WO2011153838A1

WO2011153838A1 - Traffic collection system, method and device

Info

Publication number: WO2011153838A1
Application number: PCT/CN2011/070633
Authority: WO
Inventors: 陈永欣
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-06-07
Filing date: 2011-01-26
Publication date: 2011-12-15
Also published as: CN101854305B; CN101854305A

Abstract

The present invention discloses a traffic collection system, method and device, in order to solve the problem in prior art that a single traffic collector can not achieve the collection and query for large traffic data information of network devices. The traffic collection system provided by the present invention includes a management server and at least one traffic collector, wherein said management server is used for broadcasting traffic query messages to at least one registered traffic collector and gathering the traffic data of each network device, which are reported by the traffic collectors, to obtain a gathered result; said traffic collector is used for collecting the traffic data of the network devices which are managed by the traffic collector and reporting the traffic data to said management server on basis of the traffic query message broadcasted by the management server.

Description

Flow collection system, method and device thereof

The present invention relates to the field of network device traffic management, and in particular, to a traffic collection system, a method and a device thereof. Background technique

With the rapid development of the Internet, the Internet Protocol (IP) network has become an indispensable tool in people's daily work and life, and point-to-point data transmission in IP networks is more common, and there are few users. Occupying a large amount of device bandwidth, resulting in the telecommunications carrier's network equipment investment can not meet the user's demand for bandwidth. Therefore, telecom operators hope to increase the visibility of the network and understand the actual occupancy of the network, which in turn can effectively control the network, ensure the balance of user usage, and can introduce differentiated products to meet the needs of different users.

In order to increase the visibility of the network, understand the actual occupation of the network, and meet the needs of different users, it is necessary to collect the traffic data of the network device and perform analysis and control. Generally, all the network devices in the network are connected through a single traffic collector ( Traffic data such as switches and routers are collected. In the network environment of a metropolitan area network or a large enterprise, the traffic data information of the user IP network device is very large, which makes the collection and query pressure of the traffic collector large, resulting in A single traffic collector cannot complete the collection and query of large-traffic data information of all network devices (such as multiple routers or switches), and even improve the hardware performance of a single traffic collector cannot meet the collection of large-traffic data information. And the query, visible, is urgently needed to provide a solution that can complete the collection and query of large-flow data information of network devices. Summary of the invention

The embodiments of the present invention provide a traffic collection system, a method, and a device thereof, which are used to solve the problem that a single traffic collector in the prior art cannot complete the collection and query of large traffic data information of the network device.

The traffic collection system provided by the present invention, the system includes a management server and at least one traffic collector;

The management server is configured to broadcast a traffic query message to the registered at least one traffic collector, and summarize traffic data of the network device reported by each traffic collector to obtain a summary result;

The traffic collector is configured to collect traffic data of the network device under the jurisdiction according to the traffic query message broadcasted by the management server, and report the traffic data to the management server.

Correspondingly, the present invention also provides a traffic collection method, the method comprising:

The management server broadcasts the traffic query message to the registered at least one traffic collector; the management server obtains the traffic data of the governed network device that the traffic collector collects according to the traffic query message;

The management server summarizes the obtained traffic data and stores the summary results.

The present invention also provides a traffic collection device, which includes a message subject module, a message queue module, and a summary module;

The message subject module is configured to broadcast a traffic query message to the registered at least one traffic collector;

The message queue module is configured to obtain traffic data of the network device that is collected by the traffic collector according to the traffic query message;

The summary module is configured to summarize the obtained traffic data and store the summary result. The above-mentioned traffic collection system, method, and apparatus provided by the embodiments of the present invention, for collecting and querying large-flow data information that cannot be completed by a single traffic collector, by at least one The traffic collector collects the collection and query of the large-flow data information of the network device, centrally manages all the traffic collectors, ensures the reliability of the message, and solves the large-flow data information that cannot be completed by a single traffic collector. The problem of collection and query ensures the effective control of the network by the telecom operator and the balance of the network used by the user. With the increase of the network equipment at the aggregation layer and the core layer, the traffic collector can be added without upgrading. Some traffic collectors increase the scalability of the system.

