CN115277504B - Network traffic monitoring method, device and system - Google Patents
Network traffic monitoring method, device and system Download PDFInfo
- Publication number
- CN115277504B CN115277504B CN202210809695.2A CN202210809695A CN115277504B CN 115277504 B CN115277504 B CN 115277504B CN 202210809695 A CN202210809695 A CN 202210809695A CN 115277504 B CN115277504 B CN 115277504B
- Authority
- CN
- China
- Prior art keywords
- message
- network
- switch
- switches
- determining
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 238000012544 monitoring process Methods 0.000 title claims abstract description 38
- 230000005540 biological transmission Effects 0.000 claims abstract description 149
- 238000004458 analytical method Methods 0.000 claims abstract description 14
- 238000012806 monitoring device Methods 0.000 claims description 22
- 230000002159 abnormal effect Effects 0.000 claims description 21
- 238000004590 computer program Methods 0.000 claims description 10
- 238000003012 network analysis Methods 0.000 claims description 7
- HRULVFRXEOZUMJ-UHFFFAOYSA-K potassium;disodium;2-(4-chloro-2-methylphenoxy)propanoate;methyl-dioxido-oxo-$l^{5}-arsane Chemical compound [Na+].[Na+].[K+].C[As]([O-])([O-])=O.[O-]C(=O)C(C)OC1=CC=C(Cl)C=C1C HRULVFRXEOZUMJ-UHFFFAOYSA-K 0.000 claims 10
- 238000010586 diagram Methods 0.000 description 17
- 238000004891 communication Methods 0.000 description 8
- 238000012545 processing Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 7
- 238000005516 engineering process Methods 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000005856 abnormality Effects 0.000 description 3
- 238000004422 calculation algorithm Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 238000005538 encapsulation Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 238000013473 artificial intelligence Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 239000000835 fiber Substances 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 235000008694 Humulus lupulus Nutrition 0.000 description 1
- 230000000903 blocking effect Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network traffic monitoring method, device and system, and relates to the technical field of data centers. One embodiment of the method comprises the following steps: the method can acquire the information of a plurality of switches in the data center network and the copied message information of the switches; based on the messages copied by the switches and the time information related to the transmission of the messages, the network transmission link of the service flow to which the messages belong is determined, and the transmission condition of the network transmission link is analyzed, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be acquired is solved, and the efficiency of network flow control is improved.
Description
Technical Field
The present invention relates to the field of data centers, and in particular, to a method, an apparatus, and a system for monitoring network traffic.
Background
With the development of technologies such as big data, artificial intelligence, cloud computing and the like, the demands on computing power and storage performance of data centers on which the technologies depend are higher and higher, so that the capacity of the data center computing and storage equipment is continuously expanded, and the network scale of the data center is continuously expanded. The problem often encountered with the expansion of the network size of a data center is that the service processing speed is slow and the efficiency is reduced, which is generally caused by that one or a plurality of switches of a transmission link of the service flow in the network of the data center are congested, so that the transmission delay of the service flow is increased and even the condition of losing the service flow packet occurs.
Therefore, it is important to monitor the transmission path of the traffic flow, so as to find out the problem existing in the transmission path in time based on the monitoring result. However, there is no effective method for acquiring a transmission path of a traffic flow.
Disclosure of Invention
In view of the above, embodiments of the present invention provide a method, an apparatus, and a system for monitoring network traffic, which can obtain information of a plurality of switches and copied message information of the switches in a data center network; based on the messages copied by the switches and the time information related to the transmission of the messages, the network transmission link of the service flow to which the messages belong is determined, and the transmission condition of the network transmission link is analyzed, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be acquired is solved, and the efficiency of network flow control is improved.
To achieve the above object, according to an aspect of the embodiments of the present invention, there is provided a network traffic monitoring method, including: obtaining a message copied by a plurality of switches in a data center network and information of the switches corresponding to the message; determining time information related to the transmission of the message; based on the message copied by the plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
Optionally, the method for monitoring network traffic, determining a network transmission link of the service traffic to which the packet belongs, includes: for each acquired message, executing the following operations: analyzing the characteristic information of the message; searching a previously acquired message matched with the characteristic information of the message; and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the message acquired in advance, determining the series connection sequence of the switches in the network transmission link where the message is positioned.
Optionally, the method for monitoring network traffic, determining a network transmission link of the service traffic to which the packet belongs, includes: analyzing the stored characteristic information of a plurality of messages; searching a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switches corresponding to the target messages.
Optionally, the network traffic monitoring method, the obtaining a message replicated by a plurality of switches in a data center network includes: and acquiring messages corresponding to the service to be monitored, which are copied by a plurality of switches in the data center network.
Optionally, in the network traffic monitoring method, the switch is configured with a plurality of queues, each of the queues is configured with a plurality of DSCP values, and a reserved DSCP value exists in the plurality of DSCP values, so that a user allocates one reserved DSCP value for the service to be monitored; the obtaining the message corresponding to the service to be monitored, which is copied by a plurality of switches in the data center network, comprises the following steps: and obtaining the message with the reserved DSCP value, which is copied by a plurality of switches in the data center network.
Optionally, the network traffic monitoring method, the determining time information related to transmitting the packet includes: for each acquired message copied by the switch, executing the following operations: and reading an entry time stamp and an exit time stamp added for the message by the last switch included in the message copied by the switch.
Optionally, the network traffic monitoring method, the determining time information related to transmitting the packet includes: and recording the writing time of the message copied by the switch.
Optionally, the method for monitoring network traffic, determining a network transmission link of the service traffic to which the packet belongs, further includes: and determining the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp as the starting position of the network transmission link.
Optionally, the method for monitoring network traffic, analyzing the transmission condition of the network transmission link, includes: and determining a first time difference between an entering time stamp and an leaving time stamp added by the switch in the network transmission link, and determining that the switch with the time difference exceeding a preset first time difference threshold is an abnormal switch.
Optionally, the method for monitoring network traffic, analyzing the transmission condition of the network transmission link, includes: and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch of which the second time difference exceeds a preset second time difference threshold value as an abnormal switch.
Optionally, the method for monitoring network traffic, analyzing the transmission condition of the network transmission link, includes: determining information of one or more target switches connected with a target address of the service flow to which the message belongs; aiming at the situation that the information of the last switch in the network transmission link of the service flow to which the message belongs is inconsistent with the information of any target switch, determining that the network transmission link is abnormal in packet loss aiming at the service flow, and determining the switch with abnormal packet loss.
To achieve the above object, according to a second aspect of an embodiment of the present invention, there is provided a network traffic monitoring device, including: an acquisition unit, and a network analysis unit, wherein,
the acquisition unit is used for acquiring messages copied by a plurality of switches in the data center network and information of the switches corresponding to the messages;
the network analysis unit is used for determining time information related to the transmission of the message; based on the message copied by the plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
Optionally, the network traffic monitoring device includes: the determining the network transmission link of the service flow to which the message belongs comprises the following steps: for each acquired message, executing the following operations: analyzing the characteristic information of the message; searching a previously acquired message matched with the characteristic information of the message; and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the message acquired in advance, determining the series connection sequence of the switches in the network transmission link where the message is positioned.
Optionally, the network traffic monitoring device includes: the determining the network transmission link of the service flow to which the message belongs comprises the following steps: analyzing the stored characteristic information of a plurality of messages; searching a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switches corresponding to the target messages.
Optionally, the network traffic monitoring device includes: the obtaining the message copied by the switches in the data center network comprises the following steps: and acquiring messages corresponding to the service to be monitored, which are copied by a plurality of switches in the data center network.
Optionally, the network traffic monitoring device includes: the switch is configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values so that a user distributes one reserved DSCP value for the service to be monitored; the obtaining the message corresponding to the service to be monitored, which is copied by a plurality of switches in the data center network, comprises the following steps: and obtaining the message with the reserved DSCP value, which is copied by a plurality of switches in the data center network.
Optionally, the network traffic monitoring device includes: the determining time information related to the transmission of the message comprises: for each acquired message copied by the switch, executing the following operations: and reading an entry time stamp and an exit time stamp added for the message by the last switch included in the message copied by the switch.
Optionally, the network traffic monitoring device includes: the determining time information related to the transmission of the message comprises: and recording the writing time of the message copied by the switch.
Optionally, the network traffic monitoring device includes: the determining the network transmission link of the service flow to which the message belongs further comprises: and determining the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp as the starting position of the network transmission link.
Optionally, the network traffic monitoring device includes: the analyzing the transmission condition of the network transmission link includes: and determining a first time difference between an entering time stamp and an leaving time stamp added by the switch in the network transmission link, and determining that the switch with the time difference exceeding a preset first time difference threshold is an abnormal switch.
Optionally, the network traffic monitoring device includes: the analyzing the transmission condition of the network transmission link includes: and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch of which the second time difference exceeds a preset second time difference threshold value as an abnormal switch.
Optionally, the network traffic monitoring device includes: the analyzing the transmission condition of the network transmission link includes: determining information of one or more target switches connected with a target address of the service flow to which the message belongs; aiming at the situation that the information of the last switch in the network transmission link of the service flow to which the message belongs is inconsistent with the information of any target switch, determining that the network transmission link is abnormal in packet loss aiming at the service flow, and determining the switch with abnormal packet loss.
To achieve the above object, according to a third aspect of the embodiments of the present invention, there is provided a network traffic monitoring system, including: a plurality of switches in a data center network and a network traffic monitoring device according to the third aspect.
The switch copies the received message, and adds an entry time stamp and an exit time stamp to the message when the message is sent to the next switch, namely, the message comprises the entry time stamp and the exit time stamp added to the message by the prior switch or switches; the switch is also configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values so that a user distributes one reserved DSCP value for the service to be monitored; and copying the message with the reserved DSCP value through a plurality of switches.
In order to achieve the above object, according to a fourth aspect of an embodiment of the present invention, there is provided an electronic apparatus for controlling an unmanned vehicle, comprising: one or more processors; and a storage means for storing one or more programs that, when executed by the one or more processors, cause the one or more processors to implement the method of any of the methods of controlling an unmanned vehicle described above.
To achieve the above object, according to a fifth aspect of the embodiments of the present invention, there is provided a computer-readable medium having stored thereon a computer program, characterized in that the program, when executed by a processor, implements a method as described in any one of the above methods of controlling an unmanned vehicle.
One embodiment of the above invention has the following advantages or benefits: the method and the device can acquire the messages copied by the plurality of switches, the information of the switches corresponding to the messages and the time information related to the transmitted messages so as to determine the network transmission links of the service flow to which the messages belong and analyze the transmission conditions of the network transmission links, thereby enabling a user to manage the network transmission links based on the analysis results, solving the problem that the network transmission links of the service flow cannot be acquired, and improving the efficiency and the automation degree of the network flow control.
Further effects of the above-described non-conventional alternatives are described below in connection with the embodiments.
Drawings
The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:
FIG. 1 is a schematic diagram of the main flow of a network traffic monitoring method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a prior art data center network;
FIG. 3 is a schematic diagram of a data center network according to an embodiment of the present invention;
fig. 4 is a schematic diagram of the structure of DSCP queues comprised by a switch according to an embodiment of the present invention;
Fig. 5 is a schematic structural diagram of a network traffic monitoring device according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of a network traffic monitoring system according to an embodiment of the present invention;
FIG. 7 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;
fig. 8 is a schematic diagram of a computer system suitable for use in implementing an embodiment of the invention.
Detailed Description
Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding, and are to be considered merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.
With the development of internet technology, data centers used for internet applications are rapidly increasing in scale and number. Meanwhile, the development of fifth generation communication technology, big data, artificial intelligence, cloud computing and other technologies provides support for digital economy, and the increasing data traffic puts more demands on data centers. The data center network needs to be capable of providing stable and efficient transmission for network applications in various different scenes, and ensuring normal operation of the service. On the one hand, the traffic borne by the internet is continuously increased and diversified, the requirement on network bandwidth is higher and higher, and the performance of network equipment in a data center, such as switch port rates from 10G, 25G, 100G and 400G, is rapidly increased in continuous iteration; on the other hand, the diversification of service scenes and the increase of application scale have higher and higher requirements on the computing power and the storage performance of the data center, the computing and storage equipment of the data center are continuously expanded, and the network scale is also continuously expanded. How to ensure the stable operation of the high-bandwidth large-scale network, and higher requirements are put forward on the design, operation and maintenance as well as monitoring of the data center network. Fig. 2 illustrates a topology of an architecture commonly used by existing data center networks, as shown in fig. 2, where multiple redundant links are accessed between switches to provide load balancing of traffic. The network shown in fig. 2 is an ECMP (Equal Cost Multi-path), meaning that there are multiple paths with the same overhead that can reach the same destination address. The switch in the data center supports the function, and a route exists in the equipment, namely, the same destination IP network segment corresponds to a plurality of next hops, namely, outlets, and a message sent to the destination IP network segment can be subjected to load sharing through a plurality of paths, and when some paths fail, other paths can automatically replace the paths to complete flow forwarding. However, the conventional method has the following problems: there are multiple load balancing links from one physical server to another, and which link a corresponding traffic (e.g., message information) will travel is determined by the ECMP's flow-based hash operation; the switch computes the egress link by selecting some fields in the message as input to the hash algorithm, including the five-tuple of the message (destination IP address, source IP address, IP protocol number, destination port number, source port number), the destination MAC address of the message, the source MAC address, and one or more fields in the VLAN ID. The same traffic (with the same values for some of the above fields) would be shared on the same link. However, the load balancing hash algorithm has higher complexity, the fact that a certain service flow can be distributed to which link cannot be determined through a simulation algorithm, and the switch equipment does not provide an external interface to obtain the service flow.
In the operation and maintenance of a data center network, a problem often encountered is that a certain service processing speed is slow, and efficiency is reduced, which is probably caused by the increase of transmission delay of a service flow network. In a data center network, the transmission time of a message on a physical link is basically fixed, so that the problem that the forwarding delay of equipment is increased due to congestion of a certain switch exists, and the traffic transmission time length is further increased. The switch generally adopts a store-and-forward mode, and firstly, a message is assigned with a plurality of DSCP values according to DSCP (Differentiated Services Code Point, differential service code point) values, different service divisions are cached in different queues of a port for the service division, and then, the queue scheduling is carried out for forwarding. The DSCP value range is 0-63, each port of the switch has 8 queues, the mapping relation can be freely configured, when burst traffic is encountered, more and more messages are cached in the queues, the forwarding delay is gradually increased, and when the depth of the queues exceeds the maximum storage which can be allocated by the queues, packet loss occurs. However, in this case, since the forwarding path of the traffic cannot be known, it cannot be determined which network device has congestion or which device has lost packets.
In view of this, fig. 1 is a network traffic monitoring according to an embodiment of the present invention, and as shown in fig. 1, the method includes the following steps:
step S101: and obtaining the messages copied by a plurality of switches in the data center network and the information of the switches corresponding to the messages.
Specifically, a message copied by a plurality of switches in a data center network and information of the switch corresponding to the message are obtained; taking the schematic structure of the data center network in the embodiment of the present invention shown in fig. 3 as an example, as shown in fig. 3, the data center network includes an origin server S1, a destination server S2, and switches a-F for sending messages; the message sent by the source server S1 is copied and sent by a plurality of switches, and finally reaches the target server S2; to complete the transmission of the message. Wherein, the switch is dynamically determined based on load balancing, for example, when a message is transmitted through switch a, switch C, and switch B, the message copied by switch a, switch C, and switch B and the information (identifiers of switch a, switch C, and switch B) of the switch corresponding to the message are obtained.
Preferably, a collector (i.e. a network traffic monitoring device according to the present invention) is used to obtain a message copied by a plurality of switches in a data center network and information of the switches corresponding to the message; specifically, each switch may include a traffic monitoring tool (e.g., ERSPAN, encapsulated Remote Switch Port Analyzer) based on a remote network, where each switch obtains a message transmitted by a plurality of switches in a data center network through the ERSPAN, copies the received message, encapsulates the message through GRE (Generic Routing Encapsulation), and sends the encapsulated message to a collector for analysis, where the collector may be a device with network connection and data processing capabilities, such as a server, cloud service, client, and the like.
Further, because the data flow in the data center network is larger, preferably, the message to be monitored is selectively determined, and the collector is utilized to acquire the message of the service to be monitored, so that the accuracy and efficiency of monitoring the message are improved, and the consumption of network resources is reduced; the method for determining the message of the service to be monitored by the collector can be determined by analyzing the content of the message, for example: for example, if the HTTP service provided by the IP address 1.1.1.1 port number 80 is a service to be monitored, the real-time situation of the traffic needs to be monitored, so that the message copied by the one or more switches associated with the IP address 1.1.1.1 port number 80 is determined as the message of the service to be monitored; that is, the obtaining the message copied by the plurality of switches in the data center network includes: and acquiring messages corresponding to the service to be monitored, which are copied by a plurality of switches in the data center network.
Further, the switch is configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values, so that a user allocates one reserved DSCP value for the service to be monitored; the obtaining the message corresponding to the service to be monitored, which is copied by a plurality of switches in the data center network, comprises the following steps: and obtaining the message with the reserved DSCP value, which is copied by a plurality of switches in the data center network. Specifically, the invention filters out the traffic of the traffic to be monitored by using the DSCP field as a matching item of ACL (Access Control List ), and then performs the operations of ERSPAN and adding a time stamp (Timestamp). Preferably, the switch can reserve 8 DSCP values for the messages of the service to be monitored, and map the values to 8 queues of the port respectively; fig. 4 shows 8 queues of DSCP set by a switch, and an example graph of a plurality of DSCP values contained in each of the 8 queues, including reserved DSCP values, i.e., each of the queues is configured with a plurality of DSCP values, one of the plurality of DSCP values being present; as shown in fig. 4, for example, the DSCP value range is 0-63, each port of the switch has 8 queues, each queue has a DSCP value range corresponding to the queue, for example: the range of DSCP values for queue 0 is 0-7; queue 1DSCP values range from 8-15, and so on; for example, if the DSCP value reserved by the switch for the service a to be monitored is 1, mapping the DSCP value into the queue 0; the DSCP value reserved for the traffic to be monitored cannot be used by other traffic, so it can be seen that by reserving 8 DSCPs for the monitored traffic to map to 8 queues of the switch, the forwarding path of traffic of the traffic to be monitored can be accurately tracked without affecting traffic forwarding.
Step S102: and determining time information related to the transmission of the message.
Specifically, a message copied from a plurality of switches in a data center network and information of the switch corresponding to the message are acquired, and time information related to the transmission of the message is analyzed and determined.
The time information related to transmitting the message may be a timestamp of a received message and a timestamp of a sent message of the switch, taking a schematic diagram of fig. 3 as an example, as shown in fig. 3, the switch a receives an original message sent by the source server S1, copies the original message and adds a timestamp, and may respectively add two timestamps of an entry timestamp and an exit timestamp, that is, a timestamp of the received message (i.e., an entry timestamp) and a timestamp of the sent message (i.e., an exit timestamp), where the format of the timestamp may be 48 bits, which is a time format of UTC standard time, where the first 18 bits represent seconds, and the last 30 bits represent nanoseconds, and it may be understood that a difference between the two timestamps of the entry timestamp and the exit timestamp represents a time when the message stays in the switch a, that is, a time when the switch a processes the message; further, switch A forwards the message to the next switch (any of switches C/D/E/F). Similarly, assuming that the switch C receives the message sent by the switch a, the same operation of adding the entry timestamp and the exit timestamp as the switch a is performed, and further, after receiving the message sent by the switch, the switch B sends the message to the destination server S2; preferably, the message with each switch added with a timestamp is sent to the collector through GRE encapsulation, the collector analyzes the timestamp of the message, since each switch through which the message passes adds two timestamps (i.e. an entering timestamp and an exiting timestamp), by determining that there are several pairs of timestamps, it can be determined that the switch through which the message is sent passes through several switches, and determining that the switch through which the message is sent is a- > C- > B according to the identifier (for example, unique identifier such as an IP address) of the switch included in the message, that is, determining time information related to transmitting the message includes: for each acquired message copied by the switch, executing the following operations: and reading an entry time stamp and an exit time stamp added for the message by the last switch included in the message copied by the switch.
Further, determining time information associated with transmitting the message includes: and recording the writing time of the message copied by the switch. Preferably, the collector may further record the writing time of the received message obtained by the record and copied by the switch, and further detect whether there is a delay in the time of processing the message by the switch in combination with the entry timestamp and the exit timestamp of the switch, which are included in the message and are added for the message.
Step S103: based on the message copied by the plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
Specifically, there are two methods for determining a network transmission link of a traffic flow to which a packet belongs based on a packet copied by a plurality of switches, information of the switch corresponding to the packet, and time information related to transmission of the packet:
the first method is as follows: the network transmission link for determining the service flow to which the message belongs comprises the following steps: for each acquired message, executing the following operations: analyzing the characteristic information of the message; searching a previously acquired message matched with the characteristic information of the message; and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the message acquired in advance, determining the series connection sequence of the switches in the network transmission link where the message is positioned.
Specifically, for each acquired message, characteristic information is resolved, where the characteristic information may be information in a message header or a message body included in a message transmitted on a switch, it may be understood that the same message forwarded by a plurality of switches includes the same characteristic information, so that a matched previously acquired message is searched for by the characteristic information, and in the case of being searched, information of a switch corresponding to the message is concatenated to information of a switch corresponding to the previously acquired message, so as to determine a concatenation order of switches in a network transmission link where the message is located; for example: taking the latest acquired message ABC as an example, analyzing the characteristic information obtained by the message ABC as 'aaa', searching whether the message containing the characteristic information as 'aaa' exists or not, and determining the switch information corresponding to the prior message under the condition of searching; storing the message to perform subsequent characteristic information matching operation under the condition of not finding; for example: the switch information corresponding to the message ABC which is acquired by the collector newly is a switch B; the switch information of the preceding message determined by the feature information matching is "switch C", and the time sequence is determined according to the time stamp carried by the message sent by the switch, for example, the serial connection sequence of the switches in the network transmission link where the message is located is determined to be "switch C" → "switch B", that is, the sequence of the switch B serial connected to the switch C is that the switch B serial connected to the switch C.
The second method is as follows: the network transmission link for determining the service flow to which the message belongs comprises the following steps: analyzing the stored characteristic information of a plurality of messages; searching a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switches corresponding to the target messages. Specifically, the collector acquires a plurality of stored messages, and finds a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; for example: by analyzing the characteristic information 'aaa', 3 target messages containing the characteristic information 'aaa' are found, time information (for example, any timestamp added by a switch for a message or time information of a received message) in the 3 target messages is further analyzed, the sequence of information of the switches corresponding to the plurality of target messages is determined according to the time sequence indicated by the time information, for example, the determined sequence of information of the switches corresponding to the 3 target messages is 'switch A' - 'switch C' - 'switch B', and the network transmission link of the service flow to which the target messages belong is determined to be 'switch A' - 'switch C' - 'switch B' based on the sequence.
Further, determining a network transmission link of the service flow to which the message belongs, and further includes: and determining the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp as the starting position of the network transmission link. Taking the schematic diagram of fig. 3 as an example, for example, after receiving an original message sent by the server S1, the switch a copies an original message and performs GRE encapsulation and then sends the original message to the collector, after receiving the encapsulated message, the collector performs parsing to determine that the message of the entry timestamp and the exit timestamp is not read from the original message, and determines that the switch a corresponding to the original message is the starting position of the network transmission link.
Further, the analysis of the transmission condition of the network transmission link may specifically include the following analysis method:
the first method is as follows: and determining a first time difference between an entering time stamp and an leaving time stamp added by the switch in the network transmission link, and determining that the switch with the time difference exceeding a preset first time difference threshold is an abnormal switch. Specifically, the first time difference between the entry time stamp and the exit time stamp added by the switch for transmitting the message is obtained, and it can be understood that the first time difference represents the time taken by the switch to process the message, and if the first time difference exceeds a preset first time difference threshold (for example, 500 ms, 3 s, 5 s, etc.), it is indicated that the switch has abnormal conditions such as abnormal hardware or blocked transmission message, that is, it is determined that the switch is an abnormal switch.
The second method is as follows: and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch of which the second time difference exceeds a preset second time difference threshold value as an abnormal switch. Specifically, the writing time corresponding to the message of each two adjacent switches is obtained, and the second time difference of the writing time of each two adjacent switches is determined, for example, in the schematic diagram shown in fig. 3, the network transmission link is "switch a" → "switch C" → "switch B", and if the second time difference of the writing time of the adjacent switch a and the writing time of the switch C exceeds a preset second time difference threshold (for example, 500 ms, 3 seconds, 5 seconds, etc.), it is indicated that the switch has abnormal conditions such as hardware abnormality or transmission message blocking, etc., that is, it is determined that the switch is an abnormal switch.
The third method is as follows: determining information of one or more target switches connected with a target address of the service flow to which the message belongs; aiming at the situation that the information of the last switch in the network transmission link of the service flow to which the message belongs is inconsistent with the information of any target switch, determining that the network transmission link is abnormal in packet loss aiming at the service flow, and determining the switch with abnormal packet loss. Specifically, according to the destination address (e.g., IP address, MAC address, etc.) of the traffic flow, determining information of one or more destination switches connected to the destination address, where the information method of the one or more destination switches connected to the determined destination address may be obtained by parsing a packet corresponding to the traffic flow, for example, the parsed plurality of destination switches are switch a, switch C, and switch B, respectively; still taking fig. 3 as an example, in the schematic diagram shown in fig. 3, assuming that a network transmission link of a service flow to which a packet belongs is "switch a" → "switch C" → "switch B", information of a last switch in the network transmission link, for example, information of the last switch is "switch B", message information corresponding to the switch B is analyzed, if it is determined that the message information of the switch B is inconsistent with any one of other target switches (switch a or switch C), it is determined that a packet loss abnormality occurs for the service flow, and a switch in which the packet loss abnormality occurs can be determined according to the inconsistent information.
Further preferably, the collector (i.e. the network traffic monitoring device) may utilize the visualized data presentation to analyze the results of the network traffic monitored data, as well as the data in case of anomalies.
As shown in fig. 5, a network traffic monitoring device 500 according to an embodiment of the present invention includes: an acquisition unit 501, and a network analysis unit 502, wherein,
the acquiring unit 501 is configured to acquire a packet copied by a plurality of switches in a data center network and information of a switch corresponding to the packet;
the network analysis unit 502 is configured to determine time information related to the transmission of the packet; based on the message copied by the plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
As shown in fig. 6, a network traffic monitoring system 600 provided in an embodiment of the present invention includes: a plurality of switches 601 in a data center network and network traffic monitoring device 500. The switch 601 copies the received message, and adds an entry timestamp and an exit timestamp to the message when sending the message to the next switch, that is, the message includes the entry timestamp and the exit timestamp added to the message by the previous switch or switches; the switch 601 is further configured with a plurality of queues, each of the queues is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values, so that a user allocates one reserved DSCP value to the service to be monitored; and copying the message with the reserved DSCP value through a plurality of switches.
The embodiment of the invention also provides a network flow monitoring electronic device, which comprises: one or more processors; and a storage device for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the method provided by any of the embodiments described above.
The embodiment of the invention also provides a computer readable medium, on which a computer program is stored, which when executed by a processor implements the method provided by any of the above embodiments.
Fig. 7 illustrates an exemplary system architecture 700 in which the network traffic monitoring method or network traffic monitoring device of embodiments of the present invention may be applied.
As shown in fig. 7, a system architecture 700 may include terminal devices 701, 702, 703, a network 704, and a server 705 (this architecture is merely an example, and the components contained in a particular architecture may be tailored to the application specific case). The network 704 is the medium used to provide communication links between the terminal devices 701, 702, 703 and the server 705. The network 704 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.
A user may interact with the server 705 via the network 704 using the terminal devices 701, 702, 703 to receive or send messages or the like. Various communication client applications, such as shopping class applications, web browser applications, search class applications, instant messaging tools, mailbox clients, social platform software, etc., may be installed on the terminal devices 701, 702, 703.
The terminal devices 701, 702, 703 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop computers, switches, desktop computers, and the like.
The server 705 may be a server providing various services, such as a background management server processing and analyzing messages sent by the terminal devices 701, 702, 703. The background management server can analyze and other data such as received messages and feed back the analyzed flow monitoring result to the terminal equipment.
It should be noted that, the method for monitoring network traffic provided in the embodiment of the present invention is generally executed by the server 705, and accordingly, the network traffic monitoring device is generally disposed in the server 705.
It should be understood that the number of terminal devices, networks and servers in fig. 7 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
Referring now to FIG. 8, there is illustrated a schematic diagram of a computer system 800 suitable for use in implementing an embodiment of the present invention. The terminal device shown in fig. 8 is only an example, and should not impose any limitation on the functions and the scope of use of the embodiment of the present invention.
As shown in fig. 8, the computer system 800 includes a Central Processing Unit (CPU) 801 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 802 or a program loaded from a storage section 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the system 800 are also stored. The CPU 801, ROM 802, and RAM 803 are connected to each other by a bus 804. An input/output (I/O) interface 805 is also connected to the bus 804.
The following components are connected to the I/O interface 805: an input portion 806 including a keyboard, mouse, etc.; an output portion 807 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 808 including a hard disk or the like; and a communication section 809 including a network interface card such as a LAN card, a modem, or the like. The communication section 809 performs communication processing via a network such as the internet. The drive 810 is also connected to the I/O interface 805 as needed. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 810 as needed so that a computer program read out therefrom is mounted into the storage section 808 as needed.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 809, and/or installed from the removable media 811. The above-described functions defined in the system of the present invention are performed when the computer program is executed by a Central Processing Unit (CPU) 801.
The computer readable medium shown in the present invention may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units (or "modules") involved in the embodiments of the present invention may be implemented in software or in hardware. The described unit (or "module") may also be provided in the processor, for example, it may be described as: a processor comprises an acquisition unit and a network analysis unit, wherein the names of these units do not in some cases constitute a limitation of the unit itself, e.g. the acquisition unit may also be described as "unit for acquiring messages replicated by a plurality of switches in a data center network and information of the switches corresponding to said messages".
As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be present alone without being fitted into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to include: obtaining a message copied by a plurality of switches in a data center network and information of the switches corresponding to the message; determining time information related to the transmission of the message; based on the message copied by the plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
According to the technical scheme of the embodiment of the invention, the message copied by a plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission message can be acquired to determine the network transmission link of the service flow to which the message belongs and analyze the transmission condition of the network transmission link, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be acquired is solved, and the efficiency and the automation degree of the network flow control are improved.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives can occur depending upon design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.
Claims (13)
1. A method for monitoring network traffic, applied to a network traffic monitoring device, comprising:
obtaining a message copied by a plurality of switches in a data center network and information of the switches corresponding to the message;
determining time information related to the transmission of the message;
based on the message copied by a plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result;
the obtaining the message copied by the switches in the data center network comprises the following steps:
acquiring messages corresponding to a service to be monitored, which are copied by a plurality of switches in a data center network;
The switch is configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values so that a user distributes one reserved DSCP value for the service to be monitored;
the obtaining the message corresponding to the service to be monitored, which is copied by a plurality of switches in the data center network, comprises the following steps:
and obtaining the message with the reserved DSCP value, which is copied by a plurality of switches in the data center network.
2. The method for monitoring network traffic according to claim 1, wherein the determining the network transmission link of the traffic to which the packet belongs comprises:
for each acquired message, executing the following operations:
analyzing the characteristic information of the message;
searching a previously acquired message matched with the characteristic information of the message;
and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the message acquired in advance, determining the series connection sequence of the switches in the network transmission link where the message is positioned.
3. The method for monitoring network traffic according to claim 1, wherein the determining the network transmission link of the traffic to which the packet belongs comprises:
Analyzing the stored characteristic information of a plurality of messages;
searching a plurality of target messages with the same characteristic information;
determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages;
and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switches corresponding to the target messages.
4. The method of claim 1, wherein determining time information associated with transmitting the message comprises:
for each acquired message copied by the switch, executing the following operations:
and reading an entry time stamp and an exit time stamp added for the message by the last switch included in the message copied by the switch.
5. The method of claim 1, wherein determining time information associated with transmitting the message comprises:
and recording the writing time of the message copied by the switch.
6. The method for monitoring network traffic according to claim 4, wherein determining the network transmission link of the traffic to which the packet belongs further comprises:
And determining the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp as the starting position of the network transmission link.
7. The method for monitoring network traffic according to claim 4, wherein the analyzing the transmission condition of the network transmission link includes:
and determining a first time difference between an entering time stamp and an leaving time stamp added by the switch in the network transmission link, and determining that the switch with the time difference exceeding a preset first time difference threshold is an abnormal switch.
8. The method for monitoring network traffic according to claim 5, wherein the analyzing the transmission condition of the network transmission link includes:
and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch of which the second time difference exceeds a preset second time difference threshold value as an abnormal switch.
9. The method for monitoring network traffic according to claim 1, wherein the analyzing the transmission condition of the network transmission link includes:
determining information of one or more target switches connected with a target address of the service flow to which the message belongs;
Aiming at the situation that the information of the last switch in the network transmission link of the service flow to which the message belongs is inconsistent with the information of any target switch, determining that the network transmission link is abnormal in packet loss aiming at the service flow, and determining the switch with abnormal packet loss.
10. A network traffic monitoring device, comprising: an acquisition unit, and a network analysis unit, wherein,
the acquisition unit is used for acquiring messages copied by a plurality of switches in the data center network and information of the switches corresponding to the messages;
the network analysis unit is used for determining time information related to the transmission of the message; based on the message copied by a plurality of switches, the information of the switch corresponding to the message and the time information related to the transmission of the message, determining a network transmission link of the service flow to which the message belongs, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result;
the obtaining the message copied by the switches in the data center network comprises the following steps:
acquiring messages corresponding to a service to be monitored, which are copied by a plurality of switches in a data center network;
The switch is configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values so that a user distributes one reserved DSCP value for the service to be monitored;
the obtaining the message corresponding to the service to be monitored, which is copied by a plurality of switches in the data center network, comprises the following steps:
and obtaining the message with the reserved DSCP value, which is copied by a plurality of switches in the data center network.
11. A network traffic monitoring system, comprising: a plurality of switches in a data center network and the network traffic monitoring device of claim 10.
12. A network traffic monitoring electronic device, comprising:
one or more processors;
storage means for storing one or more programs,
when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-9.
13. A computer readable medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the method according to any of claims 1-9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210809695.2A CN115277504B (en) | 2022-07-11 | 2022-07-11 | Network traffic monitoring method, device and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210809695.2A CN115277504B (en) | 2022-07-11 | 2022-07-11 | Network traffic monitoring method, device and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115277504A CN115277504A (en) | 2022-11-01 |
| CN115277504B true CN115277504B (en) | 2024-04-05 |
Family
ID=83764269
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210809695.2A Active CN115277504B (en) | 2022-07-11 | 2022-07-11 | Network traffic monitoring method, device and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115277504B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117544550A (en) * | 2024-01-10 | 2024-02-09 | 紫光恒越技术有限公司 | Method and device for monitoring network quality, storage medium and electronic equipment |
Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014141004A1 (en) * | 2013-03-15 | 2014-09-18 | International Business Machines Corporation | Load balancing for physical and virtual networks |
| CN106921588A (en) * | 2015-12-28 | 2017-07-04 | 华为技术有限公司 | A kind of flow control methods, device and equipment |
| CN107465527A (en) * | 2016-06-02 | 2017-12-12 | 中兴通讯股份有限公司 | A kind of network element, pretection switch method and its system |
| CN110120887A (en) * | 2019-04-25 | 2019-08-13 | 新华三技术有限公司合肥分公司 | A kind of network quality information monitoring method, electronic equipment and storage medium |
| US10630567B1 (en) * | 2018-02-05 | 2020-04-21 | Illuminate Technologies, Llc | Methods, systems and computer readable media for monitoring communications networks using cross-correlation of packet flows |
| WO2020135429A1 (en) * | 2018-12-29 | 2020-07-02 | 中兴通讯股份有限公司 | Traffic analysis method and apparatus, and traffic detection method and apparatus |
| CN111769998A (en) * | 2019-08-13 | 2020-10-13 | 北京京东尚科信息技术有限公司 | Method and device for detecting network delay state |
| EP3767882A1 (en) * | 2019-07-16 | 2021-01-20 | Profitap HQ B.V. | Network traffic monitoring device |
| CN112313910A (en) * | 2018-06-13 | 2021-02-02 | 华为技术有限公司 | Multi-path selection system and method for data center centric metropolitan area networks |
| CN112422357A (en) * | 2019-08-23 | 2021-02-26 | 华为技术有限公司 | Method and device for detecting state of network communication path |
| CN112511383A (en) * | 2020-11-26 | 2021-03-16 | 杭州迪普信息技术有限公司 | Network traffic monitoring method and device |
| CN112737889A (en) * | 2020-12-29 | 2021-04-30 | 迈普通信技术股份有限公司 | Flow processing method, flow monitoring method, device, system and storage medium |
| WO2021155637A1 (en) * | 2020-02-07 | 2021-08-12 | 阿里巴巴集团控股有限公司 | Information processing method, device, and system, and storage medium |
| CN113595809A (en) * | 2020-04-30 | 2021-11-02 | 华为技术有限公司 | Flow monitoring method, related equipment and system |
| CN113949669A (en) * | 2021-10-15 | 2022-01-18 | 湖南八零二三科技有限公司 | Vehicle-mounted network switching device and system capable of automatically configuring and analyzing according to flow |
| CN113973082A (en) * | 2020-07-06 | 2022-01-25 | 华为技术有限公司 | Message processing method and network equipment |
| WO2022067791A1 (en) * | 2020-09-30 | 2022-04-07 | 华为技术有限公司 | Data processing method, data transmission method, and related device |
| CN114629816A (en) * | 2022-03-14 | 2022-06-14 | 京东科技信息技术有限公司 | Method and system for detecting public network IP network state |
| CN114629823A (en) * | 2022-05-16 | 2022-06-14 | 鹏城实验室 | Server testing and monitoring method and device, terminal equipment and storage medium |
| CN114640679A (en) * | 2022-03-14 | 2022-06-17 | 京东科技信息技术有限公司 | Data packet transmission method and device, storage medium and electronic equipment |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9596192B2 (en) * | 2013-03-15 | 2017-03-14 | International Business Machines Corporation | Reliable link layer for control links between network controllers and switches |
| TWI664838B (en) * | 2017-12-14 | 2019-07-01 | 財團法人工業技術研究院 | Method and device for monitoring traffic in a network |
| US11057305B2 (en) * | 2018-10-27 | 2021-07-06 | Cisco Technology, Inc. | Congestion notification reporting for a responsive network |
-
2022
- 2022-07-11 CN CN202210809695.2A patent/CN115277504B/en active Active
Patent Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014141004A1 (en) * | 2013-03-15 | 2014-09-18 | International Business Machines Corporation | Load balancing for physical and virtual networks |
| CN106921588A (en) * | 2015-12-28 | 2017-07-04 | 华为技术有限公司 | A kind of flow control methods, device and equipment |
| CN107465527A (en) * | 2016-06-02 | 2017-12-12 | 中兴通讯股份有限公司 | A kind of network element, pretection switch method and its system |
| US10630567B1 (en) * | 2018-02-05 | 2020-04-21 | Illuminate Technologies, Llc | Methods, systems and computer readable media for monitoring communications networks using cross-correlation of packet flows |
| CN112313910A (en) * | 2018-06-13 | 2021-02-02 | 华为技术有限公司 | Multi-path selection system and method for data center centric metropolitan area networks |
| WO2020135429A1 (en) * | 2018-12-29 | 2020-07-02 | 中兴通讯股份有限公司 | Traffic analysis method and apparatus, and traffic detection method and apparatus |
| CN110120887A (en) * | 2019-04-25 | 2019-08-13 | 新华三技术有限公司合肥分公司 | A kind of network quality information monitoring method, electronic equipment and storage medium |
| EP3767882A1 (en) * | 2019-07-16 | 2021-01-20 | Profitap HQ B.V. | Network traffic monitoring device |
| CN111769998A (en) * | 2019-08-13 | 2020-10-13 | 北京京东尚科信息技术有限公司 | Method and device for detecting network delay state |
| CN112422357A (en) * | 2019-08-23 | 2021-02-26 | 华为技术有限公司 | Method and device for detecting state of network communication path |
| WO2021155637A1 (en) * | 2020-02-07 | 2021-08-12 | 阿里巴巴集团控股有限公司 | Information processing method, device, and system, and storage medium |
| CN113595809A (en) * | 2020-04-30 | 2021-11-02 | 华为技术有限公司 | Flow monitoring method, related equipment and system |
| CN113973082A (en) * | 2020-07-06 | 2022-01-25 | 华为技术有限公司 | Message processing method and network equipment |
| WO2022067791A1 (en) * | 2020-09-30 | 2022-04-07 | 华为技术有限公司 | Data processing method, data transmission method, and related device |
| CN112511383A (en) * | 2020-11-26 | 2021-03-16 | 杭州迪普信息技术有限公司 | Network traffic monitoring method and device |
| CN112737889A (en) * | 2020-12-29 | 2021-04-30 | 迈普通信技术股份有限公司 | Flow processing method, flow monitoring method, device, system and storage medium |
| CN113949669A (en) * | 2021-10-15 | 2022-01-18 | 湖南八零二三科技有限公司 | Vehicle-mounted network switching device and system capable of automatically configuring and analyzing according to flow |
| CN114629816A (en) * | 2022-03-14 | 2022-06-14 | 京东科技信息技术有限公司 | Method and system for detecting public network IP network state |
| CN114640679A (en) * | 2022-03-14 | 2022-06-17 | 京东科技信息技术有限公司 | Data packet transmission method and device, storage medium and electronic equipment |
| CN114629823A (en) * | 2022-05-16 | 2022-06-14 | 鹏城实验室 | Server testing and monitoring method and device, terminal equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115277504A (en) | 2022-11-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP4258598A1 (en) | Computing power application traffic forwarding method and apparatus | |
| US11463511B2 (en) | Model-based load balancing for network data plane | |
| CN112039796B (en) | Data packet transmission method and device, storage medium and electronic equipment | |
| CN111769998B (en) | Method and device for detecting network delay state | |
| US10284460B1 (en) | Network packet tracing | |
| CN112788060B (en) | Data packet transmission method and device, storage medium and electronic equipment | |
| CN109617810B (en) | Data transmission method and device | |
| JP2013090079A (en) | Access relay method and device | |
| CN114285781B (en) | SRV6 service flow statistics method, device, electronic equipment and medium | |
| CN112787913B (en) | Intelligent network card assembly, physical machine, cloud service system and message sending method | |
| US20230216775A1 (en) | Packet forwarding method, forwarding indication information advertising method, advertisement packet advertising method, and device | |
| CN115277504B (en) | Network traffic monitoring method, device and system | |
| US20150026333A1 (en) | Network system, network management apparatus and application management apparatus | |
| US20160248652A1 (en) | System and method for classifying and managing applications over compressed or encrypted traffic | |
| US11818051B2 (en) | Distributed node processing of network traffic | |
| CN116886496A (en) | DPU-based data processing method, device, equipment and readable storage medium | |
| CN110247847B (en) | Method and device for back source routing between nodes | |
| WO2022152230A1 (en) | Information flow identification method, network chip, and network device | |
| CN112242937B (en) | Network speed measuring method and device, electronic equipment and computer readable medium | |
| CN113079055B (en) | AGV operation data dynamic acquisition method and device | |
| EP3471351B1 (en) | Method and device for acquiring path information about data packet | |
| CN115250254B (en) | Netflow message distribution processing method and device | |
| CN113169936A (en) | Service chaining mechanism for data stream processing | |
| CN117041103A (en) | Communication method and router for named data network | |
| CN110389785B (en) | Big data processing system and method, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |