WO2022100581A1

WO2022100581A1 - Method for processing ipfix message, storage medium, network switching chip and asic chip

Info

Publication number: WO2022100581A1
Application number: PCT/CN2021/129606
Authority: WO
Inventors: 朱涛; 周伟
Original assignee: 苏州盛科通信股份有限公司
Priority date: 2020-11-10
Filing date: 2021-11-09
Publication date: 2022-05-19
Also published as: CN112422434A

Abstract

Disclosed in the present invention are a method for processing an IPFIX message, a storage medium, a network switching chip and an ASIC chip. The method comprises: transmitting a corresponding flow ID to an outgoing direction during IPFIX message processing in an incoming direction; and indexing a corresponding flow according to the transmitted flow ID in the outgoing direction, and performing IPFIX message processing in the outgoing direction on the flow. In this case, a flow table does not need to be generated again according to flow table feature information in the outgoing direction, while the IPFIX flow table in the incoming direction is multiplexed, such that the IPFIX flow table in the incoming direction and the IPFIX flow table in the outgoing direction are combined into one flow table, and the subsequent IPFIX message reporting function and the chip working reliability are ensured.

Description

IPFIX message processing method, storage medium, network switching chip and ASIC chip

This application claims the priority of the Chinese patent application with the application number 202011247536.5 and the invention title "IPFIX message processing method and its application, ASIC chip" filed with the China Patent Office on November 10, 2020, the entire contents of which are incorporated herein by reference Applying.

technical field

The present invention relates to the field of the Internet, in particular, to an IPFIX message processing method, a storage medium, a network switching chip and an ASIC chip.

Background technique

The IPFIX (IP Flow Information Export, IP data flow information output) network mainly includes three devices: the reporting device Export, the collection device Collector, and the analysis device Analyzer, as shown in Figure 8. Export is used to analyze and process network flows (Flow), extract eligible flow statistics, and output the statistics to the Collector; the Collector is responsible for parsing the Export data packets (IPFIX), and collects the statistical data into the database. For Analyser to analyze; Analyser extracts statistical data from Collector, performs subsequent processing, provides basis for various services, and displays it in the form of a graphical interface.

IPFIX is based on the concept of "flow". A flow refers to: from the same sub-interface, with the same source and destination IP (Internet Protocol, Internet Protocol) addresses, protocol types, the same source and destination protocol port numbers, and the same ToS (Terms of Service, terms of service) message, usually a seven-tuple. IPFIX will record the statistics of this flow, including: timestamp, number of packets, total number of bytes, etc.

In the IPFIX processing flow of the Export device, when the message passes through the ASIC (Application Specific Integrated Circuit) chip, an IPFIX flow table will be generated in the IPFIX engine, and the information will be reported to the CPU (Central Processing Unit, CPU). After receiving the IPFIX flow table information, the CPU reorganizes the data and sends packets in standard IPFIX format to the Collector device.

Referring to Figure 9, in the IPFIX processing flow of the ASIC chip, when the ASIC chip receives a packet (processing in the inbound direction), it will send the packet information to the IPFIX engine for processing. In the IPFIX engine, an IPFIX flow table will be generated and reported to the CPU. ; When the ASIC chip sends a packet (outbound processing), it will also send the packet information to the IPFIX engine for processing. In the IPFIX engine, an IPFIX flow table will be generated and reported to the CPU.

It can be seen that in the existing IPFIX processing flow, the IPFIX flow table is independently generated in the incoming direction and the outgoing direction of the ASIC and the information is reported separately. However, in practical applications, due to resource constraints, the corresponding IPFIX flow table may not be successfully generated using the flow table feature information in the inbound or outbound direction, resulting in the failure of the subsequent IPFIX message reporting function and affecting the reliability of the chip. sex.

SUMMARY OF THE INVENTION

In view of this, the purpose of the embodiments of the present invention is to provide an IPFIX message processing method, an application thereof, and an ASIC chip.

In order to achieve the above purpose, the technical solution provided by an embodiment of the present invention is as follows:

A method for processing an IPFIX message, the method comprising:

When processing the inbound IPFIX message, transmit the corresponding stream ID (Identity Document, identity number) to the given direction;

In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and the outbound direction IPFIX message processing is performed on it.

The present application also provides another embodiment of the method for processing an IPFIX message, including:

When processing the inbound direction IPFIX message, the corresponding flow ID and flow table change count are transmitted to give a direction, and the flow table change count is set to change the count when the corresponding flow is deleted;

In the outgoing direction, according to the corresponding flow of the flow ID index of the transmission, and judge whether the flow table change count corresponding to the flow of the index is consistent with the flow table change count transmitted in the inbound direction; if not,

No IPFIX message processing for the indexed flow is performed in the outbound direction.

In one embodiment, if the flow table change count corresponding to the indexed flow is consistent with the flow table change count transmitted in the inbound direction, the IPFIX message processing is performed on the indexed flow in the outgoing direction.

In an embodiment, performing IPFIX message processing on the indexed flow in the outbound direction, including:

In the outgoing direction, update the IPFIX flow table record information of the outgoing direction flow table corresponding to the indexed flow.

In one embodiment, the method further includes:

When the inbound direction meets the reporting conditions, report the inbound flow table record information and outbound flow table record information of the IPFIX flow table at the same time; and/or,

When the outbound direction meets the reporting conditions, the inbound direction flow table record information and the outbound direction flow table record information of the IPFIX flow table are reported at the same time.

In one embodiment, the method further includes:

When processing the incoming direction IPFIX message, transmit the corresponding stream ID valid flag to give the direction;

When the transmitted stream ID valid flag is invalid, no IPFIX message processing is performed in the outbound direction.

The application also provides an embodiment of an ASIC chip, where the ASIC chip includes an IPFIX engine and is set to:

When processing the inbound IPFIX message, the corresponding flow ID is transmitted to give the direction;

In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and it is judged whether the flow table change count corresponding to the indexed stream is consistent with the flow table change count transmitted in the inbound direction; if not,

The present application also provides an embodiment of a network switch chip, the network switch chip includes: a kernel and a RAM, and the kernel is configured to implement the above-mentioned IPFIX message processing method.

The present application also provides an embodiment of a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and the computer-executable instructions are configured to execute the above-mentioned IPFIX message processing method.

In the technical solution of the present application, when processing the inbound IPFIX message, the corresponding flow ID is transmitted to give the direction, and in the outbound direction, the corresponding flow can be indexed directly according to the transmitted flow ID, and the outbound IPFIX message processing is performed on it; In this way, in the outbound direction, it is not necessary to regenerate the flow table according to the characteristic information of the flow table, but multiplex the IPFIX flow table in the inbound direction, so that the IPFIX flow table in the inbound direction and the outbound direction is combined into one flow table, which ensures the subsequent IPFIX flow table. Message reporting function and reliability of chip work.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments described in the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

1 is a flowchart of an IPFIX message processing method according to an embodiment of the present invention;

2 is a flowchart of a method for processing an IPFIX message according to another embodiment of the present invention;

Fig. 3 is the schematic diagram of the reporting device processing IPFIX message of the IPFIX message processing method of an embodiment of the present invention;

4 is a schematic diagram of an ASIC chip processing an IPFIX message according to an embodiment of the present invention;

5 is a functional schematic diagram of an IPFIX aging timer in an ASIC chip of an IPFIX message processing method according to an embodiment of the present invention;

6 is a block diagram of an ASIC chip of an IPFIX message processing method according to an embodiment of the present invention;

7 is a schematic diagram of a hardware structure of a network switch chip in an embodiment of the present invention;

8 is a schematic diagram of the networking composition of the prior art IPFIX;

FIG. 9 is a schematic diagram of a prior art ASIC chip processing an IPFIX message.

Detailed ways

In order to make those skilled in the art better understand the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described The embodiments are only some of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Before introducing the IPFIX message processing method of the present application, several typical IPFIX application scenarios are first introduced.

1. Usage-based Accounting (billing based on usage traffic)

In the past, the traffic billing in network operators was generally simply based on the user's upload and download traffic. Since IPFIX can be accurate to fields such as destination IP, protocol port, etc., traffic charging can be charged in sections based on the characteristics of application services.

2. Traffic Profiling (traffic overview), Traffic Engineering: (traffic engineering)

Through the record output of IPFIX Exporter, IPFIX Collector can output very rich traffic record information in various chart forms, which is the concept of Traffic Profiling. However, it is only a record of information, and the powerful functions of IPFIX cannot be used. IETF also introduced the concept of Traffic Engineering: in the actual operation network, load balancing and redundant backup are often planned, but various protocols are generally planned according to the network. It can be adjusted according to the predetermined route or the principle of the agreement. However, if IPFIX is used to monitor the traffic in the network, and it is found that some data flows are large in a certain period of time, it can be reported to the network administrator for traffic adjustment, so as to allocate and adjust more network bandwidth for related application services and reduce uneven load. situation occurs. Even more intelligently, setting rules such as routing adjustment, bandwidth allocation, and security policy can be directly bound to the operations on the IPFIX Collector, and network traffic adjustment can be automatically completed.

3. Attack/Intrusion Detection: Attack/Intrusion Detection

From the description of the second application scenario above, it can be known that IPFIX can detect network attacks (such as typical IP scanning, port scanning, DDOS (Distributed Denial Of Service, distributed denial of service) attacks) based on traffic characteristics. Using the standard IPFIX protocol, you can also use the "signature library" upgrade to prevent the latest network attacks like the general host-side virus protection.

Referring to FIG. 1, an optional implementation manner of the method for processing an IPFIX message of the present application is introduced. In this embodiment, the method includes:

S11. When processing the inbound IPFIX message, transmit the corresponding flow ID to give the direction.

With reference to Figure 3 and Figure 4, when the Export device receives a data packet, it will go through the IPFIX engine of the ASIC chip. When a packet passes through the IPFIX engine, it first determines whether the IPFIX feature is enabled. If it is not enabled, the IPFIX engine processing is skipped; if the IPFIX feature is enabled, it enters the IPFIX engine. In the IPFIX engine, the flow table feature information of the packet is extracted, and according to the flow table feature information, it is searched whether there is a flow (Flow) with the same flow table feature information. If the Flow already exists, update the corresponding inbound flow table record information; if the Flow does not exist, generate a new Flow, fill in the flow table characteristic information of the Flow with the flow table characteristic information of the packet, and update the corresponding inbound flow Table records information. Of course, if the newly generated Flow fails here, the processing of the subsequent IPFIX engine is skipped.

Illustratively, for the IPFIX flow table, the seven-tuple flow table feature information is generally used:

1. Source IP address

2. Destination IP address

3. TCP/UDP source port

4. TCP/UDP destination port

5. Layer 3 protocol type

6. Type-of-service bytes

7. Input logic interface

When processing the IPFIX message in the above inbound direction, the IPFIX engine will send the corresponding flow ID to the direction, and each Flow has a unique flow ID; preferably, the corresponding flow ID valid flag (FlowIDValid) will also be sent. Given the direction, the flow valid flag is used to indicate whether the corresponding Flow is "valid", such as invalid when the IPFIX feature is not enabled, and invalid when the flow table generation fails.

In this embodiment, when the inbound direction meets the reporting conditions, the flow table feature information of the IPFIX flow table, the inbound direction flow table record information and the outbound direction flow table record information are also reported at the same time. Illustratively, common reporting conditions include:

1. New flow generation

2. Delete the flow table

3. The total number of packets exceeds the set threshold

4. The total number of bytes of the message exceeds the set threshold

5. The packet timestamp exceeds the set threshold

6. The TCP connection is disconnected

7. Packet jitter is too large

8. The message delay is too large

9. Packet TTL (Time To Live, time to live) changes

10. The reason for discarding packets is changed

11. The count of discarded packets exceeds the set threshold

12. The message destination information has changed

In this way, even when analyzing the IPFIX message reported in the inbound direction, the corresponding outbound direction flow table record information can be obtained.

S12. In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and the outbound direction IPFIX message processing is performed on it.

First, determine whether the stream ID valid flag is valid. When the transmitted stream ID valid flag is invalid, it means that no IPFIX message processing is required in the outbound direction, and the IPFIX engine processing is skipped.

If the stream ID valid flag is valid, it indicates that the IPFIX feature has been enabled and entered the IPFIX engine. In the IPFIX engine, the corresponding Flow is indexed according to the transmitted flow ID, and the outbound flow table record information of the IPFIX flow table corresponding to the indexed Flow is updated in the outbound direction to complete the outbound direction IPFIX message processing.

It can be seen that, in the IPFIX message processing method provided by this application, it is not necessary to regenerate the flow table according to the characteristic information of the flow table in the outgoing direction, but the outgoing flow is indexed by the flow ID, so that the IPFIX flow table in the inbound direction is not required to be generated again. After multiplexing, the inbound and outbound IPFIX flow tables are combined into one flow table, which ensures the reliability of subsequent IPFIX message reporting and chip operation.

Similarly, when the outbound direction meets the reporting conditions, the flow table feature information of the IPFIX flow table, the inbound direction flow table record information, and the outbound direction flow table record information are also reported at the same time, reducing the complexity of the CPU chip merging table entries.

In practical applications, there is a certain time difference between the processing of IPFIX messages in the outbound direction and the processing of IPFIX messages in the inbound direction. Therefore, there may be a situation in which the flow corresponding to the inbound direction is deleted by the aging timer during the processing of IPFIX messages in the outbound direction, or even restarted. When a new Flow is learned, if the flow is directly indexed by the flow ID in the outbound direction, the outbound flow table record information of other Flows may be modified, so that the IPFIX message of another Flow is reported by the wrong DMA.

For the above possibility, referring to FIG. 2 , the present application also provides another optional implementation manner of an IPFIX message processing method. In this embodiment, the method includes:

S21. When processing the inbound IPFIX message, transmit the corresponding flow ID and flow table change count to the given direction.

Referring to FIG. 4 and FIG. 5 , different from the previous embodiment, in this embodiment, when the direction is given by the stream ID, the stream table change count is also transmitted. The flow table change count is set to be changed only when the corresponding flow is deleted, and is recorded in the flow table record information.

The deletion here may be, for example, that the aging timer determines that the IPFIX flow table corresponding to the Flow satisfies the aging condition when performing the aging scan, so as to execute the aging deletion of the Flow. In one embodiment, the flow table change count may, for example, have an initial value=1. When the IPFIX flow table is deleted, the flow table change count in the flow table record information will not be cleared, but an accumulation operation will be performed. Flow table change count = 2.

S22: Index the corresponding flow according to the transmitted flow ID in the outbound direction, and determine whether the flow table change count corresponding to the indexed flow is consistent with the flow table change count transmitted in the inbound direction.

Since the corresponding flow table change count has been sent to the given direction when the inbound direction IPFIX message is processed, the flow table change count that has been sent to the given direction will not be changed because the corresponding Flow is deleted. In this way, in the outbound direction, the flow table change count corresponding to the flow indexed according to the flow ID can be compared with the flow table change count of the transmission. If the two values are inconsistent, it means that the corresponding Flow has been deleted during the transmission process; correspondingly, if the two values are consistent, it means that the corresponding Flow has not been deleted during the transmission process.

S23. If the flow table change count corresponding to the indexed flow is inconsistent with the flow table change count transmitted in the inbound direction, the IPFIX message processing for the indexed flow is not performed in the outbound direction.

In the case that the Flow corresponding to the outgoing direction has been deleted, the Flow is already a newly generated Flow according to the flow ID index, and the corresponding IPFIX flow table outgoing direction record information is not updated at this time. Exemplarily, in this case, the IPFIX processing can be skipped directly.

If the Flow corresponding to the outbound direction is not deleted, the record information of the outbound direction flow table corresponding to the Flow indexed according to the flow ID is directly updated.

For the IPFIX message processing method in this embodiment, reference may also be made to the previous embodiment in part or in whole, and repeated methods/steps will not be repeated here.

Referring to FIG. 6 , the present application also provides an optional implementation manner of an ASIC chip. In this embodiment, the ASIC chip includes an IPFIX engine, which is configured to transmit the corresponding stream ID to give a direction when processing the inbound IPFIX message; in the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, And process the outbound IPFIX message. or,

The IPFIX engine is configured to transmit the corresponding flow ID and flow table change count to a given direction when processing the inbound IPFIX message; in the outbound direction, index the corresponding flow according to the transmitted flow ID, and determine the index Whether the flow table change count corresponding to the outgoing flow is consistent with the flow table change count transmitted in the incoming direction; if not, the IPFIX message processing for the indexed flow is not performed in the outgoing direction.

The above description of the ASIC chip device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects to the method embodiment. For technical details not disclosed in the device embodiments of the present application, please refer to the descriptions of the method embodiments of the present application for understanding.

In a typical Export device, the ASIC chip here is integrated with the PHY (Physical Layer, physical layer) chip, the MAC (Media Access Layer, media access layer) chip and the CPU chip, so that many external components can be removed, making A good match is achieved between the chips, and the number of pins and chip area can be reduced at the same time.

It should be noted that, in the embodiments of the present application, if the above data reading and writing method is implemented in the form of a software function module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or the parts that make contributions to the prior art not only exist in the chip implementation, but can also be embodied in the form of software products, and the computer software products are stored in a The storage medium includes several instructions for causing a switch chip to execute all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read only memory (Read Only Memory, ROM), a magnetic disk or an optical disk and other media that can store program codes. As such, the embodiments of the present application are not limited to any specific combination of hardware and software.

Correspondingly, an embodiment of the present application provides a network switch chip, including a memory, a kernel and a RAM (Random Access Memory, random access memory), the memory stores a computer program that can be run through the kernel, and the kernel is in the When running the computer program, the steps in the IPFIX message processing method provided by the above embodiment are implemented, and the method includes:

When processing the inbound IPFIX message, the corresponding stream ID is transmitted to give the direction; in the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and the outbound IPFIX message processing is performed on it. or,

When processing the inbound IPFIX message, the corresponding flow ID and flow table change count are transmitted to give the direction; in the outbound direction, the corresponding flow is indexed according to the transmitted flow ID, and the corresponding flow of the indexed flow is determined. Whether the table change count is consistent with the flow table change count transmitted in the inbound direction; if not, the IPFIX message processing for the flow indexed out is not performed in the outbound direction.

Correspondingly, the core of the network switching chip may also be used to implement the steps in the IPFIX processing method provided in the above embodiment, which will not be repeated here.

Correspondingly, the embodiments of the present application provide a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and the computer-executable instructions are configured to execute the IPFIX message processing methods provided by the above embodiments. step.

It should be pointed out here that the descriptions of the above storage medium and device embodiments are similar to the descriptions of the above method embodiments, and have similar beneficial effects to the method embodiments. For technical details not disclosed in the embodiments of the storage medium and device of the present application, please refer to the description of the method embodiments of the present application to understand.

It should be noted that Fig. 7 is a schematic diagram of a hardware entity of a network switching chip in the embodiment of the application, and as shown in Fig. 7, the hardware entity of this switching chip includes: a kernel, a communication interface and a memory, wherein:

The kernel usually controls the overall operation of the network switch chip.

The communication interface enables the network switch chip to communicate with other terminals or servers through the network.

The memory is configured to store instructions and applications executable by the kernel, and can also cache data (for example, image data, audio data, voice communication data and video communication data) to be processed or processed by each module in the kernel and the network switch chip, It can be implemented by random access memory (Random Access Memory, RAM).

In the technical solution of the present application, when processing the inbound IPFIX message, the corresponding flow ID is transmitted to give the direction, and in the outbound direction, the corresponding flow can be indexed directly according to the transmitted flow ID, and the outbound IPFIX message processing is performed on it; In this way, in the outbound direction, it is not necessary to generate the flow table again according to the characteristic information of the flow table, but multiplex the IPFIX flow table in the inbound direction, so that the IPFIX flow table in the inbound direction and the outbound direction are combined into one flow table; Comparing the change count of the transport flow table with the change count of the flow table corresponding to the indexed flow in the outgoing direction can avoid performing wrong operations on the indexed flow in the outgoing direction when the original flow in the inbound direction has been deleted. IPFIX message processing ensures the reliability of subsequent IPFIX message reporting function and chip operation.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.

For the convenience of description, when describing the above device, the functions are divided into various modules and described respectively. Of course, when implementing one or more embodiments of this specification, the functions of each module may be implemented in one or more software and/or hardware.

It should also be noted that the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device comprising a series of elements includes not only those elements, but also Other elements not expressly listed, or inherent to such a process, method, article of manufacture or apparatus are also included. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article of manufacture, or device that includes the element.

As will be appreciated by one skilled in the art, embodiments of one or more of the embodiments of this specification may be provided as a method, system or computer program product. Accordingly, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of the present specification may employ one or more computer-usable storage media (including but not limited to disk storage, CD-ROM (Compact Disk Read Only Memory), compact disc only read memory), optical memory, etc.) in the form of a computer program product.

One or more embodiments of this specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

It will be apparent to those skilled in the art that the present invention is not limited to the details of the above-described exemplary embodiments, but that the present invention may be embodied in other forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments are to be regarded in all respects as illustrative and not restrictive, and the scope of the invention is to be defined by the appended claims rather than the foregoing description, which are therefore intended to fall within the scope of the claims. All changes within the meaning and scope of the equivalents of , are included in the present invention. Any reference signs in the claims shall not be construed as limiting the involved claim.

In addition, it should be understood that although this specification is described in terms of embodiments, not each embodiment only includes an independent technical solution, and this description in the specification is only for the sake of clarity, and those skilled in the art should take the specification as a whole , the technical solutions in each embodiment can also be appropriately combined to form other implementations that can be understood by those skilled in the art.

Claims

A method for processing an IPFIX message, the method comprising:

When processing the inbound IPFIX message, the corresponding flow ID is transmitted to give the direction;

In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and the outbound direction IPFIX message processing is performed on it.
A method for processing an IPFIX message, the method comprising:

When processing the inbound IPFIX message, the corresponding flow ID and flow table change count are transmitted to give a direction, and the flow table change count is set to change the count when the corresponding flow is deleted;

In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and it is judged whether the flow table change count corresponding to the indexed stream is consistent with the flow table change count transmitted in the inbound direction; if not,

No IPFIX message processing for the indexed flow is performed in the outbound direction.
The method for processing an IPFIX message according to claim 1, wherein, if the flow table change count corresponding to the indexed flow is consistent with the flow table change count transmitted in the inbound direction, the indexed flow is processed in the outbound direction. Perform IPFIX message processing.
The method for processing an IPFIX message according to any one of claims 1 to 3, wherein performing IPFIX message processing on the indexed stream in the outbound direction, comprising:

In the outgoing direction, the IPFIX flow table record information of the outgoing direction flow table corresponding to the indexed flow is updated.
The method for processing an IPFIX message according to any one of claims 1 to 3, wherein the method further comprises:

When the inbound direction meets the reporting conditions, report the inbound flow table record information and outbound flow table record information of the IPFIX flow table at the same time; and/or,

When the outbound direction meets the reporting conditions, the inbound direction flow table record information and the outbound direction flow table record information of the IPFIX flow table are reported at the same time.
The method for processing an IPFIX message according to any one of claims 1 to 3, wherein the method further comprises:

When processing the incoming direction IPFIX message, transmit the corresponding stream ID valid flag to give the direction;

When the transmitted stream ID valid flag is invalid, no IPFIX message processing is performed in the outbound direction.
An ASIC chip, the ASIC chip comprising an IPFIX engine, configured as:

When processing the inbound IPFIX message, the corresponding flow ID is transmitted to give the direction;

In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and the outbound direction IPFIX message processing is performed on it.
An ASIC chip, the ASIC chip comprising an IPFIX engine, configured as:

When processing the inbound IPFIX message, the corresponding flow ID and flow table change count are transmitted to give a direction, and the flow table change count is set to change the count when the corresponding flow is deleted;

In the outbound direction, the corresponding stream is indexed according to the transmitted stream ID, and it is judged whether the flow table change count corresponding to the indexed stream is consistent with the flow table change count transmitted in the inbound direction; if not,

No IPFIX message processing for the indexed flow is performed in the outbound direction.
A network switch chip, the network switch chip comprising: a kernel and a RAM, the kernel is configured to implement the IPFIX message processing method provided by any one of the above claims 1 to 6.
A computer-readable storage medium, storing computer-executable instructions in the computer-readable storage medium, the computer-executable instructions being configured to execute the IPFIX message processing method provided by any one of claims 1 to 6 above.