CN109547257A - Method for controlling network flow, device, equipment, system and storage medium - Google Patents

Abstract

The invention discloses a kind of method for controlling network flow, this method comprises: obtaining preset configuration information corresponding with the packet amount warning information when detecting the packet amount warning information of destination network device；The configuration information is packaged into the remote procedure call rpc message based on NETCONF agreement；The rpc message is issued to the destination network device, so that the destination network device executes corresponding control of network flow quantity emergency operation according to the rpc message.The invention also discloses a kind of control of network flow quantity device, equipment, system and a kind of storage mediums.The present invention, which can be realized, carries out flow control efficient, precisely, stable and inexpensive to the network equipment under bank's basic network architectures.

Description

Network flow control method, device, device, system and storage medium

technical field

The present invention relates to the field of communication technologies, and in particular, to a network flow control method, apparatus, device, system and storage medium.

Background technique

At present, the corresponding emergency operations based on network traffic monitoring mainly include two methods:

The first is to monitor traffic based on the SNMP (Simple Network Management Protocol) protocol, and then log in to the traditional switch from the springboard using the traditional CLI (command-line interface, command-line interface) method based on the notifications generated by the monitoring. Take appropriate emergency actions. This method is currently the most widely used method in the infrastructure of major banks, that is, the network environment is monitored based on the SNMP protocol. A series of network configurations such as firewalls. The disadvantages of this approach are:

1. Slow emergency operation: For some emergency operations such as firewall bypass, it is necessary to perform configuration operations on multiple devices. At this time, manual input not only consumes time and manpower, but also affects the stability of production and operation; 2. Weak programmability: different There are differences in the manufacturer's instructions, and there is no unified standard for the configuration method; 3. Poor macroscopic: the operator only configures the network devices one by one, rather than the entire network; 4. The operation and maintenance consumption is high: under normal circumstances, the The OIDs (Object identifiers) of some of the same indicators are different, which increases the cost of operation and maintenance only at the monitoring level and increases the difficulty of monitoring application development.

The second is to monitor network traffic based on the sflow protocol, and then based on the notification generated by the monitoring, based on the openflow protocol (a network communication protocol, which belongs to the data link layer and can control the forwarding plane of the network switch or router, thereby changing the The network path taken by the network data packets) configure a real switch (which needs to support the openflow protocol) or issue a flow table to the OVS (Open VSwitch) virtual switch to complete the corresponding emergency operations. The disadvantages of this approach are:

1. General adaptability in the financial industry: Since the network architecture of the financial industry (traditional banks, securities companies) takes stability as the first priority, and this solution needs to redesign a new network architecture (the coexistence of OVS virtual switches and physical switches is required), this It will have a big impact on the stable operation of the bank; 2. Expensive: new SDN (software-defined networking, software-defined networking) software development talents are needed in terms of manpower, and physical switches that support the openflow protocol need to be purchased in terms of material resources.

Based on the shortcomings of the above two solutions, there is currently a lack of an efficient, accurate, stable and low-cost flow control solution for network equipment under the bank's basic network architecture.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide a network flow control method, device, equipment, system and storage medium, aiming at realizing efficient, accurate, stable and low-cost flow control of network equipment under the basic network architecture of the bank.

In order to achieve the above object, the present invention provides a network flow control method, the network flow control method includes the following steps:

When detecting the packet volume alarm information of the target network device, obtain preset configuration information corresponding to the packet volume alarm information;

The configuration information is encapsulated into a remote procedure call rpc message based on the NETCONF protocol;

The rpc message is delivered to the target network device, so that the target network device performs a corresponding emergency network flow control operation according to the rpc message.

Preferably, before the step of acquiring preset configuration information corresponding to the packet volume alarm information when the packet volume alarm information of the target network device is detected, the method further includes:

Obtain the packet volume information of the data packets flowing through the target network device collected by the packet volume collection device;

analyzing the packet volume information to determine whether the packet volume information meets a preset packet volume alarm condition;

If yes, generate packet volume alarm information of the target network device.

