WO2017162117A1 - 一种集群精确限速方法和装置 - Google Patents

一种集群精确限速方法和装置 Download PDF

Info

Publication number
WO2017162117A1
WO2017162117A1 PCT/CN2017/077285 CN2017077285W WO2017162117A1 WO 2017162117 A1 WO2017162117 A1 WO 2017162117A1 CN 2017077285 W CN2017077285 W CN 2017077285W WO 2017162117 A1 WO2017162117 A1 WO 2017162117A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
packet
header
identity information
client
Prior art date
Application number
PCT/CN2017/077285
Other languages
English (en)
French (fr)
Inventor
姜邦杰
祝顺民
文荣
孙成浩
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2017162117A1 publication Critical patent/WO2017162117A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H04L67/1014—Server selection for load balancing based on the content of a request
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames

Definitions

  • the present application relates to the field of computer technology, and in particular, to a cluster accurate speed limit method and a cluster precise speed limit device.
  • the application environment of the network is also increasingly diversified, for example, by using a cluster composed of a group of service entities working together to provide services to multiple clients or multiple users.
  • a cluster composed of a group of service entities working together to provide services to multiple clients or multiple users.
  • the cluster contains multiple service entities, such as servers.
  • Each service entity provides services at the same time, which in turn causes traffic of the same client to fall on multiple service entities in the cluster.
  • each service entity is speed-limiting separately, as the cluster size increases, the total speed limit bandwidth of each client is also expanded, so it is necessary to provide an accurate global speed limit scheme for the cluster.
  • the first type a dedicated flow control entity, such as a flow control server, is used in the cluster to control the speed limit of each service entity.
  • the flow control entity is responsible for monitoring the traffic rate of each rate limiting unit on the serving entity and dynamically allocating the rate limiting bandwidth.
  • Each service entity in the cluster allocates the bandwidth purchased by the client or the user on average. If the cluster has N service entities and the user purchases the bandwidth of B, the rate limit of each service entity is B/N.
  • the third category provides a special speed limit node composed of devices with speed limit function between the client and the cluster.
  • the traffic of each client falls evenly to each service entity, and the operability is low.
  • the traffic of the client is not uniform, then the traffic of some clients on a certain service entity is greater than the specific rate limit, so that the packet loss is caused, and the actual bandwidth of the user cannot reach the bandwidth of the purchase, and the accuracy is better. low.
  • embodiments of the present application have been made in order to provide a cluster accurate speed limit method and a corresponding cluster precision speed limit device that overcome the above problems or at least partially solve the above problems.
  • a cluster accurate speed limiting method including:
  • the data packet is forwarded to a service entity responsible for responding to the client to which the data packet belongs;
  • the data packet is a data packet of a client that is responsible for the response, the data packet is subjected to rate limiting processing based on the identity information of the data packet.
  • the step of forwarding the data packet to a service entity responsible for responding to a client to which the data packet belongs includes:
  • the data packet encapsulating the protocol header is forwarded through the switch to the service entity responsible for responding to the client to which the data packet belongs.
  • the step of encapsulating the protocol header according to the identity information of the data packet in accordance with the rules of the network transmission protocol including:
  • IP packet header and a UDP packet header Re-encapsulating an IP packet header and a UDP packet header according to the identity of the network transmission protocol according to the identity information of the data packet, or based on the identity information of the data packet, in the data packet
  • the packet is further encapsulated with an IP packet header and a TCP packet header according to the rules of the network transmission protocol.
  • the step of re-encapsulating an IP packet header and a TCP packet header according to the rules of the network transmission protocol in the data packet including:
  • the five-tuple includes: a source IP address, a destination IP address, a source port, a destination port, and a transport protocol type; and the destination IP address is an IP address corresponding to the service entity. ;
  • an IP packet header and a TCP packet header are further encapsulated in the data packet according to the rules of the network transmission protocol.
  • the step of acquiring the identity information corresponding to the data packet includes:
  • the IP packet header of the data packet is parsed at the network layer to obtain an IP address.
  • the step of acquiring the identity information corresponding to the data packet includes:
  • the data packet is temporarily stored in the network layer, and the data packet is sent upward to the application layer;
  • the data area of the data packet is parsed at the application layer to obtain the user ID of the data packet.
  • the step of selecting the same five-tuple according to the identity information includes:
  • the method further includes:
  • the quintuple obtained at the application layer is sent to the network layer.
  • the step of re-encapsulating an IP packet header and a UDP packet header according to the rules of the network transmission protocol in the data packet according to the quintuple includes:
  • the source IP address, the destination IP address, and the transport protocol type in the quintuple are encapsulated into an IP packet header outside the data packet.
  • the step of re-encapsulating an IP packet header and a TCP packet header according to the rules of the network transmission protocol in the data packet according to the quintuple includes:
  • the source IP address, the destination IP address, and the transport protocol type in the quintuple are encapsulated into an IP packet header outside the data packet.
  • the step of determining whether the data packet is a data packet of a client that is responsible for responding by itself comprises:
  • the data packet is a data packet forwarded by the service entity, it is confirmed that the data packet is a data packet of a client that is responsible for the response;
  • the data packet is a data packet sent by the client, it is confirmed that the data packet is not a data packet of the client that is responsible for the response.
  • the step of determining whether the data packet is a data packet forwarded by a service entity or a data packet sent by a client includes:
  • the data packet is a data packet of the client that is responsible for the response;
  • the data packet is not a data packet of the client that is responsible for the response.
  • the step of performing rate limiting processing on the data packet based on the identity information of the data packet includes:
  • the data packet is discarded.
  • the step of determining whether the traffic corresponding to the identity information reaches a threshold includes:
  • the data packet is discarded.
  • a cluster precise speed limit device including:
  • a receiving module adapted to receive a data packet
  • the determining module is adapted to determine whether the data packet is a data packet of a client that is responsible for responding by itself; if the data packet is not a data packet of a client that is responsible for the response, the packet is entered into the forwarding module; if the data packet is The data packet of the client that is responsible for the response is entered into the speed limit module;
  • a forwarding module configured to forward the data packet to a service entity responsible for responding to a client to which the data packet belongs;
  • the rate limiting module is adapted to perform rate limiting processing on the data packet based on identity information of the data packet.
  • the forwarding module includes:
  • Encapsulating a sub-module adapted to encapsulate a protocol header according to the identity information of the data packet, in accordance with a rule of a network transmission protocol, in addition to the data packet;
  • the forwarding submodule is adapted to forward the data packet encapsulating the protocol header to the service entity responsible for responding to the client to which the data packet belongs by using the switch.
  • the package submodule comprises:
  • the first encapsulating submodule is adapted to further encapsulate an IP packet header and a UDP packet header according to the rule of the network transmission protocol according to the identity information of the data packet;
  • the second encapsulating submodule is adapted to further encapsulate an IP packet header and a TCP packet header according to the rules of the network transmission protocol according to the identity information of the data packet.
  • the first package submodule, or the second package submodule includes:
  • An identity information obtaining submodule configured to obtain identity information corresponding to the data packet
  • a five-tuple selection sub-module configured to select the same five-tuple according to the identity information;
  • the five-tuple includes: a source IP address, a destination IP address, a source port, a destination port, and a transmission protocol type;
  • the IP address is the IP address corresponding to the service entity;
  • a first packet header sub-module configured to further encapsulate an IP packet header and a UDP packet header according to the rules of the network transmission protocol according to the quintuple according to the quintuple; or, the second packet
  • the header encapsulation submodule is adapted to re-encapsulate an IP packet header and a TCP packet header according to the rules of the network transmission protocol according to the quintuple according to the quintuple.
  • the identity information obtaining submodule includes:
  • the first identity information obtaining submodule is adapted to parse the IP packet header of the data packet at the network layer to obtain an IP address.
  • the identity information obtaining submodule includes:
  • the data packet is temporarily stored in the network layer, and the data packet is sent up to the application layer;
  • the second identity information obtaining submodule is adapted to parse the data area of the data packet at the application layer to obtain a user ID of the data packet.
  • the quintuple selection submodule comprises:
  • the application layer quintuple selection submodule is adapted to select the same quintuple according to the identity information at the application layer;
  • a sending submodule configured to send the quintuple obtained at the application layer to the network layer
  • the first packet header encapsulation submodule includes:
  • a first port encapsulation submodule configured to encapsulate a source port and a destination port in the quintuple into a UDP packet header outside the data packet;
  • the IP address encapsulating submodule is adapted to encapsulate the source IP address, the destination IP address, and the transport protocol type in the quintuple into an IP packet header other than the data packet.
  • the second packet header encapsulation submodule includes:
  • a second port encapsulation submodule configured to encapsulate the source port and the destination port in the quintuple into a TCP packet header outside the data packet;
  • the IP address encapsulating submodule is adapted to encapsulate the source IP address, the destination IP address, and the transport protocol type in the quintuple into an IP packet header other than the data packet.
  • the determining module includes:
  • the determining submodule is adapted to determine whether the data packet is a data packet forwarded by the service entity or a data packet sent by the client; if the data packet is a data packet forwarded by the service entity, confirming that the data packet is itself The data packet of the client responsible for the response; if the data packet is a data packet sent by the client, it is confirmed that the data packet is not a data packet of the client that is responsible for the response.
  • the determining submodule comprises:
  • a protocol header judging sub-module adapted to determine, for any data packet, whether there is a protocol header encapsulated according to a rule of a network transmission protocol outside the data packet; if there is a network transmission protocol outside the data packet The rule encapsulation protocol header enters the first acknowledgment submodule; if there is no protocol header encapsulated according to the rules of the network transmission protocol outside the data packet, the second acknowledgment submodule is entered.
  • the speed limit module includes:
  • a packet identity information obtaining submodule configured to obtain identity information of the data packet
  • the traffic judgment sub-module is configured to determine whether the traffic corresponding to the identity information exceeds a traffic threshold; if the traffic corresponding to the identity information exceeds a traffic threshold, enter a discarding sub-module;
  • Discarding the submodule suitable for discarding the data packet.
  • the traffic judgment sub-module includes:
  • a user ID search submodule configured to search for a user ID corresponding to the IP address
  • a traffic threshold search sub-module configured to search for a corresponding traffic threshold according to the user ID
  • the first traffic judging sub-module is configured to calculate whether the traffic corresponding to the IP address exceeds the traffic threshold; if the traffic corresponding to the IP address exceeds the traffic threshold, the discarding sub-module is entered.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure the same client.
  • the traffic of the terminal falls on the same service entity, and then, on the service entity, the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet.
  • the embodiment of the present application does not need to set a flow control entity in the cluster to limit the rate of the service entity in the entire cluster, and the entire cluster may not be affected by the fault of the flow control entity.
  • the normal work, the applicability is strong.
  • the data packet of the same client is responsible for performing specific business logic processing by the same service entity, and determining whether to perform the next processing or discarding, therefore, Precise control of traffic to each client, high operability.
  • the embodiment of the present application improves the processing flow of the data packet under the original architecture of the cluster, and forwards the data packets of the same client received by each service entity to the same one.
  • the service entity performs speed limit processing without increasing system complexity, and does not use additional hardware facilities, and does not increase hardware costs.
  • the embodiment of the present application only utilizes the computing function of the cluster itself, that is, the speed limit processing of the traffic of the same client is implemented, and can be applied to a cluster of any size, and has wider applicability.
  • the embodiments of the present application improve the applicability, operability, and accuracy of the cluster speed limit without increasing system complexity and cost.
  • FIG. 1A is a schematic diagram of an application scenario of the present application.
  • FIG. 2 is a flow chart showing the steps of another embodiment of the cluster precise rate limiting method of the present application.
  • FIG. 3 is a flow chart of steps of another embodiment of a cluster precise rate limiting method of the present application.
  • FIG. 4 is a structural block diagram of an embodiment of a cluster precise speed limit device of the present application.
  • FIG. 5 is a structural block diagram of another embodiment of a cluster precise speed limit device of the present application.
  • FIG. 6 is a structural block diagram of another embodiment of a cluster precise speed limit device of the present application.
  • the cluster precise rate limiting method and apparatus can pass a data packet of a client that is not responsible for the response, without increasing the complexity of the system. Forwarding to the service entity in the same cluster responsible for responding to the client to which the data packet belongs, thereby ensuring that the traffic of the same client falls on the same service entity, and then, on the service entity, the data of the client is based on the identity information of the corresponding data packet.
  • the package is speed limited. Therefore, compared with the background art, the applicability, operability, and accuracy of the cluster speed limit are improved without increasing system complexity and cost.
  • FIG. 1 a flow chart of steps of an embodiment of a cluster precise rate limiting method of the present application is shown, which may specifically include the following steps:
  • Step 110 Receive a data packet.
  • FIG. 1A is a schematic diagram of an application scenario of the present application. It can be seen that there are four service entities in the cluster, and the service entity communicates with the external, for example, the client through each switch, and the data packet sent by the client first passes through the switch, and then redistributed by the switch to at least one service entity. deal with.
  • a cluster is a group of service entities that work together to provide a service platform that is more scalable and usable than a single service entity. It mainly includes High Availability Cluster, Load Balance Cluster, and High Performance Computing Cluster. This application is mainly for high availability clusters and load balancing clusters.
  • a service entity is a device that can provide certain services, such as a server. In the embodiment of the present application, a data packet can be received and a speed limit operation is performed.
  • the client interacts with the server by sending its request and other information to the server in the form of a data packet.
  • the data packets sent by the same client may fall on multiple service entities in the cluster.
  • the TCP/IP protocol data packet is the data unit in the TCP/IP (Transmission Control Protocol/Internet Protocol) protocol communication transmission.
  • TCP/IP Transmission Control Protocol/Internet Protocol
  • packets in the process of network information transmission, a single A message is divided into multiple data blocks, called data packets, which contain the address information of the sender and receiver. These packets are then transmitted along different paths in one or more networks and reassembled at the destination.
  • the data packet is mainly composed of a packet header and data.
  • the TCP/IP protocol is a protocol family, which includes TCP (Transmission Control Protocol), IP (Internet Protocol), and UDP (User Datagram Protocol). , ICMP (Internet Control Message Protocol), RIP (Routing Information Protocol), SMTP (Simple Mail Transfer Protocol), SNMP (Simple Network Management Protocol) Many protocols such as ARP (Address Resolution Protocol) and FTP (File Transfer Protocol).
  • TCP Transmission Control Protocol
  • IP Internet Protocol
  • UDP User Datagram Protocol
  • ICMP Internet Control Message Protocol
  • RIP Rastering Information Protocol
  • SMTP Simple Mail Transfer Protocol
  • SNMP Simple Network Management Protocol
  • ARP Address Resolution Protocol
  • FTP File Transfer Protocol
  • the transport layer is called a segment
  • the network layer is called a datagram
  • the link layer is called a frame.
  • a cluster precise rate limiting method of the present application is to limit the rate of data packets in information transmission, so the data packet needs to be received first.
  • Step 120 Determine whether the data packet is a data packet of a client that is responsible for responding by itself; if the data packet is not a data packet of a client that is responsible for the response, go to step 130; if the data packet is responsible for itself The client's data packet is processed, and the process proceeds to step 140.
  • the switch may determine, according to a certain algorithm, a client that is responsible for each service entity in the cluster, that is, a service entity in the cluster may only be responsible for determining by the algorithm.
  • the data packet sent by the client is subjected to a rate limit.
  • the specific client may be referred to as a client that the data packet itself is responsible for.
  • the service entity After receiving the data packet of the client, it is necessary to further determine whether the data packet is a data packet of the client that is responsible for the response, and if the data packet is not a data packet of the client that is responsible for the response, the service entity is considered. Only rate the data packets sent by the client that is responsible for the response, so the data packet needs to be forwarded to the service entity responsible for the client of the data packet; if the data packet is by itself The data packet of the client responsible for the response can directly limit the data packet based on the identity information of the data packet.
  • Step 130 Forward the data packet to a service entity responsible for responding to the client to which the data packet belongs.
  • the service entity may forward the received data packet that is not handled by itself to the service responsible for responding to the client to which the data packet belongs.
  • entity For example, if the service entity 1 receives a data packet, and the client to which the data packet belongs is handled by the service entity 3, after the service entity receives the data packet, the data packet is sent to the switch 1 again, and then Switch 1 then sends the data packet to service entity 3.
  • step 130 includes:
  • Sub-step 131 based on the identity information of the data packet, encapsulates the protocol header in addition to the data packet according to the rules of the network transmission protocol.
  • the protocol header may be encapsulated outside the data packet based on the identity information of the data packet, and the protocol header is encapsulated outside the data packet according to the rules of the network transmission protocol.
  • the identity information of the data packet may include a user ID, and/or an IP address of the client, and the like; a network protocol generally refers to a network layer protocol and a transport layer protocol, for example, the IP shown in the table (1). (Internet Protocol, Network Protocol) protocol, TCP protocol, UDP protocol, etc. In practical applications, the TCP protocol and the UDP protocol use only one packet of the same packet.
  • a network protocol generally refers to a network layer protocol and a transport layer protocol, for example, the IP shown in the table (1). (Internet Protocol, Network Protocol) protocol, TCP protocol, UDP protocol, etc. In practical applications, the TCP protocol and the UDP protocol use only one packet of the same packet.
  • the differences between the TCP protocol and the UDP protocol are mainly as follows:
  • the TCP protocol needs to connect between objects having a communication relationship, and the UDP protocol does not need to connect between objects having a communication relationship;
  • the transmission speed of the TCP protocol is slower, and the transmission speed of the UDP protocol is faster;
  • TCP protocol can guarantee the data sequence
  • UDP protocol can not guarantee the data sequence
  • TCP protocol can ensure data correctness
  • UDP protocol may lose packets
  • the TCP protocol has many requirements on system resources, and the UDP protocol system requires less resources.
  • the present application encapsulates the protocol header in accordance with the rules of the network transmission protocol in addition to the data packet, and may encapsulate the protocol header according to the rules of the IP protocol + TCP protocol or the IP protocol + UDP protocol.
  • the first data indicating the identity information of the client to which the data packet belongs is encapsulated in the protocol header.
  • the first data encapsulated in the protocol header of any of its packets is unique and can be distinguished from other clients.
  • Sub-step 132 forwarding the data packet encapsulating the protocol header to the packet responsible for responding to the data packet The service entity of the client to which it belongs.
  • the data packet sent by the same client needs to be merged into a preset service entity corresponding to the client, and then the speed limit is accurately performed.
