Embodiment
For making the purpose, technical solutions and advantages of the present invention clearer, embodiment of the present invention is described further in detail below in conjunction with accompanying drawing.
The embodiment of the invention provides a kind of method of traffic statistics, and this method is successively carried out traffic statistics according to default statistics strategy according to standard from coarse to fine, can reduce cost of labor, realizes the meticulous statistics of flow under the situation that does not increase equipment cost.As shown in Figure 1, the concrete steps of present embodiment are as follows:
101: the level of dividing traffic statistics according to standard from coarse to fine.
According to the needs of different traffic statistics, the level of division is different again, specifically comprises:
First kind, carry out the level of traffic statistics according to the logical relation of interface itself and divide.As shown in Figure 2, the ground floor that carries out traffic statistics is physical interfaces such as Ethernet (Ethernet) interface, GigaEthernet (gigabit Ethernet) interface or atm interface, is called main interface; Sub-interface is created in the main interface support, and this sub-interface is as the second layer; At atm interface, after creating atm sub-interface, also be supported in and create PVC on the atm sub-interface, this PVC is the 3rd layer.
Second kind, carry out the level of traffic statistics according to the statistics classification and divide.As shown in Figure 3, ground floor is still physical interfaces such as Ethernet interface, GigaEthernet interface or atm interface, is called main interface; Can dispose VLAN Trunk (trunk) on the main interface is the second layer, and the expression main interface can be by a plurality of vlan traffics, according to the VLAN under VLAN Tag (label) the identification message; The 3rd layer is the QinQ flow, is used to discern the user who sends message, and this QinQ has two-layer VLAN Tag, and outer VLAN tag is represented the subnet at place usually, and inner VLAN tag is represented concrete user.
The third carries out the level of traffic statistics and divides according to type of service.Ground floor is still physical interfaces such as Ethernet interface, GigaEthernet interface or atm interface, is called main interface; When carrying out flow monitoring at IPTV content supplier, the second layer can be the traffic statistics of distinguishing particular content provider, promptly carries out traffic statistics by content supplier; The actual total bandwidth that takies when certain content supplier is during greater than the bandwidth of renting to operator, need count on content supplier which channel is provided, whether the flow size of channel number or some channel exceeds hiring agreement, and promptly distinguish the traffic statistics of concrete channel according to the 3rd layer this moment.
Several division methods of the level of traffic statistics have below simply been introduced, in the practical application, be not limited to above-mentioned three kinds of division methods, and each division methods is not limited to concrete two levels or three levels, but can carries out more multi-layered time division as required.The level of traffic statistics is many more, helps more objects of statistics is carried out refinement, thereby helps the traffic statistics that become more meticulous more.
102: each layer is provided with concrete traffic statistics strategy.
At the atm interface in the atm network, the level of traffic statistics can be divided into main interface as first level, sub-interface as second level, PVC as the 3rd level.At different levels the traffic statistics strategy is set:
The first, carry out traffic statistics according to the size of flow.The strategy that begins and stop at the traffic statistics of the flow set sub-interface of main interface, the strategy that this laminar flow amount statistics beginning of PVC is set and stops at sub-interface.For example, the threshold value that main interface is set is that 10 megabits (can be 5 megabits in the practical application, 7 megabits or other numerical value), when the flow of main interface surpasses 10 megabits, begin sub-interface is carried out traffic statistics, surpass certain hour, for example 10 seconds (in the practical application when the flow of main interface is lower than 10 megabits, can be 5 seconds, 7 seconds or other numerical value) time, stop sub-interface being carried out traffic statistics; At each sub-interface the traffic statistics strategy of PVC is set, for example, 10 sub-interfaces is arranged under the main interface, the threshold value of each sub-interface is 1 megabit.When the flow of one of them sub-interface surpasses 1 megabit, begin the PVC under this interface is carried out traffic statistics; Surpass certain hour when the flow of this sub-interface is lower than 1 megabit, when for example 6 seconds (in the practical application, can be 5 seconds, 7 seconds or other numerical value), stop the PVC this interface is under carried out traffic statistics, and discharge the statistics resource, need in order to follow-up statistics.In addition, also can when sub-interface is begun to carry out traffic statistics, stop main interface being carried out traffic statistics, send the statistics of record, discharge the statistics resource; In like manner, also can when PVC is begun to carry out traffic statistics, stop sub-interface being carried out traffic statistics, send the statistics of record, discharge the statistics resource.That is to say when the following one deck when anterior layer is begun to carry out traffic statistics, stop to send the statistics of record, discharge the statistics resource, to make full use of the statistics resource to carrying out traffic statistics when anterior layer.
