WO2012058988A1 - 一种报文转向的方法和深度包检测设备 - Google Patents

一种报文转向的方法和深度包检测设备 Download PDF

Info

Publication number
WO2012058988A1
WO2012058988A1 PCT/CN2011/079915 CN2011079915W WO2012058988A1 WO 2012058988 A1 WO2012058988 A1 WO 2012058988A1 CN 2011079915 W CN2011079915 W CN 2011079915W WO 2012058988 A1 WO2012058988 A1 WO 2012058988A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
message
steering
identifier
slave device
Prior art date
Application number
PCT/CN2011/079915
Other languages
English (en)
French (fr)
Inventor
宁志明
陈浩
陈亮
Original Assignee
成都市华为赛门铁克科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都市华为赛门铁克科技有限公司 filed Critical 成都市华为赛门铁克科技有限公司
Priority to EP11837514.6A priority Critical patent/EP2568670B1/en
Publication of WO2012058988A1 publication Critical patent/WO2012058988A1/zh
Priority to US13/706,063 priority patent/US8594086B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H04L12/4645—Details on frame tagging

Definitions

  • the present invention relates to the field of network communications, and in particular, to a packet forwarding method and a deep packet inspection device. Background technique
  • network devices monitor the network by analyzing and monitoring traffic and packets. Because different network devices have different focus on packet processing and different bandwidth support, they are often required to form clusters during deployment. The assistance analysis between network devices can meet the processing requirements of packets.
  • an application scenario may occur in which a packet needs to be transmitted to multiple network devices in the same cluster in turn.
  • Each network device in the cluster has a specific analysis and processing function, and the same cluster is in the same cluster.
  • the network device needs to redirect the same packet; the steering refers to the process of handing over the packet from one network device to another network device, and the other network device returns the packet after the processing is completed.
  • the steering refers to the process of handing over the packet from one network device to another network device, and the other network device returns the packet after the processing is completed.
  • An object of the embodiments of the present invention is to provide a packet forwarding method and a deep packet inspection device to solve the problem of packet steering.
  • the embodiment of the invention provides a method for packet forwarding, which includes:
  • the inner layer Vlan header includes a turn identification field, and the turn identification field includes a turn indicator;
  • the slave device Transmitting a message with an inner Vlan header to a corresponding slave device according to the steering identity in the Steering Identity field, the slave device comprising at least one.
  • the embodiment of the invention further provides a deep packet inspection device, including:
  • a receiving unit configured to receive a packet, where the packet includes a user identifier
  • a searching unit configured to search for a service type corresponding to the user identifier in the packet according to the first identifier of the user identifier and the preset user identifier and the service type;
  • a processing unit configured to add an inner layer virtual to the packet according to the service type, the pre-set service type, the second correspondence of the slave device identifier, and the third correspondence between the device identifier and the direction identifier field a local area VLAN header, the inner layer Vlan header includes a turn identification field, and the turn identification field includes a turn indicator;
  • a steering unit configured to redirect the packet with the inner Vlan header to the corresponding slave device according to the steering identifier in the steering identifier field, where the slave device includes at least one.
  • the packet forwarding method and the deep packet inspection device of the embodiment of the present invention provide a solution for packet forwarding, by adding an inner layer Vlan header with a turn identification field to the packet, indicating that the packet is in the same cluster. Turning to reduce the processing burden of DPI devices, while allowing users to customize a number of different personalized services.
  • FIG. 1 is a schematic structural diagram of a DPI device and a slave device in the same cluster according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a first embodiment of a method for redirecting a packet according to an embodiment of the present invention
  • FIG. 3 is an inner layer Vlan header of the present invention
  • FIG. 4 is a schematic flowchart of a second embodiment of a packet forwarding method according to an embodiment of the present invention
  • FIG. 5 is a schematic diagram of a packet direction between a DPI device and a slave device according to a third embodiment of the present invention
  • FIG. 7 is a schematic diagram of a third embodiment of a packet forwarding method
  • FIG. 7 is a schematic diagram of a packet before adding an inner layer Vlan header according to an embodiment of the present invention
  • Figure 8 is a schematic view showing the inner layer Vlan head in the third embodiment of the invention.
  • FIG. 9 is a schematic diagram of a message according to a third embodiment of the present invention after adding an inner Vlan header
  • FIG. 10 is a schematic diagram of a packet direction between a DPI device and a slave device when the switch is provided in the third embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a first embodiment of a deep packet inspection device according to an embodiment of the present invention
  • FIG. 12 is a schematic structural diagram of a second embodiment of a deep packet inspection device according to an embodiment of the present invention.
  • the DPI device In the DPI (Deep Packet Inspection) device of this embodiment, at least one slave device can be attached. As shown in FIG. 1 , the DPI device has simple service processing capability, and each slave device has a specific analysis processing function. For example, antivirus, URL (Uniform Resource Locator) filtering, WAN (wide area network) acceleration, etc., the DPI setting method, as shown in FIG. 2, includes the following steps: S10. Receive a packet, where the packet includes a user identifier.
  • URL Uniform Resource Locator
  • the DPI device can provide customized services for users within its control range.
  • the packet is an uplink packet
  • the user identifier of the packet is a user identifier for sending the packet, and the user identifier of the sent packet may be a source IP (Internet Protocol) address, a user account, or the like
  • the message is a downlink message
  • the user identifier is a user identifier for receiving the message
  • the user identifier of the received message may be a destination IP address, a user account, or the like.
  • the user identifier has a one-to-one correspondence with the user.
  • the DPI device can establish a first correspondence between the user identifier of the user and the service type customized by the user. Sex service.
  • the service type may include antivirus, URL filtering, WAN acceleration, and the like.
  • the services that can be customized for the uplink and downlink packets can be the same. Different services can be customized for the uplink and downlink packets.
  • the first correspondence is differentiated. The first correspondence between the uplink packet and the first correspondence between the downlink packet, where the packet attribute (upstream or downlink) can enter the attribute (uplink or downlink) of the ingress interface of the DPI device according to the packet. To judge.
  • a typical DPI device typically includes a shunt module and processing module in the foreground, and a web page configuration module and database located in the back office.
  • the first correspondence may be stored in the offloading module; when the number of the first correspondences is large, the first correspondence may be stored in a database in the background of the DPI device.
  • the inner layer Vlan header includes a turn identification field, and the turn identification field includes a turn indicator.
  • Vlan technology is a technology for realizing virtual workgroups by logically dividing devices in a local area network into network segments.
  • a protocol for solving Ethernet broadcast and security problems is proposed, which is based on Ethernet frames.
  • Vlan header use Vlan to divide users into smaller working groups, and limit Two-layer mutual visits between users with the working group.
  • the existing Vlan headers are 16 bits.
  • the first 3 bits represent the PRI (priority), the fourth bit indicates the CFI (Canonical Format Indicator), and the last 12 bits are reserved.
  • the application is reserved for the last 12 bits, and the first 4 bits are reserved as they are.
  • the inner layer Vlan header may include a turn identification field, and may further include a link number field, where the turn identification field includes a turn indicator, and the turn indicator may be represented by 1 or 0, which is of course not limited thereto.
  • FIG 3 it is a schematic diagram of the structure of the inner Vlan header.
  • the last 12 bits of the inner Vlan header contain the Steering ID field and the Link Number field. The number of bits in the Steering ID field can be the same as the number of slave devices attached to the DPI device, or more than the number of slave devices.
  • the service type and the slave device identifier have a second correspondence, and the second correspondence relationship is preset in the DPI device.
  • the second correspondence the user-customized service can be specified to the slave device providing the service, and the message sent/received by the user can be transferred to the slave device providing the corresponding service to provide the user with the customized service.
  • Each bit in the slave device identification and the turn identification field has a third correspondence, and the third correspondence is preset in the DPI device. Through the third correspondence, the DPI device can determine how to set the steering identifier field when adding the inner Vlan header to the packet to indicate the subsequent steering operation.
  • the Steering Identification field includes a Steering Identity: a directional flag corresponding to the slave device to which the packet needs to be redirected, and a non-turning identifier on the bit corresponding to the slave device to which the packet does not need to be redirected.
  • the value of the bit corresponding to the slave device to which the message needs to be turned can be set to 1, and the value of the bit corresponding to the slave device that does not need to be redirected to the message is set to 0.
  • S40 Forward a packet with an inner Vlan header to a corresponding slave device according to the steering identifier in the steering identifier field, where the slave device includes at least one.
  • the DPI device and each slave device use a dual-arm networking, and the DPI device sends a packet with an inner Vlan header to one of the two arms to the slave device. After the device is processed, the message is returned to the DPI device through the other end of the arm.
  • the DPI device itself can separately record the entire steering operation process of the message, and the message is sequentially switched from left to right or right to left according to the direction of the steering indicator in the inner Vlan head turn identification field.
  • the slave device in this way, can avoid missing steering or repeated steering operations.
  • the DPI device itself may not record the steering operation process, but instead records the steering operation process in the steering identification field of the inner Vlan header with the message.
