WO2016161713A1 - 路由设备中数据流分析的方法、装置及路由设备 - Google Patents

路由设备中数据流分析的方法、装置及路由设备 Download PDF

Info

Publication number
WO2016161713A1
WO2016161713A1 PCT/CN2015/084127 CN2015084127W WO2016161713A1 WO 2016161713 A1 WO2016161713 A1 WO 2016161713A1 CN 2015084127 W CN2015084127 W CN 2015084127W WO 2016161713 A1 WO2016161713 A1 WO 2016161713A1
Authority
WO
WIPO (PCT)
Prior art keywords
random value
routing device
sampling ratio
random
allocated
Prior art date
Application number
PCT/CN2015/084127
Other languages
English (en)
French (fr)
Inventor
刘莉
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016161713A1 publication Critical patent/WO2016161713A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters

Definitions

  • This document relates to the field of data flow analysis in routing devices, and in particular, to a method, device and routing device for analyzing data streams in a routing device.
  • NetFlow is a data exchange method. It is a method for statistical analysis of various flows in the network. In recent years, it has been widely used by major operators for network planning and network monitoring, and is gradually being applied to large traffic.
  • the left side is a router device that contains three systems for sampling: multiple detectors, collectors, and reporting systems.
  • the right is an independent centralized traffic analysis system. The detector is used to monitor the network data stream, the collector is used to collect the data stream sent by the detector, and the reporting system is used to generate an easy-to-read report according to the data collected by the collector.
  • FIG. 2 is a schematic diagram of sampling under two mechanisms. Since the accuracy of the non-random mechanism is high, the related art generally uses a non-random mechanism to analyze the network data stream. For the non-random mechanism, because it is strictly sampling, the detector needs to be implemented based on statistics. The detector first adds one statistic for each message received, reads the statistical result, compares the statistical result with the sampling ratio, and equalizes the sampling. After sampling, the statistical results need to be cleared to facilitate the next round of statistics. General detector access to statistical peripherals is time consuming. This method accesses at least 2 statistical peripherals per packet, so the processing performance of the detector is greatly reduced.
  • non-random sampling can obtain a uniform sample stream for a single interface, but when multiple interfaces are simultaneously sampled and the traffic rate is the same, the sample stream arriving at the collector may become an interface-level burst stream, as shown in Figure 3. As shown, the collector is overloaded, so that the collector does not reach the required sampling processing rate, which affects the processing performance of the collector.
  • the main purpose of the present invention is to provide a method, a device, and a routing device for analyzing data streams in a routing device, which are to solve the technical problem that the NetFlow non-random mechanism analyzes the traffic and the flow direction slowly and causes the processing performance of the detector to be degraded.
  • a method for analyzing data streams in a routing device includes the following steps:
  • Determining a sampling ratio and respectively assigning a first random value to each of the detecting interfaces, wherein the first random value is zero to an arbitrary integer between the sampling ratio minus one;
  • the first random value is a prime number.
  • the step of acquiring a sampling ratio and separately assigning a first random value to each detecting interface includes:
  • the first random value is assigned to the probe interface.
  • the step of determining, according to the operation result and the first random value, whether to sample the received message includes:
  • the received message is forwarded.
  • An apparatus for analyzing data streams in a routing device includes an allocation module, an obtaining module, an arithmetic module, and an analyzing module, wherein:
  • the allocating module is configured to: determine a sampling ratio, and respectively assign a first random value to each detecting interface, wherein the first random value bit is zero to an arbitrary integer between the sampling ratio minus one;
  • the acquiring module is configured to: when the detecting interface receives the packet, acquire a second random value generated by the random generator;
  • the operation module is configured to: perform a remainder operation on the second random value and the sampling ratio, and obtain an operation result;
  • the analyzing module is configured to: determine, according to the operation result and the first random value, whether to sample the received message.
  • the first random value is a prime number.
  • the allocation module includes a determining unit and an allocating unit, wherein:
  • the determining unit is configured to: determine whether the allocated first random value has been allocated and used by other detecting interfaces;
  • the allocating unit is configured to: if the first random value has been allocated for use, redistribute, and if the first random value is not allocated for use, assign the first random value to the probe interface.
  • the analysis module comprises a first analysis unit and a second analysis unit, wherein:
  • the first analyzing unit is configured to: if the operation result is equal to the first random value, forward the received message and sample the message;
  • the second analyzing unit is configured to: if the operation result is not equal to the first random value, forward the received message.
  • a router device comprising any of the above described means for analyzing data streams.
  • a computer program comprising program instructions that, when executed by a computer, cause the computer to perform a method of data stream analysis in any of the above-described routing devices.
  • a method, a device, and a routing device for analyzing data streams in a routing device are actually a random mechanism, and the technical solution of the present invention adds a temporary attribute value to the network data stream. And random values, and then according to the probability of a certain value to achieve random sampling, because the detector is not required to be based on access peripherals and statistics, can quickly analyze the flow and flow direction, improve the processing performance of the detector; When multiple interfaces are configured with sampling at the same time and the traffic rate is the same, the data flow is prevented from reaching the collector and becomes an interface-level burst.
  • FIG. 1 is a schematic structural diagram of a router device and a traffic analysis system in related art
  • Figure 2 is an effect diagram of two sampling methods of random mechanism and non-random mechanism in NetFlow
  • 3 is a schematic diagram of sampling flow of simultaneous sampling of multiple interfaces under a non-random mechanism
  • FIG. 4 is a schematic flowchart of an embodiment of a method for analyzing data streams in a routing device according to the present invention
  • FIG. 5 is a schematic diagram of sampling flow of simultaneous sampling of multiple interfaces in FIG. 4;
  • step S101 in FIG. 4 is a schematic flowchart of the refinement of step S101 in FIG. 4;
  • FIG. 7 is a schematic diagram showing the refinement process of step S104 in FIG. 4;
  • FIG. 8 is a schematic diagram of functional modules of an apparatus for analyzing data streams in a routing device according to the present invention.
  • FIG. 9 is a schematic diagram of a refinement function module of the distribution module of FIG. 8;
  • FIG. 10 is a schematic diagram of a refinement function module of the analysis module of FIG. 8.
  • An embodiment of the present invention provides a method for analyzing data streams in a routing device.
  • a method for analyzing data streams in the routing device includes:
  • Step S101 Obtain a sampling ratio, and respectively assign a first random value to each detecting interface, where the first random value is within a range from zero to a value of the sampling ratio minus one;
  • This embodiment relates to a related implementation algorithm for performing traffic and flow direction analysis technologies on various types of services in a routing device.
  • the sampling ratio is obtained, and the maximum sampling ratio is 1000:1 and the minimum value is 1:1.
  • the sampling ratio of this embodiment is configured according to network traffic conditions.
  • the routing device has multiple detectors, and each detector has a detection interface.
  • each of the detection interfaces is randomly assigned a first random value A, and the first random value A is at [0, (sampling ratio -1). In the range of ]], both the sampling ratio and the first random value A are stored in the memory of the corresponding detector. For example, when the sampling ratio obtained is 10, each detection interface is randomly in the range of [0, 9].
  • the first random value A is respectively allocated, for example, the first random value A that can be assigned to the first probe interface is 2, and the first random value A of the second probe interface is 7 or the like. After the first random value A is allocated, the first random value A serves as a temporary attribute value of the probe interface.
  • the first random value A is optionally a prime number.
  • Step S102 when the detecting interface receives the message, acquiring a second random value generated by the random generator;
  • the random generator can be built in the routing device.
  • a random generator B when the probe interface receives the message, a random generator B generates a second random value B every time a message is received. For example, when a certain probe interface receives a message, the random generator generates a random value of 0x12336784, and the second random value B is used to perform a certain mathematical operation with the sampling ratio and the first random value A.
  • the range of the second random value B is large, and can be set according to the maximum sampling ratio.
  • Step S103 performing a remainder operation on the second random value and the sampling ratio to obtain an operation result
  • Step S104 Determine, according to the operation result and the first random value, whether to sample the received message.
  • the detector receives messages from interface 1 and interface 2 at the same time.
  • the random generator After receiving the message, the random generator generates two second random values 0x12336784 and 0x12336787, respectively, and then performs a certain operation on the second random value and the sampling ratio.
  • the second random value and the sampling ratio are subjected to a remainder operation, that is, 0x12336784 is divided by the sampling ratio 10, and the remaining number is 4, 0x12336787 is divided by the sampling ratio 10, and the remaining number is 7.
  • the remainder 4 is not equal to the first random value A1 of interface 1, which means that no sampling is required; the remainder 7 is equal to the first random value A2 of interface 2, which means that sampling is required, and so on.
  • This embodiment is actually a random mechanism, and the effect diagram of random sampling is shown in FIG. 5.
  • a temporary attribute value and a random value are added to the network data stream, and then random sampling is implemented according to the probability of occurrence of a certain value. Since the probe is not required to be implemented based on the access peripheral and statistics, the traffic can be quickly performed.
  • the analysis of the flow direction improves the processing performance of the detector; when the sampling is configured simultaneously on multiple interfaces and the flow rate is the same, the data flow is prevented from reaching the collector and becomes an interface-level burst.
  • the foregoing step S101 includes:
  • Step S1011 determining whether the allocated first random value has been allocated and used by other detecting interfaces
  • Step S1012 if it has been allocated for use, reassign, otherwise the first random value is assigned to the probe interface.
  • each of the detecting interfaces is respectively assigned a first random value ranging from zero to a sampling ratio.
  • the foregoing step S104 includes:
  • Step S1041 If the operation result is equal to the first random value, forward the received message and perform message sampling;
  • Step S1042 If the operation result is not equal to the first random value, forward the received message.
  • the second random value and the sampling ratio are subjected to a remainder operation, and the operation result is a remainder. If the remainder is equal to the first random value, the received message is normally forwarded, and a copy of the message is simultaneously copied.
  • the collector is configured to collect the packet; if the remainder is not equal to the first random value, the received packet is normally forwarded, but the packet does not need to be sampled.
  • the embodiment of the present invention further provides an apparatus for analyzing data streams in a routing device.
  • the apparatus for analyzing data streams in the routing device includes:
  • the allocating module 101 is configured to: acquire a sampling ratio, and respectively assign a first random value to each detecting interface, wherein the first random value is in a range from zero to a value of the sampling ratio minus one;
  • This embodiment relates to a related implementation algorithm for performing traffic and flow direction analysis technologies on various types of services in a routing device.
  • the sampling ratio is obtained, and the maximum sampling ratio is 1000:1 and the minimum value is 1:1.
  • the sampling ratio of this embodiment is configured according to network traffic conditions.
  • the routing device has multiple detectors, and each detector has a detection interface.
  • each of the detection interfaces is randomly assigned a first random value A, and the first random value A is at [0, (sampling ratio -1). In the range of ]], both the sampling ratio and the first random value A are stored in the memory of the corresponding detector. For example, when the sampling ratio obtained is 10, each detection interface is randomly in the range of [0, 9].
  • a first random value A that can be assigned to the first probe interface is 2, and a first random value A of the second probe interface is 7 Wait. After the first random value A is allocated, the first random value A serves as a temporary attribute value of the probe interface.
  • the first random value A is optionally a prime number.
  • the obtaining module 102 is configured to: when the detecting interface receives the packet, acquire a second random value generated by the random generator;
  • the random generator can be built in the routing device.
  • a random generator B when the probe interface receives the message, a random generator B generates a second random value B every time a message is received. For example, when a certain probe interface receives a message, the random generator generates a random value of 0x12336784, and the second random value B is used to perform a certain mathematical operation with the sampling ratio and the first random value A.
  • the range of the second random value B is large, and can be set according to the maximum sampling ratio.
  • the operation module 103 is configured to: perform a remainder operation on the second random value and the sampling ratio, and obtain an operation result;
  • the analyzing module 104 is configured to: determine whether to sample the received message according to the operation result and the first random value.
  • the detector receives messages from interface 1 and interface 2 at the same time.
  • the random generator After receiving the message, the random generator generates two second random values 0x12336784 and 0x12336787, respectively, and then performs a certain operation on the sampling ratio.
  • the second random value and the sampling ratio are subjected to a remainder operation, that is, 0x12336784 is divided by the sampling ratio 10, and the remaining number is 4, 0x12336787 is divided by the sampling ratio 10, and the remaining number is 7.
  • the remainder 4 is not equal to the first random value A1 of interface 1, which means that no sampling is required; the remainder 7 is equal to the first random value A2 of interface 2, which means that sampling is required, and so on.
  • This embodiment is actually a random mechanism, and the effect diagram of random sampling is shown in FIG. 5.
  • a temporary attribute value and a random value are added to the network data stream, and then random sampling is implemented according to the probability of occurrence of a certain value. Since the probe is not required to be implemented based on the access peripheral and statistics, the traffic can be quickly performed.
  • the analysis of the flow direction improves the processing performance of the detector; when the sampling is configured simultaneously on multiple interfaces and the flow rate is the same, the data flow is prevented from reaching the collector and becomes an interface-level burst.
  • the distribution module 101 includes:
  • the determining unit 1011 is configured to: determine whether the allocated first random value has been allocated and used by other detecting interfaces;
  • the allocating unit 1012 is configured to: if it has been allocated for use, reassign, otherwise assign the first random value to the probe interface.
  • each of the detecting interfaces is respectively assigned a first random value ranging from zero to a sampling ratio, and in the process of allocating, determining whether the allocated first random value has been used by another The probe interface is allocated for use. If the first random value has been allocated to another probe interface, re-apply another first random value for the probe interface, if the first random value is not allocated to other probe interfaces. And determining that the first random value is allocated for use by the probe interface.
  • the analysis module 104 includes:
  • the first analyzing unit 1041 is configured to: if the operation result is equal to the first random value, forward the received message and perform message sampling;
  • the second analyzing unit 1042 is configured to: if the operation result is not equal to the first random value, Then the received message is forwarded.
  • the second random value and the sampling ratio are subjected to a remainder operation, and the operation result is a remainder. If the remainder is equal to the first random value, the received message is normally forwarded, and a copy of the message is simultaneously copied.
  • the collector is configured to collect the packet; if the remainder is not equal to the first random value, the received packet is normally forwarded, but the packet does not need to be sampled.
  • the embodiment of the present invention further provides a router device, where the router device includes the device for analyzing data stream in the routing device.
  • the embodiment of the invention also discloses a computer program, comprising program instructions, which, when executed by a computer, enable the computer to perform the method of data stream analysis in any of the above routing devices.
  • the embodiment of the invention also discloses a carrier carrying the computer program.
  • the technical solution of the invention can quickly analyze the flow and the flow direction, improve the processing performance of the detector, and prevent the data flow from reaching the collector to become an interface-level burst stream when the sampling is configured simultaneously on multiple interfaces and the flow rate is the same. Therefore, the present invention has strong industrial applicability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种路由设备中数据流分析的方法、装置及路由设备，所述路由设备中数据流分析的方法包括以下步骤：获取采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值在零至所述采样比减1的值所在的范围内；当探测接口接收到报文时，获取随机产生器产生的第二随机值；对所述第二随机值及所述采样比进行取余运算，获取运算结果；根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。本发明技术方案能够快速进行流量及流向的分析，提高探测器的处理性能，并在多个接口同时配置采样且流量速率一样时，避免数据流到达采集器变成一个接口数量级突发流。

Description

路由设备中数据流分析的方法、装置及路由设备 技术领域
本文涉及路由设备中数据流分析技术领域，尤其涉及一种路由设备中数据流分析的方法、装置及路由设备。
背景技术
NetFlow是一种数据交换方式，是对网络中的各种流进行统计分析的一种方法，近年来被各大运营商广泛地用来进行网络规划和网络监测，且逐渐被应用在具有大流量的核心路由器上。如图1所示，左边是一个路由器设备，内部包含了采样的3个系统：多个探测器、采集器、报告系统，右边是个独立的集中流量分析系统。其中，探测器用来监听网络数据流，采集器用来收集探测器传来的数据流，报告系统用来根据采集器采集的数据产生易读的报告。
NetFlow支持随机和非随机2种机制，如图2所示，图2为两种机制下进行采样的示意图。由于非随机机制的精确性较高，因此相关技术一般使用非随机机制进行网络数据流的分析。对于非随机机制，由于是严格的采样，需要探测器基于统计来实现，探测器每接收一个报文首先做加一统计，读取统计结果，将统计结果与采样比进行比较，相等则需要采样，采样后还需要将统计结果清零，便于下一轮的统计。一般探测器访问统计外设比较耗时，这种方法每个包至少访问2次统计外设，因此探测器的处理性能大大降低。另外非随机采样就单个接口来说可以获得均匀的采样流，但是当多个接口同时配置采样且流量速率一样时，到达采集器的采样流就可能变成一个接口数量级突发流，如图3所示，采集器负荷过重，使得采集器达不到需要的采样处理速率，影响采集器的处理性能。
上述内容仅用于辅助理解本发明的技术方案，并不代表承认上述内容是相关技术。
发明内容
本发明的主要目的在于提供一种路由设备中数据流分析的方法、装置及路由设备，旨在解决NetFlow非随机机制对流量及流向的分析速度慢并导致探测器处理性能降低的技术问题。
为实现上述目的，采用如下技术方案：
一种路由设备中数据流分析的方法，包括以下步骤：
确定采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值为零至所述采样比减1之间任意的整数；
当探测接口接收到报文时，获取随机产生器产生的第二随机值；
对所述第二随机值及所述采样比进行取余运算，获取运算结果；
根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。
可选地，所述第一随机值为质数。
可选地，所述获取采样比，并为每个探测接口分别分配第一随机值的步骤包括：
判断所分配的第一随机值是否已经被其他探测接口分配使用；
若已经被分配使用，则重新分配；
若该第一随机值没有被分配使用，则将所述第一随机值分配给所述探测接口。
可选地，所述根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样的步骤包括：
若所述运算结果与所述第一随机值相等，则转发所接收到的报文并对该报文进行采样；
若所述运算结果与所述第一随机值不相等，则转发所接收到的报文。
一种路由设备中数据流分析的装置，包括分配模块、获取模块、运算模块和分析模块，其中：
所述分配模块设置成：确定采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值位零至所述采样比减1之间任意的整数；
所述获取模块设置成：当探测接口接收到报文时，获取随机产生器产生的第二随机值；
所述运算模块设置成：对所述第二随机值及所述采样比进行取余运算，获取运算结果；
所述分析模块设置成：根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。
可选地，所述第一随机值为质数。
可选地，所述分配模块包括判断单元和分配单元，其中：
所述判断单元设置成：判断所分配的第一随机值是否已经被其他探测接口分配使用；
所述分配单元设置成：若该第一随机值已经被分配使用，则重新分配，若该第一随机值没有被分配使用，则将所述第一随机值分配给所述探测接口。
可选地，所述分析模块包括第一分析单元和第二分析单元，其中：
所述第一分析单元设置成：若所述运算结果与所述第一随机值相等，则转发所接收到的报文并对该报文进行采样；
所述第二分析单元设置成：若所述运算结果与所述第一随机值不相等，则转发所接收到的报文。
一种路由器设备，包括上述任意的数据流分析的装置。
一种计算机程序，包括程序指令，当该程序指令被计算机执行时，使得该计算机可执行上述任意的路由设备中数据流分析的方法。
一种载有所述的计算机程序的载体。
本发明技术方案的一种路由设备中数据流分析的方法、装置及路由设备，实际上是一种随机机制，本发明技术方案为网络数据流添加一个临时属性值 及随机值，然后根据某个特定值所出现的概率来实现随机采样，由于不需要探测器基于访问外设及统计来实现，能够快速进行流量及流向的分析，提高探测器的处理性能；在多个接口同时配置采样且流量速率一样时，避免数据流到达采集器变成一个接口数量级突发流。
附图概述
图1为相关技术中路由器设备及流量分析系统的结构示意图；
图2为NetFlow中随机机制及非随机机制两种采样方式的效果图；
图3为非随机机制下多接口同时采样的采样流量示意图；
图4为本发明路由设备中数据流分析的方法一实施例的流程示意图；
图5为图4中多接口同时采样的采样流量示意图；
图6为图4中步骤S101的细化流程示意图；
图7为图4中步骤S104的细化流程示意图；
图8为本发明路由设备中数据流分析的装置一实施例的功能模块示意图；
图9为图8中分配模块的细化功能模块示意图；
图10为图8中分析模块的细化功能模块示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
本发明的较佳实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
本发明实施例提供一种路由设备中数据流分析的方法，参照图4，在一实施例中，该路由设备中数据流分析的方法包括：
步骤S101，获取采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值在零至所述采样比减1的值所在的范围内；
本实施例涉及路由设备中各类业务进行流量和流向分析技术的相关实现算法。
本实施例中，获取采样比，采样比的最大值为1000:1，最小值为1:1，本实施例的采样比根据网络流量状况进行配置。路由设备中具有多个探测器，每个探测器具有一个探测接口，本实施例为每个探测接口分别随机分配一第一随机值A，第一随机值A在[0，(采样比-1)]的范围内，采样比及第一随机值A两者均存储在对应的探测器的存储器中，例如获取的采样比为10时，在[0，9]范围内随机为每个探测接口分别分配第一随机值A，例如可以分配给第一个探测接口的第一随机值A为2，第二个探测接口的第一随机值A为7等。分配了第一随机值A后，该第一随机值A就作为该探测接口的临时属性值。
本实施例中，第一随机值A可选地为质数。
步骤S102，当探测接口接收到报文时，获取随机产生器产生的第二随机值；
本实施例中，可以将随机产生器内置于路由设备中。
本实施例中，当探测接口接收到报文时，每接收到一个报文随机产生器就产生一个第二随机值B。例如，当某一探测接口接收到报文时，随机产生器产生一0x12336784的随机值，第二随机值B用于与采样比及第一随机值A进行一定的数学运算。
本实施例中，第二随机值B的范围较大，可以根据最大采样比来进行设定。
步骤S103，对所述第二随机值及所述采样比进行取余运算，获取运算结果；
步骤S104，根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。
本实施例中，假设路由设备中有两个探测器，采样比为10:1，将该采样比应用到接口1和接口2，分别为接口1和接口2分配第一随机值为2和7，即A1＝2，A2＝7。
假设探测器同时从接口1和接口2接收报文，当接收到报文后，随机产生器分别产生两个第二随机值0x12336784及0x12336787，然后将第二随机值与采样比进行一定的运算。
本实施例中对第二随机值及采样比进行取余运算，即将0x12336784除以采样比10，并取其余数为4，将0x12336787除以采样比10，并取其余数为7。余数4与接口1的第一随机值A1相比不相等，则代表不需要采样；余数7与接口2的第一随机值A2相比相等，则代表需要采样，依此类推。
本实施例中，如果采样比为10，则从概率上说，探测接口每接收到10个报文就有一个报文满足采样条件。
又如，采样比为1:1，将该采样比应用到接口1和接口2，分别为接口1和接口2分配第一随机值为0和0，即A1＝0，A2＝0。这样，当探测接口接收到报文时，无论随机产生器产生什么随机值，其对采样比取余后都为0，因此，探测接口接收到每个报文时，均需要对接收到的报文进行采样。
本实施例实际上是一种随机机制，其随机采样的效果图如图5所示。本实施例为网络数据流添加一个临时属性值及随机值，然后根据某个特定值所出现的概率来实现随机采样，由于不需要探测器基于访问外设及统计来实现，能够快速进行流量及流向的分析，提高探测器的处理性能；在多个接口同时配置采样且流量速率一样时，避免数据流到达采集器变成一个接口数量级突发流。
在一可选的实施例中，如图6所示，在上述图4的实施例的基础上，上述步骤S101包括：
步骤S1011，判断所分配的第一随机值是否已经被其他探测接口分配使用；
步骤S1012，若已经被分配使用，则重新分配，否则将所述第一随机值分配给所述探测接口。
本实施例中，获取采样比后，为每个探测接口分别分配一在零至采样比的范围内的第一随机值，在分配的过程中，判断所分配的第一随机值是否已 经被其他探测接口分配使用，如果该第一随机值已经被分配给其他的探测接口使用，则重新为该探测接口申请另一第一随机值，如果该第一随机值未被分配给其他的探测接口使用，则确定该第一随机值分配给该探测接口使用。
在一可选的实施例中，如图7所示，在上述图4的实施例的基础上，上述步骤S104包括：
步骤S1041，若所述运算结果与所述第一随机值相等，则转发所接收到的报文并进行报文采样；
步骤S1042，若所述运算结果与所述第一随机值不相等，则转发所接收到的报文。
本实施例中，对第二随机值及采样比进行取余运算，其运算结果为余数，如果余数与第一随机值相等，则正常转发所接收到的报文，同时复制一份该报文该采集器，以便采集器对该报文进行采集；如果余数与第一随机值不相等，则正常转发所接收到的报文，但是不需要对该报文进行采样。
本发明实施例还提供一种路由设备中数据流分析的装置，如图8所示，所述路由设备中数据流分析的装置包括：
分配模块101，设置成：获取采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值在零至所述采样比减1的值所在的范围内；
本实施例涉及路由设备中各类业务进行流量和流向分析技术的相关实现算法。
本实施例中，获取采样比，采样比的最大值为1000:1，最小值为1:1，本实施例的采样比根据网络流量状况进行配置。路由设备中具有多个探测器，每个探测器具有一个探测接口，本实施例为每个探测接口分别随机分配一第一随机值A，第一随机值A在[0，(采样比-1)]的范围内，采样比及第一随机值A两者均存储在对应的探测器的存储器中，例如获取的采样比为10时，在[0，9]范围内随机为每个探测接口分别分配第一随机值A，例如可以分配给第一个探测接口的第一随机值A为2，第二个探测接口的第一随机值A为7 等。分配了第一随机值A后，该第一随机值A就作为该探测接口的临时属性值。
本实施例中，第一随机值A可选地为质数。
获取模块102，设置成：当探测接口接收到报文时，获取随机产生器产生的第二随机值；
本实施例中，可以将随机产生器内置于路由设备中。
本实施例中，当探测接口接收到报文时，每接收到一个报文随机产生器就产生一个第二随机值B。例如，当某一探测接口接收到报文时，随机产生器产生一0x12336784的随机值，第二随机值B用于与采样比及第一随机值A进行一定的数学运算。
本实施例中，第二随机值B的范围较大，可以根据最大采样比来进行设定。
运算模块103，设置成：对所述第二随机值及所述采样比进行取余运算，获取运算结果；
分析模块104，设置成：根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。
本实施例中，假设路由设备中有两个探测器，采样比为10:1，将该采样比应用到接口1和接口2，分别为接口1和接口2分配第一随机值为2和7，即A1＝2，A2＝7。
假设探测器同时从接口1和接口2接收报文，当接收到报文后，随机产生器分别产生两个第二随机值0x12336784及0x12336787，然后将第二随机值于采样比进行一定的运算。
本实施例中对第二随机值及采样比进行取余运算，即将0x12336784除以采样比10，并取其余数为4，将0x12336787除以采样比10，并取其余数为7。余数4与接口1的第一随机值A1相比不相等，则代表不需要采样；余数7与接口2的第一随机值A2相比相等，则代表需要采样，依此类推。
本实施例中，如果采样比为10，则从概率上说，探测接口每接收到10个报文就有一个报文满足采样条件。
又如，采样比为1:1，将该采样比应用到接口1和接口2，分别为接口1和接口2分配第一随机值为0和0，即A1＝0，A2＝0。这样，当探测接口接收到报文时，无论随机产生器产生什么随机值，其对采样比取余后都为0，因此，探测接口接收到每个报文时，均需要对接收到的报文进行采样。
本实施例实际上是一种随机机制，其随机采样的效果图如图5所示。本实施例为网络数据流添加一个临时属性值及随机值，然后根据某个特定值所出现的概率来实现随机采样，由于不需要探测器基于访问外设及统计来实现，能够快速进行流量及流向的分析，提高探测器的处理性能；在多个接口同时配置采样且流量速率一样时，避免数据流到达采集器变成一个接口数量级突发流。
在一可选的实施例中，如图9所示，在上述图8的实施例的基础上，所述分配模块101包括：
判断单元1011，设置成：判断所分配的第一随机值是否已经被其他探测接口分配使用；
分配单元1012，设置成：若已经被分配使用，则重新分配，否则将所述第一随机值分配给所述探测接口。
本实施例中，获取采样比后，为每个探测接口分别分配一在零至采样比的范围内的第一随机值，在分配的过程中，判断所分配的第一随机值是否已经被其他探测接口分配使用，如果该第一随机值已经被分配给其他的探测接口使用，则重新为该探测接口申请另一第一随机值，如果该第一随机值未被分配给其他的探测接口使用，则确定该第一随机值分配给该探测接口使用。
在一可选的实施例中，如图10所示，在上述图8的实施例的基础上，所述分析模块104包括：
第一分析单元1041，设置成：若所述运算结果与所述第一随机值相等，则转发所接收到的报文并进行报文采样；
第二分析单元1042，设置成：若所述运算结果与所述第一随机值不相等， 则转发所接收到的报文。
本实施例中，对第二随机值及采样比进行取余运算，其运算结果为余数，如果余数与第一随机值相等，则正常转发所接收到的报文，同时复制一份该报文该采集器，以便采集器对该报文进行采集；如果余数与第一随机值不相等，则正常转发所接收到的报文，但是不需要对该报文进行采样。
本发明实施例还提供一种路由器设备，所述路由器设备包括上述的路由设备中数据流分析的装置。
本发明实施例还公开了一种计算机程序，包括程序指令，当该程序指令被计算机执行时，使得该计算机可执行上述任意的路由设备中数据流分析的方法。
本发明实施例还公开了一种载有所述的计算机程序的载体。
以上仅为本发明的可选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
工业实用性
本发明技术方案能够快速进行流量及流向的分析，提高探测器的处理性能，并在多个接口同时配置采样且流量速率一样时，避免数据流到达采集器变成一个接口数量级突发流。因此本发明具有很强的工业实用性。

Claims (11)

  1. 一种路由设备中数据流分析的方法，包括以下步骤：
    确定采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值为零至所述采样比减1之间任意的整数；
    当探测接口接收到报文时，获取随机产生器产生的第二随机值；
    对所述第二随机值及所述采样比进行取余运算，获取运算结果；
    根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。
  2. 如权利要求1所述的路由设备中数据流分析的方法，其中，所述第一随机值为质数。
  3. 如权利要求1或2所述的路由设备中数据流分析的方法，其中，所述获取采样比，并为每个探测接口分别分配第一随机值的步骤包括：
    判断所分配的第一随机值是否已经被其他探测接口分配使用；
    若已经被分配使用，则重新分配；
    若该第一随机值没有被分配使用，则将所述第一随机值分配给所述探测接口。
  4. 如权利要求1或2所述的路由设备中数据流分析的方法，其中，所述根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样的步骤包括：
    若所述运算结果与所述第一随机值相等，则转发所接收到的报文并对该报文进行采样；
    若所述运算结果与所述第一随机值不相等，则转发所接收到的报文。
  5. 一种路由设备中数据流分析的装置，包括分配模块、获取模块、运算模块和分析模块，其中：
    所述分配模块设置成：确定采样比，并为每个探测接口分别分配第一随机值，其中，所述第一随机值位零至所述采样比减1之间任意的整数；
    所述获取模块设置成：当探测接口接收到报文时，获取随机产生器产生的第二随机值；
    所述运算模块设置成：对所述第二随机值及所述采样比进行取余运算，获取运算结果；
    所述分析模块设置成：根据所述运算结果及所述第一随机值判断是否对所接收到的报文进行采样。
  6. 如权利要求5所述的路由设备中数据流分析的装置，其中，所述第一随机值为质数。
  7. 如权利要求5或6所述的路由设备中数据流分析的装置，其中，所述分配模块包括判断单元和分配单元，其中：
    所述判断单元设置成：判断所分配的第一随机值是否已经被其他探测接口分配使用；
    所述分配单元设置成：若该第一随机值已经被分配使用，则重新分配，若该第一随机值没有被分配使用，则将所述第一随机值分配给所述探测接口。
  8. 如权利要求5或6所述的路由设备中数据流分析的装置，其中，所述分析模块包括第一分析单元和第二分析单元，其中：
    所述第一分析单元设置成：若所述运算结果与所述第一随机值相等，则转发所接收到的报文并对该报文进行采样；
    所述第二分析单元设置成：若所述运算结果与所述第一随机值不相等，则转发所接收到的报文。
  9. 一种路由器设备，包括如权利要求5至8任一项所述的数据流分析的装置。
  10. 一种计算机程序，包括程序指令，当该程序指令被计算机执行时，使得该计算机可执行如权利要求1-4中任一项所述的路由设备中数据流分析的方法。
  11. 一种载有如权利要求10所述的计算机程序的载体。
PCT/CN2015/084127 2015-04-10 2015-07-15 路由设备中数据流分析的方法、装置及路由设备 WO2016161713A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510169306.4 2015-04-10
CN201510169306.4A CN106161129B (zh) 2015-04-10 2015-04-10 路由设备中数据流分析的方法、装置及路由设备

Publications (1)

Publication Number Publication Date
WO2016161713A1 true WO2016161713A1 (zh) 2016-10-13

Family

ID=57071709

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/084127 WO2016161713A1 (zh) 2015-04-10 2015-07-15 路由设备中数据流分析的方法、装置及路由设备

Country Status (2)

Country Link
CN (1) CN106161129B (zh)
WO (1) WO2016161713A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113783754A (zh) * 2021-09-13 2021-12-10 北京天融信网络安全技术有限公司 性能测试方法、装置、系统、测试设备及存储介质
WO2022078299A1 (zh) * 2020-10-14 2022-04-21 锐捷网络股份有限公司 一种报文采样方法、装置、设备及介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113904952B (zh) * 2021-10-08 2023-04-25 深圳依时货拉拉科技有限公司 网络流量采样方法及装置、计算机设备及可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070043798A1 (en) * 2005-08-16 2007-02-22 Boerstler David W Random number generator
CN102223261A (zh) * 2011-05-17 2011-10-19 中兴通讯股份有限公司 一种针对报文进行采样的方法及装置
CN103294447A (zh) * 2013-05-30 2013-09-11 华为技术有限公司 一种生成随机数的方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070043798A1 (en) * 2005-08-16 2007-02-22 Boerstler David W Random number generator
CN102223261A (zh) * 2011-05-17 2011-10-19 中兴通讯股份有限公司 一种针对报文进行采样的方法及装置
CN103294447A (zh) * 2013-05-30 2013-09-11 华为技术有限公司 一种生成随机数的方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022078299A1 (zh) * 2020-10-14 2022-04-21 锐捷网络股份有限公司 一种报文采样方法、装置、设备及介质
CN113783754A (zh) * 2021-09-13 2021-12-10 北京天融信网络安全技术有限公司 性能测试方法、装置、系统、测试设备及存储介质
CN113783754B (zh) * 2021-09-13 2023-09-26 北京天融信网络安全技术有限公司 性能测试方法、装置、系统、测试设备及存储介质

Also Published As

Publication number Publication date
CN106161129A (zh) 2016-11-23
CN106161129B (zh) 2019-09-13

Similar Documents

Publication Publication Date Title
JP5475744B2 (ja) 分散型トラフィック分析
US8677485B2 (en) Detecting network anomaly
US12047295B2 (en) Microburst detection and management
CN103580905B (zh) 一种流量预测方法、系统及流量监测方法、系统
WO2016161713A1 (zh) 路由设备中数据流分析的方法、装置及路由设备
TW201119285A (en) Identification of underutilized network devices
CN105530138A (zh) 一种数据监控方法及装置
CN112260899B (zh) 基于mmu的网络监测方法和装置
US11075950B2 (en) Generation of security policies for microsegmented computer networks
WO2013185489A1 (zh) 分析信令流量的方法及装置
US20230261940A1 (en) Network Intention Monitoring Method, Network Intention Monitoring System, and Storage Medium
CN110650020A (zh) 拟态模糊判决方法、装置及系统
US20170093665A1 (en) Problem detection in a distributed digital network through distributed packet analysis
CN113992544B (zh) 端口流量分配的优化方法、装置
CN110677327A (zh) 一种基于芯片的rtp流量故障实时检测方法
WO2016201876A1 (zh) 一种加密流量的业务识别方法、装置和计算机存储介质
CN111355670A (zh) 一种流量识别方法、装置、电子设备及存储介质
WO2015154512A1 (zh) 一种组播链路的检测方法、网络设备及服务器
CN108063764B (zh) 一种网络流量处理方法和装置
JP2013030944A (ja) パケットキャプチャ処理方法及び装置
WO2017206499A1 (zh) 网络攻击检测方法以及攻击检测装置
CN106817268B (zh) 一种ddos攻击的检测方法及系统
CN110661684A (zh) 流量统计方法及装置
Özer et al. Yazılım tanımlı ağlarda izleme
CN106452979A (zh) 一种在线捕包方法及工具

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15888268

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15888268

Country of ref document: EP

Kind code of ref document: A1