Other features and advantages of the invention will be set forth in the description which follows, The objectives and other advantages of the invention will be realized and attained by the <RTI DRAWINGS

1 is a block diagram showing the composition of a traffic collection system according to Embodiment 1 of the present invention;

2 is a structural block diagram of a traffic collection system with three traffic collectors as an example in the first embodiment of the present invention;

3 is a flowchart of a method for collecting traffic in a second embodiment of the present invention;

4 is a flow chart of registration of a traffic collector in Embodiment 2 of the present invention;

5 is a flowchart of a management server broadcast message according to Embodiment 2 of the present invention;

FIG. 6 is a flow collection device according to Embodiment 2 of the present invention. detailed description

In the embodiment of the present invention, in order to solve the problem that the network resources occupied by users in the prior art are not balanced, and the single traffic collector cannot satisfy the collection and query of large-traffic data information in the network, the problem that the telecommunication operator cannot effectively control the network resources is caused. The invention provides a traffic collection system, a method, and a device thereof, which share traffic collection and query work of a network device by using at least one traffic collector, and centrally manage all traffic collectors, thereby solving a single traffic collector cannot Number of completed large flows According to the collection of information and query questions.

The preferred embodiments of the present invention are described with reference to the accompanying drawings, and the preferred embodiments described herein are intended to illustrate and explain the invention.

Hehe.

Embodiment 1

This embodiment first provides a traffic collection system, as shown in FIG. 1, including a management server 100 and at least one traffic collector ₂₀₀ , wherein: the management server 100 is configured to register at least one traffic collector The broadcast traffic query message is summarized, and the traffic data of the network device reported by each traffic collector is summarized to obtain a summary result.

The traffic collector 200 is configured to collect traffic data of the network device under the jurisdiction according to the traffic query message broadcasted by the management server, and report the traffic data to the management server.

Further, the traffic collector 200 is further configured to periodically report a heartbeat message to the management server in a normal working state.

The management server 100 is further configured to: when receiving the heartbeat message reported by the traffic collector, update the received time of the stored heartbeat message of the traffic collector, according to the received heartbeat message of each traffic collector. The time is judged whether the traffic collector is in a normal working state, and the status information of the traffic collector in the normal working state is queried.

The management server 100 is configured to send a status query message to the traffic collector of each normal working state, where the collector ID of the traffic collector of the normal working state is carried.

The traffic collector 200 is configured to receive a status query message sent by the management server, and confirm that the collector ID carried in the status query message is consistent with the locally stored collector ID, and query the message according to the status. The status information of the traffic collector is queried and reported to the management server. Preferably, the management server 100 is further configured to hand over the network device under the jurisdiction of the traffic collector in the abnormal working state to the traffic collector in which the state information meets the normal working state of the set condition.

For the convenience of introduction, it is assumed that there are three traffic collectors of the same structure, namely 200A, 200B and 200C, as shown in FIG. 2, including the management server 100 and the traffic collectors (200A, 200B and 200C);

The management server 100 is configured to broadcast a traffic query message to the registered traffic collectors (200A, 200B, and 200C), and summarize the traffic data of the network devices reported by each traffic collector to obtain a summary result.

The traffic collectors (200A, 200B, and 200C) are configured to receive a traffic query message broadcast by the management server 100, and confirm that the message object of the traffic query message includes the collector ID of the traffic collector, according to the The traffic query message collects the traffic data of the network device under the jurisdiction and reports it to the management server 100.

Assuming that the reception time of the heartbeat message of the traffic collector 200A and the traffic collector 200B satisfies the set time requirement, and the reception time of the heartbeat message of the traffic collector 200C does not satisfy the requirement of the set time, the management server 100 confirms. The traffic collectors (200A and 200B) are in a normal working state, and the traffic collector 200C is in an abnormal working state.

The status message includes a server CPU usage message, a memory usage message, and a disk usage percentage message.

Preferably, the management server 100 is further configured to use a traffic collector of an abnormal working state.

The network device under the jurisdiction of 200C is handed over to the traffic collector 200A or the traffic collector 200B whose status information satisfies the normal operating state of the set condition.

Obviously, assuming that the CPU memory usage of the traffic collector 200B in the status message is lower than that of the traffic collector 200A, it indicates that the collection pressure of the traffic collector 200B is small, that is, the traffic collector 200C of the abnormal working state is The governed network device is handed over to the traffic collector 200B, from The dynamic collection of the traffic collector is implemented.

Preferably, the management server 100 is further configured to open the collector switch of the traffic collector by sending a collection open message to the at least one traffic collector before broadcasting the traffic query message.

Further, the traffic collector is further configured to send a registration message to the management server according to the configured IP address of the management server each time it is started;

The management server is further configured to extract, from the received registration message, an IP address of the traffic collector that initiates registration, and find whether the collector ID corresponding to the IP address of the traffic collector is recorded locally, if not, Configuring a collector ID for the traffic collector and recording a correspondence between the IP address of the traffic collector and the configured collector ID, and if so, extracting the collector ID of the traffic collector; And returning a registration confirmation message carrying the collector ID to the traffic collector that initiated the registration.

Further, £ is provided with three traffic collectors, that is, the traffic collectors (200A, 200B, and 200C) are also used to send a registration message to the management server 100 according to the configured IP address of the management server 100 each time it is started. .

The method for obtaining the collector ID by the traffic collectors (200A, 200B, and 200C) is: The management server 100 is further configured to extract, from the received registration message, the traffic collectors (200A, 200B, and 200C) that initiate registration. IP address, find whether the local collector ID of the IP address of the traffic collector (200A, 200B, and 200C) is recorded locally. If the collector ID of the traffic collector 200A is not found, it is the traffic collector 200A. Configure the collector ID and record the correspondence between the IP address of the traffic collector and the configured collector ID. If the collector ID of the traffic collectors (200B and 200C) is found, the traffic collector is set. The collector IDs of (200B and 200C) are fetched; and the registration confirmation message carrying the collector ID is fed back to the traffic collectors (200A, 200B, and 200C) that initiated the registration.

Embodiment 2 Based on the same technical concept, this embodiment provides a traffic collection method, as shown in FIG. 3, including the following steps:

Step S301: The management server broadcasts a traffic query message to the registered at least one traffic collector.

Step S302: The management server obtains traffic data of the governed network device that is collected by the traffic collector according to the traffic query message.

Step S303: The management server summarizes the obtained traffic data, and stores the summary result. Further, before the broadcast server queries the traffic query message, the management server further includes: opening the aggregation switch of the traffic collector by broadcasting the set open message to the at least one traffic collector.

Further, the process of registering the traffic collector with the management server includes: the management server extracting an IP address of the traffic collector from the registration message sent by the traffic collector.

The management server searches whether the local collector ID corresponding to the IP address of the traffic collector is recorded locally, and if not, configures the collector ID for the traffic collector and records the IP address and configuration of the traffic collector. Corresponding relationship between the collector IDs, if any, fetching the collector ID of the traffic collector;

The management server feeds back to the originating traffic collector a registration confirmation message carrying the collector ID.

The specific registration process of the traffic collector is shown in Figure 4, including the following steps:

Step S401: The traffic collector sends a registration message to the management server according to the configured IP address of the management server each time it starts.

Step S402: The management server extracts the IP address of the traffic collector that initiates the registration from the received registration message, and searches whether the collector ID corresponding to the IP address of the traffic collector is recorded in the management server. If not, the process proceeds to the step. S403; if yes, go to step S404. Step S403: The management server configures the collector ID for the traffic collector and records the correspondence between the IP address of the traffic collector and the configured collector ID.

Step S404: The management server extracts the collector ID of the traffic collector.

Step S405: After obtaining the corresponding traffic collector identifier, the management server feeds back the registration confirmation message carrying the collector ID to the originating traffic collector.

Further, the management server updates the stored reception time of the heartbeat message of the traffic collector when receiving the heartbeat message periodically reported by the traffic collector;

According to the received time of the heartbeat message of each of the stored traffic collectors, it is determined whether the traffic collector is in a normal working state, and the status information of the traffic collector in the normal working state is queried.

The heartbeat message is used to determine an indicator of whether the traffic collector is working normally, and the receiving time can be set to 10 seconds or other time.

Further, the management server queries the status information of the traffic collector in a normal working state, and specifically includes:

The management server sends a status query message to each of the normal working state traffic collectors, where the query message carries the collector identifier of the traffic collector in the normal working state.

The management server obtains the status information reported by the traffic collector when it confirms that the collector identifier carried in the received query message is consistent with the locally stored collector identifier.

Further, after the management server queries the status information of the traffic collector in the normal working state, the management server further includes:

The network device under the jurisdiction of the traffic collector of the abnormal working state is handed over to the traffic collector whose state information satisfies the normal working state of the set condition.

Preferably, when the time of the heartbeat message on the traffic collector does not meet the set time, the management server confirms that the traffic collector is in an abnormal working state, and according to the status reported by the other traffic collector The message determines the traffic set with the lowest collection pressure in other traffic collectors. And handing over the network device under the jurisdiction of the traffic collector of the abnormal working state to the traffic collector with the lowest collection pressure.

The process of the management server broadcasting the message to the at least one traffic collector is as shown in FIG. 5, and specifically includes the following steps:

Step S501: The management server encapsulates the broadcasted message object.

Step S502: The management server determines whether it is sent to the specified traffic collector, if the message is sent to the specified traffic collector, the process proceeds to step S503; if the message is sent to all the traffic collectors, the process proceeds to step S504. .

Step S503: The management server encapsulates the collector ID of the specified traffic collector into the query message object, and then proceeds to step S504.

Step S504: The management server sets the attribute of the collector ID of each traffic collector to NULL, and then proceeds to step S505.

Step S505: The management server sends the message to each traffic collector.

Step S506: After receiving the message, the traffic collector obtains the collector ID from the message object, and determines whether it is NULL; if not NULL, the process proceeds to step S507; if it is NULL, the process proceeds to step S508.

Step S507: Determine whether the acquired ID of the collector is the same as the ID obtained after the registration of the collector, and if yes, go to step S508; otherwise, go to step S509.

Step S508: The traffic collector receives the message and processes the process, and the process ends.

Step S509: The traffic collector abandons the received message, and the process ends.

The processing described in step S508 refers to an operation performed by the traffic collector in accordance with the content of the instruction carried in the management server broadcast message.

The present invention further provides a traffic collection device, as shown in FIG. 6, including a message subject module 601, a message queue module 602, and a summary module 603;

The message subject module 601 is configured to broadcast traffic to the registered at least one traffic collector. Query the message.

The message queue module 602 is configured to obtain traffic data of the network device that is collected by the traffic collector according to the traffic query message.

The summary module 603 is configured to summarize the obtained traffic data and store the summary result. Preferably, the summary module 603 is further configured to generate a flow data information report in a plurality of formats, such as a real-time report, a daily report, a weekly report, and a monthly report, and may also be a histogram, a two-dimensional, a three-dimensional coordinate curve, and a pie chart. The form generates real-time network device traffic data information reports, and the summary results of large-scale network device traffic data information situation analysis.

Preferably, the traffic collection device further includes a storage module, configured to store a summary result obtained by the summary module;

Preferably, the traffic collection device further includes a display module, configured to display a summary result of the storage module.

According to the foregoing traffic collection system, the method and the device thereof, the collection and query work of the large-flow data information that cannot be completed by a single traffic collector, and the large traffic of the network device is shared by multiple traffic collectors. Collecting and querying data information, centrally managing all traffic collectors, ensuring the reliability of messages, and solving the problem of collecting and querying large-volume data information that cannot be completed by a single traffic collector. The effective control of the network by the telecom operator and the balance of the network used by the user. With the increase of the network equipment at the aggregation layer and the core layer, the traffic collector can be added, and the existing traffic collector can be upgraded without adding an existing system. Scalability.

Claims

Claim

A traffic collection system, characterized in that the system comprises a management server and at least one traffic collector; wherein

2. The flow collection system of claim 1 wherein:

The traffic collector is further configured to send a registration message to the management server according to the configured IP address of the management server at each startup;

The management server is further configured to extract, from the received registration message, an IP address of the traffic collector that initiates the registration, and find whether the collector ID corresponding to the IP address of the traffic collector is recorded locally. If not, configuring the collector ID for the traffic collector, and recording a correspondence between the IP address of the traffic collector and the configured collector ID; if yes, the traffic collector The collector ID is fetched; the registration confirmation message carrying the collector ID is fed back to the traffic collector that initiated the registration.

3. The flow collection system of claim 1 wherein:

The traffic collector is further configured to periodically report a heartbeat message to the management server in a normal working state;

The management server is further configured to: when receiving the heartbeat message reported by the traffic collector, update the received time of the stored heartbeat message of the traffic collector, according to the stored heartbeat message of each traffic collector The receiving time determines whether the traffic collector is in a normal working state, and queries the status information of the traffic collector in a normal working state.

4. The traffic collection system of claim 3, wherein: The management server is further configured to send a status query message to the traffic collector of each normal working state, where the collector ID of the traffic collector of the normal working state is carried;

The traffic collector is further configured to receive the status query message sent by the management server, and confirm that the collector ID carried in the status query message is consistent with the locally stored collector ID, according to the status The query message queries the status information of the traffic collector and reports it to the management server.

5. The flow collection system of claim 3 or 4, wherein

The management server is further configured to hand over the network device under the jurisdiction of the traffic collector of the abnormal working state to the traffic collector whose state information meets the normal working state of the set condition.

The traffic collection system according to claim 1, wherein the management server is further configured to send a collection open message to the at least one traffic collector before broadcasting the traffic query message. , turn on the collector switch of the flow collector.

7. A method for collecting traffic, characterized in that the method comprises:

The management server broadcasts a traffic query message to the registered at least one traffic collector; the management server obtains traffic data of the managed network device that each traffic collector collects according to the traffic query message;

8. The method according to claim 7, wherein the method further comprises: the traffic collector registering with the management server; and the traffic collector performing the registration to the management server comprises: managing the server from the traffic collector Extracting the IP address of the traffic collector from the sent registration message;

The management server searches whether the collector ID corresponding to the IP address of the traffic collector is recorded locally, and if not, configures the collector ID for the traffic collector, and records the IP address of the traffic collector Corresponding relationship with the configured collector ID; if yes, taking out the collector ID of the traffic collector; the management server feeding back to the traffic collector that initiated the registration Register confirmation message for the device ID.

The method according to claim 7, wherein the method further comprises: updating the stored heartbeat message of the traffic collector when receiving a heartbeat message periodically reported by the traffic collector Receiving time

The method according to claim 9, wherein the management server queries the status information of the traffic collector in the normal working state, including:

The management server sends a status query message to the traffic collector of each normal working state, where the query message carries the identifier of the traffic collector of the normal working state;

The management server obtains the state information of the traffic collector that confirms the received query message when the carried collector identifier is consistent with the locally stored collector identifier.

The method according to claim 9 or 10, wherein after the management server queries the status information of the traffic collector in the normal working state, the method further includes:

The method according to claim 7, wherein the method further comprises: before the management server broadcasts the traffic query message, the method further comprises:

The stream collector switch of the traffic collector is turned on by broadcasting a message to the at least one traffic collector.

A traffic collection device, comprising: a message subject module, a message queue module, and a summary module; wherein

The message subject module is configured to broadcast a traffic query message to the registered at least one traffic collector; The message queue module is configured to obtain traffic data of the network device that is collected by the traffic collector according to the traffic query message;

The summary module is configured to summarize the obtained traffic data and store the summary result.