  • the method further includes:
  • the message completion steering refers to the message completing the transition between the DPI device and the slave device; when the message needs to be redirected to multiple slave devices, The completion of the message is that the message completes the transition between the DPI device and all the slave devices. That is to say, when the message only needs to be redirected to a slave device, the message is completed once the message is completed and the message is completed. When the message needs to be redirected to multiple slave devices, only when the message is completed multiple times It is called the message completion turn.
  • different processing may be performed according to the manner in which the steering operation process is recorded. If the DPI device is using the entire steering operation process of recording the message by itself, when the message is turned to the process record to display the message completion steering, it is confirmed that the message completes the steering; if it is used, the steering operation process is recorded in the steering In the manner that the packet is redirected along with the packet, when the steering identifier field of the redirected packet does not contain the steering identifier, the packet is confirmed to be turned. Otherwise, the packet is not completed.
  • the DPI device may have two operation modes during the steering process, first When the message with the inner Vlan header is about to turn to the slave device, the bit corresponding to the slave device in the turn identification field is turned by the turn flag. Complete the identification, and then redirect the message to the slave device; second, when the message with the inner WLAN header is turned back from a certain slave device, it will turn to the corresponding identifier field corresponding to the slave device.
  • the bit is set to the steering completion indicator by the steering indicator.
  • the steering indicator can be 1, the steering completion indicator can be 0; or the steering indicator can be 0, and the steering completion indicator is 1.
  • the steering completion indicator can be represented by the same identifier as the non-turning indicator, but the steering is completed. There is a difference between the logo and the turn logo. The turn logo and the non-turn logo should also differ.
  • the steering indicator, the non-turning indicator, and the steering completion indicator may be set according to a predetermined policy, the steering indicator indicates that the packet needs to be redirected to the slave device corresponding to the bit, and the non-turning indicator indicates that the message is not turned to the bit corresponding to the bit.
  • the slave device, to the completion flag indicates that the message has been diverted to the slave device corresponding to the bit.
  • the steering indicator is 1, the non-turning indicator is 0, and the steering completion flag is 0, and the DPI device turns to the corresponding slave device in turn in the order of the turn indicator field from left to right when the message is turned.
  • the packet corresponding to the steering slave device in the direction of the redirected indicator is set to the steering completion identifier by the steering indicator, and the message is forwarded to the slave device: Specifically, after the DPI device adds the inner Vlan header to the packet, the DPI device first checks the first bit from the left to the right of the steering identifier field of the inner Vlan header to determine the bit. The corresponding slave A is the first slave that the message is diverted to, and then the value of the bit in the turn identification field is set to the turn completion flag 0 by the turn indicator 1 and will be with the inner Vlan header. The message is forwarded to the slave device.
  • the DPI device checks again the first bit from the left to the right in the turn identification field is 1, and determines the slave device B corresponding to the bit.
  • the second slave device that the message turns to, and then turns the value of the bit corresponding to the slave device B in the direction of the redirected message to the turn completion flag 0 by the turn indicator 1, and forwards the message with the inner Vlan header to From device B, so
  • the S50 may be specifically: determining whether the bits in the diverted identification field in the packet that is turned back from the slave device are non-turning signs or steering completion signs, that is, determining the direction of the message returned from a certain slave device. Whether the value of the bit in the identification field is all 0. If all are 0, it means that the message has completed all steering operations in sequence.
  • the DPI device After the message is turned back from a slave device, it will turn to the identity field and the slave.
  • the bit corresponding to the device is set to the steering completion identifier by the steering indicator. Specifically, after the DPI device adds the inner Vlan header to the packet, the DPI device first checks the first value from left to right in the steering identifier field. After the bit of 1 is determined, the DPI device sets the value of the bit corresponding to the slave device A in the direction indicated by the device A to the first slave from the device A.
  • the completion flag 0 then checking the first bit from the left to the right in the turn identification field to a value of 1, determining that the slave device B is the second slave device that the message is diverted to, with The packet after the layer Vlan header is forwarded to the second slave device B.
  • the DPI device turns to the value of the bit corresponding to the slave device B in the identification field and is turned by the turn indicator 1
  • the S50 may be: after the bit position corresponding to the slave device in the steering identifier field is the steering completion identifier, it is determined whether each bit in the turn identification field of the packet is a non-turning identifier.
  • Or turn The identifier is determined, that is, after the DPI device sets the steering identifier 1 corresponding to a certain slave device to the steering completion identifier 0, it is determined whether the value of the bit in the turn identification field is all 0, and if all are 0, the message is All steering operations have been completed in sequence.
  • DPI devices can use the same mode of operation for slave devices in the same group. It should be noted that during the packet forwarding process, the slave device processes only the packet and does not operate the inner Vlan header.
  • the message can be diverted between the DPI device and its attached slave device.
  • the DPI device separately records the entire steering operation process of the message, when the message is turned to the process record to display the message completion steering, it is confirmed that the message completes the steering; if the DPI device does not separately record the steering operation process, When the steering operation process is recorded in the steering identification field of the inner Vlan header, the message is turned together, and when the steering identification field of the turned-back message does not contain the steering indicator, it is confirmed that the steering is completed.
  • the DPI device After the packet is diverted, the DPI device removes the inner Vlan header in the packet and continues to transmit the packet through the communication link that receives the packet. Further, the DPI device may further record the link number of the link when receiving the message from the communication link, and continue to transmit through the communication link corresponding to the recorded link number after the message is completed. Message.
  • the DPI device may also add the link number of the link to the inner layer Vlan header, that is, the inner layer Vlan header further includes a link number field corresponding to the link, and the DPI device passes the The communication link corresponding to the link identifier in the link number field in the inner Vlan header continues to transmit the message.
  • the reserved field in the Vlan header is the last 12 bits, and for the service requirements that the user may form in the future, the eight slave devices can basically satisfy the user's personalized customization, and the 4-bit link number field can be distinguished.
  • the 16 links can basically meet the scale of network development in the future. Therefore, preferably, the steering identifier field of the inner layer Vlan header may be set to 8 bits, and the link number field is set to 4 bits.
  • the embodiment of the present invention does not limit the order of the direction of the turn identification field and the link number field.
  • the advantage of carrying the link number of the transmission packet in the link number field in the inner Vlan header is that the recording burden of the DPI device can be reduced, and the link number is carried in the inner Vlan header to follow the message, and if it is turning In the process, the packet is not filtered according to the user-customized rules.
  • the DPI device does not need to record the link number of the packet, and the subsequent process can be performed by the shunt module except the first step of adding the inner Vlan header. This is done to make the DPI device process the message more efficiently.
  • the packet forwarding method of the embodiment provides a solution for packet forwarding. By adding an inner Vlan header with a turn identification field to the packet, the packet is instructed to perform multiple steerings in the same cluster, thereby reducing The processing burden of the DPI device.
  • the method of packet forwarding in this embodiment supports the user to customize a plurality of different personalized services.
  • This embodiment is a specific embodiment of the method for steering.
  • a cluster include one DPI device and three slave devices it manages (see Figure 5): slave device a, slave device b, and slave device c.
  • the function of the slave device a is antivirus
  • the function of the slave device b is URL filtering
  • the function of the slave device c is WAN acceleration.
  • Each slave device can only communicate with the DPI device, and the slave devices cannot communicate with each other.
  • the method includes: 5101.
  • the DPI device receives a packet, where the packet includes a user identifier.
  • the DPI device searches for a service type corresponding to the IP address in the packet according to the IP address and the first correspondence between the preset IP address and the service type.
  • the message needs to be forwarded to the slave device a and the slave device. b.
  • the DPI device adds an inner layer to the genius according to the service type, a pre-set service type, a second correspondence of the slave device identifier, and a third correspondence between each bit in the device identifier and the turn identifier field. Vlan head.
  • the inner Vlan header in this example includes an 8-bit steering identifier field and a 4-bit link number field, as shown in Figure 8.
  • the slave device corresponding to the antivirus is identified as a
  • the slave device corresponding to the URL filtering is b
  • the slave device a corresponds to the first bit in the identifier field
  • the slave device b corresponds to the pointer in the identifier field. 2nd bit.
  • the link number of the link is 3.
  • the message with the inner Vlan header added is shown in Figure 9, where "0x8100" is used to indicate that the Vlan header is added, "Vlan ID" is the inner Vlan header, "0x8100” and the Vlan header are 4 bytes.
  • S104 The DPI device forwards the packet with the inner Vlan header to the corresponding slave device according to the steering identifier in the steering identifier field, where the slave device includes at least one.
  • the DPI device forwards the message with the inner Vlan header to the slave device a (the dotted line in Figure 5 indicates the packet direction, where the numbers 1-6 indicate the message.
  • the order of delivery after receiving the message returned by the slave device a, the value of the bit corresponding to the slave device a in the turn identification field is set to 0; after that, the message is redirected to the slave device b, when After the message is returned by the slave device b, the value of the bit corresponding to the slave device b in the turn identification field is set to zero.
  • the DPI device After the packet is turned, the DPI device removes the inner Vlan header in the packet and continues to transmit the packet through the communication link that receives the packet.
  • the DPI device removes the inner Vlan header in the packet and continues to transmit packets through the uplink port of the communication link with link number 3.
  • two layers of Vlan can be constructed. For example, 802.1 Q in 802.1 Q.
  • the fourth correspondence between the slave device identifier and the switch port number is configured on the DPI device.
  • the DPI device adds an outer Vlan header to the packet according to the fourth correspondence between the device identifier and the switch port number.
  • the value of the outer Vlan header is the packet.
  • the switch port number corresponding to the slave device that will be turned.
  • the DPI device is connected to the slave device 111, the slave device n, and the slave device p through a switch.
  • the dotted line in the figure indicates the packet direction, where the numbers 1-10 indicate The order in which messages are delivered.
  • the switch port corresponding to the device m is (100, 101), where 100 is the transmit port, 101 is the receive port; the switch port corresponding to the slave device n is (102, 103), and the switch port corresponding to the slave device p is (104, 105); DPI devices and switches can be connected through trunks, and trunks can be released to all switch ports.
  • the DPI device After adding the inner Vlan header and the outer Vlan header to the packet, the DPI device redirects the packet.
  • the DPI first sends the packet with the inner Vlan header and the outer Vlan header to the switch.
  • the switch determines the port number of the switch where the slave device m is to be forwarded according to the value of the outer Vlan header, and passes the packet through the port.
  • the packet 100 is redirected to the slave device m, and the packet is forwarded to the corresponding slave device through the switch port corresponding to the value of the outer Vlan header; after the device m processes the message, it returns to the switch through the port 101; The message is returned to the DPI device; the DPI device sets the bit corresponding to the slave device m in the turn identification field of the inner Vlan header to 0, and then searches for the next slave device to which the message needs to be redirected.
  • the DPI device Since the value of the second bit of the steering identifier field of the inner Vlan header is 1, the DPI device changes the switch port number in the outer Vlan header to 102, and the DPI device sends the packet to the switch; the switch according to the outer Vlan header In the switch port number, the packet is forwarded to the slave device through the port 102; after the slave device n processes the packet, it returns to the switch through the port 103; the switch then returns the DPI device to the DPI device; the DPI device will The value of the bit corresponding to the slave device n in the turn flag field of the inner layer Vlan header is set to zero. At this time, since the value of the bit in the turn identification field is 0, it means that all the steering is completed. After the packet is diverted, the DPI device removes the inner Vlan header and the outer Vlan header in the packet. Thereafter, the DPI device continues to transmit the message by receiving the communication link of the message.
  • the slave device processes only the packets and does not operate the inner Vlan header and the outer Vlan header.
  • the switch forwards the packets only according to the switch port in the outer VLAN header.
  • the inner Vlan header and the outer Vlan header are also not operated; the DPI device controls the switch to forward the packet to the corresponding slave device through the outer Vlan header, and records the progress of the packet steering operation through the inner Vlan header.
  • the packet forwarding method of the present embodiment provides a solution for packet forwarding, by adding an inner Vlan header and an outer Vlan header with a turn identification field to the packet, indicating that the packet is in the same cluster.
  • the second turn reduces the processing load of the DPI device and supports the user to customize the personalized service.
  • the deep packet detecting device includes: a receiving unit 10, a searching unit 20, a processing unit 30, and a steering unit 40.
  • the receiving unit 10 is configured to receive a packet, where the packet includes a user identifier.
  • the searching unit 20 is configured to search for a service type corresponding to the user identifier in the packet according to the user identifier and a first correspondence between the preset user identifier and the service type.
  • the user identifier is a user identifier for sending the packet, and the user identifier of the sent packet may be a source IP address, a user account, or the like;
  • the user identifier is the user identifier of the packet, and the user identifier of the received packet may be a destination IP address, a user account, or the like.
  • the processing unit 30 is configured to add an inner layer to the packet according to the service type, the pre-set service type, and the second correspondence between the slave device identifier and the third correspondence between the device identifier and the direction identifier field.
  • the Vlan header, the inner Vlan header may include a turn identification field, and the turn identification field includes a turn indicator.
  • the bit corresponding to the slave device that the packet needs to be redirected is a turn indicator
  • the bit corresponding to the slave device that does not need to be redirected is a non-turning identifier, where the turn indicator can be 1 or 0. It is of course not limited to the above two, and the steering indicator needs to be distinguished from the non-turning logo.
  • the steering unit 40 is configured to redirect the packet with the inner layer Vlan header to the corresponding slave device according to the steering identifier in the steering identifier field, where the slave device includes at least one.
  • the deep packet inspection device provided in this embodiment adds an inner Vlan header with a turn indication field to the packet, indicating that the packet is turned in the same cluster, reducing the processing load of the DPI device, and providing user customization. Personalized service.
  • the deep packet inspection apparatus of FIG. 12 may further include:
  • the determining unit 50 is configured to determine whether the packet completes the steering after the message is completed. Specifically, when the packet only needs to be redirected to a slave device, the message completion steering refers to the message completing the DPI device and the Steering between devices: When a message needs to be redirected to multiple slaves, the message completion turns to the message to complete the transition between the DPI device and all slave devices. That is to say, when the message only needs to be redirected to a slave device, the message is completed once the message is completed and the message is completed. When the message needs to be redirected to multiple slave devices, only when the message is completed multiple times It is called the message completion turn.
  • the sending unit 60 is configured to: after the determining unit 50 determines that the packet has completed the steering, remove the inner Vlan header in the packet, and continue to transmit the packet by using the communication link that receives the packet.
  • the inner layer Vlan header may further include a link number field corresponding to the link, where the link number field includes a link identifier of a communication link that receives a message, and the sending unit 60 Specifically, the method may be: continuing to transmit a message by using a communication link corresponding to the link identifier in the link number field in the inner Vlan header.
  • the turn identification field includes 8 bits
  • the link number field includes 4 bits.
  • the value of the bit corresponding to the slave device to which the message needs to be turned may be set to 1, and the value of the bit corresponding to the slave device that does not need to be redirected to the message is set to 0.
  • the message with the inner Vlan header is preferably redirected to the slave device whose message needs to be redirected in the order of the turn identification field from left to right or right to left.
  • the steering unit 40 may record the steering operation process in the steering identifier field of the inner layer Vlan head and turn along with the message, and in this case, determine whether the message is completed or not.
  • the following two methods may be used: the bit position corresponding to the slave device in the identification field is a steering completion identifier; and the determining unit 50 turns to the identifier or the steering completion flag to determine whether the steering is completed.
  • the bit position corresponding to the slave device in the identifier field is a turn completion identifier; then the determining unit may turn to the identifier field after the packet with the inner layer Vlan header is turned back from a slave device After the bit position corresponding to the slave device is the steering completion identifier, it is determined whether each bit in the turn identification field of the packet is a non-turning indicator or a steering completion identifier to determine whether the packet completes the steering.
  • the processing unit 30 may be further configured to: add an outer Vlan header to the packet according to a fourth correspondence between the preset device identifier and the switch port number.
  • the value of the outer Vlan header is the switch port number corresponding to the slave device to which the packet is to be turned; the steering unit 40 can be used to: pass the ⁇ with the inner Vlan header and the outer Vlan header The switch port corresponding to the value of the outer Vlan head is diverted to the corresponding slave device.
  • the sending unit 60 may be configured to: after the completion of the diversion, remove the inner Vlan header and the outer Vlan header in the packet, and continue to transmit the packet by receiving the communication link of the packet.
  • the deep packet inspection device of the embodiment provides a packet forwarding function, and adds an inner Vlan header with a turn identification field to the packet, indicating that the packet is redirected multiple times in the same cluster, thereby reducing the DPI device.
  • the deep packet inspection device of this embodiment can provide a customized service customized by the user.
  • the descriptions of the various embodiments have different emphasis, and the parts that are not detailed in a certain embodiment, It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is any such actual relationship or order between them.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Description

一种报文转向的方法和深度包检测设备 本申请要求于 2010 年 11 月 4 日提交中国专利局、 申请号为 201010532260.5、 发明名称为 "一种报文转向的方法和深度包检测设备" 的中 国专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域
本发明涉及网络通信领域， 特别是涉及一种报文转向的方法和深度包检 测设备。 背景技术
随着 Internet技术的发展， 网络设备的功能也越来越丰富， 对网络进行监 控变得愈加必要。
目前， 网络设备通过对流量和报文的分析和监控来实现对网络的监控。 由于不同网络设备对报文处理的侧重点不同， 带宽支持也不同， 因此在部署 时经常需要组成集群， 通过网络设备之间的协助分析， 满足报文的处理需求。
发明人在实现本发明的过程中发现：
在上述部署格局下， 可能出现一种应用场景， 即一个报文需要依次被传 递给同一集群内的多个网络设备， 集群内的每个网络设备具有特定的分析处 理功能， 则同一集群内的网络设备之间需要对同一个报文进行转向； 所述转 向是指将报文由一个网络设备交给另一个网络设备处理， 所述另一个网络设 备处理完成后再将报文返回的过程。 但是， 现有技术中还没有实现报文转向 的技术方案。 发明内容
本发明实施例的目的是提供一种报文转向的方法和深度包检测设备， 以 解决报文转向的问题。 本发明实施例提供了一种报文转向的方法， 包括：
接收报文， 所述报文中包含有用户标识；
根据所述用户标识以及预先设置的用户标识与服务类型的第一对应关 系， 查找与所述报文中的用户标识对应的服务类型；
根据所述服务类型、 预先设置的服务类型和从设备标识的第二对应关系 以及从设备标识和转向标识字段中各比特位的第三对应关系， 为报文添加内 层虚拟局域网 Vlan头，所述内层 Vlan头包括转向标识字段，所述转向标识字 段中包含有转向标识；
根据所述转向标识字段中的转向标识将带有内层 Vlan头的报文转向给对 应的从设备， 所述从设备包括至少一台。
本发明实施例还提供了一种深度包检测设备， 包括：
接收单元， 用于接收报文， 所述报文中包含有用户标识；
查找单元， 用于根据所述用户标识以及预先设置的用户标识与服务类型 的第一对应关系， 查找与所述报文中的用户标识对应的服务类型；
处理单元， 用于根据所述服务类型、 预先设置的服务类型和从设备标识 的第二对应关系以及从设备标识和转向标识字段中各比特位的第三对应关 系 ,为报文添加内层虚拟局域网 Vlan头，所述内层 Vlan头包括转向标识字段， 所述转向标识字段中包含有转向标识；
转向单元， 用于根据所述转向标识字段中转向标识将带有内层 Vlan头的 报文转向给对应的从设备， 所述从设备包括至少一台。
本发明实施例的报文转向的方法和深度包检测设备， 提供了报文转向的 解决方案， 通过在报文中添加带有转向标识字段的内层 Vlan头， 指示报文在 同一集群中的转向， 降低 DPI设备的处理负担， 同时可以支持用户定制多个 不同的个性化服务。 附图说明
为了更清楚地说明本发明实施例中的技术方案， 下面将对实施例描述中 所需要使用的附图作简单地介绍， 显而易见地， 下面描述中的附图仅仅是本 发明的一些实施例， 对于本领域普通技术人员来讲， 在不付出创造性劳动性 的前提下， 还可以根据这些附图获得其他的附图。
图 1是本发明实施例同一集群中 DPI设备和从设备的架构示意图； 图 2是本发明实施例报文转向的方法的第一实施例的流程示意图； 图 3是本发明的内层 Vlan头的示意图；
图 4是本发明实施例报文转向的方法的第二实施例的流程示意图； 图 5是本发明第三实施例中 DPI设备和从设备之间报文的走向示意图； 图 6是本发明实施例报文转向的方法的第三实施例的流程示意图； 图 7是本发明实施例的报文添加内层 Vlan头之前的示意图；
图 8是发明第三实施例中内层 Vlan头的示意图；
图 9是本发明第三实施例的报文添加内层 Vlan头之后的示意图；
图 10是本发明第三实施例中具有交换机时， DPI设备和从设备之间报文的 走向示意图；
图 11是本发明实施例的深度包检测设备的第一实施例的结构示意图； 图 12是本发明实施例的深度包检测设备的第二实施例的结构示意图。 具体实施方式
为使本发明实施例的上述目的、 特征和优点能够更加明显易懂， 下面结 合附图和具体实施方式对本发明实施例作进一步详细的说明。
实施例一
本实施例的 DPI ( Deep Packet Inspection, 深度包检测 )设备下可以附属 有至少一台从设备， 如图 1所示， DPI设备具备简单的业务处理能力， 每个从 设备具有特定的分析处理功能， 例如杀毒、 URL ( Uniform Resource Locator, 统一资源定位符）过滤、 WAN ( wide area network, 广域网）加速等， DPI设 的方法， 如图 2所示， 包括如下步骤： S10, 接收报文， 所述报文中包含有用户标识。
S20, 根据所述用户标识以及预先设置的用户标识与服务类型的第一对应 关系， 查找与所述报文中的用户标识对应的服务类型。
由于 DPI设备位于核心网和用户之间， 所以 DPI设备可以为其控制范围 内的用户提供定制的服务。 若所述报文为上行报文， 则所述报文中用户标识 为发送所述报文的用户标识， 所述发送报文的用户标识可以为源 IP (网际协 议）地址、 用户账号等； 若所述报文为下行报文， 则所述用户标识为接收所 述才艮文的用户标识， 所述接收 ·艮文的用户标识可以为目的 IP地址、 用户账号 等。 由于用户标识与用户具有一一对应的关系， 当用户定制了符合个性需求 的服务类型后， DPI设备可以通过将用户的用户标识和用户定制的服务类型建 立第一对应关系， 实现为用户的针对性服务。 所述服务类型可以包括杀毒、 URL过滤、 WAN加速等。 用户针对上下行报文定制的服务可以相同， 也可以 针对上行报文和下行报文定制不同的服务， 当针对上行报文和下行报文定制 的服务不同时， 第一对应关系要区分为针对上行报文的第一对应关系和针对 下行报文的第一对应关系， 其中， 报文属性（上行或下行）可以根据报文进 入 DPI设备的入链路接口的属性（上行口或下行口） 来判断。
典型的 DPI设备通常包括位于前台的分流模块和处理模块， 以及位于后 台的网页配置模块和数据库。 当第一对应关系的数量较少时， 第一对应关系 可以存储在分流模块中； 当第一对应关系的数量较多时， 可以存储在 DPI设 备后台的数据库中。
S30, 根据所述服务类型、 预先设置的服务类型和从设备标识的第二对应 关系以及从设备标识和转向标识字段中各比特位的第三对应关系， 为报文添 加内层虚拟局域网 Vlan头，所述内层 Vlan头包括转向标识字段，所述转向标 识字段中包含有转向标识。
Vlan技术是一种通过将局域网内的设备逻辑地划分成一个个网段从而实 现虚拟工作组的技术， 提出了解决以太网的广播和安全性问题的协议， 其在 以太网帧的基础上增加 Vlan头，用 Vlan把用户划分为更小的工作组， 限制不 同工作组间的用户二层互访。
现有的 Vlan头共 16bit, 其中前 3bit表示的字段为 PRI (优先级）， 第 4bit 表示的字段为 CFI ( Canonical Format Indicator, 标准格式指示）， 后 12bit均 为保留字段。 在本实施例中， 都是对后 12bit保留字段的应用， 而对前 4bit进 行原样保留。 内层 Vlan头可以包括转向标识字段， 还可以进一步包括链路号 字段， 其中， 转向标识字段中包含有转向标识， 转向标识可以用 1或 0来表 示， 当然不限于此。 如图 3所示， 为内层 Vlan头的结构示意图。 内层 Vlan 头的后 12bit中包含转向标识字段和链路号字段， 转向标识字段的比特位数可 以与 DPI设备下附属的从设备数量相同， 也可以多于从设备的数量。
服务类型和从设备标识具有第二对应关系 ,第二对应关系预先设置在 DPI 设备中。 通过第二对应关系， 可以将用户定制的服务具体到提供服务的从设 备， 将用户发出 /接收的报文转向给提供对应服务的从设备即可实现为用户提 供其定制的服务。
从设备标识和转向标识字段中各比特位具有第三对应关系， 第三对应关 系预先设置在 DPI设备中。 通过第三对应关系， DPI设备可以在给报文添加 内层 Vlan头时， 确定转向标识字段如何设置， 以指示后续的转向操作。 转向 标识字段中包含有转向标识： 与报文需要转向的从设备对应的比特位上具有 转向标识， 与报文不需要转向的从设备对应的比特位上具有不转向标识。 具 体的， 在设置转向标识字段时， 可以将报文需要转向的从设备对应的比特位 的值置为 1 , 报文不需要转向的从设备对应的比特位的值置为 0。 当然， 也可 以将报文需要转向的从设备对应的比特位的值置为 0,报文不需要转向的从设 备对应的比特位的值置为 1。 且不限于上述两种设置方式， 可以根据具体需要 而定。
实际应用中， 由于第二对应关系和第三对应关系的数量都不是艮大， 可 以保存在 DPI设备前台的分流模块中。
S40, 根据所述转向标识字段中的转向标识将带有内层 Vlan头的报文转 向给对应的从设备， 所述从设备包括至少一台。 在附图 1所示的组网结构中， DPI设备和每个从设备釆用双臂组网， DPI 设备将带有内层 Vlan头的报文通过双臂中的一端发送给从设备， 该从设备处 理完之后再将报文通过双臂中的另一端返回 DPI设备。
在实际应用中， DPI设备自身可以单独记录报文的整个转向操作过程，并 将报文按照内层 Vlan头转向标识字段中的转向标识从左到右或从右到左的顺 序依次转向给对应的从设备， 这样， 可以避免遗漏转向或重复转向操作。
DPI设备自身也可以不记录转向操作过程，而是将转向操作过程记录在内 层 Vlan头的转向标识字段中随报文一起转向。
在另一种实现方式中， 当报文通过上述步骤完成转向后， 如图 4所示， 所述方法还包括：
S50, 判断报文是否完成转向；
具体的， 当报文只需要转向给一台从设备时， 则报文完成转向是指报文 完成 DPI设备与该台从设备之间的转向； 当报文需要转向给多台从设备时， 则报文完成转向是指报文完成 DPI设备与所有从设备之间的转向。也就是说， 当报文只需要转向给一台从设备时， 则报文完成一次转向即为报文完成转向； 当报文需要转向给多台从设备时， 只有当报文完成多次转向时才称为报文完 成转向。
具体的， 判断报文是否完成转向时， 可以根据转向操作过程记录的方式 不同进行不同的处理。 若 DPI设备是釆用自身单独记录报文的整个转向操作 过程， 则当报文转向过程记录中显示报文完成转向时， 确认所述报文完成转 向； 若是釆用将转向操作过程记录在转向标识字段中随报文一起转向的方式， 则当转向回来的报文的转向标识字段中不含有转向标识时， 确认报文完成转 向， 否则认为报文没有完成转向。
具体的， 在判断报文是否完成转向的过程中， 对于 DPI设备不记录转向 操作过程的情况， 为了避免重复转向或遗漏转向操作， 在转向过程中， DPI 设备可以有两种操作模式， 第一种， 当带有内层 Vlan头的报文即将向从设备 转向前， 将转向标识字段中与所述从设备对应的比特位由转向标识置为转向 完成标识， 然后再将报文转向到所述从设备； 第二种， 当带有内层 Vlan头的 报文从某个从设备转向回来后， 将转向标识字段中与所述从设备对应的比特 位由转向标识置为转向完成标识。 其中， 转向标识可以为 1、 转向完成标识可 以为 0; 或转向标识可以为 0、 转向完成标识为 1 , 可以理解的是， 转向完成 标识可以与不转向标识用相同的标识表示， 但转向完成标识与转向标识要有 所区别， 转向标识与不转向标识也应有所区别。 转向标识、 不转向标识和转 向完成标识可以根据预定的策略进行设置， 转向标识表示需要将报文转向到 该比特位对应的从设备， 不转向标识表示不将该报文转向到该比特位对应的 从设备， 转向完成标识表示已经将该报文转向到该比特位对应的从设备。
以下以转向标识为 1、 不转向标识为 0、 转向完成标识为 0, 且 DPI设备 在报文转向时， 按照转向标识字段从左到右的顺序依次转向给对应的从设备 为例对上述两种操作模式进行详细描述：
第一种， 在将该报文转向某个从设备前， 将转向标识字段中与该转向从 设备对应的比特位由转向标识置为转向完成标识后， 将报文转向到所述从设 备： 具体的， 当 DPI设备为所述报文添加内层 Vlan头后， DPI设备先检查内 层 Vlan头的转向标识字段中从左到右的第一个值为 1的比特位， 确定该比特 位对应的从设备 A为报文转向的第一个从设备， 然后将转向标识字段中的该 比特位的值由转向标识 1置为转向完成标识 0, 并将带有内层 Vlan头的 ·艮文 转向给从设备 Α; 当报文从从设备 Α返回后， DPI设备再次检查转向标识字 段中从左到右的第一个值为 1的比特位， 确定该比特位对应的从设备 B为报 文转向的第二个从设备， 然后将转向标识字段中与从设备 B对应的该比特位 的值由转向标识 1置为转向完成标识 0, 将带有内层 Vlan头的报文转向给从 设备 B, 如此往复， 则 S50具体可以为： 判断从所述从设备转向回来的报文 中转向标识字段中各比特位是否为不转向标识或转向完成标识， 即判断从某 个从设备返回的报文的转向标识字段中的比特位的值是否全部为 0,若全部为 0则表示该报文已经依次完成所有转向操作。
第二种， 在该报文从某个从设备转向回来后， 将转向标识字段中与该从 设备对应的比特位由转向标识置为转向完成标识， 具体的， 当 DPI设备为所 述报文添加内层 Vlan头后， DPI设备先检查转向标识字段中从左到右的第一 个值为 1的比特位， 确定该比特位对应的从设备 A为报文转向的第一个从设 回后， DPI设备将转向标识字段中与从设备 A对应的比特位的值由转向标识 1 置为转向完成标识 0;接着检查转向标识字段中从左到右的第一个值为 1的比 特位， 确定该比特位对应的从设备 B为报文转向的第二个从设备， 将带有内 层 Vlan头后的报文转向给第二个从设备 B, 在报文从从设备 B返回后， DPI 设备将转向标识字段中与从设备 B对应的比特位的值由转向标识 1置为转向 完成标识 0, 如此往复， 则 S50具体可以为： 在将转向标识字段中与所述从设 备对应的比特位置为转向完成标识后， 判断报文的转向标识字段中各比特位 是否为不转向标识或转向完成标识， 即在 DPI设备将与某个从设备对应的转 向标识 1置为转向完成标识 0后， 判断转向标识字段中的比特位的值是否全 部为 0, 若全部为 0则表示该报文已经依次完成所有转向操作。
实际应用中， DPI设备可以对同一群组中的从设备釆用同一种操作模式。 需要说明的是， 在报文转向过程中， 从设备仅对报文进行处理， 对内层 Vlan头不进行操作。
由此， 报文能够在 DPI设备与其附属的从设备之间进行转向。
S60, 当报文完成转向后， 去除报文中的内层 Vlan头， 并通过接收报文 的通信链路继续传输报文。
具体的， 若 DPI设备单独记录报文的整个转向操作过程， 则当报文转向 过程记录中显示报文完成转向时， 确认所述报文完成转向； 若 DPI设备没有 单独记录转向操作过程， 而是将转向操作过程记录在内层 Vlan头的转向标识 字段中随报文一起转向， 则当转向回来的报文的转向标识字段中不含有转向 标识时， 确认 4艮文完成转向。
在该报文完成转向后， DPI设备去除报文中的内层 Vlan头， 并通过接收 报文的通信链路继续传输报文。 进一步的， DPI设备还可以在从通信链路接收到报文时记录所述链路的链 路号， 以在报文完成转向后， 通过与记录的该链路号相应的通信链路继续传 输报文。
进一步的， DPI设备也可以将所述链路的链路号添加在内层 Vlan头中， 即内层 Vlan头还包括与所述链路对应的链路号字段， 则 DPI设备通过与所述 内层 Vlan头中链路号字段中的链路标识对应的通信链路继续传输报文。
实际应用中， 由于 Vlan头中的保留字段为后 12bit, 且， 对于将来一段时 间内用户可能形成的服务需求， 8个从设备基本可以满足用户的个性化定制， 4bit的链路号字段可以区分 16条链路， 也基本可以满足将来一段时间的网络 发展规模。 因此， 优选的， 可以将所述内层 Vlan头的转向标识字段设置为 8 比特， 所述链路号字段设置为 4 比特。 此外， 需要说明的是， 本发明实施例 对转向标识字段和链路号字段的前后顺序不作限制。 通过内层 Vlan头中的链 路号字段携带传输报文的链路号的好处是可以减少 DPI设备的记录负担， 将 链路号携带在内层 Vlan头中跟随报文一起转向， 若在转向过程中该报文不符 合用户定制的规则而被过滤掉， DPI设备就没必要记录该报文的链路号， 而且 除了第一步的添加内层 Vlan头外， 后续过程都可以由分流模块完成， 使 DPI 设备处理报文的效率更高。
本实施例的报文转向的方法， 提供了报文转向的解决方案， 通过在报文 中添加带有转向标识字段的内层 Vlan头， 指示报文在同一集群中进行多次转 向， 从而降低了 DPI设备的处理负担。 本实施例的报文转向的方法， 支持用 户定制多个不同的个性化服务。
实施例二
本实施例为 4艮文转向方法的一个具体实施例。 设一个集群中包括一台 DPI设备和其管理的三台从设备（参见图 5 ): 从设备 a、 从设备 b、 从设备 c。 设其中从设备 a的功能是杀毒， 从设备 b的功能是 URL过滤 , 从设备 c的功 能是 WAN加速。每个从设备只能与 DPI设备进行通信，从设备之间无法通信。
如图 6所示， 该方法包括： 5101 , DPI设备接收报文， 所述报文中包含有用户标识。
5102, DPI设备根据 IP地址以及预先设置的 IP地址与服务类型的第一对 应关系， 查找与报文中 IP地址对应的服务类型。
所述 文如图 7所示， 若所述 ·艮文为下行 ·艮文， 且其目的 IP地址对应的 服务类型包括杀毒和 URL过滤，则所述报文需要转向给从设备 a和从设备 b。
5103 , DPI设备根据所述服务类型、 预先设置的服务类型和从设备标识 的第二对应关系、 以及从设备标识和转向标识字段中各比特位的第三对应关 系， 为才艮文添加内层 Vlan头。
本例中的内层 Vlan头包括 8比特的转向标识字段和 4bit的链路号字段， 如图 8所示。 第二对应关系中杀毒对应的从设备标识为 a, URL过滤对应的 从设备标识为 b, 第三对应关系中从设备 a对应转向标识字段中的第 lbit, 从 设备 b对应转向标识字段中的第 2bit。 所述链路的链路号为 3。 添加了内层 Vlan头的报文如图 9所示，其中" 0x8100"用于指示所增加的为 Vlan头， "Vlan ID" 即内层 Vlan头， "0x8100" 和 Vlan头共 4字节。
5104, DPI设备根据所述转向标识字段中的转向标识将带有内层 Vlan头 的报文转向给对应的从设备， 所述从设备包括至少一台。
以 DPI釆用第二种操作模式为例， DPI设备将带有内层 Vlan头的报文转 向给从设备 a (图 5中的虚线表示了报文走向， 其中的数字 1-6表示报文传递 的顺序）， 在接收到由从设备 a返回的报文后， 将转向标识字段中与从设备 a 对应的比特位的值置为 0; 之后， 将报文再转向给从设备 b, 当报文由从设备 b返回后， 将转向标识字段中与从设备 b对应的比特位的值置为 0。
5105, 当报文完成转向后， DPI设备去除报文中的内层 Vlan头， 并通过 接收报文的通信链路继续传输报文。
由于在将转向标识字段中与从设备 b对应的比特位的值置为 0后， 报文 的转向标识字段中的比特位的值均为 0, 则全部转向完成。 DPI设备去除报文 中的内层 Vlan头， 并通过链路号为 3的通信链路的上行口继续传输报文。
对于 DPI设备与各从设备之间还包括交换机的情况，可以构造两层 Vlan, 例如 802.1 Q in 802.1 Q。在 DPI设备上配置从设备标识和交换机端口号的第四 对应关系。 在为报文添加内层 Vlan头时， DPI设备根据预先设置的从设备标 识和交换机端口号的第四对应关系， 为报文添加外层 Vlan头； 所述外层 Vlan 头的值为报文即将转向的从设备对应的交换机端口号。
还是以上面的例子进行说明， 如图 10所示， DPI设备与从设备111、 从设 备 n、 从设备 p之间通过交换机连接， 图中虚线表示了报文走向， 其中的数字 1-10表示报文传递的顺序。 从设备 m对应的交换机端口为（ 100, 101 ), 其中 100为发送端口， 101为接收端口；从设备 n对应的交换机端口为（ 102, 103 ), 从设备 p对应的交换机端口为（ 104 , 105 ); DPI设备与交换机可以通过 trunk 连接， trunk使能后可以对所有的交换机端口放行。
在为报文添加内层 Vlan头和外层 Vlan头之后， DPI设备对报文进行转向。 DPI先将带有内层 Vlan头和外层 Vlan头的报文发送给交换机；交换机根据外 层 Vlan头的值， 确定报文即将转向的从设备 m所在的交换机端口号， 将报文 通过端口 100转向给从设备 m, 即将报文通过与所述外层 Vlan头的值对应的 交换机端口转向给相应的从设备； 从设备 m处理完报文后， 通过端口 101返 回给交换机； 交换机再将报文返回 DPI设备； DPI设备将内层 Vlan头的转向 标识字段中与从设备 m对应的比特置为 0, 然后查找报文需要转向的下一个 从设备。 由于内层 Vlan头的转向标识字段的第 2比特位的值为 1 , DPI设备 将外层 Vlan头中的交换机端口号改为 102, DPI设备将报文发送给交换机； 交换机根据外层 Vlan头中的交换机端口号， 将报文通过端口 102转向给从设 备 n; 从设备 n处理完报文后， 通过端口 103返回给交换机； 交换机再将当所 述才艮文返回 DPI设备； DPI设备将内层 Vlan头的转向标识字段中与从设备 n 对应的比特位的值置为 0。 这时， 由于转向标识字段中的比特位的值均为 0, 代表全部转向完成。 当报文完成转向后， DPI设备会去除报文中的内层 Vlan 头及外层 Vlan头。 之后， DPI设备通过接收报文的通信链路继续传输报文。
在报文转向过程中， 从设备仅对报文进行处理， 对内层 Vlan 头和外层 Vlan头不进行操作； 交换机仅按照外层 Vlan头中的交换机端口转发报文， 对 内层 Vlan头和外层 Vlan头也不进行操作； DPI设备通过外层 Vlan头控制交 换机将报文转向给对应的从设备， 通过内层 Vlan头记录报文转向操作的进展 状况。
本实施例的报文转向的方法， 提供了报文转向的解决方案， 通过在报文 中添加带有转向标识字段的内层 Vlan头和外层 Vlan头，指示报文在同一集群 中的多次转向， 降低 DPI设备的处理负担， 同时可以支持用户定制个性化服 务。 实施例三
本实施例提供了一种深度包检测设备， 所述深度包检测设备下可以附属 有至少一台从设备。 如图 11所示， 所述深度包检测设备包括： 接收单元 10、 查找单元 20, 处理单元 30, 转向单元 40。
接收单元 10, 用于接收报文， 所述报文中包含有用户标识。
查找单元 20, 用于根据所述用户标识以及预先设置的用户标识与服务类 型的第一对应关系， 查找与所述报文中的用户标识对应的服务类型。
具体的， 若所述报文为上行报文， 则所述用户标识为发送所述报文的用 户标识， 所述发送报文的用户标识可以为源 IP地址、 用户账号等； 若所述报 文为下行报文， 则所述用户标识为接收所述报文的用户标识， 所述接收报文 的用户标识可以为目的 IP地址、 用户账号等。
处理单元 30, 用于根据所述服务类型、 预先设置的服务类型和从设备标 识的第二对应关系以及从设备标识和转向标识字段中各比特位的第三对应关 系， 为报文添加内层 Vlan头， 所述内层 Vlan头可以包括转向标识字段， 转向 标识字段中包含有转向标识。
具体的， 转向标识字段中， 与报文需要转向的从设备对应的比特位为转 向标识， 与报文不需要转向的从设备对应的比特位为不转向标识， 其中转向 标识可以用 1或 0表示， 当然不限于上述两种， 且转向标识需要与不转向标 识相区别。 转向单元 40,用于根据所述转向标识字段中转向标识将带有内层 Vlan头 的报文转向给对应的从设备， 所述从设备包括至少一台。
本实施例提供的深度包检测设备， 通过在报文中添加带有转向标识字段 的内层 Vlan头， 指示报文在同一集群中转向， 降低 DPI设备的处理负担， 并 能够为用户提供用户定制的个性化服务。
参见图 12, 在又一个本发明实施例中， 在图 11所述的实施例基础上， 图 12所述的深度包检测设备还可以包括：
判断单元 50, 用于当报文完成转向后， 判断报文是否完成转向； 具体的， 当报文只需要转向给一台从设备时， 则报文完成转向是指报文 完成 DPI设备与该台从设备之间的转向； 当报文需要转向给多台从设备时， 则报文完成转向是指报文完成 DPI设备与所有从设备之间的转向。也就是说， 当报文只需要转向给一台从设备时， 则报文完成一次转向即为报文完成转向； 当报文需要转向给多台从设备时， 只有当报文完成多次转向时才称为报文完 成转向。
发送单元 60, 用于当所述判断单元 50判断出报文完成转向后， 去除报文 中的内层 Vlan头， 并通过接收报文的通信链路继续传输报文。
其中， 所述内层 Vlan头还可以包括与所述链路对应的链路号字段， 所述 链路号字段中包含有接收报文的通信链路的链路标识， 则所述发送单元 60具 体可以用于： 通过与所述内层 Vlan头中链路号字段中的链路标识对应的通信 链路继续传输报文。
优选的， 所述转向标识字段包括 8比特， 所述链路号字段包括 4比特。 例如在所述转向标识字段中， 可以将报文需要转向的从设备对应的比特位的 值置为 1 , 报文不需要转向的从设备对应的比特位的值置为 0。
所述带有内层 Vlan头的报文优选按照转向标识字段从左到右或从右到左 的顺序依次转向给报文需要转向的从设备。
具体的， 所述转向单元 40可以将转向操作过程记录在内层 Vlan头的转 向标识字段中随报文一起转向， 则， 在这种情况下， 判断报文是否完成转向 时具体可以釆用下述两种方式： 识字段中与所述从设备对应的比特位置为转向完成标识； 则所述判断单元 50 转向标识或转向完成标识来判断 4艮文是否完成转向。 向标识字段中与所述从设备对应的比特位置为转向完成标识； 则所述判断单 元可以在当带有内层 Vlan头的报文从某个从设备转向回来后， 将转向标识字 段中与所述从设备对应的比特位置为转向完成标识后， 判断报文的转向标识 字段中各比特位是否为不转向标识或转向完成标识来判断报文是否完成转 向。 换机时， 在为报文添加内层 Vlan头时， 所述处理单元 30还可以用于： 根据 预先设置的从设备标识和交换机端口号的第四对应关系， 为报文添加外层 Vlan头，所述外层 Vlan头的值为报文即将转向的从设备对应的交换机端口号； 则所述转向单元 40可以用于： 将带有内层 Vlan头和外层 Vlan头的 ·艮文 通过与所述外层 Vlan头的值对应的交换机端口转向给相应的从设备。
则所述发送单元 60 可以用于： 当才艮文完成转向后， 去除才艮文中的内层 Vlan头及外层 Vlan头， 并通过接收报文的通信链路继续传输报文。
本实施例的深度包检测设备， 提供了报文转向的功能， 通过在报文中添 加带有转向标识字段的内层 Vlan头， 指示报文在同一集群中进行多次转向， 从而降低 DPI设备的处理负担。 本实施例的深度包检测设备， 能够为用户提 供用户定制的个性化服务。 的比较简略， 相关之处请参见方法实施例部分， 此处不再赘述。 且在上述实 施例中， 对各个实施例的描述都各有侧重， 某个实施例中没有详述的部分， 需要说明的是， 在本文中， 诸如第一和第二等之类的关系术语仅仅用来 将一个实体或者操作与另一个实体或操作区分开来， 而不一定要求或者暗示 这些实体或操作之间存在任何这种实际的关系或者顺序。 而且， 术语 "包括"、 "包含" 或者其任何其他变体意在涵盖非排他性的包含， 从而使得包括一系 列要素的过程、 方法、 物品或者设备不仅包括那些要素， 而且还包括没有明 确列出的其他要素， 或者是还包括为这种过程、 方法、 物品或者设备所固有 的要素。 在没有更多限制的情况下， 由语句 "包括一个 ... ... " 限定的要素， 并不排除在包括所述要素的过程、 方法、 物品或者设备中还存在另外的相同 要素。
以上所述仅为本发明的较佳实施例而已， 并非用于限定本发明的保护范 围。 凡在本发明的精神和原则之内所作的任何修改、 等同替换、 改进等， 均 包含在本发明的保护范围内。

Claims

权 利 要 求
1、 一种报文转向的方法， 其特征在于， 包括：
接收报文， 所述报文中包含有用户标识；
根据所述用户标识以及预先设置的用户标识与服务类型的第一对应关 系， 查找与所述报文中的用户标识对应的服务类型；
根据所述服务类型、 预先设置的服务类型和从设备标识的第二对应关系 以及从设备标识和转向标识字段中各比特位的第三对应关系， 为报文添加内 层虚拟局域网 Vlan头，所述内层 Vlan头包括转向标识字段，所述转向标识字 段中包含有转向标识；
根据所述转向标识字段中的转向标识将带有内层 Vlan头的报文转向给对 应的从设备， 所述从设备包括至少一台。
2、 如权利要求 1所述的方法， 其特征在于， 还包括：
判断报文是否完成转向；
当报文完成转向后， 去除报文中的内层 Vlan头， 并通过接收报文的通信 链路继续传输报文。
3、 如权利要求 2所述的方法， 其特征在于， 所述内层 Vlan头还包括链 路号字段， 所述链路号字段中包含有接收报文的通信链路的链路标识；
所述通过接收报文的通信链路继续传输报文包括：
通过与所述内层 Vlan头中链路号字段中的链路标识对应的通信链路继续 传输报文。
4、 如权利要求 2所述的方法， 其特征在于， 所述判断报文是否完成转向 包括：
若单独记录报文的转向操作过程， 则当报文转向过程记录中显示报文完 成转向时， 确认所述报文完成转向； 或
若将转向操作过程记录在转向标识字段中随报文一起转向， 则当转向回 来的报文的转向标识字段中不含有转向标识时， 确认所述报文完成转向。
5、 如权利要求 4所述的方法， 其特征在于， 当单独记录报文的转向操作 将报文按照内层 Vlan头转向标识字段中的转向标识从左到右或从右到左 的顺序依次转向给对应的从设备。
6、 如权利要求 4所述的方法， 其特征在于， 当不记录报文的转向操作过 当带有内层 Vlan头的报文即将向从设备转向前， 将转向标识字段中与所 述从设备对应的比特位由转向标识置为转向完成标识， 然后再将报文转向到 所述从设备； 或者，
当带有内层 Vlan头的报文从从设备转向回来后， 将转向标识字段中与该 从设备对应的比特位由转向标识置为转向完成标识。
7、 如权利要求 2或 3所述的方法， 其特征在于， 还包括：
根据预先设置的从设备标识和交换机端口号的第四对应关系， 为报文添 端口号；
则所述根据转向标识字段中的转向标识将带有内层 Vlan头的报文转向给 对应的从设备包括： 应的交换机端口转向给相应的从设备；
所述当才艮文完成转向后， 去除 ·艮文中的内层 Vlan头， 并通过接收 ·艮文的 通信链路继续传输报文包括：
当报文完成转向后，去除报文中的内层 Vlan头及外层 Vlan头，并通过接 收报文的通信链路继续传输报文。
8、 一种深度包检测设备， 其特征在于， 包括：
接收单元， 用于接收报文， 所述报文中包含有用户标识；
查找单元， 用于根据所述用户标识以及预先设置的用户标识与服务类型 的第一对应关系， 查找与所述报文中的用户标识对应的服务类型； 处理单元， 用于根据所述服务类型、 预先设置的服务类型和从设备标识 的第二对应关系以及从设备标识和转向标识字段中各比特位的第三对应关 系 ,为报文添加内层虚拟局域网 Vlan头，所述内层 Vlan头包括转向标识字段， 所述转向标识字段中包含有转向标识；
转向单元， 用于根据所述转向标识字段中转向标识将带有内层 Vlan头的 报文转向给对应的从设备， 所述从设备包括至少一台。
9、 如权利要求 8所述的深度包检测设备， 其特征在于， 还包括： 判断单元， 用于判断报文是否完成转向；
发送单元， 用于当所述判断单元判断报文完成转向后， 去除报文中的内 层 Vlan头， 并通过接收报文的通信链路继续传输报文。
10、 如权利要求 9所述的深度包检测设备， 其特征在于：
所述内层 Vlan头还包括链路号字段， 所述链路号字段中包含有接收报文 号字段中的链路标识对应的通信链路继续传输报文。
11、 如权利要求 8或 9所述的深度包检测设备， 其特征在于：
所述处理单元， 还用于根据预先设置的从设备标识和交换机端口号的第 四对应关系，为报文添加外层 Vlan头； 所述外层 Vlan头的值为报文即将转向 的从设备对应的交换机端口号； 贝' J ,
所述转向单元，用于将带有内层 Vlan头和外层 Vlan头的报文通过与所述 外层 Vlan头的值对应的交换机端口转向给相应的从设备；
所述发送单元， 用于当报文完成转向后， 去除报文中的内层 Vlan头及外 层 Vlan头， 并通过接收报文的通信链路继续传输报文。
+
PCT/CN2011/079915 2010-11-04 2011-09-21 一种报文转向的方法和深度包检测设备 WO2012058988A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP11837514.6A EP2568670B1 (en) 2010-11-04 2011-09-21 Method for message forwarding and device for deep packet inspection
US13/706,063 US8594086B2 (en) 2010-11-04 2012-12-05 Packet diversion method and deep packet inspection device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010532260.5A CN101984598B (zh) 2010-11-04 2010-11-04 一种报文转向的方法和深度包检测设备
CN201010532260.5 2010-11-04

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/706,063 Continuation US8594086B2 (en) 2010-11-04 2012-12-05 Packet diversion method and deep packet inspection device

Publications (1)

Publication Number Publication Date
WO2012058988A1 true WO2012058988A1 (zh) 2012-05-10

Family

ID=43641769

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/079915 WO2012058988A1 (zh) 2010-11-04 2011-09-21 一种报文转向的方法和深度包检测设备

Country Status (4)

Country Link
US (1) US8594086B2 (zh)
EP (1) EP2568670B1 (zh)
CN (1) CN101984598B (zh)
WO (1) WO2012058988A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014042914A1 (en) 2012-09-13 2014-03-20 Symantec Corporation Systems and methods for performing selective deep packet inspection

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101984598B (zh) 2010-11-04 2012-11-07 成都市华为赛门铁克科技有限公司 一种报文转向的方法和深度包检测设备
CN102143081B (zh) 2011-03-31 2014-02-19 华为技术有限公司 一种报文多次转向方法、装置和系统
CN102137022B (zh) * 2011-04-01 2013-11-06 华为技术有限公司 提供用于识别数据包的信息的方法、爬虫引擎及网络系统
EP2587751A1 (en) * 2011-10-24 2013-05-01 TELEFONAKTIEBOLAGET LM ERICSSON (publ) Method and arrangement for data clustering
CN102546441B (zh) * 2012-02-29 2014-09-17 杭州华三通信技术有限公司 一种报文分流方法和网络设备
CN102938739B (zh) * 2012-11-26 2016-08-24 华为技术有限公司 深度报文检查方法与装置
CN104753704B (zh) * 2013-12-27 2019-03-12 中兴通讯股份有限公司 一种软件定义网络中的状态迁移方法及交换机
WO2015100751A1 (zh) * 2014-01-06 2015-07-09 华为技术有限公司 一种转发报文的方法和装置
CN106105098B (zh) * 2014-09-25 2019-05-31 华为技术有限公司 交换机及业务请求报文的处理方法
CN109388499A (zh) * 2017-08-04 2019-02-26 东软集团股份有限公司 报文转发方法及装置、计算机可读存储介质、电子设备
CN110601881B (zh) * 2019-09-04 2021-10-22 厦门网宿有限公司 一种二层专线网络系统、配置方法及设备
CN110661684B (zh) * 2019-09-29 2021-06-29 北京浪潮数据技术有限公司 流量统计方法及装置
CN111371655B (zh) * 2020-04-07 2022-02-25 中移雄安信息通信科技有限公司 深度报文检测方法、dpi设备、中转设备、系统及存储介质
EP4020942A4 (en) * 2020-08-31 2022-11-02 Huawei Technologies Co., Ltd. SECURITY PROTECTION METHOD AND DEVICE AND STORAGE MEDIA
CN112994953B (zh) * 2021-04-20 2021-08-17 广东睿江云计算股份有限公司 一种基于报文追踪的网络调试方法
CN115473835B (zh) * 2022-08-05 2023-09-26 北京罗克维尔斯科技有限公司 流量统计方法及相关设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101102184A (zh) * 2007-08-02 2008-01-09 中兴通讯股份有限公司 宽带接入服务器及用于宽带接入服务器的高速dpi单板装置
CN101102273A (zh) * 2007-07-20 2008-01-09 中兴通讯股份有限公司 宽带接入设备及宽带接入方法
CN101237404A (zh) * 2008-03-11 2008-08-06 华为技术有限公司 报文转发方法和装置
US20100189004A1 (en) * 2009-01-23 2010-07-29 Neuralitic Systems Method and system for context aware deep packet inspection in ip based mobile data networks
CN101984598A (zh) * 2010-11-04 2011-03-09 成都市华为赛门铁克科技有限公司 一种报文转向的方法和深度包检测设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9444785B2 (en) * 2000-06-23 2016-09-13 Cloudshield Technologies, Inc. Transparent provisioning of network access to an application
US7536693B1 (en) * 2004-06-30 2009-05-19 Sun Microsystems, Inc. Method for load spreading of requests in a distributed data storage system
IL189530A0 (en) * 2007-02-15 2009-02-11 Marvell Software Solutions Isr Method and apparatus for deep packet inspection for network intrusion detection
CN101267399B (zh) * 2008-04-24 2010-10-27 杭州华三通信技术有限公司 报文转发方法、报文转发设备及其上行接口板

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101102273A (zh) * 2007-07-20 2008-01-09 中兴通讯股份有限公司 宽带接入设备及宽带接入方法
CN101102184A (zh) * 2007-08-02 2008-01-09 中兴通讯股份有限公司 宽带接入服务器及用于宽带接入服务器的高速dpi单板装置
CN101237404A (zh) * 2008-03-11 2008-08-06 华为技术有限公司 报文转发方法和装置
US20100189004A1 (en) * 2009-01-23 2010-07-29 Neuralitic Systems Method and system for context aware deep packet inspection in ip based mobile data networks
CN101984598A (zh) * 2010-11-04 2011-03-09 成都市华为赛门铁克科技有限公司 一种报文转向的方法和深度包检测设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2568670A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014042914A1 (en) 2012-09-13 2014-03-20 Symantec Corporation Systems and methods for performing selective deep packet inspection
EP2896169A4 (en) * 2012-09-13 2016-05-11 Symantec Corp SYSTEMS AND METHODS FOR PERFORMING DEEP SELECTIVE PACKET INSPECTION

Also Published As

Publication number Publication date
CN101984598A (zh) 2011-03-09
US20130094511A1 (en) 2013-04-18
EP2568670A4 (en) 2013-05-29
EP2568670A1 (en) 2013-03-13
CN101984598B (zh) 2012-11-07
US8594086B2 (en) 2013-11-26
EP2568670B1 (en) 2014-07-16

Similar Documents

Publication Publication Date Title
WO2012058988A1 (zh) 一种报文转向的方法和深度包检测设备
US11374848B2 (en) Explicit routing with network function encoding
US11979322B2 (en) Method and apparatus for providing service for traffic flow
EP2712128B1 (en) Message processing method and related device thereof
EP2708001B1 (en) Label switched routing to connect low power network domains
CN110022264B (zh) 控制网络拥塞的方法、接入设备和计算机可读存储介质
US20130259060A1 (en) Method and apparatus for sending packet
US10812292B2 (en) Packet processing method and device
WO2014198060A1 (zh) 一种数据报文的路由方法和设备
WO2007009349A1 (fr) Méthode et appareil de transmission de message
US10341140B2 (en) Dynamic network service overlay establishment in hub-and-spoke packet switching networks
CN109936492A (zh) 一种通过隧道传输报文的方法、装置和系统
WO2009021424A1 (en) A device and method for handling messages
US6721274B2 (en) Controlling packet flow through a stack using service records
WO2015018263A1 (zh) 生成转发信息的方法及设备
EP1830522A1 (en) Bridging end point device supporting inter access point communication
WO2012130084A1 (zh) 一种报文多次转向方法、装置和系统
CN116095197B (zh) 数据传输方法及相关装置
WO2014040422A1 (zh) 介质访问控制地址学习控制方法、装置和路由桥
CN100496024C (zh) 一种转发隧道报文的方法和一种网络设备
WO2012062106A1 (zh) 线性保护组隧道复用方法和隧道尾节点
JP5458340B2 (ja) ネットワーク中継装置
CN112788116A (zh) 一种报文转发的方法及装置
CN106059846B (zh) 应用于vxlan中的故障分析方法和装置
JP7293728B2 (ja) パケットカプセル化方法およびパケットカプセル化装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11837514

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2011837514

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE