Friday, July 22, 2016

Docker Network Demo - Part 4

So, there's always the oops moment when you know that you did something wrong, often before you did it.

I closed one of the putty windows.  Wasn't sure how to get back to my new container. 

Update:  https://github.com/docker/docker/issues/2838 Control-P and Control-Q on the console allow you to move into and out of the psuedo-shell

As it turns out, the container is given a name (assumption that a name could be applied to it also).

docker ps - to see the running containers

nelson@lab1:~$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
4a567ec8d878        alpine              "/bin/sh"           4 hours ago         Up 4 hours                              serene_jennings
60f137369165        alpine              "/bin/sh"           18 hours ago        Up 18 hours                             nauseous_meninsky

I'm after nauseous_meninsky (have to look up where they get these names later).


nelson@lab1:~$ docker attach nauseous_meninsky
/ #

Whew!  Disaster averted.  Back in my container!
……

Getting back to the networking, the default docker network is an RFC1918 class B.  It seemed like a waste of address space to me, so let's create another network in docker.

docker network create -d bridge --subnet 172.16.1.0/24 docker1

-d is the driver, we want a bridge 
--subnet defines the network range, looks like the default gateway is always the first in the range

docker1 is the defined name, like docker0 in the ifconfig -a from the host

nelson@lab1:~$ docker network create -d bridge --subnet 172.16.1.0/24 docker1
11f4ac20d39dd523c48fe3ac6462dd8bcb4a7247dba5162bec37d46208315bc2

docker network ls - to see if it added to the networks

nelson@lab1:~$ docker network ls
NETWORK ID          NAME                DRIVER
1c9307d1163e        bridge              bridge
11f4ac20d39d        docker1             bridge
72a37254aedb        host                host
ae03349bbf0e        none                null

Let's create a container and associate it to the new network.

docker run --net=docker1 alpine -it alpine /bin/sh


nelson@lab1:~$ docker run --net=docker1 -it alpine /bin/sh
/ # ifconfig -a
eth0      Link encap:Ethernet  HWaddr 02:42:AC:10:01:02
          inet addr:172.16.1.2  Bcast:0.0.0.0  Mask:255.255.255.0
          inet6 addr: fe80::42:acff:fe10:102%32720/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:54 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:11822 (11.5 KiB)  TX bytes:648 (648.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1%32720/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

/ #

nelson@lab1:~$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
2b9cacaef4f6        alpine              "/bin/sh"           36 seconds ago      Up 35 seconds                           sick_mclean
4a567ec8d878        alpine              "/bin/sh"           4 hours ago         Up 4 hours                              serene_jennings
60f137369165        alpine              "/bin/sh"           19 hours ago        Up 19 hours                             nauseous_meninsky

Now, lets see what it can talk to from the new shell.

Internet - Success

/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=57 time=24.809 ms
64 bytes from 8.8.8.8: seq=1 ttl=57 time=25.089 ms
64 bytes from 8.8.8.8: seq=2 ttl=57 time=29.708 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 24.809/26.535/29.708 ms

Gateway - Success

/ # ping 172.16.1.1
PING 172.16.1.1 (172.16.1.1): 56 data bytes
64 bytes from 172.16.1.1: seq=0 ttl=64 time=0.130 ms
64 bytes from 172.16.1.1: seq=1 ttl=64 time=0.117 ms
64 bytes from 172.16.1.1: seq=2 ttl=64 time=0.111 ms
^C
--- 172.16.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.111/0.119/0.130 ms

Container 1 - Failure

/ # ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2): 56 data bytes
^C
--- 172.17.0.2 ping statistics ---
9 packets transmitted, 0 packets received, 100% packet loss

Container 2 - Failure

/ # ping 172.17.0.3
PING 172.17.0.3 (172.17.0.3): 56 data bytes
^C
--- 172.17.0.3 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

So, there's no path between 172.16.1.0/24 and 172.17.0.0/16

The routes from the host

nelson@lab1:~$ ip route
default via 192.168.123.254 dev wlan0  proto static
172.16.1.0/24 dev br-11f4ac20d39d  proto kernel  scope link  src 172.16.1.1
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.0.1
192.168.123.0/24 dev wlan0  proto kernel  scope link  src 192.168.123.24  metric 9
Modified for 2 bridges attached to docker
So, maybe it looks a little more like this.

Docker Network Demo - Part 3

Let's have a look at what is happening between the host and the container.

docker network ls - from the physical host shows the networks attached to docker

There is a bridge (softswitch), a host network on the bridge and a (none) null network (don't know what this is yet)

nelson@lab1:~$ docker network ls
NETWORK ID          NAME                DRIVER
1c9307d1163e        bridge              bridge
72a37254aedb        host                host
ae03349bbf0e        none                null

ifconfig -a to show the host connected network interfaces

docker0 is the bridge for the containers, eth0,eth1 currently unused, lo the host loopback and
wlan0, the currently connected host network (also where host default route resides)

There are also two networks with 'veth' prefixes.  These are the virtual interfaces to docker0 for each container.

nelson@lab1:~$ ifconfig -a
docker0   Link encap:Ethernet  HWaddr 02:42:5e:2d:df:17
          inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:5eff:fe2d:df17/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:235 errors:0 dropped:0 overruns:0 frame:0
          TX packets:251 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:16644 (16.6 KB)  TX bytes:27519 (27.5 KB)

eth0      Link encap:Ethernet  HWaddr fc:aa:14:98:ca:29
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth1      Link encap:Ethernet  HWaddr fc:aa:14:98:ca:2b
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:20 Memory:f7e00000-f7e20000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1747 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1747 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:180141 (180.1 KB)  TX bytes:180141 (180.1 KB)

vethc07b410 Link encap:Ethernet  HWaddr b6:c1:69:71:74:31
          inet6 addr: fe80::b4c1:69ff:fe71:7431/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:94 errors:0 dropped:0 overruns:0 frame:0
          TX packets:172 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:7805 (7.8 KB)  TX bytes:19445 (19.4 KB)

vethd678055 Link encap:Ethernet  HWaddr 9a:e2:9a:71:7f:3a
          inet6 addr: fe80::98e2:9aff:fe71:7f3a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:48 errors:0 dropped:0 overruns:0 frame:0
          TX packets:81 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4176 (4.1 KB)  TX bytes:10628 (10.6 KB)

wlan0     Link encap:Ethernet  HWaddr d8:fc:93:47:01:fd
          inet addr:192.168.1.24  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::dafc:93ff:fe47:1fd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:683977 errors:0 dropped:7 overruns:0 frame:0
          TX packets:2165426 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:110733511 (110.7 MB)  TX bytes:2883791106 (2.8 GB)

Just for my edification, wanted to see if the host can reach the container

First Container

nelson@lab1:~$  ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.106 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.066 ms
64 bytes from 172.17.0.2: icmp_seq=3 ttl=64 time=0.073 ms
64 bytes from 172.17.0.2: icmp_seq=4 ttl=64 time=0.079 ms
^C
--- 172.17.0.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2997ms
rtt min/avg/max/mdev = 0.066/0.081/0.106/0.015 ms

Second Container

nelson@lab1:~$ ping 172.17.0.3
PING 172.17.0.3 (172.17.0.3) 56(84) bytes of data.
64 bytes from 172.17.0.3: icmp_seq=1 ttl=64 time=0.048 ms
64 bytes from 172.17.0.3: icmp_seq=2 ttl=64 time=0.047 ms
^C
--- 172.17.0.3 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.047/0.047/0.048/0.006 ms

docker network inspect bridge - show what the bridge (by name from docker network ls) is and how it is configured in a JSON object  http://www.json.org/ 

Notice the containers identified in the container section

nelson@lab1:~$ docker network inspect bridge
[
    {
        "Name": "bridge",
        "Id": "1c9307d1163e9d46a0a34a6430e4031ba7c41e1c33cd55304965e389905667bf",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.17.0.0/16",
                    "Gateway": "172.17.0.1"
                }
            ]
        },
        "Internal": false,
        "Containers": {
            "4a567ec8d878c73614a72db1d465e811cbb345384a2a02507596f3d161f8e77b": {
                "Name": "serene_jennings",
                "EndpointID": "58d1e794d6abe6ac142008080c78f2a072f76ad3514485238b2ee36aff69442d",
                "MacAddress": "02:42:ac:11:00:03",
                "IPv4Address": "172.17.0.3/16",
                "IPv6Address": ""
            },
            "60f1373691651b1b9694cc20e8ee4940611e7744a7526c7d513581f3a0c71e30": {
                "Name": "nauseous_meninsky",
                "EndpointID": "8c8ff1ccb10110f4befec2c83fb9af32247af5f8584be21ca7dc681c2a4b679e",
                "MacAddress": "02:42:ac:11:00:02",
                "IPv4Address": "172.17.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.bridge.default_bridge": "true",
            "com.docker.network.bridge.enable_icc": "true",
            "com.docker.network.bridge.enable_ip_masquerade": "true",
            "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
            "com.docker.network.bridge.name": "docker0",
            "com.docker.network.driver.mtu": "1500"
        },
        "Labels": {}
    }
]

Feel free to repeat this command for host and none.

Wondering where the traffic is going…

ip route - from the host for specific traffic directions

nelson@lab1:~$ ip route
default via 192.168.1.254 dev wlan0  proto static
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.0.1
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.24  metric 9

Also from one of the containers

/ # ip route
default via 172.17.0.1 dev eth0

Docker Network Demo - Part 2

Opening a new session with the host.  I'm going to create a second running container and see if they can communicate.

nelson@lab1:~$ docker run -it alpine /bin/sh
/ #

Verifying it is a second shell…

nelson@lab1:~$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
4a567ec8d878        alpine              "/bin/sh"           32 seconds ago      Up 32 seconds                           serene_jennings
60f137369165        alpine              "/bin/sh"           14 hours ago        Up 14 hours                             nauseous_meninsky

Let's look at the IP addressing

/ # ifconfig -a
eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:03
          inet addr:172.17.0.3  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:acff:fe11:3%32717/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:26 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5575 (5.4 KiB)  TX bytes:648 (648.0 B)

Ping Externally Success


/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=57 time=24.538 ms
64 bytes from 8.8.8.8: seq=1 ttl=57 time=22.519 ms
64 bytes from 8.8.8.8: seq=2 ttl=57 time=22.623 ms
64 bytes from 8.8.8.8: seq=3 ttl=57 time=23.002 ms
64 bytes from 8.8.8.8: seq=4 ttl=57 time=22.303 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 22.303/22.997/24.538 ms

Question:  Can the two containers communicate with each other?

.3 to .2  Success

/ # ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2): 56 data bytes
64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.175 ms
64 bytes from 172.17.0.2: seq=1 ttl=64 time=0.128 ms
64 bytes from 172.17.0.2: seq=2 ttl=64 time=0.131 ms
64 bytes from 172.17.0.2: seq=3 ttl=64 time=0.130 ms
64 bytes from 172.17.0.2: seq=4 ttl=64 time=0.175 ms
^C
--- 172.17.0.2 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.128/0.147/0.175 ms

.2 to .3 Success

/ # ping 172.17.0.3
PING 172.17.0.3 (172.17.0.3): 56 data bytes
64 bytes from 172.17.0.3: seq=0 ttl=64 time=0.144 ms
64 bytes from 172.17.0.3: seq=1 ttl=64 time=0.128 ms
64 bytes from 172.17.0.3: seq=2 ttl=64 time=0.129 ms
64 bytes from 172.17.0.3: seq=3 ttl=64 time=0.122 ms
64 bytes from 172.17.0.3: seq=4 ttl=64 time=0.126 ms
^C
--- 172.17.0.3 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.122/0.129/0.144 ms


Here's what it looks like.

Containers communicating on the bridge

http://www.abusedbits.com/2016/07/docker-network-demo-part-3.html

Thursday, July 21, 2016

Docker Network Demo - Part 1


Install
On Linux distributions
Installation on Ubuntu

Make sure you reboot

While I don't know about running docker in windows, you can use VirtualBox to create an experimentation OS on your host.


nelson@lab1 - is the host Ubuntu System running LTS 14.04

I open two terminals into the host to experiment with it.  I'm using putty.

Once docker is running as a service

docker pull alpine   (this gets you a local os image to work with)

nelson@lab1:~$ docker pull alpine
Using default tag: latest
latest: Pulling from library/alpine
e110a4a17941: Already exists
Digest: sha256:3dcdb92d7432d56604d4545cbd324b14e647b313626d99b889d0626de158f73a
Status: Downloaded newer image for alpine:latest

docker images (show's you what's in the image repo)

nelson@lab1:~$ docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
hello-world         latest              c54a2cc56cbb        2 weeks ago         1.848 kB
alpine              latest              4e38e38c8ce0        4 weeks ago         4.799 MB

docker run -it alpine /bin/sh (runs the shell from alpine)

nelson@lab1:~$ docker run -it alpine /bin/sh
/ #

WHOOT!  You have a shell!

nelson@lab1:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether fc:aa:14:98:ca:29 brd ff:ff:ff:ff:ff:ff
3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether fc:aa:14:98:ca:2b brd ff:ff:ff:ff:ff:ff
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether d8:fc:93:47:01:fd brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.24/24 brd 192.168.1.255 scope global wlan0
       valid_lft forever preferred_lft forever
    inet6 fe80::dafc:93ff:fe47:1fd/64 scope link
       valid_lft forever preferred_lft forever
5: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:5e:2d:df:17 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:5eff:fe2d:df17/64 scope link
       valid_lft forever preferred_lft forever
17: vethc07b410: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
    link/ether b6:c1:69:71:74:31 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::b4c1:69ff:fe71:7431/64 scope link
       valid_lft forever preferred_lft forever

     IP Addressing!  look at docker0 (zero), yes, it's wasting space, but we can change that later

nelson@lab1:~$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED              STATUS              PORTS               NAMES
d148901e8f70        alpine              "/bin/sh"           About a minute ago   Up About a minute                       stoic_curie

Ping something that should be reachable from your network.  I chose the universal loopback.  (Just kidding, don't use 8.8.8.8 as a loopback.)

/ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=57 time=24.921 ms
64 bytes from 8.8.8.8: seq=1 ttl=57 time=32.615 ms
64 bytes from 8.8.8.8: seq=2 ttl=57 time=23.340 ms
64 bytes from 8.8.8.8: seq=3 ttl=57 time=22.864 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss

round-trip min/avg/max = 22.864/25.935/32.615 ms

Update:  If you want to see a little deeper into what is happening,do an ifconfig and identify the physical network port name.  Then do a tcpdump on it for icmp.  Command looks like this from the host:

sudo tcpdump -i ens33 icmp 

/ # ifconfig -a
eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:02
          inet addr:172.17.0.2  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:acff:fe11:2%32519/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:138 errors:0 dropped:0 overruns:0 frame:0
          TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:16510 (16.1 KiB)  TX bytes:6657 (6.5 KiB)

Here's basically what it looks like

Monday, July 18, 2016

Networks Not Flat

I just thought this was an interesting representation of both man made and natural networks side-by-side.

I have no argument for the depiction other than they exist.



Image on the left is a map of the internet circa 2012.  Image on the left is from this article https://spectrumnews.org/news/atlas-maps-flow-of-neurons-in-the-mouse-brain/

Happy viewing.

Monday, July 11, 2016

Representing an Overlay / Underlay Network

A train provides a really good representation for illustrating the relationship between an underlay and overlay network.

In this model, the tracks represent the physical network, the real world connection between two locations.  The train acts as the underlay depiction of the transport. In networking this is SRC (Source) and DST (Destination), between which the packet exists for some duration before being acted upon.


The relationship between the overlay and the underlay is similar to the relationship between the passenger car and the contents of the passenger car.  There is only a passing awareness between the two where the SRC and DST of the train is likely NOT the SRC and DST of the contents of the train. (Depiction below).

Figure:  Train diagram of Networking

As shown in the diagram (the sum total of my artistic talent), the passenger provides the intelligence, the "control plane management" of his/her suitcase.  When the passenger leaves this particular train, it may be to get on another train (routing, switching, gateway or re-encapsulation) or maybe to a hotel or home (virtual or host operating system).

In such a way, the passenger moves the payload (their suitcase) from a SRC to a DST, sharing for the briefest of times the Underlay (passenger car) with other payloads with other SRC and DST.  The end-to-end commute represents the path (or tunnel) that is traveled and much akin to the VxLAN or NVGRE tunnel that a packet in an Overlay network takes across an Underlay to get from one place to another.

Tuesday, April 19, 2016

LAN Physical to Overlay

It is terribly difficult to express the design elements of VxLAN technology in a single drawing.  As seen in previous blogs, the elements of the physical construct of an ECMP (Equal-Cost Multi-Path) spine and leaf is astonishingly complex.  These become represented in abstracted views of the total in graduations from quite simple to piece-by-piece elements in order to express their true nature.

Part of the problem is associated with these complexities, but having put together multiple descriptive models, it really is because the OVERLAY doesn't look anything like the physical design.  Networkers got used to broadcast domains being associated with a wire.  Then being associated with an L2 abstraction.  Now networkers need to figure out how to represent the multiple levels of networking with additional L2-in-L3 tunnels.

It's also not as if this hasn't happened before.  VPN drawings look much like VxLAN drawings, but in a VPN drawing, there may be one or a couple, in VxLAN there could be a lot more.  Ultimately, the issue becomes how complex the drawing is to layer in all of the information.

Starting from the view of a Modern Platform for Enterprise (as opposed to public cloud), networkers need to connect particular security elements, network services, control plane services, backup, networking and platforms.  Architecturally, the model looks very much like this.

Figure 1.  Modern Platform
DC LAN (red) plays a dominant role in this platform architecture, providing connectivity from any element to any element within the construct.  Be it a physical device, a virtual machine on a hypervisor or a container on an operating system.

Figure 2.  Any to Any
It's not as simple as that though.  The network attributes are overlaid on top of hardware, software and logical (or abstracted) networking mechanisms in this model.  In this extremely simplified model, use case 1 is where the hypervisor communicates with another hypervisor (green) and use case 2 where the hypervisor communicates with a bare metal object.  A third use case exists where a container communicates with hypervisor or hardware, but it's not used frequently yet in the Enterprise.

The VxLAN (Virtual eXtensible LAN) kernel module of the hypervisor (in this case VMware ESX) communicates through it's vSwitch to the physical medium, a network adapter on the physical machine.  This is then passed to the physical switch to be passed in accordance to the VNI (Virtual Network Identifier) associated with the packets.  In case 1, it is then picked up by the network card on the second physical host, working though the vSwitch to get to the virtual machine.  In case 2, the endpoint is a VTEP (Virtual Tunnel EndPoint) where it is de-encapsulated from L3 to L2 to arrive at the physical server.

In both cases, two sets of interacting Control Planes, VMware NSX and Arista CVX provide the path information to instantiate the VxLAN tunnel.

Figure 3.  VxLAN Delivery (gratuitous re-use from earlier blog)
Now, there needs to be a bold red blinking sign that states the network still exists, both in its physical and logical form.  Herein lies the Spine-and-Leaf.  It is similar to a Clos design (as in Charles Clos) that does have some oversubscription at different levels.  Physically it utilizes the spine as a one hop transport route between all leaf nodes.

The concept though is quite simple.  Scale out horizontally as large as possible.  When that is exceeded, add another spine and make a 2 hop transport route.  The Leaf nodes come in two basic flavors, one that provides transport access to hosts, the other leaf flavor provides Services.  Services Leaf are used to establish specific service functions.  The two examples shown here are WAN access with perimeter security Firewall and IP protocol based storage.

Moving from Brown to Green in this model should be relatively easy.  Once the Spine and Leaf is established, legacy networks may be connected at a Leaf node to provide access utilizing the switch VTEP.  It's an extra hop, but the latency in this network type is extremely low.

Figure 4.  Spine and Leaf (high level)
Combining Figure 3 and Figure 4 is terribly problematic.  It may not even be useful at large scale due to the enormous details necessary to show it in its entirety.  

What networkers can do is abstract the drawing a bit.  Pull it up from the physical layer.  The view in Figure 5 is just such a drawing.

Utilizing Figure 4 as the groundwork (the physical) and "pulling up" the abstractions and overlays that reside on it.  

In this scenario, the spine and each leaf are BGP Autonomous Systems.  The first layer above the physical equipment is an IP network routed solely within the confines of the spine and leaf (Blue routers).  Additionally, a VRF is run on the same structure to propagate a management network (Red routers) to all switches.  It also acts as the distribution layer for any management switches deployed within the Leaf cabinets.

The VNI framework is then "pulled up" to the final level.  This is the tunnel path.  

Below the physical switch VTEP, an OVSDB (OpenVSwitch DataBase) is used to manage the interactions of all platform systems that are virtualized with, in this case, VMware NSX.

At and above the physical switch are the VTEP, managed by another OVSDB for all physical element connections not associated with VMware NSX.  The control plane in this model is Arista CVX.

As in Diagram 3, the OVSDB (VMware) communicates with the OVSDB (Arista) to manage the entirety of the tunnel formation.

Figure 5.  An high level view of the network from physical to overlay
In light of creating a view of the network that expresses as much as possible with the least amount of complexity, this drawing has proven to be quite good at showing as much as possible without making it impossible to follow.

If you use this model to describe your network, please do let me know how it turned out.

I'm interested in any other way you may have to show this type of information graphically.  Please tweet them to @abusedbits or link them to my Google+.