WO2018121397A1

WO2018121397A1 - Network traffic control method and switch device

Info

Publication number: WO2018121397A1
Application number: PCT/CN2017/117705
Authority: WO
Inventors: 周雍恺; 陈华俊; 袁航; 刘国宝; 严峻岭
Original assignee: 中国银联股份有限公司
Priority date: 2016-12-30
Filing date: 2017-12-21
Publication date: 2018-07-05
Also published as: CN106982179A

Abstract

Provided is a network traffic control method. The method comprises: mirroring a message transmitted in a network; performing routing encapsulation on mirrored traffic of the message; and exporting the mirrored traffic having undergone the route encapsulation from the locality. In addition, also provided is a switch device. The switch device comprises: a mirroring module, for mirroring a message transmitted in a network; an encapsulation module, for performing routing encapsulation on mirrored traffic of the message; and an export module, for exporting the mirrored traffic having undergone the routing encapsulation from the locality.

Description

Network flow control method and switch device

Technical field

The present invention generally relates to the field of network operation and maintenance technologies, and in particular, to a network traffic control scheme.

Background technique

With the popularity of the Internet, the monitoring of network traffic has become an important part of network operation and maintenance. In order not to affect the normal data transmission in the network and analyze the network traffic at the same time, the commonly used method is port mirroring of the switch, that is, completely copying the traffic actually transmitted in the switch link to a destination, and then managing by the network. At the destination, the analyst analyzes the mirror traffic to find out the cause of the network problem, including analyzing the data flow direction, throughput performance, troubleshooting, and security anomalies in the network.

However, the current port mirroring analysis involves routing the mirrored traffic to a remote location. The encapsulated mirrored traffic shares the same link resources as the normal traffic, which affects the traffic normally forwarded in the network.

Therefore, it is desirable to design a simple and low-cost network flow control scheme to mitigate or avoid interference of normal traffic with mirrored traffic for network analysis.

Summary of the invention

In view of this, the present invention provides a network flow control scheme that can improve the above problems.

In one aspect, the present invention provides a network traffic control method, including: mirroring a packet transmitted in a network; routing and encapsulating the mirrored traffic of the packet; and locally exporting the mirrored encapsulated mirrored traffic.

The method as described above, wherein locally routing the routed encapsulated mirrored traffic comprises reserving a port for the routed encapsulated mirrored traffic on the local device and deriving the routed encapsulated mirrored traffic from the reserved port.

The method as described above, wherein deriving the routed encapsulated mirrored traffic from the reserved port comprises statically binding an IP address to the reserved port, and using the IP address bound to the reserved port as the The destination address of the mirrored traffic that is encapsulated.

The method as described above, wherein the local device is a Layer 3 switch.

In the method described above, locally routing the routed encapsulated mirrored traffic includes locally transmitting the routed encapsulated mirrored traffic to the traffic aggregation device, wherein the traffic aggregation device is in communication with the network analysis device.

The method as described above, wherein the route encapsulation includes description information of the message.

The method as described above, wherein the route encapsulation comprises an index of descriptive information for the message.

The method as described above, wherein the route encapsulation adopts a form of encapsulating a remote port mirroring ERSPAN message, and using a session identification field in the ERSPAN packet as the index.

In another aspect, the present invention further provides a switch device, including: a mirroring module, configured to mirror a message transmitted in a network; and an encapsulating module, configured to perform routing and encapsulation on the mirrored traffic of the packet; The export module is used to locally export the mirrored encapsulated mirrored traffic.

DRAWINGS

The foregoing and other objects, features, and advantages of the invention will be apparent from

1 is a schematic flow chart of a network flow control method according to an example of the present invention.

2 is a schematic application scenario of a network traffic control method according to another example of the present invention.

3 is a schematic block diagram of a switch device in accordance with one example of the present invention.

detailed description

BRIEF DESCRIPTION OF THE DRAWINGS Exemplary embodiments of the present invention will now be described with reference to the drawings, wherein like reference numerals refer to the like. The examples described below are provided to enable those skilled in the art to understand the invention, and the examples are intended to be illustrative and not limiting. The illustrations of the various elements, components, modules, devices and device bodies in the figures are only illustrative of the existence of such elements, components, modules, devices, and device bodies, and also indicate the relative relationship between them, but are not intended to limit their specificity. Shape; the relationship of the steps in the flowchart is not limited to the order given, and can be adjusted according to the actual application without departing from the scope of protection of the present application.

1 is a schematic flow chart of a network flow control method according to an example of the present invention. The method shown in Figure 1 can be implemented, for example, in a switch device. As shown in FIG. 1, the message transmitted in the network is first mirrored in step 11. In some examples, this may, for example, employ a port mirroring process of the switch, ie, completely copying the traffic of the source port of the switch. The main purpose of generating a mirror is to enable the network administrator to analyze the packet mirror to find out the cause of the network problem. The message that generates the image can be specified, for example, by a network administrator, or automatically generated by a switch or a processing system communicatively coupled to the switch in accordance with pre-set conditions.

Next, in step 13, the generated mirrored traffic is route encapsulated so that the mirrored traffic can be routed to the remote network analysis device in the network. On the other hand, various descriptions related to the original message or indexes containing the description information may be included in the headers of these route encapsulations, which is especially useful for cloud network environments. A cloud network is a network that hosts cloud platform virtualization applications. Cloud network traffic is characterized by virtualization and dynamization. Virtualization refers to the existence of logical access traffic and actual physical traffic. Each physical port may carry traffic of multiple virtual hosts. Dynamicization means that virtual hosts can be dynamically migrated, so their network traffic is also migrated and is not fixed to a physical port. By including the description information of the mirrored message in the route encapsulation or including an index for the description information, the network administrator can analyze the network traffic situation more accurately and efficiently. Specifically, the description information of the packet may include, for example, one or more of message and user information, path information, virtual network group information, and the like.

In an example, the packet mirroring may be encapsulated in the form of an encapsulated remote port mirroring ERSPAN packet. In the case of adopting an ERSPAN packet, the session identifier field in the ERSPAN packet may be used as the index. For example, in the process of encapsulating the ERSPAN packet, the session identifier (in the session_id field) in the ERSPAN header is stored together with the description information of the packet as an association table. Therefore, after receiving the ERSPAN message, the network analysis device can extract the description information according to the session identifier thereof for the network administrator to use in the analysis process.

In conventional systems, these routed encapsulated mirrored traffic will be transmitted along with normal traffic in the network, potentially causing network congestion. In contrast, in the example of FIG. 1, step 15 includes locally routing the mirrored encapsulated mirrored traffic.

In some examples, the port may be reserved for routed encapsulated mirrored traffic on the local switch device and the routed encapsulated mirrored traffic may be derived from the reserved port. For example, the IP address can be statically bound to the reserved port, and the IP address bound to the reserved port is used as the destination address of the mirrored encapsulated traffic.

The local device can be, for example, a Layer 3 switch, so routing traffic can be routed. However, in the present invention, it is specified that all mirrored traffic that is to be routed to the remote network analysis device is all locally exported, thereby avoiding the impact of the mirrored traffic on the normal traffic in the switch link. Mirrored traffic only occupies the reserved interface bandwidth, and the excess can be directly discarded, so that it does not overflow or encroach on other link resources. At the same time, the routing encapsulation can be used to enable the mirroring traffic to carry the description information related to the packet, so that it has better flexibility and relevance than the general local traffic mirroring, which is especially applicable in the cloud network scenario.

2 is a schematic application scenario of a network traffic control method according to another example of the present invention. As shown in FIG. 1, the routed encapsulated mirrored traffic may be locally transmitted from the locally encapsulated mirrored traffic to a traffic aggregation device (such as a TAP device), which in turn is in communication with the network analysis device. The deepened portion in the switch shown in Figure 2 represents a reserved port. Mirror traffic from different switches can be aggregated through the TAP device and finally imported into the network analysis device for traffic analysis.

The network traffic control scheme provided by the present invention can improve the controllability of the impact on the mirrored traffic, especially the packets such as ERSPAN encapsulation. By utilizing the method of the present invention, the mirrored traffic of the route encapsulation will be restricted to the local exchange to avoid occupying the uplink bandwidth, and by preserving a fixed port channel for the mirrored traffic, the mirrored traffic can be limited to a controllable range. To prevent overflow, greatly increasing the stability of the network and related equipment. In addition, the method of the present invention can provide administrators with more traffic for the traffic while limiting the impact of the ERSPAN mode mirrored traffic on the network link while utilizing its flexibility and relevance to the local mirrored traffic. Analyze useful information and improve the efficiency of network traffic monitoring. As mentioned above, this is especially true in cloud network scenarios.

3 is a schematic block diagram of a switch device in accordance with one example of the present invention. As shown in FIG. 3, the switch device 300 includes a mirroring module 31, a packaging module 33, and an exporting module 35. Specifically, the mirroring module is configured to mirror the packets transmitted in the network; the encapsulating module 33 is configured to route the encapsulated traffic of the packet; and the exporting module 35 is configured to derive the routing encapsulation from the local Mirror traffic.

Descriptions of other configurations of general switch devices are omitted in this specification to avoid unnecessary redundancy. However, those skilled in the art will appreciate that the structure shown in Figure 3 can be integrated into any switch device that is or is being developed. The switch device shown in Figure 3 can be configured to implement any of the operations described above that are implemented at the switch device as provided by the present invention. Those skilled in the art can understand that the module division shown in FIG. 3 is only schematic, and these modules can be integrated or further divided according to a specific implementation, and implemented in any software or hardware form.

It should be noted that the above specific embodiments are merely illustrative of the technical solutions of the present invention and are not limited thereto. While the invention has been described in detail herein with reference to the preferred embodiments of the embodiments of the invention All are covered by the scope of the claimed invention.

Claims

A network flow control method includes:

Mirroring packets transmitted on the network;

Routing encapsulation of the mirrored traffic of the packet;

The mirrored encapsulated mirror traffic is exported locally.
The method of claim 1 wherein locally routing the routed encapsulated mirrored traffic comprises reserving a port for the routed encapsulated mirrored traffic on the local device and deriving the routed encapsulated mirrored traffic from the reserved port .
The method of claim 2, wherein deriving the routed encapsulated mirrored traffic from the reserved port comprises statically binding an IP address to the reserved port and an IP address bound to the reserved port As the destination address of the mirrored encapsulated mirrored traffic.
The method of claim 2 wherein said local device is a Layer 3 switch.
The method of claim 1 wherein locally routing the routed encapsulated mirrored traffic comprises locally routing the encapsulated encapsulated mirrored traffic to a traffic aggregation device, wherein the traffic aggregation device is in communication with the network analysis device.
The method of claim 1 wherein said routing encapsulation comprises descriptive information of said message.
The method of claim 1 wherein said routing encapsulation comprises an index of descriptive information for said message.
The method of claim 7, wherein the routing encapsulation takes the form of encapsulating a remote port mirroring ERSPAN message and using the session identification field in the ERSPAN message as the index.
A switch device includes:

The mirroring module is configured to mirror the packets transmitted on the network.

An encapsulating module, configured to perform routing and encapsulation on the mirrored traffic of the packet;

The export module is used to locally export the mirrored encapsulated mirrored traffic.
The switch device of claim 9, wherein locally routing the routed encapsulated mirrored traffic comprises reserving a port for the routed encapsulated mirrored traffic and deriving the routed encapsulated mirrored traffic from the reserved port.
The switch device of claim 10, wherein deriving the routed encapsulated mirrored traffic from the reserved port comprises statically binding an IP address to the reserved port and binding the IP with the reserved port The address is used as the destination address of the mirrored encapsulated traffic.
The switch device of claim 9, wherein locally routing the routed encapsulated mirrored traffic comprises transmitting the routed encapsulated mirrored traffic to a traffic aggregation device, wherein the traffic aggregation device is in communication with the network analysis device.
The switch device of claim 9, wherein the routing encapsulation comprises descriptive information of the message.
The switch device of claim 9, wherein the routing encapsulation comprises an index to descriptive information of the message.
The switch device of claim 14, wherein the route encapsulation takes the form of encapsulating a remote port mirroring ERSPAN message and using the session identification field in the ERSPAN message as the index.
The switch device of claim 9, wherein the switch device is a Layer 3 switch.