CN108429657A - Packet sampling method, apparatus and message processor - Google Patents
Packet sampling method, apparatus and message processor Download PDFInfo
- Publication number
- CN108429657A CN108429657A CN201810169894.5A CN201810169894A CN108429657A CN 108429657 A CN108429657 A CN 108429657A CN 201810169894 A CN201810169894 A CN 201810169894A CN 108429657 A CN108429657 A CN 108429657A
- Authority
- CN
- China
- Prior art keywords
- data message
- sampling
- different types
- packet
- message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
- H04L43/0894—Packet rate
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
Abstract
A kind of packet sampling method, apparatus of disclosure offer and message processor, are related to technical field of data transmission.The method is applied to message processor, the method includes：The Packet Classification that will be received；Different types of data message is sampled respectively by the sampling interval, obtains different types of data message sample.Using the packet sampling method, apparatus and message processor, the reliable samples to different types of data message are realized.
Description
Technical field
This disclosure relates to technical field of data transmission, at a kind of packet sampling method, apparatus and message
Manage equipment.
Background technology
In many scenes, data message sampling plan is often used, such as carry out to the service traffics in network
During statistics and analysis, data message is sampled by the sampling interval of setting, and then data message pair is calculated
The service traffics answered, through inventor the study found that existing data message sampling plan limited reliability, cannot be satisfied practical need
It asks, for example, when being sampled after being counted to the data message unification of various flows in network based on the sampling interval of setting, due to
The difference of uninterrupted does not simply fail to accomplish reliable samples, in some instances it may even be possible to omit for the smaller data message of flow.
Invention content
In view of this, the disclosure is designed to provide a kind of packet sampling method, apparatus and message processor, to carry
The reliability of high packet sampling.
In a first aspect, present disclose provides a kind of packet sampling method, it is applied to message processor, the method packet
It includes：
The Packet Classification that will be received；
Different types of data message is sampled respectively by the sampling interval, obtains different types of data message sample
This.
Optionally, the step of Packet Classification that will be received, including：
Identify the source address and destination address of data message；
It is source address is identical and the identical data message of destination address is divided into same type of data message.
Optionally, the step of different types of data message being sampled respectively by the sampling interval, including：
The quantity of different types of data message is counted respectively；
For different types of data message, the quantity obtained according to statistics is sampled according to the sampling interval.
Optionally, the step of counting the quantity of different types of data message respectively, including：
When receiving data message, according to the feature calculation hash value of the data message, determined according to the hash value
The corresponding quantity statistics address of the data message, and the count value of the corresponding counter in quantity statistics address is added 1；
For different types of data message, the step of quantity obtained according to statistics is sampled according to the sampling interval,
Including：
When the count value of arbitrarycounter meets the sampling interval, to the data messages of the counter corresponding types into
The primary sampling of row, to which sampling obtains different types of data message sample.
Optionally, the counter is stored in the dynamic random access memory of the message processor.
Optionally, the method further includes：
The data message sample that replica samples obtain；
A copy of it data message sample obtained after duplication is sent to NetStream business boards, by another data
Message sample is forwarded.
Optionally, the method further includes：
According to the quantity variance for the different types of data message sample that sampling obtains, various types of data messages are obtained
Accounting of the corresponding flow in sample objects.
Second aspect, present disclose provides a kind of packet sampling devices, are applied to message processor, the packet sampling
Device includes：
Sort module, the Packet Classification for will receive；
Sampling module obtains different type for being sampled respectively to different types of data message by the sampling interval
Data message sample.
Optionally, the sort module includes：
Address Recognition submodule, for identification source address and destination address of data message；
Category division submodule, for source address is identical and the identical data message of destination address to be divided into same type
Data message.
Optionally, the sampling module includes：
Quantity statistics submodule, the quantity for counting different types of data message respectively；
Submodule is sampled, for being directed to different types of data message, the quantity obtained according to statistics is according to the sampling interval
It is sampled.
Optionally, the quantity statistics submodule includes：
Statistic unit, for when receiving data message, according to the feature calculation hash value of the data message, according to institute
It states hash value and determines the corresponding quantity statistics address of the data message, and by the counting of the corresponding counter in quantity statistics address
Value plus 1；
The sampling submodule is specifically used for, when the count value of arbitrarycounter meets the sampling interval, to the meter
The data message of number device corresponding types is once sampled, to which sampling obtains different types of data message sample.
Optionally, the packet sampling device further includes：
Replication module, the data message sample obtained for replica samples；
Processing module, a copy of it data message sample for being obtained after replicating are sent to NetStream business boards,
Another data message sample is forwarded.
Optionally, the packet sampling device further includes：
Flow analysis module, the quantity variance of the different types of data message sample for being obtained according to sampling obtain
Accounting of the corresponding flow of various types of data messages in sample objects.
The third aspect, present disclose provides a kind of message processors, including：
Memory；
Processor；And
Packet sampling device, the packet sampling device include：
Sort module, the Packet Classification for will receive；
Sampling module obtains different type for being sampled respectively to different types of data message by the sampling interval
Data message sample.
Fourth aspect, present disclose provides a kind of computer readable storage medium, the computer readable storage medium packet
Computer program is included, the message processor computer program controls the computer readable storage medium when running where is held
The above-mentioned packet sampling method of row.
The packet sampling method, apparatus and message processor that the disclosure provides, the Packet Classification that will be received, needle
Different types of data message is sampled respectively, so as to reliably be adopted to various types of data messages
Sample, the data message for avoiding flow smaller is missed in sampling, to improve the reliability and accuracy of sampling.
To enable the above objects, features, and advantages of the disclosure to be clearer and more comprehensible, preferred embodiment cited below particularly, and coordinate
Appended attached drawing, is described in detail below.
Description of the drawings
In order to illustrate more clearly of the technical solution of the disclosure, letter will be made to attached drawing needed in the embodiment below
It singly introduces, it should be understood that the following drawings illustrates only some embodiments of the disclosure, therefore is not construed as to range
It limits, it for those of ordinary skill in the art, without creative efforts, can also be according to these attached drawings
Obtain other relevant attached drawings.
Fig. 1 is a kind of block diagram for message processor that the disclosure provides.
Fig. 2 is a kind of flow chart for packet sampling method that the disclosure provides.
Fig. 3 is the exemplary process diagram of step S11 in Fig. 2 that the disclosure provides.
Fig. 4 is the exemplary process diagram of step S12 in Fig. 2 that the disclosure provides.
Fig. 5 is a kind of block diagram for packet sampling device that the disclosure provides.
Icon：10- message processors；11- memories；12- processors；13- network modules；20- packet sampling devices；
21- sort modules；211- Address Recognition submodules；212- category division submodules；22- sampling modules；221- quantity statistics
Module；2211- counter group allocation units；2212- statistic units；222- samples submodule；23- replication modules；24- handles mould
Block；25- flow analysis modules.
Specific implementation mode
In many scenes, be required to use packet sampling scheme, for example, need to the service traffics in network into
In the scene of row statistics and analysis, during realizing traffic statistics based on NetStream technologies, generally require in conjunction with data
Packet sampling scheme realizes traffic statistics, is sampled to data message by setting the sampling interval, needs to count to reduce
Data message quantity, analytical sampling to information can reflect the traffic conditions of whole network.In addition, based on sampling
Information, which carries out statistics, can also reduce the flow of network, and the big flow in network is avoided to cause shadow to the performance of message processor
It rings.However, being found through investigation, existing data message sampling plan limited reliability, sampling accuracy rate cannot be satisfied practical need
It asks.
Inventor has found that message in the prior art is adopted after being analysed in depth to packet sampling flow in the prior art
Sample, either sequential sampling or stochastical sampling, the method for use be usually to all data messages for meeting sampling condition into
Then row quantity statistics are sampled according to the sampling interval of setting, if for example, the sampling interval is 1000：1, sequential sampling is then
The data message that the quantity counted on is 1000,2000,3000 ... is chosen to be sampled.Stochastical sampling is then in every 1000 data
A data message is randomly selected in message to be sampled.Then the data message again obtained sampling carries out subsequent processing, example
Such as, in NetStream technologies, NetStream business boards are sent to after the data message that sampling obtains being done mirror image processing,
NetStream business boards carry out the business such as traffic statistics.
Through analysis, it is using the reason of packet sampling scheme limited reliability in the prior art, is generally deposited in network
In various flow rate, for example, source address is identical and the identical each data message of destination address corresponds to a kind of flow, source address or purpose
The different data message in address corresponds to different types of flow, and the size of different types of flow has differences, and use is existing
The sampling message that sampling plan in technology obtains can not carry out reliable samples, example to the data message of different types of flow
Such as, when based on the sampling interval of setting to being sampled after the unified statistics of the data message of various flows in network, due to flow
The difference of size does not simply fail to accomplish reliable samples, in some instances it may even be possible to omit, in turn for the smaller data message of flow
Influence the reliability that the data message based on sampling carries out subsequent processing.
Based on this, present disclose provides a kind of packet sampling schemes, break through thinking limitation in the prior art, abandon existing
Quantity statistics are uniformly carried out to all data messages in technology, then according to the scheme that the sampling interval of setting is sampled, originally
Dexterously classify to the data message received in scheme, different types of data message sampled respectively, it is ensured that
Different types of data message can improve sampling reliability and while accuracy by reliable samples, for by using obtaining
Information carry out subsequent analysis provide more possibilities.For example, when carrying out Packet Classification by flow, it can be ensured that various
The corresponding data message of discharge pattern can be sampled, and adopting caused by the difference in size because of different flow in the prior art is avoided
Sample limited reliability, or even the case where sampling is leaked, sampling reliability is improved, the various discharge patterns that sampling is obtained correspond to
Data message quantity compare and can be obtained the proportion of the various types of flows of network.
For the defect present in the prior art, be inventor being obtained after putting into practice and carefully studying as a result,
Therefore, the solution that the discovery procedure of the above problem and the disclosure are proposed for problem in the presence of the prior art, all
It should be the contribution that inventor makes the disclosure during disclosure.
Below in conjunction with attached drawing in the disclosure, the technical solution in the disclosure is clearly and completely described, it is clear that
Described embodiment is only disclosure a part of the embodiment, instead of all the embodiments.Usually retouched in attached drawing here
The component for the disclosure stated and shown can be arranged and be designed with a variety of different configurations.Therefore, below to carrying in the accompanying drawings
The detailed description of the embodiment of the disclosure of confession is not intended to limit claimed the scope of the present disclosure, but is merely representative of this
Disclosed selected embodiment.Based on embodiment of the disclosure, those skilled in the art are in the premise for not making creative work
Lower obtained every other embodiment belongs to the range of disclosure protection.
It should be noted that：Similar label and letter indicate similar terms in following attached drawing, therefore, once a certain Xiang Yi
It is defined, then it further need not be defined and explained in subsequent attached drawing in a attached drawing.
As shown in Figure 1, being a kind of block diagram for the message processor 10 that the disclosure provides.Message in the disclosure
Processing equipment 10 can be the equipment with message analysis processing and forwarding capability such as router, interchanger, gateway.Such as Fig. 1 institutes
Show, message processor 10 includes：Memory 11, processor 12, network module 13 and packet sampling device 20.
The memory 11, processor 12 and network module 13 are directly or indirectly electrically connected between each other, with reality
The transmission or interaction of existing data.For example, these elements can be realized between each other by one or more communication bus or signal wire
It is electrically connected.Be stored with packet sampling device 20 in memory 11, the packet sampling device 20 include it is at least one can be soft
The form of part or firmware (firmware) is stored in the software function module in the memory 11, and the processor 12 passes through fortune
Row is stored in software program and module in memory 11, various to execute such as the packet sampling device 20 in the disclosure
The packet sampling method in the disclosure is realized in application of function and data processing.
Wherein, the memory 11 may be, but not limited to, random access memory (Random Access Memory,
RAM), read-only memory (Read Only Memory, ROM), programmable read only memory (Programmable Read-Only
Memory, PROM), erasable read-only memory (Erasable Programmable Read-Only Memory, EPROM),
Electricallyerasable ROM (EEROM) (Electric Erasable Programmable Read-Only Memory, EEPROM) etc..
Wherein, memory 11 is for storing program, and the processor 12 executes described program after receiving and executing instruction.
The processor 12 may be a kind of IC chip, the processing capacity with data.Above-mentioned processor 12
Can be general processor, including central processing unit (Central Processing Unit, CPU), network processing unit
(Network Processor, NP) etc..It may be implemented or execute each method, step and logic diagram disclosed in the disclosure.
General processor can be microprocessor or the processor can also be any conventional processor etc..
Network module 13 is used to establish the communication connection between message processor 10 and external communications terminals by network,
Realize the transmitting-receiving operation of network signal and data.Above-mentioned network signal may include wireless signal or wire signal.
It is appreciated that structure shown in FIG. 1 is only to illustrate, message processor 10 may also include more than shown in Fig. 1
Either less component or with the configuration different from shown in Fig. 1.Hardware, software may be used in each component shown in Fig. 1
Or combinations thereof realize.
The disclosure also provides a kind of computer readable storage medium, including computer program.The computer program operation
When control the computer readable storage medium where message processor 10 execute following packet sampling method.
Fig. 2 is please referred to, message processor 10 realizes packet sampling by following steps.
Step S11, the Packet Classification that will be received.
In the present embodiment, various ways may be used and classify to data message, for example, and purpose identical in source address
It, can be according to source address and destination address by data message point in the case that the identical each data message in address corresponds to a kind of flow
Class, and then realize the traffic statistics to various types of data messages.
Fig. 3 is please referred to, according to source address and destination address by Packet Classification, step can be passed through
Rapid S111 and step S112 realizes the classification of data message.
Step S111 identifies the source address and destination address of data message.
Step S112 is identical by source address and the identical data message of destination address is divided into same type of datagram
Text.
In another example the data length distribution situation of the data message if desired transmitted in statistics network, can divide number in advance
Corresponding type identifies datagram after receiving data message when being located at different range value according to the data length of message
The data length of text is analyzed the value range and corresponding type that the data length is located at, and then is realized to various data lengths
Data message classification.In another example agreement situation used in the data message if desired transmitted in statistics network, it can be by agreement
The type of data message is divided, after receiving data message, agreement used in data message is identified, by agreement phase used
Same data message is divided into same class.For the mode classification of data message also to there is other, the present embodiment is not construed as limiting this.
Step S12 samples different types of data message by the sampling interval, obtains different types of data respectively
Message sample.
Fig. 4 is please referred to, it, can be by step S121 and step S122 to not after classifying to data message
The data message of same type is sampled respectively.
Step S121 counts the quantity of different types of data message respectively.
There are many modes of the quantity of statistical data message, for example, can pass through the quantity of counter statistics message.
When by the quantity of counter statistics message, for same type of data message, may be used a counter into
Row quantity statistics, for a plurality of types of data messages, then distribution counting device group, quantity statistics, meter are carried out using counter group
Each counter in number device group is respectively used to count the quantity of different types of data message, such as distributes the addresses 64K as counting
The address of device group, each counter in counter group is corresponding with initial address respectively, when receiving data message, according to the number
According to the feature calculation hash value of message, the data message corresponding quantity statistics in counter group are determined according to hash value
Location, and the count value of the corresponding counter in quantity statistics address is added 1, to realize the number to different types of data message
Amount statistics.
Wherein it is possible to calculate hash value by various features, for example, according to source address and destination address by data message
In the case of classification, hash value, correspondingly, the number of data message can be calculated by the source address and destination address of data message
Amount statistics address be initial address and the data message of the counter of data message for counting the type hash value it
With.
Quantity statistics address can also be obtained by other means, for example, being carried out to data message according to data length
In the case of classification, each value range can be given to distribute fixing address, for example, it is less than 128 data message for data length, it can
To set constant offset as 1, for data message of the data length between 128~256, constant offset can be set as 2
Deng.The initial address of the counter of distribution is deviated into corresponding fixed offset value as the data that data length is respective range value
The quantity statistics address of message.
Step S122, for different types of data message, the quantity obtained according to statistics is adopted according to the sampling interval
Sample.
In the case where counting the quantity of various types of data messages by counter group, in the counting of arbitrarycounter
When value meets the sampling interval, the data message of the counter corresponding types is once sampled, to which sampling obtains not
The data message sample of same type.
Count value meets the sampling interval and includes, and count value is carried out data to sampling interval modulus if modulus value is 0
Packet sampling.Wherein, the sampling interval can flexibly set, for example, can be 1999:1、1000：1、75:1、50:1 etc., it is adopting
1000 are divided between sample：In the case of 1, when 1000 integral multiple such as count value 1000,2000,3000,4000, by count value pair
The modulus value of sampling interval modulus is 0, carries out data message sampling.The mode of sampling can flexibly be set, for example, can carry out suitable
Sequence samples, can also stochastical sampling.The present embodiment is not restricted this.
Considered based on cost performance, in the case where counting the quantity of various types of data messages by counter group, meter
Number device groups be stored in message processor 10 dynamic random access memory (Dynamic Random Access Memory,
DRAM in).DRAM memory spaces are larger, disclosure satisfy that count requirement, and cheap.
Step S12 is being executed, after completing to the sampling of various types of data messages in network, following step can be executed
Suddenly.
Step S13, the data message sample that replica samples obtain.
Wherein it is possible to realize the duplication of the data message sample obtained to sampling by image feature.
A copy of it data message sample obtained after duplication is sent to NetStream business boards by step S14, will be another
A data message sample is forwarded.
A copy of it data message sample obtained after duplication is sent to NetStream business boards, NetStream business
Plate can be for statistical analysis to various types of data message samples etc. business, for example, by source address is identical and destination
In the case that the identical data message in location is divided into same type of data message, pass through the data message sample obtained to sampling
Analysis, accounting of the different types of data message in sample objects can be analyzed.
In the present embodiment, is sampled using the identical sampling interval for various types of data messages, set by Dui
The analysis of the quantity variance of the different types of data message sample sampled in timing is long, you can obtain various types of data
Accounting of the corresponding flow of message in sample objects.
Another data message sample is forwarded, the operation of the transmission to the data message received can be realized.
In order to more clearly illustrate the implementation in the disclosure, by source address is identical and the identical number of destination address
It is divided into same type of data message according to message, for packet sampling scheme is applied in NetStream technologies, to the disclosure
Workflow be illustrated.
Assuming that the source IP address (Internet Protocol Address) of user is 10.0.0.1, which mainly visits
It asks that two destination addresses, purpose IP address are respectively 15.0.0.1 and 25.0.0.1, is denoted as DIP1 and DIP2 respectively, user accesses
The rate of DIP1 is 10pps, and the rate for accessing DIP2 is 10Mpps, will be set as 1000 in the sampling interval：1, the visit to the user
Ask the Netstream sampling statistics that situation carries out 10 minutes, then, implementation process is as follows.
The source address of each data message and destination address show that there are two kinds of datagrams in network in identification network
Text, wherein the data message of the first type is to be sent to purpose IP address 15.0.0.1 by source IP address 10.0.0.1, second
The data message of type is to be sent to purpose IP address 25.0.0.1 by source IP address 10.0.0.1.
Since the rate of the data message of second of type of transmission is the rate for the data message for transmitting the first type
1000000 times, quantity statistics are carried out to two kinds of data message using counter group respectively, using counter group into line number
The mode counted according to message amount is as follows：Cyclic redundancy check (CRC) 16 is carried out using source IP address+purpose IP address to calculate, and is obtained
Hash value to the data message of the first type is 0xe6e6, and the hash value of the data message of second of type is 0x9493.
It is 0~64k to distribute a segment counter address.Then the corresponding statistics address of the data message of the first type is stat1：
The corresponding statistics address of data message of 0xe6e6, second of type are stat2：0x9493.Often enter first type
Data message, stat1 cumulative 1 often enters the data message of second of type, stat2 cumulative 1.Ideally, 10
After minute, the message number of stat1 is added to 10pps*60s*10min=6000, and the message number of stat2 is added to 10Mpps*
60s*10min=6000M.
By 1000：1 sampling interval respectively samples two kinds of data message, ideally, 10 minutes
Sampled result it is as follows：The number of samples of the data message of first type is 10pps*60s*10min/1000=6；Second
The number of samples of the data message of type is 10Mpps*60s*10min/1000=6000000.
The two kinds of data message sample that replica samples obtain, a copy of it data message sample that will be obtained after duplication
Originally NetStream business boards are sent to, another data message sample is forwarded.
NetStream business boards are according to the data message sample of the data message sample and second of type of the first type
Quantity variance：6：6000000=1：1000000, you can show that the corresponding flow of the data message of the first type is sampling
Accounting in object is about 1：1000001, the accounting of the corresponding flow of data message of second of type in sample objects is about
It is 1000000：1000001.
It, will according to sample mode in the prior art since the transmission rate difference of two kinds of data message is very big
The data message of first type and the data message of second of type, which are put together, carries out data statistics, every 1000 datagrams
In text sample a data message, due to two kinds of data message be not the regular arrangement within the unit interval, first
The data message maximum probability of type will not be sampled, even if the data message of the first type is sampled, such as be adopted
For sample to 5, the ratio between the flow of data message of the data message of the first type and second of type also can be than actual stream
As many as the ratio between amount difference 20%.
It, can be reliably to various types of numbers by above-mentioned analysis it is found that using the packet sampling scheme in the disclosure
It is sampled according to message, sampled result is more reliable, can correctly reflect various types of data messages in sample objects
Accounting.
On the basis of the above, as shown in figure 5, present disclose provides a kind of packet sampling device 20, the packet sampling dress
It includes sort module 21 and sampling module 22 to set 20.
Wherein, the Packet Classification that sort module 21 is used to receive.
Since sort module 21 is similar with the realization principle of step S11 in Fig. 2, thus do not illustrate more herein.
Sort module 21 includes Address Recognition submodule 211 and category division submodule 212.
Wherein, the source address and destination address of the data message for identification of Address Recognition submodule 211.
Since Address Recognition submodule 211 is similar with the realization principle of step S111 in Fig. 3, thus do not speak more more herein
It is bright.
Category division submodule 212 is for source address is identical and the identical data message of destination address to be divided into same class
The data message of type.
Since category division submodule 212 is similar with the realization principle of step S112 in Fig. 3, thus do not speak more more herein
It is bright.
Sampling module 22 obtains different type for being sampled respectively to different types of data message by the sampling interval
Data message sample.
Since sampling module 22 is similar with the realization principle of step S12 in Fig. 2, thus do not illustrate more herein.
Sampling module 22 includes quantity statistics submodule 221 and sampling submodule 222.
Quantity statistics submodule 221 is used to count the quantity of different types of data message respectively.
Since quantity statistics submodule 221 is similar with the realization principle of step S121 in Fig. 4, thus do not speak more more herein
It is bright.
Submodule 222 is sampled, for being directed to different types of data message, the quantity obtained according to statistics is according between sampling
Every being sampled.
Since sampling submodule 222 is similar with the realization principle of step S122 in Fig. 4, thus do not illustrate more herein.
Wherein, quantity statistics submodule 221 includes counter group allocation unit 2211 and statistic unit 2212.
Counter group allocation unit 2211 is used for distribution counting device group, and each counter in the counter group is respectively used to
Count the number of different types of data message.
Statistic unit 2212 is used for when receiving data message, according to the feature calculation hash value of the data message, root
The corresponding quantity statistics address of the data message is determined according to the hash value, and by the corresponding counter in quantity statistics address
Count value adds 1.
It samples submodule 222 to be specifically used for when the count value of arbitrarycounter meets the sampling interval, to the counting
The data message of device corresponding types is once sampled, to which sampling obtains different types of data message sample.
Optionally, packet sampling device 20 further includes replication module 23, processing module 24 and flow analysis module 25.
Replication module 23 is used for the data message sample that replica samples obtain.
Since replication module 23 is similar with the realization principle of step S13 in Fig. 2, thus do not illustrate more herein.
A copy of it data message sample that processing module 24 is used to obtain after replicating is sent to NetStream business
Another data message sample is forwarded by plate.
Since processing module 24 is similar with the realization principle of step S14 in Fig. 2, thus do not illustrate more herein.
Flow analysis module 25, the quantity variance of the different types of data message sample for being obtained according to sampling, is obtained
Obtain accounting of the corresponding flow of various types of data messages in sample objects.
Realization principle about packet sampling device 20 can refer to the description in packet sampling method, thus not make herein
It repeats.
Packet sampling method, apparatus in the disclosure and message processor are distinguished for different types of data message
Sampled, so as to reliably be sampled to various types of data messages so that sampled result it is relatively reliable and
Accurately, counter group is dexterously selected to carry out the quantity statistics of data message, counter group is stored in DRAM, hardly increases
Hardware cost and software cost and easy to operate, it is big to avoid the occupied space recorded using modes such as flow tables present in flow,
The problems such as software programming is complicated.
In several embodiments that the disclosure is provided, it should be understood that disclosed device and method can also pass through
Other modes are realized.Device and method embodiment described above is only schematical, for example, the flow chart in attached drawing
The device of multiple embodiments according to the disclosure, the system in the cards of method and computer program product are shown with block diagram
Framework, function and operation.In this regard, each box in flowchart or block diagram can represent a module, section or code
A part, the part of the module, section or code includes one or more for implementing the specified logical function
Executable instruction.It should also be noted that at some as in the realization method replaced, the function of being marked in box can also be with not
It is same as the sequence marked in attached drawing generation.For example, two continuous boxes can essentially be basically executed in parallel, they have
When can also execute in the opposite order, this is depended on the functions involved.It is also noted that in block diagram and or flow chart
Each box and the box in block diagram and or flow chart combination, the dedicated of function or action as defined in executing can be used
Hardware based system is realized, or can be realized using a combination of dedicated hardware and computer instructions.
In addition, each function module in each embodiment of the disclosure can integrate to form an independent portion
Point, can also be modules individualism, can also two or more modules be integrated to form an independent part.
It, can be with if the function is realized and when sold or used as an independent product in the form of software function module
It is stored in a computer read/write memory medium.Based on this understanding, the technical solution of the disclosure is substantially in other words
The part of the part that contributes to existing technology or the technical solution can be expressed in the form of software products, the meter
Calculation machine software product is stored in a storage medium, including some instructions are used so that a computer equipment (can be
People's computer, message processor or network equipment etc.) execute each embodiment the method for the disclosure all or part
Step.And storage medium above-mentioned includes：It is USB flash disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random
Access various Jie that can store program code such as memory (RAM, Random Access Memory), magnetic disc or CD
Matter.It should be noted that herein, the terms "include", "comprise" or its any other variant are intended to nonexcludability
Include so that including a series of elements process, method, article or equipment not only include those elements, but also
Including other elements that are not explicitly listed, or further include for this process, method, article or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that wanted including described
There is also other identical elements in the process, method, article or equipment of element.
The foregoing is merely the alternative embodiments of the disclosure, are not limited to the disclosure, for the skill of this field
For art personnel, the disclosure can have various modifications and variations.It is all within the spirit and principle of the disclosure, made by any repair
Change, equivalent replacement, improvement etc., should be included within the protection domain of the disclosure.
Claims (14)
1. a kind of packet sampling method is applied to message processor, which is characterized in that the method includes：
The Packet Classification that will be received；
Different types of data message is sampled respectively by the sampling interval, obtains different types of data message sample.
2. packet sampling method according to claim 1, which is characterized in that by the step of the Packet Classification received
Suddenly, including：
Identify the source address and destination address of data message；
It is source address is identical and the identical data message of destination address is divided into same type of data message.
3. packet sampling method according to claim 1, which is characterized in that by the sampling interval to different types of datagram
The step of text is sampled respectively, including：
The quantity of different types of data message is counted respectively；
For different types of data message, the quantity obtained according to statistics is sampled according to the sampling interval.
4. packet sampling method according to claim 3, which is characterized in that count different types of data message respectively
The step of quantity, including：
When receiving data message, according to the feature calculation hash value of the data message, which is determined according to the hash value
Add 1 according to the corresponding quantity statistics address of message, and by the count value of the corresponding counter in quantity statistics address；
For different types of data message, the step of quantity obtained according to statistics is sampled according to the sampling interval, including：
When the count value of arbitrarycounter meets the sampling interval, one is carried out to the data message of the counter corresponding types
Secondary sampling, to which sampling obtains different types of data message sample.
5. packet sampling method according to any one of claims 1 to 4, which is characterized in that the method further includes：
The data message sample that replica samples obtain；
A copy of it data message sample obtained after duplication is sent to NetStream business boards, by another data message
Sample is forwarded.
6. packet sampling method according to any one of claims 1 to 4, which is characterized in that the method further includes：
According to the quantity variance for the different types of data message sample that sampling obtains, obtains various types of data messages and correspond to
Accounting of the flow in sample objects.
7. a kind of packet sampling device, it is applied to message processor, which is characterized in that the packet sampling device includes：
Sort module, the Packet Classification for will receive；
Sampling module obtains different types of number for being sampled respectively to different types of data message by the sampling interval
According to message sample.
8. packet sampling device according to claim 7, which is characterized in that the sort module includes：
Address Recognition submodule, for identification source address and destination address of data message；
Category division submodule, for source address is identical and the identical data message of destination address to be divided into same type of number
According to message.
9. packet sampling device according to claim 7, which is characterized in that the sampling module includes：
Quantity statistics submodule, the quantity for counting different types of data message respectively；
Submodule is sampled, for being directed to different types of data message, the quantity obtained according to statistics is carried out according to the sampling interval
Sampling.
10. packet sampling device according to claim 9, which is characterized in that the quantity statistics submodule includes：
Statistic unit, for when receiving data message, according to the feature calculation hash value of the data message, according to described
Hash value determines the corresponding quantity statistics address of the data message, and by the count value of the corresponding counter in quantity statistics address
Add 1；
The sampling submodule is specifically used for, when the count value of arbitrarycounter meets the sampling interval, to the counter
The data message of corresponding types is once sampled, to which sampling obtains different types of data message sample.
11. according to claim 7 to 10 any one of them packet sampling device, which is characterized in that the packet sampling device
Further include：
Replication module, the data message sample obtained for replica samples；
Processing module, a copy of it data message sample for being obtained after replicating are sent to NetStream business boards, will be another
A data message sample is forwarded.
12. according to claim 7 to 10 any one of them packet sampling device, which is characterized in that the packet sampling device
Further include：
Flow analysis module, the quantity variance of the different types of data message sample for being obtained according to sampling obtain various
Accounting of the corresponding flow of data message of type in sample objects.
13. a kind of message processor, which is characterized in that including：
Memory；
Processor；And
Packet sampling device, the packet sampling device include：
Sort module, the Packet Classification for will receive；
Sampling module obtains different types of number for being sampled respectively to different types of data message by the sampling interval
According to message sample.
14. a kind of computer readable storage medium, which is characterized in that the computer readable storage medium includes computer journey
Sequence, the message processor perform claim requirement computer program controls the computer readable storage medium when running where
1~6 any one of them packet sampling method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810169894.5A CN108429657A (en) | 2018-02-28 | 2018-02-28 | Packet sampling method, apparatus and message processor |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810169894.5A CN108429657A (en) | 2018-02-28 | 2018-02-28 | Packet sampling method, apparatus and message processor |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN108429657A true CN108429657A (en) | 2018-08-21 |
Family
ID=63157377
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810169894.5A Pending CN108429657A (en) | 2018-02-28 | 2018-02-28 | Packet sampling method, apparatus and message processor |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108429657A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021031190A1 (en) * | 2019-08-22 | 2021-02-25 | 北京大学深圳研究生院 | Router and data packet evaluation method thereof |
| CN112422360A (en) * | 2020-10-14 | 2021-02-26 | 锐捷网络股份有限公司 | Message sampling method, device, equipment and medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102130789A (en) * | 2011-04-15 | 2011-07-20 | 北京网御星云信息技术有限公司 | Method, device and system for measuring and sampling streams based on application groups |
| US8615742B2 (en) * | 2010-11-16 | 2013-12-24 | International Business Machines Corporation | Autonomic hotspot profiling using paired performance sampling |
| CN106156328A (en) * | 2016-07-06 | 2016-11-23 | 中国银行股份有限公司 | A kind of bank's running log data monitoring method and system |
| CN106656971A (en) * | 2016-10-14 | 2017-05-10 | 福建星瑞格软件有限公司 | Service behavior data acquisition system |
| CN107070745A (en) * | 2017-03-31 | 2017-08-18 | 武汉绿色网络信息服务有限责任公司 | Unknown flow rate analysis method caused by a kind of rule is omitted |
| CN107239232A (en) * | 2017-05-10 | 2017-10-10 | 华立科技股份有限公司 | Date storage method for electric energy meter |
-
2018
- 2018-02-28 CN CN201810169894.5A patent/CN108429657A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8615742B2 (en) * | 2010-11-16 | 2013-12-24 | International Business Machines Corporation | Autonomic hotspot profiling using paired performance sampling |
| CN102130789A (en) * | 2011-04-15 | 2011-07-20 | 北京网御星云信息技术有限公司 | Method, device and system for measuring and sampling streams based on application groups |
| CN106156328A (en) * | 2016-07-06 | 2016-11-23 | 中国银行股份有限公司 | A kind of bank's running log data monitoring method and system |
| CN106656971A (en) * | 2016-10-14 | 2017-05-10 | 福建星瑞格软件有限公司 | Service behavior data acquisition system |
| CN107070745A (en) * | 2017-03-31 | 2017-08-18 | 武汉绿色网络信息服务有限责任公司 | Unknown flow rate analysis method caused by a kind of rule is omitted |
| CN107239232A (en) * | 2017-05-10 | 2017-10-10 | 华立科技股份有限公司 | Date storage method for electric energy meter |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021031190A1 (en) * | 2019-08-22 | 2021-02-25 | 北京大学深圳研究生院 | Router and data packet evaluation method thereof |
| CN112422360A (en) * | 2020-10-14 | 2021-02-26 | 锐捷网络股份有限公司 | Message sampling method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2021135532A1 (en) | Cloud network vulnerability discovery method, apparatus, electronic device, and medium | |
| CN105591973B (en) | Application identification method and device | |
| CN109600441B (en) | Alliance link information publishing control method and terminal equipment | |
| CN109542786A (en) | Visual testing method and device | |
| WO2020039337A1 (en) | Identifying device types based on behavior attributes | |
| CN110213124A (en) | Passive operation system identification method and device based on the more sessions of TCP | |
| CN107038108A (en) | The method of testing and device of software | |
| CN108429657A (en) | Packet sampling method, apparatus and message processor | |
| CN109561300A (en) | Quality of service detection method and device | |
| CN112564991A (en) | Application identification method and device and storage medium | |
| CN108712496B (en) | Port mirroring method and device of OLT (optical line terminal) equipment | |
| CN108197050B (en) | Equipment identification method, device and system | |
| CN113765728B (en) | Network detection method, device, equipment and storage medium | |
| CN112688924A (en) | Network protocol analysis system | |
| CN110839007A (en) | Cloud network security processing method and device and computer storage medium | |
| CN115514579B (en) | Method and system for realizing service identification based on IPv6 address mapping flow label | |
| US8576717B2 (en) | System and method for detecting rogue traffic using flow statistics with a list of authorized engines | |
| TW201429189A (en) | Method and device for testing network equipment | |
| US20230161634A1 (en) | Mapping an application signature to designated cloud resources | |
| KR101414176B1 (en) | Apparatus and method for analyzing vulnerability of zigbee network | |
| CN113807373B (en) | Traffic identification method and device, equipment and storage medium | |
| US20200344113A1 (en) | Anonymizing action implementation data obtained from incident analysis systems | |
| CN110995887B (en) | ID association method and device | |
| CN114006838B (en) | Testing method and system of flow control device | |
| CN108322485A (en) | Free switching method and device based on NB-IoT networks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20180821 |
|
| RJ01 | Rejection of invention patent application after publication |