CN113794655A - Flow monitoring method and device, computer storage medium and electronic equipment - Google Patents
Flow monitoring method and device, computer storage medium and electronic equipment Download PDFInfo
- Publication number
- CN113794655A CN113794655A CN202010694424.8A CN202010694424A CN113794655A CN 113794655 A CN113794655 A CN 113794655A CN 202010694424 A CN202010694424 A CN 202010694424A CN 113794655 A CN113794655 A CN 113794655A
- Authority
- CN
- China
- Prior art keywords
- timestamp
- flow value
- mirror
- flow
- sending
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/20—Support for services
- H04L49/208—Port mirroring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/02—Standardisation; Integration
- H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/90—Buffering arrangements
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present disclosure relates to the field of communications technologies, and provides a traffic monitoring method, a traffic monitoring apparatus, a computer storage medium, and an electronic device, wherein the traffic monitoring method includes: when a mirror flow value sent by an intranet core switch is received, recording a first timestamp; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch; acquiring a first time interval between the first timestamp and the target timestamp, and judging whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is the packet sending timestamp closest to the first timestamp; and if the first time interval is greater than or equal to the preset packet sending interval, sending the mirror image flow value to the flow monitoring equipment. The flow monitoring method disclosed by the invention can not only reduce the data acquisition cost, but also realize millisecond-level data acquisition and ensure the normal operation of each server in an intranet.
Description
Technical Field
The present disclosure relates to the field of communications technologies, and in particular, to a traffic monitoring method, a traffic monitoring apparatus, a computer storage medium, and an electronic device.
Background
With the rapid development of network technologies, cloud computing technologies are widely applied, network traffic of private clouds and public clouds applying the cloud technologies is also increasing, and requirements for management control, operation and maintenance and the like in the network are higher and higher, so that monitoring of the traffic of the whole network is more and more important.
At present, monitoring is generally realized through an x86 server, a program is deployed on x86, and the program acquires traffic on a switch port in an SNMP (Simple Network Management Protocol, SNMP for short), where a related code needs to be developed, and development cost is high.
In view of the above, there is a need in the art to develop a new traffic monitoring method and apparatus.
It is to be noted that the information disclosed in the background section above is only used to enhance understanding of the background of the present disclosure.
Disclosure of Invention
The present disclosure is directed to a traffic monitoring method, a traffic monitoring apparatus, a computer storage medium, and an electronic device, so as to avoid, at least to a certain extent, the defects of an excessive data granularity and a high cost in the related art.
Additional features and advantages of the disclosure will be set forth in the detailed description which follows, or in part will be obvious from the description, or may be learned by practice of the disclosure.
According to a first aspect of the present disclosure, there is provided a traffic monitoring method applied to a programmable switch, including: when a mirror flow value sent by an intranet core switch is received, recording a first timestamp; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch; acquiring a first time interval between the first timestamp and a target timestamp, and judging whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is a packet sending timestamp closest to the first timestamp; and if the first time interval is greater than or equal to the preset packet sending interval, sending the mirror flow value to flow monitoring equipment.
In an exemplary embodiment of the present disclosure, the method further comprises: if the first time interval is smaller than the preset packet sending interval, discarding the first timestamp and caching the mirror flow value; when a new mirror image flow value sent by the intranet core switch is received, recording a second timestamp; determining a second time interval between the second timestamp and the target timestamp, and determining an accumulated value of the new image traffic value and the image traffic value; and if the second time interval is greater than or equal to the preset packet sending interval, sending the accumulated value to the traffic monitoring equipment.
In an exemplary embodiment of the present disclosure, if the first time interval is greater than or equal to the preset packet sending interval, sending the mirror flow value to a flow monitoring device, includes: if the first time interval is greater than or equal to the preset packet sending interval, acquiring a port number of the intranet core switch corresponding to the mirror flow value; packaging the port number, the mirror flow value and the first timestamp into a data message; and sending the data message to the flow monitoring equipment.
In an exemplary embodiment of the present disclosure, after sending the mirrored flow value to a flow monitoring device, the method further comprises: determining the time for sending the mirror flow value as the packet sending timestamp; and resetting the flow value of the target port corresponding to the port number to a target numerical value.
According to a second aspect of the present disclosure, a traffic monitoring method is provided, which is applied to an intranet core switch, and includes: copying the flow value flowing through each port of the flow meter in real time to obtain a mirror flow value; determining a target port of a programmable switch associated with each port of the intranet core switch according to a preset port association relation; sending the image traffic value to the target port of the programmable switch.
In an exemplary embodiment of the present disclosure, the method further comprises: determining the message length of a data message flowing through an intranet core switch; and determining the message length as a flow value flowing through the intranet core switch.
According to a third aspect of the present disclosure, there is provided a traffic monitoring apparatus applied to a programmable switch, including: the receiving module is used for recording a first timestamp when receiving a mirror flow value sent by the intranet core switch; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch; the acquisition module is used for acquiring a first time interval between the first timestamp and a target timestamp and judging whether the first time interval is greater than or equal to a preset packet sending interval or not; the target timestamp is a packet sending timestamp closest to the first timestamp; and the sending module is used for sending the mirror flow value to flow monitoring equipment if the first time interval is greater than or equal to the preset packet sending interval.
According to a fourth aspect of the present disclosure, there is provided a flow monitoring apparatus applied to an intranet core switch, including: the real-time mirror image module is used for copying the flow value flowing through each port of the real-time mirror image module in real time to obtain a mirror image flow value; the determining module is used for determining a target port of the programmable switch associated with each port of the intranet core switch according to a preset port association relation; a sending module, configured to send the image traffic value to the target port of the programmable switch.
According to a fifth aspect of the present disclosure, there is provided a computer storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the flow monitoring method according to the first or second aspect.
According to a sixth aspect of the present disclosure, there is provided an electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the traffic monitoring method according to the first and second aspects via executing the executable instructions.
As can be seen from the foregoing technical solutions, the traffic monitoring method, the traffic monitoring apparatus, the computer storage medium and the electronic device in the exemplary embodiments of the present disclosure have at least the following advantages and positive effects:
in the technical solutions provided in some embodiments of the present disclosure, on one hand, when a mirror flow value (obtained by mirroring the flow value flowing through the intranet core switch in real time) sent by the intranet core switch is received, the first timestamp is recorded, so that the technical problems that in the prior art, data acquisition is performed through an x86 server, only second-level monitoring can be performed, and program development cost needs to be automatically developed is high can be avoided, instantaneity and fine granularity of data are ensured, and data monitoring cost is reduced. On the other hand, the first time interval between the first timestamp and the target timestamp (the packet sending timestamp closest to the first timestamp) is obtained, whether the first time interval is larger than or equal to a preset packet sending interval or not is judged, if the first time interval is larger than or equal to the preset packet sending interval, the mirror flow value is sent to the flow monitoring equipment, the problem that the flow monitoring equipment is broken down or cannot correctly receive data due to the fact that the data are sent in real time frequently can be avoided, the technical problem that data receiving fails is caused, and the data monitoring process is guaranteed to be normally carried out.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and together with the description, serve to explain the principles of the disclosure. It is to be understood that the drawings in the following description are merely exemplary of the disclosure, and that other drawings may be derived from those drawings by one of ordinary skill in the art without the exercise of inventive faculty.
Fig. 1 shows a flow diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure;
FIG. 2 illustrates a sub-flow diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure;
FIG. 3 illustrates a sub-flow diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure;
FIG. 4 illustrates a network topology diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure;
FIG. 5 is a schematic flow chart diagram illustrating an overall flow monitoring method in an exemplary embodiment of the present disclosure;
FIG. 6 is a schematic diagram illustrating an exemplary embodiment of a flow monitoring device according to the present disclosure;
FIG. 7 shows a schematic diagram of a flow monitoring device in another exemplary embodiment of the present disclosure;
FIG. 8 shows a schematic diagram of a structure of a computer storage medium in an exemplary embodiment of the disclosure;
fig. 9 shows a schematic structural diagram of an electronic device in an exemplary embodiment of the present disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the subject matter of the present disclosure can be practiced without one or more of the specific details, or with other methods, components, devices, steps, and the like. In other instances, well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.
The terms "a," "an," "the," and "said" are used in this specification to denote the presence of one or more elements/components/parts/etc.; the terms "comprising" and "having" are intended to be inclusive and mean that there may be additional elements/components/etc. other than the listed elements/components/etc.; the terms "first" and "second", etc. are used merely as labels, and are not limiting on the number of their objects.
Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repetitive description will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities.
At present, monitoring is generally realized by an x86 server, a program is deployed on x86, and the program acquires traffic on a switch port in an SNMP (Simple Network Management Protocol, SNMP for short). However, the following drawbacks exist in the related art:
the granularity of collected data is overlarge: the conventional monitoring can only achieve second-level monitoring, but in internal network traffic, a millisecond-level burst may exist, and the burst cannot be monitored by the conventional monitoring, but the burst may affect the normal traffic of the current port;
secondly, the development cost is high: the relevant codes need to be developed by themselves so that the program deployed on the x86 server acquires the traffic on the switch port in an SNMP manner, and therefore, time and labor are wasted, and the development cost is high.
In the embodiments of the present disclosure, a traffic monitoring method is provided first, which overcomes, at least to some extent, the defects of the traffic monitoring method provided in the prior art that the data granularity is too large and the cost is high.
Fig. 1 shows a flow diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure, and an execution subject of the traffic monitoring method may be a programmable switch that monitors traffic.
Referring to fig. 1, a traffic monitoring method according to one embodiment of the present disclosure includes the steps of:
step S110, when a mirror flow value sent by an intranet core switch is received, recording a first timestamp; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch;
step S120, acquiring a first time interval between the first timestamp and the target timestamp, and judging whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is the packet sending timestamp closest to the first timestamp;
and step S130, if the first time interval is greater than or equal to the preset packet sending interval, sending the mirror flow value to the flow monitoring equipment.
In the technical scheme provided by the embodiment shown in fig. 1, on one hand, when a mirror flow value sent by an intranet core switch is received (the mirror flow value is obtained by real-time mirroring of a flow value flowing through the intranet core switch), a first timestamp is recorded, so that the technical problems that in the prior art, data acquisition is performed through an x86 server, only second-level monitoring can be achieved, and program self-development cost is high can be avoided, instantaneity and fine granularity of data are ensured, and data monitoring cost is reduced. On the other hand, the first time interval between the first timestamp and the target timestamp (the packet sending timestamp closest to the first timestamp) is obtained, whether the first time interval is larger than or equal to a preset packet sending interval or not is judged, if the first time interval is larger than or equal to the preset packet sending interval, the mirror flow value is sent to the flow monitoring equipment, the problem that the flow monitoring equipment is broken down or cannot correctly receive data due to the fact that the data are sent in real time frequently can be avoided, the technical problem that data receiving fails is caused, and the data monitoring process is guaranteed to be normally carried out.
The following describes the specific implementation of each step in fig. 1 in detail:
a Network switch (Network switch, for short) is a Network hardware that receives and forwards data to a target device through message switching, and it can connect different devices on a computer Network. A switch is a multi-port bridge that forwards data using MAC addresses at the data link layer. Some switches may also forward data at the network layer by introducing routing functions, such switches being generally referred to as three-layer switches or multi-layer switches. Ethernet switches are the most common form of network switch. The main functions of the switch include physical addressing, network topology, error checking, frame sequencing, and flow control. At present, the switch also has some new functions, such as support for VLAN (virtual local area network), support for link aggregation, and even some switches also have a firewall function.
Intranet refers to a local area network, where several or dozens of computers have mutual access. The intranet core switch is that when an intranet has a network formed by a plurality of switches, one of the switches is used as a main switch to forward data to other switches, and the switch is not connected with a terminal device directly, so that the switch can be called as the intranet core switch.
Programmable switches are switches that support high throughput packet processing, reduce cost, and improve the programmability and automation of the network.
For example, an association relationship or a one-to-one correspondence relationship between the ports of the intranet core switch and the ports of the programmable switches may be established in advance. For example, the port C1 of the intranet core switch may be associated with the port P1 of the programmable switch, and the port C2 of the intranet core switch may be associated with the port P2 of the programmable switch, which may be set according to actual situations, and belongs to the protection scope of the present disclosure.
For example, the intranet core switch may determine a message length of a data message flowing through itself (the message is a data unit exchanged and transmitted in the network, that is, a data block to be sent by a station at one time), and determine the message length as a traffic value flowing through the intranet core switch. For example, when the length of the data packet flowing through the intranet core switch at a certain time is 300Kb, the corresponding traffic value flowing through the intranet core switch at that time is 300 Kb. Furthermore, the intranet core switch may copy the flow value flowing through each port of the intranet core switch in real time to obtain a mirror flow value, and determine a target port of the programmable switch associated with each port of the intranet core switch according to the preset port association relationship, for example, referring to the above explanation, the port P1 of the intranet core switch may send the mirror flow value to the target port of the programmable switch (port P1).
Referring next to fig. 1, in step S110, when a mirror flow value transmitted by the intranet core switch is received, a first timestamp is recorded.
When a target port of the programmable switch receives a mirror flow value (obtained by mirroring a flow value flowing through the programmable switch in real time for the intranet core switch) sent by the intranet core switch, a first timestamp of received data can be recorded. Exemplary, mirror flow value L1May be 300Kb and the first timestamp may be 10 minutes 10 seconds 31 milliseconds at 7 months, 7 days, 10 hours 2020.
In step S120, a first time interval between the first timestamp and the target timestamp is obtained, and it is determined whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is the packet-sending timestamp closest to the first timestamp.
Furthermore, a first time interval between the first timestamp and the target timestamp can be obtained, and whether the first time interval is greater than or equal to a preset packet sending interval or not is judged. The target timestamp may be a nearest packet-sending timestamp to the first timestamp, and may be, for example, 10 minutes, 10 seconds, 30 milliseconds at 7 months, 7 days, 10 days, and 2020.
It should be noted that the preset packet sending interval may be determined according to an actual situation, and when the plurality of ports in the programmable switch send data to the traffic monitoring device at the preset packet sending interval, a value that ensures that the traffic monitoring device can just successfully complete a data receiving task is ensured, which may be 1 millisecond for example, and may be set according to the actual situation, which belongs to the protection scope of the present disclosure.
The first time interval between the first time stamp and the target time stamp is 1ms, and therefore, it can be determined that the first time interval is equal to the preset packet sending interval.
In step S130, if the first time interval is greater than or equal to the preset packet sending interval, the mirror flow value is sent to the flow monitoring device.
When the first time interval is determined to be larger than or equal to the preset packet sending interval, the mirror flow value L can be directly used1And sending the data to the flow monitoring equipment. Therefore, the technical problem that data receiving fails due to the fact that the traffic monitoring equipment is crashed or cannot receive data correctly due to the fact that the traffic value is sent to the traffic monitoring equipment in real time can be solved, and the data monitoring process is guaranteed to be carried out normally.
Specifically, referring to fig. 2, fig. 2 shows a sub-flow diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure, specifically, a sub-flow diagram that can directly send the mirror traffic value to a traffic monitoring device when it is determined that the first time interval is greater than or equal to the preset packet sending interval includes steps S201 to S203, and step S130 is explained below with reference to fig. 2.
In step S201, if the first time interval is greater than or equal to the preset packet sending interval, a port number of the intranet core switch corresponding to the mirror flow value is obtained.
If the first time interval is greater than or equal to the preset packet sending interval, the port number of the intranet core switch corresponding to the mirror flow value can be acquired. Illustratively, referring to the related explanation of the above steps, the port number may be: C1.
in step S202, the port number, the mirror flow value, and the first timestamp are encapsulated as a data packet.
Further, the port number (C1) and the mirror flow value L may be set to1(300Kb) and the first timestamp (10 minutes, 10 seconds and 32 milliseconds at 7 months, 7 days and 10 days in 2020), are encapsulated into a UDP (User data Protocol, UDP) data message.
In step S203, the data packet is sent to the traffic monitoring device.
Furthermore, the target port P1 of the programmable switch may send a data packet including the mirror flow value to the flow monitoring device, so that the flow monitoring device monitors the flow value flowing through the intranet core switch in real time to ensure the normal operation of the intranet core switch. Meanwhile, the time for sending the data message can be recorded as a packet sending timestamp, so that the sequential proceeding of the subsequent monitoring process is ensured, and the data chaos is avoided.
After the data packet is sent to the traffic monitoring device, the traffic value corresponding to the port C1 of the intranet core switch may be reset to a target value (e.g., 0), so as to avoid interference on subsequent related statistical results and ensure accuracy of subsequent traffic monitoring data.
For example, referring to fig. 3, fig. 3 shows a sub-flow diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure, and in particular shows a sub-flow diagram when a first time interval is smaller than a preset packet sending interval, which includes steps S301 to S304, and the following explains a specific implementation manner with reference to fig. 3.
In step S301, if the first time interval is smaller than the preset packet sending interval, the first timestamp is discarded and the mirror flow value is cached.
Referring to the related explanation of step S110, for example, when the first timestamp is 10 minutes, 10 seconds, 30.5 milliseconds at 7 days, 10 days, 7 days, 2020, it can be determined that the first time interval between the first timestamp and the target timestamp is 0.5 milliseconds, and 0.5 milliseconds is less than 1 millisecond, so that the first timestamp can be discarded and the mirror flow value L can be obtained1(300Kb) is buffered in the memory buffer. Therefore, the interference of the recorded invalid timestamp on the follow-up flow monitoring process can be avoided, and the accuracy of follow-up monitoring data is ensured.
In step S302, when a new mirror flow value sent by the intranet core switch is received, a second timestamp is recorded.
When the programmable switch receives a new mirror flow value L sent by the intranet core switch2A second timestamp of the received data may be recorded. For example, the new mirror flow value L2May be 200Kb and the second timestamp may be 10 minutes 10 seconds 31.5 milliseconds at 7 months, 7 days, 10 hours 2020.
In step S303, a second time interval between the second timestamp and the target timestamp is determined, and a new mirror flow value and an accumulated value of the mirror flow values are determined.
Further, it may be determined that a second time interval between the second timestamp and the target timestamp is 1.5 milliseconds, and the second time interval is greater than a preset packet sending interval. In addition, a new mirror flow value L may be determined2With the above-mentioned mirror flow value L1The accumulated value of (1) is 500 Kb.
In step S304, if the second time interval is greater than or equal to the preset packet sending interval, the accumulated value is sent to the traffic monitoring device.
The programmable switch may send the accumulated value to the traffic monitoring device after determining that the second time interval is greater than the predetermined packet transmission interval. Specifically, the mirror flow value L may be obtained by referring to the explanations regarding step S201 to step S2031Or the new mirror flow value L2And the corresponding port number (for example, C1) of the intranet core switch encapsulates the port number (C1), the accumulated value (500Kb) and the second timestamp (10 minutes, 10 seconds, 31.5 milliseconds at 7 months, 7 days and 10 days in 2020) into a data message, and sends the data message to the traffic monitoring equipment. For example, when each port of the programmable switch pushes data to the traffic monitoring device every 1ms, one port in 1s can push 1000 data to the traffic monitoring device, and at most 64 ports of one 6.4T programmable switchAnd 1s pushes 64k of data to the traffic monitoring device at most, and the data volume is within a tolerable range for the traffic monitoring device, so that the normal operation of the traffic monitoring device can be ensured.
Similarly, referring to the related explanation of the step S302, for example, when the second time interval between the second timestamp and the target timestamp is less than the preset packet sending interval, for example, when the second timestamp is 10 minutes, 10 seconds, 30.8 milliseconds at 7, 10 days, 10 months at 2020, the second time interval may be determined to be 0.8 milliseconds and less than 1 millisecond, the second timestamp may be discarded, and the new image flow value L may be calculated2With the above flow value L1The accumulated value (500Kb) is buffered in the memory buffer. When the mirror flow value L sent by the intranet core switch is received next time3Then, a third timestamp may be recorded and a traffic accumulation value L may be determined1+L2+L3. Further, a third time interval between the third time stamp and the target time stamp is determined, and whether the accumulated value L is equal to or not is determined according to the comparison result of the third time interval and the value of the preset packet sending interval1+L2+L3And sending the data to the flow monitoring equipment.
For example, referring to fig. 4, fig. 4 shows an overall network topology diagram of a traffic monitoring method in an exemplary embodiment of the present disclosure, and a specific implementation is explained below with reference to fig. 4.
When a plurality of servers (for example, 100 servers) exist in the intranet, each server may correspond to a unique TOR (top of rack) switch, and the TOR switches may receive data requests of the servers and convert the data requests to other TOR switches through the intranet core switch, so as to implement data communication between the servers. In addition, the intranet core switch can also mirror the flow value flowing through the intranet core switch in real time and send the mirror flow value to the programmable switch, so that the programmable switch pushes the mirror flow value to the flow monitoring equipment.
For example, referring to fig. 5, fig. 5 shows an overall flowchart of a flow monitoring method in an embodiment of the present disclosure, which includes steps S501 to S506, and a specific implementation is explained below with reference to fig. 5.
In step S501, when a flow value sent by the intranet core switch is received, a current timestamp is obtained;
in step S502, it is determined whether the difference between the current timestamp and the target timestamp is greater than or equal to 1 millisecond;
if yes, in step S503, assembling a data packet (including a port number of the intranet core switch, a current timestamp, and a flow value) according to the format;
in step S504, the data packet is sent to the traffic monitoring device;
if not, in step S505, discarding the current timestamp;
in step S506, the flow value or the statistically accumulated flow value is buffered.
Based on the technical scheme, the method and the device can reduce the data acquisition cost, realize millisecond-level data acquisition, solve the technical problem that in the prior art, only second-level monitoring can be realized, so that when a network has millisecond-level burst, monitoring cannot be carried out in time and measures cannot be taken, and ensure the normal operation of each server in the intranet; and the problem that the flow monitoring equipment is crashed due to the fact that data are sent too frequently can be avoided, and normal operation of the flow monitoring equipment is guaranteed.
The present disclosure also provides a traffic monitoring apparatus applied to a programmable switch, and fig. 6 shows a schematic structural diagram of the traffic monitoring apparatus in an exemplary embodiment of the present disclosure; as shown in fig. 6, the traffic monitoring apparatus 600 may include a receiving module 601, an obtaining module 602, and a sending module 603. Wherein:
the receiving module 601 is configured to record a first timestamp when receiving a mirror flow value sent by the intranet core switch; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch.
In an exemplary embodiment of the present disclosure, the receiving module is configured to record a first timestamp when receiving a mirror flow value sent by the intranet core switch; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch.
An obtaining module 602, configured to obtain a first time interval between the first timestamp and the target timestamp, and determine whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is the packet-sending timestamp closest to the first timestamp.
In an exemplary embodiment of the disclosure, the obtaining module is configured to obtain a first time interval between the first timestamp and the target timestamp, and determine whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is the packet-sending timestamp closest to the first timestamp.
The sending module 603 is configured to send the mirror flow value to the flow monitoring device if the first time interval is greater than or equal to a preset packet sending interval.
In an exemplary embodiment of the present disclosure, the sending module is further configured to obtain a port number of the intranet core switch, corresponding to the mirror flow value, if the first time interval is greater than or equal to a preset packet sending interval; packaging the port number, the mirror flow value and the first timestamp into a data message; and sending the data message to the flow monitoring equipment.
In an exemplary embodiment of the present disclosure, the sending module is further configured to discard the first timestamp and cache the mirror flow value if the first time interval is smaller than a preset packet sending interval; when a new mirror image flow value sent by the intranet core switch is received, recording a second timestamp; determining a second time interval between the second timestamp and the target timestamp, and determining a new image flow value and an accumulated value of the image flow values; and if the second time interval is greater than or equal to the preset packet sending interval, sending the accumulated value to the flow monitoring equipment.
In an exemplary embodiment of the present disclosure, the sending module is further configured to determine a time when the mirror flow value is sent as the packet sending timestamp; and resetting the flow value of the target port corresponding to the port number to the target value.
The present disclosure also provides another traffic monitoring apparatus, which is applied to an intranet core switch, and fig. 7 shows a schematic structural diagram of the traffic monitoring apparatus in another exemplary embodiment of the present disclosure; as shown in fig. 7, the traffic monitoring apparatus 700 may include a real-time mirroring module 701, a determining module 702, and a sending module 703. Wherein:
the real-time mirroring module 701 is configured to copy the flow values flowing through each port of the real-time mirroring module in real time to obtain mirrored flow values.
In an exemplary embodiment of the present disclosure, the real-time mirroring module is configured to determine a message length of a data message flowing through the intranet core switch; and determining the length of the message as a flow value flowing through the intranet core switch.
A determining module 702, configured to determine, according to a preset port association relationship, a target port of a programmable switch associated with each port of the intranet core switch.
In an exemplary embodiment of the present disclosure, the determining module is configured to determine, according to a preset port association relationship, a target port of a programmable switch associated with each port of the intranet core switch.
A sending module 703, configured to send the image traffic value to a target port of the programmable switch.
In an example embodiment of the present disclosure, the sending module is to send the image traffic value to a destination port of the programmable switch.
The specific details of each module in the flow monitoring device have been described in detail in the corresponding flow monitoring method, and therefore are not described herein again.
It should be noted that although in the above detailed description several modules or units of the device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.
Moreover, although the steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that the steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions, etc.
Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
In an exemplary embodiment of the present disclosure, there is also provided a computer storage medium capable of implementing the above method. On which a program product capable of implementing the above-described method of the present specification is stored. In some possible embodiments, various aspects of the disclosure may also be implemented in the form of a program product comprising program code for causing a terminal device to perform the steps according to various exemplary embodiments of the disclosure described in the "exemplary methods" section above of this specification, when the program product is run on the terminal device.
Referring to fig. 8, a program product 800 for implementing the above method according to an embodiment of the present disclosure is described, which may employ a portable compact disc read only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
A computer readable signal medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Program code for carrying out operations for the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).
In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.
As will be appreciated by one skilled in the art, aspects of the present disclosure may be embodied as a system, method or program product. Accordingly, various aspects of the present disclosure may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.
An electronic device 900 according to this embodiment of the disclosure is described below with reference to fig. 9. The electronic device 900 shown in fig. 9 is only an example and should not bring any limitations to the functionality or scope of use of the embodiments of the present disclosure.
As shown in fig. 9, the electronic device 900 is embodied in the form of a general purpose computing device. Components of electronic device 900 may include, but are not limited to: the at least one processing unit 910, the at least one storage unit 920, a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910), and a display unit 940.
Wherein the storage unit stores program code that is executable by the processing unit 910 to cause the processing unit 910 to perform steps according to various exemplary embodiments of the present disclosure described in the above section "exemplary method" of the present specification. For example, the processing unit 910 may perform the following as shown in fig. 1: step S110, when a mirror flow value sent by an intranet core switch is received, recording a first timestamp; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch; step S120, acquiring a first time interval between the first timestamp and the target timestamp, and judging whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is the packet sending timestamp closest to the first timestamp; and step S130, if the first time interval is greater than or equal to the preset packet sending interval, sending the mirror flow value to the flow monitoring equipment.
The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM)9201 and/or a cache memory unit 9202, and may further include a read only memory unit (ROM) 9203.
The electronic device 900 may also communicate with one or more external devices 1000 (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device 900, and/or with any devices (e.g., router, modem, etc.) that enable the electronic device 900 to communicate with one or more other computing devices. Such communication may occur via input/output (I/O) interface 950. Also, the electronic device 900 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN) and/or a public network, such as the Internet) via the network adapter 960. As shown, the network adapter 960 communicates with the other modules of the electronic device 900 via the bus 930. It should be appreciated that although not shown, other hardware and/or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.
Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
Furthermore, the above-described figures are merely schematic illustrations of processes included in methods according to exemplary embodiments of the present disclosure, and are not intended to be limiting. It will be readily understood that the processes shown in the above figures are not intended to indicate or limit the chronological order of the processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, e.g., in multiple modules.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
Claims (10)
1. A flow monitoring method applied to a programmable switch is characterized by comprising the following steps:
when a mirror flow value sent by an intranet core switch is received, recording a first timestamp; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch;
acquiring a first time interval between the first timestamp and a target timestamp, and judging whether the first time interval is greater than or equal to a preset packet sending interval; the target timestamp is a packet sending timestamp closest to the first timestamp;
and if the first time interval is greater than or equal to the preset packet sending interval, sending the mirror flow value to flow monitoring equipment.
2. The method of claim 1, further comprising:
if the first time interval is smaller than the preset packet sending interval, discarding the first timestamp and caching the mirror flow value;
when a new mirror image flow value sent by the intranet core switch is received, recording a second timestamp;
determining a second time interval between the second timestamp and the target timestamp, and determining an accumulated value of the new image traffic value and the image traffic value;
and if the second time interval is greater than or equal to the preset packet sending interval, sending the accumulated value to the traffic monitoring equipment.
3. The method according to claim 1 or 2, wherein the sending the mirror traffic value to a traffic monitoring device if the first time interval is greater than or equal to the preset packet sending interval comprises:
if the first time interval is greater than or equal to the preset packet sending interval, acquiring a port number of the intranet core switch corresponding to the mirror flow value;
packaging the port number, the mirror flow value and the first timestamp into a data message;
and sending the data message to the flow monitoring equipment.
4. The method of claim 3, wherein after sending the mirrored flow value to a flow monitoring device, the method further comprises:
determining the time for sending the mirror flow value as the packet sending timestamp;
and resetting the flow value of the target port corresponding to the port number to a target numerical value.
5. A flow monitoring method is applied to an intranet core switch and is characterized by comprising the following steps:
copying the flow value flowing through each port of the flow meter in real time to obtain a mirror flow value;
determining a target port of a programmable switch associated with each port of the intranet core switch according to a preset port association relation;
sending the image traffic value to the target port of the programmable switch.
6. The method of claim 5, further comprising:
determining the message length of a data message flowing through an intranet core switch;
and determining the message length as a flow value flowing through the intranet core switch.
7. A traffic monitoring apparatus for use in a programmable switch, comprising:
the receiving module is used for recording a first timestamp when receiving a mirror flow value sent by the intranet core switch; the mirror image flow value is obtained by carrying out real-time mirror image on the flow value flowing through the intranet core switch;
the acquisition module is used for acquiring a first time interval between the first timestamp and a target timestamp and judging whether the first time interval is greater than or equal to a preset packet sending interval or not; the target timestamp is a packet sending timestamp closest to the first timestamp;
and the sending module is used for sending the mirror flow value to flow monitoring equipment if the first time interval is greater than or equal to the preset packet sending interval.
8. The utility model provides a flow monitoring device, is applied to intranet core switch, its characterized in that includes:
the real-time mirror image module is used for copying the flow value flowing through each port of the real-time mirror image module in real time to obtain a mirror image flow value;
the determining module is used for determining a target port of the programmable switch associated with each port of the intranet core switch according to a preset port association relation;
a sending module, configured to send the image traffic value to the target port of the programmable switch.
9. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the flow monitoring method of any one of claims 1 to 6.
10. An electronic device, comprising:
a processor; and
a memory for storing executable instructions of the processor;
wherein the processor is configured to perform the traffic monitoring method of any of claims 1-6 via execution of the executable instructions.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010694424.8A CN113794655A (en) | 2020-07-17 | 2020-07-17 | Flow monitoring method and device, computer storage medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010694424.8A CN113794655A (en) | 2020-07-17 | 2020-07-17 | Flow monitoring method and device, computer storage medium and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113794655A true CN113794655A (en) | 2021-12-14 |
Family
ID=78876804
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010694424.8A Pending CN113794655A (en) | 2020-07-17 | 2020-07-17 | Flow monitoring method and device, computer storage medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113794655A (en) |
Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101557321A (en) * | 2009-05-21 | 2009-10-14 | 中兴通讯股份有限公司 | Method for monitoring bandwidth of interface in distributed system and device |
| US20100039957A1 (en) * | 2008-08-14 | 2010-02-18 | Verizon Corporate Services Group Inc. | System and method for monitoring and analyzing network traffic |
| US20140010096A1 (en) * | 2012-07-09 | 2014-01-09 | International Business Machines Corporation | Port mirroring in distributed switching systems |
| US20140169196A1 (en) * | 2005-08-19 | 2014-06-19 | Cpacket Networks Inc. | Apparatus, System, and Method for Enhanced Reporting and Measurement of Performance Data |
| CN104468254A (en) * | 2013-09-24 | 2015-03-25 | 中兴通讯股份有限公司 | Network flow statistic reporting processing method and device, controller and switch |
| CN104994138A (en) * | 2015-06-02 | 2015-10-21 | 上海天奕无线信息科技有限公司 | Positioning device, positioning system and data transmission method |
| CN105357151A (en) * | 2015-11-19 | 2016-02-24 | 成都科来软件有限公司 | DPDK-based packet capture and mirror image flow forwarding method |
| CN105915467A (en) * | 2016-05-17 | 2016-08-31 | 清华大学 | Data center network flow balancing method and device oriented to software definition |
| CN108092852A (en) * | 2017-12-26 | 2018-05-29 | 北京科来数据分析有限公司 | A kind of OpenStack flow collection methods based on Transmission Control Protocol |
| US20180287903A1 (en) * | 2017-03-29 | 2018-10-04 | Ca, Inc. | Adjusting monitoring based on inspection of network traffic |
| CN109039936A (en) * | 2018-08-30 | 2018-12-18 | 华为技术有限公司 | Transmission rate control, device, sending device and receiving device |
| CN109525464A (en) * | 2018-12-25 | 2019-03-26 | 杭州迪普科技股份有限公司 | Monitor the method and device of flow |
| CN109587264A (en) * | 2018-12-20 | 2019-04-05 | 新华三技术有限公司 | Data monitoring method, device and cloud platform server |
| CN110932931A (en) * | 2019-11-13 | 2020-03-27 | 苏宁云计算有限公司 | Detection method and device for network delay of data center |
| US20210385753A1 (en) * | 2018-02-06 | 2021-12-09 | Nokia Technologies Oy | Managing power consumption of portable devices |
-
2020
- 2020-07-17 CN CN202010694424.8A patent/CN113794655A/en active Pending
Patent Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20140169196A1 (en) * | 2005-08-19 | 2014-06-19 | Cpacket Networks Inc. | Apparatus, System, and Method for Enhanced Reporting and Measurement of Performance Data |
| US20100039957A1 (en) * | 2008-08-14 | 2010-02-18 | Verizon Corporate Services Group Inc. | System and method for monitoring and analyzing network traffic |
| CN101557321A (en) * | 2009-05-21 | 2009-10-14 | 中兴通讯股份有限公司 | Method for monitoring bandwidth of interface in distributed system and device |
| US20140010096A1 (en) * | 2012-07-09 | 2014-01-09 | International Business Machines Corporation | Port mirroring in distributed switching systems |
| CN104468254A (en) * | 2013-09-24 | 2015-03-25 | 中兴通讯股份有限公司 | Network flow statistic reporting processing method and device, controller and switch |
| CN104994138A (en) * | 2015-06-02 | 2015-10-21 | 上海天奕无线信息科技有限公司 | Positioning device, positioning system and data transmission method |
| CN105357151A (en) * | 2015-11-19 | 2016-02-24 | 成都科来软件有限公司 | DPDK-based packet capture and mirror image flow forwarding method |
| CN105915467A (en) * | 2016-05-17 | 2016-08-31 | 清华大学 | Data center network flow balancing method and device oriented to software definition |
| US20180287903A1 (en) * | 2017-03-29 | 2018-10-04 | Ca, Inc. | Adjusting monitoring based on inspection of network traffic |
| CN108092852A (en) * | 2017-12-26 | 2018-05-29 | 北京科来数据分析有限公司 | A kind of OpenStack flow collection methods based on Transmission Control Protocol |
| US20210385753A1 (en) * | 2018-02-06 | 2021-12-09 | Nokia Technologies Oy | Managing power consumption of portable devices |
| CN109039936A (en) * | 2018-08-30 | 2018-12-18 | 华为技术有限公司 | Transmission rate control, device, sending device and receiving device |
| CN109587264A (en) * | 2018-12-20 | 2019-04-05 | 新华三技术有限公司 | Data monitoring method, device and cloud platform server |
| CN109525464A (en) * | 2018-12-25 | 2019-03-26 | 杭州迪普科技股份有限公司 | Monitor the method and device of flow |
| CN110932931A (en) * | 2019-11-13 | 2020-03-27 | 苏宁云计算有限公司 | Detection method and device for network delay of data center |
Non-Patent Citations (1)
| Title |
|---|
| 郭秉礼;赵宁;朱志文;宁帆;黄善国;: "数据中心中面向光互联的流量识别与调度研究", 通信学报, no. 09, pages 122 - 128 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP6310052B2 (en) | Data transmission method based on protection control system of smart substation | |
| CN108696428B (en) | Tunnel technology-based route detection method, route node and central server | |
| CN113037560B (en) | Service flow switching method and device, storage medium and electronic equipment | |
| US11336545B2 (en) | Network device measurements employing white boxes | |
| CN106657180B (en) | Information transmission method and device for cloud service, terminal equipment and system | |
| JP6299640B2 (en) | Communication device | |
| CN110868278B (en) | Method for dual-computer redundancy of communication front-end processor of rail transit comprehensive monitoring system | |
| CN104702386A (en) | Full-network-based centralized control system and method | |
| KR20200014255A (en) | Network failure monitoring server and operating method thereof | |
| US20200220786A1 (en) | Statistics increment for multiple publishers | |
| CN113794655A (en) | Flow monitoring method and device, computer storage medium and electronic equipment | |
| CN116708129A (en) | Method, device and storage medium for link fault detection and quick recovery | |
| CN113672416B (en) | Method and device for positioning cause of hard buffer leakage | |
| CN115277450A (en) | OPNET-based virtual-real combined heterogeneous communication network fusion system and application | |
| CN115514682A (en) | Data transmission method, device, equipment and storage medium | |
| US11210156B1 (en) | Intelligent distributed tracing | |
| US11477101B2 (en) | Communication time calculation method and recording medium recording communication time calculation program | |
| CN114520778A (en) | Connectivity detection method, connectivity detection device, electronic equipment and storage medium | |
| CN112433982A (en) | FPGA dynamic reconstruction method for ship public computing service terminal | |
| CN114338477A (en) | Communication link monitoring method, device, equipment and storage medium | |
| CN112217718A (en) | Service processing method, device, equipment and storage medium | |
| CN109039680B (en) | Method and system for switching main Broadband Network Gateway (BNG) and standby BNG and BNG | |
| CN104243197A (en) | Data transmitting method and system and virtual storage gateways | |
| CN112787917A (en) | Protection method, end node, protection group network and storage medium for flexible Ethernet | |
| US9900207B2 (en) | Network control protocol |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |