CN115484193A - Method, system, storage medium and device for monitoring and analyzing network packet loss flow - Google Patents
Method, system, storage medium and device for monitoring and analyzing network packet loss flow Download PDFInfo
- Publication number
- CN115484193A CN115484193A CN202211004934.3A CN202211004934A CN115484193A CN 115484193 A CN115484193 A CN 115484193A CN 202211004934 A CN202211004934 A CN 202211004934A CN 115484193 A CN115484193 A CN 115484193A
- Authority
- CN
- China
- Prior art keywords
- message
- discarded
- information
- error
- packet loss
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0823—Errors, e.g. transmission errors
- H04L43/0829—Packet loss
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/20—Support for services
- H04L49/208—Port mirroring
Abstract
The invention discloses a method, a system, a storage medium and a device for monitoring and analyzing network packet loss flow, belonging to the technical field of network communication, wherein the method comprises the following steps: adding a discarding information message header in a discarding message to obtain a first discarding message; wherein, the discard information message header includes error information; mirroring the first discarded message to obtain a second discarded message; and sending the second discarded message to the monitoring equipment so that the monitoring equipment analyzes error information carried by the second discarded message to obtain the packet loss reason of the discarded message and perform message discarding statistics to obtain statistical information of the discarded message. The invention can realize the purpose of monitoring packet loss based on the flow, and timely finds the packet loss flow to carry out deep message content-based statistics on the packet loss.
Description
Technical Field
The present invention relates to the field of network communication technologies, and in particular, to a method, a system, a storage medium, and a computer device for monitoring and analyzing network packet loss traffic.
Background
With the expansion of network scale, the number of switching devices in the network also increases sharply, the search for network packet loss becomes complicated, and it is very important to find, analyze and investigate the switching device problems to know the network packet loss in time. Network packet loss is a phenomenon in which a data packet is lost in a channel for various reasons when a destination station is inquired using ping.
The packet loss statistics refers to obtaining packet loss quantity and packet loss rate data according to the difference between all the flows entering the network and the flows leaving the network within a certain measurement time interval. At present, a common switching chip only provides port-based packet loss reason records and packet loss statistics, and can only determine port-based packet loss and cannot determine specific flow.
Traffic differentiation of ACL matches can be performed by ACLs (access control lists). ACL is a packet filtering based access control technique that can filter packets on an interface, allow them to pass or drop, depending on set conditions. The access control list is widely applied to routers and three-layer switches, and by means of the access control list, the access of users to the network can be effectively controlled, so that the network security is guaranteed to the greatest extent. However, the matching items (source MAC, destination MAC, VLAN, quintuple, etc.) of the differentiated traffic supported by the ACL are limited, and the differentiation of packet loss traffic by the ACL is also limited to the matching items supported by the ACL, and cannot perform statistics based on deep-level services; in addition, the ACL belongs to a scarce resource, and a large amount of ACLs are required to be occupied when packet loss reason recording and packet loss statistics based on flow are carried out by using the ACL.
The information disclosed in this background section is only for enhancement of understanding of the general background of the invention and should not be taken as an acknowledgement or any form of suggestion that this information forms the prior art that is already known to a person skilled in the art.
Disclosure of Invention
The invention aims to provide a method, a system, a storage medium and equipment for monitoring and analyzing network packet loss flow, which can quickly read error information by adding a drop information message header, further realize the purpose of monitoring packet loss based on flow, and timely find packet loss flow and carry out deep message content-based statistics on packet loss.
In order to achieve the above object, the present invention provides a method for monitoring network packet loss traffic, which is applied to a switch chip of a switch, and the method includes the following steps:
adding a discarding information message header in a discarding message to obtain a first discarding message; wherein, the discard information message header comprises error information;
mirroring the first discarded message to obtain a second discarded message;
and uploading the second discarded message to the monitoring equipment so that the monitoring equipment analyzes the error information carried by the second discarded message to obtain the packet loss reason of the discarded message and carry out message discarding statistics to obtain the statistical information of the discarded message.
In an embodiment of the present invention, the error information at least includes an error information identifier and information used for packet discard statistics; the information for the message discarding statistics comprises an equipment number ID, source port information, length information of discarded messages and error codes; the error information identifier is used for identifying the discarded message, and the information for message discarding statistics is used after the error information identifier is identified;
the equipment number ID is used for determining the equipment generating the discarded message; the source port information is used for determining a source port generating the discarded message; the length information of the discarded message is used for determining the length of the discarded message and judging whether the discarded message is damaged or not; the error code is used for identifying the error type of the discarded message; analyzing and counting the equipment for generating the discarded messages, the source port for generating the discarded messages, the information of message damage and the error types of the discarded messages to obtain the quantity of the discarded messages generated by each equipment or source port, the quantity of damaged messages and the statistical information of the error types of the discarded messages, and positioning the equipment for generating the discarded messages and the source port.
In an embodiment of the present invention, the mirroring the first discarded packet to obtain a second discarded packet specifically includes the following steps: intercepting the front preset bytes of the first discarded message to obtain an intercepted discarded message, and mirroring the intercepted discarded message to obtain a second discarded message containing the discarded information message header; and adding the discarded information message header into the first preset bytes of the discarded message.
In an embodiment of the present invention, the monitoring device is a switch CPU and/or a remote network monitoring device;
when a remote network monitoring device exists, sending the second discarded message to the remote network monitoring device for error statistical analysis, wherein the specific steps are as follows:
performing service header encapsulation on the second discarded message according to the destination address of the remote network monitoring equipment and the source address of the switch to obtain an encapsulated discarded message;
forwarding the packaged discarded message to a remote network monitoring device so that the remote network monitoring device analyzes the packaged discarded message to perform error statistical analysis;
and when no remote network monitoring equipment exists, sending the second discarded message to the CPU of the switch for error statistical analysis.
The invention also provides an analysis method of network packet loss flow, which is applied to the monitoring equipment, and the method comprises the following steps:
receiving a second discarded message which is sent by a switch chip and obtained by mirroring a first discarded message, wherein the first discarded message is a message of adding a discarded information message header in the discarded message by the switch chip, and the discarded information message header comprises error information;
and analyzing the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
In an embodiment of the present invention, the error information at least includes an error information identifier and information for packet discard statistics; the information for the message discarding statistics comprises an equipment number ID, source port information, length information of discarded messages and error codes; the error information identifier is used for identifying the discarded message, and the information for message discarding statistics is used after the error information identifier is identified;
the equipment number ID is used for determining the equipment generating the discarded message; the source port information is used for determining a source port generating the discarded message; the length information of the discarded message is used for determining the length of the discarded message and judging whether the discarded message is damaged or not; the error code is used for identifying the error type of the discarded message; analyzing and counting the equipment for generating the discarded messages, the source port for generating the discarded messages, the information of message damage and the error types of the discarded messages to obtain the quantity of the discarded messages generated by each equipment or source port, the quantity of damaged messages and the statistical information of the error types of the discarded messages, and positioning the equipment for generating the discarded messages and the source port.
In an embodiment of the present invention, the analyzing the error information in the second discarded packet includes:
the second discarded message is a message obtained by intercepting the front preset bytes of the first discarded message and then mirroring the intercepted bytes; and adding the discarded information message header into the first preset bytes of the discarded message.
In an embodiment of the present invention, the monitoring device is a switch CPU and/or a remote network monitoring device;
when the far-end network monitoring equipment exists, the far-end network monitoring equipment receives a packaged discarded message which is sent by a switch chip and is used for packaging a second discarded message by a service desk, and analyzes the packaged discarded message to obtain the packet loss reason and the statistical information of the discarded message;
and when the remote network monitoring equipment does not exist, the switch CPU analyzes the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
The invention also provides a system for monitoring network packet loss flow, which comprises:
a message header generating module, configured to add a discard information message header to a discard message to obtain a first discard message; wherein, the discard information message header includes error information;
the mirror image module is used for carrying out mirror image on the first discarded message to obtain a second discarded message;
and the sending module is used for sending the second discarded message to the monitoring equipment so that the monitoring equipment can analyze the error information carried by the second discarded message to obtain the packet loss reason of the discarded message and carry out message discarding statistics.
The invention also provides a storage medium, which includes a stored program, wherein the program executes the method for monitoring the network packet loss traffic or/and executes the method for analyzing the network packet loss traffic.
The invention further provides a computer device, which includes a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the processor implements the monitoring method for the network packet loss traffic or/and implements the analysis method for the network packet loss traffic when executing the computer program.
The invention also provides a system for analyzing the network packet loss flow, which comprises the following steps: and the analysis module is used for analyzing the discarded message containing the discarded information message header, wherein the information after the first protocol type information of the discarded message is read is the error information of the discarded message.
Compared with the prior art, according to the method, the system, the storage medium and the equipment for monitoring and analyzing the network packet loss flow, the discarded information message header is added into the discarded message, and the discarded information message header can contain some error information, so that the analysis and the statistics can be directly carried out in the subsequent switch CPU or the remote network monitoring equipment; in addition, the invention sets the purpose of packet loss mirroring on the switch chip, mirrors the packet loss message to the switch CPU or the remote network monitoring equipment, and analyzes and counts the packet loss by the switch CPU or the network monitoring equipment.
Drawings
Fig. 1 is a flowchart of a method for monitoring network packet loss traffic according to an embodiment of the present invention;
FIG. 2 is a diagram of a message format according to an embodiment of the invention;
FIG. 3 is a schematic diagram of a flow of mirror image of a discard message of a switch chip according to an embodiment of the present invention;
fig. 4 is a flowchart of a method for analyzing network packet loss traffic according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of a system for monitoring network packet loss traffic according to an embodiment of the present invention.
Detailed Description
Specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings, but it should be understood that the scope of the present invention is not limited to the specific embodiments.
Throughout the specification and claims, unless explicitly stated otherwise, the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element or component but not the exclusion of any other element or component.
As shown in fig. 1 to fig. 3, a method for monitoring network packet loss traffic according to a preferred embodiment of the present invention is mainly applied to a switch chip of a switch, and specifically includes the following steps:
s1: adding a discard information message header in the discard message to obtain a first discard message.
The step is carried out in the exchange chip, when the exchange chip generates message discarding, a discarding information message header is added in the discarded message, specifically, the discarding information message header is added behind a source mac address of the discarded message. Because the specific data content of the discarded message is after the source mac address of the discarded message is discarded, the discarded information message header is added after the source mac address, the data content added in the discarded information message header and the original data content in the discarded message can be fused together, and therefore, the error information statistics can be conveniently carried out on the packet loss condition of the whole network in the follow-up process, and the method is more convenient.
The discard message is a message format of an ethernet protocol, and includes a destination MAC address (DEST _ MAC), a source MAC address (SRC _ MAC), and a protocol type (etitype), and specifically, a discard information message header is added between the source MAC address (SRC _ MAC) and the protocol type (etitype), as shown in fig. 2.
The discard information packet header includes error information, where the error information includes information of the discard packet used for performing statistics on packet loss traffic. Specifically, the error information at least includes an error information identifier (e.g., an ethernet _ CODE) and information for packet discard statistics, where the ethernet (error _ CODE) is a marker used by a special value to identify a discarded packet, and the information after identifying is information for packet discard statistics.
The information for the PACKET drop statistics includes a device number ID (UNIQUE _ ID), source PORT information (SRC _ PORT), length of dropped PACKET (PACKET _ LEN), and error coding (error _ CODE).
The UNIQUE _ ID is used as the UNIQUE identification of the switching equipment and is used for determining the equipment generating the discarded messages, and further, the statistical information such as the number, the error types and the like of the discarded messages generated by each equipment can be counted according to the equipment generating the discarded messages. The SRC _ PORT is source PORT information of a packet, and is used to determine a source PORT that generates a discarded packet, and further can count statistics information such as the number and error types of discarded packets generated by each source PORT according to the source PORT that generates the discarded packet. The PACKET _ LEN is used to identify the length of the discarded message, and can be used to determine whether the discarded message has message damage information such as character loss. The ERRO _ CODE is used for identifying the error type of the discarded message, and further can count the specific error type of the discarded message.
For example, the ethernet _ CODE may be configured to be 0x8809, when the remote network monitoring device receives a PACKET whose ethernet is 0x8809, the PACKET may be identified as a PACKET discarded by the switch chip, and the device number (UNIQUE _ ID), the source PORT information (SRC _ PORT), the length of the discarded PACKET (PACKET _ LEN), and the error CODE 0x8809 of the discarded PACKET may be obtained by performing PACKET parsing according to the format shown in fig. 2, so as to obtain the device to which the discarded PACKET belongs, from which PORT the discarded PACKET is sent, and whether a character loss and an error type occur, and if 0x8809 indicates a protocol conversion error, it is determined that the discarded PACKET has a protocol conversion error in the transmission process. Therefore, the far-end network monitoring device can count the discarding reasons (such as protocol conversion errors, analysis errors, character loss and the like) of the discarded messages and related statistical data (the total number of the discarded messages, the number of messages corresponding to different discarding reasons, which device has message discarding and the message discarding number of the device, which source port has message discarding and the message discarding number of the source port and other statistical information, and the device and the source port corresponding to the currently discarded messages and other statistical information) according to all the discarded messages received.
Through the above error information contained in the discard information message header, the device generating the discard message, the source port, the message damage and the error type of the discard message can be obtained through the information used for the message discard statistics in the subsequent steps, and the monitoring device analyzes and counts the information to obtain statistics of various discard information, for example, the number of the discard messages generated by each device or each source port, the number of the message damage and the statistical information of the error types of various discard messages, so as to position the device generating the discard message and the source port, and facilitate the subsequent optimization of the device and the source port according to the number of the message damage and the error type.
As shown in fig. 2, the format of the error information added message is a discard message added with a discard information message header, where an etitype (error _ CODE) is used to identify the following information as error information, and the etitype is an etitype carried by the discard message itself, and the two are not the same.
S2: and mirroring the first discarded message to obtain a second discarded message.
In this step, the purpose of mirroring is to mirror the first discarded packet out of the switch chip, which is convenient for analysis in a subsequent switch CPU or a remote network monitoring device.
In the mirroring process, optionally, in order to save bandwidth, after a preset number of bytes are obtained before the first discarded packet is intercepted, the intercepted discarded packet is obtained, and the intercepted discarded packet is mirrored, wherein the intercepted discarded packet at least includes a discarded information packet header. The preset bytes may be 32, 64, etc. bytes.
Because the discard information message header comprises the main information of the discard message, the flow information of the discard message can be obtained by analyzing the discard information message header without reading and analyzing the whole discard message.
S3: and uploading the second discarded messages to monitoring equipment, wherein the monitoring equipment can be a switch CPU and/or remote network monitoring equipment, and error information carried in the discarded information message header is analyzed in the switch CPU and/or the network monitoring equipment to obtain the reason of the discarded messages and carry out message discarding statistics to obtain statistical information of the discarded messages.
As shown in fig. 3, which shows a chip discard message mirroring flow chart, after configuring the second discard message, the mirrored discard message may be selectively sent to the switch CPU and/or the remote network monitoring device according to mirroring configuration (whether mirroring is configured locally or configured to the remote network monitoring device, i.e., whether mirroring is remote mirroring as shown in fig. 3).
When the remote network monitoring equipment exists, the second discarded message can be optionally sent to the remote network monitoring equipment for error statistical analysis, so that the whole network monitoring can be conveniently carried out.
Specifically, the specific step of sending the second discard packet to the remote network monitoring device is as follows:
s301: and performing service header encapsulation on the second discarded message according to the destination address of the remote network monitoring equipment and the source address of the switch, wherein the service header encapsulation is determined by a network channel which can be reached from the packet-discarded node to the remote network monitoring equipment.
The service header encapsulation is to add header information corresponding to the remote network monitoring device when transmitting data in the network, and the main function of the header information is to help the intermediate transmission system to transmit data to a correct destination. For example, if the common L2 is reachable, the destination mac address is encapsulated as the mac address of the remote monitoring device, and the corresponding VLAN is encapsulated, and if the IP is reachable, the destination IP address is encapsulated as the IP address of the remote monitoring device.
S302: and forwarding the message after the service header is packaged to the remote network monitoring equipment.
The method comprises the steps that a far-end network monitoring device analyzes a message encapsulated by a service header to obtain a switching device from which a discarded message comes, the discarded message is identified by first protocol type information (ETHTYPE (ERRO _ CODE)), and the header of the discarded message is analyzed to obtain a source PORT (SRC _ PORT) and an error type (ERRO _ CODE).
In addition, error information statistics based on the switch device port, quintuple and deep packet contents can be carried out on the discarded packet, and the packet loss condition of the whole network can be mastered by counting the discarded packet quantity of each error type.
In this step, the message after the service header encapsulation is forwarded after looking up the table from the entering direction; in the message entering direction, the switch determines whether the message is allowed to enter a forwarding port after table lookup, and if the message is allowed to enter, the message is forwarded to the remote network monitoring equipment through the port.
In addition, the statistical process of the application can be completed in the remote network monitoring equipment, and can also be completed in the switch CPU when the remote network monitoring equipment does not exist.
When there is no remote network monitoring device, the second discarded message may be optionally sent to the local switch CPU for error statistical analysis. The switch CPU identifies the discarded packet by using first protocol type information (e.g., ethype (ERRO _ CODE)) carried by the second discarded packet, and analyzes a header of the discarded packet to obtain a source PORT (SRC _ PORT) and an error type (ERRO _ CODE), so as to perform error information statistics on the discarded packet based on the switch device PORT, the quintuple, and the depth packet content. The packet loss condition of the whole network can be controlled by counting the number of the discarded messages under each error type. Through the steps, error information statistics can be carried out on the message based on the switching equipment, the switching equipment port, the quintuple and the deep message content.
The monitoring device can obtain the device generating the discarded message, the source port, the message damage and the error type of the discarded message through the information for the message discarding statistics, and the monitoring device analyzes and counts the information to obtain statistics of various discarded information, for example, the number of discarded messages generated by each device or each source port, the number of message damage and the error type of various discarded messages are statistical information, so as to position the device generating the discarded message and the source port, and facilitate the subsequent optimization of the device and the source port according to the number of message damage and the error type.
Through the steps, error information statistics can be carried out on the message based on the switching equipment, the switching equipment port, the quintuple and the deep message content. The quintuple is a set composed of five quantities of a source IP address, a source port, a destination IP address, a destination port and a transport layer protocol, can distinguish different sessions, and the corresponding session is unique. The application type is identified through the port number based on the five-tuple error information statistics, and the mode easily causes that some virus or garbage applications are disguised as legal messages by adopting a mode of fake port numbers, so that the detection cannot be carried out. Therefore, the application can also detect the content of the deep message, namely the analysis of the application layer, can identify various applications and the content thereof, and realizes the fine control and analysis of network flow.
The invention relates to a method for monitoring network packet loss flow, which adds a discard information message header in a switch chip discard message, adds the discard information message header to the message when the chip generates the message discard, and sends the message to a switch CPU or a remote network monitoring device according to mirror image configuration, wherein the switch CPU or the network monitoring device can obtain a source port and an error type by analyzing the discard information message header. In addition, by analyzing the discarded messages, the reason of packet loss can be known, and the message discarding statistics can be carried out according to the information of the discarded messages and the flow.
As shown in fig. 4, a method for analyzing network packet loss traffic according to a preferred embodiment of the present invention can be applied to a monitoring device (a switch CPU or a remote network monitoring device) to analyze a discard packet sent by a switch chip in the method for monitoring network packet loss traffic. Specifically, the method comprises the following steps:
s4: and receiving a second discarded message which is sent by the switch chip and obtained by mirroring the first discarded message, wherein the first discarded message is a message in which a discarded information message header is added to the discarded message by the switch chip, and the discarded information message header comprises error information.
The process of adding the discard information header to the first discard message is performed in the switch chip, specifically, the discard information header is added after the source mac address of the discard message. Because the specific data content of the discarded message is after the source mac address of the discarded message is discarded, and the discarded information message header is added after the source mac address, the data content added in the discarded information message header and the original data content in the discarded message can be fused together, so that the error information statistics on the packet loss condition of the whole network can be conveniently carried out subsequently, and the method is more convenient.
The discard message is a message format of an ethernet protocol, and includes a destination MAC address (DEST _ MAC), a source MAC address (SRC _ MAC), and a protocol type (etitype), and specifically, a discard information message header is added between the source MAC address (SRC _ MAC) and the protocol type (etitype), as shown in fig. 2.
The discard information message header includes error information, and the error information includes information of the discard message for counting packet loss traffic. Specifically, the error information at least includes an error information identifier (ERRO _ CODE) and information for packet discard statistics, the error information identifier (ERRO _ CODE) is a marker used for identifying a discarded packet as a special value, and the information after identifying is information for performing packet discard statistics.
The information for the PACKET drop statistics includes a device number ID (UNIQUE _ ID), source PORT information (SRC _ PORT), length of dropped PACKET (PACKET _ LEN), and error coding (error _ CODE).
The UNIQUE _ ID is used as the UNIQUE identification of the switching equipment and is used for determining the equipment generating the discarded messages, and further, the statistical information such as the number, the error types and the like of the discarded messages generated by each equipment can be counted according to the equipment generating the discarded messages. The SRC _ PORT is a source PORT of the packet, and is configured to determine the source PORT that generates the discarded packet, and further may count statistics information such as the number and the error type of the discarded packets generated by each source PORT according to the source PORT that generates the discarded packet. The PACKET _ LEN is used to identify the length of the discarded PACKET, and can be used to determine whether the discarded PACKET has information about PACKET damage such as character loss. The ERRO _ CODE is used for identifying the error type of the discarded message, and further statistics can be carried out according to the specific error type of the discarded message.
For example, etiype (error _ CODE) may be configured to be 0x8809, when the remote network monitoring device receives a message whose etiype is 0x8809, the message may be identified as a mirror message of a message discarded by a chip, and the device and the source port to which the discarded message belongs, the discarding reason, and the discarded original message may be obtained by performing message parsing according to the format shown in fig. 2.
Through the above error information contained in the discard information message header, the device generating the discard message, the source port, the message damage and the error type of the discard message can be obtained through the information used for the message discard statistics in the subsequent steps, and the monitoring device analyzes and counts the information to obtain statistics of various discard information, for example, the number of the discard messages generated by each device or each source port, the number of the message damage and the statistical information of the error types of various discard messages, so as to position the device generating the discard message and the source port, and facilitate the subsequent optimization of the device and the source port according to the number of the message damage and the error type.
As shown in fig. 2, the format of the error information added message is a discard message added with a discard information message header, where an etitype (error _ CODE) is used to identify the following information as error information, and the etitype is an etitype carried by the discard message itself, and the two are not the same.
The process of mirroring the first discarded message into the second discarded message is performed in the switch chip, and the purpose of mirroring is to mirror the first discarded message out of the switch chip, so that the first discarded message can be conveniently analyzed in a subsequent switch CPU or a remote network monitoring device.
In the mirroring process, optionally, in order to save bandwidth, after a preset number of bytes are obtained before the first discarded packet is intercepted, the intercepted discarded packet is obtained, and the intercepted discarded packet is mirrored, where the intercepted discarded packet at least includes a discarded information packet header. The preset bytes may be 32, 64, etc. bytes.
Because the discard information message header comprises the main information of the discard message, the flow information of the discard message can be obtained by analyzing the discard information message header without reading and analyzing the whole discard message.
S5: and analyzing the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
The monitoring device is a switch CPU and/or a remote network monitoring device, and the discard message of the mirror image can be selectively sent to the switch CPU and/or the remote network monitoring device according to the mirror image configuration (whether the mirror image is configured locally or configured to the remote network monitoring device, that is, whether the mirror image is a remote mirror image as shown in fig. 3).
When the far-end network monitoring equipment exists, the far-end network monitoring equipment receives a packaged discarded message which is sent by the switch chip and is used for packaging the second discarded message by the service desk, and analyzes the packaged discarded message to obtain the packet loss reason and the statistical information of the discarded message
The service header encapsulation is to add header information corresponding to a remote network monitoring device when data is transmitted in a network, and the header information mainly serves to help an intermediate transmission system to transmit the data to a correct destination. For example, if the common L2 is reachable, the destination mac address is encapsulated as the mac address of the remote monitoring device, and the corresponding VLAN is encapsulated, and if the IP is reachable, the destination IP address is encapsulated as the IP address of the remote monitoring device.
The message encapsulated by the service header is analyzed by the remote network monitoring equipment to obtain the switching equipment from which the discarded message comes, the discarded message is identified by the first protocol type information (namely ETHTYPE (ERRO _ CODE)), and the header of the discarded message is analyzed to obtain a source PORT (SRC _ PORT) and an error type (ERRO _ CODE). In addition, error information statistics based on the switch device port, quintuple and deep packet contents can be carried out on the discarded packet, and the packet loss condition of the whole network can be mastered by counting the discarded packet quantity of each error type.
In addition, the statistical process of the application can be completed in the remote network monitoring equipment, and can also be completed in the switch CPU when the remote network monitoring equipment does not exist.
And when no remote network monitoring equipment exists, the switch CPU analyzes the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message. The switch CPU identifies the discarded packet by using first protocol type information (e.g., ethype (ERRO _ CODE)) carried by the second discarded packet, and analyzes a header of the discarded packet to obtain a source PORT (SRC _ PORT) and an error type (ERRO _ CODE), so as to perform error information statistics on the discarded packet based on the switch device PORT, the quintuple, and the depth packet content. The packet loss condition of the whole network can be controlled by counting the number of the discarded messages under each error type. Through the steps, error information statistics can be carried out on the message based on the switching equipment, the switching equipment port, the quintuple and the deep message content.
The monitoring device can obtain the device generating the discarded message, the source port, the message damage and the error type of the discarded message through the information for the message discarding statistics, and the monitoring device analyzes and counts the information to obtain statistics of various discarded information, for example, the number of discarded messages generated by each device or each source port, the number of message damage and the error type of various discarded messages are statistical information, so as to position the device generating the discarded message and the source port, and facilitate the subsequent optimization of the device and the source port according to the number of message damage and the error type.
Through the steps, error information statistics can be carried out on the message based on the switching equipment, the ports of the switching equipment, the quintuple and the deep message content. The quintuple is a set composed of five quantities of a source IP address, a source port, a destination IP address, a destination port and a transport layer protocol, can distinguish different sessions, and the corresponding session is unique. The error information statistics based on the quintuple identifies the application type through the port number, and the mode easily causes that some virus or spam applications are disguised as legal messages by adopting a mode of fake port numbers, so that the detection cannot be carried out. Therefore, the application can also detect the content of the deep message, namely the analysis of the application layer, can identify various applications and the content thereof, and realizes the fine control and analysis of network flow.
The method can read the wrong information of the discarded message by analyzing the discarded information message header, and can timely find the packet loss flow to carry out deep message content-based statistics on the packet loss.
As shown in fig. 5, the present invention further provides a system for monitoring network packet loss traffic, including:
the message header generating module 1 is configured to add a discard information message header to a discard message to obtain a first discard message.
The message header generating module 1 is disposed in the switch chip, and when the switch chip generates a message discard, adds a discard information message header to the discard message, specifically, adds the discard information message header to a source MAC address of the discard message. Because the specific data content of the discarded message is after the source MAC address of the discarded message is discarded, the discarded information message header is added after the source MAC address, the data content added in the discarded information message header and the original data content in the discarded message can be fused together, and therefore the error information statistics on the packet loss condition of the whole network can be conveniently carried out subsequently, and the method is more convenient.
The discard message is a message format of an ethernet protocol, and includes a destination MAC address (DEST _ MAC), a source MAC address (SRC _ MAC), and a protocol type (etitype), and specifically, a discard information message header is added between the source MAC address (SRC _ MAC) and the protocol type (etitype), as shown in fig. 2.
The discard information message header includes error information, and the error information includes information of the discard message for counting packet loss traffic. Specifically, the error information at least includes an error information identifier (etitype (error _ CODE)), a device number ID (UNIQUE _ ID), source PORT information (SRC _ PORT), a length of a discarded PACKET (PACKET _ LEN), and an error CODE (error _ CODE).
The UNIQUE _ ID is used as the UNIQUE identification of the switching equipment and is used for determining the equipment generating the discarded messages, and further, the statistical information such as the number, the error types and the like of the discarded messages generated by each equipment can be counted according to the equipment generating the discarded messages. The SRC _ PORT is a source PORT of the packet, and is configured to determine the source PORT that generates the discarded packet, and further may count statistics information such as the number and the error type of the discarded packets generated by each source PORT according to the source PORT that generates the discarded packet. The PACKET _ LEN is used to identify the length of the discarded PACKET, and can be used to determine whether the discarded PACKET has information about PACKET damage such as character loss. The ERRO _ CODE is used for identifying the error type of the discarded message, and further can count the specific error type of the discarded message.
For example, etiype (error _ CODE) may be configured to be 0x8809, when the remote network monitoring device receives a message whose etiype is 0x8809, the message may be identified as a mirror message of a message discarded by a chip, and the device and the source port to which the discarded message belongs, the discarding reason, and the discarded original message may be obtained by performing message parsing according to the format shown in fig. 2.
Through the above error information contained in the discard information message header, the device generating the discard message, the source port, the message damage and the error type of the discard message can be obtained through the information used for the message discard statistics in the subsequent steps, and the monitoring device analyzes and counts the information to obtain statistics of various discard information, for example, the number of the discard messages generated by each device or each source port, the number of the message damage and the statistical information of the error types of various discard messages, so as to position the device generating the discard message and the source port, and facilitate the subsequent optimization of the device and the source port according to the number of the message damage and the error type.
As shown in fig. 2, the format of the message with the error information added is a discard message with a discard information header added, where an etitpype (ERRO _ CODE) is used to identify the following information as the error information, and the etitpype is an etitpype carried by the discard message itself, and the two are not the same.
And the mirror image module 2 is used for carrying out mirror image on the first discarded message to obtain a second discarded message.
The purpose of mirroring by the mirroring module 2 is to mirror the first discarded packet out of the switch chip, which is convenient for analysis in a subsequent switch CPU or a remote network monitoring device.
In the mirroring process, optionally, in order to save bandwidth, after a preset number of bytes are obtained before the first discarded packet is intercepted, the intercepted discarded packet is obtained, and the intercepted discarded packet is mirrored, wherein the intercepted discarded packet at least includes a discarded information packet header. The preset bytes may be 32, 64, etc. bytes.
Because the discard information message header comprises the main information of the discard message, the flow information of the discard message can be obtained by analyzing the discard information message header without reading and analyzing the whole discard message.
And the sending module 3 is configured to send the second discarded message to the switch CPU and/or the remote network monitoring device, where the error information carried in the discarded information message header is analyzed in the switch CPU and/or the network monitoring device to obtain a reason for packet loss, and the packet discarding statistics is performed to obtain statistical information of the discarded message.
The sending module 3 may selectively send the discarded message of the image to the switch CPU and/or the remote network monitoring device according to the image configuration (whether the image is configured locally or configured to the remote network monitoring device, i.e., whether the image is a remote image as shown in fig. 3).
When the remote network monitoring equipment exists, the second discarded message can be optionally sent to the remote network monitoring equipment for error statistical analysis, so that the whole network monitoring can be conveniently carried out.
Specifically, the specific step of sending the second discard packet to the remote network monitoring device is as follows:
s301: and performing service header encapsulation on the second discarded message according to the destination address of the remote network monitoring equipment and the source address of the switch, wherein the service header encapsulation is determined by a network channel which can be reached from the packet-discarded node to the remote network monitoring equipment.
The service header encapsulation is to add header information corresponding to the remote network monitoring device when transmitting data in the network, and the header information mainly serves to help the intermediate transmission system to transmit the data to a correct destination. For example, if the common L2 is reachable, the destination MAC address is encapsulated as the MAC address of the remote monitoring device, and the corresponding VLAN is encapsulated, and if the IP is reachable, the destination IP address is encapsulated as the IP address of the remote monitoring device.
S302: and forwarding the message after the service header is packaged to the remote network monitoring equipment.
The method comprises the steps that a far-end network monitoring device analyzes a message encapsulated by a service header to obtain a switching device from which a discarded message comes, the discarded message is identified by first protocol type information (namely ETHTYPE (ERRO _ CODE)), and the header of the discarded message is analyzed to obtain a source PORT (SRC _ PORT) and an error type (ERRO _ CODE). In addition, error information statistics based on the switch device port, quintuple and deep packet contents can be carried out on the discarded packet, and the packet loss condition of the whole network can be mastered by counting the discarded packet quantity of each error type.
In this step, the message encapsulated by the service header is forwarded after looking up the table by the incoming direction; in the message entering direction, the switch determines whether the message is allowed to enter the forwarding port after table lookup, and if the message is allowed to enter, the message is transferred to the remote network monitoring equipment through the port.
In addition, the statistical process of the application can be completed in the remote network monitoring equipment, and can also be completed in the CPU of the switch when the remote network monitoring equipment does not exist.
When there is no remote network monitoring device, the second discarded message may be optionally sent to the local switch CPU for error statistical analysis. The switch CPU identifies the discarded packet by the first protocol type information (e.g., ethype (ERRO _ CODE)) carried by the second discarded packet, and parses the header of the discarded packet to obtain the source PORT (SRC _ PORT) and the error type (ERRO _ CODE), so as to perform error information statistics on the discarded packet based on the switch device PORT, the quintuple, and the content of the deep packet. The packet loss condition of the whole network can be controlled by counting the number of the discarded messages under each error type. Through the steps, error information statistics can be carried out on the message based on the switching equipment, the switching equipment port, the quintuple and the deep message content.
The monitoring device can obtain the device generating the discarded message, the source port, the message damage and the error type of the discarded message through the information for the message discarding statistics, and the monitoring device analyzes and counts the information to obtain statistics of various discarded information, for example, the number of discarded messages generated by each device or each source port, the number of message damage and the error type of various discarded messages are statistical information, so as to position the device generating the discarded message and the source port, and facilitate the subsequent optimization of the device and the source port according to the number of message damage and the error type.
By the monitoring device, error information statistics can be carried out on the message based on the switching device, the switching device port, the quintuple and the deep message content. The quintuple is a set composed of five quantities of a source IP address, a source port, a destination IP address, a destination port and a transport layer protocol, can distinguish different sessions, and the corresponding session is unique. The application type is identified through the port number based on the five-tuple error information statistics, and the mode easily causes that some virus or garbage applications are disguised as legal messages by adopting a mode of fake port numbers, so that the detection cannot be carried out. Therefore, the application can also detect the content of the deep message, namely the analysis of the application layer, can identify various applications and the content thereof, and realizes the fine control and analysis of network flow.
The invention also comprises a system for analyzing the network packet loss flow, a receiving module, a judging module and a flow analyzing module, wherein the receiving module is used for receiving a second discarded message which is sent by the switch chip and is obtained by mirroring the first discarded message, the first discarded message is a message which is obtained by adding a discarded information message header into the discarded message by the switch chip, and the discarded information message header comprises error information;
and the analysis module is used for analyzing the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
The method can read the wrong information of the discarded message by analyzing the discarded information message header, and can timely find the packet loss flow to carry out deep message content-based statistics on the packet loss.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The foregoing descriptions of specific exemplary embodiments of the present invention have been presented for purposes of illustration and description. It is not intended to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The exemplary embodiments were chosen and described in order to explain certain principles of the invention and its practical application to enable one skilled in the art to make and use various exemplary embodiments of the invention and various alternatives and modifications. It is intended that the scope of the invention be defined by the claims and their equivalents.
Claims (12)
1. A method for monitoring network packet loss flow is applied to a switch chip of a switch, and the method comprises the following steps:
adding a discard information message header in the discard message to obtain a first discard message; wherein, the discard information message header includes error information;
mirroring the first discarded message to obtain a second discarded message;
and sending the second discarded message to the monitoring equipment so that the monitoring equipment analyzes error information carried by the second discarded message to obtain the packet loss reason of the discarded message and perform message discarding statistics to obtain statistical information of the discarded message.
2. The method for monitoring network packet loss traffic according to claim 1, wherein the error information at least includes an error information identifier and information for packet discard statistics; the information for the message discarding statistics comprises an equipment number ID, source port information, length information of discarded messages and error codes; the error information identifier is used for identifying the discarded message, and the information for message discarding statistics is used after the error information identifier is identified;
the equipment number ID is used for determining the equipment generating the discarded message; the source port information is used for determining a source port generating the discarded message; the length information of the discarded message is used for determining the length of the discarded message and judging whether the discarded message is damaged or not; the error code is used for identifying the error type of the discarded message; analyzing and counting the equipment for generating the discarded messages, the source port for generating the discarded messages, the information of message damage and the error types of the discarded messages to obtain the quantity of the discarded messages generated by each equipment or source port, the quantity of damaged messages and the statistical information of the error types of the discarded messages, and positioning the equipment for generating the discarded messages and the source port.
3. The method for monitoring network packet loss traffic according to claim 1, wherein the mirroring is performed on the first discarded packet to obtain a second discarded packet, specifically comprising the following steps: intercepting the front preset bytes of the first discarded message to obtain an intercepted discarded message, and mirroring the intercepted discarded message to obtain a second discarded message containing the discarded information message header; and adding the discarded information message header into the first preset bytes of the discarded message.
4. The method for monitoring network packet loss traffic according to claim 2, wherein the monitoring device is a switch CPU and/or a remote network monitoring device;
when a remote network monitoring device exists, sending the second discarded message to the remote network monitoring device for error statistical analysis, wherein the specific steps are as follows:
performing service header encapsulation on the second discarded message according to the destination address of the remote network monitoring equipment and the source address of the switch to obtain an encapsulated discarded message;
forwarding the packaged discarded message to a remote network monitoring device so that the remote network monitoring device analyzes the packaged discarded message to perform error statistical analysis;
and when no remote network monitoring equipment exists, sending the second discarded message to the CPU of the switch for error statistical analysis.
5. An analytic method of network packet loss traffic is applied to a monitoring device, and the method includes the following steps:
receiving a second discarded message which is sent by a switch chip and obtained by mirroring a first discarded message, wherein the first discarded message is a message of adding a discarded information message header in the discarded message by the switch chip, and the discarded information message header comprises error information;
and analyzing the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
6. The method for analyzing network packet loss traffic according to claim 5, wherein the error information at least includes an error information identifier and information used for packet discard statistics; the information for the message discarding statistics comprises an equipment number ID, source port information, length information of discarded messages and error codes; the error information identifier is used for identifying the discarded message, and the information for message discarding statistics is used after the error information identifier is identified;
the equipment number ID is used for determining the equipment generating the discarded message; the source port information is used for determining a source port generating the discarded message; the length information of the discarded message is used for determining the length of the discarded message and judging whether the discarded message is damaged or not; the error code is used for identifying the error type of the discarded message; analyzing and counting the equipment for generating the discarded messages, the source port for generating the discarded messages, the information of message damage and the error types of the discarded messages to obtain the quantity of the discarded messages generated by each equipment or source port, the quantity of damaged messages and the statistical information of the error types of the discarded messages, and positioning the equipment for generating the discarded messages and the source port.
7. The method for analyzing network packet loss traffic according to claim 5, wherein the analyzing the error information in the second discard message includes:
the second discarded message is a message obtained by intercepting a preset byte before the first discarded message and then mirroring the first discarded message; and adding the discarded information message header into the first preset bytes of the discarded message.
8. The method for analyzing network packet loss traffic according to claim 5, wherein the monitoring device is a switch CPU and/or a remote network monitoring device;
when the far-end network monitoring equipment exists, the far-end network monitoring equipment receives a packaged discarded message which is sent by a switch chip and is used for packaging a second discarded message by a service desk, and analyzes the packaged discarded message to obtain the packet loss reason and the statistical information of the discarded message;
and when the remote network monitoring equipment does not exist, the switch CPU analyzes the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
9. A system for monitoring network packet loss traffic, comprising:
a message header generating module, configured to add a discard information message header to a discard message to obtain a first discard message; wherein, the discard information message header includes error information;
the mirror image module is used for carrying out mirror image on the first discarded message to obtain a second discarded message;
and the sending module is used for sending the second discarded message to the monitoring equipment so that the monitoring equipment can analyze the error information carried by the second discarded message to obtain the packet loss reason of the discarded message and carry out message discarding statistics.
10. A system for analyzing network packet loss traffic is characterized by comprising:
the receiving module is used for receiving a second discarded message which is sent by the switch chip and obtained by mirroring a first discarded message, wherein the first discarded message is a message which is obtained by adding a discarded information message header to the discarded message by the switch chip, and the discarded information message header comprises error information;
and the analysis module is used for analyzing the error information in the second discarded message to obtain the packet loss reason and the statistical information of the discarded message.
11. A storage medium, characterized in that the storage medium comprises a stored program, wherein the program executes the method for monitoring network packet loss traffic according to any one of claims 1 to 4 or/and the method for analyzing network packet loss traffic according to any one of claims 5 to 8.
12. A computer device comprising a processor, a memory and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for monitoring network packet loss traffic according to any one of claims 1 to 4 or/and to implement the method for analyzing network packet loss traffic according to any one of claims 5 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211004934.3A CN115484193A (en) | 2022-08-22 | 2022-08-22 | Method, system, storage medium and device for monitoring and analyzing network packet loss flow |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211004934.3A CN115484193A (en) | 2022-08-22 | 2022-08-22 | Method, system, storage medium and device for monitoring and analyzing network packet loss flow |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115484193A true CN115484193A (en) | 2022-12-16 |
Family
ID=84422998
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211004934.3A Pending CN115484193A (en) | 2022-08-22 | 2022-08-22 | Method, system, storage medium and device for monitoring and analyzing network packet loss flow |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115484193A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117294576A (en) * | 2023-11-27 | 2023-12-26 | 南京华芯科晟技术有限公司 | Abnormal message processing method, device, equipment and medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104717150A (en) * | 2013-12-13 | 2015-06-17 | 中兴通讯股份有限公司 | Exchange device and packet loss method |
| CN105897511A (en) * | 2016-04-11 | 2016-08-24 | 烽火通信科技股份有限公司 | Analysis method and system for sending packet to CPU for screening based on packet loss reason |
| CN106559395A (en) * | 2015-09-29 | 2017-04-05 | 北京东土军悦科技有限公司 | A kind of data message detection method and device based on industrial network |
| CN110324198A (en) * | 2018-03-30 | 2019-10-11 | 华为技术有限公司 | Loss treating method and packet loss processing unit |
| CN111953568A (en) * | 2020-08-19 | 2020-11-17 | 杭州迪普科技股份有限公司 | Method and device for managing packet loss information |
| CN114006806A (en) * | 2021-10-26 | 2022-02-01 | 苏州浪潮智能科技有限公司 | Message processing method and device, switch equipment and storage medium |
-
2022
- 2022-08-22 CN CN202211004934.3A patent/CN115484193A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104717150A (en) * | 2013-12-13 | 2015-06-17 | 中兴通讯股份有限公司 | Exchange device and packet loss method |
| CN106559395A (en) * | 2015-09-29 | 2017-04-05 | 北京东土军悦科技有限公司 | A kind of data message detection method and device based on industrial network |
| CN105897511A (en) * | 2016-04-11 | 2016-08-24 | 烽火通信科技股份有限公司 | Analysis method and system for sending packet to CPU for screening based on packet loss reason |
| CN110324198A (en) * | 2018-03-30 | 2019-10-11 | 华为技术有限公司 | Loss treating method and packet loss processing unit |
| CN111953568A (en) * | 2020-08-19 | 2020-11-17 | 杭州迪普科技股份有限公司 | Method and device for managing packet loss information |
| CN114006806A (en) * | 2021-10-26 | 2022-02-01 | 苏州浪潮智能科技有限公司 | Message processing method and device, switch equipment and storage medium |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117294576A (en) * | 2023-11-27 | 2023-12-26 | 南京华芯科晟技术有限公司 | Abnormal message processing method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10148573B2 (en) | Packet processing method, node, and system | |
| EP3958521A1 (en) | Method and apparatus for providing service for service flow | |
| Phaal et al. | InMon corporation's sFlow: A method for monitoring traffic in switched and routed networks | |
| US8705362B2 (en) | Systems, methods, and apparatus for detecting a pattern within a data packet | |
| US8218539B2 (en) | Flexible packet field processor | |
| US20040003094A1 (en) | Method and apparatus for mirroring traffic over a network | |
| US9356844B2 (en) | Efficient application recognition in network traffic | |
| US20070171826A1 (en) | System, method, and computer program product for controlling output port utilization | |
| EP1517517A1 (en) | IP time to live (ttl) field used as a covert channel | |
| EP3082293B1 (en) | Switching device and packet loss method therefor | |
| CN110557342B (en) | Apparatus for analyzing and mitigating dropped packets | |
| WO2022078293A1 (en) | Method for detecting multicast service flow and related apparatus | |
| CN109510785B (en) | Method and device for mirroring message | |
| CN106685827B (en) | Downlink message forwarding method and AP (access point) equipment | |
| CN101626323A (en) | Method and device for monitoring network data flow | |
| US7478168B2 (en) | Device, method and program for band control | |
| CN105591989B (en) | Chip implementation method for uploading protocol message to CPU | |
| US20170222953A1 (en) | User packet forwarding control method and processing node | |
| CN115484193A (en) | Method, system, storage medium and device for monitoring and analyzing network packet loss flow | |
| CN112787902B (en) | Message encapsulation method and device and message decapsulation method and device | |
| KR101292873B1 (en) | Network interface card device and method of processing traffic by using the network interface card device | |
| CN115174676A (en) | Convergence and shunt method and related equipment thereof | |
| US20160248652A1 (en) | System and method for classifying and managing applications over compressed or encrypted traffic | |
| CN110224932B (en) | Method and system for rapidly forwarding data | |
| WO2017070965A1 (en) | Data processing method based on software defined network and related device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |