WO2022022404A1 - Network data processing system and method, network element device and server - Google Patents

Abstract

An embodiment of the present application provides a network data processing system and method, a network element device, and a server. Said system comprises: a first network element device, configured to send first data to a second network element device, replicate the first data to obtain second data, and send the second data to a target server; and the target server, configured to execute a corresponding network traffic monitoring task according to the received second data. According to the technical solution provided in the embodiments of the present application, in cases where there is no need to connect a plurality of complex auxiliary devices, such as an optical splitter and a shunting switch, to a network interface, the first network element device can directly complete the replication operation of data traffic, and then send the replicated data traffic to the target server for executing a monitoring task. The network data processing system of the present solution has a simple structure, low costs and high construction efficiency.

Description

Network data processing system, method, network element device and server

This application claims the priority of the Chinese patent application filed on July 30, 2020 with the application number of 202010753981.2 and the invention titled "Network data processing system, method, network element device and server", the entire contents of which are incorporated into this application by reference .

technical field

The present application relates to the field of computer technology, and in particular, to a network data processing system, method, network element device and server.

Background technique

In network applications, in order to ensure the legitimate rights and interests of network platforms and users, network device monitoring is usually required. For example, in the application of public cloud network products, it is necessary to charge the traffic used by each user, and to monitor the network attack behavior. A more commonly used monitoring method is to use the diversion technology to divert the traffic of the target network device, and then to perform relevant analysis and processing on the traffic obtained by diversion.

In the prior art, in order to reduce the adverse impact of the offload operation on network stability when monitoring the offload operation, a monitoring system is usually built. For example, an optical splitter is connected to the traffic port of the target network device, and then The optical splitter is connected to the distribution switch, and the distribution is sent to the monitoring server through the distribution switch, so as to achieve the purpose of monitoring. Specifically, the optical splitter is used to obtain traffic mirroring from the traffic port, and the splitting switch performs traffic splitting processing to obtain the mirrored traffic of a target network device. The distribution switch then sends the mirrored traffic to the monitoring server, and the monitoring server monitors the target network device through the mirrored traffic. This solution uses optical splitters and split switches to build a monitoring system with high equipment cost, complex structure and long construction period.

SUMMARY OF THE INVENTION

In order to solve or improve the problems existing in the prior art, various embodiments of the present application provide a network data processing system, method, network element device and server.

In one embodiment of the present application, a network data processing system is provided. The system includes:

a first network element device, configured to send the first data to the second network element device, copy the first data to obtain the second data; send the second data to the target server;

The target server is configured to perform a corresponding network traffic monitoring task according to the received second data.

In an embodiment of the present application, a network data processing method is provided, which is applied to a first network element device. The method includes:

sending the received first data to the second network element device;

Copying the first data to obtain second data;

The second data is sent to the target server.

In another embodiment of the present application, a network data processing method is provided, which is applied to a server. The method includes:

acquiring second data obtained by duplicating the first data by the first network element device;

According to the second data, a corresponding network traffic monitoring task is performed.

In an embodiment of the present application, a network element device is provided. The network element equipment includes: a memory and a processor; wherein,

the memory for storing programs;

The processor, coupled to the memory, executes the program stored in the memory for:

sending the received first data to the second network element device;

Copying the first data to obtain second data;

The second data is sent to the target server.

In an embodiment of the present application, a server is provided, and the server includes: a memory and a processor; wherein,

the memory for storing programs;

The processor, coupled to the memory, executes the program stored in the memory for:

acquiring second data obtained by duplicating the first data by the first network element device;

According to the second data, a corresponding network traffic monitoring task is performed.

In the technical solutions provided by the embodiments of the present application, after the first network element device receives the first data sent by the network interface device, for example, the first network element device sends the first data to the second network element device, and the first network element device also sends the first data to the second network element device. The first data is copied to obtain second data; the target server receives the second data sent by the first network element device, and performs related network traffic monitoring tasks according to the second data. With the technical solution provided in this embodiment, there is no need to set up multiple complex auxiliary devices such as optical splitters and distribution switches in the network architecture, and the first network element device can directly use the first network element to complete the data replication, and then send the number of replications to The target server with network traffic monitoring capability has simple structure, lower cost and higher construction efficiency.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

1 is a schematic structural diagram of an existing network traffic monitoring system provided by an embodiment of the present application;

FIG. 2 is a schematic structural diagram of a network data processing system according to an embodiment of the present application;

3 is a schematic structural diagram of another network data processing system provided by an embodiment of the present application;

4 is a schematic structural diagram of another network data processing system provided by an embodiment of the present application;

FIG. 5 is a schematic flowchart of a network data processing method according to an embodiment of the present application;

FIG. 6 is a schematic flowchart of another network data processing method provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a network data processing apparatus according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of another network data processing apparatus provided by an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a first network element device according to an embodiment of the present application;

FIG. 10 is a schematic structural diagram of a server according to an embodiment of the present application.

detailed description

FIG. 1 is a schematic structural diagram of an existing network traffic monitoring system according to an embodiment of the present application. As can be seen from Figure 1, in the existing network traffic monitoring system, it is usually achieved with the help of optical splitters and split switches. Referring to the example shown in Figure 1, in order to monitor network traffic, an optical splitter 2 needs to be set up in the network, and an optical splitter 2 is set between the network interface device 1 of the optical splitter 2 and the gateway device 3, and the optical splitter 2 will copy the The obtained traffic is sent to the distribution switch 4, and then the distribution switch 4 imports the traffic to the target server 5 that plays a monitoring role. However, with the development of cloud network technology, the network system is becoming larger and larger. To complete the monitoring task of network traffic, it is necessary to build a huge and complex network traffic monitoring system. As a result, not only need to pay more hardware costs such as optical splitters and split switches, but also need to spend more labor to build, maintain and so on. In addition, the more complex the system, the less stable it is.

The present application provides the following embodiments to solve or partially solve the problems existing in the above solutions. In order to make those skilled in the art better understand the solutions of the present application, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application.

Some of the processes described in the specification, claims, and above-mentioned figures of the present application contain operations that occur in a particular order, and the operations may be performed out of the order in which they are presented herein or in parallel. The sequence numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the sequence numbers themselves do not represent any execution order. Additionally, these flows may include more or fewer operations, and these operations may be performed sequentially or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequence, nor do they limit "first" and "second" are different types. In addition, the embodiments described below are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of this application.

FIG. 2 is a schematic structural diagram of a network data processing system according to an embodiment of the present application. In this network data processing system, there are no split devices such as optical splitters and split switches, and no split switches are required to provide mirror ports for traffic mirroring operations. As shown in FIG. 2 , it includes: a first network element device 13 and a target server 14 . Specifically:

the first network element device 13, configured to send the first data to the second network element device 200, copy the first data to obtain the second data; send the second data to the target server 14;

The target server 14 is configured to perform a corresponding network traffic monitoring task according to the received second data.

In this embodiment, the first network element device not only retains the original function (such as converting and sending data using different transmission protocols in the two networks), but also has a data duplication capability. When monitoring the first data sent by the third network element device, the first data can be copied by the first network element device, that is, there is no need to set up a device such as an optical splitter between the network interface device and the first network element device. . The first network element device may be a gateway device.

Specifically, the system provided in this embodiment, as shown in FIG. 2 , may further include a network interface device 12 for receiving the first data sent by the third network element device 11 and sending the first data to The first network element device 13 . During specific implementation, the network interface device may be a router, a wireless access point (such as a Wi-Fi-AP), a switch, or the like, which is not specifically limited in this embodiment.

Referring to FIG. 2 , the third network element device 11 and the second network element device 15 may be respectively in two networks, such as the first network 100 and the second network 200 . The data transmission protocols of the two networks may be different or the same, which is not limited in this embodiment. Specifically, the first network 100 and the second network 200 are both local area networks; or, the first network 100 is the network where the cloud platform providing public services is located, and the second network 200 is the Internet composed of network service providers.

It should be noted that, here the first network element device is used to copy the first data, which will not affect the transmission of the first data. This is different from the use of splitters and split switches. If the split ratio occupied by the splitter is too large, the stability and accuracy of the data transmission of the original link may be weakened; in addition, in some application scenarios, there will be two Sub-splitting or multiple splitting, which will directly lead to serious attenuation of the optical signal. In this application, the first network element equipment is used to directly copy the received first data, which will not affect the transmission of the first data, and will not cause the problem of signal attenuation, which can effectively ensure the obtained first data. Accuracy and stability of data and secondary data. After the first network element device obtains the second data by means of copying, the first data may be further sent to the second network element device.

Further, the first network element device 13 selected here may be a gateway device with a built-in programmable switching processing module, and a data replication engine is configured in the programmable switching processing module. For example, after the first network element device receives the first data sent by the network interface device, the data replication engine is started to replicate the first data to obtain identical second data. In addition, in the programmable switching module, the data replication format, data processing method, etc. can also be set. For example, unimportant packets in the first data may be filtered. Since the replication operation is performed directly in the gateway, there is no need to go through too many data transmission and data processing operations, which can ensure data security and improve data replication efficiency. In addition, the programmable switching module can be programmed as needed, which can better meet a variety of different application scenarios and different application requirements.

The network data processing system shown in FIG. 2 has a simple architecture, and the first network element device 13 can directly send the copied second data to the target server 14 . The two network elements of the first network element device 13 and the target server 14 are relatively closely coupled. Another deformable solution of this embodiment, as shown in FIG. 3 , the first network element device 13 and the target server 14 may not communicate directly, but the first network element device 13 sends the copied second data to the network interface device 12 for forwarding the second data to the target server 14 by the network interface device 12 . Compared with the structure shown in FIG. 2 , in the solution shown in FIG. 3 , the coupling between the first network element device 13 and the target server 14 is not so tight, which is simpler and more convenient in network construction, and is conducive to improving the stability of network elements. sex.

In practical applications, in addition to monitoring network traffic, the target server can also be used for abnormal traffic analysis, traffic accounting, network performance analysis, and online user behavior analysis. In specific implementation, different servers may undertake different tasks by deploying multiple servers; for example, some servers are used for network traffic monitoring, traffic accounting, etc.; some servers are used for abnormal traffic analysis, etc. Of course, there may be one or more servers that undertake the same task, which is not limited in this embodiment.

In a specific embodiment solution, the network data processing system of this embodiment includes a plurality of servers. Suppose, multiple servers are all responsible for the same task, such as traffic monitoring. Correspondingly, the target server 11 mentioned in this embodiment is one of the multiple servers 16 (as shown in FIG. 4 ). Specifically, when the first network element device 13 in this embodiment sends the second data to the target server 11, it may be as follows:

from the plurality of servers 16, selecting a target server for the second data;

Sending the second data to the target server.

Referring to FIG. 4 , the first network element device 13 may send the second data and the identifier of the target server to the network interface device 12, so that the network interface device 12 can send the second data and the identifier of the target server to the network interface device 12 according to the identifier of the target server. , and send the second data to the target server.

Ideally, all data messages for the same session are sent to the same server. If the data of the same session is randomly distributed to different servers, since the different servers will not communicate with each other, it is impossible to track the traffic between the two network element devices very well. Session refers to the process of communication between two communicating parties. It is mostly used on the network. For example, the three-way handshake of TCP creates a session, and when TCP closes the connection, the session is closed. Once the session is established, it will always exist, and the session will not be deleted until the idle time of the communicating party exceeds a time threshold. During the existence (or survival period) of the session, the data transmitted by the two communicating parties (for example, the request sent by the user's client device to the server) will be stored in the session. For example, use a linear linked list to manage sessions. When there is new data, it can be searched to determine whether there is a session corresponding to the new data in the managed session linked list, and if so, the new data is stored in the corresponding session. It can be seen that, in this embodiment, the first network element device can select a target server for the second data by searching for a session. Specifically, when the first network element device 13 selects a target server for the second data from the plurality of servers 16, it is specifically used for:

determining whether there is a session to which the second data belongs;

When there is a session to which the second data belongs, the server associated with the session among the plurality of servers is used as the target server.

During specific implementation, the corresponding session may be queried based on the parameters carried in the second data. That is, when the first network element device 13 determines whether there is a session to which the second data belongs, it is specifically used to:

Acquire parameters carried by the second data, where the parameters include but are not limited to: source IP address, source port, destination IP address, and destination port; based on the parameters, query whether there is a session to which the second data belongs .

For example, after receiving the second data, the first network element device will parse and filter the second data to obtain parameters carried in the second data. The parameters include: source IP address, source port, destination IP address, and destination port; in addition, may also include transport layer protocol, service type, interface index, and the like. In some possible implementations, two data with the same parameters may be considered the same session. Therefore, during specific implementation, it is possible to query whether there is a session to which the second data belongs by comparing the parameters of the second data with the parameters of the existing data in each session. If there is a session to which the second data belongs, the server associated with the session is used as the target server. Wherein, the server associated with the session can be simply understood as: the server to which the copy data of the first data of the session is sent when the session is created. The first data of the session may be randomly sent to any server, or the server may be selected based on a load balancing principle. During specific implementation, a data table can be designed, and the data table contains the corresponding relationship between sessions and servers. After a session is deleted, the relational data about the session in this data table is also deleted.

In some applications, a hash algorithm can be introduced to participate in the process of sending network traffic. Specifically, using a hashing algorithm, a hash factor associated therewith is calculated for any one of the at least one session. That is, in this embodiment, when querying whether there is a session to which the second data belongs based on the parameter, the first network element device 13 may specifically: calculate a hash factor according to the parameter; use the hash factor The si factor is used to query whether there is a session to which the second data belongs.

Further, if the hash factor is used to query the session to which the second data does not exist, the first network element device 13 described in this embodiment can also be used to: when there is no session to which the second data belongs, Create a session to which the second data belongs; use a hash algorithm to calculate a hash factor associated with the session for easy query; use any one of the multiple servers as the target server; use the The server identifier of the target server is associated with the session, so that the operation of sending the replicated data to the target server can be completed based on the server identifier when subsequently receiving replicated data belonging to the session with the second data.

In practical applications, the session, the hash factor associated with the session, and the server identifier associated with the session may be stored in the first network element device, or may be stored in a dedicated storage device. For example, the network data processing system provided in this embodiment may further include a storage device communicatively connected to the first network element device 13 . The storage device stores at least one session and a server identifier associated with each session; the first network element device 13 is further configured to use a hash algorithm to calculate a hash factor associated with any session in the at least one session ; Send the calculated hash factor to the storage device, so that the storage device can associate the hash factor with the corresponding session. It is easy to understand that by storing relevant data such as hash factors in a storage device having a communication connection relationship, the storage burden of the first network element device can be effectively reduced, and the storage space of the storage device is larger.

Alternatively, the first network element device 13 in this embodiment may be an edge gateway with a certain computing capability. The edge gateway retains the basic functions of the gateway (ie, data conversion and transmission, etc.), and also has the function of data replication, calculation of hash factors, data storage capabilities, etc., which makes the system architecture provided by this embodiment simpler and the construction cost is low.

The above-mentioned embodiments describe the technical solutions of the present application from the perspective of the overall system. The following will be explained from the perspective of a single executive. FIG. 5 is a schematic flowchart of a method for processing network data according to an embodiment of the present application. The execution body of the network data processing method provided in this embodiment may be the first network element device. The first network element device is a device having a programmable switching processing module, and a data replication engine is configured in the programmable switching processing module, so that operations related to network traffic distribution can be independently implemented. Specifically, as shown in FIG. 5 , the network data processing method includes:

401: Send the received first data to a second network element device.

402: Copy the first data to obtain second data.

403: Send the second data to the target server.

The manner in which the above 402 replicates the first data is as follows:

After receiving the first data, the data replication engine in the first network element device is started; the first data is replicated through the data replication engine to obtain the second data. It should be noted that the first network element device can completely copy the first data to obtain the second data, and can also parse and filter the first data according to actual application requirements (for example, billing applications, security monitoring applications, etc.). operation to filter out irrelevant data, and then copy to obtain second data related to the current application; firstly, the first data may be copied, and then the copied data is parsed and filtered, and the second data is produced.

As can be seen from FIG. 2 and FIG. 3 in the aforementioned embodiments, there may be two ways for the structural relationship of the network data processing system, respectively corresponding to two different ways of sending the second data to the target server. Specifically, the above step 403 can be implemented in the following two ways:

Mode 1, with reference to the schematic structural diagram shown in FIG. 2 , after receiving the first data sent by the network interface device, the first network element device copies the first data, and then the first network element device directly sends it to The target server that has a connection relationship with it, so as to realize the operation of monitoring network traffic.

Mode 2, with reference to the schematic structural diagram shown in FIG. 3 , after receiving the first data sent by the network interface device 12, the first network element device 13 copies the first data, and then the first network element device 13 copies all the data. The second data is sent to the network interface device 12 for forwarding the second data to the target server 14 by the network interface device 12 . The first data is sent by the third network element device 11 to the network interface device 12 , and then sent by the network interface device 12 . That is, the step 403 of “sending the second data to the target server” in this embodiment includes: sending the second data to the network interface device, so that the network interface device forwards the second data to the target server. the target server.

When there are multiple servers, step 403 in this embodiment may include the following steps:

4031. From a plurality of servers, select a target server for the second data;

4032. Send the second data to the target server.

Specifically, in the above step 4031, the target server may be selected by using the session to which the second data belongs. That is, the above 4031 may include;

It is determined whether there is a session to which the second data belongs; when there is a session to which the second data belongs, a server associated with the session among the multiple servers is used as the target server.

The method of determining whether there is a session corresponding to the second data includes: acquiring parameters carried by the second data, wherein the parameters include: source IP address, source port, destination IP address, and destination port; based on the parameter, query whether there is a session to which the second data belongs. The parameters mentioned here may also include a transport layer protocol (specifically, a protocol number), a service type, an interface index, and the like. Further, based on these parameters, the session to which the second data belongs is searched from multiple sessions. Specifically, for how to find the content of the session to which the second data belongs, reference may be made to the corresponding content above, which will not be repeated here.

Further, the hash factor can also be used to implement the query of the session. That is, the above step "based on the parameter, query whether there is a session to which the second data belongs" may include:

S1, according to the parameter, calculate the hash factor;

S2. Using the hash factor, query whether there is a session to which the second data belongs.

It should be noted here that the algorithm for calculating the hash factor based on the source IP address, source port, destination IP address, and destination port, etc., is not specifically limited in this embodiment.

If there is a session to which the second data belongs to the query, a server associated with the session among the multiple servers is used as the target server. For example, the first network element device locally stores a list of association relationships between sessions and server identifiers, so during specific implementation, the server identifier corresponding to a session can be obtained by querying the association relationship list.

If there is no session to which the second data belongs to the query, the method provided by this embodiment may further include the following steps:

404. When the session to which the second data belongs does not exist, create a session to which the second data belongs;

405. Using a hash algorithm, calculate a hash factor associated with the session for easy query;

406. Use any one of the multiple servers as the target server;

407. Associate the server identifier of the target server with the session, so that when the replicated data that belongs to the session as the second data is subsequently received, the replicated data can be sent to the target based on the server identifier. Operation of the server.

FIG. 6 is a schematic flowchart of another network data processing method provided by an embodiment of the present application. The execution body of the network data processing method provided in this embodiment may be a server. The server may be configured to perform a task of monitoring network traffic, or analyzing abnormal traffic, etc. with respect to the received replication data, which is not specifically limited in this embodiment. In this embodiment, the server undertakes the network traffic monitoring task as an example for description. Specifically, as shown in FIG. 6 , the network data processing method includes:

501: Acquire second data obtained by duplicating the first data by the first network element device.

502: Execute a corresponding network traffic monitoring task according to the second data.

There are two ways to implement step 501, including: receiving the second data sent by the first network element device after duplicating the first data; or receiving the second data sent by a network interface device.

Generally speaking, with the structure shown in FIG. 2 , the server can directly receive the second data from the first network element device. With the structure shown in FIG. 3 , the server receives the second data copied by the first network element device from the network interface device. Of course, this is only used as an example. In practical applications, the user can select an appropriate connection mode according to his actual needs, so that the first network element device can be directly used to help the target server implement the corresponding network traffic monitoring function.

It should be noted that the first data is sent by the third network element device to the network interface device, and then sent to the first network element device by the network interface; the second data is the first data Sent by a network element device to the network interface device after copying the first data.

FIG. 7 is a schematic structural diagram of a network data processing apparatus according to an embodiment of the present application. As shown in FIG. 7 , the network data processing apparatus includes: a sending module 61 and a data copying module 62 (for example, it may be a programmable switching processing module configured with a copying engine, so that the data copying function can be realized by this module). in,

The sending module 61 is configured to send the received first data to the second network element device. The data copying module 62 is configured to copy the first data to obtain the second data. The sending module 61 is further configured to send the second data to the target server.

In the technical solution provided by this embodiment, after the first network element device receives the first data sent by the network interface device, and sends the first data to the second network element device, the first network element device also sends the first data to the second network element device. One data is copied to obtain second data; the target server receives the second data sent by the first network element device, and performs related network traffic monitoring tasks according to the second data. With the technical solution provided in this embodiment, there is no need to set up multiple complex auxiliary devices such as optical splitters and distribution switches in the network architecture, and the first network element device can directly use the first network element to complete the data replication, and then send the number of replications to The target server with network traffic monitoring capability has simple structure, lower cost and higher construction efficiency.

Further, the data duplication module 62 is configured to start a data duplication engine after receiving the first data; and obtain the second data by duplicating the first data through the data duplication engine.

Further, the sending module 61 is further configured to send the second data to a network interface device, so that the network interface device forwards the second data to the target server; wherein the first data is the first data The three network element devices are sent to the network interface device, and then sent by the network interface device.

Further, the sending module 61 is further configured to select a target server for the second data from a plurality of servers; and send the second data to the target server.

Further, it also includes a determining module 63 for determining whether there is a session to which the second data belongs; when there is a session to which the second data belongs, the server associated with the session among the multiple servers is used as the the target server.

Further, the determining module 63 is configured to obtain parameters carried by the second data, wherein the parameters include: source IP address, source port, destination IP address and destination port; based on the parameters, query whether there is the first 2. The session to which the data belongs.

Further, the determining module 63 is configured to calculate a hash factor according to the parameter; and use the hash factor to query whether there is a session to which the second data belongs.

Further, the determining module 63 is configured to create a session and store the second data if there is no session to which the second data belongs; using a hash algorithm, calculate a hash factor associated with the session for the convenience of query; use any one of the multiple servers as the target server; associate the server identifier of the target server with the session, so as to subsequently receive the replicated data that belongs to the session with the second data At the same time, the operation of sending the replicated data to the target server can be completed based on the server identifier.

It should be noted here that the network data processing apparatus provided by the above embodiments can implement the technical solutions described in the above corresponding method embodiments, and the specific implementation principles and beneficial effects of the above modules or units can be referred to the corresponding method embodiments above. The content will not be repeated here.

FIG. 8 is a schematic structural diagram of another network data processing apparatus according to an embodiment of the present application. As shown in FIG. 8 , the network data processing apparatus includes: an acquisition module 71 and an execution module 72 .

The obtaining module 71 is configured to obtain second data obtained by duplicating the first data by the first network element device.

The execution module 72 is configured to execute a corresponding network traffic monitoring task according to the second data.

Further, the obtaining module 71 is configured to receive the second data sent by the first network element device after duplicating the first data; or receive the second data sent by the network interface device; wherein the first data One data is sent by the third network element device to the network interface device, and then sent by the network interface to the first network element device; the second data is that the first network element device is responding to the first network element device. The data is copied and sent to the network interface device.

It should be noted here that the network data processing apparatus provided by the above embodiments can implement the technical solutions described in the above corresponding method embodiments, and the specific implementation principles and beneficial effects of the above modules or units can be referred to the corresponding method embodiments above. The content will not be repeated here.

Yet another embodiment of the present application further provides a network element device. FIG. 9 is a schematic structural diagram of a network element device according to an embodiment of the present application. The network element device includes a memory 81, a processor 82 and a communication component 83; wherein,

The memory 81 is used to store programs;

The processor 82, coupled to the memory 81, is configured to execute the program stored in the memory 81, so as to: instruct the communication component 83 to send the received first data to the second network element device; Copying the first data to obtain second data; instructing the communication component to send the second data to the target server.

The memory described above may be configured to store various other data to support operations on the network element device. Examples of such data include instructions for any application or method operating on the network element device. Memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk.

Further, the processor in this embodiment may specifically be: a programmable switching processing chip, and a data copying engine is configured in the programmable switching processing chip, which can copy the received data.

When the above-mentioned processor executes the program in the memory, in addition to the above-mentioned functions, other functions may also be implemented. For details, please refer to the descriptions of the foregoing embodiments.

Further, as shown in FIG. 9 , the network element device further includes: a power supply component 84 and other components. Only some components are schematically shown in FIG. 9 , which does not mean that the first network element device only includes the components shown in FIG. 9 .

During specific implementation, the network element device may be a gateway device.

The embodiment of the present application also provides a server, which is applied to a network traffic monitoring server. FIG. 10 is a schematic structural diagram of a server according to an embodiment of the present application. The server includes a memory 91, a processor 92, a communication component 93 and a power supply component 94; wherein, the memory 91 is used to store programs;

The processor 92, coupled to the memory 91, is configured to execute the program stored in the memory 91, so as to: obtain second data obtained by copying the first data by the first network element device; For the second data, a corresponding network traffic monitoring task is performed.

Wherein, when the processor 92 executes the program in the memory 91, in addition to the above functions, other functions may also be implemented. For details, please refer to the descriptions of the foregoing embodiments.

Correspondingly, the embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the steps or functions of the network data processing methods provided by the foregoing embodiments can be implemented.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions recorded in the foregoing embodiments, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (23)

1. A network data processing system, comprising:

   a first network element device, configured to send the first data to the second network element device, copy the first data to obtain the second data; send the second data to the target server;

   The target server is configured to perform a corresponding network traffic monitoring task according to the received second data.
2. The system according to claim 1, wherein the first network element device has a programmable switching processing module, and the programmable switching processing module is configured with a data replication engine;

   The data replication engine is configured to replicate the received first data to obtain the second data.
3. The system according to claim 1, wherein, when the first network element device sends the second data to the target server, it is specifically used for:

   The second data is sent to the network interface device for forwarding by the network interface device to the target server.
4. The system according to any one of claims 1 to 3, characterized in that it comprises a plurality of servers, and the target server is one of the plurality of servers; and

   When the first network element device sends the second data to the target server, it is specifically used for:

   from the plurality of servers, selecting a target server for the second data;

   Sending the second data to the target server.
5. The system according to claim 4, wherein, when the first network element device selects a target server for the second data from the plurality of servers, it is specifically used for:

   determining whether there is a session to which the second data belongs;

   When there is a session to which the second data belongs, the server associated with the session among the plurality of servers is used as the target server.
6. The system according to claim 5, wherein, when the first network element device determines whether there is a session to which the second data belongs, it is specifically configured to:

   Acquiring parameters carried by the second data, wherein the parameters include: a source IP address, a source port, a destination IP address, and a destination port;

   Based on the parameter, query whether there is a session to which the second data belongs.
7. The system according to claim 6, wherein when the first network element device queries whether there is a session to which the second data belongs based on the parameter, the first network element device is specifically used for:

   According to the parameter, calculate the hash factor;

   Using the hash factor, it is queried whether there is a session to which the second data belongs.
8. The system according to claim 7, wherein the first network element device stores at least one session and a server identifier associated with each session; and

   The first network element device is also used for:

   A hash factor associated with any one of the at least one session is calculated using a hashing algorithm.
9. The system according to claim 7, further comprising: a storage device communicatively connected to the first network element device;

   The storage device is used to store at least one session and a server identifier associated with each session;

   The first network element device is further configured to use a hash algorithm to calculate a hash factor associated with any session in the at least one session; send the calculated hash factor to the storage device, to facilitate the storage device to associate the hash factor with the corresponding session.
10. The system according to any one of claims 1 to 3, wherein the first network element device is a gateway device.
11. The system of claim 10, further comprising:

    A network interface device, configured to receive first data sent by a third network element device, and send the first data to the first network element device.
12. A network data processing method, characterized in that it is applicable to a first network element device, comprising:

    sending the received first data to the second network element device;

    Copying the first data to obtain second data;

    The second data is sent to the target server.
13. The method according to claim 12, wherein the first data is copied to obtain the second data, comprising:

    After receiving the first data, start the data replication engine;

    The second data is obtained by copying the first data through the data copying engine.
14. The method according to claim 12, wherein sending the second data to the target server comprises:

    sending the second data to a network interface device for forwarding by the network interface device to the target server;

    Wherein, the first data is sent by the third network element device to the network interface device, and then sent by the network interface device.
15. The method according to claim 12, wherein sending the second data to the target server comprises:

    From a plurality of servers, selecting a target server for the second data;

    Sending the second data to the target server.
16. The method according to claim 15, wherein selecting a target server for the second data from a plurality of servers comprises:

    determining whether there is a session to which the second data belongs;

    When there is a session to which the second data belongs, the server associated with the session among the plurality of servers is used as the target server.
17. The method according to claim 16, wherein determining whether there is a session to which the second data belongs, comprising:

    Acquiring parameters carried by the second data, wherein the parameters include: a source IP address, a source port, a destination IP address, and a destination port;

    Based on the parameter, query whether there is a session to which the second data belongs.
18. The method according to claim 17, wherein, based on the parameter, querying whether there is a session to which the second data belongs, comprising:

    Calculate the hash factor according to the parameters;

    Using the hash factor, it is queried whether there is a session to which the second data belongs.
19. The method of claim 18, wherein the method further comprises:

    When there is no session to which the second data belongs, creating a session to which the second data belongs;

    utilizing a hashing algorithm, computing a hash factor associated therewith for the session to facilitate query;

    Use any one of the multiple servers as the target server;

    Associating the server identifier of the target server with the session, so that the process of sending the replicated data to the target server can be completed based on the server identifier when subsequently receiving replicated data that belongs to the same session as the second data. operate.
20. A network data processing method, characterized in that it is applicable to a server, the method comprising:

    acquiring second data obtained by duplicating the first data by the first network element device;

    According to the second data, a corresponding network traffic monitoring task is performed.
21. The method according to claim 20, wherein acquiring the second data obtained by duplicating the first data by the first network element device comprises:

    receiving the second data sent by the first network element device after duplicating the first data; or

    receiving the second data sent by the network interface device;

    The first data is sent by the third network element device to the network interface device, and then sent by the network interface to the first network element device; the second data is the first network element The device sends the first data to the network interface device after copying the first data.
22. A network element device is characterized by comprising a memory, a processor and a communication component; wherein,

    the memory for storing programs;

    The processor, coupled to the memory, executes the program stored in the memory for:

    instructing the communication component to send the received first data to the second network element device;

    Copying the first data to obtain second data;

    The communication component is instructed to send the second data to a target server.
23. A server, characterized by comprising a memory and a processor; wherein,

    the memory for storing programs;

    The processor, coupled to the memory, executes the program stored in the memory for:

    acquiring second data obtained by duplicating the first data by the first network element device;

    According to the second data, a corresponding network traffic monitoring task is performed.

Images