CN105763391A - Conversation data flow processing system and method, and related equipment - Google Patents
Conversation data flow processing system and method, and related equipment Download PDFInfo
- Publication number
- CN105763391A CN105763391A CN201410785508.7A CN201410785508A CN105763391A CN 105763391 A CN105763391 A CN 105763391A CN 201410785508 A CN201410785508 A CN 201410785508A CN 105763391 A CN105763391 A CN 105763391A
- Authority
- CN
- China
- Prior art keywords
- data stream
- session
- routing device
- information
- dpi equipment
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a conversation data flow processing system and method, and related equipment, so as to achieve a purpose that the same DPI device detects the uplink and downlink flow of the same data flow under the condition that the load balance among physical links is not damaged. The system comprises at least one routing device and at least one DPI device, wherein the first DPI device is used for transmitting a conversation information request to the first routing device, which is used for processing the first data flow of conversation, for the conversation with the data loss being detected, wherein the conversation information request comprises a conversation identification. The first DPI device is also used for completing the complete data flow processing of conversation according to the response of the first routing device. The first routing device is used for judging whether the first routing device processes the second data flow with the conversation loss. The first routing device is also used for processing the link related information of the first physical link for processing the second data flow if the first routing device processes the second data flow with the conversation loss. If the first routing device does not process the second data flow with the conversation loss, the first routing device obtains the flow related information of the second data flow, and returns the obtained link related information or flow related information to the first DPI device.
Description
Technical field
The present invention relates to network communication technology field, particularly relate to a kind of session data stream processing system, method and relevant device.
Background technology
DPI (DeepPacketInspection, deep-packet detection) equipment is for carrying out identification and the monitoring of network traffics.
The identification of packet is based on data stream with record by DPI equipment, unique data stream that namely an IP five-tuple is determined.For identifying a data stream, the up-downgoing flow of this data stream is all necessary, because the key message of data stream is present in the middle of request and the response message of user and server interaction.Such as, DNS (DomainNameSystem, a domain name system) inquiry, upstream request comprises domain-name information, and downstream response comprises the IP address information that domain name is corresponding, and in order to identify and record this DNS query, up-downgoing flow is all necessary.Meanwhile, the DPI record to data stream, is also that up-downgoing is combined and obtains a record, and as user has initiated primary video viewing business, the flow of up-downgoing adds up the total flow being only current business.
At present, in the operator network, the router of each network node is that two-router is arranged, and adopts load balancing technology, in order that making flow more balanced between router；Sometimes two-router can be distributed in the middle of the different offices location in same city, it is also possible in the middle of different cities.And in the middle of load balancing technology, which bar physical link flow is assigned on is determined according to physical link loading condition by the upper level router oneself of two-router, there is randomness and uncertainty.It means that the up-downgoing flow of same data stream, in the middle of the network using load balancing technology, it is more likely that process is different router path.
This situation brings very big challenge to the content recognition of DPI equipment and traffic statistics.Because DPI equipment is disposed according to physical link, once up-downgoing flow does not walk same physical link, it is meant that DPI equipment can only get the flow of half in a data stream, affect the identification to data stream and statistics.
For solving this problem, existing common solution is that a plurality of physical link first accesses a load equalizer, by load equalizer by the up-downgoing assignment of traffic of same data stream to same physical link, then every physical link connects DPI equipment again, ensures that each DPI equipment can obtain the up-downgoing flow of a stream with this.
After adopting above-mentioned solution, introducing new problem: on the one hand, load equalizer destroys the load balancing original intention of router.Using load-balancing technique is to balance the flow between each bar physical link, and the up-downgoing of a data stream is adjusted on a physical link by load equalizer, destroys again this balance.On the other hand, the access of load equalizer limits the scope of adjustable physical link.Load equalizer is a physical equipment, can only access the physical link of limited quantity nearby, say, that it can only regulate the up-downgoing flow accessed between these physical links.If the router doing load balancing is different office location, or physical link number exceedes the access capability of load equalizer, then the up-downgoing flow between these physical links will be unable to allotment.
Summary of the invention
The embodiment of the present invention provides a kind of session data stream processing system, method and relevant device, in order to not destroy between link under the premise of load balancing, it is achieved by the up-downgoing flow of the same data stream of same DPI equipment Inspection.
The embodiment of the present invention provides a kind of session data stream processing system, including at least one routing device and at least one deep-packet detection DPI equipment, wherein:
Oneth DPI equipment, for for the session detecting that data stream lacks, sending Information Request to the first routing device processing described session the first data stream, carry the session identification of described session in described Information Request；And the link related information or flow relevant information according to described first routing device return completes the partial data stream to described session and processes；
First routing device, for according to described session identification, it is judged that self whether process the second data stream of described session disappearance；When judged result is for being, acquisition processes the link related information of the first physical link of described second data stream；When judged result is no, obtain the flow relevant information of described second data stream；And the link related information of the first physical link of the described second data stream obtained or the flow relevant information of described second data stream is returned to a described DPI.
The embodiment of the present invention provides the session data method for stream processing that a kind of routing device is implemented, including:
Routing device receives deep-packet detection DPI equipment the Information Request sent when session data stream lacks being detected, and carries the session identification of described session in described Information Request；
Described routing device is according to described session identification, it is judged that self whether process the data stream of described session disappearance；
If it is, acquisition processes the link related information of the physical link of missing data stream, otherwise, the flow relevant information of missing data stream is obtained；
Described routing device returns the link related information or flow relevant information that obtain to described DPI equipment, described DPI equipment complete the partial data stream to described session according to the link related information received or flow relevant information and process.