The second, carry out traffic statistics according to Preset Time.At main interface timer is set, when timer expiry, begins sub-interface is carried out traffic statistics, after sub-interface is carried out traffic statistics reaching certain hour, stop timer, promptly stop sub-interface being carried out traffic statistics.At each sub-interface timer is set, when the timer expiry of some sub-interfaces, begin the PVC under this sub-interface is carried out traffic statistics, after this sub-interface carried out traffic statistics reaching certain hour, stop timer, promptly stop the PVC under this sub-interface is carried out traffic statistics,, cause system's instability in order to avoid cause frequent shake.
Concrete, at main interface a timer is set, when this timer expiry (for example length of timer is 5 seconds or other numerical value), begin sub-interface is carried out traffic statistics.When sub-interface being carried out traffic statistics reach 5 seconds, stop sub-interface being carried out traffic statistics.Correspondingly, be provided with at each sub-interface a timer is set respectively, when the timer expiry (for example, length of timer is 6 seconds or other numerical value) of some sub-interfaces, begin the PVC under this sub-interface is carried out traffic statistics; Reached certain hour for example 6 seconds when the PVC under this sub-interface being carried out traffic statistics, stop the PVC under this interface is carried out traffic statistics.Starting at a little of the timer of each sub-interface can be staggered as required, in order to avoid cause the resource anxiety.In addition, for length of timer irregular duration is set as required.In addition, also can when sub-interface is begun to carry out traffic statistics, stop main interface being carried out traffic statistics, send the statistics of record, discharge the statistics resource; In like manner, also can when PVC is begun to carry out traffic statistics, stop sub-interface being carried out traffic statistics, send the statistics of record, discharge the statistics resource.That is to say when the following one deck when anterior layer is begun to carry out traffic statistics, stop to send the statistics of record, discharge the statistics resource, to make full use of the statistics resource to carrying out traffic statistics when anterior layer.
More than be two kinds of traffic statistics strategies that carry out traffic statistics, in the practical application, be not limited to above-mentioned two kinds of strategies.
103: carry out traffic statistics to working as anterior layer, and record is when the traffic statistics data of anterior layer.
104:, then begin the following one deck when anterior layer is carried out traffic statistics, and the traffic statistics data of following one deck of anterior layer worked as in record when satisfying when the traffic statistics of following one deck of anterior layer begin strategy.
As optional step, system can stop the following one deck when anterior layer is carried out traffic statistics, to make full use of the statistics resource when beginning that the following one deck when anterior layer carried out traffic statistics.
105: satisfy when the traffic statistics of following one deck of anterior layer stop strategy, then stop the following one deck when anterior layer is carried out traffic statistics, and record is when the traffic statistics data of following one deck of anterior layer, and with the record the traffic statistics data send to device log or Network Management Equipment, discharge the statistics resource, need in order to follow-up traffic statistics.
Carry out traffic statistics at the level division of first kind of traffic statistics in the step 101 and be example, concrete, user's open system, system carries out traffic statistics to main interface under default situations, writes down the data on flows of this main interface.
When the main interface flow satisfies in the step 102 traffic statistics to sub-interface and begins strategy, sub-interface is carried out traffic statistics, write down the data on flows of this sub-interface.As optional step, system can stop main interface being carried out traffic statistics, to make full use of the statistics resource when beginning that sub-interface carried out traffic statistics.
When the flow of main interface satisfies in the step 102 traffic statistics to sub-interface and stops strategy, stop sub-interface being carried out traffic statistics, the data on flows of statistics is charged to device log or be sent to the Network Management Equipment preservation, discharge the statistics resource, need in order to follow-up traffic statistics.
In like manner, the group interface flow satisfies in the step 102 traffic statistics to PVC when beginning strategy, and the PVC of this sub-interface is carried out traffic statistics, writes down the data on flows of this PVC; When the flow of sub-interface satisfies in the step 102 traffic statistics to PVC and stops strategy, stop the flow of the PVC of this sub-interface is added up, the data on flows of statistics is charged to device log or be sent to the Network Management Equipment preservation, discharge the statistics resource, need in order to follow-up traffic statistics.
The embodiment of the invention is to divide at the level of first kind of traffic statistics in the step 101 that to carry out traffic statistics be example, and the basic principle of carrying out traffic statistics at the division of other traffic statistics level is similar, repeats no more.
Be to enable in the prior art by the network maintenance staff is manual, go to enable the control device lack of wisdomization of the traffic statistics of some object, the cost of labor height, if in order to obtain various abnormal flow data, then need to open the traffic statistics function of used object, omit in order to avoid statistics occurs, this makes equipment cost improve.The continuous development of network simultaneously makes traffic statistics no longer be confined to the physical interface of fixing, also no longer be confined to the concentrated messages classification, do statistics at a large amount of interfaces and statistics classification, need memory devices such as a large amount of internal memories or chip register, this also makes the cost of equipment significantly improve.The embodiment of the invention is divided the traffic statistics level according to standard from coarse to fine, at first to carrying out traffic statistics when anterior layer, when satisfying when next laminar flow amount statistics of anterior layer begins strategy, begins the following one deck when anterior layer is carried out traffic statistics; When satisfying when next laminar flow amount statistics of anterior layer stops strategy, stop that the following one deck when anterior layer is carried out traffic statistics and carry out traffic statistics, and discharge the statistics resource.Because the embodiment of the invention is successively to carry out traffic statistics as required, can reach the purpose that reduces the statistics resource.Simultaneously, the following one deck when anterior layer is carried out can discharging the statistics resource when traffic statistics are carried out in traffic statistics stopping, helping to utilize to greatest extent the statistics resource.In addition,, do not need manually to enable and go to enable, can reduce cost of labor owing to be that system carries out traffic statistics automatically.
To sum up, help on the basis that does not increase the existing equipment cost, to have realized to carry out traffic statistics as required automatically, guaranteed the balance between the meticulous statistics of equipment cost and flow better, reduced cost of labor by the described technical scheme of the embodiment of the invention.
The embodiment of the invention provides a kind of device of statistic of layering flow, its as shown in Figure 4, this device comprises:
First statistical module is used for the traffic statistics level divided in advance carried out traffic statistics when anterior layer;
First trigger module is used for triggering second statistical module when satisfying when the traffic statistics of following one deck of anterior layer begin strategy;
Described second statistical module is used under the triggering of first trigger module, and the following one deck when anterior layer is carried out traffic statistics.
Further, this device also comprises:
Second trigger module is used for triggering second statistical module and stopping the following one deck when anterior layer is carried out traffic statistics when satisfying when the traffic statistics of following one deck of anterior layer stop strategy, and discharges and add up resource.
Further, this device also comprises:
The 3rd trigger module is used for triggering sending module as a result when second statistical module stops that the following one deck when anterior layer carried out traffic statistics;
Sending module sends to information storing device with the traffic statistics data of second statistical module as a result.
Further, this device also comprises:
The 4th trigger module is used for when second statistical module carries out traffic statistics to the following one deck when anterior layer, triggers first statistical module and stops current laminar flow amount statistics.
Concrete, under the default situations, first statistical module is to carrying out traffic statistics when anterior layer.
Whether first trigger module determines to notify second statistical module to begin the following one deck when anterior layer is carried out traffic statistics according to predetermined strategy, for example first trigger module is collected the data on flows of first statistical module counts, if the data on flows of collecting surpasses default threshold value (for example 10 megabits), then notify second statistical module to begin the following one deck when anterior layer is carried out traffic statistics; Or first trigger module whether detect timer (for example duration is 30 seconds) overtime, if during super timer, then notify second statistical module to begin the following one deck of working as anterior layer is carried out traffic statistics.
Whether second trigger module determines to notify second statistical module to stop the following one deck when anterior layer is carried out traffic statistics according to predetermined strategy, for example, second trigger module is collected the data on flows of first statistical module counts, after if the data on flows of collecting is lower than default threshold value (for example 10 megabits) certain hour (for example 5 seconds), then notify second statistical module to stop the following one deck when anterior layer is carried out traffic statistics, and discharge the statistics resource; Or second trigger module whether detect timer (for example duration is 30 seconds) overtime, if during super timer, then notify second statistical module to stop the following one deck when anterior layer is carried out traffic statistics, and discharge and add up resource.
Whether the 3rd trigger module detects second statistical module stops the following one deck when anterior layer is carried out traffic statistics, stop carrying out traffic statistics if the 3rd trigger module detects second statistical module, then trigger sending module as a result the traffic statistics data of second statistical module are sent to information storing device when following one deck of anterior layer.
Whether the 4th trigger module detects second statistical module begins the following one deck when anterior layer is carried out traffic statistics, begin the following one deck when anterior layer is carried out traffic statistics if detect second statistical module, then notify first statistical module to stop current laminar flow amount statistics.
The described technical scheme of the embodiment of the invention is divided the traffic statistics level according to standard from coarse to fine, to the inferior traffic statistics strategy that is provided with respectively of flow statistics layer, successively carry out traffic statistics according to the traffic statistics strategy that is provided with, realized carrying out traffic statistics automatically according to demand, changed and relied on the method for manually carrying out traffic statistics in the prior art, reduce cost of labor, guaranteed the balance between the meticulous statistics of equipment cost and flow.
All or part of content in the technical scheme that above embodiment provides can realize that its software program is stored in the storage medium that can read by software programming, storage medium for example: the hard disk in the computer, CD or floppy disk.
The above only is preferred embodiment of the present invention, and is in order to restriction the present invention, within the spirit and principles in the present invention not all, any modification of being done, is equal to replacement, improvement etc., all should be included within protection scope of the present invention.