WO2023004992A1 - Open Stack租户网络的流量监控方法、装置 - Google Patents

Open Stack租户网络的流量监控方法、装置 Download PDF

Info

Publication number
WO2023004992A1
WO2023004992A1 PCT/CN2021/121906 CN2021121906W WO2023004992A1 WO 2023004992 A1 WO2023004992 A1 WO 2023004992A1 CN 2021121906 W CN2021121906 W CN 2021121906W WO 2023004992 A1 WO2023004992 A1 WO 2023004992A1
Authority
WO
WIPO (PCT)
Prior art keywords
flow
traffic
virtual machine
data
data flow
Prior art date
Application number
PCT/CN2021/121906
Other languages
English (en)
French (fr)
Inventor
孙希发
雷亚帅
Original Assignee
苏州浪潮智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州浪潮智能科技有限公司 filed Critical 苏州浪潮智能科技有限公司
Priority to US18/270,417 priority Critical patent/US20240048468A1/en
Publication of WO2023004992A1 publication Critical patent/WO2023004992A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/20—Arrangements for monitoring or testing data switching networks the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H04L43/0888—Throughput
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45591—Monitoring or debugging support
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H04L43/045—Processing captured monitoring data, e.g. for logfile generation for graphical visualisation of monitoring data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/12—Network monitoring probes

Definitions

  • the present application relates to the field of computer technology, in particular to a flow monitoring method, device, equipment and medium of an OpenStack tenant network.
  • the purpose of this application is to provide a traffic monitoring method, device, equipment and medium of an Open Satck tenant network, so as to monitor the traffic interaction between virtual machines.
  • the specific plan is as follows:
  • a flow monitoring method of an Open Stack tenant network comprising:
  • the callback function Utilize the callback function to detect the flow in and out status of the first virtual machine in the first OpenStack host;
  • the callback function is a function pre-registered in the Linux bridge in the first OpenStack host;
  • the target flow table rule stored in the integrated bridge in the first OpenStack host is utilized matching the first data stream corresponding to the first traffic, and sending the copied first data stream to a traffic monitoring platform to monitor the first traffic;
  • the target flow table rule is used to match the second data flow corresponding to the second flow, And send the copied second data stream to the physical network bridge of the first OpenStack host;
  • the physical network bridge When the physical network bridge receives the copied second data flow, reflective learning is performed on the second data flow according to the target flow table rules to obtain a third data flow, and the third data flow is The data flow is sent to the integrated bridge;
  • the integrated network bridge When the integrated network bridge receives the third data stream, it sends the third data stream to the traffic monitoring platform to monitor the second traffic.
  • the physical network bridge receives the copied second data flow
  • reflective learning is performed on the second data flow according to the target flow table rules to obtain a third data flow
  • the process of sending the third data stream to the integrated bridge includes:
  • unicast learning is performed on the copied second data stream to obtain the third data stream, and the third data stream is Streams are sent to the integration bridge.
  • it also includes:
  • the integrity of the copied first data stream and/or the third data stream is verified by using the traffic monitoring platform.
  • it also includes:
  • the process of sending the third data flow to the traffic monitoring platform to monitor the second traffic includes :
  • the integrated network bridge When the integrated network bridge receives the third data flow, the vlan in the third data flow is modified to be the target vlan corresponding to the traffic monitoring platform, and the target vlan is used to set the The third data stream is sent to the traffic monitoring platform to monitor the second traffic.
  • it also includes:
  • it also includes:
  • IP address and/or MAC address and/or target port of the first virtual machine and/or the second virtual machine and/or the third virtual machine are detected to be abnormal by using the traffic monitoring platform, Then disable the IP address and/or the MAC address and/or the target port.
  • this application also discloses a traffic monitoring device for an Open Stack tenant network, including:
  • the state detection module is used to detect the flow in and out state of the first virtual machine in the first Open Stack host using a callback function; wherein, the callback function is pre-registered in the Linux bridge in the first Open Stack host function;
  • the first monitoring module is configured to use the integrated network bridge in the first OpenStack host when it is detected that the first virtual machine sends the first traffic to the second virtual machine in the first OpenStack host
  • the stored target flow table rule matches the first data flow corresponding to the first flow, and sends the copied first data flow to a flow monitoring platform, so as to monitor the first flow;
  • a data sending module configured to use the target flow table rule matching to correspond to the second traffic when it is detected that the first virtual machine sends the second traffic to the third virtual machine in the second OpenStack host The second data stream, and send the copied second data stream to the physical bridge of the first OpenStack host;
  • a data processing module configured to, when the physical bridge receives the copied second data flow, reflectively learn the second data flow according to the target flow table rules to obtain a third data flow, and sending the third data stream to the integrated bridge;
  • the second monitoring module is configured to, when the integrated network bridge receives the third data flow, send the third data flow to the flow monitoring platform, so as to monitor the second flow.