  • the data packet encapsulating the protocol header According to the content of the protocol header, the data packet encapsulating the protocol header is forwarded by the switch to the service entity responsible for responding to the client to which the data packet belongs.
  • the switch's HASH (hash/hash) policy can be used to accurately forward the data packet encapsulating the protocol header to the service entity responsible for the client to which the data packet belongs.
  • the cluster switch hashes the first data in the protocol header of the data packet, and then distributes the data packet to the corresponding service entity according to the hash result. For example, the hash value of the first data is calculated, and then the hash value is used as a remainder for the total number of service entities, and then the data packet is sent to the service entity corresponding to the remainder according to the correspondence between the remainder and the service entity.
  • Step 140 Perform rate limiting processing on the data packet based on identity information of the data packet.
  • the cluster needs to provide services to multiple clients.
  • a service entity can be used to limit the speed of a certain client.
  • different traffic thresholds may be preset according to different clients, and then it is determined whether the traffic of each data packet received by the service entity exceeds the traffic threshold corresponding to the client, if a certain data If the traffic of the packet exceeds the traffic threshold corresponding to the client, the packet may be discarded, and if the traffic of the packet does not exceed the traffic threshold corresponding to the client, the packet is retained.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure the same The traffic of the client falls on the same service entity, and then the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet on the service entity. Therefore, the application has the following advantages:
  • the embodiment of the present application does not need to set a flow control entity in the cluster to limit the rate of the service entity in the entire cluster, and the entire cluster may not be affected by the fault of the flow control entity.
  • the normal work the applicability is strong.
  • the data packet of the same client is responsible for performing specific business logic processing by the same service entity, and determining whether to perform the next processing or discarding. Therefore, the traffic of each client can be precisely controlled, and the operability is high.
  • the embodiment of the present application improves the processing flow of the data packet under the original architecture of the cluster, and forwards the data packets of the same client received by each service entity to the same one.
  • the service entity performs speed limit processing without increasing system complexity, and does not use additional hardware facilities, and does not increase hardware costs.
  • the embodiment of the present application only utilizes the computing function of the cluster itself, that is, the speed limit processing of the traffic of the same client is implemented, and can be applied to a cluster of any size, and has wider applicability.
  • the three types of rate limiting schemes improve the applicability, operability, and accuracy of the cluster speed limit without increasing system complexity and cost.
  • FIG. 2 a flow chart of the steps of the embodiment of the cluster precise rate limiting method of the present application is shown, which may specifically include the following steps:
  • Step 210 Receive a data packet.
  • Step 220 Determine whether the data packet is a data packet of a client that is responsible for responding by itself; if the data packet is not a data packet of a client that is responsible for the response, proceed to step 230; if the data packet is responsible for itself In response to the client's data packet, proceed to step 250.
  • Step 230 Based on the identity information of the data packet, further encapsulate an IP packet header and a TCP packet header in addition to the data packet according to the rules of the network transmission protocol.
  • the rules of the network transmission protocol may be used in addition to the data packet. Then encapsulate an IP packet header and a TCP packet header. A TCP packet header is encapsulated according to the TCP protocol, and then an IP packet header is encapsulated according to the IP protocol.
  • TCP is a connection-oriented transport protocol, which needs to establish a connection relationship between a client and a service entity that need to communicate and between different service entities.
  • TCP uses the "three-way handshake" method to establish a connection.
  • the client and the service entity are used as an example. The specific steps are as follows:
  • the client receives the SYN+ACK packet from the service entity and sends an acknowledgement packet to the service entity.
  • the client and the service entity can start transmitting data.
  • the serial number TCP serial number, that is, the serial number of the first byte of the data sent by this segment.
  • Confirmation number The serial number of the first byte of the data that you want to receive next time.
  • PSH Push Bit: Transfer to the other party according to the team, do not wait for the cache to fill up and then submit it to the upper layer, but submit it immediately.
  • RST Reset bit. A serious error has occurred in the TCP connection and the connection must be released and re-established immediately. Also used to reject an illegal segment or refuse to open a connection.
  • the receiving end informs itself of the receiving capability, that is, the size of the receiving window itself, and the sender will send data according to this size.
  • Checksum The scope of the inspection includes the header and data. When calculating the checksum, a 12-byte pseudo header is added to the front of the TCP segment.
  • Urgent pointer A valid field when the emergency pointer code bit is set. If valid, this value indicates the offset of the octet of the current serial number, which is the starting position of the first non-emergency data.
  • step 230 includes:
  • Sub-step 231 acquiring identity information corresponding to the data packet
  • Sub-step 232 selecting the same five-tuple according to the identity information; the five-tuple includes: a source IP address, a destination IP address, a source port, a destination port, and a transport protocol type; and the destination IP address is a service entity. Corresponding IP address;
  • Sub-step 233 based on the quintuple, re-encapsulating an IP packet header and a TCP packet header in addition to the data packet according to the rules of the network transmission protocol.
  • the transport protocol type in the quintuple is TCP protocol, that is, the data packet is repackaged according to the rules of the TCP protocol.
  • a layer of IP packet headers and TCP packet headers According to the IP packet header structure and the TCP packet header structure respectively shown in Table (2) and Table (4), in actual applications, the source IP address, the destination IP address, and the transport protocol type in the quintuple are respectively The source address, the destination address, and the protocol in the IP packet header are in one-to-one correspondence.
  • the source port and the destination port in the quintuple group correspond to the source port number and the destination port number in the TCP packet header.
  • the content of the IP packet header and other parts of the TCP packet header are not limited in this embodiment.
  • step 233 includes:
  • Sub-step 2331 the source port and the destination port in the quintuple are encapsulated into a TCP packet header outside the data packet.
  • the source port and the destination port in the quintuple are respectively encapsulated into a source port number and a destination port number in a TCP packet header other than the data packet.
  • the data applicable to any type of the TCP packet header may be used, which is not limited in this embodiment of the present application.
  • Sub-step 2332 the source IP address, the destination IP address, and the transport protocol type in the quintuple are sealed. Installed in the IP header outside the packet.
  • Step 240 Forward the data packet encapsulating the protocol header to the service entity responsible for responding to the client to which the data packet belongs.
  • Step 250 Perform rate limiting processing on the data packet based on identity information of the data packet.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure that the complexity of the system is not increased.
  • the traffic of the same client falls on the same service entity, and then the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet.
  • the applicability, operability, and accuracy of the cluster speed limit are improved without increasing system complexity and cost.
  • an IP packet header and a TCP packet header are encapsulated by the data packet sent by the client, which is received by the service entity, and then the encapsulated data packet is forwarded to be responsible for responding.
  • the service entity of the client to which the data packet belongs in the embodiment of the present application, the connection between the entities needs to be established, and the accuracy of the data in the data packet can be further ensured, and the data packet is accurately forwarded to the corresponding service. In the entity, the accuracy of the cluster speed limit is further improved.
  • FIG. 3 a flow chart of steps of another embodiment of the cluster precise rate limiting method of the present application is shown, which may specifically include the following steps:
  • Step 310 receiving a data packet.
  • Step 320 Determine whether the data packet is a data packet forwarded by a service entity or a data packet sent by a client. If the data packet is a data packet forwarded by a service entity, it is confirmed that the data packet is not handled by itself. The client's data packet then proceeds to step 330; if the data packet is a data packet sent by the client, it is confirmed that the data packet is the data packet of the client that is responsible for the response, and then proceeds to step 350.
  • the data packet received by the service entity is a data packet of the client
  • the data packet is forwarded to a service entity responsible for responding to the client to which the data packet belongs, and Before forwarding, the service entity cannot confirm whether the client it receives is sending a packet to the client that is responsible for the response.
  • only one forwarding process is required, that is, the data packet can be forwarded to a service entity responsible for responding to the client to which the data packet belongs.
  • a certain data packet is not a data packet of a client that is received by a service entity that receives the data packet, it indicates that the service entity needs to forward the received data packet to The The packet is forwarded to the service entity responsible for the client to which the packet belongs.
  • a certain data packet is a data packet of a client that is handled by a service entity itself, it indicates that the service entity does not need to forward the data packet again.
  • the data packet received by the service entity is a data packet forwarded by the service entity, it may be confirmed that the data packet is a data packet of the client that is responsible for the response, and if the data received by the service entity is received, A packet is a packet sent by a client, and the packet may be defaulted to a client packet that is not handled by the service entity itself.
  • This step is a preferred embodiment of step 120 in the first embodiment. It should be noted that, in the embodiment of the present application, the data packet received by the service entity may be a data packet forwarded by itself.
  • service entity A For example, for service entity A, it receives two data packets: data packet a, data packet b, where data packet a is forwarded by service entity B, and data packet b is sent by client C.
  • client C For example, for service entity A, it receives two data packets: data packet a, data packet b, where data packet a is forwarded by service entity B, and data packet b is sent by client C.
  • the data packet a is the data packet of the client that is handled by the service entity A
  • the data packet b is not the data packet of the client that is handled by the service entity A.
  • the service entity A before the service entity A forwards the data packet b, it cannot confirm whether the client C to which the data packet b belongs is the client that the service entity A is responsible for, and in addition, the service entity A and the service entity B may be the same. Service entity.
  • step 320 includes:
  • Sub-step 321 for any data packet, determining whether there is a protocol header encapsulated according to the rules of the network transmission protocol outside the data packet; if there is a protocol encapsulated according to the rules of the network transmission protocol outside the data packet a header, confirming that the data packet is a data packet of the client that is responsible for the response, and then proceeds to step 350; if there is no protocol header encapsulated according to the rules of the network transmission protocol outside the data packet, confirming the The packet is not the packet of the client that is responsible for itself, and then proceeds to step 330.
  • the protocol header needs to be encapsulated according to the rules of the network transmission protocol before the data packet. If the service entity does not forward the received data packet, it does not need to encapsulate the protocol header in accordance with the rules of the network transmission protocol in addition to the data packet.
  • any data packet received by the service entity it is determined whether there is a protocol header encapsulated according to the rules of the network transmission protocol outside the data packet. If there is a protocol header encapsulated according to the rules of the network transmission protocol outside the data packet, it indicates that the data packet received by the service entity is a data packet forwarded by the service entity, so that the data packet can be confirmed by the The data packet of the client that the service entity itself is responsible for; if there is no protocol header encapsulated according to the rules of the network transmission protocol outside the data packet, it indicates that the data packet received by the service entity is a data packet sent by the client. To confirm that the packet is not by itself The packet of the client responsible for the response.
  • Step 330 Based on the identity information of the data packet, further encapsulate an IP packet header and a UDP packet header in addition to the data packet according to the rules of the network transmission protocol.
  • the protocol header needs to be re-encapsulated according to the network transmission protocol rules in addition to the identity information of the data packet.
  • UDP is a connectionless datagram service.
  • the source service entity does not need to establish a connection with the target service entity before transmitting the data.
  • the data is sent to the destination service entity directly after the UDP header field such as the source and destination port numbers.
  • UDP is more efficient than TCP in the case of less and less transmitted data.
  • the IP packet is further encapsulated according to the rules of the network transmission protocol. Header and UDP headers, thus avoiding the process of establishing a connection between service entities.
  • the process of re-encapsulating an IP packet header and a UDP packet header according to the rules of the network transmission protocol outside the data packet does not affect the data packet itself.
  • the Version field 4 bits.
  • IHL Internet Header Length
  • Type of Service (TOS) field 8 bits.
  • the first 3 bits are the priority subfield (Precedence, which is now ignored).
  • the 8th bit remains unused.
  • Bits 4 to 7 represent delay, throughput, respectively Quantity, reliability and cost. When they take a value of 1, they represent minimum latency, maximum throughput, maximum reliability, and minimum cost, respectively. Only one of these 4-bit service types can be set to 1. Can be all 0, if all 0, it means general service.
  • the Service Type field declares how the datagram can be processed when it is transmitted by the network system. For example, the TELNET protocol may require minimal delay, the FTP protocol (data) may require maximum throughput, the SNMP protocol may require the highest reliability, and the NNTP (Network News Transfer Protocol) may require a minimum fee.
  • the ICMP protocol may have no special requirements (all 4 bits are 0). In fact, most hosts ignore this field, but some dynamic routing protocols such as OSPF (Open Shortest Path First Protocol) and IS-IS (Intermediate System to Intermediate System Protocol) can make routing decisions based on the values of these fields.
  • OSPF Open Shortest Path First Protocol
  • IS-IS Intermediate System to Intermediate System Protocol
  • Total length field 16 bits. Indicates the length of the entire datagram in bytes. The maximum length is 65535 bytes.
  • Flag field 16 bits. Used to uniquely identify each datagram sent by the host. Usually every time a message is sent, its value is incremented by 1.
  • Flag bit field 3 bits. Mark whether a datagram requires segmentation.
  • Segment offset field 13 bits. If a datagram requires segmentation, this field indicates where the segment offset begins with the original datagram.
  • Time to Live field 8 bits. Used to set the maximum number of routers a datagram can pass. Set by the source host that sends the data, usually 32, 64, 128, and so on. Each time a router passes, its value is decremented by one until the datagram is discarded.
  • Protocol field 8 bits. Indicates the upper layer protocol type encapsulated by the IP layer, such as ICMP (1), IGMP (2), TCP (6), UDP (17), and so on.
  • Head checksum field 16 bits.
  • the content is a checksum code calculated from the IP header.
  • the calculation method is: binary inversion of each 16 bits in the header. (Unlike ICMP, IGMP, TCP, and UDP, IP does not check the data after the header).
  • Source IP address and destination IP address field each occupying 32 bits. It is used to indicate the source host address for sending IP data packets and the destination host address for receiving IP packets.
  • Optional field 32 bits. Used to define some options: such as record path, timestamp, etc. These options are rarely used and are not supported by all hosts and routers.
  • the length of the optional field must be an integer multiple of 32 bits. If not, it must be padded with 0 to achieve this length requirement.
  • the source and destination port number fields 16 bits. Used to identify the application process of the source and target.
  • Length 16 bits, indicating the length of the UDP header and UDP data.
  • Checksum 16 bits used to verify the UDP header and UDP data.
  • step 330 includes:
  • Sub-step 331 Acquire identity information corresponding to the data packet.
  • the identity information corresponding to the data packet needs to be obtained first.
  • the identity information corresponding to the data packet may be an IP address, such as an IP address of a client that sends the data packet, or a user ID, such as a user ID that sends the data packet.
  • the user identity may also be other available information, which is not limited in this embodiment of the present application.
  • the sub-step 351 includes:
  • Sub-step 3311 parsing the IP packet header of the data packet at the network layer to obtain an IP address.
  • the identity information to be obtained is an IP address, such as the IP address of the client that sent the packet.
  • the IP layer is supported at the network layer of the TCP/IP protocol. Therefore, in the embodiment of the present application, the IP packet header of the data packet is parsed at the network layer, and the required IP address is obtained therefrom.
  • the IP packet header of the data packet is the IP packet header of the data packet itself, and is not related to the IP packet header encapsulated outside the data packet, but the structure of the IP packet header of the data packet itself is also as shown in the table (3).
  • the source address is the IP address to be obtained in the embodiment of the present application. For a specific analysis process, any of the available analytical methods in the prior art may be used, and the embodiment of the present application is not limited.
  • the sub-step 331 when the identity information is a user ID, the sub-step 331 includes:
  • Sub-step 3312 the data packet is temporarily stored in the network layer, and the data packet is sent up to the application layer.
  • the identity information to be obtained is the user ID, for example, the user ID of the data packet is sent, the information such as the user ID needs to be obtained at the application layer. Therefore, in the embodiment of the present application, the data packet is temporarily stored in the network. In the memory of the layer, the packet is sent up to the application layer at the same time.
  • the IP data packet of the network layer is uploaded to the transport layer, and after the transport layer parses the TCP packet header or the UDP packet header, the content of the data area is uploaded to the application layer. The application layer parses the contents of the data area.
  • Sub-step 3313 parsing the data area of the data packet at the application layer to obtain the user ID of the data packet.
  • information such as the user ID is stored in the data area of the data packet, and after the data packet is sent to the application layer, the data layer of the data packet can be parsed at the application layer to obtain the user ID of the data packet.
  • the data layer of the data packet can be parsed at the application layer to obtain the user ID of the data packet.
  • any available parsing method in the prior art may be used, and the embodiment of the present application is not limited thereto.
  • Sub-step 332 selecting the same five-tuple according to the identity information; the five-tuple includes: a source IP address, a destination IP address, a source port, a destination port, and a transport protocol type; and the destination IP address is a service entity. The corresponding IP address.
  • a five-tuple can distinguish between different communications and the corresponding communication is unique. Therefore, in the embodiment of the present application, the same quintuple is selected according to the identity information, and the quintuple is used to completely distinguish the user terminals corresponding to different identity information.
  • the source IP address included in the quintuple refers to the IP address of the client
  • the destination IP address is the IP address corresponding to the service entity
  • the source port is the port on which the user terminal sends the data packet
  • the destination port is the service entity.
  • the port of the packet, the transport protocol type is the specific protocol type for sending the packet.
  • the source port can use the unique ID of the port of the client.
  • the IP address of the client is unique, the last 2 bytes of the client IP address can be used as the source port.
  • other available methods can be used to identify the source port.
  • the embodiment of the present application is not limited.
  • the type of the transport protocol is related to the type of the header that is re-encapsulated outside the data packet. For example, if the transport protocol type is UDP, the IP packet header and the UDP packet are encapsulated outside the data packet. If the transport protocol type is TCP, the IP packet header and the TCP packet header are encapsulated outside the data packet.
  • the unified service address provided by the cluster service entity is a virtual IP address.
  • the client obtains the functions of each service entity in the cluster by accessing the cluster VIP address. Therefore, the destination IP address is the cluster VIP address.
  • the destination IP address in the quintuple is the same.
  • Sub-step 333 based on the quintuple, re-encapsulating an IP packet header and a UDP packet header in addition to the data packet according to the rules of the network transmission protocol.
  • the transport protocol type in the quintuple is UDP protocol, that is, the data packet is repackaged according to the UDP protocol rules.
  • a layer of IP packet headers and UDP packet headers According to the IP packet header structure and the UDP packet header structure respectively shown in Tables (3) and (4), in the actual application, the source IP address, the destination IP address, and the transport protocol type in the quintuple are respectively The source address, the destination address, and the protocol in the IP packet header are in one-to-one correspondence.
  • the source port and the destination port in the quintuple group correspond to the source port number and the destination port number in the UDP packet header.
  • the content of the IP packet header and other parts of the UDP packet header are not limited in this embodiment.
  • step 333 includes:
  • Sub-step A3331 the quintuple obtained at the application layer is sent to the network layer.
  • the quintuple obtained at the application layer needs to be sent to the network layer.
  • the quintuple information is obtained according to the user ID information, it may be a quintuple obtained at the application layer.
  • the quintuple obtained at the application layer needs to be sent to the network layer, and if it is obtained according to the IP address.
  • the quintuple can be a quintuple obtained at the network layer, and the sending process of this step is not needed at this time.
  • the acquired quintuple needs to be sent to the network layer.
  • Sub-step A3332 at the network layer, based on the quintuple, re-encapsulating an IP packet header and a UDP packet header in addition to the data packet according to the rules of the network transmission protocol.
  • the network layer is based on a quintuple, and a UDP packet header is further encapsulated according to the UDP protocol in the data packet, and then an IP packet header is encapsulated according to the UDP protocol. .
  • the IP layer header and the TCP packet header may be further encapsulated according to the rules of the network transmission protocol in the network layer based on the quintuple according to the quintuple. Basically similar.
  • step 333 includes:
  • Sub-step B3331 the source port and the destination port in the quintuple are encapsulated into a UDP packet header other than the data packet.
  • the source port and the destination port in the quintuple are respectively encapsulated into a source port number and a destination port number in a UDP packet header other than the data packet.
  • the data applicable to any type of UDP packet header may be used, which is not limited in this embodiment of the present application.
  • Sub-step B3332 the source IP address, the destination IP address, and the transport protocol type in the quintuple are encapsulated into an IP packet header other than the data packet.
  • the source IP address, the destination IP address, and the transport protocol type in the quintuple are respectively encapsulated into numbers. According to the source port number, destination port number, and protocol in the IP packet header outside the packet. For the data of other parts in the IP packet header, data applicable to any type of IP packet header can be used, which is not limited in this embodiment of the present application.
  • the sub-step 332 includes:
  • Sub-step 3321 the application layer selects the same five-tuple according to the identity information.
  • the information contained in the quintuple exists in the application layer, so the same quintuple can be selected at the application layer according to the identity information.
  • the method further includes:
  • Sub-step 334 the quintuple obtained at the application layer is sent to the network layer.
  • the quintuple obtained at the application layer needs to be sent to the network layer. This step is performed before sub-step 333.
  • Step 340 Forward the data packet encapsulating the protocol header to the service entity responsible for responding to the client to which the data packet belongs.
  • the quintuple of the data packet for the same client is consistent.
  • the IP address of the same client is unique, the IP addresses of different clients are different, so different The quintuple of the client's data packets is inconsistent.
  • the service entity responsible for responding to different clients may be preset according to the quintuple.
  • the switch's HASH policy can be used to ensure that the same 5-tuple data packet is sent to the service entity corresponding to the quintuple.
  • Step 350 Release the protocol header encapsulated according to the rules of the network transmission protocol outside the data packet.
  • the IP packet header and the UDP packet header encapsulated in the data packet are released.
  • the protocol header encapsulated in the data packet is an IP packet header and a TCP packet header
  • the protocol header encapsulated outside the data packet is an IP packet header and a TCP packet header.
  • any of the existing decapsulation methods may be used to release the protocol header encapsulated according to the rules of the network transmission protocol in the data packet, which is not limited in this application.
  • Step 360 Acquire identity information of the data packet.
  • This step is similar to the foregoing sub-step 331 and will not be described again.
  • Step 370 Determine whether the traffic corresponding to the identity information exceeds a traffic threshold; if the traffic corresponding to the identity information exceeds the traffic threshold, proceed to step 380; and if the traffic corresponding to the identity information exceeds the traffic threshold, retain the The data packet corresponding to the identity information.
  • the traffic threshold is set in advance according to the actual situation, and is not limited in this embodiment.
  • the traffic corresponding to the identity information refers to the traffic of the data packet corresponding to the identity information, that is, the traffic of the data packet of the client corresponding to the identity information. If the traffic corresponding to the identity information exceeds the traffic threshold, the data packet corresponding to the identity information is discarded. If the traffic corresponding to the identity information does not exceed the traffic threshold, the data packet corresponding to the identity information is retained.
  • the traffic threshold is 50 M/s.
  • the terminal device corresponding to the user A calculates whether the traffic speed of the user A is greater than 50 M/s according to the data packet received within one second before the current time. If the data is greater than, the data is discarded. The package, if not greater, retains the packet.
  • step 370 when the identity information is an IP address, step 370 includes:
  • Sub-step 371 searching for a user ID corresponding to the IP address.
  • the traffic threshold is generally corresponding to the user ID. Therefore, in the embodiment of the present application, the user ID corresponding to the IP address is searched for according to the IP address.
  • the corresponding relationship between the IP address and the user ID is preset, and may be pre-placed in a configuration file or stored in other manners.
  • Sub-step 372 Search for a corresponding traffic threshold according to the user ID.
  • the corresponding relationship between the user ID and the traffic threshold is preset, and may be stored in a configuration file in advance, or may be stored in other manners.
  • the correspondence between the user and the traffic threshold and the corresponding relationship between the IP address and the user ID may be stored in the same configuration file, or may be stored in different configuration files, or used differently.
  • the storage method of the present application is not limited to the embodiment of the present application.
  • Sub-step 373 Calculate whether the traffic corresponding to the IP address exceeds the traffic threshold; if the traffic corresponding to the IP address exceeds the traffic threshold, proceed to step 380.
  • the traffic corresponding to the IP address refers to the traffic of the data packet corresponding to the IP address, that is, the traffic of the data packet of the client corresponding to the IP address.
  • step 380 the data packet is discarded.
  • the data packet is deleted from the client's traffic to ensure that the network speed of the client is within the browsing threshold.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure that the complexity of the system is not increased.
  • the traffic of the same client falls on the same service entity, and then the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet.
  • an IP packet header and a UDP packet header are encapsulated by the data packet sent by the client, which is received by the service entity, and then the encapsulated data packet is forwarded to be responsible for responding.
  • the service entity of the client to which the data packet belongs so that the data packet can be forwarded to the corresponding service entity without establishing a connection, thereby further improving the applicability, operability and accuracy of the cluster speed limit.
  • a connection needs to be established between the received service entity and the forwarded service entity before being forwarded between the two, so that relative to the embodiment
  • the manner in which the IP packet header and the TCP packet header are encapsulated in the data packet, and the manner of encapsulating the IP packet header and the UDP packet header in the data packet is adaptive and operability as described in the embodiment of the present application. More efficient.
  • the cluster includes at least one switch 410 and a plurality of service entities 420.
  • Each service entity may specifically include the following modules:
  • the receiving module 421 is adapted to receive a data packet.
  • the determining module 422 is adapted to determine whether the data packet is a data packet of a client that is responsible for the response. If the data packet is not the data packet of the client that is responsible for the response, the packet is forwarded to the forwarding module 423; if the data packet is the data packet of the client that is responsible for the response, the traffic rate module 424 is entered.
  • the forwarding module 423 is adapted to forward the data packet to a service entity responsible for responding to a client to which the data packet belongs.
  • the forwarding module includes:
  • the encapsulating submodule is adapted to encapsulate the protocol header in accordance with the identity of the network transport protocol in addition to the identity information of the data packet.
  • the forwarding submodule is adapted to forward the data packet encapsulating the protocol header to the service entity responsible for responding to the client to which the data packet belongs by using the switch.
  • the rate limiting module 424 is adapted to perform rate limiting processing on the data packet based on identity information of the data packet.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure the same The traffic of the client falls on the same service entity, and then the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet on the service entity. Therefore, the application has the following advantages:
  • the embodiment of the present application does not need to set a flow control entity in the cluster to limit the rate of the service entity in the entire cluster, and the entire cluster may not be affected by the fault of the flow control entity.
  • the normal work the applicability is strong.
  • the data packet of the same client is responsible for performing specific business logic processing by the same service entity, and determining whether to perform the next processing or discarding, therefore, Precise control of traffic to each client, high operability.
  • the embodiment of the present application improves the processing flow of the data packet under the original architecture of the cluster, and forwards the data packets of the same client received by each service entity to the same one.
  • the service entity performs speed limit processing without increasing system complexity, and does not use additional hardware facilities, and does not increase hardware costs.
  • the embodiment of the present application only utilizes the computing function of the cluster itself, that is, the speed limit processing of the traffic of the same client is implemented, and can be applied to a cluster of any size, and has wider applicability.
  • the three types of rate limiting schemes improve the applicability, operability, and accuracy of the cluster speed limit without increasing system complexity and cost.
  • the cluster includes at least one switch 510 and a plurality of service entities 520.
  • Each service entity may specifically include the following modules:
  • the receiving module 521 is adapted to receive a data packet.
  • the determining module 522 is adapted to determine whether the data packet is a data packet of a client that is responsible for the response by the client; if the data packet is not a data packet of the client that is responsible for the response, the data packet is forwarded to the forwarding module 523; The data packet of the client that is responsible for the response is entered into the rate limiting module 524.
  • the forwarding module 523 is adapted to forward the data packet to a service entity responsible for responding to the client to which the data packet belongs, including:
  • the encapsulating sub-module 5231 is adapted to encapsulate the protocol header according to the identity of the network packet according to the identity information of the data packet, and specifically includes:
  • a second encapsulation submodule 52311 adapted to follow the identity information of the data packet, in addition to the data packet
  • the rules of the network transmission protocol further encapsulate a layer of IP packet headers and TCP packet headers.
  • the second package submodule 52311 includes:
  • the identity information obtaining submodule is adapted to obtain identity information corresponding to the data packet.
  • a five-tuple selection sub-module configured to select the same five-tuple according to the identity information;
  • the five-tuple includes: a source IP address, a destination IP address, a source port, a destination port, and a transmission protocol type;
  • the IP address is the IP address corresponding to the service entity.
  • the second packet header encapsulating sub-module is adapted to further encapsulate an IP packet header and a TCP packet header according to the rules of the network transmission protocol according to the quintuple according to the quintuple.
  • the second packet header encapsulation submodule includes:
  • the second port encapsulation submodule is adapted to encapsulate the source port and the destination port in the quintuple into a TCP packet header outside the data packet.
  • the IP address encapsulating submodule is adapted to encapsulate the source IP address, the destination IP address, and the transport protocol type in the quintuple into an IP packet header other than the data packet.
  • the forwarding sub-module 5232 is adapted to forward the data packet encapsulating the protocol header to the service entity responsible for responding to the client to which the data packet belongs by using the switch.
  • the rate limiting module 524 is adapted to perform rate limiting processing on the data packet based on identity information of the data packet.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure that the complexity of the system is not increased.
  • the traffic of the same client falls on the same service entity, and then the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet.
  • the applicability, operability, and accuracy of the cluster speed limit are improved without increasing system complexity and cost.
  • an IP packet header and a TCP packet header are encapsulated by the data packet sent by the client, which is received by the service entity, and then the encapsulated data packet is forwarded to be responsible for responding.
  • the service entity of the client to which the data packet belongs in the embodiment of the present application, the connection between the entities needs to be established, and the accuracy of the data in the data packet can be further ensured, and the data packet is accurately forwarded to the corresponding service. In the entity, the accuracy of the cluster speed limit is further improved.
  • FIG. 6 there is shown a structural block diagram of an embodiment of a cluster precise speed limit device of the present application, the cluster including At least one switch 610 and multiple service entities 620, each of which may specifically include the following modules:
  • the receiving module 621 is adapted to receive a data packet.
  • the determining module 622 is adapted to determine whether the data packet is a data packet of a client that is responsible for responding by itself; if the data packet is not a data packet of a client that is responsible for the response, the method proceeds to the forwarding module 623; The data packet of the client that is responsible for the response is entered into the speed limit module 624. Specifically include:
  • the determining sub-module 6221 is adapted to determine whether the data packet is a data packet forwarded by the service entity or a data packet sent by the client; if the data packet is a data packet forwarded by the service entity, confirming that the data packet is The data packet of the client that is responsible for the response, and then enters the speed limit module 624; if the data packet is a data packet sent by the client, it is confirmed that the data packet is not the data packet of the client that is responsible for the response, and then enters the forwarding Module 623.
  • the determining submodule 6221 includes:
  • a protocol header judging sub-module adapted to determine, for any data packet, whether there is a protocol header encapsulated according to a rule of a network transmission protocol outside the data packet; if there is a network transmission protocol outside the data packet
  • the rule encapsulation protocol header confirms that the data packet is a data packet of the client that is responsible for the response, and then enters the rate limiting module 624; if there is no protocol encapsulated according to the rules of the network transmission protocol outside the data packet
  • the header confirms that the data packet is not the data packet of the client that is responsible for the response, and then enters the forwarding module 623.
  • the forwarding module 623 is adapted to forward the data packet to a service entity responsible for responding to the client to which the data packet belongs, including:
  • the encapsulating sub-module 6231 is adapted to encapsulate the protocol header according to the identity of the network packet according to the identity information of the data packet, and specifically includes:
  • the first encapsulation sub-module 62311 is adapted to re-encapsulate an IP packet header and a UDP packet header according to the rules of the network transmission protocol according to the identity information of the data packet.
  • the forwarding sub-module 6232 is adapted to forward the data packet encapsulating the protocol header to the service entity responsible for responding to the client to which the data packet belongs.
  • the first package sub-module 62311 includes:
  • the identity information obtaining submodule is adapted to obtain identity information corresponding to the data packet.
  • the identity information obtaining submodule includes:
  • a first identity information obtaining submodule configured to parse an IP packet header of the data packet at a network layer, To get an IP address.
  • the identity information obtaining submodule includes:
  • the sub-module is sent upwards, and is adapted to temporarily store the data packet in the network layer, and simultaneously send the data packet to the application layer.
  • the second identity information obtaining submodule is adapted to parse the data area of the data packet at the application layer to obtain a user ID of the data packet.
  • a five-tuple selection sub-module configured to select the same five-tuple according to the identity information;
  • the five-tuple includes: a source IP address, a destination IP address, a source port, a destination port, and a transmission protocol type;
  • the IP address is the IP address corresponding to the service entity.
  • the first packet header encapsulating sub-module is adapted to further encapsulate an IP packet header and a UDP packet header according to the rules of the network transmission protocol according to the quintuple according to the quintuple.
  • the quintuple selection submodule includes:
  • the application layer quintuple selection submodule is adapted to select the same quintuple according to the identity information at the application layer.
  • the application layer quintuple selects the submodule, it also includes:
  • the sending submodule is adapted to send the quintuple obtained at the application layer to the network layer.
  • the first packet header encapsulation submodule includes:
  • the first port encapsulation submodule is adapted to encapsulate the source port and the destination port in the quintuple into a UDP packet header outside the data packet.
  • the IP address encapsulating submodule is adapted to encapsulate the source IP address, the destination IP address, and the transport protocol type in the quintuple into an IP packet header other than the data packet.
  • the rate limiting module 624 is adapted to perform rate limiting processing on the data packet based on identity information of the data packet. Specifically include:
  • the release sub-module 6241 is adapted to release the protocol header encapsulated in accordance with the rules of the network transmission protocol outside the data packet.
  • the packet identity information obtaining sub-module 6242 is adapted to acquire identity information of the data packet.
  • the traffic judging sub-module 6243 is adapted to determine whether the traffic corresponding to the identity information exceeds a traffic threshold; if the traffic corresponding to the identity information exceeds the traffic threshold, the discarding sub-module 6244 is entered.
  • the traffic judgment sub-module includes:
  • the user ID search submodule is adapted to search for a user ID corresponding to the IP address.
  • the traffic threshold search submodule is configured to search for a corresponding traffic threshold according to the user ID.
  • the first traffic judging submodule is configured to calculate whether the traffic corresponding to the IP address exceeds the traffic threshold. If the traffic corresponding to the IP address exceeds the traffic threshold, the discarding sub-module 6244 is entered.
  • the discarding sub-module 6244 is adapted to discard the data packet.
  • the data packet of the client that is not responsible for the response is forwarded to the service entity in the same cluster that is responsible for responding to the client to which the data packet belongs, so as to ensure that the complexity of the system is not increased.
  • the traffic of the same client falls on the same service entity, and then the data packet of the client is subjected to rate limiting processing based on the identity information of the corresponding data packet.
  • the applicability, operability, and accuracy of the cluster speed limit are improved without increasing system complexity and cost.
  • an IP packet header and a UDP packet header are encapsulated by the data packet sent by the client, which is received by the service entity, and then the encapsulated data packet is forwarded to be responsible for responding.
  • the service entity of the client to which the data packet belongs so that the data packet can be forwarded to the corresponding service entity without establishing a connection, thereby further improving the applicability, operability and accuracy of the cluster speed limit.
  • a connection needs to be established between the received service entity and the forwarded service entity before being forwarded between the two, so that relative to the embodiment
  • the manner in which the IP packet header and the TCP packet header are encapsulated in the data packet, and the manner of encapsulating the IP packet header and the UDP packet header in the data packet is adaptive and operability as described in the embodiment of the present application. More efficient.
  • the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.
  • embodiments of the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer device includes one or more processors (CPUs), input/output connections Port, network interface and memory.
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include non-persistent computer readable media, such as modulated data signals and carrier waves.
  • Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing terminal device
  • Means are provided for implementing the functions specified in one or more of the flow or in one or more blocks of the flow chart.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the instruction device implements the functions specified in one or more blocks of the flowchart or in a flow or block of the flowchart.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种集群精确限速方法和装置，涉及计算机技术领域。本申请的方法包括：接收数据包；判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则将所述数据包转发给负责应对所述数据包所属客户端的服务实体；如果所述数据包是由自身负责应对的客户端的数据包，则基于所述数据包的身份信息，对所述数据包进行限速处理。本申请不用单独在集群内设置一个流控实体对整个集群内的服务实体进行限速，不会因为该流控实体的故障而影响整个集群的正常工作，适用性强。而且仅仅是服务实体之间的数据包的简单转发，复杂度低。

Description

一种集群精确限速方法和装置
本申请要求2016年03月25日递交的申请号为201610179863.9、发明名称为“一种集群精确限速方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别是涉及一种集群精确限速方法和一种集群精确限速装置。
背景技术
随着网络的普及，网络的应用环境也越来越多样化，例如利用由一组协同工作的服务实体构成的集群对多客户端或者多用户提供服务。在此类应用环境中，为了防止某一客户端的流量过大而影响其它客户端或者基于某一客户端所购买的宽带流量的需求，需要针对每个客户端或者用户的流量进行限速。由于集群中包含多个服务实体，例如服务器等。每个服务实体都同时提供服务，进而会造成同一客户端的流量会落到集群的多个服务实体上。这样如果每个服务实体单独限速，那么随着集群规模的扩大，每个客户端总的限速带宽也在扩大，因此需要提供一种精确的针对集群的全局的限速方案。
为了实现达到针对集群的精确限速的目的，目前主要存在如下三类方案：
第一类：集群内使用专门的流控实体，例如流控服务器等，用于控制每台服务实体的限速。流控实体负责监控服务实体上的每个限速单元的流量速率，并动态分配限速带宽大小。
第二类：集群内每个服务实体平均分配客户端或者用户购买的带宽，假设集群有N台服务实体，用户购买带宽大小为B，那么每台服务实体的限速大小就是B/N。
第三类：在客户端和集群之间提供专门的由具有限速功能的装置构成的限速结点。
但是对于上述的三类方法，均存在不同的缺点：
对于第一类方案，首先需要在集群内提供一个流控实体来控制限速，该流控实体如果故障，会影响集群的正常工作，适用性不强。其次，由于流控实体需要监控服务实体的流量速率，因此其需要与服务实体进行大量的通信来决策给每个服务实体下发的限速大小，复杂度较高。
对于第二类方案，首先很难保证每个客户端的流量均匀落到每个服务实体上，可操作性较低。其次如果客户端的流量不均匀，那么就会存在部分服务实体上针对某些客户端的流量大于具体的限速值，从而丢包，造成用户的实际带宽达不到其购买的带宽大小，精确性较低。
对于第三类方案，增加专门的限速结点，增加成本，对于小型集群不适用。
发明内容
鉴于上述问题，提出了本申请实施例以便提供一种克服上述问题或者至少部分地解决上述问题的一种集群精确限速方法和相应的一种集群精确限速装置。
为了解决上述问题，本申请公开了一种集群精确限速方法，包括：
接收数据包；
判断所述数据包是否为由自身负责应对的客户端的数据包；
如果所述数据包不是由自身负责应对的客户端的数据包，则将所述数据包转发给负责应对所述数据包所属客户端的服务实体；
如果所述数据包是由自身负责应对的客户端的数据包，则基于所述数据包的身份信息，对所述数据包进行限速处理。
优选地，所述将所述数据包转发给负责应对所述数据包所属客户端的服务实体的步骤，包括：
基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部；
将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
优选地，基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部的步骤，包括：
基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头，或者基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
优选地，所述基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头，或者基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头的步骤，包括：
获取所述数据包对应的身份信息；
根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址；
基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头；或者，
基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
优选地，当所述身份信息为IP地址时，所述获取所述数据包对应的身份信息的步骤包括：
在网络层解析所述数据包的IP报文头，以获取IP地址。
优选地，当所述身份信息为用户ID时，所述获取所述数据包对应的身份信息的步骤包括：
将所述数据包暂存在网络层，同时将所述数据包向上发送至应用层；
在应用层解析所述数据包的数据区，以获取所述数据包的用户ID。
优选地，所述根据所述身份信息，选择同一个五元组的步骤，包括：
在应用层根据所述身份信息，选择同一个五元组；
则在根据所述身份信息，选择同一个五元组的步骤之后，还包括：
将在应用层获得的五元组发送至网络层。
优选地，所述基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头的步骤，包括：
将所述五元组中的源端口、目的端口封装到所述数据包之外的UDP报文头中；
将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
优选地，所述基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头的步骤，包括：
将所述五元组中的源端口、目的端口封装到所述数据包之外的TCP报文头中；
将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
优选地，所述判断所述数据包是否为由自身负责应对的客户端的数据包的步骤，包括：
判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包；
如果所述数据包是由服务实体转发的数据包，则确认所述数据包是自身负责应对的客户端的数据包；
如果所述数据包是由客户端发送的数据包，则确认所述数据包不是由自身负责应对的客户端的数据包。
优选地，上述判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包的步骤，包括：
针对任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部；
如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则确认所述数据包是自身负责应对的客户端的数据包；
如果在所述数据包之外不存在按照网络传输协议的规则封装的协议头部，则确认所述数据包不是由自身负责应对的客户端的数据包。
优选地，所述基于所述数据包的身份信息，对所述数据包进行限速处理的步骤，包括：
解除所述数据包之外按照网络传输协议的规则封装的协议头部；
获取所述数据包的身份信息；
判断所述身份信息对应的流量是否超过到流量阈值；
如果所述身份信息对应的流量超过流量阈值，则丢弃所述数据包。
优选地，当所述身份信息为IP地址时，所述判断所述身份信息对应的流量是否达到阈值的步骤，包括：
查找所述IP地址对应的用户ID；
根据所述用户ID查找对应的流量阈值；
计算所述IP地址对应的流量是否超过所述流量阈值；
如果所述IP地址对应的流量超过所述流量阈值，则丢弃所述数据包。
相应地，本申请还公开了一种集群精确限速装置，包括：
接收模块，适于接收数据包；
判断模块，适于判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则进入转发模块；如果所述数据包是由自身负责应对的客户端的数据包，则进入限速模块；
转发模块，适于将所述数据包转发给负责应对所述数据包所属客户端的服务实体；
限速模块，适于基于所述数据包的身份信息，对所述数据包进行限速处理。
优选地，所述转发模块，包括：
封装子模块，适于基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部；
转发子模块，适于将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
优选地，所述封装子模块，包括：
第一封装子模块，适于基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头；
或者，第二封装子模块，适于基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
优选地，所述第一封装子模块，或者，第二封装子模块，包括：
身份信息获取子模块，适于获取所述数据包对应的身份信息；
五元组选择子模块，适于根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址；
第一报文头封装子模块，适于基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头；或者，第二报文头封装子模块，适于基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
优选地，其特征在于，当所述身份信息为IP地址时，所述身份信息获取子模块包括：
第一身份信息获取子模块，适于在网络层解析所述数据包的IP报文头，以获取IP地址。
优选地，当所述身份信息为用户ID时，所述身份信息获取子模块包括：
向上发送子模块，适于将所述数据包暂存在网络层，同时将所述数据包向上发送至应用层；
第二身份信息获取子模块，适于在应用层解析所述数据包的数据区，以获取所述数据包的用户ID。
优选地，所述五元组选择子模块，包括：
应用层五元组选择子模块，适于在应用层根据所述身份信息，选择同一个五元组；
则在五元组选择子模块之后，还包括：
发送子模块，适于将在应用层获得的五元组发送至网络层；
优选地，所述第一报文头封装子模块，包括：
第一端口封装子模块，适于将所述五元组中的源端口、目的端口封装到所述数据包之外的UDP报文头中；
IP地址封装子模块，适于将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
优选地，所述第二报文头封装子模块，包括：
第二端口封装子模块，适于将所述五元组中的源端口、目的端口封装到所述数据包之外的TCP报文头中；
IP地址封装子模块，适于将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
优选地，所述判断模块，包括：
判断子模块，适于判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包；如果所述数据包是由服务实体转发的数据包，则确认所述数据包是自身负责应对的客户端的数据包；如果所述数据包是由客户端发送的数据包，则确认所述数据包不是由自身负责应对的客户端的数据包。
优选地，所述判断子模块，包括：
协议头部判断子模块，适于针对任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部；如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则进入第一确认子模块；如果在所述数据包之外不存在按照网络传输协议的规则封装的协议头部，则进入第二确认子模块。
优选地，所述限速模块，包括：
解除子模块，适于解除所述数据包之外按照网络传输协议的规则封装的协议头部；
数据包身份信息获取子模块，适于获取所述数据包的身份信息；
流量判断子模块，适于判断所述身份信息对应的流量是否超过到流量阈值；如果所述身份信息对应的流量超过流量阈值，则进入丢弃子模块；
丢弃子模块，适于丢弃所述数据包。
优选地，当所述身份信息为IP地址时，所述流量判断子模块，包括：
用户ID查找子模块，适于查找所述IP地址对应的用户ID；
流量阈值查找子模块，适于根据所述用户ID查找对应的流量阈值；
第一流量判断子模块，适于计算所述IP地址对应的流量是否超过所述流量阈值；如果所述IP地址对应的流量超过所述流量阈值，则进入丢弃子模块。
本申请实施例包括以下优点：
本申请实施例，可以在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理。首先，相对背景技术的第一类方案，本申请实施例不用单独在集群内设置一个流控实体对整个集群内的服务实体进行限速，不会应为该流控实体的故障而影响整个集群的正常工作，适用性强。而且，也不存在流控实体与服务实体之间大量的通信以决策给每个服务实体下发的限速大小，仅仅是服务实体之间的数据包的简单转发，复杂度低。
其次，相对背景技术的第二类方案，本申请实施例由于同一个客户端的数据包由同一个服务实体负责对其进行具体的业务逻辑处理，决定对其进行下一步处理还是丢弃，因此，可以精确控制每个客户端的流量，可操作性高。
再次，相对背景技术的第三类方案，本申请实施例在集群的原有架构下，对数据包的处理流程做了改进，将各个服务实体接收到的同一客户端的数据包，转发到了同一个服务实体进行限速处理，未增加系统复杂度，也没有采用额外的硬件设施，没有增加硬件成本。并且，本申请实施例仅利用集群自身的计算功能，即实现了对同一客户端的流量的限速处理，可以适用于任意规模的集群，适用性更广。
总之，相对于背景技术，本申请实施例在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
附图说明
图1是本申请的一种集群精确限速方法实施例的步骤流程图；
图1A是本申请的一个应用场景示意图；
图2是本申请的另一种集群精确限速方法实施例的步骤流程图；
图3是本申请的另一种集群精确限速方法实施例的步骤流程图；
图4是本申请的一种集群精确限速装置实施例的结构框图；
图5是本申请的另一种集群精确限速装置实施例的结构框图；
图6是本申请的另一种集群精确限速装置实施例的结构框图。
具体实施方式
为使本申请的上述目的、特征和优点能够更加明显易懂，下面结合附图和具体实施方式对本申请作进一步详细的说明。
本申请实施例的核心构思之一在于，本申请提出的一种集群精确限速方法和装置，可以在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理。从而相对于背景技术，在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
实施例一
参照图1，示出了本申请的一种集群精确限速方法实施例的步骤流程图，具体可以包括如下步骤：
步骤110，接收数据包。
如图1A为本申请的一个应用场景示意图。可以看出，在集群内部存在4台服务实体，服务实体通过各个交换机与外部，例如客户端，进行通信，客户端发送的数据包先经过交换机，然后由交换机再分发到至少一台服务实体上来处理。
其中，集群是指一组协同工作的服务实体，用以提供比单一服务实体更具扩展性与可用性的服务平台。主要包括高可用集群(High Availability Cluster)，负载均衡集群(Load Balance Cluster)，科学计算集群(High Performance Computing Cluster)，本申请主要针对高可用集群和负载均衡集群。服务实体是可以提供某些服务的装置，例如服务器等，在本申请实施例中可以接收数据包并进行限速操作。
在互联网中，客户端与服务器交互，是先将其请求等信息以数据包的形式向服务器发送。而且在本申请中，由于集群中包含多个服务实体可以同时提供服务，进而造成同一客户端发送的数据包可能会落到集群中的多个服务实体上。
以现今的互联网为例，基本上采用的TCP/IP协议等互联网协议，那么TCP/IP协议的数据包(Data Packet)是TCP/IP(Transmission Control Protocol/Internet Protocol)协议通信传输中的数据单位，一般也称为“包”(Packet)，在网络信息传递过程中，单个 消息被划分为多个数据块，这些数据块就称为数据包，它包含发送者和接收者的地址信息。这些数据包然后沿着不同的路径在一个或多个网络中传输，并且在目的地重新组合。在实际应用中，数据包主要由报文头和数据两部分组成。
在实际应用中，TCP/IP协议是一个协议族，其包括TCP((Transmission Control Protocol，传输控制协议)、IP(Internet Protocol，网间网协议)、UDP(User Datagram Protocol，用户数据包协议)、ICMP(Internet Control Message Protocol，互联网控制信息协议)、RIP(Routing Information Protocol，路由信息协议)、SMTP(Simple Mail Transfer Protocol，简单邮件传输协议)、SNMP(Simple Network manage Protocol，简单网络管理协议)、ARP(Address Resolution Protocol，地址解析协议)、FTP(File Transfer Protocol，文件传输协议)等许多协议。TCP/IP协议采用分层结构，其分层模型及协议如下表(1)：
应用层(Application) HTTP、Telnet、FTP、SMTP、SNMP
传输层(Transport) TCP、UDP
网络层(Internet) IP【ARP、RARP、ICMP】
链路层(Link) Ethernet、X.25、SLIP、PPP
表(1)
不同的协议层对数据包有不同的称谓，在传输层叫做段(segment)，在网络层叫做数据报(datagram)，在链路层叫做帧(frame)。
本申请的一种集群精确限速方法，就是针对信息传输中的数据包进行限速，所以首先需要接收数据包。
步骤120，判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则进入步骤130；如果所述数据包是由自身负责应对的客户端的数据包，则进入步骤140。
在本申请实施例中，对于集群中各服务实体，可以由交换机根据一定算法确定集群中各服务实体自身负责应对的客户端，即集群中某一服务实体可以只对由该算法确定由自身负责应对的客户端发送的数据包进行限速，在本申请实施例中，此特定的客户端可以称为数据包自身负责应对的客户端。
所以，在接收到客户端的数据包后，需要进一步判断所述数据包是否为由自身负责应对的客户端的数据包，如果所述数据包不是由自身负责应对的客户端的数据包，考虑到服务实体只对由自己负责应对的客户端发送的数据包进行限速，所以此时需要将所述数据包转发至负责应对所述数据包所述客户端的服务实体；而如果所述数据包是由自身 负责应对的客户端的数据包，则可以直接基于所述数据包的身份信息，对所述数据包进行限速处理。
步骤130，将所述数据包转发给负责应对所述数据包所属客户端的服务实体。
如图1A所示的场景图示例，服务实体接收到客户端发送的数据包后，可以经过交换机，将接收到的不是由自身负责应对的数据包转发给负责应对所述数据包所属客户端的服务实体。例如，服务实体1接收到一数据包，该数据包所属的客户端是由服务实体3负责应对的，则在服务实体接收到该数据包后，会将该数据包再次发送至交换机1，然后交换机1再将该数据包发送至服务实体3。
在本申请另一优选的实施例中，步骤130包括：
子步骤131，基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部。
在本申请实施例中，可以基于数据包的身份信息，在数据包之外封装协议头部，且该协议头部是按照网络传输协议的规则封装在数据包之外的。
其中，数据包的身份信息可以包括用户ID，和/或客户端的IP地址等；网络传输协议(Communications Protocol)一般是指网络层协议和传输层协议，例如，表(1)中所示的IP(Internet Protocol，网络协议)协议、TCP协议、UDP协议等。实际应用中，TCP协议和UDP协议同一个数据包只会使用一种。
其中TCP协议和UDP协议的区别主要为以下几点：
1、TCP协议需要存在通信关系的对象之间进行连接，UDP协议不需要存在通信关系的对象之间进行连接；
2、TCP协议的传输速度较慢，UDP协议的传输速度较快；
3、TCP协议可以保证数据顺序，UDP协议不可以保证数据顺序；
4、TCP协议可以保证数据正确性，UDP协议则可能丢包；
5、TCP协议对系统资源要求多，UDP协议系统资源要求少。
因此，可以理解，本申请在所述数据包之外再按照网络传输协议的规则封装协议头部，可以按照IP协议+TCP协议或者IP协议+UDP协议的规则封装协议头部。
在实际应用中，在本申请封装上述协议头部时，会在协议头部中封装指示数据包所属客户端的身份信息等第一数据。对同一客户端来说，在其任意数据包的协议头部中封装的上述第一数据是唯一的，可以跟其他客户端区别开来。
子步骤132，将封装了协议头部的数据包通过交换机转发给负责应对所述数据包 所属客户端的服务实体。
在本申请实施例中，需要将同一客户端发送的数据包归并到预设的与该客户端对应的服务实体中，然后进行精确地限速，对于封装了协议头部的数据包，则可以根据协议头部的内容，利用交换机，将封装了协议头部的数据包转发给负责应对该数据包所属客户端的服务实体。
在实际应用中，可以利用交换机的HASH(哈希/散列)策略，将封装了协议头部的数据包准确地转发至负责对应该数据包所属客户端的服务实体。
在实际应用中，集群的交换机是对数据包的协议头部中的上述第一数据进行哈希，然后根据哈希结果，将数据包分发至相应的服务实体中。比如计算第一数据的哈希值，然后将该哈希值对服务实体的总个数取余数，然后根据余数与服务实体的对应关系，将该数据包发送至于该余数对应的服务实体中。
步骤140，基于所述数据包的身份信息，对所述数据包进行限速处理。
在实际应用中，集群需要对多个客户端提供服务，为了防止某一客户端的流量过大而影响其它客户端或者是导致该客户端的带宽收费较高等原因，需要针对每个客户端进行限速。在本申请实施例中，将各客户端的数据包全部归并到对该客户端对应的服务实体后，即可以利用一个服务实体实现对某客户端进行限速。
在实际应用中，可以首先根据不同的客户端预置不同的流量阈值，然后判断服务实体所对应接收的客户端的各数据包的流量是否超出该客户端对应的流量阈值的范围，若某一数据包的流量超出该客户端对应的流量阈值的范围，则可以将该数据包丢弃，而若数据包的流量未超出该客户端对应的流量阈值的范围，则保留该数据包。
在本申请实施例中，在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理，因此本申请具备以下优点：
首先，相对背景技术的第一类方案，本申请实施例不用单独在集群内设置一个流控实体对整个集群内的服务实体进行限速，不会应为该流控实体的故障而影响整个集群的正常工作，适用性强。而且，也不存在流控实体与服务实体之间大量的通信以决策给每个服务实体下发的限速大小，仅仅是服务实体之间的数据包的简单转发，复杂度低。
其次，相对背景技术的第二类方案，本申请实施例由于同一个客户端的数据包由同一个服务实体负责对其进行具体的业务逻辑处理，决定对其进行下一步处理还是丢弃， 因此，可以精确控制每个客户端的流量，可操作性高。
再次，相对背景技术的第三类方案，本申请实施例在集群的原有架构下，对数据包的处理流程做了改进，将各个服务实体接收到的同一客户端的数据包，转发到了同一个服务实体进行限速处理，未增加系统复杂度，也没有采用额外的硬件设施，没有增加硬件成本。并且，本申请实施例仅利用集群自身的计算功能，即实现了对同一客户端的流量的限速处理，可以适用于任意规模的集群，适用性更广。
总之，相对于背景技术的集群限速三类方案，在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
实施例二
参照图2，示出了本申请的一种集群精确限速方法实施例的步骤流程图，具体可以包括如下步骤：
步骤210，接收数据包。
步骤220，判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则进入步骤230；如果所述数据包是由自身负责应对的客户端的数据包，则进入步骤250。
步骤230，基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
基于前述的TCP的优点，为了保证数据包在转发过程中数据的正确性，在本申请实施例中，可以基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。按照TCP协议封装一层TCP报文头，再按照IP协议封装一层IP报文头。
其中，TCP是面向连接的传输协议，需要在需要通信的客户端和服务实体之间以及不同的服务实体之间建立连接关系。TCP采用“三次握手”的方式建立连接，以客户端和服务实体为例，具体步骤如下：
第一次握手：建立连接时，客户端发送syn包(syn＝j)到服务实体，并进入SYN_SEND状态，等待服务实体确认；
第二次握手：服务实体收到syn包，必须确认客户的SYN(ack＝j+1)，同时自己也发送一个SYN包(syn＝k)，即SYN+ACK包，此时服务实体进入SYN_RECV状态；
第三次握手：客户端收到服务实体的SYN+ACK包，向服务实体发送确认包 ACK(ack＝k+1)，此包发送完毕，客户端和服务实体进入ESTABLISHED状态，完成三次握手。
完成三次握手后，客户端与服务实体可以开始传送数据。
TCP报文头的数据格式如表(2)所示：
Figure PCTCN2017077285-appb-000001
表(2)
其中，序列号：TCP序号，即本报文段所发送的数据的第一个字节的序号。
确认号：即希望下次收到对方传送的数据的第一个字节的序号。
数据偏移：指出TCP报文段的数据起始处距离TCP报文段的距离，实际就是TCP头部长度。注意，数据偏移的单位不是字节而是32bit，即4字节。TVP首部最大长度为(2^4-1)*4＝60字节。
保留：保留为今后使用，目前统一置为0。
代码位：
1、URG：紧急比特。当URG＝1时，表明紧急指针字段有效。该报文应尽快传送。而不要按原来的队列顺序来传送。
2、ACK：确认比特。当ACK＝1时确认号字段才有效，ACK＝0时，表明确认号无效。
3、PSH：推送比特：按对队传输到对方，不用待缓存填满后再提交给上层，而是立即提交。
4、RST：复位比特。TCP连接中出现严重差错，必须立即释放并重新建立连接。也用于拒绝一个非法的报文段或拒绝打开一个连接。
5、SYN：同步比特。在连接建立时用来同步序号。当SYN＝1而ACK＝0时，表明这是一个连接请求报文段。对方若同意建立连接，则应在响应的报文段中使用SYN＝1 和ACK＝1。因此，SYN＝1时，就表明这是一个连接请求或连接接受。
6、FIN：终止比特。用来释放一个连接。当FIN＝1时，表明数据发送完毕，要求释放连接。
窗口：接收端告知自己的接收能力，即自己接收窗口的大小，发送方将按这个大小发送数据。
校验和：检验的范围包括首部和数据这两部分。在计算检验和时，要在TCP报文段的前面加上12字节的伪首部。
紧急指针：当紧急指针代码位被设置时为有效字段。如果有效，这个值指明了当前序列号的八位组的偏移值，即第一个非紧急数据的起始位置。
在本申请另一优选的实施例中，步骤230，包括：
子步骤231，获取所述数据包对应的身份信息；
子步骤232，根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址；
子步骤233，基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
若要在数据包之外再封装一层IP报文头和TCP报文头，则此时五元组中的传输协议类型为TCP协议，即在数据包之外是按照TCP协议的规则再封装一层IP报文头和TCP报文头。根据表(2)和表(4)分别所示的IP报文头结构和TCP报文头结构可知，在实际应用中，五元组中的源IP地址、目的IP地址、传输协议类型分别与IP报文头中的源地址、目的地址、协议一一对应，五元组中的源端口、目的端口分别与TCP报文头中的源端口号、目的端口号一一对应。对于IP报文头和TCP报文头中其他部分的内容，本申请实施例也不加以限定。
在本申请另一优选的实施例中，步骤233，包括：
子步骤2331，将所述五元组中的源端口、目的端口封装到所述数据包之外的TCP报文头中。
具体而言，是将五元组中的源端口、目的端口分别封装到数据包之外的TCP报文头中的源端口号、目的端口号中。对于TCP报文头中的其他部分的数据内容，可以采用任意一种TCP报文头适用的数据，对此本申请实施例不加以限定。
子步骤2332，将所述五元组中的源IP地址、目的IP地址和传输协议类型封 装到所述数据包之外的IP报文头中。
步骤240，将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
步骤250，基于所述数据包的身份信息，对所述数据包进行限速处理。
在本申请实施例中，同样在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理。相对于现有的集群限速三类方案，在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
另外，在本申请实施例中，通过在服务实体接收到的由客户端发送的数据包之外封装一层IP报文头和TCP报文头，然后再将封装后的数据包转发至负责应对该数据包所属的客户端的服务实体中，相对于UDP而言，本申请实施例需要在实体之间建立连接，可以进一步保证数据包中数据的准确性，将数据包准确地转发至相应地服务实体中，进一步提高了集群限速的精确性。
实施例三
参照图3，示出了本申请的另一种集群精确限速方法实施例的步骤流程图，具体可以包括如下步骤：
步骤310，接收数据包。
步骤320，判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包；如果所述数据包是由服务实体转发的数据包，则确认所述数据包不是由自身负责应对的客户端的数据包，然后进入步骤330；如果所述数据包是由客户端发送的数据包，则确认所述数据包是自身负责应对的客户端的数据包，然后进入步骤350。
由实施例一所述可知，在实际应用中，若服务实体接收到的数据包是由客户端的数据包，则会将该数据包转发至负责应对所述数据包所属客户端的服务实体，而且在转发之前，服务实体并不能确认其所接收的客户端发送的是数据包是否为自身负责应对的客户端发送的数据包。另外，一般而言，只需一次转发过程，即可以将该数据包转发至负责应对所述数据包所属客户端的服务实体。
在本申请实施例中，确认某一数据包不是由接收到该数据包的某服务实体自身应对的客户端的数据包，则表明该服务实体需要将接收到的该数据包进行转发操作，以将该 数据包转发至负责应对该数据包所属的客户端的服务实体中。
在本申请实施例中，确认某一数据包是由某服务实体自身应对的客户端的数据包，则表明该服务实体不需要将该数据包进行再次转发操。
所以在本申请实施例中，若服务实体所接收的数据包是由服务实体转发的数据包，则可以确认该数据包是由自身负责应对的客户端的数据包；而若服务实体所接收的数据包是由客户端发送的数据包，则可以先默认该数据包不是由该服务实体自身负责应对的客户端的数据包。该步骤是实施例一中步骤120的优选方案。需要说明的是，在本申请实施例中，服务实体所接收到的数据包可能是由其自身转发的数据包。
例如，对于服务实体A，其接收到两个数据包分别为：数据包a、数据包b，其中数据包a是由服务实体B转发的，数据包b是由客户端C发送的。则经过上述步骤，可以直接确认数据包a是由服务实体A负责应对的客户端的数据包，数据包b则不是由服务实体A负责应对的客户端的数据包。而且，在服务实体A对数据包b进行转发之前，并不能确认数据包b所属的客户端C是否为服务实体A负责应对的客户端，另外，其中的服务实体A和服务实体B可能为同一服务实体。
在本申请另一优选的实施例中，步骤320，包括：
子步骤321，针对任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部；如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则确认所述数据包是自身负责应对的客户端的数据包，然后进入步骤350；如果在所述数据包之外不存在按照网络传输协议的规则封装的协议头部，则确认所述数据包不是由自身负责应对的客户端的数据包，然后进入步骤330。
根据实施例一所述的内容，在本申请实施例中，若服务实体要对所接收到的数据包进行转发，则需要先在该数据包之外再按照网络传输协议的规则封装协议头部；若服务实体不对所接收到的数据包进行转发，则不需要在该数据包之外再按照网络传输协议的规则封装协议头部。
所以，在本申请实施例中，针对服务实体接收到的任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部。如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则说明该服务实体接收到的该数据包是由服务实体转发的数据包，从而可以确认该数据包是由该服务实体自身负责应对的客户端的数据包；如果在数据包之外不存在按照网络传输协议的规则封装的协议头部，则说明该服务实体接收到的该数据包是由客户端发送的数据包，从而可以确认该数据包不是由自身 负责应对的客户端的数据包。
步骤330，基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头。
如前述，若要对接收到的数据包进行转发，则需要先基于所述数据包的身份信息，在数据包之外按照网络传输协议的规则再封装协议头部。
其中，UDP是一种无连接的数据报服务。源服务实体在传送数据前不需要和目标服务实体建立连接。数据被冠以源、目标端口号等UDP报头字段后直接发往目的服务实体。这时，每个数据段的可靠性依靠上层协议来保证。在传送数据较少、较小的情况下，UDP比TCP更加高效。考虑到UDP协议不需要在通信的服务实体之间建立连接的特性，在本申请实施例中，基于数据包的身份信息，在数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头，从而可以避免在各服务实体之间建立连接的过程。在本申请实施例中，在数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头的过程并不会影响到数据包本身。
在实际应用中，IP报文头格式如表(3)所示：
Figure PCTCN2017077285-appb-000002
表(3)
其中，版本(Version)字段：占4比特。用来表明IP协议实现的版本号，当前一般为IPv4，即0100。
报头长度(Internet Header Length，IHL)字段：占4比特。是头部占32比特的数字，包括可选项。普通IP数据报(没有任何选项)，该字段的值是5，即160比特＝20字节。此字段最大值为60字节。
服务类型(Type of Service，TOS)字段：占8比特。其中前3比特为优先权子字段(Precedence，现已被忽略)。第8比特保留未用。第4至第7比特分别代表延迟、吞吐 量、可靠性和花费。当它们取值为1时分别代表要求最小时延、最大吞吐量、最高可靠性和最小费用。这4比特的服务类型中只能置其中1比特为1。可以全为0，若全为0则表示一般服务。服务类型字段声明了数据报被网络系统传输时可以被怎样处理。例如：TELNET协议可能要求有最小的延迟，FTP协议(数据)可能要求有最大吞吐量，SNMP协议可能要求有最高可靠性，NNTP(Network News Transfer Protocol，网络新闻传输协议)可能要求最小费用，而ICMP协议可能无特殊要求(4比特全为0)。实际上，大部分主机会忽略这个字段，但一些动态路由协议如OSPF(Open Shortest Path First Protocol)、IS-IS(Intermediate System to Intermediate System Protocol)可以根据这些字段的值进行路由决策。
总长度字段：占16比特。指明整个数据报的长度(以字节为单位)。最大长度为65535字节。
标志字段：占16比特。用来唯一地标识主机发送的每一份数据报。通常每发一份报文，它的值会加1。
标志位字段：占3比特。标志一份数据报是否要求分段。
段偏移字段：占13比特。如果一份数据报要求分段的话，此字段指明该段偏移距原始数据报开始的位置。
生存期(TTL：Time to Live)字段：占8比特。用来设置数据报最多可以经过的路由器数。由发送数据的源主机设置，通常为32、64、128等。每经过一个路由器，其值减1，直到0时该数据报被丢弃。
协议字段：占8比特。指明IP层所封装的上层协议类型，如ICMP(1)、IGMP(2)、TCP(6)、UDP(17)等。
头部校验和字段：占16比特。内容是根据IP头部计算得到的校验和码。计算方法是：对头部中每个16比特进行二进制反码求和。(和ICMP、IGMP、TCP、UDP不同，IP不对头部后的数据进行校验)。
源IP地址、目标IP地址字段：各占32比特。用来标明发送IP数据报文的源主机地址和接收IP报文的目标主机地址。
可选项字段：占32比特。用来定义一些任选项：如记录路径、时间戳等。这些选项很少被使用，同时并不是所有主机和路由器都支持这些选项。可选项字段的长度必须是32比特的整数倍，如果不足，必须填充0以达到此长度要求。
UDP报头文格式如表(4)所示：
Figure PCTCN2017077285-appb-000003
表(4)
其中，源、目标端口号字段：占16比特。用来标识源端和目标端的应用进程。
长度：占16比特，标明UDP报头和UDP数据的长度。
校验和：占16比特，用来对UDP报头和UDP数据进行校验。
在本申请另一优选的实施例中，步骤330包括：
子步骤331，获取所述数据包对应的身份信息。
如步骤330所述，在对数据包进行封装之前，首先需要获取数据包对应的身份信息。一般而言，数据包对应的身份信息可以为IP地址，如发送该数据包的客户端的IP地址，也可以为用户ID，如发送该数据包的用户ID。当然，用户身份也可以为其他可用的信息，对此本申请实施例不加以限定。
在本申请另一优选的实施例中，当所述身份信息为IP地址时，子步骤351，包括：
子步骤3311，在网络层解析所述数据包的IP报文头，以获取IP地址。
如果要获取的身份信息为IP地址，例如发送该数据包的客户端的IP地址。如表(1)所示，在TCP/IP协议的网络层支持IP协议，所以，在本申请实施例中，在网络层解析数据包的IP报文头，从中获取所需的IP地址。数据包的IP报文头是数据包本身的IP报文头，与在数据包之外再封装的IP报文头不相关，但是数据包本身的IP报文头的结构也如表(3)所示，其中的源地址即为本申请实施例所要获取的IP地址。对于具体的解析过程，可以采用现有技术中的任何一种可用的解析方法，对此本申请实施例不加以限定。
在本申请另一优选的实施例中，当所述身份信息为用户ID时，子步骤331，包括：
子步骤3312，将所述数据包暂存在网络层，同时将所述数据包向上发送至应用层。
而如果要获取的身份信息为用户ID时，例如发送该数据包的用户ID，此时需要在应用层才可以获取到用户ID等信息，所以在本申请实施例中会将数据包暂存在网络层的内存中，同时将数据包向上发送至应用层。在本申请实施例中网路层的IP数据包上传至传输层，传输层解析TCP报文头或者UDP报文头后，将数据区的内容上传至应用层。 应用层对数据区的内容进行解析。
子步骤3313，在应用层解析所述数据包的数据区，以获取所述数据包的用户ID。
在实际应用中，用户ID等信息被存放于数据包的数据区，将数据包发送至应用层后，则可以在应用层解析数据包的数据区，获取其中数据包的用户ID。同样对于具体的解析过程，可以采用现有技术中的任何一种可用的解析方法，对此本申请实施例也不加以限定。
子步骤332，根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址。
在实际应用中，五元组能够区分不同的通信，并且对应的通信是唯一的。所以在本申请实施例中，会根据身份信息，选择同一个五元组与该身份信息对应，则利用五元组，可以将不同的身份信息对应的用户终端完全区分开来。
在本申请实施例中，五元组包括的源IP地址是指用户端的IP地址，目的IP地址为服务实体对应的IP地址，源端口为用户终端发送数据包的端口，目的端口为服务实体接收数据包的端口，传输协议类型为发送数据包的具体的协议类型。
源端口可以采用客户端的端口的唯一标识ID，另外因为客户端的IP地址唯一，可以使用客户端IP地址的后2个字节作为源端口，当然也可以采用其他可利用的方式用以标识源端口，对此本申请实施例不加以限定。对于目的端口，使用固定的端口以唯一标记针对同一集群的数据包的目的端口。在本申请实施例中，传输协议类型和在数据包之外再封装的头部类型有关，例如，若传输协议类型为UDP协议，则在数据包外再封装一层IP报文头和UDP报文头；若传输协议类型为TCP协议，则在数据包外再封装一层IP报文头和TCP报文头。
需要说明的是，在本申请实施例中，所针对的是由一组协同工作的服务实体组成的集群，而且在实际应用中，集群服务实体对外提供的统一的服务地址，是虚拟IP地址，也称为集群VIP(Virtual IP，虚拟IP)地址，客户端通过访问集群VIP地址获取集群内部各服务实体的功能。所以上述的目的IP地址即为集群VIP地址，针对同一集群中的服务实体，五元组中的目的IP地址是一致的。
子步骤333，基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头。
若要在数据包之外再封装一层IP报文头和UDP报文头，则此时五元组中的传输协议类型为UDP协议，即在数据包之外是按照UDP协议的规则再封装一层IP报文头和UDP报文头。根据表(3)和表(4)分别所示的IP报文头结构和UDP报文头结构可知，在实际应用中，五元组中的源IP地址、目的IP地址、传输协议类型分别与IP报文头中的源地址、目的地址、协议一一对应，五元组中的源端口、目的端口分别与UDP报文头中的源端口号、目的端口号一一对应。对于IP报文头和UDP报文头中其他部分的内容，本申请实施例不加以限定。
在本申请另一优选的实施例中，步骤333包括：
子步骤A3331，将在应用层获得的五元组发送至网络层。
由于对数据包进行封装的操作需要在网络层进行，所以在本申请实施例中需要将在应用层获得的五元组发送至网络层。如前述，若是根据用户ID信息获取的五元组信息，则可以是在应用层获取的五元组，此时需要将在应用层获得的五元组发送至网络层，而若是根据IP地址获取的五元组，则可以是在网络层获取的五元组，此时不需要本步骤的发送过程。当然，不管是根据何种类型的用户信息获取的五元组，只要所获得的五元组不在网络层，都需要将获取的五元组发送至网络层。
子步骤A3332，在网络层基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头。
在本申请实施例中，具体而言，是由网络层基于五元组，在数据包之外按照UDP协议的规则再封装一层UDP报文头，再按照UDP协议封装一层IP报文头。
当然，对于本申请实施例也可以在，在网络层基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头，其原理基本类似。
在本申请另一优选的实施例中，步骤333包括：
子步骤B3331，将所述五元组中的源端口、目的端口封装到所述数据包之外的UDP报文头中。
具体而言，是将五元组中的源端口、目的端口分别封装到数据包之外的UDP报文头中的源端口号、目的端口号中。对于UDP报文头中的其他部分的数据内容，可以采用任意一种UDP报文头适用的数据，对此本申请实施例不加以限定。
子步骤B3332，将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
具体而言，是将五元组中的源IP地址、目的IP地址、传输协议类型分别封装到数 据包之外的IP报文头中的源端口号、目的端口号、协议中。对于IP报文头中的其他部分的数据，可以采用可任意一种IP报文头可适用的数据，对此本申请实施例也不加以限定。
在本申请的另一优选的实施例中，所述子步骤332包括：
子步骤3321，在应用层根据所述身份信息，选择同一个五元组。
在实际应用中，五元组所包含的信息存在于应用层中，所以可以在应用层根据所述身份信息，选择同一个五元组。
则在子步骤332之后，还包括：
子步骤334，将在应用层获得的五元组发送至网络层。
因为具体的根据五元组对数据包进行封装的过程在网络层执行，所以需要将在应用层获得的五元组发送至网络层。本步骤在子步骤333之前执行。
步骤340，将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
经过前述步骤可知，在本申请实施例中，针对同一客户端的数据包的五元组是一致的，另外，因为同一客户端的IP地址是唯一的，不同客户端的IP地址是不同的，所以针对不同客户端的数据包的五元组是不一致的。
在本申请实施例中，可以根据五元组，预先设定负责应对不同客户端的服务实体。在实际应用中，可以利用交换机的HASH策略保证将同一五元组的数据包发送到与该五元组对应的服务实体上。
步骤350，解除所述数据包之外按照网络传输协议的规则封装的协议头部。
在本申请实施例中，即解除数据包之外封装的IP报文头和UDP报文头，
当然，若是在数据包之外封装的协议头部为IP报文头和TCP报文头，则此时是解除数据包之外封装的协议头部为IP报文头和TCP报文头。
另外，在本申请实施例中，可以采用现有的任何一种解封装方法，解除数据包之外按照网络传输协议的规则封装的协议头部，对此本申请不加以限定。
步骤360，获取所述数据包的身份信息。
该步骤与前述的子步骤331类似，在此不再赘述。
步骤370，判断所述身份信息对应的流量是否超过到流量阈值；如果所述身份信息对应的流量超过流量阈值，则进入步骤380；而若所述身份信息对应的流量超过流量阈值，则保留该身份信息对应的数据包。
其中的流量阈值是可以根据实际情况预先设置，对此本申请实施例不加以限定。身份信息对应的流量是指该身份信息对应的数据包的流量，也即身份信息对应的客户端的数据包的流量。若身份信息对应的流量超过流量阈值，则将身份信息对应的数据包丢弃，若身份信息对应的流量未超过流量阈值，则保留身份信息对应的数据包。
例如，若用户A购买的带宽是50M/s，即流量阈值为50M/s。在用户A对应的终端设备收到当前数据包后，根据当前时刻到之前的1秒内收到的数据包记录，计算该用户A的流量速度是否大于50M/s，如果大于，则丢弃该数据包，如果不大于，则保留该数据包。
在本申请另一优选的实施例中，当所述身份信息为IP地址时，步骤370包括：
子步骤371，查找所述IP地址对应的用户ID。
在实际应用中，流量阈值一般是和用户ID对应的，所以在本申请实施例中，根据IP地址查找与之对应的用户ID。其中，IP地址与用户ID的对应关系是预置的，可以预先放置在一配置文件中，或者是通过其他方式存储，对此本申请实施例不加以限定。
子步骤372，根据所述用户ID查找对应的流量阈值。
用户ID与流量阈值的对应关系是预置的，可以预先存储于一配置文件中，或者是通过其他方式存储，对此本申请实施例不加以限定。
另外，在本申请实施例中，可以将用户与流量阈值的对应关系和上述的IP地址与用户ID的对应关系存储于同一配置文件中，也可以存储与不同的配置文件中，或者是利用不同的存储方式，对此本申请实施例也不加以限制。
子步骤373，计算所述IP地址对应的流量是否超过所述流量阈值；如果所述IP地址对应的流量超过所述流量阈值，则进入步骤380。
此时，IP地址对应的流量是指IP地址对应的数据包的流量，也即IP地址对应的客户端的数据包的流量。
步骤380，丢弃所述数据包。
若数据包的流量超过对应的流量阈值，则会将该数据包从客户端的流量中删除，以保证客户端的网络速度在浏览阈值之内。
在本申请实施例中，同样在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理。相对于现有的集群限速三类方案， 在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
另外，在本申请实施例中，通过在服务实体接收到的由客户端发送的数据包之外封装一层IP报文头和UDP报文头，然后再将封装后的数据包转发至负责应对该数据包所属的客户端的服务实体中，从而可以在不需要建立连接的情况下，将数据包转发至相应地服务实体中，进一步提高了集群限速的适用性、可操作性以及精确性。而且对于封装了IP报文头和TCP报文头的数据包，则需要先在接收的服务实体以及转发的服务实体之间建立连接，才可以在其两者之间转发，所以相对于实施例二中在数据包外封装IP报文头和TCP报文头的方式，本申请实施例所述的在数据包之外封装IP报文头和UDP报文头的方式适应性、可操作性以及效率都更高。
需要说明的是，对于方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请实施例并不受所描述的动作顺序的限制，因为依据本申请实施例，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请实施例所必须的。
实施例四
参照图4，示出了本申请的一种集群精确限速装置实施例的结构框图，该集群包括至少一个交换机410和多个服务实体420，每个服务实体具体可以包括如下模块：
接收模块421，适于接收数据包。
判断模块422，适于判断所述数据包是否为由自身负责应对的客户端的数据包。如果所述数据包不是由自身负责应对的客户端的数据包，则进入转发模块423；如果所述数据包是由自身负责应对的客户端的数据包，则进入限速模块424。
转发模块423，适于将所述数据包转发给负责应对所述数据包所属客户端的服务实体。
在本申请另一优选的实施例中，所述转发模块，包括：
封装子模块，适于基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部。
转发子模块，适于将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
限速模块424，适于基于所述数据包的身份信息，对所述数据包进行限速处理。
在本申请实施例中，在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理，因此本申请具备以下优点：
首先，相对背景技术的第一类方案，本申请实施例不用单独在集群内设置一个流控实体对整个集群内的服务实体进行限速，不会应为该流控实体的故障而影响整个集群的正常工作，适用性强。而且，也不存在流控实体与服务实体之间大量的通信以决策给每个服务实体下发的限速大小，仅仅是服务实体之间的数据包的简单转发，复杂度低。
其次，相对背景技术的第二类方案，本申请实施例由于同一个客户端的数据包由同一个服务实体负责对其进行具体的业务逻辑处理，决定对其进行下一步处理还是丢弃，因此，可以精确控制每个客户端的流量，可操作性高。
再次，相对背景技术的第三类方案，本申请实施例在集群的原有架构下，对数据包的处理流程做了改进，将各个服务实体接收到的同一客户端的数据包，转发到了同一个服务实体进行限速处理，未增加系统复杂度，也没有采用额外的硬件设施，没有增加硬件成本。并且，本申请实施例仅利用集群自身的计算功能，即实现了对同一客户端的流量的限速处理，可以适用于任意规模的集群，适用性更广。
总之，相对于背景技术的集群限速三类方案，在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
实施例五
参照图5，示出了本申请的一种集群精确限速装置实施例的结构框图，该集群包括至少一个交换机510和多个服务实体520，每个服务实体具体可以包括如下模块：
接收模块521，适于接收数据包。
判断模块522，适于判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则进入转发模块523；如果所述数据包是由自身负责应对的客户端的数据包，则进入限速模块524。
转发模块523，适于将所述数据包转发给负责应对所述数据包所属客户端的服务实体，具体包括：
封装子模块5231，适于基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部，具体包括：
第二封装子模块52311，适于基于所述数据包的身份信息，在所述数据包之外按照 网络传输协议的规则再封装一层IP报文头和TCP报文头。
在本申请另一优选的实施例中，第二封装子模块52311，包括：
身份信息获取子模块，适于获取所述数据包对应的身份信息。
五元组选择子模块，适于根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址。
第二报文头封装子模块，适于基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
在本申请另一优选的实施例中，所述第二报文头封装子模块，包括：
第二端口封装子模块，适于将所述五元组中的源端口、目的端口封装到所述数据包之外的TCP报文头中。
IP地址封装子模块，适于将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
转发子模块5232，适于将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
限速模块524，适于基于所述数据包的身份信息，对所述数据包进行限速处理。
在本申请实施例中，同样在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理。相对于现有的集群限速三类方案，在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
另外，在本申请实施例中，通过在服务实体接收到的由客户端发送的数据包之外封装一层IP报文头和TCP报文头，然后再将封装后的数据包转发至负责应对该数据包所属的客户端的服务实体中，相对于UDP而言，本申请实施例需要在实体之间建立连接，可以进一步保证数据包中数据的准确性，将数据包准确地转发至相应地服务实体中，进一步提高了集群限速的精确性。
实施例六
参照图6，示出了本申请的一种集群精确限速装置实施例的结构框图，该集群包括 至少一个交换机610和多个服务实体620，每个服务实体具体可以包括如下模块：
接收模块621，适于接收数据包。
判断模块622，适于判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则进入转发模块623；如果所述数据包是由自身负责应对的客户端的数据包，则进入限速模块624。具体包括：
判断子模块6221，适于判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包；如果所述数据包是由服务实体转发的数据包，则确认所述数据包是自身负责应对的客户端的数据包，然后进入限速模块624；如果所述数据包是由客户端发送的数据包，则确认所述数据包不是由自身负责应对的客户端的数据包，然后进入转发模块623。
在本申请另一优选的实施例中，判断子模块6221，包括：
协议头部判断子模块，适于针对任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部；如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则确认所述数据包是自身负责应对的客户端的数据包，然后进入限速模块624；如果在所述数据包之外不存在按照网络传输协议的规则封装的协议头部，则确认所述数据包不是由自身负责应对的客户端的数据包，然后进入转发模块623。
转发模块623，适于将所述数据包转发给负责应对所述数据包所属客户端的服务实体，具体包括：
封装子模块6231，适于基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部，具体包括：
第一封装子模块62311，适于基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头。
转发子模块6232，适于将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
在本申请另一优选的实施例中，第一封装子模块62311，包括：
身份信息获取子模块，适于获取所述数据包对应的身份信息。
在本申请另一优选的实施例中，当所述身份信息为IP地址时，所述身份信息获取子模块包括：
第一身份信息获取子模块，适于在网络层解析所述数据包的IP报文头， 以获取IP地址。
当所述身份信息为用户ID时，所述身份信息获取子模块包括：
向上发送子模块，适于将所述数据包暂存在网络层，同时将所述数据包向上发送至应用层。
第二身份信息获取子模块，适于在应用层解析所述数据包的数据区，以获取所述数据包的用户ID。
五元组选择子模块，适于根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址。
第一报文头封装子模块，适于基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头。
在本申请另一优选的实施例中，所述五元组选择子模块，包括：
应用层五元组选择子模块，适于在应用层根据所述身份信息，选择同一个五元组。
则在应用层五元组选择子模块之后，还包括：
发送子模块，适于将在应用层获得的五元组发送至网络层。
在本申请另一优选的实施例中，所述第一报文头封装子模块，包括：
第一端口封装子模块，适于将所述五元组中的源端口、目的端口封装到所述数据包之外的UDP报文头中。
IP地址封装子模块，适于将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
限速模块624，适于基于所述数据包的身份信息，对所述数据包进行限速处理。具体包括：
解除子模块6241，适于解除所述数据包之外按照网络传输协议的规则封装的协议头部。
数据包身份信息获取子模块6242，适于获取所述数据包的身份信息。
流量判断子模块6243，适于判断所述身份信息对应的流量是否超过到流量阈值；如果所述身份信息对应的流量超过流量阈值，则进入丢弃子模块6244。
在本申请另一优选的实施例中，当所述身份信息为IP地址时，所述流量判断子模块，包括：
用户ID查找子模块，适于查找所述IP地址对应的用户ID。
流量阈值查找子模块，适于根据所述用户ID查找对应的流量阈值。
第一流量判断子模块，适于计算所述IP地址对应的流量是否超过所述流量阈值。如果所述IP地址对应的流量超过所述流量阈值，则进入丢弃子模块6244。
丢弃子模块6244，适于丢弃所述数据包。
在本申请实施例中，同样在不需要增加系统复杂度的情况下，通过将不是由自身负责应对的客户端的数据包，转发给同一集群中负责应对该数据包所属客户端的服务实体，从而保证同一客户端的流量落到同一台服务实体上，然后在该服务实体上，基于对应数据包的身份信息，对该客户端的数据包进行限速处理。相对于现有的集群限速三类方案，在不增加系统复杂度以及成本的同时，提高了集群限速的适用性、可操作性，以及精确性。
另外，在本申请实施例中，通过在服务实体接收到的由客户端发送的数据包之外封装一层IP报文头和UDP报文头，然后再将封装后的数据包转发至负责应对该数据包所属的客户端的服务实体中，从而可以在不需要建立连接的情况下，将数据包转发至相应地服务实体中，进一步提高了集群限速的适用性、可操作性以及精确性。而且对于封装了IP报文头和TCP报文头的数据包，则需要先在接收的服务实体以及转发的服务实体之间建立连接，才可以在其两者之间转发，所以相对于实施例二中在数据包外封装IP报文头和TCP报文头的方式，本申请实施例所述的在数据包之外封装IP报文头和UDP报文头的方式适应性、可操作性以及效率都更高。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本说明书中的各个实施例均采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似的部分互相参见即可。
本领域内的技术人员应明白，本申请实施例的实施例可提供为方法、装置、或计算机程序产品。因此，本申请实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
在一个典型的配置中，所述计算机设备包括一个或多个处理器(CPU)、输入/输出接 口、网络接口和内存。内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非持续性的电脑可读媒体(transitory media)，如调制的数据信号和载波。
本申请实施例是参照根据本申请实施例的方法、终端设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理终端设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理终端设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理终端设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理终端设备上，使得在计算机或其他可编程终端设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程终端设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请实施例的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请实施例范围的所有变更和修改。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将 一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者终端设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者终端设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者终端设备中还存在另外的相同要素。
以上对本申请所提供的一种集群精确限速方法和一种集群精确限速装置，进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (26)

  1. 一种集群精确限速方法，其特征在于，包括：
    接收数据包；
    判断所述数据包是否为由自身负责应对的客户端的数据包；
    如果所述数据包不是由自身负责应对的客户端的数据包，则将所述数据包转发给负责应对所述数据包所属客户端的服务实体；
    如果所述数据包是由自身负责应对的客户端的数据包，则基于所述数据包的身份信息，对所述数据包进行限速处理。
  2. 根据权利要求1所述的方法，其特征在于，所述将所述数据包转发给负责应对所述数据包所属客户端的服务实体的步骤，包括：
    基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部；
    将封装了协议头部的数据包通过交换机转发给负责应对所述数据包所属客户端的服务实体。
  3. 根据权利要求2所述的方法，其特征在于，基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部的步骤，包括：
    基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头，或者基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
  4. 根据权利要求3所述的方法，其特征在于，所述基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头，或者基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头的步骤，包括：
    获取所述数据包对应的身份信息；
    根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址；
    基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头；或者，
    基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
  5. 根据权利要求4所述的方法，其特征在于，
    当所述身份信息为IP地址时，所述获取所述数据包对应的身份信息的步骤包括：
    在网络层解析所述数据包的IP报文头，以获取IP地址。
  6. 根据权利要求4所述的方法，其特征在于，
    当所述身份信息为用户ID时，所述获取所述数据包对应的身份信息的步骤包括：
    将所述数据包暂存在网络层，同时将所述数据包向上发送至应用层；
    在应用层解析所述数据包的数据区，以获取所述数据包的用户ID。
  7. 根据权利要求4所述的方法，其特征在于，所述根据所述身份信息，选择同一个五元组的步骤，包括：
    在应用层根据所述身份信息，选择同一个五元组；
    则在根据所述身份信息，选择同一个五元组的步骤之后，还包括：
    将在应用层获得的五元组发送至网络层。
  8. 根据权利要求4所述的方法，其特征在于，所述基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头的步骤，包括：
    将所述五元组中的源端口、目的端口封装到所述数据包之外的UDP报文头中；
    将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
  9. 根据权利要求4所述的方法，其特征在于，所述基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头的步骤，包括：
    将所述五元组中的源端口、目的端口封装到所述数据包之外的TCP报文头中；
    将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
  10. 根据权利要求2-9其中之一所述的方法，其特征在于，所述判断所述数据包是否为由自身负责应对的客户端的数据包的步骤，包括：
    判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包；
    如果所述数据包是由服务实体转发的数据包，则确认所述数据包是自身负责应对的客户端的数据包；
    如果所述数据包是由客户端发送的数据包，则确认所述数据包不是由自身负责应对的客户端的数据包。
  11. 根据权利要求10所述的方法，其特征在于，上述判断所述数据包是由服务实体 转发的数据包还是由客户端发送的数据包的步骤，包括：
    针对任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部；
    如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则确认所述数据包是自身负责应对的客户端的数据包；
    如果在所述数据包之外不存在按照网络传输协议的规则封装的协议头部，则确认所述数据包不是由自身负责应对的客户端的数据包。
  12. 根据权利要求2-9其中之一所述的方法，其特征在于，所述基于所述数据包的身份信息，对所述数据包进行限速处理的步骤，包括：
    解除所述数据包之外按照网络传输协议的规则封装的协议头部；
    获取所述数据包的身份信息；
    判断所述身份信息对应的流量是否超过到流量阈值；
    如果所述身份信息对应的流量超过流量阈值，则丢弃所述数据包。
  13. 根据权利要求12所述的方法，其特征在于，当所述身份信息为IP地址时，所述判断所述身份信息对应的流量是否达到阈值的步骤，包括：
    查找所述IP地址对应的用户ID；
    根据所述用户ID查找对应的流量阈值；
    计算所述IP地址对应的流量是否超过所述流量阈值；
    如果所述IP地址对应的流量超过所述流量阈值，则丢弃所述数据包。
  14. 一种集群精确限速装置，其特征在于，包括：
    接收模块，适于接收数据包；
    判断模块，适于判断所述数据包是否为由自身负责应对的客户端的数据包；如果所述数据包不是由自身负责应对的客户端的数据包，则进入转发模块；如果所述数据包是由自身负责应对的客户端的数据包，则进入限速模块；
    转发模块，适于将所述数据包转发给负责应对所述数据包所属客户端的服务实体；
    限速模块，适于基于所述数据包的身份信息，对所述数据包进行限速处理。
  15. 根据权利要求14所述的装置，其特征在于，所述转发模块，包括：
    封装子模块，适于基于所述数据包的身份信息，在所述数据包之外再按照网络传输协议的规则封装协议头部；
    转发子模块，适于将封装了协议头部的数据包通过交换机转发给负责应对所述数据 包所属客户端的服务实体。
  16. 根据权利要求15所述的装置，其特征在于，所述封装子模块，包括：
    第一封装子模块，适于基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头；
    或者，第二封装子模块，适于基于所述数据包的身份信息，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
  17. 根据权利要求16所述的装置，其特征在于，所述第一封装子模块，或者，第二封装子模块，包括：
    身份信息获取子模块，适于获取所述数据包对应的身份信息；
    五元组选择子模块，适于根据所述身份信息，选择同一个五元组；所述五元组包括：源IP地址，目的IP地址，源端口，目的端口，传输协议类型；所述目的IP地址为服务实体对应的IP地址；
    第一报文头封装子模块，适于基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和UDP报文头；或者，第二报文头封装子模块，适于基于所述五元组，在所述数据包之外按照网络传输协议的规则再封装一层IP报文头和TCP报文头。
  18. 根据权利要求17所述的装置，其特征在于，
    当所述身份信息为IP地址时，所述身份信息获取子模块包括：
    第一身份信息获取子模块，适于在网络层解析所述数据包的IP报文头，以获取IP地址。
  19. 根据权利要求17所述的装置，其特征在于，
    当所述身份信息为用户ID时，所述身份信息获取子模块包括：
    向上发送子模块，适于将所述数据包暂存在网络层，同时将所述数据包向上发送至应用层；
    第二身份信息获取子模块，适于在应用层解析所述数据包的数据区，以获取所述数据包的用户ID。
  20. 根据权利要求17所述的装置，其特征在于，所述五元组选择子模块，包括：
    应用层五元组选择子模块，适于在应用层根据所述身份信息，选择同一个五元组；
    则在五元组选择子模块之后，还包括：
    发送子模块，适于将在应用层获得的五元组发送至网络层。
  21. 根据权利要求17所述的装置，其特征在于，所述第一报文头封装子模块，包括：
    第一端口封装子模块，适于将所述五元组中的源端口、目的端口封装到所述数据包之外的UDP报文头中；
    IP地址封装子模块，适于将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
  22. 根据权利要求17所述的装置，其特征在于，所述第二报文头封装子模块，包括：
    第二端口封装子模块，适于将所述五元组中的源端口、目的端口封装到所述数据包之外的TCP报文头中；
    IP地址封装子模块，适于将所述五元组中的源IP地址、目的IP地址和传输协议类型封装到所述数据包之外的IP报文头中。
  23. 根据权利要求15-22其中之一所述的装置，其特征在于，所述判断模块，包括：
    判断子模块，适于判断所述数据包是由服务实体转发的数据包还是由客户端发送的数据包；如果所述数据包是由服务实体转发的数据包，则确认所述数据包是自身负责应对的客户端的数据包；如果所述数据包是由客户端发送的数据包，则确认所述数据包不是由自身负责应对的客户端的数据包。
  24. 根据权利要求23所述的装置，其特征在于，所述判断子模块，包括：
    协议头部判断子模块，适于针对任一数据包，判断在所述数据包之外是否存在按照网络传输协议的规则封装的协议头部；如果在所述数据包之外存在按照网络传输协议的规则封装的协议头部，则进入第一确认子模块；如果在所述数据包之外不存在按照网络传输协议的规则封装的协议头部，则进入第二确认子模块。
  25. 根据权利要求15-22其中之一所述的装置，其特征在于，所述限速模块，包括：
    解除子模块，适于解除所述数据包之外按照网络传输协议的规则封装的协议头部；
    数据包身份信息获取子模块，适于获取所述数据包的身份信息；
    流量判断子模块，适于判断所述身份信息对应的流量是否超过到流量阈值；如果所述身份信息对应的流量超过流量阈值，则进入丢弃子模块；
    丢弃子模块，适于丢弃所述数据包。
  26. 根据权利要求25所述的装置，其特征在于，当所述身份信息为IP地址时，所述流量判断子模块，包括：
    用户ID查找子模块，适于查找所述IP地址对应的用户ID；
    流量阈值查找子模块，适于根据所述用户ID查找对应的流量阈值；
    第一流量判断子模块，适于计算所述IP地址对应的流量是否超过所述流量阈值；如果所述IP地址对应的流量超过所述流量阈值，则进入丢弃子模块。
PCT/CN2017/077285 2016-03-25 2017-03-20 一种集群精确限速方法和装置 WO2017162117A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610179863.9A CN107231269B (zh) 2016-03-25 2016-03-25 一种集群精确限速方法和装置
CN201610179863.9 2016-03-25

Publications (1)

Publication Number Publication Date
WO2017162117A1 true WO2017162117A1 (zh) 2017-09-28

Family

ID=59899247

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/077285 WO2017162117A1 (zh) 2016-03-25 2017-03-20 一种集群精确限速方法和装置

Country Status (3)

Country Link
CN (1) CN107231269B (zh)
TW (1) TWI721103B (zh)
WO (1) WO2017162117A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021243649A1 (zh) * 2020-06-04 2021-12-09 深圳市欢太科技有限公司 限速带宽调整方法及装置
CN114301960A (zh) * 2021-12-15 2022-04-08 山石网科通信技术股份有限公司 集群非对称流量的处理方法及装置、电子设备及存储介质
CN114338543A (zh) * 2022-03-14 2022-04-12 北京指掌易科技有限公司 一种网络访问限速方法、装置、设备及存储介质
CN115174482A (zh) * 2019-05-21 2022-10-11 超聚变数字技术有限公司 网络设备的报文分流方法和装置
CN117255058A (zh) * 2023-11-17 2023-12-19 深圳万物安全科技有限公司 网络限速方法、终端设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112039796B (zh) * 2020-08-28 2023-04-18 北京字节跳动网络技术有限公司 数据包传输方法和装置、存储介质和电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101938502A (zh) * 2009-07-14 2011-01-05 北京邮电大学 一种服务器集群系统及负载均衡方法
CN103581036A (zh) * 2013-10-31 2014-02-12 华为技术有限公司 一种虚拟机网络流量的控制方法、装置和系统
CN104364761A (zh) * 2012-06-15 2015-02-18 思杰系统有限公司 用于在集群网络中转发流量的系统和方法
US20150236959A1 (en) * 2012-07-23 2015-08-20 F5 Networks, Inc. Autonomously adaptive flow acceleration based on load feedback
CN105227488A (zh) * 2015-08-25 2016-01-06 上海交通大学 一种用于分布式计算机平台的网络流组调度方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102385804A (zh) * 2010-08-30 2012-03-21 谈宇清 一种智能交通系统及其导航方法
CN102025640A (zh) * 2010-12-24 2011-04-20 北京星网锐捷网络技术有限公司 流量控制方法、装置及网络设备
CN102882799B (zh) * 2012-09-13 2017-09-01 曙光信息产业(北京)有限公司 流量可控的集群部署配置系统与方法
WO2015042773A1 (zh) * 2013-09-24 2015-04-02 华为技术有限公司 一种接入点配置方法和控制器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101938502A (zh) * 2009-07-14 2011-01-05 北京邮电大学 一种服务器集群系统及负载均衡方法
CN104364761A (zh) * 2012-06-15 2015-02-18 思杰系统有限公司 用于在集群网络中转发流量的系统和方法
US20150236959A1 (en) * 2012-07-23 2015-08-20 F5 Networks, Inc. Autonomously adaptive flow acceleration based on load feedback
CN103581036A (zh) * 2013-10-31 2014-02-12 华为技术有限公司 一种虚拟机网络流量的控制方法、装置和系统
CN105227488A (zh) * 2015-08-25 2016-01-06 上海交通大学 一种用于分布式计算机平台的网络流组调度方法

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115174482A (zh) * 2019-05-21 2022-10-11 超聚变数字技术有限公司 网络设备的报文分流方法和装置
CN115174482B (zh) * 2019-05-21 2023-06-02 超聚变数字技术有限公司 网络设备的报文分流方法和装置
WO2021243649A1 (zh) * 2020-06-04 2021-12-09 深圳市欢太科技有限公司 限速带宽调整方法及装置
CN114301960A (zh) * 2021-12-15 2022-04-08 山石网科通信技术股份有限公司 集群非对称流量的处理方法及装置、电子设备及存储介质
CN114301960B (zh) * 2021-12-15 2024-03-15 山石网科通信技术股份有限公司 集群非对称流量的处理方法及装置、电子设备及存储介质
CN114338543A (zh) * 2022-03-14 2022-04-12 北京指掌易科技有限公司 一种网络访问限速方法、装置、设备及存储介质
CN114338543B (zh) * 2022-03-14 2022-06-21 北京指掌易科技有限公司 一种网络访问限速方法、装置、设备及存储介质
CN117255058A (zh) * 2023-11-17 2023-12-19 深圳万物安全科技有限公司 网络限速方法、终端设备及存储介质
CN117255058B (zh) * 2023-11-17 2024-02-23 深圳万物安全科技有限公司 网络限速方法、终端设备及存储介质

Also Published As

Publication number Publication date
CN107231269B (zh) 2020-04-07
TWI721103B (zh) 2021-03-11
TW201737664A (zh) 2017-10-16
CN107231269A (zh) 2017-10-03

Similar Documents

Publication Publication Date Title
WO2017162117A1 (zh) 一种集群精确限速方法和装置
US20200358886A1 (en) Data Transmission Method, Apparatus, And System
US7065086B2 (en) Method and system for efficient layer 3-layer 7 routing of internet protocol (“IP”) fragments
US10574763B2 (en) Session-identifer based TWAMP data session provisioning in computer networks
KR101506849B1 (ko) 정보 중심 네트워크를 위한 일반화된 듀얼 모드 데이터 포워딩 플레인
WO2023005773A1 (zh) 基于远程直接数据存储的报文转发方法、装置、网卡及设备
WO2019029318A1 (zh) 网络拥塞的通告方法、代理节点及计算机设备
US10263950B2 (en) Directing clients based on communication format
WO2019134383A1 (zh) 控制网络拥塞的方法、接入设备和计算机可读存储介质
US11489945B2 (en) TCP packet processing method, toe component, and network device
JP2008524891A (ja) データ破壊を避けることによる改善されたネットワーク性能のための方法、システム及び物品
WO2021047515A1 (zh) 一种服务路由方法及装置
US20220091754A1 (en) Methods and systems for nvme target load balancing based on real time metrics
US10009282B2 (en) Self-protecting computer network router with queue resource manager
WO2014023003A1 (zh) 控制数据传输的方法、装置和系统
CN111567011B (zh) 使用跨层信息提高视频服务和WEB服务的QoE的方法
CN113228571B (zh) 用于从驻地网络访问云服务的网络优化的方法和设备
WO2019243890A2 (en) Multi-port data transmission via udp
WO2022001287A1 (zh) 一种报文处理的方法及设备
WO2020249128A1 (zh) 一种服务路由方法及装置
US10374944B2 (en) Quality of service for data transmission
WO2023174170A1 (zh) 报文处理方法、报文校验方法和装置
Shah Comparing TCP-IPv4/TCP-IPv6 Network Performance
WO2023040782A1 (zh) 处理报文的方法、系统、设备和存储介质
WO2023005723A1 (zh) 一种报文传输方法以及通信装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17769394

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17769394

Country of ref document: EP

Kind code of ref document: A1