CN112532444B - Data flow sampling method, system, medium and terminal for network mirror flow - Google Patents
Data flow sampling method, system, medium and terminal for network mirror flow Download PDFInfo
- Publication number
- CN112532444B CN112532444B CN202011347762.0A CN202011347762A CN112532444B CN 112532444 B CN112532444 B CN 112532444B CN 202011347762 A CN202011347762 A CN 202011347762A CN 112532444 B CN112532444 B CN 112532444B
- Authority
- CN
- China
- Prior art keywords
- target data
- data stream
- sampling
- type
- random number
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/028—Capturing of monitoring data by filtering
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/142—Network analysis or design using statistical or mathematical methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/18—Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Abstract
The invention provides a data flow sampling method, a system, a medium and a terminal for network mirror flow; the method comprises the following steps: configuring parameters of a hash algorithm to obtain the configured hash algorithm; generating a non-zero random number; acquiring a sampling standard according to the non-zero random number; monitoring a target data stream on a network; judging whether the type of the target data stream conforms to the type of the target data; when the type of the target data stream accords with the type of the target data, acquiring a quintuple of the target data stream, and calculating a hash value of the quintuple; processing the hash value to obtain a processing result; comparing the processing result with a sampling standard to determine whether the target data stream is used as the sampling result according to the comparison result, and taking the target data stream as the sampling result when the comparison result is that the processing result is the same as the sampling standard; the invention has various realization modes, relatively low cost, high realizability and applicability, and can ensure the sampling quality.
Description
Technical Field
The present invention relates to the field of physics, and in particular, to a network data sampling technology, and more particularly, to a method, system, medium, and terminal for sampling a data stream for network mirror traffic.
Background
In the prior art, when the internet has large real-time flow and the flow content is connected in a long way, a direct packet capturing method is adopted for data sampling, so that the data is excessive, the packet receiving and storing pressure is large, and the analysis time is long.
By adopting a packet sampling method, data frames are randomly discarded, although the flow can be reduced, a new problem is brought, namely the flow is difficult to keep complete, if the sampling requirement is to sample all the flows a little, the effect of adopting the packet sampling method is good, but if the sampling requirement is to keep the flows complete, the method cannot meet the requirement at all.
When sampling in a flow-oriented manner, if a flow table mode is adopted, a larger flow table can be generated when the flow with a larger number of flows is faced, and the requirements on the performance and the configuration of a machine are higher; however, by adopting the acl mode, the flexibility and randomness of the acl rule (the acl rule is an access control technology provided by Cisco IOS) itself may cause high similarity of packet capturing results and high repetition probability, and it is difficult to truly reflect traffic characteristics.
Disclosure of Invention
In view of the above drawbacks of the prior art, an object of the present invention is to provide a data stream sampling method, system, medium and terminal for network mirror traffic, which can implement random per-stream sampling and have relatively low hardware requirement when facing a large amount of real-time network data.
To achieve the above and other related objects, the present invention provides a data stream sampling method for network mirror traffic, comprising the steps of: configuring parameters of a hash algorithm to obtain the configured hash algorithm; generating a non-zero random number; acquiring a sampling standard according to the non-zero random number; monitoring a target data stream on a network; judging whether the type of the target data stream conforms to the type of the target data; when the type of the target data stream accords with the target data type, acquiring a quintuple of the target data stream; processing the quintuple by using the configured hash algorithm to calculate the hash value of the quintuple; processing the hash value to obtain a processing result; comparing the processing result with the sampling standard to determine whether the target data stream is used as the sampling result according to the comparison result, and using the target data stream as the sampling result when the comparison result is that the processing result is the same as the sampling standard.
In an embodiment of the present invention, the hash algorithm adopts a pre-established toprizer algorithm; configuring parameters of a hash algorithm to obtain the configured hash algorithm comprises the following steps: configuring the parameters by using a Topritz matrix to obtain a configured hash algorithm; and after the two quintuples with opposite directions are respectively processed by the configured hash algorithm, the calculated hash values of the two quintuples are the same.
In one embodiment of the present invention, generating a non-zero random number comprises the steps of: generating a first random number by using a random number generator; and when the first random number is zero, regenerating a second random number by using the random number generator until the second random number is larger than or smaller than zero, and taking the second random number as the non-zero random number.
In an embodiment of the present invention, obtaining the sampling criteria according to the non-zero random number includes: and taking the remainder of the preset sampling rate by using the non-zero random number, and taking the remainder result as the sampling standard.
In an embodiment of the present invention, the target data types are: IPv4/IPv6 + TCP/UDP/SCTP; judging whether the type of the target data stream conforms to the target data type comprises the following steps: judging whether the type of the target data stream is IPv4 or IPv6 data; when the type of the target data flow is IPv4 or IPv6 data, judging whether the target data flow is any one of the following data flows: TCP, UDP, SCTP; when the target data stream is any one of TCP, UDP and SCTP, the target data stream conforms to the target data type.
In an embodiment of the invention, when the type of the target data stream conforms to the target data type, acquiring the five-tuple of the target data stream includes: and when the type of the target data stream conforms to the target data type, taking a preset fixed length from a fixed position of the target data stream to obtain the quintuple.
In an embodiment of the present invention, the processing the hash value, and obtaining the processing result includes: and taking the remainder of the preset sampling rate by using the hash value, and taking the remainder result as the processing result.
The invention provides a data flow sampling system for network mirror flow, which comprises: the device comprises a parameter configuration module, a numerical value generation module, a first acquisition module, a data monitoring module, a type judgment module, a second acquisition module, a processing and calculation module, a third acquisition module and a comparison analysis module; the parameter configuration module is used for configuring parameters of a hash algorithm to obtain the configured hash algorithm; the numerical value generation module is used for generating a non-zero random number; the first acquisition module is used for acquiring a sampling standard according to the non-zero random number; the data monitoring module is used for monitoring a target data stream on the network; the type judging module is used for judging whether the type of the target data stream conforms to the type of the target data; the second obtaining module is used for obtaining a quintuple of the target data stream when the type of the target data stream conforms to the target data type; the processing and calculating module is used for processing the quintuple by using the configured hash algorithm so as to calculate the hash value of the quintuple; the third obtaining module is used for processing the hash value to obtain a processing result; the comparison analysis module is used for comparing the processing result with the sampling standard to determine whether the target data stream is used as the sampling result according to the comparison result, and when the comparison result is that the processing result is the same as the sampling standard, the target data stream is used as the sampling result.
The present invention provides a storage medium having stored thereon a computer program which, when executed by a processor, implements the above-described data stream sampling method for network mirror traffic.
The present invention provides a terminal, including: a processor and a memory; the memory is used for storing a computer program; the processor is configured to execute the computer program stored in the memory, so as to enable the terminal to execute the above data stream sampling method for network mirror traffic.
As described above, the data stream sampling method, system, medium and terminal for network mirror traffic according to the present invention have the following advantages:
compared with the prior art, the invention has relatively low requirement on hardware and can realize random sampling according to stream when facing to a large amount of real-time network data; the invention has various implementation modes, relatively low cost, high realizability and applicability, and can effectively ensure the sampling quality.
Drawings
Fig. 1 is a flow chart illustrating a data flow sampling method for network mirror traffic according to an embodiment of the present invention.
FIG. 2 is a flow chart illustrating the generation of a non-zero random number according to one embodiment of the present invention.
FIG. 3 is a flowchart illustrating an embodiment of determining whether the type of the target data stream matches the target data type according to the present invention.
Fig. 4 is a schematic structural diagram of a data flow sampling system for network mirror traffic according to an embodiment of the present invention.
Fig. 5 is a schematic structural diagram of a terminal according to an embodiment of the invention.
Description of the reference symbols
41. A parameter configuration module;
42. a numerical value generation module;
43. a first acquisition module;
44. a data monitoring module;
45. a type judgment module;
46. a second acquisition module;
47. a processing calculation module;
48. a third obtaining module;
49. a comparison analysis module;
51. a processor;
52. a memory;
S1-S9;
s21 to S22;
s51 to S52.
Detailed Description
The following description of the embodiments of the present invention is provided by way of specific examples, and other advantages and effects of the present invention will be readily apparent to those skilled in the art from the disclosure herein. The invention is capable of other and different embodiments and of being practiced or of being carried out in various ways, and its several details are capable of modification in various respects, all without departing from the spirit and scope of the present invention. It should be noted that the features in the following embodiments and examples may be combined with each other without conflict.
It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present invention, and the drawings only show the components related to the present invention rather than being drawn according to the number, shape and size of the components in actual implementation, and the type, quantity and proportion of each component in actual implementation may be changed arbitrarily, and the layout of the components may be more complicated.
Compared with the prior art, the data flow sampling method, the system, the medium and the terminal for network mirror flow have relatively low requirements on hardware and can realize random sampling according to flow when facing a large amount of real-time network data; the invention has various implementation modes, relatively low cost, high realizability and applicability, and can effectively ensure the sampling quality.
As shown in fig. 1, in an embodiment, the data stream sampling method for network mirror traffic of the present invention includes the following steps:
s1, configuring parameters of a hash algorithm to obtain the configured hash algorithm.
In an embodiment, the hash algorithm is a pre-built Toeplitz (Toeplitz) algorithm.
It should be noted that the toeplitz algorithm may be implemented by hardware, or may be implemented by a code in a software manner, and the specific implementation manner and the implementation principle are not used as conditions for limiting the present invention, and therefore, detailed descriptions thereof are not repeated here.
In an embodiment, configuring parameters of a hash algorithm to obtain a configured hash algorithm includes: and configuring the parameters by using a Toeplitz matrix (toeplitz matrix) to obtain a configured hash algorithm.
It should be noted that, the toeplitz matrix, referred to as a T-type matrix for short, is proposed by Bryc, dembo, jiang in 2006, and the elements on the main diagonal of the toeplitz matrix are equal, and the elements on the line parallel to the main diagonal are also equal; each element in the matrix is symmetrical about a second diagonal, i.e. the T-shaped matrix is a second symmetrical matrix.
It should be noted that, after the parameters of the hash algorithm are configured by the toeplitz matrix, the configured hash algorithm processes two quintuples with opposite directions respectively, and the calculated hash values of the two quintuples are the same.
And S2, generating a non-zero random number.
Specifically, a non-zero random number is generated prior to packet grabbing.
Preferably, the non-zero random number is a non-zero random integer.
As shown in fig. 2, in one embodiment, generating a non-zero random number includes the steps of:
step S21, a first random number is generated by using the random number generator.
Specifically, a first random number is generated using a uniformly distributed random number generator.
Step S22, when the first random number is zero, a second random number is generated again by using the random number generator until the second random number is not zero, and the second random number is used as the non-zero random number; and when the first random number is not zero, taking the first random number as the non-zero random number.
And S3, acquiring a sampling standard according to the non-zero random number.
In one embodiment, obtaining the sampling criteria based on the non-zero random number comprises: and using the non-zero random number to carry out remainder on a preset sampling rate, and using a remainder result as the sampling standard for use in subsequent packet capturing.
It should be noted that the preset sampling rate is preset, and the specific value is not a condition for limiting the present invention.
And S4, monitoring the target data stream on the network.
And S5, judging whether the type of the target data stream conforms to the type of the target data.
In one embodiment, the target data type is: IPv4/IPv6 + TCP/UDP/SCTP.
As shown in fig. 3, in an embodiment, the determining whether the type of the target data stream conforms to the target data type includes the following steps:
and S51, judging whether the type of the target data stream is IPv4 or IPv6 data.
It should be noted that after the target data stream is obtained, it is first determined whether the data type of the target data stream is IPv4 or IPv6 data, and only if the type of the target data stream is IPv4 or IPv6 data, the next step S52 can be performed.
Step S52, judging whether the target data stream is any one of the following data streams: TCP, UDP, SCTP.
It should be noted that, when the target data stream is any one of TCP, UDP, and SCTP, the target data stream is considered to conform to the target data type.
And S6, acquiring a quintuple of the target data stream when the type of the target data stream accords with the target data type.
In an embodiment, when the type of the target data stream conforms to the target data type, acquiring a five-tuple of the target data stream includes: and when the type of the target data stream conforms to the target data type, taking a preset fixed length from a fixed position of the target data stream to obtain the quintuple.
It should be noted that the preset fixed length is preset, and the specific value is not a condition for limiting the present invention.
And S7, processing the quintuple by using the configured hash algorithm to calculate the hash value of the quintuple.
Specifically, the hash algorithm configured in step S1 is used to perform hash calculation on the quintuple corresponding to the target data stream obtained in step S6, so as to obtain a hash value corresponding to the quintuple.
And S8, processing the hash value to obtain a processing result.
In an embodiment, the processing the hash value, and obtaining the processing result includes: and using the hash value to carry out remainder on a preset sampling rate, and using a remainder result as the processing result.
The manner of processing the hash value in step S8 to obtain the processing result is the same as the manner of processing the non-zero random number in step S3 to obtain the sampling standard.
And S9, comparing the processing result with the sampling standard to determine whether the target data stream is used as the sampling result according to the comparison result, and taking the target data stream as the sampling result when the comparison result is that the processing result is the same as the sampling standard.
Specifically, the processing result obtained in step S8 is compared with the sampling standard obtained in step S3, and then it is determined whether the target data stream can be used as a sampling result according to the comparison result; when the processing result is the same as the sampling standard, the target data stream is taken as a sampling result, namely the target data stream is sampled; conversely, if the processing result is different from the sampling criterion, the target data stream cannot be used as the sampling result, i.e., indicating that the target data stream is not to be sampled.
It should be noted that the protection scope of the data stream sampling method for network mirror traffic according to the present invention is not limited to the execution sequence of the steps listed in this embodiment, and all the schemes of adding or subtracting steps and replacing steps in the prior art according to the principles of the present invention are included in the protection scope of the present invention.
As shown in fig. 4, in an embodiment, the data stream sampling system for network mirror traffic of the present invention includes a parameter configuration module 41, a numerical value generation module 42, a first obtaining module 42, a data monitoring module 44, a type determination module 45, a second obtaining module 46, a processing and calculating module 47, a third obtaining module 48, and a comparison and analysis module 49.
The parameter configuration module 41 is configured to configure parameters of the hash algorithm to obtain a configured hash algorithm.
The value generation module 42 is configured to generate a non-zero random number.
The first obtaining module 43 is configured to obtain a sampling criterion according to the non-zero random number.
The data listening module 44 is configured to listen to a target data stream on the network.
The type determining module 45 is configured to determine whether the type of the target data stream meets the target data type.
The second obtaining module 46 is configured to obtain a five-tuple of the target data stream when the type of the target data stream conforms to the target data type.
The processing and calculating module 47 is configured to process the five-tuple by using the configured hash algorithm to calculate a hash value of the five-tuple.
The third obtaining module 48 is configured to process the hash value to obtain a processing result.
The comparison analysis module 49 is configured to compare the processing result with the sampling standard, determine whether the target data stream is a sampling result according to the comparison result, and take the target data stream as the sampling result when the comparison result is that the processing result is the same as the sampling standard.
It should be noted that the structures and principles of the parameter configuration module 41, the numerical value generation module 42, the first obtaining module 42, the data monitoring module 44, the type judgment module 45, the second obtaining module 46, the processing calculation module 47, the third obtaining module 48, and the comparison analysis module 49 correspond to the steps (step S1 to step S9) in the data flow sampling method for network mirror flow one by one, and therefore are not described in detail herein.
It should be noted that the division of the modules of the above system is only a logical division, and the actual implementation may be wholly or partially integrated into one physical entity, or may be physically separated. And these modules can be realized in the form of software called by processing element; or may be implemented entirely in hardware; and part of the modules can be realized in the form of calling software by the processing element, and part of the modules can be realized in the form of hardware. For example, the x module may be a processing element that is set up separately, or may be implemented by being integrated in a chip of the system, or may be stored in a memory of the system in the form of program code, and the function of the x module may be called and executed by a processing element of the system. Other modules are implemented similarly. In addition, all or part of the modules can be integrated together or can be independently realized. The processing element described herein may be an integrated circuit having signal processing capabilities. In implementation, each step of the above method or each module above may be implemented by an integrated logic circuit of hardware in a processor element or an instruction in the form of software.
For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as: one or more Application Specific Integrated Circuits (ASICs), or one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs), etc. For another example, when one of the above modules is implemented in the form of a Processing element scheduler code, the Processing element may be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).
The storage medium of the present invention has stored thereon a computer program which, when executed by a processor, implements the above-described data stream sampling method for network mirror traffic. The storage medium includes: various media that can store program codes, such as ROM, RAM, magnetic disk, U-disk, memory card, or optical disk.
As shown in fig. 5, the terminal of the present invention includes a processor 51 and a memory 52.
The memory 52 is used for storing computer programs; preferably, the memory 52 comprises: various media that can store program codes, such as ROM, RAM, magnetic disk, U-disk, memory card, or optical disk.
The processor 51 is connected to the memory 52 and configured to execute the computer program stored in the memory 52, so as to enable the terminal to execute the above-mentioned data stream sampling method for network mirror traffic.
Preferably, the Processor 51 may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; the Integrated Circuit may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic device, or discrete hardware components.
It should be noted that, the data stream sampling system for network mirror traffic of the present invention may implement the data stream sampling method for network mirror traffic of the present invention, but the implementation apparatus of the data stream sampling method for network mirror traffic of the present invention includes but is not limited to the structure of the data stream sampling system for network mirror traffic recited in this embodiment, and all structural modifications and substitutions of the prior art made according to the principle of the present invention are included in the protection scope of the present invention.
In summary, compared with the prior art, the data stream sampling method, system, medium and terminal for network mirror flow according to the present invention have relatively low requirements on hardware, and can realize random sampling according to stream when facing a large amount of real-time network data; the invention has various implementation modes, relatively low cost, high realizability and applicability, and can effectively ensure the sampling quality; therefore, the invention effectively overcomes various defects in the prior art and has high industrial utilization value.
The foregoing embodiments are merely illustrative of the principles and utilities of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Accordingly, it is intended that all equivalent modifications or changes which can be made by those skilled in the art without departing from the spirit and technical spirit of the present invention be covered by the claims of the present invention.
Claims (2)
1. A data flow sampling method for network mirror flow is characterized by comprising the following steps:
configuring parameters of a Hash algorithm, wherein the Hash algorithm adopts a Toeplitz Hash algorithm to obtain the configured Hash algorithm;
generating a non-zero random number; generating a non-zero random number includes the steps of:
generating a first random number by using a random number generator;
when the first random number is zero, regenerating a second random number by using the random number generator until the second random number is larger than or smaller than zero, and taking the second random number as the non-zero random number;
acquiring a sampling standard according to the non-zero random number; the method comprises the following steps: taking the remainder of the preset sampling rate by using the non-zero random number, and taking the remainder result as the sampling standard;
monitoring a target data stream on a network; judging whether the type of the target data stream conforms to the type of the target data; the target data types are: IPv4/IPv6 + TCP/UDP/SCTP; judging whether the type of the target data stream conforms to the target data type comprises the following steps:
judging whether the type of the target data stream is IPv4 or IPv6 data;
when the type of the target data flow is IPv4 or IPv6 data, judging whether the target data flow is any one of the following data flows: TCP, UDP, SCTP;
when the target data stream is any one of TCP, UDP and SCTP, the target data stream conforms to the target data type;
when the type of the target data stream accords with the target data type, acquiring a quintuple of the target data stream; the method comprises the following steps: when the type of the target data stream conforms to the target data type, taking a preset fixed length from a fixed position of the target data stream to obtain the quintuple;
processing the quintuple by using the configured hash algorithm to calculate the hash value of the quintuple;
processing the hash value to obtain a processing result; the method comprises the following steps: taking the surplus of a preset sampling rate by using the hash value, and taking a surplus result as the processing result;
comparing the processing result with the sampling standard to determine whether the target data stream is used as the sampling result according to the comparison result, and using the target data stream as the sampling result when the comparison result is that the processing result is the same as the sampling standard.
2. A data stream sampling system for network mirror traffic for performing the sampling method of claim 1, comprising: the device comprises a parameter configuration module, a numerical value generation module, a first acquisition module, a data monitoring module, a type judgment module, a second acquisition module, a processing and calculation module, a third acquisition module and a comparison analysis module;
the parameter configuration module is used for configuring parameters of the hash algorithm to obtain the configured hash algorithm;
the numerical value generation module is used for generating a non-zero random number;
the first acquisition module is used for acquiring a sampling standard according to the non-zero random number;
the data monitoring module is used for monitoring a target data stream on the network;
the type judging module is used for judging whether the type of the target data stream conforms to the type of the target data;
the second obtaining module is used for obtaining the quintuple of the target data stream when the type of the target data stream conforms to the target data type;
the processing and calculating module is used for processing the quintuple by using the configured hash algorithm so as to calculate the hash value of the quintuple;
the third acquisition module is used for processing the hash value to acquire a processing result;
the comparison analysis module is used for comparing the processing result with the sampling standard, determining whether the target data stream is used as a sampling result according to the comparison result, and taking the target data stream as the sampling result when the comparison result is that the processing result is the same as the sampling standard.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011347762.0A CN112532444B (en) | 2020-11-26 | 2020-11-26 | Data flow sampling method, system, medium and terminal for network mirror flow |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011347762.0A CN112532444B (en) | 2020-11-26 | 2020-11-26 | Data flow sampling method, system, medium and terminal for network mirror flow |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112532444A CN112532444A (en) | 2021-03-19 |
| CN112532444B true CN112532444B (en) | 2023-02-24 |
Family
ID=74993992
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011347762.0A Active CN112532444B (en) | 2020-11-26 | 2020-11-26 | Data flow sampling method, system, medium and terminal for network mirror flow |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112532444B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113904952B (en) * | 2021-10-08 | 2023-04-25 | 深圳依时货拉拉科技有限公司 | Network traffic sampling method and device, computer equipment and readable storage medium |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1909554A (en) * | 2006-08-18 | 2007-02-07 | 华为技术有限公司 | Method and system for data flow sampling |
| CN101163058A (en) * | 2007-11-20 | 2008-04-16 | 东南大学 | Stream aggregation arbitrary sampling based packet measuring method |
| JP2011004333A (en) * | 2009-06-22 | 2011-01-06 | Nippon Telegr & Teleph Corp <Ntt> | System, method and program for network quality computation |
| JP2011124750A (en) * | 2009-12-10 | 2011-06-23 | Nippon Telegr & Teleph Corp <Ntt> | Flow communication quality estimating method, device, and program |
| CN104954200A (en) * | 2015-06-17 | 2015-09-30 | 国家计算机网络与信息安全管理中心 | Multi-type rule high-speed matching method and device of network data packet |
| CN107113282A (en) * | 2014-12-30 | 2017-08-29 | 华为技术有限公司 | A kind of method and device for extracting data message |
| CN108282412A (en) * | 2018-01-19 | 2018-07-13 | 世纪龙信息网络有限责任公司 | Network shunt method, apparatus, system and computer equipment |
| CN109981476A (en) * | 2017-12-27 | 2019-07-05 | 华为技术有限公司 | A kind of load-balancing method and device |
| CN110138678A (en) * | 2018-02-08 | 2019-08-16 | 华为技术有限公司 | Data transfer control method and device and web-transporting device and storage medium |
| CN111711577A (en) * | 2020-07-24 | 2020-09-25 | 杭州迪普信息技术有限公司 | Message forwarding method and device of flow control equipment |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7957315B2 (en) * | 2008-12-23 | 2011-06-07 | At&T Intellectual Property Ii, L.P. | System and method for sampling network traffic |
| CN106416171B (en) * | 2014-12-30 | 2020-06-16 | 华为技术有限公司 | Characteristic information analysis method and device |
-
2020
- 2020-11-26 CN CN202011347762.0A patent/CN112532444B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1909554A (en) * | 2006-08-18 | 2007-02-07 | 华为技术有限公司 | Method and system for data flow sampling |
| CN101163058A (en) * | 2007-11-20 | 2008-04-16 | 东南大学 | Stream aggregation arbitrary sampling based packet measuring method |
| JP2011004333A (en) * | 2009-06-22 | 2011-01-06 | Nippon Telegr & Teleph Corp <Ntt> | System, method and program for network quality computation |
| JP2011124750A (en) * | 2009-12-10 | 2011-06-23 | Nippon Telegr & Teleph Corp <Ntt> | Flow communication quality estimating method, device, and program |
| CN107113282A (en) * | 2014-12-30 | 2017-08-29 | 华为技术有限公司 | A kind of method and device for extracting data message |
| CN104954200A (en) * | 2015-06-17 | 2015-09-30 | 国家计算机网络与信息安全管理中心 | Multi-type rule high-speed matching method and device of network data packet |
| CN109981476A (en) * | 2017-12-27 | 2019-07-05 | 华为技术有限公司 | A kind of load-balancing method and device |
| CN108282412A (en) * | 2018-01-19 | 2018-07-13 | 世纪龙信息网络有限责任公司 | Network shunt method, apparatus, system and computer equipment |
| CN110138678A (en) * | 2018-02-08 | 2019-08-16 | 华为技术有限公司 | Data transfer control method and device and web-transporting device and storage medium |
| CN111711577A (en) * | 2020-07-24 | 2020-09-25 | 杭州迪普信息技术有限公司 | Message forwarding method and device of flow control equipment |
Non-Patent Citations (2)
| Title |
|---|
| 网络流量查询系统研究与实现;陈句等;《信息技术》;20181120(第11期);全文 * |
| 面向IP流测量的哈希算法研究;程光等;《软件学报》;20050530(第05期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112532444A (en) | 2021-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111083157B (en) | Method and device for processing message filtering rules | |
| CN112532444B (en) | Data flow sampling method, system, medium and terminal for network mirror flow | |
| CN111447233B (en) | Message filtering method and device based on VXLAN | |
| CN106780633B (en) | A kind of method for correcting image, device and binocular vision system | |
| US20220005004A1 (en) | Method and device for blockchain transaction tracing | |
| CN101159673A (en) | Arbitrary sampling method and apparatus | |
| US11360684B2 (en) | Data storage method and apparatus, storage medium and computer device | |
| CN112199175A (en) | Task queue generating method, device and equipment | |
| WO2020041962A1 (en) | Parallel deconvolutional calculation method, single-engine calculation method and related product | |
| CN113055420B (en) | HTTPS service identification method and device and computing equipment | |
| WO2014101532A1 (en) | Method and device for analyzing program running performance | |
| WO2016122708A1 (en) | Determining a sampling rate for data traffic | |
| CN117201368A (en) | Network flow base number estimation method and system based on pre-sampling | |
| Ye et al. | Accelerator design and performance modeling for homomorphic encrypted cnn inference | |
| CN110932982A (en) | Maintenance method and device of hardware routing table | |
| CN113179251B (en) | Front-end file processing method, device, equipment and machine-readable storage medium | |
| CN114071448B (en) | Data transmission method, related network node and storage medium | |
| CN114979236A (en) | Data transmission method, data transmission device, storage medium and electronic equipment | |
| CN108667893A (en) | Data recommendation method, device and electronic equipment | |
| CN112985781B (en) | Lens test data processing method, device, equipment and storage medium | |
| WO2019084861A1 (en) | Software testing method and device | |
| CN113055433A (en) | File transmission method, device, equipment and machine-readable storage medium | |
| CN115967459B (en) | Method, apparatus, device, medium and program product for processing phase random sequence | |
| CN110912832A (en) | Processing method and device for flow load balancing, electronic equipment and storage medium | |
| CN112907198A (en) | Service state circulation maintenance method and device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |