TWI721103B - Cluster accurate speed limiting method and device - Google Patents
Cluster accurate speed limiting method and device Download PDFInfo
- Publication number
- TWI721103B TWI721103B TW106105141A TW106105141A TWI721103B TW I721103 B TWI721103 B TW I721103B TW 106105141 A TW106105141 A TW 106105141A TW 106105141 A TW106105141 A TW 106105141A TW I721103 B TWI721103 B TW I721103B
- Authority
- TW
- Taiwan
- Prior art keywords
- data packet
- header
- module
- identity information
- client
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 66
- 238000012545 processing Methods 0.000 claims abstract description 39
- 230000005540 biological transmission Effects 0.000 claims description 117
- 238000005538 encapsulation Methods 0.000 claims description 38
- 230000004044 response Effects 0.000 claims description 19
- 238000012790 confirmation Methods 0.000 claims description 6
- 238000004806 packaging method and process Methods 0.000 claims description 5
- 230000008569 process Effects 0.000 description 21
- 238000010586 diagram Methods 0.000 description 15
- 238000005516 engineering process Methods 0.000 description 12
- 238000004891 communication Methods 0.000 description 10
- 230000006870 function Effects 0.000 description 8
- 238000004590 computer program Methods 0.000 description 7
- 238000012546 transfer Methods 0.000 description 6
- 238000004458 analytical method Methods 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 238000004422 calculation algorithm Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000000750 progressive effect Effects 0.000 description 2
- 230000000717 retained effect Effects 0.000 description 2
- 230000011218 segmentation Effects 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000000295 complement effect Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
- H04L65/40—Support for services or applications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
- H04L67/1004—Server selection for load balancing
- H04L67/1014—Server selection for load balancing based on the content of a request
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Multimedia (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本發明實施例提供了一種集群精確限速方法和裝置,涉及電腦技術領域。本發明的方法包括:接收資料包;判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體;如果所述資料包是由自身負責應對的客戶端的資料包,則基於所述資料包的身份資訊,對所述資料包進行限速處理。本發明不用單獨在集群內設置一個流控實體對整個集群內的服務實體進行限速,不會因為該流控實體的故障而影響整個集群的正常工作,適用性強。而且僅僅是服務實體之間的資料包的簡單轉發,複雜度低。 The embodiment of the present invention provides a cluster accurate speed limiting method and device, which relate to the technical field of computers. The method of the present invention includes: receiving a data package; judging whether the data package is a data package of a client that is responsible for responding by itself; if the data package is not a data package of a client that is responsible for responding, forwarding the data package To the service entity responsible for responding to the client to which the data package belongs; if the data package is a data package of the client that is responsible for responding to the data package, the data package is subjected to speed limit processing based on the identity information of the data package. The present invention does not need to separately set a flow control entity in the cluster to limit the speed of the service entities in the entire cluster, and will not affect the normal operation of the entire cluster due to the failure of the flow control entity, and has strong applicability. Moreover, it is only simple forwarding of data packets between service entities, with low complexity.
Description
本發明係有關電腦技術領域,尤其是一種集群精確限速方法和一種集群精確限速裝置。 The invention relates to the field of computer technology, in particular to a cluster accurate speed limiting method and a cluster accurate speed limiting device.
隨著網路的普及,網路的應用環境也越來越多樣化,例如利用由一組協同工作的服務實體構成的集群對多客戶端或者多用戶提供服務。在此類應用環境中,為了防止某一客戶端的流量過大而影響其它客戶端或者基於某一客戶端所購買的寬帶流量的需求,需要針對每個客戶端或者用戶的流量進行限速。由於集群中包含多個服務實體,例如伺服器等。每個服務實體都同時提供服務,進而會造成同一客戶端的流量會落到集群的多個服務實體上。這樣如果每個服務實體單獨限速,那麼隨著集群規模的擴大,每個客戶端總的限速帶寬也在擴大,因此需要提供一種精確的針對集群的全域的限速方案。 With the popularization of the Internet, the application environment of the Internet has become more and more diversified. For example, a cluster composed of a group of cooperative service entities is used to provide services to multiple clients or multiple users. In this type of application environment, in order to prevent the excessive traffic of a client from affecting other clients or the demand for broadband traffic purchased by a client, it is necessary to limit the rate of traffic of each client or user. Because the cluster contains multiple service entities, such as servers. Each service entity provides services at the same time, which will cause the traffic of the same client to fall on multiple service entities in the cluster. In this way, if each service entity individually limits the rate, then as the cluster scale expands, the total rate-limiting bandwidth of each client is also expanding. Therefore, it is necessary to provide an accurate cluster-wide rate-limiting solution.
為了實現達到針對集群的精確限速的目的,目前主要存在如下三類方案: In order to achieve the purpose of precise speed limiting for clusters, there are currently three types of solutions as follows:
第一類:集群內使用專門的流控實體,例如流控伺服 器等,用於控制每台服務實體的限速。流控實體負責監控服務實體上的每個限速單元的流量速率,並動態分配限速帶寬大小。 The first type: use a dedicated flow control entity in the cluster, such as a flow control servo It is used to control the speed limit of each service entity. The flow control entity is responsible for monitoring the flow rate of each rate-limiting unit on the service entity, and dynamically allocates the size of the rate-limiting bandwidth.
第二類:集群內每個服務實體平均分配客戶端或者用戶購買的帶寬,假設集群有N台服務實體,用戶購買帶寬大小為B,那麼每台服務實體的限速大小就是B/N。 The second type: each service entity in the cluster equally distributes the bandwidth purchased by the client or user. Assuming that there are N service entities in the cluster, and the bandwidth purchased by the user is B, then the speed limit of each service entity is B/N.
第三類:在客戶端和集群之間提供專門的由具有限速功能的裝置構成的限速結點。 The third category: Provide a special rate-limiting node composed of a device with a rate-limiting function between the client and the cluster.
但是對於上述的三類方法,均存在不同的缺點: But for the above three types of methods, there are different shortcomings:
對於第一類方案,首先需要在集群內提供一個流控實體來控制限速,該流控實體如果故障,會影響集群的正常工作,適用性不強。其次,由於流控實體需要監控服務實體的流量速率,因此其需要與服務實體進行大量的通訊來決策給每個服務實體下發的限速大小,複雜度較高。 For the first type of solution, it is first necessary to provide a flow control entity in the cluster to control the rate limit. If the flow control entity fails, it will affect the normal operation of the cluster, and the applicability is not strong. Secondly, because the flow control entity needs to monitor the flow rate of the service entity, it needs to conduct a lot of communication with the service entity to decide the size of the rate limit issued to each service entity, and the complexity is high.
對於第二類方案,首先很難保證每個客戶端的流量均勻落到每個服務實體上,可操作性較低。其次如果客戶端的流量不均勻,那麼就會存在部分服務實體上針對某些客戶端的流量大於具體的限速值,從而丟包,造成用戶的實際帶寬達不到其購買的帶寬大小,精確性較低。 For the second type of solution, it is difficult to ensure that the traffic of each client falls evenly on each service entity, and the operability is low. Secondly, if the client's traffic is uneven, then there will be some service entities for some clients whose traffic is greater than the specific rate limit, resulting in packet loss, causing the user's actual bandwidth to fall short of the bandwidth purchased, which is more accurate low.
對於第三類方案,增加專門的限速結點,增加成本,對於小型集群不適用。 For the third type of solution, special speed-limiting nodes are added and the cost is increased, which is not applicable to small clusters.
鑒於上述問題,提出了本發明實施例以便提供一種克 服上述問題或者至少部分地解決上述問題的一種集群精確限速方法和相應的一種集群精確限速裝置。 In view of the above problems, the embodiments of the present invention are proposed in order to provide a A cluster accurate speed limiting method and a corresponding cluster accurate speed limiting device that satisfy the above-mentioned problems or at least partially solve the above-mentioned problems.
為了解決上述問題,本發明揭露了一種集群精確限速方法,包括:接收資料包;判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體;如果所述資料包是由自身負責應對的客戶端的資料包,則基於所述資料包的身份資訊,對所述資料包進行限速處理。 In order to solve the above problems, the present invention discloses a cluster accurate rate limiting method, including: receiving a data packet; determining whether the data packet is a data packet of a client that is responsible for responding to it; if the data packet is not responsible for responding to it The data package of the client is forwarded to the service entity responsible for responding to the client to which the data package belongs; if the data package is the data package of the client to which it is responsible, it is based on the identity information of the data package , Perform speed limit processing on the data packet.
較佳地,所述將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體的步驟,包括:基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部;將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。 Preferably, the step of forwarding the data packet to a service entity responsible for responding to the client to which the data packet belongs includes: based on the identity information of the data packet, and then according to the network transmission outside the data packet The rules of the protocol encapsulate the protocol header; the data packet encapsulated with the protocol header is forwarded through the switch to the service entity responsible for responding to the client to which the data packet belongs.
較佳地,基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部的步驟,包括:基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文 頭,或者基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 Preferably, based on the identity information of the data packet, the step of encapsulating the protocol header in addition to the data packet according to the rules of the network transmission protocol includes: based on the identity information of the data packet, in the data packet Outside the packet, encapsulate a layer of IP header and UDP message according to the rules of the network transmission protocol Header, or based on the identity information of the data packet, a layer of IP header and TCP header is encapsulated in addition to the data packet in accordance with the rules of the network transmission protocol.
較佳地,所述基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭,或者基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭的步驟,包括:獲取所述資料包對應的身份資訊;根據所述身份資訊,選擇同一個五元組;所述五元組包括:源IP位址,目的IP位址,源端口,目的端口,傳輸協議類型;所述目的IP位址為服務實體對應的IP位址;基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭;或者,基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 Preferably, based on the identity information of the data packet, a layer of IP header and UDP header is encapsulated in addition to the data packet in accordance with the rules of the network transmission protocol, or based on the identity information of the data packet, The step of encapsulating a layer of IP header and TCP header in addition to the data packet according to the rules of the network transmission protocol includes: obtaining the identity information corresponding to the data packet; selecting the same five yuan according to the identity information Group; the five-tuple includes: source IP address, destination IP address, source port, destination port, transmission protocol type; the destination IP address is the IP address corresponding to the service entity; based on the five-tuple Encapsulating a layer of IP header and UDP header outside the data packet according to the rules of the network transmission protocol; or, based on the five-tuple, according to the rules of the network transmission protocol outside the data packet Encapsulate a layer of IP header and TCP header.
較佳地,當所述身份資訊為IP位址時,所述獲取所述資料包對應的身份資訊的步驟包括:在網路層解析所述資料包的IP報文頭,以獲取IP位址。 Preferably, when the identity information is an IP address, the step of obtaining the identity information corresponding to the data packet includes: parsing the IP header of the data packet at the network layer to obtain the IP address.
較佳地,當所述身份資訊為用戶ID時,所述獲取所述資料包對應的身份資訊的步驟包括:將所述資料包暫存在網路層,同時將所述資料包向上 發送至應用層;在應用層解析所述資料包的資料區,以獲取所述資料包的用戶ID。 Preferably, when the identity information is the user ID, the step of obtaining the identity information corresponding to the data packet includes: temporarily storing the data packet in the network layer, and at the same time uploading the data packet Send to the application layer; analyze the data area of the data packet at the application layer to obtain the user ID of the data packet.
較佳地,所述根據所述身份資訊,選擇同一個五元組的步驟,包括:在應用層根據所述身份資訊,選擇同一個五元組;則在根據所述身份資訊,選擇同一個五元組的步驟之後,還包括:將在應用層獲得的五元組發送至網路層。 Preferably, the step of selecting the same quintuple based on the identity information includes: selecting the same quintuple based on the identity information at the application layer; then selecting the same quintuple based on the identity information After the quintuple step, it also includes: sending the quintuple obtained at the application layer to the network layer.
較佳地,所述基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭的步驟,包括:將所述五元組中的源端口、目的端口封裝到所述資料包之外的UDP報文頭中;將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 Preferably, the step of encapsulating a layer of IP header and UDP header in addition to the data packet according to the rules of the network transmission protocol based on the quintuple includes: The source port and the destination port are encapsulated into the UDP header outside the data packet; the source IP address, destination IP address and transmission protocol type in the five-tuple are encapsulated into the IP outside the data packet In the header of the message.
較佳地,所述基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭的步驟,包括:將所述五元組中的源端口、目的端口封裝到所述資料包之外的TCP報文頭中;將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 Preferably, the step of encapsulating a layer of IP header and TCP header in addition to the data packet according to the rules of the network transmission protocol based on the quintuple includes: The source port and the destination port are encapsulated into the TCP header outside the data packet; the source IP address, destination IP address, and transmission protocol type in the five-tuple are encapsulated into the IP outside the data packet In the header of the message.
較佳地,所述判斷所述資料包是否為由自身負責應對 的客戶端的資料包的步驟,包括:判斷所述資料包是由服務實體轉發的資料包還是由客戶端發送的資料包;如果所述資料包是由服務實體轉發的資料包,則確認所述資料包是自身負責應對的客戶端的資料包;如果所述資料包是由客戶端發送的資料包,則確認所述資料包不是由自身負責應對的客戶端的資料包。 Preferably, said judging whether said data packet is handled by itself The step of the data package of the client includes: determining whether the data package is a data package forwarded by a service entity or a data package sent by a client; if the data package is a data package forwarded by the service entity, confirming the data package The data package is the data package of the client that is responsible for the response; if the data package is a data package sent by the client, it is confirmed that the data package is not the data package of the client that is responsible for the response.
較佳地,上述判斷所述資料包是由服務實體轉發的資料包還是由客戶端發送的資料包的步驟,包括:針對任一資料包,判斷在所述資料包之外是否存在按照網路傳輸協議的規則封裝的協議頭部;如果在所述資料包之外存在按照網路傳輸協議的規則封裝的協議頭部,則確認所述資料包是自身負責應對的客戶端的資料包;如果在所述資料包之外不存在按照網路傳輸協議的規則封裝的協議頭部,則確認所述資料包不是由自身負責應對的客戶端的資料包。 Preferably, the step of judging whether the data packet is a data packet forwarded by the service entity or a data packet sent by the client includes: for any data packet, judging whether there is a data packet outside the data packet according to the network The protocol header encapsulated by the rules of the transmission protocol; if there is a protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, it is confirmed that the data packet is the data packet of the client that it is responsible for responding to; If there is no protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, it is confirmed that the data packet is not a data packet of the client for which it is responsible for responding.
較佳地,所述基於所述資料包的身份資訊,對所述資料包進行限速處理的步驟,包括:解除所述資料包之外按照網路傳輸協議的規則封裝的協議頭部;獲取所述資料包的身份資訊;判斷所述身份資訊對應的流量是否超過到流量閾值;如果所述身份資訊對應的流量超過流量閾值,則丟棄 所述資料包。 Preferably, the step of performing rate limiting processing on the data packet based on the identity information of the data packet includes: releasing the protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet; and obtaining The identity information of the data packet; determine whether the flow corresponding to the identity information exceeds the flow threshold; if the flow corresponding to the identity information exceeds the flow threshold, discard The data package.
較佳地,當所述身份資訊為IP位址時,所述判斷所述身份資訊對應的流量是否達到閾值的步驟,包括:查找所述IP位址對應的用戶ID;根據所述用戶ID查找對應的流量閾值;計算所述IP位址對應的流量是否超過所述流量閾值;如果所述IP位址對應的流量超過所述流量閾值,則丟棄所述資料包。 Preferably, when the identity information is an IP address, the step of judging whether the traffic corresponding to the identity information reaches a threshold includes: searching the user ID corresponding to the IP address; searching according to the user ID Corresponding flow threshold; calculating whether the flow corresponding to the IP address exceeds the flow threshold; if the flow corresponding to the IP address exceeds the flow threshold, discarding the data packet.
相應地,本發明還揭露了一種集群精確限速裝置,包括:接收模組,適於接收資料包;判斷模組,適於判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則進入轉發模組;如果所述資料包是由自身負責應對的客戶端的資料包,則進入限速模組;轉發模組,適於將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體;限速模組,適於基於所述資料包的身份資訊,對所述資料包進行限速處理。 Correspondingly, the present invention also discloses a cluster accurate rate limiting device, including: a receiving module, suitable for receiving data packets; a judging module, suitable for judging whether the data packet is a data packet of a client that is responsible for its response; If the data packet is not a data packet of a client that is handled by itself, then it enters the forwarding module; if the data packet is a data packet of a client that is handled by itself, it enters the rate limiting module; the forwarding module is suitable. After forwarding the data packet to a service entity responsible for responding to the client to which the data packet belongs; the rate limiting module is adapted to perform rate limiting processing on the data packet based on the identity information of the data packet.
較佳地,所述轉發模組,包括:封裝子模組,適於基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部;轉發子模組,適於將封裝了協議頭部的資料包通過交 換機轉發給負責應對所述資料包所屬客戶端的服務實體。 Preferably, the forwarding module includes: an encapsulation sub-module, adapted to encapsulate a protocol header in addition to the data packet according to the rules of the network transmission protocol based on the identity information of the data packet; and the forwarding sub-module Module, suitable for passing the data packet encapsulating the protocol header The replacement is forwarded to the service entity responsible for responding to the client to which the data packet belongs.
較佳地,所述封裝子模組,包括:第一封裝子模組,適於基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭;或者,第二封裝子模組,適於基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 Preferably, the encapsulation sub-module includes: a first encapsulation sub-module, adapted to encapsulate a layer of IP packets in addition to the data packet in accordance with the rules of the network transmission protocol based on the identity information of the data packet Header and UDP header; or, the second encapsulation sub-module is adapted to encapsulate a layer of IP header and TCP header in addition to the data packet according to the rules of the network transmission protocol based on the identity information of the data packet .
較佳地,所述第一封裝子模組,或者,第二封裝子模組,包括:身份資訊獲取子模組,適於獲取所述資料包對應的身份資訊;五元組選擇子模組,適於根據所述身份資訊,選擇同一個五元組;所述五元組包括:源IP位址,目的IP位址,源端口,目的端口,傳輸協議類型;所述目的IP位址為服務實體對應的IP位址;第一報文頭封裝子模組,適於基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭;或者,第二報文頭封裝子模組,適於基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 Preferably, the first packaging sub-module or the second packaging sub-module includes: an identity information obtaining sub-module, adapted to obtain the identity information corresponding to the data packet; and a quintuple selection sub-module , Suitable for selecting the same quintuple according to the identity information; the quintuple includes: source IP address, destination IP address, source port, destination port, transmission protocol type; the destination IP address is The IP address corresponding to the service entity; the first packet header encapsulation submodule is suitable for encapsulating a layer of IP packet header and UDP packet header in addition to the data packet according to the rules of the network transmission protocol based on the quintuple Or, the second packet header encapsulation submodule is adapted to encapsulate a layer of IP packet header and TCP packet header in addition to the data packet according to the rules of the network transmission protocol based on the five-tuple.
較佳地,其中,當所述身份資訊為IP位址時,所述身份資訊獲取子模組包括:第一身份資訊獲取子模組,適於在網路層解析所述資 料包的IP報文頭,以獲取IP位址。 Preferably, wherein, when the identity information is an IP address, the identity information acquisition sub-module includes: a first identity information acquisition sub-module adapted to analyze the data at the network layer The IP header of the material packet to obtain the IP address.
較佳地,當所述身份資訊為用戶ID時,所述身份資訊獲取子模組包括:向上發送子模組,適於將所述資料包暫存在網路層,同時將所述資料包向上發送至應用層;第二身份資訊獲取子模組,適於在應用層解析所述資料包的資料區,以獲取所述資料包的用戶ID。 Preferably, when the identity information is a user ID, the identity information acquisition sub-module includes: an upward sending sub-module, which is adapted to temporarily store the data packet in the network layer and at the same time upload the data packet Sent to the application layer; the second identity information acquisition sub-module is adapted to parse the data area of the data packet at the application layer to obtain the user ID of the data packet.
較佳地,所述五元組選擇子模組,包括:應用層五元組選擇子模組,適於在應用層根據所述身份資訊,選擇同一個五元組;則在五元組選擇子模組之後,還包括:發送子模組,適於將在應用層獲得的五元組發送至網路層;較佳地,所述第一報文頭封裝子模組,包括:第一端口封裝子模組,適於將所述五元組中的源端口、目的端口封裝到所述資料包之外的UDP報文頭中;IP位址封裝子模組,適於將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 Preferably, the quintuple selection submodule includes: an application layer quintuple selection submodule, which is suitable for selecting the same quintuple at the application layer according to the identity information; then selecting the quintuple at the application layer After the sub-module, it further includes: a sending sub-module, adapted to send the quintuple obtained at the application layer to the network layer; preferably, the first header encapsulation sub-module includes: a first port The encapsulation submodule is suitable for encapsulating the source port and the destination port in the quintuple into a UDP header outside the data packet; the IP address encapsulation submodule is suitable for encapsulating the quintuple The source IP address, destination IP address, and transmission protocol type in the data packet are encapsulated in the IP header outside the data packet.
較佳地,所述第二報文頭封裝子模組,包括:第二端口封裝子模組,適於將所述五元組中的源端口、目的端口封裝到所述資料包之外的TCP報文頭中;IP位址封裝子模組,適於將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外 的IP報文頭中。 Preferably, the second packet header encapsulation sub-module includes: a second port encapsulation sub-module, adapted to encapsulate the source port and the destination port in the five-tuple to the TCP outside the data packet In the message header: IP address encapsulation sub-module, suitable for encapsulating the source IP address, destination IP address and transmission protocol type in the five-tuple out of the data packet In the IP packet header.
較佳地,所述判斷模組,包括:判斷子模組,適於判斷所述資料包是由服務實體轉發的資料包還是由客戶端發送的資料包;如果所述資料包是由服務實體轉發的資料包,則確認所述資料包是自身負責應對的客戶端的資料包;如果所述資料包是由客戶端發送的資料包,則確認所述資料包不是由自身負責應對的客戶端的資料包。 Preferably, the judging module includes: a judging sub-module, adapted to judge whether the data packet is a data packet forwarded by a service entity or a data packet sent by a client; if the data packet is a data packet sent by the service entity If the data packet is forwarded, it is confirmed that the data packet is the data packet of the client that it is responsible for responding to; if the data packet is a data packet sent by the client, it is confirmed that the data packet is not the data of the client that it is responsible for responding to package.
較佳地,所述判斷子模組,包括:協議頭部判斷子模組,適於針對任一資料包,判斷在所述資料包之外是否存在按照網路傳輸協議的規則封裝的協議頭部;如果在所述資料包之外存在按照網路傳輸協議的規則封裝的協議頭部,則進入第一確認子模組;如果在所述資料包之外不存在按照網路傳輸協議的規則封裝的協議頭部,則進入第二確認子模組。 Preferably, the judging sub-module includes: a protocol header judging sub-module, which is suitable for determining whether there is a protocol header encapsulated according to the rules of the network transmission protocol outside the data packet for any data packet Section; if there is a protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, enter the first confirmation submodule; if there is no rule according to the network transmission protocol outside the data packet The encapsulated protocol header enters the second confirmation sub-module.
較佳地,所述限速模組,包括:解除子模組,適於解除所述資料包之外按照網路傳輸協議的規則封裝的協議頭部;資料包身份資訊獲取子模組,適於獲取所述資料包的身份資訊;流量判斷子模組,適於判斷所述身份資訊對應的流量是否超過到流量閾值;如果所述身份資訊對應的流量超過流量閾值,則進入丟棄子模組;丟棄子模組,適於丟棄所述資料包。 Preferably, the rate-limiting module includes: a release sub-module adapted to release the protocol header encapsulated in accordance with the rules of the network transmission protocol other than the data packet; the data packet identity information acquisition sub-module, suitable To obtain the identity information of the data packet; the flow judging sub-module is suitable for judging whether the flow corresponding to the identity information exceeds the flow threshold; if the flow corresponding to the identity information exceeds the flow threshold, enter the discarding sub-module ; Discarding sub-module, suitable for discarding the data packet.
較佳地,當所述身份資訊為IP位址時,所述流量判斷子模組,包括:用戶ID查找子模組,適於查找所述IP位址對應的用戶ID;流量閾值查找子模組,適於根據所述用戶ID查找對應的流量閾值;第一流量判斷子模組,適於計算所述IP位址對應的流量是否超過所述流量閾值;如果所述IP位址對應的流量超過所述流量閾值,則進入丟棄子模組。 Preferably, when the identity information is an IP address, the traffic judgment sub-module includes: a user ID search sub-module, adapted to search for the user ID corresponding to the IP address; and a traffic threshold search sub-module Group, adapted to find the corresponding traffic threshold according to the user ID; the first traffic judging sub-module, adapted to calculate whether the traffic corresponding to the IP address exceeds the traffic threshold; if the traffic corresponding to the IP address If the traffic threshold is exceeded, then enter the discarding sub-module.
本發明實施例包括以下優點:本發明實施例,可以在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理。首先,相對背景技術的第一類方案,本發明實施例不用單獨在集群內設置一個流控實體對整個集群內的服務實體進行限速,不會應為該流控實體的故障而影響整個集群的正常工作,適用性強。而且,也不存在流控實體與服務實體之間大量的通訊以決策給每個服務實體下發的限速大小,僅僅是服務實體之間的資料包的簡單轉發,複雜度低。 The embodiments of the present invention include the following advantages: The embodiments of the present invention can forward the data package of the client that is not responsible for handling the data package to the client in the same cluster that is responsible for handling the data package without increasing the complexity of the system. The service entity on the client side ensures that the traffic of the same client falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. First of all, compared to the first type of solution in the background art, the embodiment of the present invention does not need to set a separate flow control entity in the cluster to limit the rate of the service entities in the entire cluster, and will not affect the entire cluster due to the failure of the flow control entity. The normal work, strong applicability. Moreover, there is no large amount of communication between the flow control entity and the service entity to determine the speed limit size issued to each service entity. It is only the simple forwarding of the data packets between the service entities, and the complexity is low.
其次,相對背景技術的第二類方案,本發明實施例由於同一個客戶端的資料包由同一個服務實體負責對其進行 具體的業務邏輯處理,決定對其進行下一步處理還是丟棄,因此,可以精確控制每個客戶端的流量,可操作性高。 Secondly, compared to the second type of solution in the background art, in the embodiment of the present invention, the same service entity is responsible for processing the data packets of the same client. For specific business logic processing, it is decided whether to proceed to the next processing or discard it. Therefore, the traffic of each client can be accurately controlled, and the operability is high.
再次,相對背景技術的第三類方案,本發明實施例在集群的原有架構下,對資料包的處理流程做了改進,將各個服務實體接收到的同一客戶端的資料包,轉發到了同一個服務實體進行限速處理,未增加系統複雜度,也沒有採用額外的硬體設施,沒有增加硬體成本。並且,本發明實施例僅利用集群自身的計算功能,即實現了對同一客戶端的流量的限速處理,可以適用於任意規模的集群,適用性更廣。 Thirdly, compared to the third type of solution in the background technology, the embodiment of the present invention improves the processing flow of data packets under the original architecture of the cluster, and forwards the data packets of the same client received by each service entity to the same one. The service entity performs speed limit processing without increasing the complexity of the system, nor using additional hardware facilities, and without increasing hardware costs. In addition, the embodiment of the present invention only uses the computing function of the cluster itself, that is, realizes the rate limiting processing of the traffic of the same client, and can be applied to clusters of any size, with wider applicability.
總之,相對於背景技術,本發明實施例在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 In summary, compared with the background technology, the embodiments of the present invention improve the applicability, operability, and accuracy of cluster rate limiting without increasing system complexity and cost.
110‧‧‧步驟 110‧‧‧Step
120‧‧‧步驟 120‧‧‧Step
130‧‧‧步驟 130‧‧‧Step
140‧‧‧步驟 140‧‧‧Step
210‧‧‧步驟 210‧‧‧Step
220‧‧‧步驟 220‧‧‧Step
230‧‧‧步驟 230‧‧‧Step
240‧‧‧步驟 240‧‧‧Step
250‧‧‧步驟 250‧‧‧Step
310‧‧‧步驟 310‧‧‧Step
320‧‧‧步驟 320‧‧‧Step
330‧‧‧步驟 330‧‧‧Step
340‧‧‧步驟 340‧‧‧Step
350‧‧‧步驟 350‧‧‧Step
360‧‧‧步驟 360‧‧‧Step
370‧‧‧步驟 370‧‧‧Step
380‧‧‧步驟 380‧‧‧Step
410‧‧‧交換機 410‧‧‧Switch
420‧‧‧服務實體 420‧‧‧Service entity
421‧‧‧接收模組 421‧‧‧Receiving Module
422‧‧‧判斷模組 422‧‧‧Judgment Module
423‧‧‧轉發模組 423‧‧‧ Forwarding Module
424‧‧‧限速模組 424‧‧‧Speed Limiting Module
510‧‧‧交換機 510‧‧‧Switch
520‧‧‧服務實體 520‧‧‧Service entity
521‧‧‧接收模組 521‧‧‧Receiving Module
522‧‧‧判斷模組 522‧‧‧Judgment Module
523‧‧‧轉發模組 523‧‧‧Transmitting Module
5231‧‧‧封裝子模組 5231‧‧‧Package submodule
52311‧‧‧第二封裝子模組 52311‧‧‧Second package sub-module
5232‧‧‧轉發子模組 5232‧‧‧Transfer submodule
524‧‧‧限速模組 524‧‧‧Speed Limiting Module
610‧‧‧交換機 610‧‧‧Switch
620‧‧‧服務實體 620‧‧‧Service entity
621‧‧‧接收模組 621‧‧‧Receiving Module
622‧‧‧判斷模組 622‧‧‧Judgment Module
6221‧‧‧判斷子模組 6221‧‧‧Judgment submodule
623‧‧‧轉發模組 623‧‧‧ Forwarding Module
6231‧‧‧封裝子模組 6231‧‧‧Package submodule
62311‧‧‧第一封裝子模組 62311‧‧‧The first package sub-module
6232‧‧‧轉發子模組 6232‧‧‧Transfer submodule
624‧‧‧限速模組 624‧‧‧Speed Limiting Module
6241‧‧‧解除子模組 6241‧‧‧Release submodule
6242‧‧‧資料包身份資訊獲取子模組 6242‧‧‧Data package identity information acquisition sub-module
6243‧‧‧流量判斷子模組 6243‧‧‧Flow Judgment Submodule
6244‧‧‧丟棄子模組 6244‧‧‧Discard submodule
圖1是本發明的一種集群精確限速方法實施例的步驟流程圖;圖1A是本發明的一個應用場景示意圖;圖2是本發明的另一種集群精確限速方法實施例的步驟流程圖;圖3是本發明的另一種集群精確限速方法實施例的步驟流程圖;圖4是本發明的一種集群精確限速裝置實施例的結構 方塊圖;圖5是本發明的另一種集群精確限速裝置實施例的結構方塊圖;圖6是本發明的另一種集群精確限速裝置實施例的結構方塊圖。 Figure 1 is a flow chart of steps of an embodiment of a cluster accurate speed limiting method of the present invention; Figure 1A is a schematic diagram of an application scenario of the present invention; Figure 2 is a step flow chart of another embodiment of a cluster accurate speed limiting method of the present invention; Fig. 3 is a flow chart of the steps of another embodiment of the cluster accurate rate limiting method of the present invention; Fig. 4 is the structure of an embodiment of the cluster accurate rate limiting device of the present invention Block diagram; Figure 5 is a structural block diagram of another embodiment of a cluster accurate speed limiting device of the present invention; Figure 6 is a structural block diagram of another embodiment of a cluster accurate rate limiting device of the present invention.
為使本發明的上述目的、特徵和優點能夠更加明顯易懂,下面結合圖式和具體實施方式對本發明作進一步詳細的說明。 In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the following further describes the present invention in detail with reference to the drawings and specific embodiments.
本發明實施例的核心構思之一在於,本發明提出的一種集群精確限速方法和裝置,可以在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理。從而相對於背景技術,在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 One of the core concepts of the embodiments of the present invention is that the cluster accurate rate limiting method and device proposed by the present invention can forward data packets of clients that are not responsible for the system without increasing the complexity of the system. Give the service entity in the same cluster that is responsible for the client that the data package belongs to, so as to ensure that the traffic of the same client falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data package, the data package of the client Perform speed limit processing. Therefore, compared with the background technology, the applicability, operability, and accuracy of the cluster speed limit are improved without increasing the complexity and cost of the system.
參照圖1,示出了本發明的一種集群精確限速方法實施例的步驟流程圖,具體可以包括如下步驟: Referring to Fig. 1, there is shown a flow chart of the steps of an embodiment of a cluster accurate rate limiting method of the present invention, which may specifically include the following steps:
步驟110,接收資料包。 Step 110: Receive a data packet.
如圖1A為本發明的一個應用場景示意圖。可以看出,在集群內部存在4台服務實體,服務實體通過各個交換機與外部,例如客戶端,進行通訊,客戶端發送的資料包先經過交換機,然後由交換機再分發到至少一台服務實體上來處理。 Figure 1A is a schematic diagram of an application scenario of the present invention. It can be seen that there are 4 service entities in the cluster. The service entity communicates with the outside, such as the client, through each switch. The data packet sent by the client first passes through the switch, and then is distributed by the switch to at least one service entity. deal with.
其中,集群是指一組協同工作的服務實體,用以提供比單一服務實體更具擴展性與可用性的服務平臺。主要包括高可用集群(High Availability Cluster),負載均衡集群(Load Balance Cluster),科學計算集群(High Performance Computing Cluster),本發明主要針對高可用集群和負載均衡集群。服務實體是可以提供某些服務的裝置,例如伺服器等,在本發明實施例中可以接收資料包並進行限速操作。 Among them, a cluster refers to a group of service entities that work together to provide a service platform that is more scalable and usable than a single service entity. It mainly includes a high availability cluster (High Availability Cluster), a load balance cluster (Load Balance Cluster), and a scientific computing cluster (High Performance Computing Cluster). The present invention is mainly aimed at a high availability cluster and a load balance cluster. The service entity is a device that can provide certain services, such as a server, and can receive data packets and perform rate limiting operations in the embodiment of the present invention.
在網際網路中,客戶端與伺服器交互,是先將其請求等資訊以資料包的形式向伺服器發送。而且在本發明中,由於集群中包含多個服務實體可以同時提供服務,進而造成同一客戶端發送的資料包可能會落到集群中的多個服務實體上。 In the Internet, the client interacts with the server by first sending its request and other information to the server in the form of data packets. Moreover, in the present invention, since the cluster contains multiple service entities that can provide services at the same time, the data packets sent by the same client may fall on multiple service entities in the cluster.
以現今的網際網路為例,基本上採用的TCP/IP協議等網際網路協議,那麼TCP/IP協議的資料包(Data Packet)是TCP/IP(Transmission Control Protocol/Internet Protocol)協議通訊傳輸中的資料單位,一般也稱為“包”(Packet),在網路資訊傳遞過程中,單個消息被劃分為多個資料塊,這些資料塊就稱為資料 包,它包含發送者和接收者的位址資訊。這些資料包然後沿著不同的路徑在一個或多個網路中傳輸,並且在目的地重新組合。在實際應用中,資料包主要由報文頭和資料兩部分組成。 Taking the current Internet as an example, Internet protocols such as the TCP/IP protocol are basically used. Then the data packet of the TCP/IP protocol is the TCP/IP (Transmission Control Protocol/Internet Protocol) protocol communication transmission The data unit in, is generally called "Packet". In the process of network information transmission, a single message is divided into multiple data blocks. These data blocks are called data Packet, which contains the address information of the sender and receiver. These data packets are then transmitted in one or more networks along different paths and reassembled at the destination. In practical applications, the data packet is mainly composed of two parts: the message header and the data.
在實際應用中,TCP/IP協議是一個協議族,其包括TCP((Transmission Control Protocol,傳輸控制協議)、IP(Internet Protocol,網間網協議)、UDP(User Datagram Protocol,用戶資料包協議)、ICMP(Internet Control Message Protocol,網際網路控制資訊協議)、RIP(Routing Information Protocol,路由資訊協議)、SMTP(Simple Mail Transfer Protocol,簡單郵件傳輸協議)、SNMP(Simple Network manage Protocol,簡單網路管理協議)、ARP(Address Resolution Protocol,位址解析協議)、FTP(File Transfer Protocol,文件傳輸協議)等許多協議。TCP/IP協議採用分層結構,其分層模型及協議如下表(1):
不同的協議層對資料包有不同的稱謂,在傳輸層叫做段(segment),在網路層叫做資料報(datagram),在鏈路層叫做幀(frame)。 Different protocol layers have different names for data packets. They are called segments at the transport layer, datagrams at the network layer, and frames at the link layer.
本發明的一種集群精確限速方法,就是針對資訊傳輸 中的資料包進行限速,所以首先需要接收資料包。 A cluster accurate speed limiting method of the present invention is aimed at information transmission The data packet in is subject to speed limit, so the data packet needs to be received first.
步驟120,判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則進入步驟130;如果所述資料包是由自身負責應對的客戶端的資料包,則進入步驟140。 Step 120: Determine whether the data package is the data package of the client that is responsible for the response; if the data package is not the data package of the client that is responsible for the response, go to step 130; if the data package is the data package of the client that is responsible for the response For the data package of the corresponding client, go to step 140.
在本發明實施例中,對於集群中各服務實體,可以由交換機根據一定算法確定集群中各服務實體自身負責應對的客戶端,即集群中某一服務實體可以只對由該算法確定由自身負責應對的客戶端發送的資料包進行限速,在本發明實施例中,此特定的客戶端可以稱為資料包自身負責應對的客戶端。 In the embodiment of the present invention, for each service entity in the cluster, the switch can determine the client that each service entity in the cluster is responsible for, according to a certain algorithm, that is, a certain service entity in the cluster can only be responsible for the algorithm determined by the algorithm. The data packet sent by the corresponding client is limited in rate. In the embodiment of the present invention, this specific client may be referred to as the client that the data packet itself is responsible for responding to.
所以,在接收到客戶端的資料包後,需要進一步判斷所述資料包是否為由自身負責應對的客戶端的資料包,如果所述資料包不是由自身負責應對的客戶端的資料包,考慮到服務實體只對由自己負責應對的客戶端發送的資料包進行限速,所以此時需要將所述資料包轉發至負責應對所述資料包所述客戶端的服務實體;而如果所述資料包是由自身負責應對的客戶端的資料包,則可以直接基於所述資料包的身份資訊,對所述資料包進行限速處理。 Therefore, after receiving the data package of the client, it is necessary to further determine whether the data package is the data package of the client which is responsible for the response. If the data package is not the data package of the client which is responsible for the response, the service entity Only the data packet sent by the client responsible for the response is limited, so the data packet needs to be forwarded to the service entity responsible for the client of the data packet; and if the data packet is sent by itself The data packet of the client responsible for responding can then directly limit the rate of the data packet based on the identity information of the data packet.
步驟130,將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體。 Step 130: Forward the data packet to a service entity responsible for handling the client to which the data packet belongs.
如圖1A所示的場景圖示例,服務實體接收到客戶端發送的資料包後,可以經過交換機,將接收到的不是由自身負責應對的資料包轉發給負責應對所述資料包所屬客戶 端的服務實體。例如,服務實體1接收到一資料包,該資料包所屬的客戶端是由服務實體3負責應對的,則在服務實體接收到該資料包後,會將該資料包再次發送至交換機1,然後交換機1再將該資料包發送至服務實體3。 As shown in the example of the scenario diagram shown in Figure 1A, after receiving the data packet sent by the client, the service entity can pass through the switch and forward the received data packet that it is not responsible for responding to the client responsible for responding to the data packet. Service entity at the end. For example, the service entity 1 receives a data packet, and the client to which the data packet belongs is handled by the service entity 3. After the service entity receives the data packet, it will send the data packet to the switch 1 again, and then The switch 1 then sends the data packet to the service entity 3.
在本發明另一較佳的實施例中,步驟130包括:
In another preferred embodiment of the present invention,
子步驟131,基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部。 Sub-step 131, based on the identity information of the data packet, encapsulate the protocol header in accordance with the rules of the network transmission protocol outside the data packet.
在本發明實施例中,可以基於資料包的身份資訊,在資料包之外封裝協議頭部,且該協議頭部是按照網路傳輸協議的規則封裝在資料包之外的。 In the embodiment of the present invention, the protocol header may be encapsulated outside the data packet based on the identity information of the data packet, and the protocol header is encapsulated outside the data packet according to the rules of the network transmission protocol.
其中,資料包的身份資訊可以包括用戶ID,及/或客戶端的IP位址等;網路傳輸協議(Communications Protocol)一般是指網路層協議和傳輸層協議,例如,表(1)中所示的IP(Internet Protocol,網路協議)協議、TCP協議、UDP協議等。實際應用中,TCP協議和UDP協議同一個資料包只會使用一種。 Among them, the identity information of the data packet can include the user ID, and/or the IP address of the client, etc.; the network transmission protocol (Communications Protocol) generally refers to the network layer protocol and the transport layer protocol, for example, as shown in Table (1) Show IP (Internet Protocol, network protocol) protocol, TCP protocol, UDP protocol, etc. In practical applications, only one type of TCP protocol and UDP protocol can be used for the same data packet.
其中TCP協議和UDP協議的區別主要為以下幾點:1、TCP協議需要存在通訊關係的對象之間進行連接,UDP協議不需要存在通訊關係的對象之間進行連接;2、TCP協議的傳輸速度較慢,UDP協議的傳輸速度較快;3、TCP協議可以保證資料順序,UDP協議不可以保證資料順序;4、TCP協議可以保證資料正確性,UDP協議則可能 丟包;5、TCP協議對系統資源要求多,UDP協議系統資源要求少。 The main differences between the TCP protocol and the UDP protocol are as follows: 1. The TCP protocol requires a connection between objects that have a communication relationship, and the UDP protocol does not require a connection between objects that have a communication relationship; 2. The transmission speed of the TCP protocol Slower, the transmission speed of UDP protocol is faster; 3. TCP protocol can guarantee the order of data, UDP protocol cannot guarantee the order of data; 4. TCP protocol can guarantee the correctness of data, while UDP protocol is possible Packet loss; 5. TCP protocol requires more system resources, while UDP protocol requires less system resources.
因此,可以理解,本發明在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部,可以按照IP協議+TCP協議或者IP協議+UDP協議的規則封裝協議頭部。 Therefore, it can be understood that the present invention encapsulates the protocol header according to the rules of the network transmission protocol in addition to the data packet, and can encapsulate the protocol header according to the rules of the IP protocol + TCP protocol or the IP protocol + UDP protocol.
在實際應用中,在本發明封裝上述協議頭部時,會在協議頭部中封裝指示資料包所屬客戶端的身份資訊等第一資料。對同一客戶端來說,在其任意資料包的協議頭部中封裝的上述第一資料是唯一的,可以跟其他客戶端區別開來。 In practical applications, when the present invention encapsulates the above-mentioned protocol header, first data such as the identity information of the client to which the data packet belongs will be encapsulated in the protocol header. For the same client, the above-mentioned first data encapsulated in the protocol header of any data packet is unique and can be distinguished from other clients.
子步驟132,將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。 In sub-step 132, the data packet encapsulated with the protocol header is forwarded through the switch to the service entity responsible for responding to the client to which the data packet belongs.
在本發明實施例中,需要將同一客戶端發送的資料包歸併到預設的與該客戶端對應的服務實體中,然後進行精確地限速,對於封裝了協議頭部的資料包,則可以根據協議頭部的內容,利用交換機,將封裝了協議頭部的資料包轉發給負責應對該資料包所屬客戶端的服務實體。 In the embodiment of the present invention, the data packets sent by the same client need to be merged into the preset service entity corresponding to the client, and then the rate is accurately limited. For data packets that encapsulate the protocol header, you can According to the content of the protocol header, the switch is used to forward the data packet encapsulating the protocol header to the service entity responsible for the client to which the data packet belongs.
在實際應用中,可以利用交換機的HASH(哈希/散列)策略,將封裝了協議頭部的資料包準確地轉發至負責對應該資料包所屬客戶端的服務實體。 In practical applications, the HASH (hash/hash) strategy of the switch can be used to accurately forward the data packet encapsulating the protocol header to the service entity responsible for the client to which the data packet belongs.
在實際應用中,集群的交換機是對資料包的協議頭部中的上述第一資料進行哈希,然後根據哈希結果,將資料包分發至相應的服務實體中。比如計算第一資料的哈希 值,然後將該哈希值對服務實體的總個數取餘數,然後根據餘數與服務實體的對應關係,將該資料包發送至於該餘數對應的服務實體中。 In practical applications, the switch of the cluster hashes the above-mentioned first data in the protocol header of the data packet, and then distributes the data packet to the corresponding service entity according to the hash result. For example, calculating the hash of the first data Value, and then take the remainder of the hash value from the total number of service entities, and then send the data packet to the service entity corresponding to the remainder according to the correspondence between the remainder and the service entity.
步驟140,基於所述資料包的身份資訊,對所述資料包進行限速處理。 Step 140: Perform rate limiting processing on the data packet based on the identity information of the data packet.
在實際應用中,集群需要對多個客戶端提供服務,為了防止某一客戶端的流量過大而影響其它客戶端或者是導致該客戶端的帶寬收費較高等原因,需要針對每個客戶端進行限速。在本發明實施例中,將各客戶端的資料包全部歸併到對該客戶端對應的服務實體後,即可以利用一個服務實體實現對某客戶端進行限速。 In practical applications, the cluster needs to provide services to multiple clients. In order to prevent excessive traffic of a client from affecting other clients or causing high bandwidth charges for the client, it is necessary to limit the rate of each client. In the embodiment of the present invention, after all the data packages of each client are merged into the service entity corresponding to the client, one service entity can be used to implement rate limiting on a certain client.
在實際應用中,可以首先根據不同的客戶端預置不同的流量閾值,然後判斷服務實體所對應接收的客戶端的各資料包的流量是否超出該客戶端對應的流量閾值的範圍,若某一資料包的流量超出該客戶端對應的流量閾值的範圍,則可以將該資料包丟棄,而若資料包的流量未超出該客戶端對應的流量閾值的範圍,則保留該資料包。 In practical applications, you can first preset different traffic thresholds according to different clients, and then determine whether the traffic of each data packet of the client corresponding to the service entity exceeds the range of the traffic threshold corresponding to the client, if a certain data If the flow of the packet exceeds the range of the flow threshold corresponding to the client, the data packet can be discarded, and if the flow of the data packet does not exceed the range of the flow threshold corresponding to the client, the data packet is retained.
在本發明實施例中,在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理,因此本發明具備以下優點:首先,相對背景技術的第一類方案,本發明實施例不 用單獨在集群內設置一個流控實體對整個集群內的服務實體進行限速,不會應為該流控實體的故障而影響整個集群的正常工作,適用性強。而且,也不存在流控實體與服務實體之間大量的通訊以決策給每個服務實體下發的限速大小,僅僅是服務實體之間的資料包的簡單轉發,複雜度低。 In the embodiment of the present invention, without increasing the complexity of the system, the data package of the client that is not responsible for its response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data package belongs, thereby ensuring the same The client's traffic falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. Therefore, the present invention has the following advantages: First, compared with the background art The first type of solution, the embodiment of the present invention does not Setting a single flow control entity in the cluster to limit the speed of the service entities in the entire cluster will not affect the normal operation of the entire cluster due to the failure of the flow control entity, which has strong applicability. Moreover, there is no large amount of communication between the flow control entity and the service entity to determine the speed limit size issued to each service entity. It is only the simple forwarding of the data packets between the service entities, and the complexity is low.
其次,相對背景技術的第二類方案,本發明實施例由於同一個客戶端的資料包由同一個服務實體負責對其進行具體的業務邏輯處理,決定對其進行下一步處理還是丟棄,因此,可以精確控制每個客戶端的流量,可操作性高。 Secondly, compared to the second type of solution in the background technology, in the embodiment of the present invention, the same service entity is responsible for the specific business logic processing of the data packet of the same client, and it is determined whether to proceed with the next step or discard it. Therefore, it can be Accurately control the flow of each client, with high operability.
再次,相對背景技術的第三類方案,本發明實施例在集群的原有架構下,對資料包的處理流程做了改進,將各個服務實體接收到的同一客戶端的資料包,轉發到了同一個服務實體進行限速處理,未增加系統複雜度,也沒有採用額外的硬體設施,沒有增加硬體成本。並且,本發明實施例僅利用集群自身的計算功能,即實現了對同一客戶端的流量的限速處理,可以適用於任意規模的集群,適用性更廣。 Thirdly, compared to the third type of solution in the background technology, the embodiment of the present invention improves the processing flow of data packets under the original architecture of the cluster, and forwards the data packets of the same client received by each service entity to the same one. The service entity performs speed limit processing without increasing the complexity of the system, nor using additional hardware facilities, and without increasing hardware costs. In addition, the embodiment of the present invention only uses the computing function of the cluster itself, that is, realizes the rate limiting processing of the traffic of the same client, and can be applied to clusters of any size, with wider applicability.
總之,相對於背景技術的集群限速三類方案,在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 In short, compared with the three types of cluster speed limiting solutions in the background technology, the applicability, operability, and accuracy of cluster speed limiting are improved without increasing system complexity and cost.
參照圖2,示出了本發明的一種集群精確限速方法實施例的步驟流程圖,具體可以包括如下步驟: Referring to FIG. 2, there is shown a step flow chart of an embodiment of a cluster accurate rate limiting method of the present invention, which may specifically include the following steps:
步驟210,接收資料包。 Step 210: Receive a data packet.
步驟220,判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則進入步驟230;如果所述資料包是由自身負責應對的客戶端的資料包,則進入步驟250。 Step 220: Judge whether the data package is a data package of a client that is handled by itself; if the data package is not a data package of a client that is handled by itself, go to step 230; if the data package is handled by itself For the data package of the corresponding client, go to step 250.
步驟230,基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 Step 230: Based on the identity information of the data packet, encapsulate a layer of IP header and TCP header in addition to the data packet according to the rules of the network transmission protocol.
基於前述的TCP的優點,為了保證資料包在轉發過程中資料的正確性,在本發明實施例中,可以基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。按照TCP協議封裝一層TCP報文頭,再按照IP協議封裝一層IP報文頭。 Based on the aforementioned advantages of TCP, in order to ensure the correctness of the data in the forwarding process of the data packet, in the embodiment of the present invention, the identity information of the data packet can be based on the data packet according to the network transmission protocol. The rule encapsulates a layer of IP header and TCP header. A layer of TCP header is encapsulated according to the TCP protocol, and then a layer of IP header is encapsulated according to the IP protocol.
其中,TCP是面向連接的傳輸協議,需要在需要通訊的客戶端和服務實體之間以及不同的服務實體之間建立連接關係。TCP採用“三次握手”的方式建立連接,以客戶端和服務實體為例,具體步驟如下:第一次握手:建立連接時,客戶端發送syn包(syn=j)到服務實體,並進入SYN_SEND狀態,等待服務實體確認;第二次握手:服務實體收到syn包,必須確認客戶的 SYN(ack=j+1),同時自己也發送一個SYN包(syn=k),即SYN+ACK包,此時服務實體進入SYN_RECV狀態;第三次握手:客戶端收到服務實體的SYN+ACK包,向服務實體發送確認包ACK(ack=k+1),此包發送完畢,客戶端和服務實體進入ESTABLISHED狀態,完成三次握手。 Among them, TCP is a connection-oriented transmission protocol, and a connection relationship needs to be established between a client and a service entity that need to communicate, and between different service entities. TCP uses the "three-way handshake" method to establish a connection. Take the client and the service entity as an example. The specific steps are as follows: The first handshake: When the connection is established, the client sends a syn packet (syn=j) to the service entity and enters SYN_SEND Status, waiting for confirmation from the service entity; the second handshake: the service entity receives the syn package and must confirm the customer’s SYN (ack=j+1), and at the same time send a SYN packet (syn=k), that is, SYN+ACK packet, at this time the service entity enters the SYN_RECV state; the third handshake: the client receives the SYN+ from the service entity ACK packet, send an acknowledgment packet ACK (ack=k+1) to the service entity. After this packet is sent, the client and the service entity enter the ESTABLISHED state and complete the three-way handshake.
完成三次握手後,客戶端與服務實體可以開始傳送資料。 After completing the three-way handshake, the client and the service entity can start to transmit data.
TCP報文頭的資料格式如表(2)所示:
其中,序列號:TCP序號,即本報文段所發送的資料的第一個字節的序號。 Among them, serial number: TCP serial number, that is, the serial number of the first byte of the data sent in this segment.
確認號:即希望下次收到對方傳送的資料的第一個字節的序號。 Confirmation number: the serial number of the first byte of the data sent by the other party is expected to be received next time.
資料偏移:指出TCP報文段的資料起始處距離TCP報文段的距離,實際就是TCP頭部長度。注意,資料偏移的單位不是字節而是32bit,即4字節。TVP首部最大長度為(2^4-1)*4=60字節。 Data Offset: Indicate the distance between the beginning of the data of the TCP message segment and the TCP message segment, which is actually the length of the TCP header. Note that the unit of data offset is not byte but 32bit, that is, 4 bytes. The maximum length of the TVP header is (2^4-1)*4=60 bytes.
保留:保留為今後使用,目前統一置為0. Reserved: reserved for future use, currently set to 0 uniformly.
代碼位: Code bit:
1、URG:緊急比特。當URG=1時,表明緊急指針字段有效。該報文應儘快傳送。而不要按原來的隊列順序來傳送。 1. URG: Urgent bit. When URG=1, it indicates that the urgent pointer field is valid. The message should be transmitted as soon as possible. Don't send them in the original queue order.
2、ACK:確認比特。當ACK=1時確認號字段才有效,ACK=0時,表明確認號無效。 2. ACK: Acknowledge bit. When ACK=1, the acknowledgment number field is valid, and when ACK=0, it indicates that the acknowledgment number is invalid.
3、PSH:推送比特:按對隊傳輸到對方,不用待緩存填滿後再提交給上層,而是立即提交。 3. PSH: Push bits: Transmit to the other party according to the team, do not submit to the upper layer after the cache is full, but submit it immediately.
4、RST:複位比特。TCP連接中出現嚴重差錯,必須立即釋放並重新建立連接。也用於拒絕一個非法的報文段或拒絕打開一個連接。 4. RST: Reset bit. A serious error occurred in the TCP connection, and the connection must be immediately released and re-established. It is also used to refuse an illegal segment or refuse to open a connection.
5、SYN:同步比特。在連接建立時用來同步序號。當SYN=1而ACK=0時,表明這是一個連接請求報文段。對方若同意建立連接,則應在響應的報文段中使用SYN=1和ACK=1。因此,SYN=1時,就表明這是一個連接請求或連接接受。 5. SYN: synchronization bit. Used to synchronize the serial number when the connection is established. When SYN=1 and ACK=0, it indicates that this is a connection request segment. If the other party agrees to establish a connection, it should use SYN=1 and ACK=1 in the response segment. Therefore, when SYN=1, it indicates that this is a connection request or connection acceptance.
6、FIN:終止比特。用來釋放一個連接。當FIN=1時,表明資料發送完畢,要求釋放連接。 6. FIN: Termination bit. Used to release a connection. When FIN=1, it indicates that the data has been sent and the connection is required to be released.
窗口:接收端告知自己的接收能力,即自己接收窗口的大小,發送方將按這個大小發送資料。 Window: The receiving end informs its own receiving capability, that is, the size of its own receiving window, and the sender will send data according to this size.
校驗和:檢驗的範圍包括首部和資料這兩部分。在計算檢驗和時,要在TCP報文段的前面加上12字節的偽首部。 Checksum: The scope of the check includes two parts: the header and the data. When calculating the checksum, a 12-byte pseudo header should be added in front of the TCP message segment.
緊急指針:當緊急指針代碼位被設置時為有效字段。如果有效,這個值指明了當前序列號的八位組的偏移值,即第一個非緊急資料的起始位置。 Urgent pointer: When the emergency pointer code bit is set, it is a valid field. If valid, this value indicates the offset value of the octet of the current serial number, that is, the starting position of the first non-emergency data.
在本發明另一較佳的實施例中,步驟230,包括:子步驟231,獲取所述資料包對應的身份資訊;子步驟232,根據所述身份資訊,選擇同一個五元組;所述五元組包括:源IP位址,目的IP位址,源端口,目的端口,傳輸協議類型;所述目的IP位址為服務實體對應的IP位址;子步驟233,基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。
In another preferred embodiment of the present invention,
若要在資料包之外再封裝一層IP報文頭和TCP報文頭,則此時五元組中的傳輸協議類型為TCP協議,即在資料包之外是按照TCP協議的規則再封裝一層IP報文頭和TCP報文頭。根據表(2)和表(4)分別所示的IP報文頭結構和TCP報文頭結構可知,在實際應用中,五元組中的源IP位址、目的IP位址、傳輸協議類型分別與IP報文頭中的源位址、目的位址、協議一一對應,五元組中的源端口、目的端口分別與TCP報文頭中的源端口號、目的端口號一一對應。對於IP報文頭和TCP報文頭中其他部分的內容,本發明實施例也不加以限定。 If you want to encapsulate a layer of IP header and TCP header outside the data packet, then the transport protocol type in the five-tuple is the TCP protocol, that is, outside the data packet, another layer of IP packet is encapsulated in accordance with the rules of the TCP protocol. Header and TCP header. According to the IP header structure and TCP header structure shown in Table (2) and Table (4), in practical applications, the source IP address, destination IP address, and transmission protocol type in the quintuple are respectively related to The source address, destination address, and protocol in the IP packet header correspond one-to-one, and the source port and destination port in the five-tuple correspond to the source port number and destination port number in the TCP packet header respectively. The content of other parts in the IP header and the TCP header is not limited in the embodiment of the present invention.
在本發明另一較佳的實施例中,步驟233,包括: In another preferred embodiment of the present invention, step 233 includes:
子步驟2331,將所述五元組中的源端口、目的端口 封裝到所述資料包之外的TCP報文頭中。 In sub-step 2331, the source port and destination port in the five-tuple Encapsulated into the TCP packet header outside the data packet.
具體而言,是將五元組中的源端口、目的端口分別封裝到資料包之外的TCP報文頭中的源端口號、目的端口號中。對於TCP報文頭中的其他部分的資料內容,可以採用任意一種TCP報文頭適用的資料,對此本發明實施例不加以限定。 Specifically, the source port and destination port in the 5-tuple are respectively encapsulated into the source port number and destination port number in the TCP header outside the data packet. For the data content of other parts in the TCP packet header, any data applicable to the TCP packet header can be used, which is not limited in the embodiment of the present invention.
子步驟2332,將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 Sub-step 2332, encapsulating the source IP address, destination IP address, and transmission protocol type in the five-tuple into an IP header outside the data packet.
步驟240,將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。
In
步驟250,基於所述資料包的身份資訊,對所述資料包進行限速處理。 Step 250: Perform rate limiting processing on the data packet based on the identity information of the data packet.
在本發明實施例中,同樣在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理。相對於現有的集群限速三類方案,在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 In the embodiment of the present invention, also without increasing the complexity of the system, by forwarding the data package of the client that is not responsible for handling the data package to the service entity in the same cluster responsible for handling the client to which the data package belongs, so as to ensure The traffic of the same client falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. Compared with the existing three types of cluster speed limitation schemes, it improves the applicability, operability, and accuracy of cluster speed limitation without increasing system complexity and cost.
另外,在本發明實施例中,通過在服務實體接收到的由客戶端發送的資料包之外封裝一層IP報文頭和TCP報文頭,然後再將封裝後的資料包轉發至負責應對該資料包 所屬的客戶端的服務實體中,相對於UDP而言,本發明實施例需要在實體之間建立連接,可以進一步保證資料包中資料的準確性,將資料包準確地轉發至相應地服務實體中,進一步提高了集群限速的精確性。 In addition, in the embodiment of the present invention, a layer of IP header and TCP header is encapsulated in addition to the data packet sent by the client received by the service entity, and then the encapsulated data packet is forwarded to the data packet responsible for responding to the data packet. In the service entity of the client to which it belongs, compared with UDP, the embodiment of the present invention needs to establish a connection between the entities, which can further ensure the accuracy of the data in the data packet, and accurately forward the data packet to the corresponding service entity. Further improve the accuracy of the cluster speed limit.
參照圖3,示出了本發明的另一種集群精確限速方法實施例的步驟流程圖,具體可以包括如下步驟: Referring to FIG. 3, there is shown a flow chart of the steps of another embodiment of the cluster accurate rate limiting method of the present invention, which may specifically include the following steps:
步驟310,接收資料包。 Step 310: Receive a data packet.
步驟320,判斷所述資料包是由服務實體轉發的資料包還是由客戶端發送的資料包;如果所述資料包是由服務實體轉發的資料包,則確認所述資料包不是由自身負責應對的客戶端的資料包,然後進入步驟330;如果所述資料包是由客戶端發送的資料包,則確認所述資料包是自身負責應對的客戶端的資料包,然後進入步驟350。 Step 320: Determine whether the data packet is a data packet forwarded by the service entity or a data packet sent by the client; if the data packet is a data packet forwarded by the service entity, then it is confirmed that the data packet is not handled by itself If the data package is a data package sent by the client, confirm that the data package is the data package of the client that it is responsible for, and then go to step 350.
由實施例一所述可知,在實際應用中,若服務實體接收到的資料包是由客戶端的資料包,則會將該資料包轉發至負責應對所述資料包所屬客戶端的服務實體,而且在轉發之前,服務實體並不能確認其所接收的客戶端發送的是資料包是否為自身負責應對的客戶端發送的資料包。另外,一般而言,只需一次轉發過程,即可以將該資料包轉發至負責應對所述資料包所屬客戶端的服務實體。 It can be seen from the first embodiment that, in practical applications, if the data packet received by the service entity is a data packet from the client, the data packet will be forwarded to the service entity responsible for responding to the client to which the data packet belongs, and Before forwarding, the service entity cannot confirm whether the data packet sent by the client it receives is the data packet sent by the client that it is responsible for. In addition, generally speaking, only one forwarding process is required to forward the data packet to the service entity responsible for responding to the client to which the data packet belongs.
在本發明實施例中,確認某一資料包不是由接收到該資料包的某服務實體自身應對的客戶端的資料包,則表明 該服務實體需要將接收到的該資料包進行轉發操作,以將該資料包轉發至負責應對該資料包所屬的客戶端的服務實體中。 In the embodiment of the present invention, it is confirmed that a certain data packet is not a data packet of a client that is handled by a certain service entity itself that has received the data packet. The service entity needs to forward the received data packet to forward the data packet to the service entity responsible for responding to the client to which the data packet belongs.
在本發明實施例中,確認某一資料包是由某服務實體自身應對的客戶端的資料包,則表明該服務實體不需要將該資料包進行再次轉發操。 In the embodiment of the present invention, confirming that a certain data packet is a data packet of a client that is handled by a certain service entity itself indicates that the service entity does not need to forward the data packet again.
所以在本發明實施例中,若服務實體所接收的資料包是由服務實體轉發的資料包,則可以確認該資料包是由自身負責應對的客戶端的資料包;而若服務實體所接收的資料包是由客戶端發送的資料包,則可以先默認該資料包不是由該服務實體自身負責應對的客戶端的資料包。該步驟是實施例一中步驟120的較佳方案。需要說明的是,在本發明實施例中,服務實體所接收到的資料包可能是由其自身轉發的資料包。
Therefore, in the embodiment of the present invention, if the data packet received by the service entity is a data packet forwarded by the service entity, it can be confirmed that the data packet is a data packet of the client that it is responsible for responding to; and if the data packet received by the service entity If the package is a data package sent by the client, it can be assumed that the data package is not the data package of the client that the service entity itself is responsible for. This step is the preferred solution of
例如,對於服務實體A,其接收到兩個資料包分別為:資料包a、資料包b,其中資料包a是由服務實體B轉發的,資料包b是由客戶端C發送的。則經過上述步驟,可以直接確認資料包a是由服務實體A負責應對的客戶端的資料包,資料包b則不是由服務實體A負責應對的客戶端的資料包。而且,在服務實體A對資料包b進行轉發之前,並不能確認資料包b所屬的客戶端C是否為服務實體A負責應對的客戶端,另外,其中的服務實體A和服務實體B可能為同一服務實體。 For example, for service entity A, it receives two data packets: data packet a and data packet b. Data packet a is forwarded by service entity B, and data packet b is sent by client C. After the above steps, it can be directly confirmed that the data package a is the data package of the client that the service entity A is responsible for responding to, and the data package b is not the data package of the client that the service entity A is responsible for responding to. Moreover, before the service entity A forwards the data packet b, it cannot be confirmed whether the client C to which the data packet b belongs is the client that the service entity A is responsible for. In addition, the service entity A and the service entity B may be the same Service entity.
在本發明另一較佳的實施例中,步驟320,包括:
In another preferred embodiment of the present invention,
子步驟321,針對任一資料包,判斷在所述資料包之外是否存在按照網路傳輸協議的規則封裝的協議頭部;如果在所述資料包之外存在按照網路傳輸協議的規則封裝的協議頭部,則確認所述資料包是自身負責應對的客戶端的資料包,然後進入步驟350;如果在所述資料包之外不存在按照網路傳輸協議的規則封裝的協議頭部,則確認所述資料包不是由自身負責應對的客戶端的資料包,然後進入步驟330。 Sub-step 321, for any data packet, determine whether there is a protocol header outside the data packet that is encapsulated according to the rules of the network transmission protocol; if there is outside the data packet encapsulated according to the rules of the network transmission protocol The protocol header of the data packet is confirmed to be the data packet of the client that it is responsible for, and then go to step 350; if there is no protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, then It is confirmed that the data package is not the data package of the client that is responsible for the response, and then step 330 is entered.
根據實施例一所述的內容,在本發明實施例中,若服務實體要對所接收到的資料包進行轉發,則需要先在該資料包之外再按照網路傳輸協議的規則封裝協議頭部;若服務實體不對所接收到的資料包進行轉發,則不需要在該資料包之外再按照網路傳輸協議的規則封裝協議頭部。 According to the content of the first embodiment, in the embodiment of the present invention, if the service entity wants to forward the received data packet, it needs to encapsulate the protocol header outside the data packet according to the rules of the network transmission protocol. If the service entity does not forward the received data packet, it does not need to encapsulate the protocol header in accordance with the rules of the network transmission protocol in addition to the data packet.
所以,在本發明實施例中,針對服務實體接收到的任一資料包,判斷在所述資料包之外是否存在按照網路傳輸協議的規則封裝的協議頭部。如果在所述資料包之外存在按照網路傳輸協議的規則封裝的協議頭部,則說明該服務實體接收到的該資料包是由服務實體轉發的資料包,從而可以確認該資料包是由該服務實體自身負責應對的客戶端的資料包;如果在資料包之外不存在按照網路傳輸協議的規則封裝的協議頭部,則說明該服務實體接收到的該資料包是由客戶端發送的資料包,從而可以確認該資料包不是由自身負責應對的客戶端的資料包。 Therefore, in the embodiment of the present invention, for any data packet received by the service entity, it is determined whether there is a protocol header encapsulated according to the rules of the network transmission protocol outside the data packet. If there is a protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, it means that the data packet received by the service entity is a data packet forwarded by the service entity, so that it can be confirmed that the data packet is from The service entity itself is responsible for the data packet of the client; if there is no protocol header encapsulated according to the rules of the network transmission protocol outside the data packet, it means that the data packet received by the service entity was sent by the client Data package, so that it can be confirmed that the data package is not the data package of the client that is responsible for the response.
步驟330,基於所述資料包的身份資訊,在所述資料
包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭。
如前述,若要對接收到的資料包進行轉發,則需要先基於所述資料包的身份資訊,在資料包之外按照網路傳輸協議的規則再封裝協議頭部。 As mentioned above, if the received data packet is to be forwarded, it is necessary to first encapsulate the protocol header based on the identity information of the data packet in accordance with the rules of the network transmission protocol outside the data packet.
其中,UDP是一種無連接的資料報服務。源服務實體在傳送資料前不需要和目標服務實體建立連接。資料被冠以源、目標端口號等UDP報頭字段後直接發往目的服務實體。這時,每個資料段的可靠性依靠上層協議來保證。在傳送資料較少、較小的情況下,UDP比TCP更加高效。考慮到UDP協議不需要在通訊的服務實體之間建立連接的特性,在本發明實施例中,基於資料包的身份資訊,在資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭,從而可以避免在各服務實體之間建立連接的過程。在本發明實施例中,在資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭的過程並不會影響到資料包本身。 Among them, UDP is a connectionless data report service. The source service entity does not need to establish a connection with the target service entity before transmitting data. The data is prefixed with UDP header fields such as source and destination port numbers and then directly sent to the destination service entity. At this time, the reliability of each data segment depends on the upper layer protocol to ensure. In the case of transmitting less and smaller data, UDP is more efficient than TCP. Considering that the UDP protocol does not need to establish a connection between the communicating service entities, in the embodiment of the present invention, based on the identity information of the data packet, a layer of IP header is encapsulated outside the data packet according to the rules of the network transmission protocol And UDP packet header, which can avoid the process of establishing a connection between service entities. In the embodiment of the present invention, the process of encapsulating a layer of IP header and UDP header in addition to the data packet according to the rules of the network transmission protocol does not affect the data packet itself.
在實際應用中,IP報文頭格式如表(3)所示:
其中,版本(Version)字段:占4比特。用來表明IP協議實現的版本號,當前一般為IPv4,即0100。 Among them, the version (Version) field: occupies 4 bits. It is used to indicate the version number implemented by the IP protocol. Currently, it is generally IPv4, which is 0100.
報頭長度(Internet Header Length,IHL)字段:占4比特。是頭部占32比特的數字,包括可選項。普通IP資料報(沒有任何選項),該字段的值是5,即160比特=20字節。此字段最大值為60字節。 Header Length (Internet Header Length, IHL) field: occupies 4 bits. It is a 32-bit number in the header, including optional options. Normal IP datagram (without any options), the value of this field is 5, that is, 160 bits = 20 bytes. The maximum value of this field is 60 bytes.
服務類型(Type of Service,TOS)字段:占8比特。其中前3比特為優先權子字段(Precedence,現已被忽略)。第8比特保留未用。第4至第7比特分別代表延遲、吞吐量、可靠性和花費。當它們取值為1時分別代表要求最小時延、最大吞吐量、最高可靠性和最小費用。這4比特的服務類型中只能置其中1比特為1。可以全為0,若全為0則表示一般服務。服務類型字段聲明了資料報被網路系統傳輸時可以被怎樣處理。例如:TELNET協議可能要求有最小的延遲,FTP協議(資料)可能要求有最大吞吐量,SNMP協議可能要求有最高可靠性,NNTP(Network News Transfer Protocol,網路新聞傳輸協議)可能要求最小費用,而ICMP協議可能無特殊要求(4比特全為0)。實際上,大部分主機會忽略這個字段,但一些動態路由協議如OSPF(Open Shortest Path First Protocol)、IS-IS(Intermediate System to Intermediate System Protocol)可以根據這些字段的值進行路由決策。 Type of Service (TOS) field: occupies 8 bits. The first 3 bits are the priority subfield (Precedence, now ignored). The 8th bit is reserved unused. The 4th to 7th bits represent delay, throughput, reliability, and cost, respectively. When their value is 1, they represent the minimum delay, maximum throughput, maximum reliability, and minimum cost. Only one of the four bits of the service type can be set to 1. It can be all 0, if all 0 means general service. The service type field declares how the data report can be processed when it is transmitted by the network system. For example: TELNET protocol may require minimum delay, FTP protocol (data) may require maximum throughput, SNMP protocol may require maximum reliability, and NNTP (Network News Transfer Protocol) may require minimum cost. The ICMP protocol may have no special requirements (4 bits are all 0). In fact, most hosts ignore this field, but some dynamic routing protocols such as OSPF (Open Shortest Path First Protocol) and IS-IS (Intermediate System to Intermediate System Protocol) can make routing decisions based on the values of these fields.
總長度字段:占16比特。指明整個資料報的長度(以字節為單位)。最大長度為65535字節。 Total length field: occupies 16 bits. Specify the length of the entire data report (in bytes). The maximum length is 65535 bytes.
標誌字段:占16比特。用來唯一地標識主機發送的每一份資料報。通常每發一份報文,它的值會加1。 Flag field: occupies 16 bits. Used to uniquely identify each data report sent by the host. Usually every time a message is sent, its value will increase by 1.
標誌位字段:占3比特。標誌一份資料報是否要求分段。 Flag bit field: occupies 3 bits. Mark whether an information report requires segmentation.
段偏移字段:占13比特。如果一份資料報要求分段的話,此字段指明該段偏移距原始資料報開始的位置。 Segment offset field: occupies 13 bits. If an information report requires segmentation, this field indicates where the segment is offset from the beginning of the original information report.
生存期(TTL:Time to Live)字段:占8比特。用來設置資料報最多可以經過的路由器數。由發送資料的源主機設置,通常為32、64、128等。每經過一個路由器,其值減1,直到0時該資料報被丟棄。 Time to Live (TTL: Time to Live) field: occupies 8 bits. Used to set the maximum number of routers that the data report can pass through. It is set by the source host sending the data, usually 32, 64, 128, etc. After passing through a router, its value is reduced by 1 until the data report is discarded at 0.
協議字段:占8比特。指明IP層所封裝的上層協議類型,如ICMP(1)、IGMP(2)、TCP(6)、UDP(17)等。 Protocol field: occupies 8 bits. Specify the upper layer protocol type encapsulated by the IP layer, such as ICMP (1), IGMP (2), TCP (6), UDP (17), etc.
頭部校驗和字段:占16比特。內容是根據IP頭部計算得到的校驗和碼。計算方法是:對頭部中每個16比特進行二進制反碼求和。(和ICMP、IGMP、TCP、UDP不同,IP不對頭部後的資料進行校驗)。 Header checksum field: occupies 16 bits. The content is the checksum code calculated based on the IP header. The calculation method is to perform the binary complement summation for each 16 bits in the header. (Unlike ICMP, IGMP, TCP, UDP, IP does not verify the data after the header).
源IP位址、目標IP位址字段:各占32比特。用來標明發送IP資料報文的源主機位址和接收IP報文的目標主機位址。 Source IP address and destination IP address fields: each occupies 32 bits. It is used to indicate the source host address of sending IP data packets and the destination host address of receiving IP packets.
可選項字段:占32比特。用來定義一些任選項:如記錄路徑、時間戳等。這些選項很少被使用,同時並不是所有主機和路由器都支持這些選項。可選項字段的長度必須是32比特的整數倍,如果不足,必須填充0以達到此 長度要求。 Optional field: occupies 32 bits. Used to define some options: such as record path, timestamp, etc. These options are rarely used, and not all hosts and routers support these options. The length of the optional field must be an integer multiple of 32 bits. If it is not enough, it must be filled with 0 to achieve this Length requirement.
UDP報頭文格式如表(4)所示:
其中,源、目標端口號字段:占16比特。用來標識源端和目標端的應用進程。 Among them, the source and destination port number field: occupies 16 bits. Used to identify the source and target application processes.
長度:占16比特,標明UDP報頭和UDP資料的長度。 Length: occupies 16 bits, indicating the length of the UDP header and UDP data.
校驗和:占16比特,用來對UDP報頭和UDP資料進行校驗。 Checksum: occupies 16 bits, used to check the UDP header and UDP data.
在本發明另一較佳的實施例中,步驟330包括:
In another preferred embodiment of the present invention,
子步驟331,獲取所述資料包對應的身份資訊。 In sub-step 331, the identity information corresponding to the data packet is obtained.
如步驟330所述,在對資料包進行封裝之前,首先需要獲取資料包對應的身份資訊。一般而言,資料包對應的身份資訊可以為IP位址,如發送該資料包的客戶端的IP位址,也可以為用戶ID,如發送該資料包的用戶ID。當然,用戶身份也可以為其他可用的資訊,對此本發明實施例不加以限定。
As described in
在本發明另一較佳的實施例中,當所述身份資訊為IP位址時,子步驟351,包括: In another preferred embodiment of the present invention, when the identity information is an IP address, sub-step 351 includes:
子步驟3311,在網路層解析所述資料包的IP報文頭,以獲取IP位址。 In sub-step 3311, the IP header of the data packet is parsed at the network layer to obtain an IP address.
如果要獲取的身份資訊為IP位址,例如發送該資料 包的客戶端的IP位址。如表(1)所示,在TCP/IP協議的網路層支持IP協議,所以,在本發明實施例中,在網路層解析資料包的IP報文頭,從中獲取所需的IP位址。資料包的IP報文頭是資料包本身的IP報文頭,與在資料包之外再封裝的IP報文頭不相關,但是資料包本身的IP報文頭的結構也如表(3)所示,其中的源位址即為本發明實施例所要獲取的IP位址。對於具體的解析過程,可以採用現有技術中的任何一種可用的解析方法,對此本發明實施例不加以限定。 If the identity information to be obtained is an IP address, for example, send the information The IP address of the client of the package. As shown in Table (1), the network layer of the TCP/IP protocol supports the IP protocol. Therefore, in the embodiment of the present invention, the IP header of the data packet is parsed at the network layer to obtain the required IP address. . The IP header of the data packet is the IP header of the data packet itself, which is not related to the IP header that is encapsulated outside the data packet. However, the structure of the IP header of the data packet itself is also shown in Table (3). The source address of is the IP address to be obtained in the embodiment of the present invention. For the specific analysis process, any available analysis method in the prior art can be used, which is not limited in the embodiment of the present invention.
在本發明另一較佳的實施例中,當所述身份資訊為用戶ID時,子步驟331,包括: In another preferred embodiment of the present invention, when the identity information is a user ID, sub-step 331 includes:
子步驟3312,將所述資料包暫存在網路層,同時將所述資料包向上發送至應用層。 Sub-step 3312, temporarily storing the data packet in the network layer, and at the same time sending the data packet upward to the application layer.
而如果要獲取的身份資訊為用戶ID時,例如發送該資料包的用戶ID,此時需要在應用層才可以獲取到用戶ID等資訊,所以在本發明實施例中會將資料包暫存在網路層的記憶體中,同時將資料包向上發送至應用層。在本發明實施例中網路層的IP資料包上傳至傳輸層,傳輸層解析TCP報文頭或者UDP報文頭後,將資料區的內容上傳至應用層。應用層對資料區的內容進行解析。 And if the identity information to be obtained is the user ID, such as the user ID that sent the data packet, the user ID and other information need to be obtained at the application layer. Therefore, in the embodiment of the present invention, the data packet is temporarily stored on the network. In the memory of the road layer, the data packet is sent up to the application layer at the same time. In the embodiment of the present invention, the IP data packet of the network layer is uploaded to the transport layer, and the transport layer parses the TCP packet header or the UDP packet header, and then uploads the content of the data area to the application layer. The application layer analyzes the content of the data area.
子步驟3313,在應用層解析所述資料包的資料區,以獲取所述資料包的用戶ID。 Sub-step 3313: parse the data area of the data package at the application layer to obtain the user ID of the data package.
在實際應用中,用戶ID等資訊被存放於資料包的資料區,將資料包發送至應用層後,則可以在應用層解析資 料包的資料區,獲取其中資料包的用戶ID。同樣對於具體的解析過程,可以採用現有技術中的任何一種可用的解析方法,對此本發明實施例也不加以限定。 In practical applications, the user ID and other information are stored in the data area of the data packet. After the data packet is sent to the application layer, the data can be analyzed at the application layer. In the data area of the package, get the user ID of the package. Similarly, for the specific analysis process, any available analysis method in the prior art can be used, which is not limited in the embodiment of the present invention.
子步驟332,根據所述身份資訊,選擇同一個五元組;所述五元組包括:源IP位址,目的IP位址,源端口,目的端口,傳輸協議類型;所述目的IP位址為服務實體對應的IP位址。 In sub-step 332, the same quintuple is selected based on the identity information; the quintuple includes: source IP address, destination IP address, source port, destination port, transmission protocol type; said destination IP address The IP address corresponding to the service entity.
在實際應用中,五元組能夠區分不同的通訊,並且對應的通訊是唯一的。所以在本發明實施例中,會根據身份資訊,選擇同一個五元組與該身份資訊對應,則利用五元組,可以將不同的身份資訊對應的用戶終端完全區分開來。 In practical applications, the five-tuple can distinguish different communications, and the corresponding communications are unique. Therefore, in the embodiment of the present invention, the same quintuple is selected to correspond to the identity information based on the identity information, and the quintuple is used to completely distinguish user terminals corresponding to different identity information.
在本發明實施例中,五元組包括的源IP位址是指用戶端的IP位址,目的IP位址為服務實體對應的IP位址,源端口為用戶終端發送資料包的端口,目的端口為服務實體接收資料包的端口,傳輸協議類型為發送資料包的具體的協議類型。 In the embodiment of the present invention, the source IP address included in the quintuple refers to the IP address of the user end, the destination IP address is the IP address corresponding to the service entity, the source port is the port through which the user terminal sends the data packet, and the destination port It is the port for the service entity to receive the data packet, and the transmission protocol type is the specific protocol type for sending the data packet.
源端口可以採用客戶端的端口的唯一標識ID,另外因為客戶端的IP位址唯一,可以使用客戶端IP位址的後2個字節作為源端口,當然也可以採用其他可利用的方式用以標識源端口,對此本發明實施例不加以限定。對於目的端口,使用固定的端口以唯一標記針對同一集群的資料包的目的端口。在本發明實施例中,傳輸協議類型和在資料包之外再封裝的頭部類型有關,例如,若傳輸協議類型 為UDP協議,則在資料包外再封裝一層IP報文頭和UDP報文頭;若傳輸協議類型為TCP協議,則在資料包外再封裝一層IP報文頭和TCP報文頭。 The source port can use the unique identification ID of the client's port. In addition, because the client's IP address is unique, the last 2 bytes of the client's IP address can be used as the source port. Of course, other available methods can also be used for identification. The source port is not limited in this embodiment of the present invention. For the destination port, a fixed port is used to uniquely mark the destination port of the data packet for the same cluster. In the embodiment of the present invention, the type of transmission protocol is related to the type of header re-encapsulated outside the data packet. For example, if the type of transmission protocol is If the UDP protocol is used, then another layer of IP header and UDP header is encapsulated outside the data packet; if the transmission protocol type is TCP protocol, another layer of IP header and TCP header is encapsulated outside the data packet.
需要說明的是,在本發明實施例中,所針對的是由一組協同工作的服務實體組成的集群,而且在實際應用中,集群服務實體對外提供的統一的服務位址,是虛擬IP位址,也稱為集群VIP(Virtual IP,虛擬IP)位址,客戶端通過存取集群VIP位址獲取集群內部各服務實體的功能。所以上述的目的IP位址即為集群VIP位址,針對同一集群中的服務實體,五元組中的目的IP位址是一致的。 It should be noted that, in the embodiment of the present invention, the target is a cluster composed of a group of cooperative service entities, and in practical applications, the unified service address provided by the cluster service entity is a virtual IP address. It is also called a cluster VIP (Virtual IP, virtual IP) address. The client obtains the functions of each service entity in the cluster by accessing the cluster VIP address. Therefore, the above-mentioned destination IP address is the cluster VIP address. For service entities in the same cluster, the destination IP addresses in the quintuple are the same.
子步驟333,基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭。 Sub-step 333, based on the five-tuple, encapsulate a layer of IP header and UDP header in addition to the data packet according to the rules of the network transmission protocol.
若要在資料包之外再封裝一層IP報文頭和UDP報文頭,則此時五元組中的傳輸協議類型為UDP協議,即在資料包之外是按照UDP協議的規則再封裝一層IP報文頭和UDP報文頭。根據表(3)和表(4)分別所示的IP報文頭結構和UDP報文頭結構可知,在實際應用中,五元組中的源IP位址、目的IP位址、傳輸協議類型分別與IP報文頭中的源位址、目的位址、協議一一對應,五元組中的源端口、目的端口分別與UDP報文頭中的源端口號、目的端口號一一對應。對於IP報文頭和UDP報文頭中其他部分的內容,本發明實施例不加以限定。 If you want to encapsulate a layer of IP header and UDP header outside the data packet, the transport protocol type in the five-tuple at this time is UDP protocol, that is, outside the data packet, another layer of IP packet is encapsulated according to the rules of UDP protocol. Header and UDP header. According to the IP header structure and UDP header structure shown in Table (3) and Table (4), in practical applications, the source IP address, destination IP address, and transmission protocol type in the quintuple are respectively related to The source address, destination address, and protocol in the IP packet header correspond one-to-one, and the source port and destination port in the five-tuple correspond to the source port number and destination port number in the UDP packet header respectively. The content of other parts in the IP header and the UDP header is not limited in the embodiment of the present invention.
在本發明另一較佳的實施例中,步驟333包括: In another preferred embodiment of the present invention, step 333 includes:
子步驟A3331,將在應用層獲得的五元組發送至網路層。 In substep A3331, the 5-tuple obtained at the application layer is sent to the network layer.
由於對資料包進行封裝的操作需要在網路層進行,所以在本發明實施例中需要將在應用層獲得的五元組發送至網路層。如前述,若是根據用戶ID資訊獲取的五元組資訊,則可以是在應用層獲取的五元組,此時需要將在應用層獲得的五元組發送至網路層,而若是根據IP位址獲取的五元組,則可以是在網路層獲取的五元組,此時不需要本步驟的發送過程。當然,不管是根據何種類型的用戶資訊獲取的五元組,只要所獲得的五元組不在網路層,都需要將獲取的五元組發送至網路層。 Since the operation of encapsulating data packets needs to be performed at the network layer, in the embodiment of the present invention, the quintuple obtained at the application layer needs to be sent to the network layer. As mentioned above, if the quintuple information is obtained based on the user ID information, it can be the quintuple obtained at the application layer. At this time, the quintuple obtained at the application layer needs to be sent to the network layer, and if it is based on the IP bit The five-tuple obtained by the address can be the five-tuple obtained at the network layer. In this case, the sending process of this step is not required. Of course, no matter what type of user information is obtained based on the quintuple, as long as the quintuple obtained is not in the network layer, the obtained quintuple needs to be sent to the network layer.
子步驟A3332,在網路層基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭。 Sub-step A3332, based on the quintuple at the network layer, encapsulate a layer of IP header and UDP header in addition to the data packet according to the rules of the network transmission protocol.
在本發明實施例中,具體而言,是由網路層基於五元組,在資料包之外按照UDP協議的規則再封裝一層UDP報文頭,再按照UDP協議封裝一層IP報文頭。 In the embodiment of the present invention, specifically, the network layer encapsulates a layer of UDP headers in accordance with the rules of the UDP protocol in addition to the data packet based on quintuples, and then encapsulates a layer of IP headers in accordance with the UDP protocol.
當然,對於本發明實施例也可以在,在網路層基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭,其原理基本類似。 Of course, for the embodiment of the present invention, it is also possible to encapsulate a layer of IP header and TCP header in addition to the data packet based on the five-tuple at the network layer according to the rules of the network transmission protocol. The principle is basically similar.
在本發明另一較佳的實施例中,步驟333包括: In another preferred embodiment of the present invention, step 333 includes:
子步驟B3331,將所述五元組中的源端口、目的端口封裝到所述資料包之外的UDP報文頭中。 Sub-step B3331, encapsulating the source port and destination port in the five-tuple into the UDP header outside the data packet.
具體而言,是將五元組中的源端口、目的端口分別封裝到資料包之外的UDP報文頭中的源端口號、目的端口號中。對於UDP報文頭中的其他部分的資料內容,可以採用任意一種UDP報文頭適用的資料,對此本發明實施例不加以限定。 Specifically, the source port and destination port in the 5-tuple are respectively encapsulated into the source port number and destination port number in the UDP header outside the data packet. For the data content of other parts in the UDP message header, any data applicable to the UDP message header can be used, which is not limited in the embodiment of the present invention.
子步驟B3332,將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 Sub-step B3332, encapsulating the source IP address, destination IP address, and transmission protocol type in the five-tuple into an IP header outside the data packet.
具體而言,是將五元組中的源IP位址、目的IP位址、傳輸協議類型分別封裝到資料包之外的IP報文頭中的源端口號、目的端口號、協議中。對於IP報文頭中的其他部分的資料,可以採用可任意一種IP報文頭可適用的資料,對此本發明實施例也不加以限定。 Specifically, the source IP address, destination IP address, and transmission protocol type in the 5-tuple are respectively encapsulated into the source port number, destination port number, and protocol in the IP header outside the data packet. For the data of other parts in the IP message header, any data applicable to the IP message header can be used, which is not limited in the embodiment of the present invention.
在本發明的另一較佳的實施例中,所述子步驟332包括: In another preferred embodiment of the present invention, the sub-step 332 includes:
子步驟3321,在應用層根據所述身份資訊,選擇同一個五元組。 In sub-step 3321, the same quintuple is selected at the application layer according to the identity information.
在實際應用中,五元組所包含的資訊存在於應用層中,所以可以在應用層根據所述身份資訊,選擇同一個五元組。 In practical applications, the information contained in the quintuple exists in the application layer, so the same quintuple can be selected at the application layer based on the identity information.
則在子步驟332之後,還包括: After the sub-step 332, it also includes:
子步驟334,將在應用層獲得的五元組發送至網路層。 In sub-step 334, the five-tuple obtained at the application layer is sent to the network layer.
因為具體的根據五元組對資料包進行封裝的過程在網 路層執行,所以需要將在應用層獲得的五元組發送至網路層。本步驟在子步驟353之前執行。 Because the specific process of encapsulating data packets based on quintuples is on the Internet The road layer is executed, so the five-tuple obtained at the application layer needs to be sent to the network layer. This step is executed before sub-step 353.
步驟340,將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。
In
經過前述步驟可知,在本發明實施例中,針對同一客戶端的資料包的五元組是一致的,另外,因為同一客戶端的IP位址是唯一的,不同客戶端的IP位址是不同的,所以針對不同客戶端的資料包的五元組是不一致的。 Through the foregoing steps, it can be seen that in the embodiment of the present invention, the five-tuples of the data packets for the same client are the same. In addition, because the IP address of the same client is unique, the IP addresses of different clients are different, so The five-tuples of data packets for different clients are inconsistent.
在本發明實施例中,可以根據五元組,預先設定負責應對不同客戶端的服務實體。在實際應用中,可以利用交換機的HASH策略保證將同一五元組的資料包發送到與該五元組對應的服務實體上。 In the embodiment of the present invention, the service entity responsible for handling different clients can be preset according to the quintuple. In practical applications, the HASH strategy of the switch can be used to ensure that data packets of the same quintuple are sent to the service entity corresponding to the quintuple.
步驟350,解除所述資料包之外按照網路傳輸協議的規則封裝的協議頭部。
In
在本發明實施例中,即解除資料包之外封裝的IP報文頭和UDP報文頭,當然,若是在資料包之外封裝的協議頭部為IP報文頭和TCP報文頭,則此時是解除資料包之外封裝的協議頭部為IP報文頭和TCP報文頭。 In the embodiment of the present invention, the IP packet header and UDP packet header encapsulated outside the data packet are released. Of course, if the protocol header encapsulated outside the data packet is the IP packet header and the TCP packet header, then it is released at this time. The protocol headers encapsulated outside the data packet are the IP header and the TCP header.
另外,在本發明實施例中,可以採用現有的任何一種解封裝方法,解除資料包之外按照網路傳輸協議的規則封裝的協議頭部,對此本發明不加以限定。 In addition, in the embodiment of the present invention, any existing decapsulation method can be used to release the protocol header encapsulated in accordance with the rules of the network transmission protocol other than the data packet, which is not limited by the present invention.
步驟360,獲取所述資料包的身份資訊。 Step 360: Obtain the identity information of the data package.
該步驟與前述的子步驟331類似,在此不再贅述。 This step is similar to the aforementioned sub-step 331, and will not be repeated here.
步驟370,判斷所述身份資訊對應的流量是否超過到流量閾值;如果所述身份資訊對應的流量超過流量閾值,則進入步驟380;而若所述身份資訊對應的流量超過流量閾值,則保留該身份資訊對應的資料包。 Step 370: Determine whether the flow corresponding to the identity information exceeds the flow threshold; if the flow corresponding to the identity information exceeds the flow threshold, go to step 380; and if the flow corresponding to the identity information exceeds the flow threshold, then keep the flow. The data package corresponding to the identity information.
其中的流量閾值是可以根據實際情況預先設置,對此本發明實施例不加以限定。身份資訊對應的流量是指該身份資訊對應的資料包的流量,也即身份資訊對應的客戶端的資料包的流量。若身份資訊對應的流量超過流量閾值,則將身份資訊對應的資料包丟棄,若身份資訊對應的流量未超過流量閾值,則保留身份資訊對應的資料包。 The flow threshold may be preset according to actual conditions, which is not limited in the embodiment of the present invention. The traffic corresponding to the identity information refers to the traffic of the data packet corresponding to the identity information, that is, the traffic of the data packet of the client corresponding to the identity information. If the flow corresponding to the identity information exceeds the flow threshold, the data packet corresponding to the identity information is discarded, and if the flow corresponding to the identity information does not exceed the flow threshold, the data packet corresponding to the identity information is retained.
例如,若用戶A購買的帶寬是50M/s,即流量閾值為50M/s。在用戶A對應的終端設備收到當前資料包後,根據當前時刻到之前的1秒內收到的資料包記錄,計算該用戶A的流量速度是否大於50M/s,如果大於,則丟棄該資料包,如果不大於,則保留該資料包。 For example, if the bandwidth purchased by user A is 50M/s, that is, the traffic threshold is 50M/s. After the terminal device corresponding to user A receives the current data packet, it calculates whether the traffic speed of user A is greater than 50M/s based on the data packet records received within 1 second from the current moment to the previous one, and if it is greater than that, the data is discarded If it is not larger than the package, keep the data package.
在本發明另一較佳的實施例中,當所述身份資訊為IP位址時,步驟370包括:
In another preferred embodiment of the present invention, when the identity information is an IP address,
子步驟371,查找所述IP位址對應的用戶ID。 Sub-step 371, searching for the user ID corresponding to the IP address.
在實際應用中,流量閾值一般是和用戶ID對應的,所以在本發明實施例中,根據IP位址查找與之對應的用戶ID。其中,IP位址與用戶ID的對應關係是預置的,可以預先放置在一配置文件中,或者是通過其他方式儲存,對此本發明實施例不加以限定。 In practical applications, the traffic threshold generally corresponds to the user ID, so in the embodiment of the present invention, the user ID corresponding to it is searched according to the IP address. Wherein, the corresponding relationship between the IP address and the user ID is preset, and can be placed in a configuration file in advance, or stored in other ways, which is not limited in the embodiment of the present invention.
子步驟372,根據所述用戶ID查找對應的流量閾 值。 Sub-step 372: Find the corresponding traffic threshold according to the user ID value.
用戶ID與流量閾值的對應關係是預置的,可以預先儲存於一配置文件中,或者是通過其他方式儲存,對此本發明實施例不加以限定。 The corresponding relationship between the user ID and the flow threshold is preset, and can be stored in a configuration file in advance, or stored in other ways, which is not limited in the embodiment of the present invention.
另外,在本發明實施例中,可以將用戶與流量閾值的對應關係和上述的IP位址與用戶ID的對應關係儲存於同一配置文件中,也可以儲存與不同的配置文件中,或者是利用不同的儲存方式,對此本發明實施例也不加以限制。 In addition, in the embodiment of the present invention, the corresponding relationship between the user and the traffic threshold and the above-mentioned corresponding relationship between the IP address and the user ID can be stored in the same configuration file, or stored in a different configuration file, or use Different storage methods are not limited in this embodiment of the present invention.
子步驟373,計算所述IP位址對應的流量是否超過所述流量閾值;如果所述IP位址對應的流量超過所述流量閾值,則進入步驟3110。 Sub-step 373: Calculate whether the traffic corresponding to the IP address exceeds the traffic threshold; if the traffic corresponding to the IP address exceeds the traffic threshold, go to step 3110.
此時,IP位址對應的流量是指IP位址對應的資料包的流量,也即IP位址對應的客戶端的資料包的流量。 At this time, the traffic corresponding to the IP address refers to the traffic of the data packet corresponding to the IP address, that is, the traffic of the data packet of the client corresponding to the IP address.
步驟380,丟棄所述資料包。 Step 380: Discard the data packet.
若資料包的流量超過對應的流量閾值,則會將該資料包從客戶端的流量中刪除,以保證客戶端的網路速度在瀏覽閾值之內。 If the data packet's traffic exceeds the corresponding traffic threshold, the data packet will be deleted from the client's traffic to ensure that the client's network speed is within the browsing threshold.
在本發明實施例中,同樣在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理。相對於現有的集群限速三類方案,在不增加系統複雜度以及成本的同時,提高了集 群限速的適用性、可操作性,以及精確性。 In the embodiment of the present invention, also without increasing the complexity of the system, by forwarding the data package of the client that is not responsible for handling the data package to the service entity in the same cluster responsible for handling the client to which the data package belongs, so as to ensure The traffic of the same client falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. Compared with the existing three types of cluster speed limit schemes, it improves the integration without increasing system complexity and cost. The applicability, operability, and accuracy of group rate limiting.
另外,在本發明實施例中,通過在服務實體接收到的由客戶端發送的資料包之外封裝一層IP報文頭和UDP報文頭,然後再將封裝後的資料包轉發至負責應對該資料包所屬的客戶端的服務實體中,從而可以在不需要建立連接的情況下,將資料包轉發至相應地服務實體中,進一步提高了集群限速的適用性、可操作性以及精確性。而且對於封裝了IP報文頭和TCP報文頭的資料包,則需要先在接收的服務實體以及轉發的服務實體之間建立連接,才可以在其兩者之間轉發,所以相對於實施例二中在資料包外封裝IP報文頭和TCP報文頭的方式,本發明實施例所述的在資料包之外封裝IP報文頭和UDP報文頭的方式適應性、可操作性以及效率都更高。 In addition, in the embodiment of the present invention, a layer of IP header and UDP header is encapsulated in addition to the data packet sent by the client received by the service entity, and then the encapsulated data packet is forwarded to the data packet responsible for responding to the data packet. In the service entity of the client to which it belongs, the data packet can be forwarded to the corresponding service entity without establishing a connection, which further improves the applicability, operability, and accuracy of the cluster rate limit. Moreover, for data packets that encapsulate the IP header and the TCP header, it is necessary to establish a connection between the received service entity and the forwarded service entity before it can be forwarded between the two, so compared to the second embodiment In the manner of encapsulating the IP header and the TCP header outside the data packet, the method of encapsulating the IP header and the UDP header outside the data packet described in the embodiment of the present invention has higher adaptability, operability and efficiency.
需要說明的是,對於方法實施例,為了簡單描述,故將其都表述為一系列的動作組合,但是本領域技術人員應該知悉,本發明實施例並不受所描述的動作順序的限制,因為依據本發明實施例,某些步驟可以採用其他順序或者同時進行。其次,本領域技術人員也應該知悉,說明書中所描述的實施例均屬□較佳實施例,所涉及的動作並不一定是本發明實施例所必須的。 It should be noted that for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not limited by the described sequence of actions, because According to the embodiments of the present invention, some steps may be performed in other order or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.
參照圖4,示出了本發明的一種集群精確限速裝置實施例的結構方塊圖,該集群包括至少一個交換機410和多 個服務實體420,每個服務實體具體可以包括如下模組:接收模組421,適於接收資料包。 4, there is shown a structural block diagram of an embodiment of a cluster accurate rate limiting device of the present invention. The cluster includes at least one switch 410 and multiple Each service entity 420 may specifically include the following modules: a receiving module 421 adapted to receive data packets.
判斷模組422,適於判斷所述資料包是否為由自身負責應對的客戶端的資料包。如果所述資料包不是由自身負責應對的客戶端的資料包,則進入轉發模組423;如果所述資料包是由自身負責應對的客戶端的資料包,則進入限速模組424。 The judging module 422 is suitable for judging whether the data packet is a data packet of a client that it is responsible for responding to. If the data packet is not the data packet of the client to which the user is responsible for responding, the forwarding module 423 is entered; if the data packet is the data packet of the client to which the user is responsible for responding, the rate limiting module 424 is entered.
轉發模組423,適於將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體。 The forwarding module 423 is adapted to forward the data packet to a service entity responsible for responding to the client to which the data packet belongs.
在本發明另一較佳的實施例中,所述轉發模組,包括:封裝子模組,適於基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部。 In another preferred embodiment of the present invention, the forwarding module includes: an encapsulation sub-module, which is adapted to, based on the identity information of the data packet, follow the network transmission protocol in addition to the data packet The rule encapsulates the protocol header.
轉發子模組,適於將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。 The forwarding sub-module is adapted to forward the data packet encapsulated with the protocol header through the switch to the service entity responsible for responding to the client to which the data packet belongs.
限速模組424,適於基於所述資料包的身份資訊,對所述資料包進行限速處理。 The rate limiting module 424 is adapted to perform rate limiting processing on the data packet based on the identity information of the data packet.
在本發明實施例中,在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理,因此本發明具備以下優點:首先,相對背景技術的第一類方案,本發明實施例不 用單獨在集群內設置一個流控實體對整個集群內的服務實體進行限速,不會應為該流控實體的故障而影響整個集群的正常工作,適用性強。而且,也不存在流控實體與服務實體之間大量的通訊以決策給每個服務實體下發的限速大小,僅僅是服務實體之間的資料包的簡單轉發,複雜度低。 In the embodiment of the present invention, without increasing the complexity of the system, the data package of the client that is not responsible for its response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data package belongs, thereby ensuring the same The client's traffic falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. Therefore, the present invention has the following advantages: First, compared with the background art The first type of solution, the embodiment of the present invention does not Setting a single flow control entity in the cluster to limit the speed of the service entities in the entire cluster will not affect the normal operation of the entire cluster due to the failure of the flow control entity, which has strong applicability. Moreover, there is no large amount of communication between the flow control entity and the service entity to determine the speed limit size issued to each service entity. It is only the simple forwarding of the data packets between the service entities, and the complexity is low.
其次,相對背景技術的第二類方案,本發明實施例由於同一個客戶端的資料包由同一個服務實體負責對其進行具體的業務邏輯處理,決定對其進行下一步處理還是丟棄,因此,可以精確控制每個客戶端的流量,可操作性高。 Secondly, compared to the second type of solution in the background technology, in the embodiment of the present invention, the same service entity is responsible for the specific business logic processing of the data packet of the same client, and it is determined whether to proceed with the next step or discard it. Therefore, it can be Accurately control the flow of each client, with high operability.
再次,相對背景技術的第三類方案,本發明實施例在集群的原有架構下,對資料包的處理流程做了改進,將各個服務實體接收到的同一客戶端的資料包,轉發到了同一個服務實體進行限速處理,未增加系統複雜度,也沒有採用額外的硬體設施,沒有增加硬體成本。並且,本發明實施例僅利用集群自身的計算功能,即實現了對同一客戶端的流量的限速處理,可以適用於任意規模的集群,適用性更廣。 Thirdly, compared to the third type of solution in the background technology, the embodiment of the present invention improves the processing flow of data packets under the original architecture of the cluster, and forwards the data packets of the same client received by each service entity to the same one. The service entity performs speed limit processing without increasing the complexity of the system, nor using additional hardware facilities, and without increasing hardware costs. In addition, the embodiment of the present invention only uses the computing function of the cluster itself, that is, realizes the rate limiting processing of the traffic of the same client, and can be applied to clusters of any size, with wider applicability.
總之,相對於背景技術的集群限速三類方案,在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 In short, compared with the three types of cluster speed limiting solutions in the background technology, the applicability, operability, and accuracy of cluster speed limiting are improved without increasing system complexity and cost.
參照圖5,示出了本發明的一種集群精確限速裝置實施例的結構方塊圖,該集群包括至少一個交換機510和多個服務實體520,每個服務實體具體可以包括如下模組:接收模組521,適於接收資料包。 5, there is shown a structural block diagram of an embodiment of a cluster accurate rate limiting device of the present invention. The cluster includes at least one switch 510 and multiple service entities 520. Each service entity may specifically include the following modules: Group 521, suitable for receiving data packets.
判斷模組522,適於判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則進入轉發模組523;如果所述資料包是由自身負責應對的客戶端的資料包,則進入限速模組524。 The judging module 522 is suitable for judging whether the data packet is a data packet of a client that it is responsible for responding to; if the data packet is not a data packet of the client that it is responsible for responding, then it enters the forwarding module 523; if said The data packet is the data packet of the client that is responsible for the response, and it enters the rate limiting module 524.
轉發模組523,適於將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體,具體包括:封裝子模組5231,適於基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部,具體包括:第二封裝子模組52311,適於基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 The forwarding module 523 is adapted to forward the data packet to a service entity responsible for responding to the client to which the data packet belongs, and specifically includes: an encapsulation submodule 5231, adapted to be based on the identity information of the data packet, in the data packet In addition to the packet, the protocol header is encapsulated according to the rules of the network transmission protocol, which specifically includes: a second encapsulation submodule 52311, which is adapted to be based on the identity information of the data packet, and according to the network transmission protocol outside the data packet The rule encapsulates a layer of IP header and TCP header.
在本發明另一較佳的實施例中,第二封裝子模組52311,包括:身份資訊獲取子模組,適於獲取所述資料包對應的身份資訊。 In another preferred embodiment of the present invention, the second encapsulation sub-module 52311 includes: an identity information acquisition sub-module, adapted to acquire the identity information corresponding to the data packet.
五元組選擇子模組,適於根據所述身份資訊,選擇同一個五元組;所述五元組包括:源IP位址,目的IP位址,源端口,目的端口,傳輸協議類型;所述目的IP位 址為服務實體對應的IP位址。 The quintuple selection submodule is adapted to select the same quintuple according to the identity information; the quintuple includes: source IP address, destination IP address, source port, destination port, and transmission protocol type; The destination IP bit The address is the IP address corresponding to the service entity.
第二報文頭封裝子模組,適於基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和TCP報文頭。 The second packet header encapsulation submodule is adapted to encapsulate a layer of IP packet header and TCP packet header in addition to the data packet according to the rules of the network transmission protocol based on the five-tuple.
在本發明另一較佳的實施例中,所述第二報文頭封裝子模組,包括:第二端口封裝子模組,適於將所述五元組中的源端口、目的端口封裝到所述資料包之外的TCP報文頭中。 In another preferred embodiment of the present invention, the second header encapsulation sub-module includes: a second port encapsulation sub-module, adapted to encapsulate the source port and the destination port in the five-tuple into In the TCP packet header outside the data packet.
IP位址封裝子模組,適於將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 The IP address encapsulation sub-module is adapted to encapsulate the source IP address, destination IP address, and transmission protocol type in the five-tuple into an IP header outside the data packet.
轉發子模組5232,適於將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。 The forwarding submodule 5232 is adapted to forward the data packet encapsulated with the protocol header to the service entity responsible for responding to the client to which the data packet belongs through the switch.
限速模組524,適於基於所述資料包的身份資訊,對所述資料包進行限速處理。 The rate limiting module 524 is adapted to perform rate limiting processing on the data packet based on the identity information of the data packet.
在本發明實施例中,同樣在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理。相對於現有的集群限速三類方案,在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 In the embodiment of the present invention, also without increasing the complexity of the system, by forwarding the data package of the client that is not responsible for handling the data package to the service entity in the same cluster responsible for handling the client to which the data package belongs, so as to ensure The traffic of the same client falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. Compared with the existing three types of cluster speed limitation schemes, it improves the applicability, operability, and accuracy of cluster speed limitation without increasing system complexity and cost.
另外,在本發明實施例中,通過在服務實體接收到的由客戶端發送的資料包之外封裝一層IP報文頭和TCP報文頭,然後再將封裝後的資料包轉發至負責應對該資料包所屬的客戶端的服務實體中,相對於UDP而言,本發明實施例需要在實體之間建立連接,可以進一步保證資料包中資料的準確性,將資料包準確地轉發至相應地服務實體中,進一步提高了集群限速的精確性。 In addition, in the embodiment of the present invention, a layer of IP header and TCP header is encapsulated in addition to the data packet sent by the client received by the service entity, and then the encapsulated data packet is forwarded to the data packet responsible for responding to the data packet. In the service entity of the client to which it belongs, compared with UDP, the embodiment of the present invention needs to establish a connection between the entities, which can further ensure the accuracy of the data in the data packet, and accurately forward the data packet to the corresponding service entity. Further improve the accuracy of the cluster speed limit.
參照圖6,示出了本發明的一種集群精確限速裝置實施例的結構方塊圖,該集群包括至少一個交換機610和多個服務實體620,每個服務實體具體可以包括如下模組:接收模組621,適於接收資料包。 Referring to FIG. 6, there is shown a structural block diagram of an embodiment of a cluster accurate rate limiting device of the present invention. The cluster includes at least one switch 610 and multiple service entities 620. Each service entity may specifically include the following modules: Group 621, suitable for receiving data packets.
判斷模組622,適於判斷所述資料包是否為由自身負責應對的客戶端的資料包;如果所述資料包不是由自身負責應對的客戶端的資料包,則進入轉發模組623;如果所述資料包是由自身負責應對的客戶端的資料包,則進入限速模組624。具體包括:判斷子模組6221,適於判斷所述資料包是由服務實體轉發的資料包還是由客戶端發送的資料包;如果所述資料包是由服務實體轉發的資料包,則確認所述資料包是自身負責應對的客戶端的資料包,然後進入限速模組624;如果所述資料包是由客戶端發送的資料包,則確認所述資料包不是由自身負責應對的客戶端的資料包,然後進入轉 發模組623。 The judging module 622 is adapted to judge whether the data packet is a data packet of a client that is handled by itself; if the data packet is not a data packet of a client that is handled by itself, enter the forwarding module 623; if said The data packet is the data packet of the client that is responsible for the response, and it enters the rate limiting module 624. Specifically, it includes: a judging submodule 6221, adapted to judge whether the data packet is a data packet forwarded by a service entity or a data packet sent by a client; if the data packet is a data packet forwarded by the service entity, confirm that the data packet is a data packet forwarded by the service entity; The data package is the data package of the client for which it is responsible for responding, and then enters the rate limiting module 624; if the data package is a data package sent by the client, it is confirmed that the data package is not the data of the client for which it is responsible for responding Package, and then enter the turn Hair module 623.
在本發明另一較佳的實施例中,判斷子模組6221,包括:協議頭部判斷子模組,適於針對任一資料包,判斷在所述資料包之外是否存在按照網路傳輸協議的規則封裝的協議頭部;如果在所述資料包之外存在按照網路傳輸協議的規則封裝的協議頭部,則確認所述資料包是自身負責應對的客戶端的資料包,然後進入限速模組624;如果在所述資料包之外不存在按照網路傳輸協議的規則封裝的協議頭部,則確認所述資料包不是由自身負責應對的客戶端的資料包,然後進入轉發模組623。 In another preferred embodiment of the present invention, the judging sub-module 6221 includes: a protocol header judging sub-module, which is suitable for determining whether there is any data packet outside the data packet according to the network transmission The protocol header encapsulated by the rules of the protocol; if there is a protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, confirm that the data packet is the data packet of the client that it is responsible for, and then enter the limit Speed module 624; if there is no protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet, confirm that the data packet is not a data packet of the client for which it is responsible for responding, and then enter the forwarding module 623.
轉發模組623,適於將所述資料包轉發給負責應對所述資料包所屬客戶端的服務實體,具體包括:封裝子模組6231,適於基於所述資料包的身份資訊,在所述資料包之外再按照網路傳輸協議的規則封裝協議頭部,具體包括:第一封裝子模組62311,適於基於所述資料包的身份資訊,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭。 The forwarding module 623 is adapted to forward the data packet to a service entity responsible for responding to the client to which the data packet belongs, and specifically includes: an encapsulation submodule 6231, adapted to be based on the identity information of the data packet, in the data packet In addition to the packet, the protocol header is encapsulated according to the rules of the network transmission protocol, which specifically includes: the first encapsulation submodule 62311, which is adapted to be based on the identity information of the data packet, and according to the network transmission protocol outside the data packet The rule encapsulates a layer of IP header and UDP header.
轉發子模組6232,適於將封裝了協議頭部的資料包通過交換機轉發給負責應對所述資料包所屬客戶端的服務實體。 The forwarding submodule 6232 is adapted to forward the data packet encapsulated with the protocol header to the service entity responsible for responding to the client to which the data packet belongs through the switch.
在本發明另一較佳的實施例中,第一封裝子模組62311,包括: 身份資訊獲取子模組,適於獲取所述資料包對應的身份資訊。 In another preferred embodiment of the present invention, the first packaging sub-module 62311 includes: The identity information acquisition sub-module is suitable for acquiring the identity information corresponding to the data package.
在本發明另一較佳的實施例中,當所述身份資訊為IP位址時,所述身份資訊獲取子模組包括:第一身份資訊獲取子模組,適於在網路層解析所述資料包的IP報文頭,以獲取IP位址。 In another preferred embodiment of the present invention, when the identity information is an IP address, the identity information acquisition sub-module includes: a first identity information acquisition sub-module, which is suitable for analyzing the identity information at the network layer Describe the IP header of the data packet to obtain the IP address.
當所述身份資訊為用戶ID時,所述身份資訊獲取子模組包括:向上發送子模組,適於將所述資料包暫存在網路層,同時將所述資料包向上發送至應用層。 When the identity information is a user ID, the identity information acquisition submodule includes: an upward sending submodule, which is adapted to temporarily store the data packet in the network layer and at the same time send the data packet upward to the application layer .
第二身份資訊獲取子模組,適於在應用層解析所述資料包的資料區,以獲取所述資料包的用戶ID。 The second identity information acquisition sub-module is adapted to parse the data area of the data packet at the application layer to obtain the user ID of the data packet.
五元組選擇子模組,適於根據所述身份資訊,選擇同一個五元組;所述五元組包括:源IP位址,目的IP位址,源端口,目的端口,傳輸協議類型;所述目的IP位址為服務實體對應的IP位址。 The quintuple selection submodule is adapted to select the same quintuple according to the identity information; the quintuple includes: source IP address, destination IP address, source port, destination port, and transmission protocol type; The destination IP address is the IP address corresponding to the service entity.
第一報文頭封裝子模組,適於基於所述五元組,在所述資料包之外按照網路傳輸協議的規則再封裝一層IP報文頭和UDP報文頭。 The first packet header encapsulation sub-module is adapted to encapsulate a layer of IP packet header and UDP packet header in addition to the data packet according to the rules of the network transmission protocol based on the five-tuple.
在本發明另一個在本發明另一較佳的實施例中實施例中,所述五元組選擇子模組,包括:應用層五元組選擇子模組,適於在應用層根據所述身份資訊,選擇同一個五元組。 In another embodiment of the present invention in another preferred embodiment of the present invention, the quintuple selection submodule includes: an application layer quintuple selection submodule, which is suitable for the application layer according to the For identity information, select the same 5-tuple.
則在應用層五元組選擇子模組之後,還包括: 發送子模組,適於將在應用層獲得的五元組發送至網路層。 After the application layer quintuple selects the sub-module, it also includes: The sending sub-module is suitable for sending the five-tuple obtained at the application layer to the network layer.
在本發明另一個在本發明另一較佳的實施例中實施例中,所述第一報文頭封裝子模組,包括:第一端口封裝子模組,適於將所述五元組中的源端口、目的端口封裝到所述資料包之外的UDP報文頭中。 In another embodiment of the present invention in another preferred embodiment of the present invention, the first header encapsulation sub-module includes: a first port encapsulation sub-module, which is suitable for combining the quintuple The source port and destination port of is encapsulated in the UDP header outside the data packet.
IP位址封裝子模組,適於將所述五元組中的源IP位址、目的IP位址和傳輸協議類型封裝到所述資料包之外的IP報文頭中。 The IP address encapsulation sub-module is adapted to encapsulate the source IP address, destination IP address, and transmission protocol type in the five-tuple into an IP header outside the data packet.
限速模組624,適於基於所述資料包的身份資訊,對所述資料包進行限速處理。具體包括:解除子模組6241,適於解除所述資料包之外按照網路傳輸協議的規則封裝的協議頭部。 The rate limiting module 624 is adapted to perform rate limiting processing on the data packet based on the identity information of the data packet. Specifically, it includes: the release submodule 6241, which is adapted to release the protocol header encapsulated in accordance with the rules of the network transmission protocol other than the data packet.
資料包身份資訊獲取子模組6242,適於獲取所述資料包的身份資訊。 The data packet identity information acquisition sub-module 6242 is suitable for acquiring the identity information of the data packet.
流量判斷子模組6243,適於判斷所述身份資訊對應的流量是否超過到流量閾值;如果所述身份資訊對應的流量超過流量閾值,則進入丟棄子模組6244。 The flow judging sub-module 6243 is adapted to judge whether the flow corresponding to the identity information exceeds the flow threshold; if the flow corresponding to the identity information exceeds the flow threshold, enter the discarding sub-module 6244.
在本發明另一較佳的實施例中,當所述身份資訊為IP位址時,所述流量判斷子模組,包括:用戶ID查找子模組,適於查找所述IP位址對應的用戶ID。 In another preferred embodiment of the present invention, when the identity information is an IP address, the traffic determination sub-module includes: a user ID search sub-module, which is adapted to search for the corresponding IP address User ID.
流量閾值查找子模組,適於根據所述用戶ID查找對應的流量閾值。 The flow threshold searching sub-module is suitable for searching the corresponding flow threshold according to the user ID.
第一流量判斷子模組,適於計算所述IP位址對應的流量是否超過所述流量閾值。如果所述IP位址對應的流量超過所述流量閾值,則進入丟棄子模組6244。 The first traffic judging sub-module is adapted to calculate whether the traffic corresponding to the IP address exceeds the traffic threshold. If the traffic corresponding to the IP address exceeds the traffic threshold, enter the discarding submodule 6244.
丟棄子模組6244,適於丟棄所述資料包。 The discarding submodule 6244 is adapted to discard the data packet.
在本發明實施例中,同樣在不需要增加系統複雜度的情況下,通過將不是由自身負責應對的客戶端的資料包,轉發給同一集群中負責應對該資料包所屬客戶端的服務實體,從而保證同一客戶端的流量落到同一台服務實體上,然後在該服務實體上,基於對應資料包的身份資訊,對該客戶端的資料包進行限速處理。相對於現有的集群限速三類方案,在不增加系統複雜度以及成本的同時,提高了集群限速的適用性、可操作性,以及精確性。 In the embodiment of the present invention, also without increasing the complexity of the system, by forwarding the data package of the client that is not responsible for handling the data package to the service entity in the same cluster responsible for handling the client to which the data package belongs, so as to ensure The traffic of the same client falls on the same service entity, and then on the service entity, based on the identity information of the corresponding data packet, the data packet of the client is subjected to speed limit processing. Compared with the existing three types of cluster speed limitation schemes, it improves the applicability, operability, and accuracy of cluster speed limitation without increasing system complexity and cost.
另外,在本發明實施例中,通過在服務實體接收到的由客戶端發送的資料包之外封裝一層IP報文頭和UDP報文頭,然後再將封裝後的資料包轉發至負責應對該資料包所屬的客戶端的服務實體中,從而可以在不需要建立連接的情況下,將資料包轉發至相應地服務實體中,進一步提高了集群限速的適用性、可操作性以及精確性。而且對於封裝了IP報文頭和TCP報文頭的資料包,則需要先在接收的服務實體以及轉發的服務實體之間建立連接,才可以在其兩者之間轉發,所以相對於實施例二中在資料包外封裝IP報文頭和TCP報文頭的方式,本發明實施例所述的在資料包之外封裝IP報文頭和UDP報文頭的方式適應性、可操作性以及效率都更高。 In addition, in the embodiment of the present invention, a layer of IP header and UDP header is encapsulated in addition to the data packet sent by the client received by the service entity, and then the encapsulated data packet is forwarded to the data packet responsible for responding to the data packet. In the service entity of the client to which it belongs, the data packet can be forwarded to the corresponding service entity without establishing a connection, which further improves the applicability, operability, and accuracy of the cluster rate limit. Moreover, for data packets that encapsulate the IP header and the TCP header, it is necessary to establish a connection between the received service entity and the forwarded service entity before it can be forwarded between the two, so compared to the second embodiment In the manner of encapsulating the IP header and the TCP header outside the data packet, the method of encapsulating the IP header and the UDP header outside the data packet described in the embodiment of the present invention has higher adaptability, operability and efficiency.
對於裝置實施例而言,由於其與方法實施例基本相似,所以描述的比較簡單,相關之處參見方法實施例的部分說明即可。 As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.
本說明書中的各個實施例均採用遞進的方式描述,每個實施例重點說明的都是與其他實施例的不同之處,各個實施例之間相同相似的部分互相參見即可。 The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.
本領域內的技術人員應明白,本發明實施例的實施例可提供為方法、裝置、或電腦程式產品。因此,本發明實施例可採用完全硬體實施例、完全軟體實施例、或結合軟體和硬體方面的實施例的形式。而且,本發明實施例可採用在一個或多個其中包含有電腦可用程式代碼的電腦可用儲存媒介(包括但不限於磁盤儲存器、CD-ROM、光學儲存器等)上實施的電腦程式產品的形式。 Those skilled in the art should understand that the embodiments of the present invention can be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may adopt the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may adopt computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. form.
在一個典型的配置中,所述電腦設備包括一個或多個處理器(CPU)、輸入/輸出介面、網路介面和記憶體。記憶體可能包括電腦可讀媒介中的非永久性儲存器,隨機存取儲存器(RAM)及/或非易失性記憶體等形式,如只讀儲存器(ROM)或快閃記憶體(flash RAM)。記憶體是電腦可讀媒介的示例。電腦可讀媒介包括永久性和非永久性、可行動和非可行動媒體可以由任何方法或技術來實現資訊儲存。資訊可以是電腦可讀指令、資料結構、程式的模組或其他資料。電腦的儲存媒介的例子包括,但不限於相變記憶體(PRAM)、靜態隨機存取儲存器(SRAM)、動態隨機存取儲存器(DRAM)、其他類型的隨機存取儲存器 (RAM)、只讀儲存器(ROM)、電可抹除可編程只讀儲存器(EEPROM)、快閃記憶體或其他記憶體技術、只讀光碟只讀儲存器(CD-ROM)、數位多功能光碟(DVD)或其他光學儲存、卡式磁帶,磁帶磁磁盤儲存或其他磁性儲存設備或任何其他非傳輸媒介,可用於儲存可以被計算設備存取的資訊。按照本文中的界定,電腦可讀媒介不包括非持續性的電腦可讀媒體(transitory media),如調變的資料信號和載波。 In a typical configuration, the computer equipment includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. Memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory ( flash RAM). Memory is an example of computer readable media. Computer-readable media include permanent and non-permanent, movable and non-movable media, and information storage can be realized by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), and other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital Versatile discs (DVD) or other optical storage, cassette tapes, magnetic tape storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include non-persistent computer-readable media (transitory media), such as modulated data signals and carrier waves.
本發明實施例是參照根據本發明實施例的方法、終端設備(系統)、和電腦程式產品的流程圖及/或方塊圖來描述的。應理解可由電腦程式指令實現流程圖及/或方塊圖中的每一流程及/或方塊、以及流程圖及/或方塊圖中的流程及/或方塊的結合。可提供這些電腦程式指令到通用電腦、專用電腦、嵌入式處理機或其他可編程資料處理終端設備的處理器以產生一個機器,使得通過電腦或其他可編程資料處理終端設備的處理器執行的指令產生用於實現在流程圖一個流程或多個流程及/或方塊圖一個方塊或多個方塊中指定的功能的裝置。 The embodiments of the present invention are described with reference to the flowcharts and/or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, dedicated computers, embedded processors, or other programmable data processing terminal equipment to generate a machine that can be executed by the processor of the computer or other programmable data processing terminal equipment A device for realizing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram is generated.
這些電腦程式指令也可儲存在能引導電腦或其他可編程資料處理終端設備以特定方式工作的電腦可讀儲存器中,使得儲存在該電腦可讀儲存器中的指令產生包括指令裝置的製造品,該指令裝置實現在流程圖一個流程或多個流程及/或方塊圖一個方塊或多個方塊中指定的功能。 These computer program instructions can also be stored in a computer-readable storage that can guide a computer or other programmable data processing terminal equipment to work in a specific manner, so that the instructions stored in the computer-readable storage produce a manufactured product including the instruction device , The instruction device realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
這些電腦程式指令也可裝載到電腦或其他可編程資料 處理終端設備上,使得在電腦或其他可編程終端設備上執行一系列操作步驟以產生電腦實現的處理,從而在電腦或其他可編程終端設備上執行的指令提供用於實現在流程圖一個流程或多個流程及/或方塊圖一個方塊或多個方塊中指定的功能的步驟。 These computer program instructions can also be loaded into a computer or other programmable data On processing terminal equipment, a series of operation steps are executed on a computer or other programmable terminal equipment to produce computer-implemented processing, so that the instructions executed on the computer or other programmable terminal equipment are provided for realizing a process or flow in the flowchart. Multiple processes and/or block diagrams A block or steps of a function specified in multiple blocks.
儘管已描述了本發明實施例的較佳實施例,但本領域內的技術人員一旦得知了基本進步性概念,則可對這些實施例做出另外的變更和修改。所以,所附申請專利範圍意欲解釋為包括較佳實施例以及落入本發明實施例範圍的所有變更和修改。 Although the preferred embodiments of the embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic progressive concepts. Therefore, the scope of the attached patent application is intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.
最後,還需要說明的是,在本文中,諸如第一和第二等之類的關係術語僅僅用來將一個實體或者操作與另一個實體或操作區分開來,而不一定要求或者暗示這些實體或操作之間存在任何這種實際的關係或者順序。而且,術語“包括”、“包含”或者其任何其他變體意在涵蓋非排他性的包含,從而使得包括一系列要素的過程、方法、物品或者終端設備不僅包括那些要素,而且還包括沒有明確列出的其他要素,或者是還包括為這種過程、方法、物品或者終端設備所固有的要素。在沒有更多限制的情況下,由語句“包括一個......”限定的要素,並不排除在包括所述要素的過程、方法、物品或者終端設備中還存在另外的相同要素。 Finally, it should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. Or there is any such actual relationship or sequence between operations. Moreover, the terms "including", "including" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements not only includes those elements, but also includes those elements that are not explicitly listed. Other elements listed, or also include elements inherent to this process, method, article, or terminal device. Without more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other same elements in the process, method, article, or terminal device that includes the element.
以上對本發明所提供的一種集群精確限速方法和一種集群精確限速裝置,進行了詳細介紹,本文中應用了具體 個例對本發明的原理及實施方式進行了闡述,以上實施例的說明只是用於幫助理解本發明的方法及其核心思想;同時,對於本領域的一般技術人員,依據本發明的思想,在具體實施方式及應用範圍上均會有改變之處,綜上所述,本說明書內容不應理解為對本發明的限制。 The above is a detailed introduction to a cluster accurate speed limiting method and a cluster accurate speed limiting device provided by the present invention. The specific A few examples illustrate the principles and implementation of the present invention. The descriptions of the above examples are only used to help understand the methods and core ideas of the present invention; at the same time, for those of ordinary skill in the art, according to the ideas of the present invention, in specific There will be changes in the implementation and the scope of application. In summary, the content of this specification should not be construed as limiting the present invention.
Claims (24)
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201610179863.9 | 2016-03-25 | ||
CN201610179863.9A CN107231269B (en) | 2016-03-25 | 2016-03-25 | Accurate cluster speed limiting method and device |
Publications (2)
Publication Number | Publication Date |
---|---|
TW201737664A TW201737664A (en) | 2017-10-16 |
TWI721103B true TWI721103B (en) | 2021-03-11 |
Family
ID=59899247
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW106105141A TWI721103B (en) | 2016-03-25 | 2017-02-16 | Cluster accurate speed limiting method and device |
Country Status (3)
Country | Link |
---|---|
CN (1) | CN107231269B (en) |
TW (1) | TWI721103B (en) |
WO (1) | WO2017162117A1 (en) |
Families Citing this family (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111988211B (en) * | 2019-05-21 | 2022-09-09 | 超聚变数字技术有限公司 | Message distribution method and device of network equipment |
WO2021243649A1 (en) * | 2020-06-04 | 2021-12-09 | 深圳市欢太科技有限公司 | Rate limit bandwidth adjustment method and apparatus |
CN112039796B (en) * | 2020-08-28 | 2023-04-18 | 北京字节跳动网络技术有限公司 | Data packet transmission method and device, storage medium and electronic equipment |
CN114301960B (en) * | 2021-12-15 | 2024-03-15 | 山石网科通信技术股份有限公司 | Processing method and device for cluster asymmetric traffic, electronic equipment and storage medium |
CN114338543B (en) * | 2022-03-14 | 2022-06-21 | 北京指掌易科技有限公司 | Network access speed limiting method, device, equipment and storage medium |
CN117255058B (en) * | 2023-11-17 | 2024-02-23 | 深圳万物安全科技有限公司 | Network speed limiting method, terminal equipment and storage medium |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102025640A (en) * | 2010-12-24 | 2011-04-20 | 北京星网锐捷网络技术有限公司 | Flow control method, device and network device |
CN102385804A (en) * | 2010-08-30 | 2012-03-21 | 谈宇清 | Intelligent traffic system and navigation method thereof |
CN102882799A (en) * | 2012-09-13 | 2013-01-16 | 曙光信息产业(北京)有限公司 | Cluster arrangement and collocation system and method capable of controlling flow |
CN104364761A (en) * | 2012-06-15 | 2015-02-18 | 思杰系统有限公司 | Systems and methods for forwarding traffic in a cluster network |
WO2015042773A1 (en) * | 2013-09-24 | 2015-04-02 | 华为技术有限公司 | Access point configuration method and controller |
US20150236959A1 (en) * | 2012-07-23 | 2015-08-20 | F5 Networks, Inc. | Autonomously adaptive flow acceleration based on load feedback |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101938502B (en) * | 2009-07-14 | 2013-03-27 | 北京邮电大学 | Server cluster system and load balancing method |
CN103581036B (en) * | 2013-10-31 | 2017-05-24 | 华为技术有限公司 | Method, device and system for controlling virtual machine network flow |
CN105227488B (en) * | 2015-08-25 | 2018-05-08 | 上海交通大学 | A kind of network flow group scheduling method for distributed computer platforms |
-
2016
- 2016-03-25 CN CN201610179863.9A patent/CN107231269B/en active Active
-
2017
- 2017-02-16 TW TW106105141A patent/TWI721103B/en active
- 2017-03-20 WO PCT/CN2017/077285 patent/WO2017162117A1/en active Application Filing
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102385804A (en) * | 2010-08-30 | 2012-03-21 | 谈宇清 | Intelligent traffic system and navigation method thereof |
CN102025640A (en) * | 2010-12-24 | 2011-04-20 | 北京星网锐捷网络技术有限公司 | Flow control method, device and network device |
CN104364761A (en) * | 2012-06-15 | 2015-02-18 | 思杰系统有限公司 | Systems and methods for forwarding traffic in a cluster network |
US20150236959A1 (en) * | 2012-07-23 | 2015-08-20 | F5 Networks, Inc. | Autonomously adaptive flow acceleration based on load feedback |
CN102882799A (en) * | 2012-09-13 | 2013-01-16 | 曙光信息产业(北京)有限公司 | Cluster arrangement and collocation system and method capable of controlling flow |
WO2015042773A1 (en) * | 2013-09-24 | 2015-04-02 | 华为技术有限公司 | Access point configuration method and controller |
Also Published As
Publication number | Publication date |
---|---|
CN107231269B (en) | 2020-04-07 |
TW201737664A (en) | 2017-10-16 |
CN107231269A (en) | 2017-10-03 |
WO2017162117A1 (en) | 2017-09-28 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
TWI721103B (en) | Cluster accurate speed limiting method and device | |
US11979322B2 (en) | Method and apparatus for providing service for traffic flow | |
US11882041B2 (en) | Congestion notification packet indicating specific packet flow experiencing congestion to facilitate individual packet flow based transmission rate control | |
US9749226B2 (en) | Flow-based network switching system | |
US10574763B2 (en) | Session-identifer based TWAMP data session provisioning in computer networks | |
CN113326228B (en) | Message forwarding method, device and equipment based on remote direct data storage | |
JP4829896B2 (en) | Method, system and article for improved network performance by avoiding data corruption | |
WO2019134383A1 (en) | Method for controlling network congestion, access device, and computer readable storage medium | |
US7065086B2 (en) | Method and system for efficient layer 3-layer 7 routing of internet protocol (“IP”) fragments | |
CN107948076B (en) | Method and device for forwarding message | |
WO2019029318A1 (en) | Network congestion notification method, proxy node and computer device | |
WO2021047515A1 (en) | Service routing method and apparatus | |
CN113228571B (en) | Method and apparatus for network optimization for accessing cloud services from a premise network | |
US11943326B2 (en) | Providing multiple TCP connections between a client and server | |
US10009282B2 (en) | Self-protecting computer network router with queue resource manager | |
US20220091754A1 (en) | Methods and systems for nvme target load balancing based on real time metrics | |
WO2022067791A1 (en) | Data processing method, data transmission method, and related device | |
WO2020249128A1 (en) | Service routing method and apparatus | |
CN116886621B (en) | Message forwarding control method, DPU and related equipment | |
US20090106436A1 (en) | Methods and systems for offload processing | |
US10374944B2 (en) | Quality of service for data transmission | |
WO2023040782A1 (en) | Message processing method and system, and device and storage medium | |
WO2023005723A1 (en) | Packet transmission method and communication apparatus | |
WO2023174170A1 (en) | Packet processing method and apparatus, and packet checking method and apparatus | |
WO2023244872A2 (en) | A transport protocol for in-network computing in support of rpc-based applications |