  • the application also discloses a flow monitoring device of an Open Stack tenant network, comprising:
  • the processor is configured to implement the steps of a flow monitoring method for an OpenStack tenant network as disclosed above when executing the computer program.
  • the present application also discloses a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, a kind of Open Stack tenant network as disclosed above is realized.
  • the steps of the traffic monitoring method are also disclosed.
  • the target flow table rule stored in the integrated bridge in the first OpenStack host is used to match the first flow corresponding to the first flow.
  • the traffic monitoring platform and send the copied first data flow to the traffic monitoring platform, so as to utilize the traffic monitoring platform to monitor the first traffic; when it is detected that the first virtual machine sends When the second flow, then use the target flow table rule to match the second data flow corresponding to the second flow, and send the copied second data flow to the physical network bridge of the first Open Stack host; when the first Open Stack
  • the physical bridge of the host receives the copied second data flow, it performs reflective learning on the second data flow according to the rules of the target flow table, obtains the third data flow, and sends the third data flow to the first Open Stack host
  • the integrated network bridge within; when the integrated network bridge receives the third data stream, it sends the third data stream to the traffic monitoring platform, so that the second traffic can be monitored by the traffic monitoring platform.
  • the traffic interaction between virtual machines can be monitored through the method provided in this application.
  • the traffic monitoring device, equipment and medium of an Open Stack tenant network provided by this application also have the above-mentioned beneficial effects.
  • Fig. 1 is the flowchart of the traffic monitoring method of a kind of Open Stack tenant network provided by the embodiment of the application;
  • Figure 2 is a schematic diagram of the model of the OpenStack tenant network
  • Fig. 3 is the structural diagram of the flow monitoring device of a kind of Open Stack tenant network provided by the embodiment of the present application;
  • FIG. 4 is a structural diagram of a traffic monitoring device of an Open Stack tenant network provided by an embodiment of the present application.
  • Fig. 1 is the flow chart of the traffic monitoring method of a kind of Open Stack tenant network provided by the embodiment of the present application, and this method comprises:
  • Step S11 using the callback function to detect the flow in and out status of the first virtual machine in the first Open Stack host;
  • the callback function is a function pre-registered in the Linux bridge in the first Open Stack host;
  • Step S12 When it is detected that the first virtual machine sends the first flow to the second virtual machine in the first OpenStack host, then use the target flow table rule stored in the integrated bridge in the first OpenStack host to match the first traffic A first data stream corresponding to the traffic, and sending the copied first data stream to the traffic monitoring platform to monitor the first traffic;
  • Step S13 When it is detected that the first virtual machine sends the second flow to the third virtual machine in the second OpenStack host, then use the target flow table rule to match the second data flow corresponding to the second flow, and copy After the second data stream is sent to the physical bridge of the first Open Stack host;
  • Step S14 When the physical bridge receives the copied second data flow, it performs reflective learning on the second data flow according to the target flow table rules to obtain the third data flow, and sends the third data flow to the integrated bridge ;
  • Step S15 When the integrated bridge receives the third data stream, it sends the third data stream to the traffic monitoring platform to monitor the second traffic.
  • FIG. 2 is a schematic diagram of the OpenStack tenant network model.
  • Node1 and Node2 are two physical hosts in the OpenStack tenant network respectively, wherein VM1 and VM2 are two virtual machines in the first OpenStack host Node1, and VM3 is one of the second OpenStack host Node2 They all belong to vlan (Virtual Local Area Network, virtual local area network) 100; br-int is an integrated bridge, and br-phy is a physical bridge for connecting to a physical network.
  • vlan Virtual Local Area Network, virtual local area network
  • the integrated bridge br-int will specify how to transmit or forward the data entering or leaving the integrated bridge br-int through flow table rules.
  • the conversion from the internal vlan ID to the external vlan ID will be completed through the flow table rules, so that the data entering the physical bridge br-phy has the correct vlan ID; after that, the traffic will be sent directly to On the physical switch, the physical switch forwards the traffic to the physical network card eth1 of Node2 through the physical VLAN setting, so that the traffic in VM1 is sent to VM3.
  • the traffic returned by VM3 will be forwarded to the physical bridge br-phy through the physical network card eth1 of Node1, and the physical bridge br-phy will forward the traffic to the integrated bridge br-int.
  • the integrated network The bridge br-int will convert the traffic according to the rules of the flow table, convert the external vlan into the internal vlan, and accurately send the data to the virtual devices qvb-xxx and qvo-xxx corresponding to VM1 through the internal vlan identifier, and send The internal vlan logo is removed; when the Linux bridge receives the traffic sent by the virtual devices qvb-xxx and qvo-xxx, it will send the traffic to VM1 through the network tap device, and VM1 will receive the return from VM3 through the virtual network card traffic and complete the data transmission.
  • this embodiment proposes a traffic monitoring method for the OpenStack tenant network, through which the traffic interaction between virtual machines can be monitored.
  • the key network device of the virtual machine is the tap-xxx device connected to the Linux bridge.
  • the Linux bridge is a device used for tcp/ip layer 2 protocol exchange on Linux, which is similar to the function of a switch in the real world.
  • the Linux network bridge can be connected with other network devices on Linux, and the function of the Linux network bridge is mainly implemented in the kernel.
  • netdev_rx_handler_register() is called, and a function for receiving data is registered.
  • this function will be called whenever data is received from this device, and the data will be forwarded to the Linux bridge through this function. .
  • this monitoring method it is necessary to register a callback function in the Linux bridge in the first OpenStack host in advance, so as to use the callback function to detect the flow in and out status of the virtual machine.
  • the first virtual machine VM1 receives traffic or sends traffic to other devices, it will report heartbeat information to the callback function, and use this to indicate that the first virtual machine VM1 is receiving or sending data, so that the virtual machine can The data flow and the ongoing data transmission to the monitoring virtual machine.
  • the callback function only completes a simple traffic trigger action and does not perform actual data operations. Therefore, the traffic detection process will not have any impact on the data processing of the virtual network.
  • the callback function is inserted in the Linux bridge, in order to monitor the network interaction between virtual machines, it is also necessary to insert the target flow table rule on the integrated bridge br-int, and associate a port in the integrated bridge To mirror the traffic data entering and exiting the integrated bridge to the target port of the traffic monitoring platform, so as to achieve the purpose of monitoring the traffic entering and exiting the virtual machine.
  • the callback function is used to detect the flow in and out state of the first virtual machine VM1 in the first OpenStack host, and when it is detected that the first virtual machine VM1 sends traffic to the first virtual machine VM1 in the same physical host
  • the second virtual machine VM2 uses the target flow table rule stored in the integrated bridge br-int in the first OpenStack host to match the first data flow corresponding to the first flow, and the first data flow stream, and then send the copied first data stream to a third-party traffic monitoring platform, so that the traffic monitoring platform can monitor the first traffic between the first virtual machine VM1 and the second virtual machine VM2 monitor.
  • the purpose of monitoring the traffic interaction between different virtual machines in the same OpenStack host can be achieved through such a setting method.
  • the integrated bridge br-int will send the copied second data flow to the physical bridge br-phy in the first Open Stack host, when the physical bridge br-phy receives the copied second data flow , reflective learning will be performed on the second data flow according to the target flow table rule, so that the second flow can be sent from the first virtual machine VM1 to the third virtual machine VM3.
  • the third data flow will be obtained, and then the physical bridge br-phy will send the third data flow to the integrated bridge br-int.
  • the integrated bridge br-int When the integrated bridge br-int receives the third data stream, it will send the third data stream to the third-party traffic monitoring platform, so as to use the third-party traffic monitoring platform to monitor the first virtual machine VM1 and the third virtual machine The second traffic between the machine VM3 is monitored.
  • the traffic monitoring platform can be set as Traffic Monitor, because Traffic Monitor is not only an open source and free Windows platform traffic monitoring software, but also, Traffic Monitor can also display the monitored information in real time on its task In this way, it is convenient for the user to view the traffic interaction between the virtual machines in real time, thereby improving the convenience of the user when using the traffic monitoring platform.
  • the callback function is registered in the Linux bridge in the first OpenStack host, and the callback function is used to detect the flow in and out status of the first virtual machine in the first OpenStack host.
  • the target flow table rule stored in the integrated bridge in the first OpenStack host is used to match the first flow corresponding to the first flow.
  • a data flow, and the copied first data flow is sent to the flow monitoring platform, so as to utilize the flow monitoring platform to monitor the first flow;
  • the second flow then use the target flow table rule to match the second data flow corresponding to the second flow, and send the copied second data flow to the physical network bridge of the first Open Stack host; when the first Open When the physical bridge of the Stack host receives the copied second data flow, it performs reflective learning on the second data flow according to the target flow table rules, obtains the third data flow, and sends the third data flow to the first Open Stack An integrated bridge in the host; when the integrated bridge receives the third data flow, it sends the third data flow to the traffic monitoring platform, so that the second traffic can be monitored by the traffic monitoring platform.
  • the traffic interaction between virtual machines can be monitored through the method provided in this embodiment.
  • this embodiment further explains and optimizes the technical solution.
  • the process of performing reflective learning on the second data flow to obtain the third data flow, and sending the third data flow to the integrated bridge includes:
  • the physical network bridge When the physical network bridge receives the copied second data flow, it reflects the copied second data flow to the target receiving port of the physical network bridge according to the target flow table rule;
  • the target receiving port When the target receiving port receives the duplicated second data stream, it performs unicast learning on the duplicated second data stream to obtain a third data stream, and sends the third data stream to the integrated bridge.
  • the physical network bridge in the first OpenStack host when the physical network bridge in the first OpenStack host receives the copied second data flow, it will send the copied second data flow to the target receiving port of the physical network bridge according to the target flow table rule; After receiving the second data flow, the target receiving port of the physical bridge performs unicast learning on the second data flow, thereby obtaining a third data flow capable of sending the second flow from the first virtual machine to the third virtual machine; After the physical network bridge obtains the third data flow, it will send the third data flow to the integrated network bridge, so as to send the copied second flow to the traffic monitoring platform through the integrated network bridge.
  • the traffic monitoring platform can monitor the traffic interaction between the first virtual machine and the third virtual machine.
  • the traffic monitoring method of the above-mentioned OpenStack tenant network also includes:
  • the integrity of the copied first data stream and/or the third data stream is verified by using the traffic monitoring platform.
  • the traffic monitoring platform in order to avoid the occurrence of the above situation, when the traffic monitoring platform receives the copied first data stream or the third data stream, it will also check the copied first data stream and the third data stream Check the integrity of the stream.
  • the methods for the traffic monitoring platform to check the integrity of the copied first data stream and/or the third data stream include but are not limited to parity check method (Parity Check), BBC (Block Check Character), XOR check Check method, or CRC (Cyclic Redundancy Check, cyclic redundancy check), etc.
  • the verification and detection method provided in this embodiment can achieve data integrity verification.
  • the purpose of performing verification and it will not affect the transmission performance of traffic data, so that the efficiency of monitoring virtual machine traffic can be relatively improved.
  • the traffic monitoring method of the above-mentioned OpenStack tenant network also includes:
  • the first data flow corresponding to the first flow can be matched by using the target flow table rule, the first data flow contains the flow of the first flow from the first virtual machine to the second virtual machine transfer path. Therefore, in order to send the first flow of the first virtual machine to the second virtual machine, it is necessary to send the first flow to the second virtual machine according to the first data flow.
  • the target flow table rules stored in the integrated bridge in the first OpenStack host will be A second data stream corresponding to the second traffic is matched. Therefore, after the second data flow corresponding to the second traffic is matched by the target flow table rule, the second traffic of the first virtual machine can be sent to the second traffic according to the transmission path and the transmission rule in the second data stream. In the third virtual machine in the Open Stack host.
  • this embodiment further explains and optimizes the technical solution.
  • the above steps when the integrated bridge receives the third data stream, then send the third data stream to the flow
  • the monitoring platform is used to monitor the second flow, including:
  • the integrated bridge When the integrated bridge receives the third data flow, then the vlan in the third data flow is modified to the target vlan corresponding to the flow monitoring platform, and the third data flow is sent to the flow monitoring platform through the target vlan, to A second flow is monitored.
  • the integrated network bridge after the integrated network bridge receives the third data stream, it will modify the vlan in the third data stream to the target vlan corresponding to the traffic monitoring platform, which is equivalent to establishing the integrated bridge and traffic Monitor channel connections between platforms.
  • the third data flow can be sent to the traffic monitoring platform through the target vlan, and the traffic interaction between the first virtual machine and the third virtual machine can be monitored by using the traffic monitoring platform.
  • the traffic monitoring method of the above-mentioned OpenStack tenant network also includes:
  • the traffic monitoring platform detects that the first traffic sent by the first virtual machine to the second virtual machine or the second traffic sent by the first virtual machine to the third virtual machine is abnormal, for example: the first If a large amount of retransmitted data, invalid data, and error data appear in the flow or the second flow, it indicates that there is a faulty component or an abnormal thread in the system.
