CN104579805A

CN104579805A - A novel network traffic identifying method

Info

Publication number: CN104579805A
Application number: CN201310472720.3A
Authority: CN
Inventors: 陈传兵
Original assignee: Zhengzhou Glacier Network Technology Co Ltd
Current assignee: Zhengzhou Glacier Network Technology Co Ltd
Priority date: 2013-10-12
Filing date: 2013-10-12
Publication date: 2015-04-29

Abstract

The present invention is adapted to the technical field of networks, and provides a method for identifying and QOS a data stream in the network. The specific technical solution is: defining three elements, i.e., a protocol (tcp/udp), a source IP address, and a source port, as one session, adding a specific hash algorithm, and establishing a link for the session in an internal storage; and after identifying a certain message therein, tabbing the entire session, and subsequent messages matching with the tab. Such solution is adapted to a situation of multiple P2P links. When a conventional DPI is at P2P, the same P2P source port may be connected to a plurality of target IP addresses and ports at the same time. A conventional approach is to identify the protocol (tcp/udp), the source IP address, the source port, the target IP address, the target port as an link, while in the present invention, as long as the source IP, the source port, a basic protocol are the same, they are identified as one session, which greatly reduces items of the linking number and the problem of repeated identifications of the application protocol.

Description

A kind of new network flow identification method

Technical field

The present invention is suitable for network technology and the communications field, provide a kind of data flow in network is identified fast and QOS mark method.

Background technology

At present, known flow protocol recognition technology mainly DPI (DeepPacketInspection, deep-packet detection) and DFI (Deep/DynamicFlow Inspection, the degree of depth/dynamic flow detects) these two kinds of technology, DPI is by mating the keyword in the keyword in message and system protocol storehouse thus identify application protocol, agreement in general employing IP agreement, ip address, source, source port, object ip address, this 5 element of destination interface is as a session, when in session stream, any one up-downgoing message regards as application-specific agreement, then can assert that whole session is for this agreement, the session define method of 5 elements can cause linking number entry huge, agreement repeats the problem of the inefficiencies such as identification.

Summary of the invention

In order to overcome the inefficient deficiency of DPI, the invention provides and usually define a session by agreement, source IP address, source port ternary, can to solve in DPI session entry too much, agreement repeats the problems such as identification, reaches the object of Traffic identification and optimization.

Concrete technical scheme is: basic condition element being defined as a session, add certain hash algorithm, for this session sets up a connection in internal memory, when after identification wherein certain message, a mark is stamped to whole session, follow-up message mates this and marks, this kind of scheme is applicable to P2P when connecting more, traditional DPI is when P2P, same P2P source port may connect a lot of object IP addresses simultaneously, traditional way is that each different five elements combination is identified as a connection, as long as the present invention is then source IP, source port, basic agreement element, then be identified as a session, greatly reduce linking number and the problem repeating to identify.

The invention has the beneficial effects as follows: due to the minimizing of linking number, cause inquiry, distribute uniform velocity and significantly promote, the DPI that efficiency is more traditional has obvious lifting, and avoids the protocol identification of repetition.

Accompanying drawing explanation

Accompanying drawing 1 is the linking number curve chart under the traditional DPI pattern recognition of employing

Accompanying drawing 2 is the linking number curve chart under the pattern recognition of employing element, and under element pattern, linking number decreases about 2/3, and under this kind of pattern, efficiency significantly promotes.

Embodiment

Embodiment is by this algorithm of programming realization on flow-control equipment, generally realizes at kernel state, to obtain higher efficiency.

Claims

1. one kind using agreement (tcp/udp), source IP address, source port element as the QOS method of a session, it is characterized in that: usually carry out HASH distribution by ternary, instead of traditional five elements, the method is applicable to ipv4/ipv6 network.

2. the QOS method in right 1, it is characterized in that: HASH algorithm preserves the record of session in internal memory, coordinate protocol identification time, identical source IP address and source port can be identified as identical SESSION within the close time period, though its object IP and destination interface inconsistent.

3. the QOS method in right 1, it is characterized in that, session has the time-to-live in internal memory, and pass through without movable message when exceeding this session of special time, then this session is by Automatic clearance.

4. the QOS method in right 1, is characterized in that, when showing IP address linking number entry, only showing source IP, agreement, source port, and not showing object IP address and destination interface.