Preferably, the step of delivering the rpc message to the target network device so that the target network device performs corresponding emergency network traffic control operations according to the rpc message includes:

The rpc message is delivered to the target network device through the preset NETCONF southbound interface, so that the target network device performs a corresponding emergency network flow control operation according to the rpc message. Actions include one or more of closing target network device ports, setting access control lists, firewall bypassing, and virtual private network refresh.

Preferably, the step of delivering the rpc message to the target network device through a preset NETCONF southbound interface includes:

When there are multiple target network devices, the rpc message is delivered to the multiple target network devices in parallel through the preset NETCONF southbound interface.

Preferably, before the step of acquiring preset configuration information corresponding to the packet volume alarm information when the packet volume alarm information of the target network device is detected, the method further includes:

Receive the network flow control rule information delivered by the foreground application through the NETCONF northbound interface, and save the network flow control rule information, wherein the network flow control rule information includes the packet volume alarm information and the configuration information. Correspondence;

The step of acquiring preset configuration information corresponding to the packet volume alarm information when detecting the packet volume alarm information of the target network device includes:

When the packet volume alarm information of the target network device is detected, the configuration information corresponding to the packet volume alarm information is read from the stored network flow control rule information.

In addition, in order to achieve the above object, the present invention also provides a device, and the network traffic control device includes:

a configuration information acquisition module, configured to acquire preset configuration information corresponding to the packet volume alarm information when detecting the packet volume alarm information of the target network device;

an encapsulation module for encapsulating the configuration information into a remote procedure call rpc message based on the NETCONF protocol;

A delivery module, configured to deliver the rpc message to the target network device, so that the target network device performs a corresponding emergency operation of network flow control according to the rpc message.

In addition, in order to achieve the above object, the present invention also provides a network flow control device, the network flow control device includes: a memory, a processor, and a network flow control device stored on the memory and running on the processor A program, when the network flow control program is executed by the processor, implements the steps of the network flow control method described above.

In addition, in order to achieve the above object, the present invention also provides a network flow control system, the network flow control system includes a network flow control device and a packet volume collection device; wherein,

The network flow control device is the above-mentioned network flow control device;

The packet volume collection device is configured to collect the packet volume information of the data packets flowing through the target network device, and send the collected packet volume information to the network flow control device.

Preferably, the packet collection device is an sFlow collector using the sFlow protocol, and the sFlow collector is used to:

receiving the flow data of the port of the target network device forwarded by an sFlow agent, where the sFlow agent is embedded in the target network device and used to collect the first flow data of the port of the target network device;

The first traffic data is analyzed to obtain packet volume information of the data packets flowing through the target network device.

Preferably, the packet collection device is an SNMP collector that adopts the simple network protocol SNMP, and the SNMP collector is used to:

According to the preset object identifier ODI, query the traffic data of the port of the target network device from the SNMP agent, where the SNMP agent is embedded in the target network device and used to collect the second traffic data of the port of the target network device ;

The second traffic data is analyzed to obtain packet volume information of the data packets flowing through the target network device.

In addition, in order to achieve the above object, the present invention also provides a storage medium on which a network flow control program is stored, and when the network flow control program is executed by a processor, the steps of the above network flow control method are implemented .

The network flow control method proposed by the present invention reduces the number of interactions by using the NETCONF protocol to perform the control interaction between the network flow control device and the target network device, and is more efficient and stable than the traditional multi-interaction CLI mode. It does not need to make large-scale changes to the existing network architecture of the bank, nor does it need to change the routing protocols directly related to production, which saves manpower and material costs; in addition, because the correspondence between packet volume alarm information and configuration information can be flexibly Therefore, accurate flow control can be achieved according to the corresponding relationship. Therefore, the present invention realizes efficient, accurate, stable and low-cost flow control for the network equipment under the basic network architecture of the bank.

Description of drawings

1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a first embodiment of a network traffic control method according to the present invention;

FIG. 3 is a schematic diagram of packet volume collection and reporting performed by an sFlow collector in an embodiment of the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

As shown in FIG. 1 , FIG. 1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention.

The network flow control device in this embodiment of the present invention may be a PC or a server device.

As shown in FIG. 1 , the device may include: a processor 1001 , such as a CPU, a network interface 1004 , a user interface 1003 , a memory 1005 , and a communication bus 1002 . Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (eg, a WI-FI interface). The memory 1005 may be high-speed RAM memory, or may be non-volatile memory, such as disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the terminal structure shown in FIG. 1 does not constitute a limitation on the terminal, and may include more or less components than the one shown, or combine some components, or arrange different components.

As shown in FIG. 1 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module and a network flow control program.

In the terminal shown in FIG. 1 , the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the user interface 1003 is mainly used to connect to the client (client) and perform data communication with the client; and the processor 1001 can be used to call the network flow control program stored in the memory 1005, and perform operations in various embodiments of the network flow control method described below.

Based on the above hardware structure, various embodiments of the network traffic control method of the present invention are proposed.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a first embodiment of a network traffic control method according to the present invention. The network traffic control method includes:

Step S10, when detecting the packet volume alarm information of the target network device, obtain preset configuration information corresponding to the packet volume alarm information;

In this embodiment, the network flow control device can detect in real time whether there is packet volume alarm information of the target network device, wherein the target network device is one or more preset network devices that need to perform flow control, such as a router, Switches, firewalls, and other devices with network forwarding functions. When the packet volume alarm information of the target network device is detected, it indicates that the data packets currently flowing through the target network device are abnormal, for example, when the target network device is attacked by ddos (distributed denial-of-service attack) , the data packet volume flowing through the target network device will increase sharply, and the packet volume alarm will be triggered at this time.

When the packet volume alarm information is detected, the preset configuration information corresponding to the packet volume alarm information is obtained first. Specifically, as an implementation manner, before the above step S10, it may include the steps of: receiving the network flow control rule information delivered by the foreground application through the NETCONF northbound interface, and saving the network flow control rule information, wherein all the The network flow control rule information includes the correspondence between the packet volume alarm information and the configuration information; at this time, step S10 can be replaced with: when the packet volume alarm information of the target network device is detected, from the saved network The configuration information corresponding to the packet volume alarm information is read from the flow control rule information.

Among them, NETCONF is a network device communication protocol. The NETCONF northbound interface is an interface that is provided upward to foreground applications for access and management based on the NETCONF protocol. During specific implementation, network engineers can configure network flow control rule information based on the foreground application. , the network flow control rule information contains the corresponding relationship between the packet volume alarm information and the configuration information, and then the foreground application sends the network flow control rule information to the network flow control device through the NETCONF northbound interface, and the network flow control device is in the When receiving the network flow control rule information issued by the foreground application, the network flow control rule information is saved. Subsequently, when the network flow control device detects the packet volume alarm information of the target network device, the configuration information corresponding to the detected packet volume alarm information can be read from the stored network flow control rule information.

It should be noted that the network engineer can flexibly configure and modify the network flow control rule information based on the foreground application. When the network flow control rule information changes, the foreground application will use the NETCONF northbound interface to inform the network flow control device, so that the network flow control device can be controlled. Update the locally saved network traffic control rule information.

Step S20, encapsulating the configuration information into a remote procedure call rpc message based on the NETCONF protocol;

After acquiring the configuration information corresponding to the current packet volume alarm information, the configuration information is encapsulated into a remote procedure call rpc message based on the NETCONF protocol. For ease of understanding, the content and principles of the NETCONF protocol are introduced as follows:

NETCONF is a network equipment communication protocol, which has been widely supported by network equipment manufacturers. The NETCONF protocol adopts a layered design structure, which is similar to the OSI (Open System Interconnection, Open System Interconnection) network model. The lower layer provides services for the upper layer, and each layer is an encapsulation of a certain function. The NETCONF protocol is divided into 4 layers, from bottom to top, they are the security communication layer, the message layer, the operation layer and the content layer.

Secure communication layer: This layer provides a secure communication channel between the server and the client. This part is the bottom-level definition in the NETCONF protocol, and is also the first layer supported by network devices. When the NETCONF protocol used in this solution is used for communication, the low-level communication is completed by the library of SSH (Secure Shell, Secure Shell) to connect the network device.

Message layer: NETCONF uses the rpc (Remote Procedure Call, Remote Procedure Call) mechanism. Some simple rpc messages are defined here, which are implemented through XML (Extensible Markup Language) tags. For example <rpc>\<rpc-reply>.

Operation layer: This layer is also based on XML markup. RFC6241 defines the following method: <get>\<get-config>\<edit-config>\<copy-config>\<delete-config>\lock\unlock\clo se-session, in the documentation for legacy Cisco nexus devices There is also support for this level.

Content layer: The content layer describes the configuration data involved in network management. Since the NETCONF content layer is the only layer that has not been standardized, there is no standard NETCONF data modeling language and data model, so the configuration data of equipment from various manufacturers may not be the same. same.

In essence, the netconf protocol transmits rpc messages one by one, and these rpc messages are implemented through XML (Extensible Markup Language) tags. In this embodiment, the process for the network flow control device to encapsulate the preset configuration information corresponding to the packet volume alarm information into a remote procedure call rpc message based on the NETCONF protocol may be as follows: first, a netconf model is established according to the configuration information, and the netconf model describes the Strongly related data of network devices, such as device configuration and running status, etc., the netconf model of each device is described in YANG language (a data structure language); then XML tags are written according to the established netconf model, and then according to the XML tags Generate rpc messages.

Compared with CLI, NETCONF has obvious advantages: it reduces the number of interactions, operates on the configuration data of the entire system, and defines filtering functions. Moreover, this configuration method uses XML encoding, which greatly enhances the system compatibility and programmability, and has strong scalability.

Step S30, delivering the rpc message to the target network device, so that the target network device performs a corresponding emergency network flow control operation according to the rpc message.

In this step, the target network device supports the NETCONF protocol. The network flow control device sends the rpc message to the target network device. Since the rpc message is obtained by encapsulating the configuration information, the network device can execute the network flow control emergency corresponding to the configuration information after receiving the rpc message. The network traffic control emergency operation includes but is not limited to closing the port of the target network device, setting the access control list, bypassing the firewall, and refreshing the virtual private network, etc.

In addition, in the embodiment of the present invention, the method further includes: when the configuration of the switch needs to be changed, the network flow control device changes the configuration of the target network device via the NETCONF protocol, thereby realizing centralized management and control of the entire network packet flow.

In this embodiment, the control interaction between the network flow control device and the target network device is carried out by using the NETCONF protocol, which reduces the number of interactions, and is more efficient and stable than the traditional multi-interaction CLI mode, and does not require Large-scale changes to the existing network architecture of the bank do not need to change the routing protocols directly related to production, which saves manpower and material costs; in addition, since the correspondence between the packet volume alarm information and the configuration information can be flexibly This correspondence enables precise flow control. Therefore, this embodiment realizes efficient, accurate, stable and low-cost flow control for network devices under the basic network architecture of the bank.

Further, the first embodiment of the network flow control method of the present invention proposes the second embodiment of the network flow control method of the present invention. In this embodiment, before the above step S10, the method may further include: acquiring the packet volume information of the data packets flowing through the target network device collected by the packet volume collecting device; analyzing the packet volume information, and judging the packet volume Whether the information satisfies the preset packet volume alarm condition; if so, generates packet volume alarm information of the target network device.

In this embodiment, the packet volume information of the data packets flowing through the target network device may be collected by the packet volume collection device, and then the collected packet volume information may be sent to the network flow control device by the packet volume collection device.

The network flow control device obtains the packet volume information of the data packets flowing through the target network device collected by the packet volume collection device, and then judges whether the packet volume information satisfies the preset packet volume alarm condition, and if so, generates the packet volume alarm information. The packet volume alarm condition can be flexibly set, for example, the packet volume of a single network device port exceeds a preset threshold, or the total packet volume of multiple network device ports exceeds a preset threshold, and the like. It should be noted that, the packet collection device can be optionally embedded in the network flow control device, or can be an external device of the network flow control device. In order to improve the flexibility of network flow control, the packet collection device is preferably an external device of the network flow control device.

Further, the above step S30 may include: sending the rpc message to the target network device through a preset NETCONF southbound interface, so that the target network device performs corresponding network flow control according to the rpc message The emergency operation, the emergency operation of network flow control includes one or more of closing the port of the target network device, setting an access control list, bypassing the firewall and refreshing the virtual private network.

Among them, the NETCONF southbound interface is the interface provided based on the NETCONF protocol to manage the network management or equipment of other manufacturers. The network flow control device determines the corresponding emergency operation after analyzing the results of the flow monitoring, and passes the NETCONF southbound interface. The corresponding rpc message is sent to realize the scheduling of the entire network traffic.

For example, a network engineer applies and configures a rule in the foreground: when the packet volume of a certain port of the switch reaches an abnormal value, the port down (close) operation is automatically performed. The foreground application will use the NETCONF northbound interface to inform the network traffic control device; then the network traffic control device receives the sflow monitoring module (the sflow monitoring module is used to monitor the target network device; the packet volume collection device is embedded in the sflow monitoring module, the packet volume The collection device is used to collect the packet volume information of the data packets flowing through the target network device, and transmit it to the network flow control device). The RPC implementation is delivered to the interface. At this time, the port of the target network device will be closed immediately, and the abnormal packet will be discarded immediately.

Further, the step of sending the rpc message to the target network device through the preset NETCONF southbound interface may include: when there are multiple target network devices, through the preset NETCONF southbound interface, Delivering the rpc message to the multiple target network devices in parallel.

For example, in practical applications, the operation corresponding to avoiding ddos attacks in a real production network is often a large-scale operation, not only closing one port, but performing multiple operations on multiple devices. For this reason, network traffic control The device can encapsulate these operations into rpc based on the NETCONF protocol, and then concurrently issue configurations to multiple target network devices that support NETCONF through the preset NETCONF southbound interface, specifically through multi-threading to achieve simultaneous concurrency.

The above delivery method is more robust than the CLI method. The CLI requires multiple interactions, and the connection between the controller and the device may become unstable after a certain command is executed in the middle of the command delivery. This situation will affect the complete implementation of the operation. Very dangerous; and the rpc stream only needs to be sent once, so just confirm the connectivity of the network flow control device and the target network device at the beginning to avoid the risk of the above situation.

The invention also provides a network flow control device. The network flow control device of the present invention includes:

a configuration information acquisition module, configured to acquire preset configuration information corresponding to the packet volume alarm information when detecting the packet volume alarm information of the target network device;

an encapsulation module for encapsulating the configuration information into a remote procedure call rpc message based on the NETCONF protocol;

A delivery module, configured to deliver the rpc message to the target network device, so that the target network device performs a corresponding emergency operation of network flow control according to the rpc message.

Further, the network traffic control device further includes:

The packet volume information acquisition module is used to acquire the packet volume information of the data packets flowing through the target network device collected by the packet volume acquisition device;

a judgment module, configured to analyze the packet volume information, and determine whether the packet volume information satisfies a preset packet volume alarm condition;

An alarm module, configured to generate packet volume alarm information of the target network device if the packet volume information satisfies a preset packet volume alarm condition.

Further, the sending module is further configured to send the rpc message to the target network device through a preset NETCONF southbound interface, so that the target network device executes the corresponding rpc message according to the rpc message. The emergency operation of network flow control, the emergency operation of network flow control includes one or more of closing the port of the target network device, setting an access control list, bypassing the firewall and refreshing the virtual private network.

Further, the sending module is further configured to send the rpc message to the multiple target network devices in parallel through a preset NETCONF southbound interface when there are multiple target network devices.

Further, the network traffic control device further includes:

The receiving module is configured to receive the network flow control rule information sent by the foreground application through the NETCONF northbound interface, and save the network flow control rule information, wherein the network flow control rule information includes packet volume alarm information and Correspondence between configuration information;

The configuration information acquisition module is further configured to read configuration information corresponding to the packet volume alarm information from the stored network flow control rule information when detecting the packet volume alarm information of the target network device.

For the methods implemented by the above program modules, reference may be made to the embodiments of the network flow control method of the present invention, which will not be repeated here.

The invention also provides a network flow control system.

In an embodiment of the network flow control system of the present invention, the system includes a network flow control device and a packet volume collection device; wherein,

The network flow control device is the network flow control device described in the foregoing embodiment;

The packet volume collection device is configured to collect the packet volume information of the data packets flowing through the target network device, and send the collected packet volume information to the network flow control device.

In one embodiment, the packet volume collection device may be an sFlow collector that adopts the sFlow protocol, and the sFlow collector is configured to receive the traffic data of the port of the target network device forwarded by an sFlow agent, and the sFlow agent is embedded in the In the target network device, the first flow data of the port of the target network device is collected; the first flow data is analyzed to obtain the packet volume information of the data packets flowing through the target network device.

For ease of understanding, the sFlow technology is introduced as follows:

sFlow, whose name comes from the acronym for sampled flow, is an industry specification for measuring layer 2 packets of the OSI model. sFlow is based on the latest standard network export protocol (RFC3176), which can solve many problems faced by current network managers. By embedding sFlow technology into network routers and switch ASIC chips, the specification provides a way to sample network packet information, allowing network managers to understand how the network is doing.

Unlike solutions that require mirrored ports or network bypassers to monitor transit traffic, in sFlow's solution, not every packet is sent to the collector. sFlow provides two sampling methods for users to analyze network traffic conditions from different perspectives, namely Flow sampling and Counter sampling.

Flow sampling is a process in which a device samples and analyzes packets on a specified port according to a specific sampling direction and sampling ratio, and sends the analysis results to the Collector device through sFlow packets. The main information in the flow sampling packet includes some basic information of the original packet, such as destination IP and source IP. Counter sampling is a process in which the sFlow Agent periodically obtains traffic statistics on an interface and sends the statistics to the collector through sFlow packets. Counter sampling packets mainly contain some statistical information. Furthermore, sFlow can monitor the entire switch or just some of its ports using different sampling rates, allowing flexibility in designing management solutions.

sFlow can establish a benchmark for normal network usage (thresholds can be configured), and when network activities are found to deviate significantly from the benchmark, an alarm message will be issued, so as to effectively identify access policy violations and intrusions.

Referring to FIG. 3 , FIG. 3 is a schematic diagram of packet volume collection and reporting performed by an sFlow collector in an embodiment of the present invention. The present invention uses the idea of SDN (Software Defined Network, Software Defined Network) central control under the basic network architecture of the bank. In FIG. 3, the control management layer is used as the SDN control layer, the switch is used as the SDN forwarding layer, and the packet collection equipment is used from the control management layer. Separated, used to collect the packet volume information of the switch, and report the collected packet volume information to the control management layer. When the control management layer detects the packet volume alarm information, it sends an rpc message to the router, thereby Make the router perform the corresponding network traffic control emergency operation. Specifically, packet collection devices based on sFlow technology are divided into two categories: sFlow agents and sFlow collectors. In this embodiment, the sFlow collector receives the traffic data of the port of the target network device forwarded by the sFlow agent, where the sFlow agent can be embedded in the ASIC chip of the network routing and switching device, without purchasing additional probes and bypassers to fully Monitoring the entire network, the sFlow agent collects the traffic of each port on the target network device and forms sFlow data packets, and then forwards the flow data of the sFlow data packets to the sFlow collector. Packet volume information of the data packets of the target network device.

In another implementation manner, the packet collection device may be an SNMP collector that adopts the Simple Network Management Protocol (SNMP), and the SNMP collector is configured to query the SNMP agent for all information from the SNMP agent according to the preset object identifier ODI. The flow data of the port of the target network device, the SNMP agent is embedded in the target network device, and is used to collect the second flow data of the port of the target network device; Packet volume information of the data packets of the target network device. In this embodiment, the second flow data and the first flow data are the same data.

For ease of understanding, the SNMP technology is introduced as follows:

SNMP is a network management standard based on the TCP/IP protocol suite, and is a standard protocol for managing network nodes (such as firewalls, servers, workstations, routers, switches, etc.) in an IP network. The protocol consists of a set of network management standards, including an application layer protocol, a database schema, and a set of resource objects. The protocol enables network management systems to monitor devices connected to the network for any management concerns.

MIB (Management Information Base, Management Information Base) is a collection of objects, which represent the resources and devices that can be managed in the network. Each object is basically a data variable that represents information about one aspect of the managed object. OID (Object Identifier, Object Identifier) is a key value with a unique identification provided by the SNMP agent. The MIB also provides a mapping of digitized OIDs to readable text. There are many ways to implement SNMP-based network management tools. The simplest is to install net-snmp on a server to do network collection on the SNMP agent and then report it.

In this embodiment, the SNMP collector receives the traffic data of the port of the target network device forwarded by the SNMP agent, wherein the SNMP agent can be embedded in the ASIC chip of the network routing and switching device, the SNMP agent collects the traffic data of the port of the target network device, and then The traffic data is forwarded to the SNMP collector, and the SNMP collector analyzes the traffic data to obtain the packet volume information of the data packets flowing through the target network device.

It should be noted that, unlike sFlow, the SNMP function is relatively simple, and the traffic information it collects is only simple port outbound and inbound traffic statistics, which cannot be used for in-depth traffic analysis, which is not conducive to more expansion of network traffic control devices. The sFlow technology can collect other information including traditional packet headers, transmission protocol information, and physical transmission information in addition to the port outbound and inbound traffic information. Therefore, the sFlow technology is preferably used in this embodiment. Monitor and collect the traffic of the target network device, so that the network traffic control device can do more extensible function design, and further improve the accuracy of the traffic control.

In addition, for the method for performing network flow control by the network flow control device in this embodiment, reference may be made to each embodiment of the foregoing network flow control method, which will not be repeated here.

The network traffic control system proposed in this embodiment monitors the port traffic of network devices under the bank's basic network architecture by using the data stream collection technology, and then performs network traffic control emergency operations on the network devices under the bank's basic network architecture based on the NETCONF protocol. It realizes efficient, accurate, stable and low-cost flow control of network equipment under the bank's basic network architecture.

The present invention also provides a storage medium.

A network flow control program is stored on the storage medium of the present invention, and when the network flow control program is executed by the processor, the steps of the network flow control method described above are implemented.

For the method implemented when the network flow control program running on the processor is executed, reference may be made to the various embodiments of the network flow control method of the present invention, which will not be repeated here.

It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on such understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as ROM/RAM) as described above. , magnetic disk, optical disk), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

Claims (11)

1. A network flow control method is characterized by comprising the following steps:

when packet volume alarm information of target network equipment is detected, acquiring preset configuration information corresponding to the packet volume alarm information;

encapsulating the configuration information into a NETCONF protocol-based remote procedure call rpc message;

and sending the rpc message to the target network equipment so that the target network equipment executes corresponding network flow control emergency operation according to the rpc message.

2. The method as claimed in claim 1, wherein before the step of obtaining the configuration information corresponding to the packet volume alarm information when the packet volume alarm information of the target network device is detected, the method further comprises:

acquiring packet quantity information of data packets flowing through target network equipment, which is acquired by packet quantity acquisition equipment;

analyzing the packet quantity information, and judging whether the packet quantity information meets a preset packet quantity alarm condition;

and if so, generating packet volume alarm information of the target network equipment.

3. The method of claim 1 or 2, wherein the step of sending the rpc message to the target network device to enable the target network device to perform the corresponding network traffic control emergency operation according to the rpc message comprises:

and sending the rpc message to the target network equipment through a preset NETCONF southbound interface so that the target network equipment executes corresponding network flow control emergency operation according to the rpc message, wherein the network flow control emergency operation comprises one or more of closing a target network equipment port, setting an access control list, bypassing a firewall and refreshing a virtual private network.

4. The method according to claim 3, wherein the step of sending the rpc message to the target network device through a preset NETCONF southbound interface comprises:

and when a plurality of target network devices exist, the rpc message is sent to the target network devices in parallel through a preset NETCONF southbound interface.

5. The method as claimed in claim 1, wherein before the step of obtaining the configuration information corresponding to the packet volume alarm information when the packet volume alarm information of the target network device is detected, the method further comprises:

receiving network flow control rule information issued by a foreground application through a NETCONF northbound interface, and storing the network flow control rule information, wherein the network flow control rule information comprises a corresponding relation between packet quantity alarm information and configuration information;

the step of acquiring preset configuration information corresponding to the packet volume alarm information when the packet volume alarm information of the target network device is detected comprises:

and when the packet volume alarm information of the target network equipment is detected, reading the configuration information corresponding to the packet volume alarm information from the stored network flow control rule information.

6. A network flow control device, comprising:

the configuration information acquisition module is used for acquiring preset configuration information corresponding to the packet volume alarm information when the packet volume alarm information of the target network equipment is detected;

the packaging module is used for packaging the configuration information into a NETCONF protocol-based remote procedure call rpc message;

and the issuing module is used for issuing the rpc message to the target network equipment so that the target network equipment executes corresponding network flow control emergency operation according to the rpc message.

7. A network traffic control device, characterized in that the network traffic control device comprises: memory, a processor and a network flow control program stored on the memory and executable on the processor, the network flow control program when executed by the processor implementing the steps of the network flow control method according to any of claims 1 to 5.

8. A network flow control system comprises a network flow control device and a packet quantity acquisition device; wherein,

the network traffic control device is the network traffic control device of claim 7;

the packet quantity acquisition device is used for acquiring packet quantity information of data packets flowing through the target network device and sending the acquired packet quantity information to the network flow control device.

9. The network flow control system according to claim 8, wherein the packet quantity collecting device is an sFlow collector using an sFlow protocol, the sFlow collector is configured to,

receiving flow data of the target network equipment port forwarded by an sFlow agent, wherein the sFlow agent is embedded in the target network equipment and is used for acquiring first flow data of the target network equipment port;

and analyzing the first flow data to obtain the packet volume information of the data packets flowing through the target network equipment.

10. The network flow control system of claim 8, wherein the packet volume collecting device is an SNMP collector using a simple network protocol (SNMP), the SNMP collector is configured to,

inquiring the flow data of the target network equipment port from an SNMP agent according to a preset object identifier (ODI), wherein the SNMP agent is embedded in the target network equipment and is used for acquiring second flow data of the target network equipment port;

and analyzing the second flow data to obtain the packet volume information of the data packets flowing through the target network equipment.

11. A storage medium having stored thereon a network traffic control program which, when executed by a processor, implements the steps of the network traffic control method according to any one of claims 1 to 5.