Correcting packet timestamps in virtualized environments

摘要

A network capture element is embodied on a virtual machine, and a utility function is embodied on the actual device, preferably within the virtual machine manager. Both the utility function and the traffic capture element are configured to monitor communication events. To minimize the overhead imposed, the utility function is configured to merely store the time that the event occurred on the actual machine, corresponding to an identifier of the event. The network capture element, on the other hand, performs the time consuming tasks of filtering the communications, selectively storing some or all of the data content of the communications, characterizing the data content, and so on. Instead of storing the virtual time that the communication event occurred at the virtual machine, the network capture element uses the identifier of the communication event to retrieve the actual time that the communication event occurred on the actual machine.

主权项

1. A non-transitory computer-readable medium comprising a program that, when executed by a processor, causes the processor to:
receive a packet from a virtual machine manager, the packet including an associated virtual time of arrival, retrieve an actual time of arrival of the packet from a storage element in which the virtual machine manager recorded the actual time of arrival, and replacing the virtual time of arrival with the actual time of arrival; wherein the processor retrieves the actual time of arrival by one of:
submitting a request to, and receiving a response from the virtual machine manager; andaccessing the storage element directly.