The embodiment of the present invention provides a kind of routing device, including:
Receive unit, for receiving deep-packet detection DPI equipment the Information Request sent when session data stream lacks being detected, described Information Request carries the session identification of described session；
Judging unit, for according to described session identification, it is judged that whether the routing device at self place processes the data stream of described session disappearance；
Acquiring unit, for when the judged result of described judging unit is for being, acquisition processes the link related information of the physical link of missing data stream；And when the judged result of described judging unit is no, obtain the flow relevant information of missing data stream；
Response unit, for returning the link related information or flow relevant information obtained to described DPI equipment, is completed the partial data stream to described session by described DPI equipment according to the link related information received or flow relevant information and processes.
The embodiment of the present invention provides the session data method for stream processing that a kind of DPI equipment is implemented, including:
For the session detecting that data stream lacks, send Information Request to the routing device processing described session the first data stream, described Information Request carries the session identification of described session；
Receive the link related information of physical link that described routing device returns, that process described session the second data stream or the flow relevant information of described second data stream；
Complete the partial data stream to described session according to the link related information received or flow relevant information to process.
The embodiment of the present invention provides a kind of DPI equipment, including:
Transmitting element, for the session detecting that data stream lacks, sends Information Request to the routing device processing described session the first data stream, carries the session identification of described session in described Information Request；
Receive unit, for receiving link related information or the flow relevant information that described routing device returns；
Processing unit, for completing the partial data stream to described session process according to the link related information received or flow relevant information.
The data flow processing system that the embodiment of the present invention provides, method and relevant device, DPI equipment is after the session that data stream lacks being detected, the second data stream that this session lacks is asked to the routing device processing the first data stream, routing device is after the requests have been received, process the link related information of the physical link of this session or the flow relevant information of the second data stream according to the session identification acquisition wherein carried and return to DPI equipment, make DPI equipment can obtain the relevant information of the second data stream accordingly, complete the process to session partial data stream, due in said process, without the allotment of its two data stream being processed to Same Physical link for same session, from without destroying load balancing between physical link.
Other features and advantages of the present invention will be set forth in the following description, and, partly become apparent from description, or understand by implementing the present invention.The purpose of the present invention and other advantages can be realized by structure specifically noted in the description write, claims and accompanying drawing and be obtained.
Accompanying drawing explanation
Accompanying drawing described herein is used for providing a further understanding of the present invention, constitutes the part of the present invention, and the schematic description and description of the present invention is used for explaining the present invention, is not intended that inappropriate limitation of the present invention.In the accompanying drawings:
Fig. 1 is in the embodiment of the present invention, the structural representation of session data stream processing system；
Fig. 2 is in the embodiment of the present invention, the enforcement schematic diagram of session data stream detection method；
Fig. 3 is in the embodiment of the present invention, the implementing procedure schematic diagram of the session data method for stream processing that routing device is implemented；
Fig. 4 is in the embodiment of the present invention, the implementing procedure schematic diagram of the session data method for stream processing that DPI equipment is implemented；
Fig. 5 is in the embodiment of the present invention, the structural representation of routing device；
Fig. 6 is in the embodiment of the present invention, the structural representation of DPI equipment.
Detailed description of the invention
In order to solve to use in the link of DPI equipment, causing the two data streams problem without Same Physical link of same session due to the load balancing of router, the embodiment of the present invention provides a kind of session data stream processing system, method and relevant device.
Below in conjunction with Figure of description, the preferred embodiments of the present invention are illustrated, it is to be understood that, preferred embodiment described herein is merely to illustrate and explains the present invention, it is not intended to limit the present invention, and when not conflicting, the embodiment in the present invention and the feature in embodiment can be mutually combined.
As it is shown in figure 1, the structural representation of the session data stream processing system provided for the embodiment of the present invention, including at least one routing device 11 and at least one DPI equipment 12.When user initiates two sessions, namely after two business, if the routing device in network opens load-balancing function, it would be possible to cause the load balancing of two kinds of situations:
Situation one, office location 1 routing device B and routing device A between multilink carry out load balancing, in this case, downlink traffic is walked that link routing device B again and is determined, such as the path (adopting two solid lines to represent uplink network flow path and the downlink network flow path of session 1 respectively in Fig. 1) of session 1.
Routing device B and routing device D between two, two office locations of situation carry out load balancing, in this case, which bar chain route routing device E downlink traffic walks determines, such as the path (adopting two dotted lines to represent uplink network flow path and the downlink network flow path of session 2 respectively in Fig. 1) of session 2.
Owing to the DPI equipment on different links is different, cause that DPI equipment can only get the flow of the half of same session, affect the identification to data stream and statistics.In order to solve this problem, as in figure 2 it is shown, be in the embodiment of the present invention, the enforcement schematic diagram of session data stream detection method, it is possible to comprise the following steps:
S21, a DPI equipment judge whether the session that data stream lacks to be detected.
When being embodied as, oneth DPI equipment is when the first data stream of session being detected, judge the second data stream same session whether being detected in preset duration, if it is judged that be no, and in this preset duration, still detect that the first data stream of this session exists, then can determine that this session data stream lacks.
In order to be best understood from the embodiment of the present invention, below in conjunction with Fig. 1, the specific implementation process of the embodiment of the present invention is illustrated.
DPI device A is when new session data stream being detected, it internal memory is the corresponding list item of this session establishment, and open session disappearance detection simultaneously, if this session in preset duration without downlink traffic, uplink traffic is also when continuing simultaneously, then judge that it is carried by different links as the up-downgoing flow caused due to load balancing, i.e. this session data stream disappearance.
S22, for the session detecting that data stream lacks, the first routing device to the first data stream processing this session sends Information Request.
In Fig. 1, DPI device A can send Information Request to routing device B, naturally it is also possible to sends Information Request to routing device A, illustrates being sent as example to routing device B below.Wherein carry the session identification of session.It is also preferred that the left when being embodied as, session identification can be made up of the IP five-tuple of session and session setup time.
S23, the first routing device judge the second data stream self whether processing this session disappearance.
First routing device is after receiving Information Request, whether the downstream data flow of the session that session identification that real-time monitoring is wherein carried is corresponding is through self, if it is, the first routing device acquisition processes the link related information of the first physical link of the second data stream of this session.Such as, the first routing device may determine that the physical link self processing the second data stream, and using the port of the address information of self and this physical link as above-mentioned link related information；First routing device is it may also be determined that process the first opposite end routing device of the second data stream, using the port numbers of the physical link that processes this second data stream on the first opposite end routing device address information and the first opposite end routing device as above-mentioned link related information.Illustrate for latter embodiment below.Concrete, it is possible to performing according to step S24～step S28, if it is not, then the first routing device obtains the flow relevant information of the second data stream of this session, concrete can perform according to step S29～step S219.
In Fig. 1, routing device B is after receiving Information Request, whether the downstream data flow of the session that session identification that real-time detection is wherein carried is corresponding is through self, if, routing device B obtains the link related information of the first physical link of the second data stream of this session according to step S24～step S28, otherwise, routing device obtains the flow relevant information of the second data stream of this session according to step S29～step S219.
S24, the first routing device determine the first opposite end routing device of the second data stream processing this session.
First routing device is according to session identification, it is determined that process the first opposite end routing device of the second data stream of this session.
Such as, in Fig. 1, routing device B determines that according to session identification the first opposite end routing device of the downstream data flow of process respective session is routing device A.
S25, the first routing device return the address information of the first opposite end routing device determined and the port numbers of the physical link of process the second data stream to a DPI equipment.
In Fig. 1, routing device B returns the address information of routing device A and the port numbers of the physical link of process the second data stream to DPI device A.
S26, a DPI equipment determine the address information of the 2nd DPI equipment of the second data stream processing this session.
When being embodied as, a DPI equipment is according to the address information received and port numbers, it is determined that process the first physical link of the second data stream of this session.And the corresponding relation between address information and the physical link of the DPI equipment of the same office location prestored according to self, it is determined that the address information of the DPI equipment on the first physical link.
In Fig. 1, DPI device A is according to the address information received and port numbers, it is determined that the address information of DPI equipment B on the physical link of downlink traffic process and this physical link.
S27, a DPI equipment are by the first traffic mirroring of this session to the 2nd DPI equipment.
When being embodied as, a DPI equipment can determine the 2nd DPI equipment according to the address information of the 2nd DPI equipment, and according to the interconnection interface between the 2nd DPI equipment, by the first traffic mirroring of this session to the 2nd DPI equipment.
S28, the 2nd DPI equipment complete the process of the partial data stream to this session.
When being embodied as, the 2nd DPI equipment completes the detection of up-downgoing flow, identification and various record.
When being embodied as, oneth DPI equipment is after obtaining the address information of the 2nd DPI equipment, the flow relevant information of the first data stream of this session that the 2nd DPI equipment self processes can also be notified according to this address information, such as uninterrupted, keyword and persistent period etc., processed accordingly in conjunction with the flow relevant information of the second data stream of this reply of its process by the 2nd DPI equipment, concrete, 2nd DPI equipment can according to the first data stream and the second data stream identification, record complete session, and export complete session XDR (ExternalDataRepresentation).
When being embodied as, the second traffic mirroring can also being processed to by the 2nd DPI equipment is to a DPI equipment, or the flow relevant information of the second data stream is informed to a DPI equipment, completed the process of the partial data stream of this session by a DPI equipment, this is not limited by the embodiment of the present invention.
It should be noted that consider that upstream data flow is typically smaller than downlink data flow, therefore, when being embodied as implementing, it is possible to select mirror image uplink traffic to save equipment room bandwidth.
S29, the first routing device forward, to the upstream routing device of self, the Information Request received.
Still for Fig. 1, the Information Request received is transmitted to its up routing device E by routing device B, meanwhile, routing device B can also add the address information forwarding labelling (Yes/No is the request forwarded) and forwarding routing device at this in asking.
S210, upstream routing device judge the second data stream self whether processing session disappearance.
When being embodied as, upstream routing device is according to the session identification carried in Information Request, it is judged that whether the second data stream of corresponding session is through self.If, then obtain the flow relevant information of the second data stream and be sent to the first via by equipment, concrete, can perform according to step step S211～step S219, otherwise, upstream routing device forwards the Information Request received to its neighbours' routing device, it should be noted that, the Information Request that upstream routing device forwards can add the device identification of self so that neighbours' routing device can be sent to this upstream routing device after getting the second opposite end routing device processing the second data stream.This upstream routing device, after obtaining the second opposite end routing device that neighbours' routing device returns, that process the second data stream, continues executing with execution step S212.
S211, upstream routing device determine the second opposite end routing device of the second data stream processing this session.
S212, upstream routing device forward, to the second opposite end routing device, the Information Request received.
When being embodied as, upstream routing device is when the second data stream determining this session passes through self, and determine according to forwarding labelling therein this session two data stream processes be different office location, consider that the traffic mirroring of different office location forwards and will take the substantial amounts of network bandwidth, in the embodiment of the present invention, upstream routing device is when determining the second data stream self processing this session, forward this Information Request to the down hop routing device (the second namely above-mentioned opposite end routing device) processing this session the second data stream by continuing, the flow relevant information of the second data stream of this session is obtained by the second opposite end routing device.Concrete, it is possible to perform according to step S213～step S219.
Still for Fig. 1, routing device E determines that the second data stream of this session is through self time, will forward Information Request to routing device D.
S213, the second opposite end routing device determine the 3rd DPI equipment of the second data stream processing this session.
When being embodied as, the second opposite end routing device determines the second physical link of the second data stream processing this session according to session identification；And according to the corresponding relation between the physical link prestored and DPI device address information, it is determined that the address information of the DPI equipment on the second physical link；The 3rd DPI equipment of the second data stream processing this session is determined according to the address information determined.
For Fig. 1, routing device D after receiving Information Request, determine the DPI equipment C on the physical link of this this session of process and this physical link according to session identification therein.
The Information Request that S214, the second opposite end routing device receive to the 3rd DPI device forwards.
Information Request is sent to DPI equipment C for Fig. 1, routing device D.
S215, the 3rd DPI equipment obtain the flow relevant information of the second data stream of this session.
When being embodied as, 3rd DPI equipment is according to the session identification carried in Information Request, determine the second data stream of the session of correspondence, and by the flow relevant information of the second data stream, such as uninterrupted, keyword and persistent period etc., built the response message of Information Request by the form of standard, and be sent to the second opposite end routing device.It should be noted that field number and content in flow relevant information are all expansible, and can indicate in Information Request.
S216, the 3rd DPI equipment return the response message of Information Request to the second opposite end routing device.
When being embodied as, the response message returned carries the flow relevant information of the second data stream.
S217, the second opposite end routing device return the response message received to the first routing device.
It should be noted that response message also can feed back to the first routing device according to the transmission path Yuan Lu of Information Request successively.
The response message that S218, the first routing device receive to a DPI device forwards.
The data stream that this session is complete is processed by S219, a DPI equipment.
When being embodied as, the flow relevant information of the first data stream that a DPI equipment obtains in conjunction with self according to the flow relevant information of the second data stream carried in response message, identify, record whole session, and export complete session XDR.
It should be noted that in the embodiment of the present invention, if also have the 3rd jumping between router and be more, it is possible to forward Information Request successively, be embodied as identical with the second jumping route, repeat no more here.
When being embodied as, DPI equipment is after the session that data stream lacks being detected, it is possible to being initiated Information Request by the DPI equipment of uplink session process, the DPI equipment passive response of descending session process, without active behavior.It is to say, in the embodiment of the present invention, for same session, only an XDR can be exported, the DPI equipment gone out by traffic mirroring or flow relevant information is sent out, do not re-record XDR for this session and export.
In the embodiment of the present invention, routing device needs newly-increased and DPI device intercommunicating message function, specifically include: routing device needs in the middle of the N bar route of record load balancing, every data stream specifically through which routing device forwards, can be set for each record effect duration, it is ensured that list item is not too large；Routing device also needs to receive the Information Request of DPI equipment；According to the session identification wherein carried, search the down hop route of respective session, and routing iinformation is sent back to DPI equipment；For the Information Request of load balancing list item cannot be found, routing device forwards this Information Request to the neighbours' routing device of self, add the forwarding mark of oneself simultaneously, neighbours' routing device is after receiving Information Request, the load balancing log of oneself is searched the down hop route of respective session, and routing iinformation according to the routing device forwarding mark to send back to initiation.
In above-mentioned data flow processing method, DPI equipment is after the session that data stream lacks being detected, the second data stream that this session lacks is asked to the routing device processing the first data stream, routing device is after the requests have been received, process the link related information of the physical link of this session or the flow relevant information of the second data stream according to the session identification acquisition wherein carried and return to DPI equipment, make DPI equipment can obtain the relevant information of the second data stream accordingly, thus completing the process to session partial data stream, due in said process, without the allotment of its two data stream being processed to Same Physical link for same session, from without destroying load balancing between physical link.
Based on same inventive concept, the embodiment of the present invention also each provides a kind of routing device and the routing device of session data method for stream processing that DPI equipment is implemented respectively and correspondence and DPI equipment, owing to the principle of said method and equipment solution problem is similar to above-mentioned session data stream processing system, therefore the enforcement of said method and equipment may refer to the enforcement of system, repeats part and repeats no more.
As shown in figure Fig. 3, implement the implementing procedure schematic diagram of session data method for stream processing for routing device, it is possible to comprise the following steps:
S31, routing device receive DPI equipment Information Request of transmission when detecting that session data stream lack.
Wherein, Information Request carries the session identification of described session.
S32, routing device are according to this session identification, it is judged that self whether process the data stream of described session disappearance, if it is, perform step S33, otherwise perform step S34.
S33, routing device acquisition process the link related information of physical link of missing data stream.
Concrete, routing device can pass through the link related information that any one acquisition in following two mode processes the physical link of missing data stream:
Mode one, determine self process described missing data stream physical link；Using the first port numbers of the address information of self and described physical link as described link related information.
Mode two, determine the opposite end routing device processing described missing data stream；The address information of opposite end routing device determined and described opposite end routing device are processed second port numbers of physical link of described missing data stream as described link related information.
S34, routing device obtain the flow relevant information of missing data stream.
When being embodied as, routing device forwards described Information Request to the upstream routing device of self；And receive the flow relevant information of session identification respective session missing data stream that described upstream routing device sends, that carry in described Information Request.
S35, routing device return the link related information or flow relevant information that obtain to DPI equipment, DPI equipment complete the partial data stream to this session according to the link related information received or flow relevant information and process.
As shown in Figure 4, the implementing procedure schematic diagram of session data method for stream processing is implemented for DPI equipment, it is possible to comprise the following steps:
S41, for the session detecting that data stream lacks, send Information Request to the routing device processing described session the first data stream.
Wherein, described Information Request carries the session identification of described session.
The link related information of physical link that S42, reception routing device return, that process described session the second data stream or the flow relevant information of described second data stream.
Link related information or flow relevant information that S43, basis receive complete the partial data stream to described session and process.
Step S41 wherein can determine session that the session detected is data stream disappearance in accordance with the following methods:
Step one, when the first data stream of described session being detected, it is judged that in preset duration, the second data stream of described session whether detected；
If step 2 judged result is no, and when described first data stream still being detected in described preset duration, it is determined that described session data stream lacks.
When being embodied as, in step S43, complete the partial data stream to described session according to the link related information received and process, it is possible to comprise the following steps:
Step one, the link related information returned according to described routing device determine the physical link processing described second data stream.
Corresponding relation between physical link and DPI device address information that step 2, basis prestore, it is determined that the address information of the DPI equipment on described physical link.
Described in the DPI equipment that step 3, the address information determined of notice are corresponding, the flow relevant information of the first data stream, is completed the partial data stream to described session by described DPI equipment and processes；Or obtain the flow relevant information of described second data stream to described DPI equipment, and complete the partial data stream to described session and process.
As it is shown in figure 5, the structural representation of the routing device provided for the embodiment of the present invention, it is possible to including:
Receive unit 51, for receiving deep-packet detection DPI equipment the Information Request sent when session data stream lacks being detected, wherein carry the session identification of described session；
Judging unit 52, for according to described session identification, it is judged that whether the routing device at self place processes the data stream of described session disappearance；
Acquiring unit 53, for when the judged result of described judging unit 52 is for being, acquisition processes the link related information of the physical link of missing data stream；And when the judged result of described judging unit 52 is no, obtain the flow relevant information of missing data stream；
Response unit 54, for returning the link related information or flow relevant information obtained to described DPI equipment, is completed the partial data stream to described session by described DPI equipment according to the link related information received or flow relevant information and processes.
Wherein, acquiring unit 53 may be used for when the judged result of described judging unit is for being, it is determined that processes the physical link of described missing data stream；Using the first port numbers of the address information of the routing device at self place and described physical link as described link related information.Or acquiring unit 53 may be used for when the judged result of described judging unit is for being, determine the first opposite end routing device processing missing data stream, it is to be determined to the address information of the first opposite end routing device gone out and port numbers are as the link related information of the physical link processing missing data stream.
When being embodied as, acquiring unit 53, it is possible to including:
Send subelement, for when the judged result of described judging unit is no, forwarding described conversation request information to the upstream routing device of described routing device；
Receive subelement, for receiving the flow relevant information of the missing data stream of session identification respective session that described upstream routing device returns, that carry in described Information Request.
As shown in Figure 6, the structural representation of the DPI equipment provided for the embodiment of the present invention, it is possible to including:
Transmitting element 61, for the session detecting that data stream lacks, sends Information Request to the routing device processing described session the first data stream, carries the session identification of described session in described Information Request；
Receive unit 62, for receiving link related information or the flow relevant information that described routing device returns；
Processing unit 63, for completing the partial data stream to described session process according to the link related information received or flow relevant information.
The DPI equipment that the embodiment of the present invention provides, it is also possible to including:
Judging unit, for when detecting the first data stream of described session, it is judged that the second data stream of described session whether detected in preset duration；
Determine unit, be no for the judged result at described judging unit, and when described first data stream still being detected described in described preset duration, it is determined that described session data stream lacks.
Wherein, processing unit, it is possible to including:
First determines subelement, determines, for the link related information returned according to described routing device, the physical link processing described second data stream；
Second determines subelement, for according to the corresponding relation between the physical link and the DPI device address information that prestore, it is determined that the address information of the DPI equipment on described physical link；
Notice subelement, described in the DPI equipment corresponding for notifying the address information determined, the flow relevant information of the first data stream, is completed the partial data stream to described session by described DPI equipment and processes；
Processing unit, for obtaining the flow relevant information of described second data stream to described DPI equipment, and completes the partial data stream to described session and processes.
For convenience of description, above each several part is divided by function and is respectively described for each module (or unit).Certainly, the function of each module (or unit) can be realized in same or multiple softwares or hardware when implementing the present invention.
Those skilled in the art are it should be appreciated that embodiments of the invention can be provided as method, system or computer program.Therefore, the present invention can adopt the form of complete hardware embodiment, complete software implementation or the embodiment in conjunction with software and hardware aspect.And, the present invention can adopt the form at one or more upper computer programs implemented of computer-usable storage medium (including but not limited to disk memory, CD-ROM, optical memory etc.) wherein including computer usable program code.
The present invention is that flow chart and/or block diagram with reference to method according to embodiments of the present invention, equipment (system) and computer program describe.It should be understood that can by the combination of the flow process in each flow process in computer program instructions flowchart and/or block diagram and/or square frame and flow chart and/or block diagram and/or square frame.These computer program instructions can be provided to produce a machine to the processor of general purpose computer, special-purpose computer, Embedded Processor or other programmable data processing device so that the instruction performed by the processor of computer or other programmable data processing device is produced for realizing the device of function specified in one flow process of flow chart or multiple flow process and/or one square frame of block diagram or multiple square frame.
These computer program instructions may be alternatively stored in and can guide in the computer-readable memory that computer or other programmable data processing device work in a specific way, the instruction making to be stored in this computer-readable memory produces to include the manufacture of command device, and this command device realizes the function specified in one flow process of flow chart or multiple flow process and/or one square frame of block diagram or multiple square frame.
These computer program instructions also can be loaded in computer or other programmable data processing device, make on computer or other programmable devices, to perform sequence of operations step to produce computer implemented process, thus the instruction performed on computer or other programmable devices provides for realizing the step of function specified in one flow process of flow chart or multiple flow process and/or one square frame of block diagram or multiple square frame.
Although preferred embodiments of the present invention have been described, but those skilled in the art are once know basic creative concept, then these embodiments can be made other change and amendment.So, claims are intended to be construed to include preferred embodiment and fall into all changes and the amendment of the scope of the invention.
Obviously, the present invention can be carried out various change and modification without deviating from the spirit and scope of the present invention by those skilled in the art.So, if these amendments of the present invention and modification belong within the scope of the claims in the present invention and equivalent technologies thereof, then the present invention is also intended to comprise these change and modification.
Claims (23)
1. a session data stream processing system, it is characterised in that include at least one routing device and at least one deep-packet detection DPI equipment, wherein:
Oneth DPI equipment, for for the session detecting that data stream lacks, sending Information Request to the first routing device processing described session the first data stream, carry the session identification of described session in described Information Request；And the link related information or flow relevant information according to described first routing device return completes the partial data stream to described session and processes；
First routing device, for according to the session identification carried in described Information Request, it is judged that self whether process the second data stream of described session disappearance；When judged result is for being, acquisition processes the link related information of the first physical link of described second data stream；When judged result is no, obtain the flow relevant information of described second data stream；And the link related information of the first physical link that obtain, that process described second data stream or the flow relevant information of described second data stream is returned to a described DPI equipment.
2. system as claimed in claim 1, it is characterised in that
A described DPI equipment, specifically for when the first data stream of described session being detected, judge the second data stream described session whether being detected in preset duration, if not and when described first data stream still being detected in described preset duration, it is determined that described session data stream lacks.
3. the system as claimed in claim 1, it is characterised in that
Described first routing device, specifically for when judged result is for being, it is determined that self process the first physical link of described second data stream；Or determine the first opposite end routing device of the second data stream processing described session；And using the address information of self and the first port numbers of described first physical link as described link related information；Or the address information of the first opposite end routing device determined and described first opposite end routing device are processed second port numbers of the first physical link of described second data stream as described link related information.
4. the system as described in claim 1,2 or 3, it is characterised in that
A described DPI equipment, specifically for determining the first physical link processing described second data stream according to described link related information；And according to the corresponding relation between the physical link prestored and DPI device address information, it is determined that the address information of the DPI equipment on described first physical link；Described in the 2nd DPI equipment that the address information determined of notice is corresponding, the flow relevant information of the first data stream, is completed the partial data stream to described session by described 2nd DPI equipment and processes；Or obtain the flow relevant information of described second data stream to described 2nd DPI equipment, and complete the partial data stream to described session and process.
5. system as claimed in claim 4, it is characterised in that
A described DPI equipment, specifically for by described first traffic mirroring to described 2nd DPI equipment, in, described 2nd DPI equipment complete the partial data stream to described session and process.
6. system as claimed in claim 1 or 2, it is characterised in that
Described first routing device, specifically for when judged result is no, forwarding described Information Request to the upstream routing device of self；
Described upstream routing device, for according to the session identification carried in described Information Request, it is judged that self whether process the second data stream of described session disappearance；If it is, obtain the flow relevant information of described second data stream and be sent to described first routing device.
7. system as claimed in claim 6, it is characterised in that
Described upstream routing device, during specifically for judging the second data stream self processing described session disappearance, determines the second opposite end routing device processing described second data stream according to described session identification；Described Information Request is forwarded to the second opposite end routing device determined；
Described second opposite end routing device, for according to the session identification carried in described Information Request, obtaining the flow relevant information of the second data stream of described session identification respective session and be sent to described upstream routing device.
8. system as claimed in claim 6, it is characterised in that
Described second opposite end routing device, specifically for determining the second physical link processing described second data stream according to the session identification carried in described Information Request；And according to the corresponding relation between the physical link prestored and DPI device address information, it is determined that the address information of the DPI equipment on described second physical link；And to Information Request described in the 3rd DPI device forwards corresponding to the address information determined；
Described 3rd DPI equipment, for according to the session identification carried in described Information Request, it is determined that the flow relevant information of the second data stream of described session identification respective session, and is sent to described second opposite end routing device.
9. the system as described in claim 6,7 or 8, it is characterised in that
Described upstream routing device, is additionally operable to, when judging the second data stream self not processing described session disappearance, forward described Information Request to the neighbours' routing device of self；And reception processes the second opposite end routing device processing described second data stream that neighbours' routing device of described second data stream returns.
10. a session data method for stream processing, it is characterised in that including:
Routing device receives deep-packet detection DPI equipment the Information Request sent when session data stream lacks being detected, and carries the session identification of described session in described Information Request；
Described routing device is according to described session identification, it is judged that self whether process the data stream of described session disappearance；
If it is, acquisition processes the link related information of the physical link of missing data stream, otherwise, the flow relevant information of missing data stream is obtained；
Described routing device returns the link related information or flow relevant information that obtain to described DPI equipment, described DPI equipment complete the partial data stream to described session according to the link related information received or flow relevant information and process.
11. method as claimed in claim 10, it is characterised in that acquisition processes the link related information of the physical link of missing data stream, specifically includes:
Determine that self processes the physical link of described missing data stream；
Using the first port numbers of the address information of self and described physical link as described link related information.
12. method as claimed in claim 10, it is characterised in that acquisition processes the link related information of the physical link of missing data stream, specifically includes:
Determine the opposite end routing device processing described missing data stream；
The address information of opposite end routing device determined and described opposite end routing device are processed second port numbers of physical link of described missing data stream as described link related information.
13. method as claimed in claim 10, it is characterised in that obtain the flow relevant information of missing data stream, specifically include:
Described routing device forwards described Information Request to the upstream routing device of self；
Receive the flow relevant information of the missing data stream of session identification respective session that described upstream routing device returns, that carry in described Information Request.
14. a routing device, it is characterised in that including:
Receive unit, for receiving deep-packet detection DPI equipment the Information Request sent when session data stream lacks being detected, described Information Request carries the session identification of described session；
Judging unit, for according to described session identification, it is judged that whether the routing device at self place processes the data stream of described session disappearance；
Acquiring unit, for when the judged result of described judging unit is for being, acquisition processes the link related information of the physical link of missing data stream；And when the judged result of described judging unit is no, obtain the flow relevant information of missing data stream；
Response unit, for returning the link related information or flow relevant information obtained to described DPI equipment, is completed the partial data stream to described session by described DPI equipment according to the link related information received or flow relevant information and processes.
15. routing device as claimed in claim 14, it is characterised in that
Described acquiring unit, specifically for when the judged result of described judging unit is for being, it is determined that process the physical link of described missing data stream；Using the first port numbers of the address information of the routing device at self place and described physical link as described link related information.
16. routing device as claimed in claim 14, it is characterised in that
Described acquiring unit, specifically for when the judged result of described judging unit is for being, determine the opposite end routing device processing missing data stream, it is to be determined to the address information of the opposite end routing device gone out and opposite end routing device process the second port numbers of the physical link of described missing data stream as described link related information.
17. routing device as claimed in claim 14, it is characterised in that described acquiring unit, including:
Send subelement, for when the judged result of described judging unit is no, forwarding described conversation request information to the upstream routing device of described routing device；
Receive subelement, for receiving the flow relevant information of the missing data stream of session identification respective session that described upstream routing device returns, that carry in described Information Request.
18. a session data method for stream processing, it is characterised in that including:
For the session detecting that data stream lacks, send Information Request to the routing device processing described session the first data stream, described Information Request carries the session identification of described session；
Receive the link related information of physical link that described routing device returns, that process described session the second data stream or the flow relevant information of described second data stream；
Complete the partial data stream to described session according to the link related information received or flow relevant information to process.
19. method as claimed in claim 18, it is characterised in that determine the session that the session detected is data stream disappearance in accordance with the following methods:
When the first data stream of described session being detected, it is judged that the second data stream of described session whether detected in preset duration；
If judged result is no, and when described first data stream still being detected in described preset duration, it is determined that described session data stream lacks.
20. the method as described in claim 18 or 19, it is characterised in that complete the partial data stream to described session according to the link related information received and process, specifically include:
The physical link processing described second data stream is determined according to the link related information that described routing device returns；And
According to the corresponding relation between the physical link prestored and DPI device address information, it is determined that the address information of the DPI equipment on described first physical link；
Described in the DPI equipment that the address information determined of notice is corresponding, the flow relevant information of the first data stream, is completed the partial data stream to described session by described DPI equipment and processes；Or obtain the flow relevant information of described second data stream to described DPI equipment, and complete the partial data stream to described session and process.
21. a deep-packet detection DPI equipment, it is characterised in that including:
Transmitting element, for the session detecting that data stream lacks, sends Information Request to the routing device processing described session the first data stream, carries the session identification of described session in described Information Request；
Receive unit, for receiving link related information or the flow relevant information that described routing device returns；
Processing unit, for completing the partial data stream to described session process according to the link related information received or flow relevant information.
22. DPI equipment as claimed in claim 21, it is characterised in that also include:
Judging unit, for when detecting the first data stream of described session, it is judged that the second data stream of described session whether detected in preset duration；
Determine unit, be no for the judged result at described judging unit, and when described first data stream still being detected described in described preset duration, it is determined that described session data stream lacks.
23. the DPI equipment as described in claim 21 or 22, it is characterised in that described processing unit, specifically include:
First determines subelement, determines, for the link related information returned according to described routing device, the physical link processing described second data stream；
Second determines subelement, for according to the corresponding relation between the physical link and the DPI device address information that prestore, it is determined that the address information of the DPI equipment on described physical link；
Notice subelement, described in the DPI equipment corresponding for notifying the address information determined, the flow relevant information of the first data stream, is completed the partial data stream to described session by described DPI equipment and processes；
Processing unit, for obtaining the flow relevant information of described second data stream to described DPI equipment, and completes the partial data stream to described session and processes.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410785508.7A CN105763391B (en) | 2014-12-17 | 2014-12-17 | A kind of session data stream processing system, method and relevant device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410785508.7A CN105763391B (en) | 2014-12-17 | 2014-12-17 | A kind of session data stream processing system, method and relevant device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105763391A true CN105763391A (en) | 2016-07-13 |
| CN105763391B CN105763391B (en) | 2019-06-25 |
Family
ID=56339551
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410785508.7A Active CN105763391B (en) | 2014-12-17 | 2014-12-17 | A kind of session data stream processing system, method and relevant device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105763391B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108011939A (en) * | 2017-11-29 | 2018-05-08 | 北京神州绿盟信息安全科技股份有限公司 | A kind of method and device for reducing BlueDrama |
| CN109995606A (en) * | 2018-01-02 | 2019-07-09 | 中国移动通信有限公司研究院 | Virtualize deep-packet detection vDPI flow control methods and network element device |
| CN113760979A (en) * | 2020-11-12 | 2021-12-07 | 北京沃东天骏信息技术有限公司 | Method and apparatus for generating information |
| CN115412491A (en) * | 2022-08-29 | 2022-11-29 | 中电科航空电子有限公司 | Multilink air-ground communication routing selection and flow statistical method and system |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101557329A (en) * | 2009-05-27 | 2009-10-14 | 杭州迪普科技有限公司 | Application layer-based data segmenting method and device thereof |
| CN101582808A (en) * | 2009-06-10 | 2009-11-18 | 中兴通讯股份有限公司南京分公司 | Method, terminal and system for P2P up-down flow statistical management |
| CN102594694A (en) * | 2012-03-06 | 2012-07-18 | 北京中创信测科技股份有限公司 | Data distribution method and equipment |
| CN102075423B (en) * | 2011-01-10 | 2013-01-02 | 中国人民解放军国防科学技术大学 | Hardware multi-level table-based method for controlling output traffic |
| CN103024819A (en) * | 2012-06-15 | 2013-04-03 | 中国人民解放军国防科学技术大学 | Data distribution method of third-generation mobile communication core network based on user terminal IP (Internet Protocol) |
| US20130286872A1 (en) * | 2010-11-09 | 2013-10-31 | Plustech Inc. | Session-based traffic analysis system |
-
2014
- 2014-12-17 CN CN201410785508.7A patent/CN105763391B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101557329A (en) * | 2009-05-27 | 2009-10-14 | 杭州迪普科技有限公司 | Application layer-based data segmenting method and device thereof |
| CN101582808A (en) * | 2009-06-10 | 2009-11-18 | 中兴通讯股份有限公司南京分公司 | Method, terminal and system for P2P up-down flow statistical management |
| US20130286872A1 (en) * | 2010-11-09 | 2013-10-31 | Plustech Inc. | Session-based traffic analysis system |
| CN102075423B (en) * | 2011-01-10 | 2013-01-02 | 中国人民解放军国防科学技术大学 | Hardware multi-level table-based method for controlling output traffic |
| CN102594694A (en) * | 2012-03-06 | 2012-07-18 | 北京中创信测科技股份有限公司 | Data distribution method and equipment |
| CN103024819A (en) * | 2012-06-15 | 2013-04-03 | 中国人民解放军国防科学技术大学 | Data distribution method of third-generation mobile communication core network based on user terminal IP (Internet Protocol) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108011939A (en) * | 2017-11-29 | 2018-05-08 | 北京神州绿盟信息安全科技股份有限公司 | A kind of method and device for reducing BlueDrama |
| CN108011939B (en) * | 2017-11-29 | 2020-09-22 | 北京神州绿盟信息安全科技股份有限公司 | Method and device for restoring network session |
| CN109995606A (en) * | 2018-01-02 | 2019-07-09 | 中国移动通信有限公司研究院 | Virtualize deep-packet detection vDPI flow control methods and network element device |
| CN109995606B (en) * | 2018-01-02 | 2021-09-14 | 中国移动通信有限公司研究院 | Virtualization deep packet inspection vDPI flow control method and network element equipment |
| CN113760979A (en) * | 2020-11-12 | 2021-12-07 | 北京沃东天骏信息技术有限公司 | Method and apparatus for generating information |
| CN115412491A (en) * | 2022-08-29 | 2022-11-29 | 中电科航空电子有限公司 | Multilink air-ground communication routing selection and flow statistical method and system |
| CN115412491B (en) * | 2022-08-29 | 2023-08-25 | 中电科航空电子有限公司 | Multilink air-to-ground communication route selection and flow statistics method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105763391B (en) | 2019-06-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106656800B (en) | Path selection method and system, network acceleration node and network acceleration system | |
| US10637771B2 (en) | System and method for real-time load balancing of network packets | |
| CN107395683B (en) | Method for selecting return path and server | |
| EP1430651B1 (en) | Adaptive node selection | |
| US7349348B1 (en) | Method and apparatus for determining a network topology in the presence of network address translation | |
| US8427943B2 (en) | Bandwidth-aware multicast load balancing on a multi-interface host | |
| CN103888358B (en) | Routing method, device, system and gateway equipment | |
| CN108234207B (en) | Fault positioning method and device based on Content Delivery Network (CDN) | |
| CN102195882B (en) | According to method and the device of the routing of data flow application type | |
| CN113596863B (en) | Method, equipment and medium for determining user plane function and providing information | |
| CN109787827B (en) | CDN network monitoring method and device | |
| CN107241270A (en) | Message processing method and device | |
| CN105763391A (en) | Conversation data flow processing system and method, and related equipment | |
| CN112543212B (en) | System for providing request response exact communication delay guarantee for distributed service | |
| CN104753965A (en) | Web acceleration method and system | |
| CN108270602A (en) | A kind of detection method of data link, apparatus and system | |
| CN104408182A (en) | Method and device for processing web crawler data on distributed system | |
| CN101771604A (en) | Routing detection method, system and intermediate routing device | |
| JP2007219637A (en) | Load balancing system and program therefor | |
| CN111600929B (en) | Transmission line detection method, routing strategy generation method and proxy server | |
| WO2017149355A1 (en) | Content distribution and delivery optimization in a content delivery network (cdn) | |
| CN110855528B (en) | Message processing method and test equipment | |
| CN105282231B (en) | Data drainage method, apparatus and system based on application type | |
| CN102075588A (en) | Method and system for realizing network address translation (NAT) transversing and equipment | |
| JP2012108685A (en) | Load distribution system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |