CN115277504A - Network traffic monitoring method, device and system - Google Patents
Network traffic monitoring method, device and system Download PDFInfo
- Publication number
- CN115277504A CN115277504A CN202210809695.2A CN202210809695A CN115277504A CN 115277504 A CN115277504 A CN 115277504A CN 202210809695 A CN202210809695 A CN 202210809695A CN 115277504 A CN115277504 A CN 115277504A
- Authority
- CN
- China
- Prior art keywords
- message
- network
- switch
- determining
- switches
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 75
- 238000012544 monitoring process Methods 0.000 title claims abstract description 38
- 230000005540 biological transmission Effects 0.000 claims abstract description 149
- 238000012806 monitoring device Methods 0.000 claims abstract description 20
- 238000004458 analytical method Methods 0.000 claims abstract description 14
- 230000002159 abnormal effect Effects 0.000 claims description 13
- 238000004590 computer program Methods 0.000 claims description 11
- 230000005856 abnormality Effects 0.000 claims description 10
- 238000003012 network analysis Methods 0.000 claims description 7
- HRULVFRXEOZUMJ-UHFFFAOYSA-K potassium;disodium;2-(4-chloro-2-methylphenoxy)propanoate;methyl-dioxido-oxo-$l^{5}-arsane Chemical compound [Na+].[Na+].[K+].C[As]([O-])([O-])=O.[O-]C(=O)C(C)OC1=CC=C(Cl)C=C1C HRULVFRXEOZUMJ-UHFFFAOYSA-K 0.000 claims 5
- 238000010586 diagram Methods 0.000 description 18
- 238000004891 communication Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 7
- 230000008569 process Effects 0.000 description 6
- 238000012545 processing Methods 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 4
- 238000004422 calculation algorithm Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 238000005538 encapsulation Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 238000013473 artificial intelligence Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 239000000835 fiber Substances 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 235000008694 Humulus lupulus Nutrition 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network flow monitoring method, a network flow monitoring device and a network flow monitoring system, and relates to the technical field of data centers. One embodiment of the method comprises: the method can acquire information of a plurality of switches and message information copied by the switches in the data center network; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches and time information related to the message transmission, and analyzing the transmission condition of the network transmission link, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be acquired is solved, and the efficiency of network flow control is improved.
Description
Technical Field
The invention relates to the technical field of data centers, in particular to a network traffic monitoring method, device and system.
Background
With the development of technologies such as big data, artificial intelligence and cloud computing, the requirements on computing power and storage performance of data centers on which the technologies depend are higher and higher, so that the capacity of computing and storage equipment of the data centers is continuously expanded, and the network scale of the data centers is also continuously expanded. Due to the enlargement of the network scale of the data center, the problems that the service processing speed becomes slow and the efficiency is reduced are often encountered, which generally results in the situation that a certain switch or certain switches of a transmission link of service traffic in the network of the data center are jammed, so that the transmission delay of the service traffic is increased, and even a service traffic packet is lost.
Therefore, it is very important to monitor the transmission path of the traffic flow to find out the problem existing in the transmission path in time based on the monitoring result. However, there is no effective method for acquiring the transmission path of the traffic flow.
Disclosure of Invention
In view of this, embodiments of the present invention provide a method, an apparatus, and a system for monitoring network traffic, which can obtain information of multiple switches and message information copied by the switches in a data center network; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on messages copied by a plurality of switches and time information related to the message transmission, and analyzing the transmission condition of the network transmission link, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be obtained is solved, and the efficiency of network flow control is improved.
In order to achieve the above object, according to an aspect of an embodiment of the present invention, there is provided a network traffic monitoring method, including: acquiring messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages; determining time information related to the transmission of the message; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
Optionally, the method for monitoring network traffic, where the determining a network transmission link of the service traffic to which the packet belongs, includes: and executing the following operations aiming at each acquired message: analyzing the characteristic information of the message; searching a previously acquired message matched with the characteristic information of the message; and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the previously acquired message, determining the series connection sequence of the switches in the network transmission link where the message is located.
Optionally, the method for monitoring network traffic, where the determining a network transmission link of the service traffic to which the packet belongs, includes: analyzing the stored characteristic information of a plurality of messages; searching a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switches corresponding to the target messages.
Optionally, the network traffic monitoring method, where the obtaining of the packet duplicated by the multiple switches in the data center network includes: the method comprises the steps of obtaining messages which are copied by a plurality of exchangers in a data center network and correspond to services to be monitored.
Optionally, in the network traffic monitoring method, the switch is configured with a plurality of queues, each of the queues is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values, so that a user allocates one reserved DSCP value to the service to be monitored; the acquiring of the message corresponding to the service to be monitored, which is replicated by the plurality of switches in the data center network, includes: and acquiring messages with the reserved DSCP value, which are copied by a plurality of switches in the data center network.
Optionally, the determining time information related to transmitting the packet by the network traffic monitoring method includes: and executing the following operations aiming at each acquired message copied by the switch: and reading an entering timestamp and an leaving timestamp added for the message by the previous switch in the message copied by the switch.
Optionally, the determining time information related to transmitting the packet according to the network traffic monitoring method includes: and recording the writing time of the message copied by the switch.
Optionally, the method for monitoring network traffic, where the determining a network transmission link of the service traffic to which the packet belongs, further includes: and determining that the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp is the initial position of the network transmission link.
Optionally, the analyzing the transmission condition of the network transmission link by the network traffic monitoring method includes: determining a first time difference between an entering time stamp and a leaving time stamp added by the switch in the network transmission link, and determining the switch with the time difference exceeding a preset first time difference threshold value as an abnormal switch.
Optionally, the analyzing the transmission condition of the network transmission link by the network traffic monitoring method includes: and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch with the second time difference exceeding a preset second time difference threshold value as an abnormal switch.
Optionally, the analyzing the transmission condition of the network transmission link by the network traffic monitoring method includes: determining information of one or more target switches connected with a target address of the service flow to which the message belongs; and determining that the network transmission link has packet loss abnormality aiming at the service traffic and determining the switch with the packet loss abnormality aiming at the condition that the information of the last switch in the network transmission link of the service traffic to which the message belongs is inconsistent with the information of any target switch.
To achieve the above object, according to a second aspect of the embodiments of the present invention, there is provided a network traffic monitoring apparatus, including: an acquisition unit and a network analysis unit, wherein,
the acquisition unit is used for acquiring messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages;
the network analysis unit is used for determining time information related to the transmission of the message; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
Optionally, the network traffic monitoring device includes: the determining a network transmission link of the service traffic to which the packet belongs includes: and executing the following operations aiming at each acquired message: analyzing the characteristic information of the message; searching a previously acquired message matched with the characteristic information of the message; and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the previously acquired message, determining the series connection sequence of the switches in the network transmission link where the message is located.
Optionally, the network traffic monitoring device includes: the determining a network transmission link of the service traffic to which the packet belongs includes: analyzing the stored characteristic information of a plurality of messages; searching a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switch corresponding to the target messages.
Optionally, the network traffic monitoring device includes: the obtaining of the messages replicated by the plurality of switches in the data center network includes: the method comprises the steps of obtaining messages which are copied by a plurality of exchangers in a data center network and correspond to services to be monitored.
Optionally, the network traffic monitoring device includes: the switch is configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the DSCP values, so that a user allocates one reserved DSCP value for the service to be monitored; the obtaining of the message corresponding to the service to be monitored, which is copied by a plurality of switches in the data center network, includes: and acquiring messages with the reserved DSCP value, which are copied by a plurality of switches in the data center network.
Optionally, the network traffic monitoring device includes: the determining time information related to the transmission of the packet includes: and executing the following operations aiming at the acquired message copied by each switch: and reading an entering timestamp and an leaving timestamp which are added for the message by the last switch in the message copied by the switch.
Optionally, the network traffic monitoring device includes: the determining time information related to the transmission of the message includes: and recording the writing time of the message copied by the switch.
Optionally, the network traffic monitoring device includes: the determining the network transmission link of the service traffic to which the packet belongs further includes: and determining that the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp is the initial position of the network transmission link.
Optionally, the network traffic monitoring device includes: the analyzing the transmission condition of the network transmission link includes: determining a first time difference between an entering time stamp and a leaving time stamp added by the switch in the network transmission link, and determining the switch with the time difference exceeding a preset first time difference threshold value as an abnormal switch.
Optionally, the network traffic monitoring device includes: the analyzing the transmission condition of the network transmission link includes: and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch with the second time difference exceeding a preset second time difference threshold value as an abnormal switch.
Optionally, the network traffic monitoring device includes: the analyzing the transmission condition of the network transmission link includes: determining information of one or more target switches connected with a target address of the service flow to which the message belongs; and determining that the network transmission link has packet loss abnormality aiming at the service traffic and determining the switch with the packet loss abnormality aiming at the condition that the information of the last switch in the network transmission link of the service traffic to which the message belongs is inconsistent with the information of any target switch.
To achieve the above object, according to a third aspect of the embodiments of the present invention, there is provided a network traffic monitoring system, including: a plurality of switches in a data center network and the network traffic monitoring device of the third aspect.
The switch copies the received message, and adds an entry timestamp and an exit timestamp to the message when sending the message to the next switch, that is, the message includes the entry timestamp and the exit timestamp added to the message by the previous switch or switches; the switch is also provided with a plurality of queues, each queue is provided with a plurality of DSCP values, and one reserved DSCP value exists in the DSCP values so that a user allocates one reserved DSCP value for the service to be monitored; and the message with the reserved DSCP value is copied by a plurality of the switches.
To achieve the above object, according to a fourth aspect of the embodiments of the present invention, there is provided an electronic apparatus for controlling an unmanned vehicle, characterized by comprising: one or more processors; a storage device to store one or more programs that, when executed by the one or more processors, cause the one or more processors to implement the method as in any one of the methods of controlling an unmanned vehicle described above.
To achieve the above object, according to a fifth aspect of an embodiment of the present invention, there is provided a computer-readable medium on which a computer program is stored, characterized in that the program, when executed by a processor, implements the method as in any one of the methods of controlling an unmanned vehicle described above.
One embodiment of the above invention has the following advantages or benefits: the method can acquire the messages copied by a plurality of switches, the information of the switches corresponding to the messages and the time information related to the transmitted messages so as to determine the network transmission link of the service flow to which the messages belong, and analyze the transmission condition of the network transmission link, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be acquired is solved, and the efficiency and the automation degree of network flow control are improved.
Further effects of the above-mentioned non-conventional alternatives will be described below in connection with the embodiments.
Drawings
The drawings are included to provide a better understanding of the invention and are not to be construed as unduly limiting the invention. Wherein:
fig. 1 is a schematic diagram of a main flow of a network traffic monitoring method according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of the architecture of an existing data center network;
FIG. 3 is a schematic diagram of a data center network according to an embodiment of the invention;
fig. 4 is a schematic structural diagram of a DSCP queue included in a switch according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of a network traffic monitoring device according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of a network traffic monitoring system according to an embodiment of the invention;
FIG. 7 is an exemplary system architecture diagram in which embodiments of the present invention may be employed;
fig. 8 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, in which various details of embodiments of the invention are included to assist understanding, and which are to be considered as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.
With the development of internet technology, data centers used for internet applications are also rapidly increasing in scale and quantity. Meanwhile, the development of the fifth generation communication technology, big data, artificial intelligence, cloud computing and other technologies provides support for digital economy, and the increasing data traffic puts more demands on the data center. The data center network needs to be able to provide stable and efficient transmission for network applications in various different scenarios, and ensure normal operation of services. On one hand, the traffic carried by the internet is continuously increased and diversified, the requirement on the network bandwidth is higher, the port rate of the network device inside the data center, such as a switch, is continuously iterated from 10G, 25G, 100G and 400G, and the performance of the network device is also rapidly increased; on the other hand, diversification of service scenes and increase of application scale have higher and higher requirements on data center computing power and storage performance, data center computing and storage equipment is continuously expanded, and network scale is also continuously expanded. How to ensure the stable operation of the high-bandwidth large-scale network puts higher requirements on the design, operation and maintenance and monitoring of the data center network. Fig. 2 shows an architecture topology commonly used in an existing data center network, and as shown in fig. 2, a plurality of redundant links are connected between switches to provide load balancing of traffic. The network shown in fig. 2 is an ECMP (Equal Cost Multi-path), which means that there are multiple paths with the same Cost that can reach the same destination address. The switches in the data center all support the function, such a route exists in the device, that is, the same destination IP network segment corresponds to a plurality of next hops, that is, outlets, and the message sent to the destination IP network segment can be subjected to load sharing through a plurality of paths, and when some paths have faults, other paths can automatically replace the paths to complete flow forwarding. However, the conventional method has the following problems: multiple load balancing links are arranged from a certain physical server to another server, and which link a corresponding certain service flow (such as message information) can go through is determined by the flow-based hash operation of ECMP; the switch will compute the egress link by selecting some fields in the packet as inputs to the hash algorithm, including one or more fields in the packet's five-tuple (destination IP address, source IP address, IP protocol number, destination port number, source port number), the packet's destination MAC address, source MAC address, VLAN ID. The same traffic flow (some of the above field values are the same) is shared on the same link. However, the load balancing hash algorithm has high complexity, and it cannot be determined by a simulation algorithm on which link a certain service flow is distributed, and the switch device also does not provide an external interface for obtaining the service flow.
In the operation and maintenance of the data center network, the problem that a certain service processing speed is slow and the efficiency is reduced is often encountered, and the situation is probably caused by the increase of the transmission delay of a service flow network. In a data center network, the transmission time of a message on a physical link is basically fixed, so that the problem that the forwarding delay of equipment is increased due to congestion of a certain switch exists, and the traffic transmission time is further increased. The switch generally adopts a store-and-forward mode, and first, according to DSCP (Differentiated Services Code Point) values, each service will specify some DSCP values, and different divided Services are cached in different queues of a port, and then queue scheduling is performed for forwarding. The DSCP value range is 0-63, each port of the switch is provided with 8 queues, the mapping relation can be freely configured, when burst flow is met, more and more messages are stored in the buffer queues, the forwarding time delay is gradually increased, and when the queue depth exceeds the maximum storage which can be allocated by the queues, packet loss can occur. However, when this occurs, since the forwarding path of the traffic cannot be known, it cannot be determined which network device is congested or which device is lost.
In view of the above, fig. 1 is a network traffic monitoring method according to an embodiment of the present invention, as shown in fig. 1, the method includes the following steps:
step S101: the method comprises the steps of obtaining messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages.
Specifically, messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages are obtained; taking the schematic structure of the data center network of the embodiment of the present invention shown in fig. 3 as an example, as shown in fig. 3, the data center network includes a source server S1, a target server S2, and an exchange a-exchange F, which send a message; the method comprises the following steps that a message sent by a source server S1 is copied and sent by a plurality of exchangers and finally reaches a target server S2; to complete the transmission of the message. For example, if the message is transmitted through switch a, switch C, and switch B, the message copied by switch a, switch C, and switch B and the information of the switch corresponding to the message (the identifier of switch a, switch C, and switch B) are obtained.
Preferably, a collector (i.e., the network traffic monitoring device according to the present invention) is used to obtain messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages; specifically, each Switch may include a traffic monitoring tool (e.g., an ERSPAN, encapsulated Remote Switch Port Analyzer) based on a Remote network, and each Switch acquires, through the ERSPAN, a packet transmitted by a plurality of switches in the data center network, copies the received packet, encapsulates the packet through GRE (Generic Routing Encapsulation), and then sends the Encapsulated packet to an acquirer for analysis, where the acquirer may be a device with network connection and data processing capabilities such as a server, a cloud service, a client, and the like.
Furthermore, because the data flow in the data center network is large, preferably, the message to be monitored is selectively determined, and the message of the service to be monitored is acquired by using the collector, so that the accuracy and efficiency of monitoring the message are improved, and the consumption of network resources is reduced; the method for determining the message of the service to be monitored by the collector may be determined by analyzing the content of the message, for example: for example, if the HTTP service provided by the IP address 1.1.1.1 port number 80 is a service to be monitored, the real-time status of the service traffic needs to be monitored, so that the message copied by one or more switches associated with the IP address 1.1.1.1 port number 80 is determined as the message of the service to be monitored; that is, the acquiring the messages copied by the switches in the data center network includes: the method comprises the steps of obtaining messages which are copied by a plurality of exchangers in a data center network and correspond to services to be monitored.
Further, the switch is configured with a plurality of queues, each of the queues is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values, so that a user allocates one reserved DSCP value to the service to be monitored; the acquiring of the message corresponding to the service to be monitored, which is replicated by the plurality of switches in the data center network, includes: and acquiring messages with the reserved DSCP value, which are copied by a plurality of switches in the data center network. Specifically, the present invention filters the traffic flow of the service to be monitored by using the DSCP field as a matching item of an ACL (Access Control List), and then performs the operations of ERSPAN and Timestamp (Timestamp). Preferably, the switch may reserve 8 DSCP values for the message of the service to be monitored, and map the DSCP values to 8 queues of the port respectively; fig. 4 shows an example diagram of 8 queues of DSCP set by a switch, and reserved DSCP values included in a plurality of DSCP values included in each of the 8 queues, i.e. each of the queues is configured with a plurality of DSCP values, and one reserved DSCP value exists among the plurality of DSCP values; as shown in fig. 4, for example, the DSCP value range is 0 to 63, each port of the switch has 8 queues, and each queue has a DSCP value range corresponding to the queue, for example: the DSCP value of queue 0 ranges from 0 to 7; the range of the queue 1DSCP value is 8-15, and so on; for example, if the DSCP value reserved by the switch for the service a to be monitored is 1, mapping the DSCP value into the queue 0; the DSCP value reserved for the service to be monitored cannot be used by other services, so that it can be seen that, by reserving 8 DSCPs for monitoring traffic to be mapped to 8 queues of the switch, the forwarding path of the traffic flow of the service to be monitored can be accurately tracked without affecting traffic forwarding.
Step S102: time information associated with transmitting the message is determined.
Specifically, time information related to transmission of a message is analyzed and determined from the message obtained by copying the plurality of switches in the data center network and information of the switches corresponding to the message.
Taking the schematic diagram of fig. 3 as an example, as shown in fig. 3, the switch a receives an original message sent by the source server S1, copies the original message and adds a timestamp, and may add two timestamps, namely, an entry timestamp (i.e., an entry timestamp) and an exit timestamp (i.e., an exit timestamp), to the original message, and add the timestamps, where the timestamp may be 48 bits and is a time format of UTC standard time, where the first 18 bits represent seconds and the last 30 bits represent nanoseconds, it can be understood that a difference between the two timestamps of the entry timestamp and the exit timestamp represents a time when the message stays in the switch a, and the switch a also represents a time when the message is processed by the switch a; further, switch a forwards the message to the next switch (any of switches C/D/E/F). Similarly, assuming that the switch C receives the message sent by the switch a, the same operations of adding the entry timestamp and the exit timestamp as those of the switch a are performed, and further, after receiving the message sent by the switch, the switch B sends the message to the destination server S2; preferably, the message with the timestamp added to each switch is sent to the collector through GRE encapsulation, and the collector analyzes the timestamp of the message, and because the switch through which each message passes all adds two timestamps (i.e., an entry timestamp and an exit timestamp), the switch can be determined to pass through several switches by determining several pairs of timestamps, and the switch sending the message is determined to be a- > C- > B according to the identifier (e.g., unique identifier such as IP address) of the switch included in the message, that is, the time information related to the transmission of the message is determined, including: and executing the following operations aiming at each acquired message copied by the switch: and reading an entering timestamp and an leaving timestamp added for the message by the previous switch in the message copied by the switch.
Further, determining time information associated with transmitting the message includes: and recording the writing time of the message copied by the switch. Preferably, the collector may further record write time of the received packet that is obtained by being copied by the switch, and further detect whether there is a delay in the time when the switch processes the packet, in combination with an entry timestamp and an exit timestamp that are included in the packet and added to the packet by the switch.
Step S103: the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
Specifically, there are two methods for determining a network transmission link of a service traffic to which a packet belongs based on the packet copied by a plurality of switches, information of the switches corresponding to the packet, and time information related to transmission of the packet:
the first method comprises the following steps: determining a network transmission link of the service traffic to which the packet belongs, including: and executing the following operations aiming at each acquired message: analyzing the characteristic information of the message; searching a previously acquired message matched with the characteristic information of the message; and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the previously acquired message, determining the series connection sequence of the switches in the network transmission link where the message is located.
Specifically, feature information is analyzed for each acquired message, where the feature information may be information in a message header or a message body included in a message transmitted on a switch, and it can be understood that the same message forwarded by a plurality of switches includes the same feature information, so that a matched previously acquired message is searched for through the feature information, and in the case of the search, information of a switch corresponding to the message is concatenated to information of a switch corresponding to the previously acquired message, so as to determine a concatenation order of switches in a network transmission link where the message is located; for example: taking the latest acquired message ABC as an example, if the characteristic information acquired by analyzing the message ABC is aaa, searching whether a message containing the characteristic information aaa exists, and determining switch information corresponding to the previous message under the condition of searching; under the condition that the message is not found, storing the message to perform subsequent characteristic information matching operation; for example: the switch information corresponding to the message ABC which is newly acquired by the collector is a switch B; the switch information of the previous message determined by the feature information matching is "switch C", and the time sequence is determined according to the timestamp carried by the message sent by the switch, for example, it is determined that the serial connection sequence of the switches in the network transmission link where the message is located is "switch C" → "switch B", that is, the sequence in which the switch B is serially connected to the switch C is after the switch B is serially connected to the switch C.
The second method comprises the following steps: determining a network transmission link of the service traffic to which the message belongs, including: analyzing the stored characteristic information of a plurality of messages; searching a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switch corresponding to the target messages. Specifically, the collector obtains a plurality of stored messages and finds a plurality of target messages with the same characteristic information; determining the sequence of the information of the switches corresponding to the target messages according to the time information of the target messages; for example: by analyzing the characteristic information "aaa", 3 target messages containing the characteristic information "aaa" are found, time information (for example, any timestamp added by a switch for a message, or time information of a received message, etc.) in the 3 target messages is further analyzed, the sequence of the information of the switches corresponding to the target messages is determined according to the time sequence indicated by the time information, for example, the determined sequence of the information of the switches corresponding to the 3 target messages is "switch a" → "switch C" → "switch B", and the network transmission link of the traffic flow to which the target message belongs is determined to be "switch a" → "switch C" → "switch B" based on the sequence.
Further, determining a network transmission link of the service traffic to which the packet belongs further includes: and determining that the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp is the initial position of the network transmission link. Still taking the schematic diagram of fig. 3 as an example, for example, after the switch a receives the original message sent by the server S1, the switch a copies an original message, performs GRE encapsulation, and sends the original message to the collector, and after the collector receives the encapsulated message, the collector performs analysis to determine that the message with the entry timestamp and the exit timestamp is not read from the original message, and then determines that the switch a corresponding to the original message is the initial position of the network transmission link.
Further, the transmission condition of the network transmission link is analyzed, and specifically, the following analysis method may be included:
the first method comprises the following steps: determining a first time difference between an entering time stamp and a leaving time stamp added by the switch in the network transmission link, and determining the switch with the time difference exceeding a preset first time difference threshold value as an abnormal switch. Specifically, a first time difference between an entry timestamp and an exit timestamp added by a switch for transmitting a message is obtained, it can be understood that the first time difference represents time taken for the switch to process the message, and if the first time difference exceeds a preset first time difference threshold (for example, 500 milliseconds, 3 seconds, 5 seconds, and the like), it indicates that the switch has an abnormal condition such as a hardware abnormality or a transmission message jam, that is, the switch is determined to be an abnormal switch.
The second method comprises the following steps: and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch with the second time difference exceeding a preset second time difference threshold value as an abnormal switch. Specifically, the writing time corresponding to the messages of every two adjacent switches is obtained, and the second time difference between the writing time of every two adjacent switches is determined, for example, as shown in the schematic diagram shown in fig. 3, the network transmission link is "switch a" → "switch C" → "switch B", and if the second time difference between the writing time of the adjacent switch a and the writing time of the adjacent switch C exceeds a preset second time difference threshold (for example, 500 milliseconds, 3 seconds, 5 seconds, and the like), it is indicated that the switch has an abnormal condition such as a hardware abnormality or a transmission message jam, that is, the switch is determined to be an abnormal switch.
The third method comprises the following steps: determining information of one or more target switches connected with a target address of the service flow to which the message belongs; and determining that the network transmission link has packet loss abnormality aiming at the service traffic and determining the switch with the packet loss abnormality aiming at the condition that the information of the last switch in the network transmission link of the service traffic to which the message belongs is inconsistent with the information of any target switch. Specifically, the information of one or more target switches connected to a target address is determined according to the target address (e.g., IP address, MAC address, etc.) of the service traffic, and the information method of the one or more target switches connected to the determined target address may be obtained by parsing from a message corresponding to the service traffic, for example, the parsed target switches are switch a, switch C, and switch B; still taking fig. 3 as an example, in the schematic diagram shown in fig. 3, it is assumed that a network transmission link of a service traffic to which a packet belongs is "switch a" → "switch C" → "switch B", information of a last switch in the network transmission link is acquired, for example, the information of the last switch is information of "switch B", the message information corresponding to switch B is analyzed, if it is determined that the message information of switch B is inconsistent with any one of other target switches (switch a or switch C), it is determined that a packet loss anomaly occurs with respect to the service traffic, and a switch in which the packet loss anomaly occurs may be determined according to the inconsistent information.
Further preferably, the collector (i.e. the network traffic monitoring device) may use the visualized data to show the result obtained by analyzing the data of the network traffic monitoring and the data in the abnormal situation.
As shown in fig. 5, a network traffic monitoring apparatus 500 provided in an embodiment of the present invention includes: an acquisition unit 501 and a network analysis unit 502, wherein,
the acquiring unit 501 is configured to acquire messages copied by multiple switches in a data center network and information of the switches corresponding to the messages;
the network analysis unit 502 is configured to determine time information related to transmission of the packet; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
As shown in fig. 6, a network traffic monitoring system 600 provided in an embodiment of the present invention includes: a plurality of switches 601 in a data center network and a network traffic monitoring device 500. The switch 601 copies the received message, and adds an entry timestamp and an exit timestamp to the message when sending the message to the next switch, that is, the message includes the entry timestamp and the exit timestamp added to the message by the previous switch or switches; the switch 601 is further configured with a plurality of queues, each of the queues is configured with a plurality of DSCP values, and one reserved DSCP value exists in the plurality of DSCP values, so that a user allocates one reserved DSCP value for the service to be monitored; and the message with the reserved DSCP value is copied by a plurality of switches.
An embodiment of the present invention further provides an electronic device for monitoring network traffic, including: one or more processors; the storage device is used for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are enabled to realize the method provided by any one of the above embodiments.
Embodiments of the present invention further provide a computer-readable medium, on which a computer program is stored, where the computer program is executed by a processor to implement the method provided in any of the above embodiments.
Fig. 7 illustrates an exemplary system architecture 700 of a network traffic monitoring method or network traffic monitoring device to which embodiments of the present invention may be applied.
As shown in fig. 7, the system architecture 700 may include terminal devices 701, 702, 703, a network 704 and a server 705 (this architecture is merely an example, and the components included in a specific architecture may be adjusted according to specific application). The network 704 serves to provide a medium for communication links between the terminal devices 701, 702, 703 and the server 705. Network 704 may include various types of connections, such as wire, wireless communication links, or fiber optic cables, to name a few.
A user may use the terminal devices 701, 702, 703 to interact with a server 705 over a network 704, to receive or send messages or the like. Various communication client applications, such as shopping applications, web browser applications, search applications, instant messaging tools, mailbox clients, social platform software, and the like, may be installed on the terminal devices 701, 702, and 703.
The terminal devices 701, 702, 703 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablets, laptop portable computers, switches, desktop computers, and the like.
The server 705 may be a server providing various services, for example, a background management server that processes and analyzes messages sent by the terminal devices 701, 702, and 703. The background management server can analyze and process the received data such as the messages and the like, and feed back the analyzed flow monitoring result to the terminal equipment.
It should be noted that the network traffic monitoring method provided by the embodiment of the present invention is generally executed by the server 705, and accordingly, the network traffic monitoring device is generally disposed in the server 705.
It should be understood that the number of terminal devices, networks, and servers in fig. 7 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
Referring now to FIG. 8, shown is a block diagram of a computer system 800 suitable for use in implementing a terminal device of an embodiment of the present invention. The terminal device shown in fig. 8 is only an example, and should not bring any limitation to the functions and the use range of the embodiment of the present invention.
As shown in fig. 8, the computer system 800 includes a Central Processing Unit (CPU) 801 that can perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM) 802 or a program loaded from a storage section 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data necessary for the operation of the system 800 are also stored. The CPU 801, ROM 802, and RAM 803 are connected to each other via a bus 804. An input/output (I/O) interface 805 is also connected to bus 804.
The following components are connected to the I/O interface 805: an input portion 806 including a keyboard, a mouse, and the like; an output section 807 including a signal such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 808 including a hard disk and the like; and a communication section 809 including a network interface card such as a LAN card, a modem, or the like. The communication section 809 performs communication processing via a network such as the internet. A drive 810 is also connected to the I/O interface 805 as needed. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 810 as necessary, so that the computer program read out therefrom is mounted on the storage section 808 as necessary.
In particular, according to the embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 809 and/or installed from the removable medium 811. The computer program performs the above-described functions defined in the system of the present invention when executed by the Central Processing Unit (CPU) 801.
It should be noted that the computer readable medium shown in the present invention can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present invention, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present invention, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units (or "modules") mentioned in the embodiments of the present invention may be implemented by software, or may be implemented by hardware. The units described (or "modules") may also be provided in a processor, which may be described as: a processor includes an acquisition unit and a network analysis unit, where names of the units do not constitute a limitation to the unit itself in some cases, for example, the acquisition unit may also be described as a "unit that acquires a message duplicated by a plurality of switches in a data center network and information of the switch corresponding to the message".
As another aspect, the present invention also provides a computer-readable medium that may be contained in the apparatus described in the above embodiments; or may be separate and not assembled into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to comprise: acquiring messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages; determining time information related to the transmission of the message; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
According to the technical scheme of the embodiment of the invention, the message copied by a plurality of switches, the information of the switches corresponding to the message and the time information related to the transmission message can be acquired to determine the network transmission link of the service flow to which the message belongs, and the transmission condition of the network transmission link is analyzed, so that a user can manage the network transmission link based on the analysis result, the problem that the network transmission link of the service flow cannot be acquired is solved, and the efficiency and the automation degree of network flow control are improved.
The above-described embodiments should not be construed as limiting the scope of the invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions can occur, depending on design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (15)
1. A network traffic monitoring method is characterized by comprising the following steps:
acquiring messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages;
determining time information related to the transmission of the message;
the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
2. The method according to claim 1, wherein the determining the network transmission link of the service traffic to which the packet belongs comprises:
and executing the following operations aiming at each acquired message:
analyzing the characteristic information of the message;
searching a previously acquired message matched with the characteristic information of the message;
and under the condition of finding, after the information of the switch corresponding to the message is connected in series to the information of the switch corresponding to the previously acquired message, determining the series connection sequence of the switches in the network transmission link where the message is located.
3. The method according to claim 1, wherein the determining the network transmission link of the service traffic to which the packet belongs includes:
analyzing the stored characteristic information of a plurality of messages;
searching a plurality of target messages with the same characteristic information;
determining the sequence of the information of the switch corresponding to the target messages according to the time information of the target messages;
and determining a network transmission link of the service flow to which the target message belongs according to the sequence of the information of the switches corresponding to the target messages.
4. The method according to claim 1, wherein the obtaining the message replicated by the plurality of switches in the data center network comprises:
the method comprises the steps of obtaining messages which are copied by a plurality of exchangers in a data center network and correspond to services to be monitored.
5. The network traffic monitoring method of claim 4,
the switch is configured with a plurality of queues, each queue is configured with a plurality of DSCP values, and one reserved DSCP value exists in the DSCP values, so that a user allocates one reserved DSCP value for the service to be monitored;
the acquiring of the message corresponding to the service to be monitored, which is replicated by the plurality of switches in the data center network, includes:
and acquiring messages with the reserved DSCP value, which are copied by a plurality of switches in the data center network.
6. The method according to claim 1, wherein the determining time information associated with transmitting the packet comprises:
and executing the following operations aiming at each acquired message copied by the switch:
and reading an entering timestamp and an leaving timestamp which are added for the message by the last switch in the message copied by the switch.
7. The method according to claim 1, wherein the determining time information associated with transmitting the packet comprises:
and recording the writing time of the message copied by the switch.
8. The method according to claim 6, wherein the determining the network transmission link of the service traffic to which the packet belongs further comprises:
and determining that the switch information corresponding to the messages which do not read the entering timestamp and the leaving timestamp is the initial position of the network transmission link.
9. The method according to claim 6, wherein the analyzing the transmission condition of the network transmission link includes:
determining a first time difference between an entering time stamp and a leaving time stamp added by the switch in the network transmission link, and determining the switch with the time difference exceeding a preset first time difference threshold value as an abnormal switch.
10. The method according to claim 7, wherein the analyzing the transmission condition of the network transmission link comprises:
and determining a second time difference of the writing time of every two adjacent switches in the network transmission link, and determining the switch with the second time difference exceeding a preset second time difference threshold value as an abnormal switch.
11. The method according to claim 1, wherein the analyzing the transmission condition of the network transmission link includes:
determining information of one or more target switches connected with a target address of the service flow to which the message belongs;
and determining that the network transmission link has packet loss abnormality aiming at the service traffic and determining the switch with the packet loss abnormality aiming at the condition that the information of the last switch in the network transmission link of the service traffic to which the message belongs is inconsistent with the information of any target switch.
12. A network traffic monitoring device, comprising: an acquisition unit and a network analysis unit, wherein,
the acquisition unit is used for acquiring messages copied by a plurality of switches in a data center network and information of the switches corresponding to the messages;
the network analysis unit is used for determining time information related to the transmission of the message; the method comprises the steps of determining a network transmission link of service flow to which a message belongs based on the message copied by a plurality of switches, information of the switches corresponding to the message and time information related to the transmission of the message, and analyzing the transmission condition of the network transmission link so as to enable a user to manage the network transmission link based on the analysis result.
13. A network traffic monitoring system, comprising: a plurality of switches in a data center network and the network traffic monitoring device of claim 12.
14. A network traffic monitoring electronic device, comprising:
one or more processors;
a storage device for storing one or more programs,
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method recited in any of claims 1-11.
15. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-11.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210809695.2A CN115277504B (en) | 2022-07-11 | 2022-07-11 | Network traffic monitoring method, device and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210809695.2A CN115277504B (en) | 2022-07-11 | 2022-07-11 | Network traffic monitoring method, device and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115277504A true CN115277504A (en) | 2022-11-01 |
| CN115277504B CN115277504B (en) | 2024-04-05 |
Family
ID=83764269
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210809695.2A Active CN115277504B (en) | 2022-07-11 | 2022-07-11 | Network traffic monitoring method, device and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115277504B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117544550A (en) * | 2024-01-10 | 2024-02-09 | 紫光恒越技术有限公司 | Method and device for monitoring network quality, storage medium and electronic equipment |
Citations (23)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014141004A1 (en) * | 2013-03-15 | 2014-09-18 | International Business Machines Corporation | Load balancing for physical and virtual networks |
| US20140269731A1 (en) * | 2013-03-15 | 2014-09-18 | International Business Machines Corporation | Reliable link layer for control links between network controllers and switches |
| CN106921588A (en) * | 2015-12-28 | 2017-07-04 | 华为技术有限公司 | A kind of flow control methods, device and equipment |
| CN107465527A (en) * | 2016-06-02 | 2017-12-12 | 中兴通讯股份有限公司 | A kind of network element, pretection switch method and its system |
| US20190190851A1 (en) * | 2017-12-14 | 2019-06-20 | Industrial Technology Research Institute | Method and device for monitoring traffic in a network |
| CN110120887A (en) * | 2019-04-25 | 2019-08-13 | 新华三技术有限公司合肥分公司 | A kind of network quality information monitoring method, electronic equipment and storage medium |
| US10630567B1 (en) * | 2018-02-05 | 2020-04-21 | Illuminate Technologies, Llc | Methods, systems and computer readable media for monitoring communications networks using cross-correlation of packet flows |
| US20200136972A1 (en) * | 2018-10-27 | 2020-04-30 | Cisco Technology, Inc. | Congestion notification reporting for a responsive network |
| WO2020135429A1 (en) * | 2018-12-29 | 2020-07-02 | 中兴通讯股份有限公司 | Traffic analysis method and apparatus, and traffic detection method and apparatus |
| CN111769998A (en) * | 2019-08-13 | 2020-10-13 | 北京京东尚科信息技术有限公司 | Method and device for detecting network delay state |
| EP3767882A1 (en) * | 2019-07-16 | 2021-01-20 | Profitap HQ B.V. | Network traffic monitoring device |
| CN112313910A (en) * | 2018-06-13 | 2021-02-02 | 华为技术有限公司 | Multi-path selection system and method for data center centric metropolitan area networks |
| CN112422357A (en) * | 2019-08-23 | 2021-02-26 | 华为技术有限公司 | Method and device for detecting state of network communication path |
| CN112511383A (en) * | 2020-11-26 | 2021-03-16 | 杭州迪普信息技术有限公司 | Network traffic monitoring method and device |
| CN112737889A (en) * | 2020-12-29 | 2021-04-30 | 迈普通信技术股份有限公司 | Flow processing method, flow monitoring method, device, system and storage medium |
| WO2021155637A1 (en) * | 2020-02-07 | 2021-08-12 | 阿里巴巴集团控股有限公司 | Information processing method, device, and system, and storage medium |
| CN113595809A (en) * | 2020-04-30 | 2021-11-02 | 华为技术有限公司 | Flow monitoring method, related equipment and system |
| CN113949669A (en) * | 2021-10-15 | 2022-01-18 | 湖南八零二三科技有限公司 | Vehicle-mounted network switching device and system capable of automatically configuring and analyzing according to flow |
| CN113973082A (en) * | 2020-07-06 | 2022-01-25 | 华为技术有限公司 | Message processing method and network equipment |
| WO2022067791A1 (en) * | 2020-09-30 | 2022-04-07 | 华为技术有限公司 | Data processing method, data transmission method, and related device |
| CN114629823A (en) * | 2022-05-16 | 2022-06-14 | 鹏城实验室 | Server testing and monitoring method and device, terminal equipment and storage medium |
| CN114629816A (en) * | 2022-03-14 | 2022-06-14 | 京东科技信息技术有限公司 | Method and system for detecting public network IP network state |
| CN114640679A (en) * | 2022-03-14 | 2022-06-17 | 京东科技信息技术有限公司 | Data packet transmission method and device, storage medium and electronic equipment |
-
2022
- 2022-07-11 CN CN202210809695.2A patent/CN115277504B/en active Active
Patent Citations (23)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014141004A1 (en) * | 2013-03-15 | 2014-09-18 | International Business Machines Corporation | Load balancing for physical and virtual networks |
| US20140269731A1 (en) * | 2013-03-15 | 2014-09-18 | International Business Machines Corporation | Reliable link layer for control links between network controllers and switches |
| CN106921588A (en) * | 2015-12-28 | 2017-07-04 | 华为技术有限公司 | A kind of flow control methods, device and equipment |
| CN107465527A (en) * | 2016-06-02 | 2017-12-12 | 中兴通讯股份有限公司 | A kind of network element, pretection switch method and its system |
| US20190190851A1 (en) * | 2017-12-14 | 2019-06-20 | Industrial Technology Research Institute | Method and device for monitoring traffic in a network |
| US10630567B1 (en) * | 2018-02-05 | 2020-04-21 | Illuminate Technologies, Llc | Methods, systems and computer readable media for monitoring communications networks using cross-correlation of packet flows |
| CN112313910A (en) * | 2018-06-13 | 2021-02-02 | 华为技术有限公司 | Multi-path selection system and method for data center centric metropolitan area networks |
| US20200136972A1 (en) * | 2018-10-27 | 2020-04-30 | Cisco Technology, Inc. | Congestion notification reporting for a responsive network |
| WO2020135429A1 (en) * | 2018-12-29 | 2020-07-02 | 中兴通讯股份有限公司 | Traffic analysis method and apparatus, and traffic detection method and apparatus |
| CN110120887A (en) * | 2019-04-25 | 2019-08-13 | 新华三技术有限公司合肥分公司 | A kind of network quality information monitoring method, electronic equipment and storage medium |
| EP3767882A1 (en) * | 2019-07-16 | 2021-01-20 | Profitap HQ B.V. | Network traffic monitoring device |
| CN111769998A (en) * | 2019-08-13 | 2020-10-13 | 北京京东尚科信息技术有限公司 | Method and device for detecting network delay state |
| CN112422357A (en) * | 2019-08-23 | 2021-02-26 | 华为技术有限公司 | Method and device for detecting state of network communication path |
| WO2021155637A1 (en) * | 2020-02-07 | 2021-08-12 | 阿里巴巴集团控股有限公司 | Information processing method, device, and system, and storage medium |
| CN113595809A (en) * | 2020-04-30 | 2021-11-02 | 华为技术有限公司 | Flow monitoring method, related equipment and system |
| CN113973082A (en) * | 2020-07-06 | 2022-01-25 | 华为技术有限公司 | Message processing method and network equipment |
| WO2022067791A1 (en) * | 2020-09-30 | 2022-04-07 | 华为技术有限公司 | Data processing method, data transmission method, and related device |
| CN112511383A (en) * | 2020-11-26 | 2021-03-16 | 杭州迪普信息技术有限公司 | Network traffic monitoring method and device |
| CN112737889A (en) * | 2020-12-29 | 2021-04-30 | 迈普通信技术股份有限公司 | Flow processing method, flow monitoring method, device, system and storage medium |
| CN113949669A (en) * | 2021-10-15 | 2022-01-18 | 湖南八零二三科技有限公司 | Vehicle-mounted network switching device and system capable of automatically configuring and analyzing according to flow |
| CN114629816A (en) * | 2022-03-14 | 2022-06-14 | 京东科技信息技术有限公司 | Method and system for detecting public network IP network state |
| CN114640679A (en) * | 2022-03-14 | 2022-06-17 | 京东科技信息技术有限公司 | Data packet transmission method and device, storage medium and electronic equipment |
| CN114629823A (en) * | 2022-05-16 | 2022-06-14 | 鹏城实验室 | Server testing and monitoring method and device, terminal equipment and storage medium |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117544550A (en) * | 2024-01-10 | 2024-02-09 | 紫光恒越技术有限公司 | Method and device for monitoring network quality, storage medium and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115277504B (en) | 2024-04-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111769998B (en) | Method and device for detecting network delay state | |
| EP3072260B1 (en) | Methods, systems, and computer readable media for a network function virtualization information concentrator | |
| CN112039796B (en) | Data packet transmission method and device, storage medium and electronic equipment | |
| US10284460B1 (en) | Network packet tracing | |
| CN112788060B (en) | Data packet transmission method and device, storage medium and electronic equipment | |
| US20170180235A1 (en) | Technologies for sideband performance tracing of network traffic | |
| US11171869B2 (en) | Microburst detection and management | |
| CN114285781B (en) | SRV6 service flow statistics method, device, electronic equipment and medium | |
| US11336545B2 (en) | Network device measurements employing white boxes | |
| EP2880550B1 (en) | Connection mesh in mirroring asymmetric clustered multiprocessor systems | |
| CN112787913B (en) | Intelligent network card assembly, physical machine, cloud service system and message sending method | |
| US20160248652A1 (en) | System and method for classifying and managing applications over compressed or encrypted traffic | |
| CN115277504B (en) | Network traffic monitoring method, device and system | |
| US11218394B1 (en) | Dynamic modifications to directional capacity of networking device interfaces | |
| CN116886496A (en) | DPU-based data processing method, device, equipment and readable storage medium | |
| WO2022152230A1 (en) | Information flow identification method, network chip, and network device | |
| CN112436951B (en) | Method and device for predicting flow path | |
| CN115250254B (en) | Netflow message distribution processing method and device | |
| CN114827055B (en) | Data mirroring method and device, electronic equipment and switch cluster | |
| Dowling et al. | Building an information-centric and LoRa-based sensing platform for IoT | |
| CN110389785B (en) | Big data processing system and method, electronic equipment and storage medium | |
| US20230394373A1 (en) | Method, apparatus, and system for determining collection period, device, and storage medium | |
| CN113949651B (en) | Network transmission method, device, equipment and storage medium | |
| WO2022166582A1 (en) | Network management method, apparatus, device, and computer readable storage medium | |
| CN117041103A (en) | Communication method and router for named data network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |