conditions to the network condition machine 920, which then uses these conditions in determining when to replay the packets sent from one site to the other site.

After generating the emulated packet flow results (specifying the predicted traversal of the sampled flows through the second network link), the emulator 325 in some embodiments stores the emulated results in a storage (not shown) that can be queried through the user interface 330 to generate one or more reports that compare the traversal of the sampled flows through the second link with the traversal of the sampled flows through the first link. Such reports can then be used to compare the quality of the second network link to the quality of the first network link on a per flow or per category of flow basis (e.g., for VoIP calls, for video conferencing, for VPN access, etc.).

For instance, when comparing the traversal of a particular flow or class of flows through the MPLS link versus the traversal of flows through commercial Internet link, the user interface 330 obtains the FCTs for the flow or flows through the MPLS network based on the records produced by the trace builder 305 and compares these FCTs with FCTs produced by the emulator 325. Based on this comparison, the user interface 330 produces a report that compares the different FCTs through the different links in order to allow the user to determine which flows it can move to the commercial Internet link.

FIG. 10 illustrates an example of a report 1000 generated through the user interface 330. As shown, this report provides a percentage of service degradation (as expressed through the FCT metric) for a particular volume of monitored traffic flow related to seven sets of flows (referred to in this figure as services). In this example, the user has specified that the commercial Internet connection should not be used if the performance degradation is more than 10%. Hence, the generated report 1000 identifies the commercial Internet connection as unsuitable for the first, third and fourth flow sets. This report also shows that the Internet connection is suitable for the second, fifth, sixth and seventh sets of flows. By moving these sets of flows from the MPLS link to the commercial Internet link, the user can move 53% of the traffic to the commercial Internet link and reduce its MPLS cost by a substantial amount.

As mentioned above, some embodiments of the invention are used to evaluate network links that are used to establish an SD-WAN. FIG. 11 illustrates an example of an SD-WAN 1100 (also referred to below as virtual network) for connecting multiple branch sites to each other and to a controller and at least one datacenter hub. As shown, the SD-WAN 1100 includes a controller 1110, three branch sites 1120-1124 that each include an edge forwarding node 1130-1134 (also referred herein as edge nodes or nodes), a cloud gateway 1140, and a datacenter 1150 with a hub 1145.

The edge nodes in some embodiments are edge machines (e.g., virtual machines (VMs), containers, programs executing on computers, etc.) and/or standalone appliances that operate at multi-computer locations of the particular entity (e.g., at an office or datacenter of the entity) to connect the computers at their respective locations to other nodes, hubs, etc. in the virtual network. In some embodiments, the nodes are clusters of nodes at each of the branch sites. In other embodiments, the edge nodes are deployed at each of the branch sites as high-availability pairs such that one edge node in the pair is the active node and the other edge node in the pair is the standby node that can take over as the active edge node in case of failover.

An example of an entity for which such a virtual network can be established includes a business entity (e.g., a corporation), a non-profit entity (e.g., a hospital, a research organization, etc.), and an education entity (e.g., a university, a college, etc.), or any other type of entity. Examples of public cloud providers include Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, etc., while examples of entities include a company (e.g., corporation, partnership, etc.), an organization (e.g., a school, a non-profit, a government entity, etc.), etc. In other embodiments, hubs like the hub 1145 can also be deployed in private cloud datacenters of a virtual WAN provider that hosts hubs to establish SD-WANs for different entities.

In the example SD-WAN 1100, the hub 1145 is a single tenant or multi-tenant forwarding element that is deployed on the premises of the datacenter 1150. The hub 1145 can be used to establish secure connection links (e.g., tunnels) with edge nodes at the particular entity's multi-computer sites, such as branch sites 1130-1134, third party datacenters (not shown), etc. For example, the hub 1145 can be used to provide access from each branch site 1120-1124 to each other branch site 1120-1124 (e.g., via the connection links 1160 that terminate at the hub 1145) as well as to the resources 1155 of the datacenter 1150. These multi-computer sites are often at different physical locations (e.g., different buildings, different cities, different states, etc.), according to some embodiments. In some embodiments, hubs can be deployed as physical nodes or virtual nodes. Additionally, hubs in some embodiments can be deployed on a cloud (e.g., as a set of virtual edges configured as a cluster).

In the SD-WAN 1100, the hub 1145 also provides access to the resources 1155 of the datacenter 1150 as mentioned above. The resources in some embodiments include a set of one or more servers (e.g., web servers, database servers, etc.) within a microservices container (e.g., a pod). Conjunctively, or alternatively, some embodiments include multiple such microservices containers, each accessible through a different set of one or more hubs of the datacenter (not shown). The resources, as well as the hubs, are within the datacenter premises, according to some embodiments. While not shown, some embodiments include multiple different SaaS datacenters, which may each be accessed via different sets of hubs, according to some embodiments. In some embodiments, the SaaS datacenters include datacenters for video conferencing SaaS providers, for middlebox (e.g., firewall) service providers, for storage service providers, etc.

Additional examples of resources accessible via the hub 1145, in some embodiments, include compute machines (e.g., virtual machines and/or containers providing server operations), storage machines (e.g., database servers), and middlebox service operations (e.g., firewall services, load balancing services, encryption services, etc.). In some embodiments, the connections 1160 between the branch sites 1120-1124 and the hub 1145 are secure encrypted connections that encrypt packets exchanged between the edge nodes 1130-1134 of the branch sites 1120-1124 and the hub 1145. Examples of secure encrypted connections used in some embodiments include VPN (virtual private network) connections, or secure IPsec (Internet Protocol security) connection.

In some embodiments, multiple secure connection links (e.g., multiple secure tunnels) can be established between an edge node and the hub 1145. When multiple such links are defined between a node and a hub, each secure connection link, in some embodiments, is associated with a different physical network link between the node and an external network. For instance, to access external networks in some embodiments, a node has one or more commercial broadband Internet links (e.g., a cable mode and a fiber optic link) to access the Internet, a wireless cellular link (e.g., a 5G LTE network), etc. The collection of the edge nodes, gateway, datacenter hub, controller, and secure connections between the edge nodes, gateway, datacenter hub, and controller form the SD-WAN 1100.

As mentioned above, the controller 1110 communicates with each of the nodes 1130-1134 at the branch sites 1120-1124, in some embodiments, to exchange information via the connection links 1170A-1170C. The controller 1110 also communicates with the gateway 1140 and hub 1145 through the connection links 1170D-1170E to exchange information. While illustrated as individual connection links, the links 1170A-1170E are sets of multiple connection links, according to some embodiments. In addition to the connection links 1170A-1170E and 1160, edge nodes 1132 and 1134 are connected via a connection link 1164, while edge nodes 1130 and 1132 are connected to the gateway 1140 via connection links 1162. The gateway 1140 in this example is responsible for relaying information between edge nodes (e.g., edge nodes 1130 and 1132, which do not share a direct connection). Also, the gateway 1140 in some embodiments is used to set up direct edge-to-edge connections. In some embodiments, the gateway 1140 can be used to provide the edge nodes with access to cloud resources (e.g., compute, storage, and service resources of a cloud datacenter).

Many of the above-described features and applications are implemented as software processes that are specified as a set of instructions recorded on a computer readable storage medium (also referred to as computer readable medium). When these instructions are executed by one or more processing unit(s) (e.g., one or more processors, cores of processors, or other processing units), they cause the processing unit(s) to perform the actions indicated in the instructions. Examples of computer readable media include, but are not limited to, CD-ROMs, flash drives, RAM chips, hard drives, EPROMs, etc. The computer readable media does not include carrier waves and electronic signals passing wirelessly or over wired connections.

In this specification, the term “software” is meant to include firmware residing in read-only memory or applications stored in magnetic storage, which can be read into memory for processing by a processor. Also, in some embodiments, multiple software inventions can be implemented as sub-parts of a larger program while remaining distinct software inventions. In some embodiments, multiple software inventions can also be implemented as separate programs. Finally, any combination of separate programs that together implement a software invention described here is within the scope of the invention. In some embodiments, the software programs, when installed to operate on one or more electronic systems, define one or more specific machine implementations that execute and perform the operations of the software programs.

FIG. 12 conceptually illustrates a computer system 1200 with which some embodiments of the invention are implemented. The computer system 1200 can be used to implement any of the above-described hosts, controllers, and network analyzers. As such, it can be used to execute any of the above described processes. This computer system includes various types of non-transitory machine readable media and interfaces for various other types of machine readable media. Computer system 1200 includes a bus 1205, processing unit(s) 1210, a system memory 1225, a read-only memory 1230, a permanent storage device 1235, input devices 1240, and output devices 1245.

The bus 1205 collectively represents all system, peripheral, and chipset buses that communicatively connect the numerous internal devices of the computer system 1200. For instance, the bus 1205 communicatively connects the processing unit(s) 1210 with the read-only memory 1230, the system memory 1225, and the permanent storage device 1235.

From these various memory units, the processing unit(s) 1210 retrieve instructions to execute and data to process in order to execute the processes of the invention. The processing unit(s) may be a single processor or a multi-core processor in different embodiments. The read-only-memory (ROM) 1230 stores static data and instructions that are needed by the processing unit(s) 1210 and other modules of the computer system. The permanent storage device 1235, on the other hand, is a read-and-write memory device. This device is a non-volatile memory unit that stores instructions and data even when the computer system 1200 is off. Some embodiments of the invention use a mass-storage device (such as a magnetic or optical disk and its corresponding disk drive) as the permanent storage device 1235.

Other embodiments use a removable storage device (such as a floppy disk, flash drive, etc.) as the permanent storage device. Like the permanent storage device 1235, the system memory 1225 is a read-and-write memory device. However, unlike storage device 1235, the system memory is a volatile read-and-write memory, such a random access memory. The system memory stores some of the instructions and data that the processor needs at runtime. In some embodiments, the invention's processes are stored in the system memory 1225, the permanent storage device 1235, and/or the read-only memory 1230. From these various memory units, the processing unit(s) 1210 retrieve instructions to execute and data to process in order to execute the processes of some embodiments.

The bus 1205 also connects to the input and output devices 1240 and 1245. The input devices 1240 enable the user to communicate information and select commands to the computer system. The input devices 1240 include alphanumeric keyboards and pointing devices (also called “cursor control devices”). The output devices 1245 display images generated by the computer system. The output devices 1245 include printers and display devices, such as cathode ray tubes (CRT) or liquid crystal displays (LCD). Some embodiments include devices such as a touchscreen that function as both input and output devices.

Finally, as shown in FIG. 12, bus 1205 also couples computer system 1200 to a network 1265 through a network adapter (not shown). In this manner, the computer can be a part of a network of computers (such as a local area network (“LAN”), a wide area network (“WAN”), or an Intranet, or a network of networks, such as the Internet. Any or all components of computer system 1200 may be used in conjunction with the invention.

Some embodiments include electronic components, such as microprocessors, storage and memory that store computer program instructions in a machine-readable or computer-readable medium (alternatively referred to as computer-readable storage media, machine-readable media, or machine-readable storage media). Some examples of such computer-readable media include RAM, ROM, read-only compact discs (CD-ROM), recordable compact discs (CD-R), rewritable compact discs (CD-RW), read-only digital versatile discs (e.g., DVD-ROM, dual-layer DVD-ROM), a variety of recordable/rewritable DVDs (e.g., DVD-RAM, DVD-RW, DVD+RW, etc.), flash memory (e.g., SD cards, mini-SD cards, micro-SD cards, etc.), magnetic and/or solid state hard drives, read-only and recordable Blu-Ray® discs, ultra-density optical discs, any other optical or magnetic media, and floppy disks. The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations. Examples of computer programs or computer code include machine code, such as is produced by a compiler, and files including higher-level code that are executed by a computer, an electronic component, or a microprocessor using an interpreter.

While the above discussion primarily refers to microprocessor or multi-core processors that execute software, some embodiments are performed by one or more integrated circuits, such as application specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs). In some embodiments, such integrated circuits execute instructions that are stored on the circuit itself.

As used in this specification, the terms “computer”, “server”, “processor”, and “memory” all refer to electronic or other technological devices. These terms exclude people or groups of people. For the purposes of the specification, the terms display or displaying means displaying on an electronic device. As used in this specification, the terms “computer readable medium,” “computer readable media,” and “machine readable medium” are entirely restricted to tangible, physical objects that store information in a form that is readable by a computer. These terms exclude any wireless signals, wired download signals, and any other ephemeral or transitory signals.

While the invention has been described with reference to numerous specific details, one of ordinary skill in the art will recognize that the invention can be embodied in other specific forms without departing from the spirit of the invention. For instance, several of the above-described examples illustrate virtual corporate WANs of corporate tenants of a virtual network provider. One of ordinary skill will realize that in other embodiments, the SD-WANs are deployed for non-corporate tenants (e.g., for schools, colleges, universities, non-profit entities, etc.).

Also, several figures conceptually illustrate processes of some embodiments of the invention. In other embodiments, the specific operations of these processes may not be performed in the exact order shown and described in these figures. The specific operations may not be performed in one continuous series of operations, and different specific operations may be performed in different embodiments. Furthermore, the process could be implemented using several sub-processes, or as part of a larger macro process. Thus, one of ordinary skill in the art would understand that the invention is not to be limited by the foregoing illustrative details, but rather is to be defined by the appended claims.

Claims

1. A method of assessing changes to physical network links used to connect different compute sites, the method comprising: identifying sample packets from packets exchanged between first and second compute sites connected through a first physical network link as part of a set of flows exchanged between the first and second compute sites, wherein the sample packets are a subset of all of the packets of the set of flows;analyzing the sample packets to identify attributes of the sample packets;computing attributes of predicted packets each of which is between two identified sample packets in a flow in the set of flows in order to identify attributes of each flow in the set of flows; andusing the identified and computed attributes of each flow in the set of flows to perform an emulation of the set of flows being exchanged between the first and second compute sites through a second physical network link in order to assess whether the second physical network link should be used for future flows.

2. The method of claim 1, wherein the future flows comprise future flows exchanged between the first and second compute sites.

3. The method of claim 1, wherein computing attributes comprises: identifying one or more predicted packets each of which is between two identified sample packets in a flow in the set of flows; andidentifying attributes of the identified predicted packets.

4. The method of claim 1, wherein the identified and computed attributes comprise packet delay attributes, andusing the identified and computed attributes comprises: normalizing the identified and computed delays by removing predicted delays for traversal of packets between the first and second compute sites through the first physical network link, said normalized delays representing communication delays between processes that exchange the flows in the set of flows and that execute on devices at the first and second compute sites; andusing the normalized delays to perform the emulation.

5. The method of claim 4, wherein the normalizing is performed to render the assessment regarding the use of the second physical network link independent of operating conditions of the first physical network link.

6. The method of claim 4, wherein normalizing comprises: identifying sets of request flows and response flows between the first and second compute sites;computing the delay between each request flow and the response flow associated with the request flow; andremoving communication delay through the first physical network link from each computed delay.

7. The method of claim 1, wherein using the identified and computed attributes comprises: monitoring a set of operating conditions associated with the second physical network link; andusing the monitored set of operating conditions to perform the emulation.

8. The method of claim 1, wherein using the identified and computed attributes comprises: generating predicted attributes for the set of flows if the set of flows had been exchanged through the second physical network link; andcomparing the generated predicted attributes for the set of flows through the second physical network link with the identified and computed attributes associated with the set of flows through the first physical network link to compare a quality of the second physical network link to a quality of the first physical network link.

9. The method of claim 1, wherein the assessment is performed to determine whether the second physical network link should be used for a subset of future flows between the first and second compute sites.

10. The method of claim 9, wherein the second physical network link is less expensive and has a lower performance than the first physical network link.

11. A non-transitory machine readable medium storing a program for assessing changes to physical network links used to connect different compute sites, the program for execution by at least one processing unit of a computer, the program comprising sets of instructions for: using a packet sampler to identify sample packets from packets exchanged between first and second compute sites connected through a first physical network link as part of a set of flows exchanged between the first and second compute sites, wherein the sample packets are a subset of all of the packets of the set of flows;analyzing the sample packets to identify attributes of the sample packets;identifying a plurality of predicted packets that are each predicted to be between two identified sample packets in a flow in the set of flows;computing attributes of the predicted packets in order to identify attributes of each flow in the set of flows; andusing the identified and computed attributes of each flow in the set of flows to perform an emulation of the set of flows being exchanged between the first and second compute sites through a second physical network link in order to assess whether the second physical network link should be used for future flows.

12. The non-transitory machine readable medium of claim 11, wherein the future flows comprise future flows exchanged between the first and second compute sites.

13. The non-transitory machine readable medium of claim 11, wherein the identified and computed attributes comprise packet delay attributes, and the set of instructions for using the identified and computed attributes comprises sets of instructions for: normalizing the identified and computed delays by removing predicted delays for traversal of packets between the first and second compute sites through the first physical network link, said normalized delays representing communication delays between processes that exchange the flows in the set of flows and that execute on devices at the first and second compute sites; andusing the normalized delays to perform the emulation.

14. The non-transitory machine readable medium of claim 13, wherein the set of instructions for the normalizing is performed to render the assessment regarding the use of the second physical network link independent of operating conditions of the first physical network link.

15. The non-transitory machine readable medium of claim 13, wherein the set of instructions for normalizing comprises the sets of instructions for: identifying sets of request flows and response flows between the first and second compute sites;computing the delay between each request flow and the response flow associated with the request flow; andremoving communication delay through the first physical network link from each computed delay.

16. The non-transitory machine readable medium of claim 11, wherein the set of instructions for using the identified and computed attributes comprises sets of instructions for: monitoring a set of operating conditions associated with the second physical network link; andusing the monitored set of operating conditions to perform the emulation.

17. The non-transitory machine readable medium of claim 11, wherein the set of instructions for using the identified and computed attributes comprises the sets of instructions for: generating predicted attributes for the set of flows if the set of flows had been exchanged through the second physical network link; andcomparing the generated predicted attributes for the set of flows through the second physical network link with the identified and computed attributes associated with the set of flows through the first physical network link to compare a quality of the second physical network link to a quality of the first physical network link.

18. The non-transitory machine readable medium of claim 11, wherein the assessment is performed to determine whether the second physical network link should be used for a subset of future flows between the first and second compute sites.

19. The non-transitory machine readable medium of claim 18, wherein the second physical network link is less expensive and has a lower performance than the first physical network link.