WO2018024187A1 - 报文监控 - Google Patents

报文监控 Download PDF

Info

Publication number
WO2018024187A1
WO2018024187A1 PCT/CN2017/095387 CN2017095387W WO2018024187A1 WO 2018024187 A1 WO2018024187 A1 WO 2018024187A1 CN 2017095387 W CN2017095387 W CN 2017095387W WO 2018024187 A1 WO2018024187 A1 WO 2018024187A1
Authority
WO
WIPO (PCT)
Prior art keywords
vtep
packet
monitoring server
address
forwarding entry
Prior art date
Application number
PCT/CN2017/095387
Other languages
English (en)
French (fr)
Inventor
宋小恒
Original Assignee
新华三技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三技术有限公司 filed Critical 新华三技术有限公司
Priority to EP17836369.3A priority Critical patent/EP3493477B1/en
Priority to JP2019505173A priority patent/JP6928076B2/ja
Priority to US16/322,387 priority patent/US10938679B2/en
Publication of WO2018024187A1 publication Critical patent/WO2018024187A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the controller can monitor the packets of the VM (Virtual Machine): the VTEP (VXLAN Tunnel End Point) that the controller accesses to the monitored VM. , VXLAN tunnel endpoint) sends Openflow (open flow) flow entries. After receiving the user packet, the VTEP can match the source address or the destination address of the user packet with the flow entry. If the match is matched, the user packet is mirrored and the obtained mirrored packet is forwarded to the controller.
  • VM Virtual Machine
  • VXLAN tunnel endpoint Openflow (open flow) flow entries.
  • the VTEP forwards the user message sent by the monitoring VM and the mirror of the user message sent to the VM to the controller for monitoring.
  • FIG. 1 is a networking diagram of an SDN according to an exemplary embodiment of the present disclosure
  • FIG. 2 is a flowchart of a forwarding entry configuration process performed after a VTEP accessed by a monitored host receives monitoring configuration information according to an exemplary embodiment of the present disclosure
  • FIG. 3 is a schematic diagram showing the format of an extended VXLAN header according to an exemplary embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a format of a BGP packet carrying monitoring configuration information according to an exemplary embodiment of the present disclosure
  • FIG. 5 is a flowchart of a forwarding entry configuration process performed after a VTEP that is not accessed by a monitored host receives monitoring configuration information according to an exemplary embodiment of the present disclosure
  • FIG. 6 is a flowchart of a process for forwarding a message after receiving a message by a VTEP according to an exemplary embodiment of the present disclosure
  • FIG. 7 is a flowchart of a process for forwarding a user message after receiving a user message by the VTEP according to an exemplary embodiment of the present disclosure
  • FIG. 8 is a flowchart of a process for forwarding a VXLAN message after receiving a VXLAN message by a VTEP according to an exemplary embodiment of the present disclosure
  • FIG. 9 is a flowchart of a process of updating a forwarding entry after a VTEP receives an address of a monitoring server according to an exemplary embodiment of the present disclosure
  • FIG. 10 is a schematic diagram of networking after the VM 10 in FIG. 1 is migrated;
  • FIG. 11 is a schematic diagram of networking after the SERV21 in FIG. 10 is migrated;
  • FIG. 12 is a schematic diagram showing the hardware structure of a VTEP according to an exemplary embodiment of the present disclosure
  • FIG. 13 is a schematic structural diagram of a VTEP according to an exemplary embodiment of the present disclosure.
  • FIG. 14 is another schematic structural diagram of a VTEP according to an exemplary embodiment of the present disclosure.
  • FIG. 15 is a schematic diagram showing still another structure of a VTEP according to an exemplary embodiment of the present disclosure.
  • first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information without departing from the scope of the present disclosure.
  • second information may also be referred to as first information.
  • word "if” as used herein may be interpreted as "when” or “when” or “in response to a determination.”
  • the data streams of all monitored VMs need to be forwarded to the controller for monitoring.
  • the CPU Central Processing Unit
  • the following embodiments of the present disclosure provide a message monitoring method, and a VTEP to which the method can be applied.
  • an EVPN (Ethernet Virtual Private Network) technology is applied in the SDN as shown in FIG. That is, the EVPN is used as the bearer network of the SDN.
  • the BGP Border Gateway Protocol
  • the VXLAN encapsulation mode is used to forward user packets on the data plane.
  • the controller 100, the routers R10 and R20, and the VTEPs 101 to 104 are included.
  • the host connected to each VTEP may be a VM or a physical device, which is not limited in this disclosure.
  • VMs 210 through 240 and server SERV 21 are connected to respective VTEPs.
  • the message monitoring method of the embodiment of the present disclosure includes the following contents:
  • the controller 100 can obtain information about the host connected to the VTEP from each VTEP, where the information of the host includes: an IP (Internet Protocol) address of the host, and a MAC (Media Access Control). Controlling the address and the physical location information of the host.
  • the physical location information may be an identifier (ID) of the VTEP accessed by the host and an ID of a user port connected to the host on the VTEP.
  • the controller 100 provides a network architecture of the SDN through a visual interface, so that the user can specify the monitored host by clicking and the like, and designate a monitoring server responsible for monitoring the monitored host; wherein the monitored host and the monitoring server can be connected in the same On the VTEP, it can also be connected to different VTEPs, which is not limited in this disclosure.
  • the controller 100 After receiving the monitoring command carrying the ID of the monitored host and the ID of the monitoring server, the controller 100 sends monitoring configuration information to the VTEP accessed by the monitored host, where the monitoring configuration information includes at least: the address of the monitored host and The VXLAN ID (identification) to which it belongs, the address of the monitoring server, and the ID of the monitoring server, wherein the above address may include a MAC address and/or an IP address.
  • the ID of the monitoring server is the unique identifier assigned by the controller to the monitoring server.
  • the controller can send monitoring configuration information to the VTEP accessed by the monitored host through the NETCONF (Network Configuration) protocol.
  • the VTEP accessed by the monitored host After receiving the monitoring configuration information sent by the controller 100, the VTEP accessed by the monitored host saves the monitoring configuration information, and performs the steps shown in FIG. 2:
  • Step S101 According to the address of the monitoring server carried in the monitoring configuration information, determine whether the monitoring server is connected to the VTEP. If yes, the VTEP is both the VTEP accessed by the monitored host and the VTEP accessed by the monitoring server. S102. Otherwise, step S103 is performed.
  • Step S102 Configure a first forwarding entry and a third forwarding entry in the local forwarding table.
  • the match rule of the first forwarding entry is: the source address of the packet is the address (IP address or MAC address) of the monitored host.
  • the action of the first forwarding entry is: mirroring the user packet, and sending the mirrored packet to the local monitoring server.
  • the matching rule of the third forwarding entry is: the ID of the monitoring server carried in the VXLAN packet.
  • the execution of the third forwarding entry is: decapsulating the VXLAN packet and sending it to the local monitoring server.
  • the VTEP can determine the user port connected to the monitoring server on the VTEP according to the address of the monitoring server, and the mirrored packet can be sent to the monitoring server through the user port.
  • Step S103 Configure a first forwarding entry in the local forwarding table.
  • the matching rule of the first forwarding entry is that the source address of the packet is an address (IP address or MAC address) of the monitored host.
  • the action of the first forwarding entry is: mirroring the user packet, and the mirroring packet is encapsulated in a VXLAN and sent to the remote VTEP accessed by the monitoring server, where the VXLAN packet carrying the VXLAN packet is monitored and carried.
  • the ID of the server is accessed by the monitoring server.
  • the encapsulated VXLAN packet is sent to the remote VTEP accessed by the monitoring server. It can be seen that the VXLAN packet needs to carry the ID of the monitoring server. For this reason, the VXLAN header of the VXLAN packet is extended in the embodiment of the present disclosure.
  • the format of the extended VXLAN header is as shown in FIG. 3, and the HOST ID field is used. The ID of the monitoring server.
  • the VTEP that is accessed by the monitored host and monitored by the monitoring server is not only configured with the first forwarding entry but also the third forwarding entry is configured, and the monitored host does not access the monitoring server. Only the first forwarding entry is configured for the VTEP to be accessed.
  • the VTEP accessed by the monitored host after receiving the monitoring configuration information sent by the controller 100, the VTEP accessed by the monitored host also sends the monitoring configuration information to all remote VTEPs in the VXLAN carried in the monitoring configuration information.
  • the BGP is used to flood the VXLAN in the BGP packet, and the flooding is flooded to all the remote VTEPs in the VXLAN.
  • the format of the BGP packet carrying the monitoring configuration information is as shown in FIG. 4 , where the Source MAC Address field is used to carry the MAC address of the monitored host, and the Source IP Address field is used to carry the IP address of the monitored host.
  • the Monitor MAC Address field is used to carry the MAC address of the monitoring server.
  • the Monitor IP Address field is used to carry the IP address of the monitoring server.
  • the HOST ID field is used to carry the ID of the monitoring server.
  • the remote VTEP After receiving the monitoring configuration information, the remote VTEP that is not accessed by the monitored host saves the monitoring configuration information, and also performs the steps shown in FIG. 5:
  • Step S201 determining, according to the address of the monitoring server carried in the monitoring configuration information, whether the monitoring server is connected to the VTEP, if not, executing step S202; if yes, indicating that the VTEP is a VTEP accessed by the monitoring server, executing Step S203.
  • Step S202 Configure a second forwarding entry in the local forwarding table.
  • the matching rule of the second forwarding entry is: the destination address of the packet is the address of the monitored host.
  • the second forwarding entry performs the following operations: mirroring the user packet, and performing the VXLAN encapsulation on the mirrored packet to be sent to the remote VTEP accessed by the monitoring server, where the VXLAN packet obtained by the VXLAN encapsulation is carried. Monitor the ID of the server.
  • Step S203 configuring a second forwarding entry and a third forwarding entry in the local forwarding table.
  • the matching rule of the second forwarding entry is: the destination address of the packet is the address of the monitored host.
  • the action of the second forwarding entry is: mirroring the user packet, and sending the mirrored packet to the local monitoring server.
  • the matching rule of the third forwarding entry is: the ID of the monitoring server carried in the VXLAN packet.
  • the execution of the third forwarding entry is: decapsulating the VXLAN packet and sending it to the local monitoring server.
  • the VTEP that is not accessed by the monitored host and not monitored by the monitoring server only configures the second forwarding entry, and the VTEP that is not accessed by the monitored host and accessed by the monitoring server is not only configured.
  • the second forwarding entry is also configured.
  • the VTEP that is accessed by the monitored host and is not accessed by the monitoring server is configured with the first forwarding entry, and the VTEP that is accessed by the monitoring host and configured by the monitoring server configures the first forwarding entry and the third forwarding entry, and the monitored host
  • the VTEP that is not connected to the monitoring server is configured with the second forwarding entry, and the VTEP that is not accessed by the monitoring host and configured by the monitoring server configures the second forwarding entry and the third forwarding entry.
  • FIG. 6 is a flowchart of a process for forwarding a message after receiving a message by a VTEP according to an exemplary embodiment of the present disclosure.
  • step S301 the VTEP can receive the message.
  • step S302 the VTEP can determine the type of the message.
  • step S303 the VTEP mirrors the packet and performs VXLAN encapsulation according to the matching first forwarding entry, and then sends the packet to the remote VTEP accessed by the monitoring server, or sends the packet image to the local monitoring server.
  • step S304 the VTEP mirrors the packet and performs VXLAN encapsulation according to the matched second forwarding entry, and then sends the packet to the remote VTEP accessed by the monitoring server, or sends the packet image to the local monitoring server.
  • step S305 the VTEP decapsulates the VXLAN message according to the matched third forwarding entry, and sends the VXLAN message to the local monitoring server.
  • the VTEP determines the type of the packet by determining whether the packet hits the first forwarding entry in step S302. If the packet hits the first forwarding entry, the VTEP clarifies that the packet is a user packet from the local monitored host, and performs the operation in step S303.
  • the ID of the monitoring server is encapsulated in the VXLAN with the mirrored packet, and the encapsulated VXLAN packet is sent to the remote VTEP accessed by the monitoring server.
  • the VTEP determines the type of the packet by determining whether the packet hits the second forwarding entry in step S302. If the packet hits the second forwarding entry, the VTEP clarifies that the packet is a user packet from the local host, and performs the operation in step S304.
  • step S304 when the packet mirroring is performed in the VXLAN encapsulation, the ID of the monitoring server is encapsulated in the VXLAN with the mirrored packet, and the encapsulated VXLAN packet is sent to the remote VTEP accessed by the monitoring server. .
  • the VTEP determines the type of the packet by determining whether the packet hits the third forwarding entry in step S302. If the packet hits the third forwarding entry, the VTEP can specify that the packet is a VXLAN packet from the remote VTEP and carries the identifier of the monitoring server, and performs the operation in step S305.
  • the VTEP when determining the type of the message, the VTEP first determines whether the message is a user message or a VXLAN message. For example, the VTEP can determine whether the port that receives the packet is a user-side port or a public-network-side port. If the port is a user-side port, the packet is a user packet sent by the virtual machine. The port indicates that the packet is a VXLAN packet received through the VXLAN tunnel. Then, the VTEP matches the received user packet or VXLAN packet with the local forwarding entry.
  • Step S401 After receiving the user packet, the VTEP matches the source address of the user packet with the first forwarding entry.
  • step S402 the VTEP determines whether the first forwarding entry is hit, and if so, the user packet is clarified as a user packet from the local monitored host, and step S403 is performed; otherwise, step S404 is performed;
  • Step S403 The VTEP mirrors the user packet according to the matched first forwarding entry, and the mirrored packet is encapsulated in a VXLAN and then sent to the remote VTEP accessed by the monitoring server, or the mirrored packet is sent to the local monitoring. Server; then exit this process.
  • the ID of the monitoring server is encapsulated in the VXLAN with the mirrored packet, and the encapsulated VXLAN packet is sent to the remote VTEP accessed by the monitoring server.
  • Step S404 the VTEP matches the destination address of the user packet with the second forwarding entry.
  • step S405 the VTEP determines whether the second forwarding entry is hit. If yes, the user packet is clarified as a user packet from the local host, and step S406 is performed. Otherwise, the process is exited.
  • Step S406 The VTEP mirrors the user packet according to the action of the matched second forwarding entry, and the mirrored packet is encapsulated in a VXLAN and sent to the remote VTEP accessed by the monitoring server, or the mirrored packet is sent to the VTEP. Local monitoring server.
  • the ID of the monitoring server is encapsulated in the VXLAN with the mirrored packet, and the encapsulated VXLAN packet is sent to the remote VTEP accessed by the monitoring server.
  • the VTEP that is accessed by the monitored host sends the mirrored packet of the user packet sent by the monitored host to the remote VTEP accessed by the monitoring server through the VXLAN tunnel, or the user is sent to the user through the above steps S401 to S406.
  • the mirrored packet of the packet is sent to the local monitoring server.
  • the VTEP sends the mirrored packet of the user packet sent by the local host to the monitored host to the remote VTEP accessed by the monitoring server through the VXLAN tunnel.
  • the mirrored packet of the packet is sent to the local monitoring server.
  • Step S501 After receiving the VXLAN message, the VTEP matches the VXLAN message with the third forwarding entry.
  • step S502 the VTEP determines whether the VXLAN packet hits the third forwarding entry, and if so, the VXLAN packet is a VXLAN packet that is from the remote VTEP and carries the identifier of the monitoring server, and performs step S503; otherwise, exits. This process;
  • Step S503 The VTEP decapsulates the VXLAN packet according to the matched third forwarding entry, and sends the VXLAN packet to the local monitoring server.
  • the VTEP decapsulates the VXLAN packet, and forwards the decapsulated user packet to the monitoring server through the user port connected to the monitoring server on the VTEP, so that the monitoring is performed by the monitoring server.
  • the server monitors the user packet.
  • the VTEP connected to the monitored host after receiving the user packet sent by the monitored host, performs VXLAN encapsulation on the image of the user packet according to the performed action of the matched first forwarding entry. After Send the remote VTEP to the monitoring server or send the image of the user packet to the local monitoring server. After receiving the user packet sent by the local host to the monitored host, the VTEP that is not accessed by the monitored host will The image of the user packet is encapsulated in the VXLAN and sent to the remote VTEP that is accessed by the monitoring server, or the image of the user packet is sent to the local monitoring server, where The image of the user packet carries the monitoring server identifier after being encapsulated in the VXLAN.
  • the VTEP that is connected to the monitoring server receives the VXLAN packet from the remote VTEP and carries the monitoring server identifier, and then matches the third forwarding entry according to the matching. After the action is performed, the VXLAN packet is decapsulated and sent to the local monitoring server, so that the packet sent by the monitored host and the packet sent to the monitored host are monitored.
  • the controller can obtain the monitoring result from the monitoring server without monitoring by the controller, thereby saving the CPU resources of the controller and improving the performance of the controller.
  • the VTEP can be used as the VTEP that is accessed by the monitored host, or as the VTEP that is not accessed by the monitored host, or as the VTEP that the monitoring server accesses.
  • the role is VTEP, you can perform the corresponding operation.
  • the VM can be migrated in the SDN. Therefore, when the monitored host is migrated, the VTEP sends the BGP packet to all remote VTEPs in the VXLAN to which the VM belongs after detecting that the monitored host is moved to the VTEP.
  • the address of the host to be monitored, and the second forwarding entry of the address of the monitored host in the matching rule is found in the local forwarding table, and the second forwarding entry that is found is updated to be the matching rule report.
  • the source address is the first forwarding entry of the monitored host address.
  • the remote VTEP After receiving the BGP packet carrying the address of the monitored host, the remote VTEP (that is, the VTEP that is not currently accessed by the monitored host) determines whether the monitored host is migrated from the VTEP. When it is determined that the monitored host is migrating from the VTEP, the local forwarding table searches for the first forwarding entry in the matching rule whose source address is the monitored host address, and the first forwarding entry to be found is found. The second forwarding entry is updated to match the destination address of the packet in the rule to the address of the monitored host. Thus, the remote VTEP becomes a VTEP that is not accessed by the monitored host.
  • the method for detecting that the monitored host is moved to the VTEP may be: after receiving the ARP (Address Resolution Protocol) packet that is sent after the VM is migrated, according to the locally saved monitoring. Determining the VM as the monitored host; and updating the MAC entry corresponding to the MAC address; at this time, if the MAC address is found to correspond to the VXLAN tunnel before the update, and the update corresponds to the local user port, it may be determined The monitored host is moved to the VTEP.
  • ARP Address Resolution Protocol
  • the specific method for judging that the monitored host is migrating from the VTEP may be: receiving the BGP carrying the address of the VM. After the message is received, the VM is determined to be the monitored host according to the locally saved monitoring configuration information; and the MAC address corresponding to the MAC address is updated; at this time, if the MAC address is found to be corresponding to the local user port before the update, the update is updated. After corresponding to the VXLAN tunnel, it can be determined that the monitored host is migrated from the VTEP.
  • the VTEP sends the monitoring server's address to all remote VTEPs in the VXLAN to which the monitoring server belongs after detecting the migration of the monitoring server to the VTEP;
  • the configuration information is used to confirm the address of the monitored host corresponding to the monitoring server and the identifier of the monitoring server.
  • the local forwarding table is used to search for the first forwarding entry of the address of the monitored host in the matching rule.
  • the destination address of the packet is the second forwarding entry of the monitored host, and the execution action of the first forwarding entry or the second forwarding entry is updated to send the packet image to the local device.
  • the monitoring server is configured to configure a third forwarding entry in the local forwarding table, where the monitoring server identifier in the matching rule is an identifier of the monitoring server that is moved into the VTEP.
  • the remote VTEP (that is, the VTEP that the monitoring server is not currently accessing) performs the operations shown in Figure 9 after receiving the BGP packet carrying the address of the monitoring server:
  • Step S601 the VTEP confirms the address of the monitored host corresponding to the monitoring server and the identifier of the monitoring server according to the locally saved monitoring configuration information.
  • Step S602 VTEP determines whether the monitoring server migrates from the VTEP, and if so, steps S603 and S504, otherwise, step S605;
  • step S603 the VTEP searches the local forwarding table for the first forwarding entry in the matching rule whose source address is the address of the monitored host, or the destination address of the packet in the matching rule is the second address of the monitored host. Forwarding the entry, and updating the executed action of the first forwarding entry or the second forwarding entry to the VTEP that is sent to the monitoring server after the packet mirroring is VXLAN encapsulated;
  • Step S604 the VTEP searches for a third forwarding entry that matches the identifier of the monitoring server in the matching rule in the local forwarding table, and deletes the third forwarding entry.
  • step S605 the VTEP searches the local forwarding table for the first forwarding entry in the matching rule whose source address is the address of the monitored host, or the destination address of the packet in the matching rule is the second address of the monitored host.
  • the forwarding entry updates the execution action of the first forwarding entry or the second forwarding entry to the VTEP that is sent to the monitoring server after the packet mirroring is VXLAN encapsulated.
  • the specific method for the detection and monitoring server to move into the VTEP may be: after receiving the ARP (Address Resolution Protocol) packet that is sent after the VM is migrated, The monitored configuration information is saved, and the VM is determined to be a monitoring server, and the MAC address corresponding to the MAC address is updated. At this time, if the MAC address is found to correspond to the VXLAN tunnel before the update, and the update corresponds to the local user port, Then it can be determined that the monitoring server is moved into the VTEP.
  • ARP Address Resolution Protocol
  • the method for determining that the monitoring server is migrating from the VTEP may be: after receiving the BGP packet carrying the address of the VM, determining that the VM is the monitoring server according to the locally saved monitoring configuration information, and updating the MAC address. Corresponding MAC entry. At this time, if the MAC address is found to correspond to the local user port before the update, and the update corresponds to the VXLAN tunnel, it can be determined that the monitoring server is migrated from the VTEP.
  • each VTEP when the monitored host and the monitoring server are migrated, each VTEP dynamically updates the first forwarding entry, the second forwarding entry, and the third forwarding entry of the VTEP, thereby It can monitor the packets when the monitored host and monitoring server are migrated.
  • VM210 to VM240 belong to VXLAN1
  • VTEP104 is connected to one monitoring server SERV21
  • any two VTEPs in VTEP101 to VTEP104 are established.
  • a NETCONF protocol connection is established between the controller 100 and each VTEP for transmitting monitoring configuration information.
  • the ID of SERV21 is HOST ID1
  • the MAC address of each VM is represented as VM-MAC
  • the IP address is represented as VM-IP
  • MAC address of each VTEP is represented as VTEP-MAC
  • the IP address is represented as VTEP-IP.
  • the controller 100 sends monitoring configuration information to the VTEP 101 through the NETCONF protocol, where the monitoring configuration information includes: the MAC address of the monitored host VM 210, the IP address and the VXLAN to which it belongs, the MAC address and IP address of the monitoring server SERV21, and the HOST ID1.
  • the VTEP 101 After receiving the monitoring configuration information, the VTEP 101 saves the monitoring configuration information, and configures the first forwarding entry in the local forwarding table as shown in the second row of Table 1-1, and sends the monitoring configuration information to the BGP packet to the BGP packet.
  • the monitoring configuration information is saved, and the second forwarding entry shown in the second row of Table 2-1 is configured in the local forwarding table; the VTEP 104 receives the BGP packet.
  • the monitoring configuration information is saved, and the second forwarding entry shown in the second row of Table 3-1 and the third forwarding entry shown in the third row of Table 3-1 are configured in the local forwarding table. .
  • the VM 210 accesses the VM 230, it sends a user packet whose source IP address is VM210-IP and whose destination IP address is VM230-IP.
  • the VTEP 101 forwards the table according to the destination IP address of the user packet.
  • the VXLAN packet is forwarded to the VTEP 103.
  • the user packet is matched with the first forwarding entry as shown in the second row of Table 1-1. If the first forwarding entry is hit, the user packet is mirrored, and the HOST ID1 is matched with the mirrored packet.
  • the encapsulated VXLAN packet is sent to the VTEP 104.
  • the VTEP 104 After receiving the VXLAN packet, the VTEP 104 matches the VXLAN packet with the third forwarding entry as shown in the third row of Table 3-1. The result is that the third forwarding entry is hit, and the VXLAN packet is sent to the VXLAN packet. Decapsulation is performed to obtain a user packet, and the user packet is sent to SERV21, and the SERV21 monitors the user packet.
  • the VTEP 103 After receiving the VXLAN packet, the VTEP 103 decapsulates the user packet and forwards the user packet to the VM 230. After receiving the user packet, the VM 230 responds with a user message whose source IP address is VM230-IP and whose destination IP address is VM210-IP. After receiving the user packet, the VTEP 103 forwards the table according to the destination IP address of the user packet. After the VXLAN encapsulation of the user packet, the VXLAN packet is forwarded to the VTEP 101. On the one hand, the user packet is matched with the second forwarding entry as shown in the second row of Table 2-1. The result is that the second forwarding entry is hit, and the user packet is mirrored, and the HOST ID1 is The VXLAN encapsulation is performed together with the mirrored message and sent to the VTEP 104.
  • the VTEP 104 After receiving the VXLAN packet, the VTEP 104 matches the VXLAN packet with the third forwarding entry as shown in the third row of Table 3-1. The result is that the third forwarding entry is hit, and the VXLAN packet is sent to the VXLAN packet. Decapsulation is performed to obtain a user packet, and the user packet is sent to SERV21, and the SERV21 monitors the user packet.
  • the SERV 21 implements monitoring of user messages sent by the VM 210 and user messages sent to the VM 210.
  • the controller periodically obtains the monitoring result from SERV21.
  • the VTEP 102 detects that the VM 210 is migrated to the VTEP, and determines that the VM 210 is the monitored host according to the locally saved monitoring configuration information, and then forwards the BGP packet to the VTEP 101.
  • the VTEP 103 and the VTEP 104 send the MAC address VM210-MAC and the IP address VM210-IP of the VM 210, and update the second forwarding entry as shown in the second row of Table 2-1 to the matching rule that the source address of the packet is VM210.
  • the first forwarding entry of the IP address VM210-IP is as shown in the second row of Table 2-2.
  • the VTEP 101 After receiving the MAC address and IP address of the VM 210 sent by the VTEP 102 through the BGP packet, the VTEP 101 determines that the VM 210 is the monitored host according to the locally saved monitoring configuration information, and then determines that the VM 210 is migrated from the VTEP.
  • the first forwarding entry as shown in the second row of Table 1-1, is updated to be the second forwarding entry whose destination address is VM210-IP, and the second forwarding entry is as shown in Table 1-2. As shown in the line.
  • the VTEP 103 and the VTEP 104 After receiving the MAC address and IP address of the VM 210 sent by the VTEP 102 through the BGP packet, the VTEP 103 and the VTEP 104 determine that the VM 210 is the monitored host according to the locally saved monitoring configuration information. However, it is determined that the VM 210 is not migrated from the VTEP. , the second forwarding entry will not be updated.
  • the VTEP 103 determines that the SERV 21 is monitored according to the locally saved monitoring configuration information.
  • the server determines the ID of the SERV21 as the HOST ID1 and the MAC address and IP address of the corresponding monitored host VM210, and then sends the address of the SERV21 to the VTEP101, VTEP102, and VTEP104 through the BGP message, and will be as shown in Table 2-
  • the second forwarding entry shown in line 2 is updated as shown in the second row of Table 4-1.
  • VTEP103 also configures the third forwarding as shown in the third row of Table 4-1 in the local forwarding table. Publish the item.
  • the VTEP 104 After receiving the address of the SERV21 sent by the VTEP 103 through the BGP packet, the VTEP 104 determines that the SERV21 is the monitoring server according to the locally saved monitoring configuration information, and determines that the ID of the SERV21 is the HOST ID1 and the MAC of the corresponding monitored host VM210. Address and IP address, and then, when it is determined that SERV21 is migrating from the VTEP, the second forwarding entry as shown in the second row of Table 3-1 is updated as shown in the second row of Table 3-2; Delete the third forwarding entry as shown in the third line of Table 3-1.
  • the VTEP 101 After receiving the address of the SERV21 sent by the VTEP 103 through the BGP packet, the VTEP 101 determines that the SERV21 is the monitoring server according to the locally saved monitoring configuration information, and determines that the ID of the SERV21 is the HOST ID1 and the MAC of the corresponding monitored host VM210. Address and IP address, then, in judging that SERV21 is not from this
  • the second forwarding entry as shown in the second row of Table 1-2 is updated as shown in the second row of Table 1-3.
  • VTEP102 After receiving the address of SERV21 sent by VTEP103 through BGP packet, VTEP102 is based on local The saved monitoring configuration information determines that the SERV21 is the monitoring server, and determines that the ID of the SERV21 is the HOST ID1, and the MAC address and IP address of the corresponding monitored host VM210, and then, when it is determined that the SERV21 is not migrated from the VTEP, The first forwarding entry as shown in the second row of Table 2-2 is updated as shown in the second row of Table 2-3.
  • the present disclosure also provides an embodiment of the VTEP to which the message monitoring method is applied.
  • FIG. 12 is a schematic diagram of a hardware structure of a VTEP according to an example of the present disclosure.
  • the VTEP can include a processor 1201, a machine readable storage medium 1202 that stores machine executable instructions.
  • the processor 1201 and the machine readable storage medium 1202 can communicate via the system bus 1203. And, by reading and executing the machine executable instructions in the machine readable storage medium 1202 corresponding to the message monitoring logic, the processor 1201 can perform the message monitoring method described above.
  • the machine-readable storage medium 1202 referred to herein can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, and the like.
  • the machine-readable storage medium may be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as a hard disk drive), solid state drive, any type of storage disk. (such as a disc, dvd, etc.), or a similar storage medium, or a combination thereof.
  • the foregoing packet monitoring logic includes: a receiving module 1301 , a package sending module 1302 , and a decapsulation sending module 1303 .
  • the receiving module 1301 is configured to receive a message.
  • the encapsulation transmitting module 1302 is configured to: if the packet received by the receiving module 1301 is a user packet from the local monitored host, the packet mirroring is performed in a VXLAN package and then sent to the packet according to the matching action of the first forwarding entry. Monitoring the remote VTEP that the server accesses, or sending the packet image to the local monitoring server; and if the packet received by the receiving module 1301 is a user packet sent by the local host to the monitored host, according to the matching After the packet forwarding is performed in the VXLAN, the packet is sent to the remote VTEP that is accessed by the monitoring server, or the packet is mirrored to the local monitoring server. The packet mirroring is carried in the VXLAN package and carries the monitoring server. Logo.
  • the decapsulation sending module 1303 is configured to: if the receiving packet received by the receiving module 1301 is from a remote VTEP, The VXLAN packet with the monitoring server identifier is decapsulated and sent to the local monitoring server according to the action of the matched third forwarding entry.
  • the source address of the user packet from the local monitored host is the same as the source address of the packet matching the first forwarding entry.
  • the destination address of the user packet sent by the local host to the monitored host matches the destination address.
  • the destination address of the packet in the matching rule of the second forwarding entry is the same; the monitoring server identifier carried in the VXLAN packet is the same as the monitoring server identifier in the matching rule of the matched third forwarding entry.
  • the packet monitoring logic further includes: a configuration module 1404 and an information sending module 1405.
  • the receiving module 1301 is further configured to: when the VTEP is a VTEP that is accessed by the monitored host, to receive monitoring configuration information sent by the controller, where the monitoring configuration information includes at least: being monitored The address of the host and the VXLAN ID of the host, the address of the monitoring server, and the monitoring server ID. It is also used to receive the monitoring configuration information sent by the remote VTEP when the VTEP is a VTEP that is not accessed by the monitored host. When the VTEP is used to monitor the VTEP accessed by the server, the VTEP receives the monitoring configuration information sent by the remote VTEP.
  • the configuration module 1404 is configured to: after the receiving module 1301 receives the monitoring configuration information sent by the controller, configure the first forwarding entry in the local forwarding table; and when the VTEP is the VTEP that is not accessed by the monitored host. After the receiving module 1301 receives the monitoring configuration information sent by the remote VTEP, the second forwarding entry is configured in the local forwarding table. The VTEP is also received by the receiving module 1301 when the VTEP is the VTEP accessed by the monitoring server. After the configuration information sent by the remote VTEP is configured, the third forwarding entry is configured in the local forwarding table.
  • the information sending module 1405 is configured to send the monitoring configuration information to all remote VTEPs after the receiving module 1301 receives the monitoring configuration information sent by the controller.
  • the message monitoring logic further includes: a lookup update module 1406.
  • the information sending module 1405 is further configured to send the address of the monitored host to all remote VTEPs after detecting that the monitored host migrates to the VTEP.
  • the lookup update module 1406 is configured to: after detecting that the monitored host migrates to the VTEP, find a second forwarding entry in the local forwarding table that matches the destination address of the packet in the matching rule to the address of the monitored host, and the discovered forwarding entry is found.
  • the second forwarding entry is updated to be the first forwarding entry in the matching rule where the source address of the packet is the monitored host address.
  • the packet monitoring logic further includes: a determining module 1407.
  • the receiving module 1301 is further configured to receive an address of the monitored host sent by the remote VTEP.
  • the determining module 1407 is configured to receive, by the receiving module 1301, the address of the monitored host sent by the remote VTEP. After that, it is determined whether the monitored host migrates from the VTEP.
  • the search update module 1406 is configured to: if the judgment result of the determining module 1406 is that the monitored host is migrated from the VTEP, find the first source of the source address of the monitored host in the matching rule in the local forwarding table. The item is updated, and the first forwarding entry to be searched is updated to a second forwarding entry whose matching destination address is the address of the monitored host.
  • the message monitoring logic further includes: a confirmation module 1508.
  • the information sending module 1405 is further configured to send the address of the monitoring server to all remote VTEPs after detecting that the monitoring server migrates to the VTEP.
  • the confirmation module 1508 is configured to confirm the address of the monitored host corresponding to the monitoring server and the identifier of the monitoring server after detecting that the monitoring server migrates to the VTEP.
  • the lookup update module 1406 is configured to: after the confirmation module 1508 confirms the address of the monitored host corresponding to the monitoring server, find the first forwarding entry in the local forwarding table that matches the source address of the packet in the matching rule to the address of the monitored host. Or, in the matching rule, the destination address of the packet is the second forwarding entry of the monitored host, and the execution action of the first forwarding entry or the second forwarding entry is updated to send the packet image to Local monitoring server.
  • the configuration module 1404 is further configured to: after the confirmation module 1508 confirms the identifier of the monitoring server corresponding to the monitoring server, configure a third forwarding entry in the local forwarding table, where the monitoring server identifier in the matching rule is the inbound VTEP The identity of the monitoring server.
  • the message monitoring logic further includes: a confirmation module 1508.
  • the receiving module 1301 is further configured to receive an address of the monitoring server sent by the remote VTEP.
  • the confirmation module 1508 is configured to confirm the address of the monitored host corresponding to the monitoring server and the identifier of the monitoring server after the receiving module 1301 receives the address of the monitoring server sent by the remote VTEP.
  • the determining module 1407 is configured to determine, after the receiving module 1301 receives the address of the monitoring server sent by the remote VTEP, whether the monitoring server migrates from the VTEP.
  • the search update module 1406 is configured to: if the judgment result of the determination module 1407 is that the monitoring server is migrated from the VTEP, after the confirmation module 1508 confirms the address of the monitored host corresponding to the monitoring server and the identifier of the monitoring server,
  • the local forwarding table searches for the first forwarding entry of the address of the monitored host in the matching rule, or the second forwarding entry of the address of the monitored host in the matching rule.
  • the execution action of the first forwarding entry or the second forwarding entry is updated to send the packet mirror to the monitoring service after being VXLAN encapsulated.
  • the device embodiment since it basically corresponds to the method embodiment, reference may be made to the partial description of the method embodiment.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the present disclosure. Those of ordinary skill in the art can understand and implement without any creative effort.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

VTEP接收报文；若该报文为来自本地被监控主机的用户报文，则根据匹配的第一转发表项的执行动作，将报文镜像进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；若该报文为本地主机发往被监控主机的用户报文，则根据匹配的第二转发表项的执行动作，将报文镜像进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；若该报文为来自远端VTEP、且携带监控服务器标识的VXLAN报文，则根据匹配的第三转发表项的执行动作，对VXLAN报文解封装后发送给本地监控服务器。

Description

报文监控
相关申请的交叉引用
本专利申请要求于2016年8月1日提交的、申请号为201610620508.0、发明名称为“报文监控方法及装置”的中国专利申请的优先权，该申请的全文以引用的方式并入本文中。
背景技术
SDN(Software Defined Network，软件定义网络)网络中，控制器可对VM(Virtual Machine，虚拟机)的报文进行监控的过程为：控制器向被监控的VM接入的VTEP(VXLAN Tunnel End Point，VXLAN隧道端点)发送Openflow(开放流)流表项。该VTEP在接收到用户报文之后，可将该用户报文的源地址或者目的地址与该流表项进行匹配。若匹配，则将该用户报文进行镜像，并将得到的镜像报文转发给控制器。
通过上述过程，VTEP将被监控VM发出的用户报文、以及发往该VM的用户报文镜像一份转发给控制器进行监控。
附图说明
图1是本公开一示例性实施例示出的SDN的组网示意图；
图2是本公开一示例性实施例示出的被监控主机接入的VTEP接收到监控配置信息之后，执行的转发表项配置过程的流程图；
图3是本公开一示例性实施例示出的扩展后的VXLAN头的格式示意图；
图4是本公开一示例性实施例示出的携带监控配置信息的BGP报文的格式示意图；
图5是本公开一示例性实施例示出的被监控主机未接入的VTEP接收到监控配置信息之后，执行的转发表项配置过程的流程图；
图6是本公开一示例性实施例示出的VTEP接收到报文之后，对该报文进行转发的处理流程图；
图7是本公开一示例性实施例示出的VTEP接收到用户报文之后，对该用户报文进行转发的处理流程图；
图8是本公开一示例性实施例示出的VTEP在接收到VXLAN报文之后，对该VXLAN报文进行转发的处理流程图；
图9是本公开一示例性实施例示出的VTEP接收到监控服务器的地址之后，对转发表项进行更新的处理流程图；
图10是图1中的VM10发生了迁移后的组网示意图；
图11是图10中的SERV21发生了迁移后的组网示意图；
图12是本公开一示例性实施例示出的VTEP的硬件结构示意图；
图13是本公开一示例性实施例示出的VTEP的一种结构示意图；
图14是本公开一示例性实施例示出的VTEP的另一种结构示意图；
图15是本公开一示例性实施例示出的VTEP的又一种结构示意图。
具体实施方式
这里将结合附图详细地对示例性实施例进行说明。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
在本公开使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开。在本公开和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
在背景技术描述的报文监控方法中，所有被监控的VM的数据流都需要转发给控制器进行监控。当被监控的VM的数量较多，和/或被监控的VM的数据流的流量较大时，会占用控制器较多的CPU(Central Processing Unit，中央处理单元)资源，从而影响控制器的性能。
因此，本公开以下实施例中提供了一种报文监控方法，以及一种可以应用该方法的VTEP。
在本公开实施例中，在如图1所示的SDN中应用EVPN(Ethernet Virtual Private Network，以太网虚拟专用网络)技术。即，由EVPN作为SDN的承载网，在控制平面上采用BGP(Border Gateway Protocol，边界网关协议)通告路由信息，在数据平面上采用VXLAN封装方式转发用户报文。
在如图1所示的SDN中，包括控制器100、路由器R 10和R 20、以及VTEP 101至104。其中，各个VTEP上连接的主机可以是VM也可以是物理设备，本公开对此不作限定。例如，VM 210至240以及服务器SERV 21分别连接至各个VTEP。
由此，本公开实施例的报文监控方法包括以下内容：
在SDN中，控制器100能够从各个VTEP获取该VTEP连接的主机的信息，其中，该主机的信息中包括：该主机的IP(Internet Protocol，因特网协议)地址、MAC(Media Access Control，媒体访问控制)地址、以及该主机所处的物理位置信息，该物理位置信息具体可以是该主机接入的VTEP的标识(ID)和该VTEP上连接该主机的用户端口的ID。
控制器100通过可视化界面提供SDN的网络架构，从而，用户可以通过点击等方式指定被监控主机，以及，指定负责监控该被监控主机的监控服务器；其中，被监控主机和监控服务器可以连接在同一VTEP上，也可以连接在不同VTEP上，本公开对此不做限定。
在接收到携带有被监控主机的ID和监控服务器的ID的监控指令之后，控制器100向被监控主机接入的VTEP发送监控配置信息，该监控配置信息中至少包括：被监控主机的地址和所属的VXLAN ID(标识)、监控服务器的地址、以及该监控服务器的ID，其中，上述地址可以包括MAC地址和/或IP地址。监控服务器的ID是控制器为监控服务器分配的唯一标识。在实际实施过程中，控制器可以通过NETCONF(网络配置)协议，向被监控主机接入的VTEP发送监控配置信息。
被监控主机接入的VTEP接收到控制器100发来的监控配置信息之后，保存该监控配置信息，并且执行如图2所示的步骤：
步骤S101，根据该监控配置信息中携带的监控服务器的地址，判断该监控服务器是否连接在本VTEP上，若是，则本VTEP既是被监控主机接入的VTEP也是监控服务器接入的VTEP，执行步骤S102，否则，执行步骤S103。
步骤S102，在本地转发表中配置第一转发表项和第三转发表项。其中，该第一转发表项的匹配规则(match rule)为：报文源地址为该被监控主机的地址(IP地址或MAC地址)。 该第一转发表项的执行动作(action)为：对用户报文进行镜像，将镜像报文发送给本地的监控服务器。该第三转发表项的匹配规则为：VXLAN报文中携带监控服务器的ID。该第三转发表项的执行动作为：对VXLAN报文解封装后发送给本地的监控服务器。
在实际实施过程中，VTEP根据该监控服务器的地址即可确定出本VTEP上连接该监控服务器的用户端口，通过该用户端口即可将该镜像报文发送给该监控服务器。
步骤S103，在本地转发表中配置第一转发表项。其中，该第一转发表项的匹配规则为报文源地址为该被监控主机的地址(IP地址或MAC地址)。该第一转发表项的执行动作为：对用户报文进行镜像，将镜像报文进行VXLAN封装后发送给监控服务器接入的远端VTEP，其中，进行VXLAN封装后得到的VXLAN报文携带监控服务器的ID。
在实际实施过程中，将该监控服务器的ID与镜像报文一起进行VXLAN封装后，将封装得到的VXLAN报文发送给该监控服务器接入的远端VTEP。可见，VXLAN报文中需要携带监控服务器的ID，为此，本公开实施例对VXLAN报文的VXLAN头进行了扩展，扩展后的VXLAN头的格式如图3所示，其中的HOST ID字段用于携带监控服务器的ID。
从而，通过上述步骤S101～步骤S103，被监控主机接入且监控服务器接入的VTEP不仅要配置第一转发表项，还要配置第三转发表项；而被监控主机接入且监控服务器未接入的VTEP，仅配置第一转发表项。
另外，在接收到控制器100发来的监控配置信息之后，被监控主机接入的VTEP还会将该监控配置信息发送给该监控配置信息中携带的VXLAN内的所有远端VTEP。在实际实施过程中，由于在控制层面上采用BGP，因此，该监控配置信息会携带在BGP报文中在该VXLAN内泛洪，从而，泛洪给该VXLAN内的所有远端VTEP。
其中，上述携带有监控配置信息的BGP报文的格式如图4所示意，其中，Source MAC Address字段用于携带被监控主机的MAC地址，Source IP Address字段用于携带被监控主机的IP地址，Monitor MAC Address字段用于携带监控服务器的MAC地址，Monitor IP Address字段用于携带监控服务器的IP地址，HOST ID字段用于携带监控服务器的ID。
被监控主机未接入的远端VTEP在接收到监控配置信息之后，保存该监控配置信息，并且，还会执行如图5所示的步骤：
步骤S201，根据该监控配置信息中携带的监控服务器的地址，判断该监控服务器是否连接在本VTEP上，若否，则执行步骤S202，若是，说明本VTEP是监控服务器接入的VTEP，则执行步骤S203。
步骤S202，在本地转发表中配置第二转发表项。其中，该第二转发表项的匹配规则为：报文目的地址为被监控主机的地址。该第二转发表项的执行动作为：对用户报文进行镜像，对镜像报文进行VXLAN封装后发送给该监控服务器接入的远端VTEP，其中，进行VXLAN封装后得到的VXLAN报文携带监控服务器的ID。
步骤S203，在本地转发表中配置第二转发表项和第三转发表项。其中，该第二转发表项的匹配规则为：报文目的地址为被监控主机的地址。该第二转发表项的执行动作为：对用户报文进行镜像，将镜像报文发送给本地的监控服务器。该第三转发表项的匹配规则为：VXLAN报文中携带监控服务器的ID。该第三转发表项的执行动作为：对VXLAN报文解封装后发送给本地的监控服务器。
从而，通过上述步骤S201～步骤S203，被监控主机未接入且监控服务器未接入的VTEP仅配置第二转发表项，而被监控主机未接入且监控服务器接入的VTEP不仅要配置第二转发表项，还要配置第三转发表项。
至此，被监控主机接入且监控服务器未接入的VTEP配置第一转发表项，被监控主机接入且监控服务器接入的VTEP配置第一转发表项和第三转发表项，被监控主机未接入且监控服务器未接入的VTEP配置第二转发表项，被监控主机未接入且监控服务器接入的VTEP配置第二转发表项和第三转发表项。
参见图6，图6是本公开一示例性实施例示出的VTEP接收到报文之后，对该报文进行转发的处理流程图。
步骤S301，VTEP可接收到报文。
步骤S302，VTEP可确定该报文的类型。
若该报文为来自本地被监控主机的用户报文，则流程进行到步骤S303。在步骤S303，VTEP根据匹配的第一转发表项，将报文镜像并进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器。
若该报文为本地主机发往被监控主机的用户报文，则流程进行到步骤S304。在步骤S304，VTEP根据匹配的第二转发表项，将报文镜像并进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器。
若该报文为来自远端VTEP、且携带监控服务器的标识的VXLAN报文，则流程进行到步骤S305。在步骤S305中，VTEP根据匹配的第三转发表项，对所述VXLAN报文解封装后发送给本地监控服务器。
若VTEP为被监控主机接入的VTEP，则在步骤S302中VTEP通过判断该报文是否命中该第一转发表项来确定该报文的类型。若该报文命中该第一转发表项，则VTEP明确该报文为来自本地被监控主机的用户报文，并执行步骤S303中的操作。
其中，在步骤S303中会将监控服务器的ID与镜像报文一起进行VXLAN封装，并将封装得到的VXLAN报文发送给监控服务器接入的远端VTEP。
若VTEP为被监控主机未接入的VTEP，则在步骤S302中VTEP通过判断该报文是否命中第二转发表项来确定该报文的类型。若该报文命中该第二转发表项，则VTEP明确该报文为来自本地主机的用户报文，并执行步骤S304中的操作。
其中，在步骤S304中，在对报文镜像进行VXLAN封装时，会将监控服务器的ID与镜像报文一起进行VXLAN封装，并将封装得到的VXLAN报文发送给监控服务器接入的远端VTEP。
若VTEP为监控服务器接入的VTEP，则在步骤S302中VTEP通过判断该报文是否命中第三转发表项来确定该报文的类型。若该报文命中该第三转发表项，VTEP可明确该报文是来自远端VTEP、且携带监控服务器的标识的VXLAN报文，并执行步骤S305中的操作。
在实际实施中，在步骤S302中，VTEP在确定报文的类型时，首先会判断该报文是用户报文还是VXLAN报文。例如，VTEP可以确定接收到该报文的端口是用户侧端口还是公网侧端口，如果端口是用户侧端口，则说明该报文是虚拟机发来的用户报文，如果端口是公网侧端口，则说明该报文是通过VXLAN隧道接收的VXLAN报文。然后，VTEP将接收的用户报文或VXLAN报文与本地的转发表项进行匹配。
在本公开的示例中，还存在与被监控主机接入同一VTEP的本地主机向该被监控主机发送报文的情况。结合图7来描述在该情况下VTEP接收到用户报文之后执行的操作。
步骤S401，VTEP在接收到用户报文之后，将用户报文的源地址与第一转发表项进行匹配；
步骤S402，VTEP判断是否命中该第一转发表项，若是，则明确用户报文为来自本地被监控主机的用户报文，并执行步骤S403，否则，执行步骤S404；
步骤S403，VTEP根据匹配的第一转发表项，将该用户报文进行镜像，将镜像报文进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将镜像报文发送给本地的监控服务器；之后退出本流程。
其中，在步骤S403中会将监控服务器的ID与镜像报文一起进行VXLAN封装，并将封装后的VXLAN报文发送给监控服务器接入的远端VTEP。
步骤S404，VTEP将该用户报文的目的地址与第二转发表项进行匹配；
步骤S405，VTEP判断是否命中该第二转发表项，若是，则明确用户报文为来自本地主机的用户报文，并执行步骤S406，否则，退出本流程。
步骤S406，VTEP根据匹配的第二转发表项的执行动作，对该用户报文进行镜像，将镜像报文进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将镜像报文发送给本地的监控服务器。
其中，在步骤S406中会将监控服务器的ID与镜像报文一起进行VXLAN封装，并将封装得到的VXLAN报文发送给监控服务器接入的远端VTEP。
从而，通过上述步骤S401～步骤S406，被监控主机接入的VTEP会将被监控主机发出的用户报文的镜像报文后通过VXLAN隧道发送给监控服务器接入的远端VTEP，或者将该用户报文的镜像报文发送给本地的监控服务器；VTEP会将本地主机发往被监控主机的用户报文的镜像报文，通过VXLAN隧道发送给监控服务器接入的远端VTEP，或者将该用户报文的镜像报文发送给本地的监控服务器。
VTEP在接收到VXLAN报文之后执行的步骤如图8所示：
步骤S501，VTEP在接收到VXLAN报文之后，将该VXLAN报文与第三转发表项进行匹配；
步骤S502，VTEP判断该VXLAN报文是否命中第三转发表项，若是，则明确该VXLAN报文为来自远端VTEP、且携带监控服务器的标识的VXLAN报文，并执行步骤S503，否则，退出本流程；
步骤S503，VTEP根据匹配的第三转发表项，对该VXLAN报文解封装后发送给本地的监控服务器。
具体的，在步骤S503中，VTEP会对该VXLAN报文进行解封装，并将解封装得到的用户报文通过本VTEP上连接该监控服务器的用户端口转发给该监控服务器，从而，由该监控服务器对该用户报文进行监控。
在上述实施例的方法中，被监控主机连接的VTEP在接收到被监控主机发出的用户报文之后，会根据匹配的第一转发表项的执行动作，对该用户报文的镜像进行VXLAN封装后发 送给监控服务器接入的远端VTEP，或者将该用户报文的镜像发送给本地监控服务器；被监控主机未接入的VTEP在接收到本地主机发往被监控主机的用户报文之后，会根据匹配的第二转发表项的执行动作，将该用户报文的镜像进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将该用户报文的镜像发送给本地监控服务器，其中，该用户报文的镜像进行VXLAN封装后携带监控服务器标识；监控服务器接入的VTEP在接收到来自远端VTEP、且携带监控服务器标识的VXLAN报文之后，会根据匹配的第三转发表项的执行动作，对该VXLAN报文解封装后发送给本地监控服务器，从而，实现了对被监控主机发出的报文以及发往被监控主机的报文的监控。
在上述方法中，无需由控制器进行监控，控制器可向监控服务器获取监控结果即可，从而节约了控制器的CPU资源，提高了控制器的性能。
需要注意的是：在实际实施过程中，VTEP既可以作为被监控主机接入的VTEP，也可以作为被监控主机未接入的VTEP，还可以作为监控服务器接入的VTEP，当该VTEP作为不同角色的VTEP时，可以执行相应的操作。
由于在SDN中VM可以发生迁移，因此，当被监控主机发生迁移时，VTEP在检测到该被监控主机迁入本VTEP之后，会通过BGP报文向该VM所属VXLAN内的所有远端VTEP发送被监控主机的地址，并且，在本地转发表中查找匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第二转发表项更新为匹配规则中报文源地址为该被监控主机地址的第一转发表项。
远端VTEP(即，被监控主机当前未接入的VTEP)接收到携带有该被监控主机的地址的BGP报文之后，会判断该被监控主机是否是从本VTEP迁出。在判断出该被监控主机是从本VTEP迁出时，在本地转发表中查找匹配规则中报文源地址为该被监控主机地址的第一转发表项，将查找到的第一转发表项更新为匹配规则中报文目的地址为该被监控主机的地址的第二转发表项。从而，该远端VTEP成为该被监控主机未接入的VTEP。
其中，检测被监控主机迁入本VTEP的具体方法可以是：在接收到VM迁移后发出的携带有该VM的地址的ARP(Address Resolution Protocol，地址解析协议)报文之后，根据本地保存的监控配置信息，确定该VM是被监控主机；并且，更新该MAC地址对应的MAC表项；此时，如果发现更新前该MAC地址对应于VXLAN隧道，而更新后对应于本地用户端口，则可以确定该被监控主机是迁入本VTEP的。
判断被监控主机是从本VTEP迁出的具体方法可以是：在接收到携带有VM的地址的BGP 报文之后，根据本地保存的监控配置信息，确定该VM是被监控主机；并且，更新该MAC地址对应的MAC表项；此时，如果发现更新前该MAC地址对应于本地用户端口，而更新后对应于VXLAN隧道，则可以确定该被监控主机是从本VTEP迁出的。
另外，当监控服务器发生迁移时，VTEP在检测到监控服务器迁入本VTEP之后，会通过BGP报文向该监控服务器所属VXLAN内的所有远端VTEP发送该监控服务器的地址；根据本地保存的监控配置信息，确认该监控服务器对应的被监控主机的地址和该监控服务器的标识；然后，在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像发送给本地的该监控服务器；在本地转发表中配置第三转发表项，其中，匹配规则中的监控服务器标识为迁入本VTEP的该监控服务器的标识。
远端VTEP(即，监控服务器当前未接入的VTEP)在接收到携带有该监控服务器的地址的BGP报文之后，会执行如图9所示的操作：
步骤S601，VTEP根据本地保存的监控配置信息，确认该监控服务器对应的被监控主机的地址和该监控服务器的标识；
步骤S602，VTEP判断该监控服务器是否从本VTEP迁出，若是，则执行步骤S603和S504，否则，执行步骤S605；
步骤S603，VTEP在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的VTEP；
步骤S604，VTEP在本地转发表中查找匹配规则中包含该监控服务器的标识的第三转发表项并删除；
步骤S605，VTEP在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的VTEP。
其中，检测监控服务器迁入本VTEP的具体方法可以是：在接收到VM迁移后发出的携带有该VM的地址的ARP(Address Resolution Protocol，地址解析协议)报文之后，根据本 地保存的监控配置信息，确定该VM是监控服务器，并且，更新该MAC地址对应的MAC表项，此时，如果发现更新前该MAC地址对应于VXLAN隧道，而更新后对应于本地用户端口，则可以确定该监控服务器是迁入本VTEP的。
判断监控服务器是从本VTEP迁出的具体方法可以是：在接收到携带有VM的地址的BGP报文之后，根据本地保存的监控配置信息，确定该VM是监控服务器，并且，更新该MAC地址对应的MAC表项，此时，如果发现更新前该MAC地址对应于本地用户端口，而更新后对应于VXLAN隧道，则可以确定该监控服务器是从本VTEP迁出的。
在上述实施例的方法中，当被监控主机和监控服务器发生了迁移时，各个VTEP会动态的更新本VTEP上的第一转发表项、第二转发表项和第三转发表项，从而，能够实现被监控主机和监控服务器发生迁移时的报文监控。
以如图1所示的SDN为例进行说明，在该SDN中应用EVPN技术，VM210～VM240同属于VXLAN1，VTEP104连接了1个监控服务器SERV21，VTEP101～VTEP104中的任意两个VTEP之间建立了VXLAN隧道。控制器100和各个VTEP之间建立了NETCONF协议连接，用于传输监控配置信息。SERV21的ID为HOST ID1，各个VM的MAC地址表示为VM-MAC、IP地址表示为VM-IP，各个VTEP的MAC地址表示为VTEP-MAC、IP地址表示为VTEP-IP。
控制器100通过NETCONF协议向VTEP101发送监控配置信息，其中，该监控配置信息中包括：被监控主机VM210的MAC地址、IP地址和所属VXLAN，监控服务器SERV21的MAC地址和IP地址，以及HOST ID1。
VTEP101接收到该监控配置信息之后，保存该监控配置信息，在本地转发表中配置如表1-1第2行所示的第一转发表项，并将该监控配置信息通过BGP报文发送给VXLAN1内的VTEP102～VTEP104。
表1-1
Figure PCTCN2017095387-appb-000001
VTEP102和VTEP103通过BGP报文接收到该监控配置信息之后，保存该监控配置信息，在本地转发表中配置如表2-1第2行所示的第二转发表项；VTEP104通过BGP报文接收到该 监控配置信息之后，保存该监控配置信息，在本地转发表中配置如表3-1第2行所示的第二转发表项和如表3-1第3行所示的第三转发表项。
表2-1
Figure PCTCN2017095387-appb-000002
表3-1
Figure PCTCN2017095387-appb-000003
VM210要访问VM230时，发出源IP地址为VM210-IP、目的IP地址为VM230-IP的用户报文。VTEP101接收到该用户报文后，一方面根据该用户报文的目的IP地址进行查表转发，从而，对该用户报文进行VXLAN封装后，将VXLAN报文转发给VTEP103；另一方面，将该用户报文与如表1-1第2行所示的第一转发表项进行匹配，结果命中该第一转发表项，则对该用户报文进行镜像，将HOST ID1与镜像报文一起进行VXLAN封装后，将封装得到的VXLAN报文发送给VTEP104。
VTEP104接收到该VXLAN报文后，将该VXLAN报文与如表3-1第3行所示的第三转发表项进行匹配，结果是命中该第三转发表项，则对该VXLAN报文进行解封装得到用户报文，将该用户报文发送给SERV21，由SERV21对该用户报文进行监控。
VTEP103接收到VXLAN报文后，进行解封装得到用户报文，并将该用户报文转发给VM230。VM230接收到该用户报文后，应答源IP地址为VM230-IP、目的IP地址为VM210-IP的用户报文。VTEP103接收到该用户报文之后，一方面，根据该用户报文的目的IP地址进行查表转发，从而，对该用户报文进行VXLAN封装后，将封装得到的VXLAN报文转发给VTEP101；另一方面，将该用户报文与如表2-1第2行所示的第二转发表项进行匹配，结果是命中该第二转发表项，则对该用户报文进行镜像，将HOST ID1与镜像报文一起进行VXLAN封装后发送给VTEP104。
VTEP104接收到该VXLAN报文后，将该VXLAN报文与如表3-1第3行所示的第三转发表项进行匹配，结果是命中该第三转发表项，则对该VXLAN报文进行解封装得到用户报文，将该用户报文发送给SERV21，由SERV21对该用户报文进行监控。
按照上述过程，SERV21实现了对VM210发出的用户报文和发往VM210的用户报文的监控。控制器定期向SERV21获取监控结果即可。
后续，当VM210从VTEP101迁移到了VTEP102时，如图10所示，VTEP102检测到VM210迁移到本VTEP之后，根据本地保存的监控配置信息，确定VM210是被监控主机，则通过BGP报文向VTEP101、VTEP103和VTEP104发送VM210的MAC地址VM210-MAC和IP地址VM210-IP，并且，将如表2-1第2行所示的第二转发表项，更新为匹配规则是报文源地址为VM210的IP地址VM210-IP的第一转发表项，该第一转发表项如表2-2第2行所示。
表2-2
Figure PCTCN2017095387-appb-000004
VTEP101在接收到VTEP102通过BGP报文发来的VM210的MAC地址和IP地址之后，根据本地保存的监控配置信息，确定VM210是被监控主机，则在判断出VM210是从本VTEP迁出时，将如表1-1第2行所示的第一转发表项，更新为匹配规则是报文目的地址为VM210-IP的第二转发表项，该第二转发表项如表1-2第2行所示。
而VTEP103和VTEP104在接收到VTEP102通过BGP报文发来的VM210的MAC地址和IP地址之后，根据本地保存的监控配置信息，确定VM210是被监控主机，然而，判断出VM210不是从本VTEP迁出，则不会对第二转发表项进行更新。
表1-2
Figure PCTCN2017095387-appb-000005
当监控服务器SERV21从VTEP104迁移到VTEP103时，如图11所示，VTEP103在检测到SERV21迁移到本VTEP之后，根据本地保存的监控配置信息，确定SERV21是监控 服务器，并确定出SERV21的ID为HOST ID1、以及对应的被监控主机VM210的MAC地址和IP地址，然后，通过BGP报文向VTEP101、VTEP102、VTEP104发送SERV21的地址，并且，将如表2-1第2行所示的第二转发表项更新为如表4-1第2行所示；另外，VTEP103还会在本地转发表中配置如表4-1第3行所示的第三转发表项。
表4-1
Figure PCTCN2017095387-appb-000006
VTEP104在接收到VTEP103通过BGP报文发来的SERV21的地址之后，根据本地保存的监控配置信息，确定SERV21是监控服务器，并确定出SERV21的ID为HOST ID1、以及对应的被监控主机VM210的MAC地址和IP地址，然后，在判断出SERV21是从本VTEP迁出时，将如表3-1第2行所示的第二转发表项更新为如表3-2第2行所示；并且，删除如表3-1第3行所示的第三转发表项。
表3-2
Figure PCTCN2017095387-appb-000007
VTEP101在接收到VTEP103通过BGP报文发来的SERV21的地址之后，根据本地保存的监控配置信息，确定SERV21是监控服务器，并确定出SERV21的ID为HOST ID1、以及对应的被监控主机VM210的MAC地址和IP地址，然后，在判断出SERV21不是从本
VTEP迁出时，将如表1-2第2行所示的第二转发表项更新为如表1-3第2行所示。
表1-3
Figure PCTCN2017095387-appb-000008
VTEP102在接收到VTEP103通过BGP报文发来的SERV21的地址之后，根据本地 保存的监控配置信息，确定SERV21是监控服务器，并确定出SERV21的ID为HOST ID1、以及对应的被监控主机VM210的MAC地址和IP地址，然后，在判断出SERV21不是从本VTEP迁出时，将如表2-2第2行所示的第一转发表项更新为如表2-3第2行所示。
表2-3
Figure PCTCN2017095387-appb-000009
与前述报文监控方法的实施例相对应，本公开还提供了该报文监控方法所应用的VTEP的实施例。
图12为本公开示例提供的一种VTEP的硬件结构示意图。该VTEP可包括处理器1201、存储有机器可执行指令的机器可读存储介质1202。处理器1201与机器可读存储介质1202可经由系统总线1203通信。并且，通过读取并执行机器可读存储介质1202中与报文监控逻辑对应的机器可执行指令，处理器1201可执行上文描述的报文监控方法。
本文中提到的机器可读存储介质1202可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，机器可读存储介质可以是：RAM(Radom Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)，或者类似的存储介质，或者它们的组合。
请参考图13，从功能上划分，上述报文监控逻辑中包括：接收模块1301、封装发送模块1302和解封装发送模块1303。
在这种情况下，接收模块1301，用于接收报文。
封装发送模块1302，用于若接收模块1301接收到的报文为来自本地被监控主机的用户报文，则根据匹配的第一转发表项的执行动作，将报文镜像进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；还用于若接收模块1301接收到的报文为本地主机发往被监控主机的用户报文，则根据匹配的第二转发表项的执行动作，将报文镜像进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；其中，报文镜像进行VXLAN封装后携带监控服务器标识。
解封装发送模块1303，用于若接收模块1301接收到的报文为来自远端VTEP、且携 带监控服务器标识的VXLAN报文，则根据匹配的第三转发表项的执行动作，对该VXLAN报文解封装后发送给本地监控服务器。
其中，来自本地被监控主机的用户报文的源地址与匹配的第一转发表项的匹配规则中的报文源地址相同；本地主机发往被监控主机的用户报文的目的地址与匹配的第二转发表项的匹配规则中的报文目的地址相同；VXLAN报文携带的监控服务器标识与匹配的第三转发表项的匹配规则中的监控服务器标识相同。
如图14所示，上述报文监控逻辑中还包括：配置模块1404和信息发送模块1405。
在这种情况下，接收模块1301，还用于当本VTEP为被监控主机接入的VTEP时，用于接收控制器发来的监控配置信息，其中，该监控配置信息中至少包括：被监控主机的地址和所属的VXLAN标识、监控服务器的地址、以及监控服务器标识；还用于当本VTEP为被监控主机未接入的VTEP时，接收远端VTEP发送的监控配置信息；还用于当本VTEP为监控服务器接入的VTEP时，接收远端VTEP发送的监控配置信息。
配置模块1404，用于在接收模块1301接收到控制器发来的监控配置信息之后，在本地转发表中配置第一转发表项；还用于当本VTEP为被监控主机未接入的VTEP时，在接收模块1301接收到远端VTEP发送的监控配置信息之后，在本地转发表中配置第二转发表项；还用于当本VTEP为监控服务器接入的VTEP时，在接收模块1301接收到远端VTEP发送的监控配置信息之后，在本地转发表中配置第三转发表项。
信息发送模块1405，用于在接收模块1301接收到控制器发来的监控配置信息之后，将该监控配置信息发送给所有远端VTEP。
如图14所示，上述报文监控逻辑还包括：查找更新模块1406。
在这种情况下，信息发送模块1405，还用于在检测到被监控主机迁入本VTEP之后，向所有远端VTEP发送被监控主机的地址。
查找更新模块1406，用于在检测到被监控主机迁入本VTEP之后，在本地转发表中查找匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第二转发表项更新为匹配规则中报文源地址为该被监控主机地址的第一转发表项。
如图14所示，上述报文监控逻辑中还包括：判断模块1407。
在这种情况下，接收模块1301，还用于接收远端VTEP发来的被监控主机的地址。
判断模块1407，用于在接收模块1301接收到远端VTEP发来的被监控主机的地址之 后，判断该被监控主机是否从本VTEP迁出。
查找更新模块1406，用于若判断模块1406的判断结果是该被监控主机是从本VTEP迁出，则在本地转发表中查找匹配规则中报文源地址为该被监控主机地址的第一转发表项，将查找到的第一转发表项更新为匹配规则中报文目的地址为该被监控主机的地址的第二转发表项。
如图15所示，上述报文监控逻辑中还包括：确认模块1508。
在这种情况下，信息发送模块1405，还用于在检测到监控服务器迁入本VTEP之后，向所有远端VTEP发送该监控服务器的地址。
确认模块1508，用于在检测到监控服务器迁入本VTEP之后，确认该监控服务器对应的被监控主机的地址和该监控服务器的标识。
查找更新模块1406，用于在确认模块1508确认该监控服务器对应的被监控主机的地址之后，在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像发送给本地的该监控服务器。
配置模块1404，还用于在确认模块1508确认该监控服务器对应的该监控服务器的标识之后，在本地转发表中配置第三转发表项，其中，匹配规则中的监控服务器标识为迁入本VTEP的该监控服务器的标识。
如图15所示，上述报文监控逻辑中还包括：确认模块1508。
在这种情况下，接收模块1301，还用于接收远端VTEP发来的监控服务器的地址。
确认模块1508，用于在接收模块1301接收到远端VTEP发来的监控服务器的地址之后，确认该监控服务器对应的被监控主机的地址和该监控服务器的标识。
判断模块1407，用于在接收模块1301接收到远端VTEP发来的监控服务器的地址之后，判断该监控服务器是否从本VTEP迁出。
查找更新模块1406，用于若判断模块1407的判断结果是该监控服务器是从本VTEP迁出，则在确认模块1508确认该监控服务器对应的被监控主机的地址和该监控服务器的标识之后，在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务 器迁入的远端VTEP，在本地转发表中查找匹配规则中包含该监控服务器的标识的第三转发表项并删除；查找更新模块1406，还用于若判断模块1407的判断结果是该监控服务器不是从本VTEP迁出，则在确认模块1508确认该监控服务器对应的被监控主机的地址之后，在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的远端VTEP。
上述装置中各个单元的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本公开方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅为本公开的较佳实施例而已，并不用以限制本公开，凡在本公开的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本公开保护的范围之内。

Claims (14)

  1. 一种报文监控方法，包括：
    可扩展虚拟局域网络VXLAN隧道端点VTEP接收报文；
    若所述报文为来自本地被监控主机的用户报文，则所述VTEP根据与所述报文匹配的第一转发表项，将报文镜像并进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；
    若所述报文为本地主机发往所述被监控主机的用户报文，则所述VTEP根据与所述报文匹配的第二转发表项，将报文镜像并进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；
    若所述报文为来自远端VTEP、且携带所述监控服务器的标识的VXLAN报文，则所述VTEP根据与所述报文匹配的第三转发表项，对所述VXLAN报文解封装后发送给本地监控服务器。
  2. 根据权利要求1所述的方法，其中，
    所述来自本地被监控主机的用户报文的源地址与所述第一转发表项的匹配规则中的报文源地址相同；
    所述本地主机发往所述被监控主机的用户报文的目的地址与所述第二转发表项的匹配规则中的报文目的地址相同；
    所述VXLAN报文携带的所述监控服务器的标识与所述第三转发表项的匹配规则中的监控服务器标识相同。
  3. 根据权利要求2所述的方法，还包括：
    所述被监控主机接入的VTEP接收控制器发来的监控配置信息，在本地转发表中配置所述第一转发表项，并将所述监控配置信息发送给所有远端VTEP；
    所述被监控主机未接入的VTEP接收远端VTEP发送的所述监控配置信息，在本地转发表中配置所述第二转发表项；
    所述监控服务器接入的VTEP接收所述远端VTEP发送的所述监控配置信息，在本地转发表中配置所述第三转发表项；
    其中，所述监控配置信息中至少包括：所述被监控主机的地址和所属的VXLAN标识、所述监控服务器的地址、以及所述监控服务器标识。
  4. 根据权利要求3所述的方法，还包括：
    所述VTEP在检测到所述被监控主机迁入本VTEP之后，向所有远端VTEP发送所述被 监控主机的地址；
    所述VTEP在本地转发表中查找匹配规则中报文目的地址为该被监控主机的地址的第二转发表项；
    所述VTEP将查找到的第二转发表项更新为匹配规则中报文源地址为该被监控主机地址的第一转发表项。
  5. 根据权利要求3所述的方法，还包括：
    所述VTEP在接收到远端VTEP发来的被监控主机的地址之后，判断该被监控主机是否从本VTEP迁出；
    若该被监控主机是从本VTEP迁出，
    所述VTEP在本地转发表中查找匹配规则中报文源地址为该被监控主机地址的第一转发表项，
    所述VTEP将查找到的第一转发表项更新为匹配规则中报文目的地址为该被监控主机的地址的第二转发表项。
  6. 根据权利要求3所述的方法，还包括：
    所述VTEP在检测到所述监控服务器迁入本VTEP之后，向所有远端VTEP发送该监控服务器的地址；
    所述VTEP确认该监控服务器对应的被监控主机的地址和该监控服务器的标识；
    所述VTEP在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，
    所述VTEP将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像发送给所述监控服务器；
    所述VTEP在本地转发表中配置第三转发表项，其中，所述第三转发表项中的匹配规则中的监控服务器标识为迁入本VTEP的该监控服务器的标识。
  7. 根据权利要求3所述的方法，还包括：
    所述VTEP在接收到远端VTEP发来的监控服务器的地址之后，确认该监控服务器对应的被监控主机的地址和该监控服务器的标识；
    所述VTEP判断该监控服务器是否从本VTEP迁出；
    若所述监控服务器是从本VTEP迁出，
    所述VTEP在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，
    所述VTEP将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的远端VTEP，
    所述VTEP在本地转发表中查找匹配规则中包含该监控服务器的标识的第三转发表项并删除；
    若所述监控服务器不是从本VTEP迁出，
    所述VTEP在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，
    所述VTEP将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的远端VTEP。
  8. 一种可扩展虚拟局域网络VXLAN隧道端点VTEP，包括处理器和机器可读存储介质，所述机器可读存储介质存储有能够被所述处理器执行的机器可执行指令，所述处理器被所述机器可执行指令促使：
    接收报文；
    若所述报文为来自本地被监控主机的用户报文，则根据匹配的第一转发表项，将报文镜像并进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；
    若所述报文为本地主机发往所述被监控主机的用户报文，则根据匹配的第二转发表项，将报文镜像并进行VXLAN封装后发送给监控服务器接入的远端VTEP，或者将报文镜像发送给本地监控服务器；
    若所述报文为来自远端VTEP、且携带所述监控服务器的标识的VXLAN报文，则根据匹配的第三转发表项，对所述VXLAN报文解封装后发送给本地监控服务器。
  9. 根据权利要求8所述的VTEP，其中，
    所述来自本地被监控主机的用户报文的源地址与所述匹配的第一转发表项的匹配规则中的报文源地址相同；
    所述本地主机发往所述被监控主机的用户报文的目的地址与所述匹配的第二转发表项的匹配规则中的报文目的地址相同；
    所述VXLAN报文携带的所述监控服务器的标识与所述匹配的第三转发表项的匹配规则中的监控服务器标识相同。
  10. 根据权利要求9所述的VTEP，其中，所述处理器被所述机器可执行指令促使：
    所述VTEP作为所述被监控主机接入的VTEP的情况下，
    接收并保存控制器发来的监控配置信息，在本地转发表中配置所述第一转发表项，并将所述监控配置信息发送给所有远端VTEP；
    所述VTEP作为所述被监控主机未接入的VTEP的情况下，
    接收远端VTEP发送的所述监控配置信息，在本地转发表中配置所述第二转发表项；
    所述VTEP作为所述监控服务器接入的VTEP的情况下，
    接收所述远端VTEP发送的所述监控配置信息，在本地转发表中配置所述第三转发表项；
    其中，所述监控配置信息中至少包括：所述被监控主机的地址和所属的VXLAN标识、所述监控服务器的地址、以及所述监控服务器标识。
  11. 根据权利要求10所述的VTEP，其中，所述处理器被所述机器可执行指令促使：
    在检测到所述被监控主机迁入本VTEP之后，向所有远端VTEP发送所述被监控主机的地址；
    在本地转发表中查找匹配规则中报文目的地址为该被监控主机的地址的第二转发表项；
    将查找到的第二转发表项更新为匹配规则中报文源地址为该被监控主机地址的第一转发表项。
  12. 根据权利要求10所述的VTEP，其中，所述处理器被所述机器可执行指令促使：
    在接收到远端VTEP发来的被监控主机的地址之后，判断该被监控主机是否从本VTEP迁出；
    若该被监控主机是从本VTEP迁出，
    在本地转发表中查找匹配规则中报文源地址为该被监控主机地址的第一转发表项，
    将查找到的第一转发表项更新为匹配规则中报文目的地址为该被监控主机的地址的第二转发表项。
  13. 根据权利要求10所述的VTEP，其中，所述处理器被所述机器可执行指令促使：
    在检测到所述监控服务器迁入本VTEP之后，向所有远端VTEP发送该监控服务器的地址；
    确认该监控服务器对应的被监控主机的地址和该监控服务器的标识；
    在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，
    将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像发送给所述监控服务器；
    在本地转发表中配置第三转发表项，其中，所述第三转发表项中的匹配规则中的监控服 务器标识为迁入本VTEP的该监控服务器的标识。
  14. 根据权利要求10所述的VTEP，其中，所述处理器被所述机器可执行指令促使：
    在接收到远端VTEP发来的监控服务器的地址之后，确认该监控服务器对应的被监控主机的地址和该监控服务器的标识；
    判断该监控服务器是否从本VTEP迁出；
    若所述监控服务器是从本VTEP迁出，
    在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，
    将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的远端VTEP，
    在本地转发表中查找匹配规则中包含该监控服务器的标识的第三转发表项并删除；
    若所述监控服务器不是从本VTEP迁出，
    在本地转发表中查找匹配规则中报文源地址为该被监控主机的地址的第一转发表项，或者，匹配规则中报文目的地址为该被监控主机的地址的第二转发表项，
    将查找到的第一转发表项或第二转发表项的执行动作更新为将报文镜像进行VXLAN封装后发送给该监控服务器迁入的远端VTEP。
PCT/CN2017/095387 2016-08-01 2017-08-01 报文监控 WO2018024187A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17836369.3A EP3493477B1 (en) 2016-08-01 2017-08-01 Message monitoring
JP2019505173A JP6928076B2 (ja) 2016-08-01 2017-08-01 パケット監視
US16/322,387 US10938679B2 (en) 2016-08-01 2017-08-01 Packet monitoring

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610620508.0A CN107682275B (zh) 2016-08-01 2016-08-01 报文监控方法及装置
CN201610620508.0 2016-08-01

Publications (1)

Publication Number Publication Date
WO2018024187A1 true WO2018024187A1 (zh) 2018-02-08

Family

ID=61072773

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/095387 WO2018024187A1 (zh) 2016-08-01 2017-08-01 报文监控

Country Status (5)

Country Link
US (1) US10938679B2 (zh)
EP (1) EP3493477B1 (zh)
JP (1) JP6928076B2 (zh)
CN (1) CN107682275B (zh)
WO (1) WO2018024187A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3451597A4 (en) * 2016-04-27 2019-03-13 New H3C Technologies Co., Ltd. PACKET TRANSFER
JP2020205571A (ja) * 2019-06-19 2020-12-24 富士通株式会社 情報処理システム、情報処理装置、及び情報処理プログラム
JP2021530158A (ja) * 2018-06-30 2021-11-04 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108418740B (zh) * 2018-02-28 2020-09-08 新华三技术有限公司 报文处理方法及装置
US20210092103A1 (en) * 2018-10-02 2021-03-25 Arista Networks, Inc. In-line encryption of network data
CN110719215B (zh) * 2019-10-21 2022-02-18 北京百度网讯科技有限公司 虚拟网络的流信息采集方法及装置
US11477270B1 (en) * 2021-07-06 2022-10-18 Vmware, Inc. Seamless hand-off of data traffic in public cloud environments

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043387A (zh) * 2007-03-22 2007-09-26 杭州华三通信技术有限公司 远程镜像实现方法、远程监控设备及实现远程镜像的系统
CN101252475A (zh) * 2008-03-28 2008-08-27 中兴通讯股份有限公司 报文镜像方法及装置
CN104618194A (zh) * 2015-02-15 2015-05-13 杭州华三通信技术有限公司 软件定义网络报文监控方法和sdn控制器、交换设备

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7486674B2 (en) * 2003-04-28 2009-02-03 Alcatel-Lucent Usa Inc. Data mirroring in a service
EP2629463B1 (en) 2010-10-15 2019-09-04 Nec Corporation Switching system, and monitoring centralization management method
US9203755B1 (en) * 2011-09-27 2015-12-01 Cisco Technology, Inc. Error message monitoring in a network environment
WO2013180207A1 (ja) 2012-05-31 2013-12-05 日本電気株式会社 制御装置、通信システム、スイッチ制御方法及びプログラム
US9621508B2 (en) * 2013-08-20 2017-04-11 Arista Networks, Inc. System and method for sharing VXLAN table information with a network controller
US9612854B2 (en) * 2013-12-18 2017-04-04 Telefonaktiebolaget Lm Ericsson (Publ) System and method for virtualizing a remote device
KR102122949B1 (ko) * 2014-01-24 2020-06-16 한국전자통신연구원 네트워크를 통해 연결된 세그먼트들을 관리하는 방법 및 장치
US9548873B2 (en) 2014-02-10 2017-01-17 Brocade Communications Systems, Inc. Virtual extensible LAN tunnel keepalives
US9794079B2 (en) * 2014-03-31 2017-10-17 Nicira, Inc. Replicating broadcast, unknown-unicast, and multicast traffic in overlay logical networks bridged with physical networks
CN105471740B (zh) * 2014-07-09 2018-10-12 新华三技术有限公司 基于软件定义网络的网关迁徙处理方法及装置
JPWO2016017737A1 (ja) 2014-07-31 2017-05-18 日本電気株式会社 スイッチ、オーバーレイネットワークシステム、通信方法及びプログラム
JP2016100799A (ja) 2014-11-25 2016-05-30 株式会社日立製作所 監視システムおよび監視方法
CN105099922B (zh) * 2015-06-18 2018-10-09 新华三技术有限公司 一种跨虚拟可扩展局域网的数据报文转发方法和装置
JP6557097B2 (ja) * 2015-09-01 2019-08-07 日本電気株式会社 仮想ネットワーク監視システム、仮想ネットワーク監視方法、及び、プログラム
CN105337884A (zh) * 2015-09-25 2016-02-17 盛科网络（苏州）有限公司 基于逻辑端口实现多级报文编辑业务控制的方法及装置
CN105591955B (zh) * 2015-10-30 2019-07-09 新华三技术有限公司 一种报文传输的方法和装置
US10200278B2 (en) * 2016-03-02 2019-02-05 Arista Networks, Inc. Network management system control service for VXLAN on an MLAG domain
JP6990097B2 (ja) 2017-11-30 2022-01-12 三菱重工業株式会社 液体金属ナトリウムの回収方法及び回収装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043387A (zh) * 2007-03-22 2007-09-26 杭州华三通信技术有限公司 远程镜像实现方法、远程监控设备及实现远程镜像的系统
CN101252475A (zh) * 2008-03-28 2008-08-27 中兴通讯股份有限公司 报文镜像方法及装置
CN104618194A (zh) * 2015-02-15 2015-05-13 杭州华三通信技术有限公司 软件定义网络报文监控方法和sdn控制器、交换设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3493477A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3451597A4 (en) * 2016-04-27 2019-03-13 New H3C Technologies Co., Ltd. PACKET TRANSFER
JP2021530158A (ja) * 2018-06-30 2021-11-04 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
JP7216120B2 (ja) 2018-06-30 2023-01-31 華為技術有限公司 Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
US11973795B2 (en) 2018-06-30 2024-04-30 Huawei Technologies Co., Ltd. BGP message sending method, BGP message receiving method, and device
JP2020205571A (ja) * 2019-06-19 2020-12-24 富士通株式会社 情報処理システム、情報処理装置、及び情報処理プログラム
JP7226123B2 (ja) 2019-06-19 2023-02-21 富士通株式会社 情報処理システム、情報処理装置、及び情報処理プログラム

Also Published As

Publication number Publication date
CN107682275A (zh) 2018-02-09
US20200186447A1 (en) 2020-06-11
JP6928076B2 (ja) 2021-09-01
EP3493477A4 (en) 2019-06-05
US10938679B2 (en) 2021-03-02
CN107682275B (zh) 2020-08-04
EP3493477B1 (en) 2022-05-04
EP3493477A1 (en) 2019-06-05
JP2019523608A (ja) 2019-08-22

Similar Documents

Publication Publication Date Title
WO2018024187A1 (zh) 报文监控
US20210351984A1 (en) Dynamic service device integration
US11095513B2 (en) Scalable controller for hardware VTEPs
US9825900B2 (en) Overlay tunnel information exchange protocol
US10541913B2 (en) Table entry in software defined network
WO2018040530A1 (zh) 一种确定虚拟机迁移的方法和装置
US8358661B2 (en) Remote adapter configuration
US10341185B2 (en) Dynamic service insertion
US8566257B2 (en) Address data learning and registration within a distributed virtual bridge
EP2874359B1 (en) Extended ethernet fabric switches
US10237179B2 (en) Systems and methods of inter data center out-bound traffic management
US8489763B2 (en) Distributed virtual bridge management
WO2014136864A1 (ja) パケット書換装置、制御装置、通信システム、パケット送信方法及びプログラム
CN107113241B (zh) 路由确定方法、网络配置方法以及相关装置
WO2015100656A1 (zh) 一种实现虚拟机通信的方法和装置
EP3214816B1 (en) Method, gateway and system for synchronizing virtual machine location information between data center gateways
WO2014079005A1 (zh) Mac地址强制转发装置及方法
JP2020520612A (ja) パケット伝送方法、エッジデバイス及び機械可読記憶媒体
WO2019201209A1 (zh) 报文转发
US10581669B2 (en) Restoring control-plane connectivity with a network management entity
WO2018171722A1 (zh) Mac地址同步
WO2016183732A1 (zh) 一种数据包转发方法和网络设备
WO2014067055A1 (zh) 流表刷新的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17836369

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019505173

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017836369

Country of ref document: EP

Effective date: 20190301