  • the maintenance personnel can be informed of the traffic transmission between the virtual machines in a timely manner by prompting the early warning information, and take corresponding remedial measures, which can greatly reduce the economic losses suffered by the users. loss.
  • the traffic monitoring method of the above-mentioned OpenStack tenant network also includes:
  • the IP address and/or MAC address and/or target port of the first virtual machine and/or the second virtual machine and/or the third virtual machine are detected to be abnormal by using the traffic monitoring platform, the IP address and/or MAC are disabled address and/or destination port.
  • the traffic monitoring platform detects that the IP address and/or MAC address and/or target port of the first virtual machine and/or the second virtual machine and/or the third virtual machine are abnormal, it means that the first The virtual machine and/or the second virtual machine and/or the third virtual machine cannot perform normal data transmission work.
  • you continue to use the IP address and/or MAC address and/or destination port of the first virtual machine and/or the second virtual machine and/or the third virtual machine to transmit traffic data it will not only increase the amount of wrong data transmission, The resources of the virtual machine are wasted, and the security risk of the first Open Stack host and/or the second Open Stack host will also be increased.
  • the IP address and/or MAC address and/or MAC address of the first virtual machine and/or the second virtual machine and/or the third virtual machine are monitored on the traffic monitoring platform Or when the target port is abnormal, disable the IP address and/or MAC address and/or target port of the first virtual machine and/or the second virtual machine and/or the third virtual machine, that is, suspend the IP address of the failure and/or MAC address and/or destination port usage.
  • Fig. 3 is the structural diagram of a kind of flow monitoring device of Open Stack tenant network provided by the embodiment of the present application, and this device comprises:
  • State detection module 21 is used for utilizing callback function to detect the flow in and out state of the first virtual machine in the first Open Stack host;
  • callback function is the function registered in the Linux network bridge in the first Open Stack host in advance;
  • the first monitoring module 22 is used for when detecting that the first virtual machine sends the first flow to the second virtual machine in the first OpenStack host, then utilize the target flow stored in the integrated network bridge in the first OpenStack host
  • the table rule matches the first data stream corresponding to the first traffic, and sends the copied first data stream to the traffic monitoring platform to monitor the first traffic;
  • Data sending module 23 when detecting that the first virtual machine sends the second flow to the third virtual machine in the second OpenStack host, then utilize the target flow table rule to match the second data flow corresponding to the second flow , and send the copied second data stream to the physical network bridge of the first Open Stack host;
  • the data processing module 24 is configured to perform reflective learning on the second data flow according to the rules of the target flow table when the physical bridge receives the copied second data flow, obtain a third data flow, and send the third data flow to the integrated bridge;
  • the second monitoring module 25 is configured to send the third data stream to the traffic monitoring platform when the integrated bridge receives the third data stream, so as to monitor the second traffic.
  • a flow monitoring device for an Open Stack tenant network provided in an embodiment of the present application has the beneficial effects of the aforementioned disclosed flow monitoring method for an Open Stack tenant network.
  • Fig. 4 is a structural diagram of a flow monitoring device of an Open Stack tenant network provided by the embodiment of the present application, the device includes:
  • memory 31 for storing computer programs
  • the processor 32 is configured to implement the steps of the method for monitoring traffic of an OpenStack tenant network as disclosed above when executing the computer program.
  • a traffic monitoring device for an Open Stack tenant network provided in an embodiment of the present application has the beneficial effects of the aforementioned disclosed traffic monitoring method for an Open Stack tenant network.
  • the embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it realizes the flow of an OpenStack tenant network as disclosed above. The steps of the monitoring method.
  • the computer-readable storage medium provided by the embodiment of the present application has the beneficial effects of the disclosed method for monitoring traffic of an OpenStack tenant network.
  • each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other.
  • the description is relatively simple, and for the related part, please refer to the description of the method part.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种Open Stack租户网络的流量监控方法，包括：利用回调函数对第一虚拟机的流量进出状态进行检测；当检测到该虚拟机向同一主机内的第二虚拟机发送第一流量时，利用集成网桥中的目标流表规则匹配与第一流量相对应的第一数据流，并将复制后的第一数据流发送至流量监控平台；当检测到第一虚拟机向远程主机内的第三虚拟机发送第二流量时，利用目标流表规则匹配与第二流量相对应的第二数据流，并将复制后的第二数据流发送至物理网桥，以利用物理网桥对复制后的第二数据流进行反射学习，得到第三数据流；当集成网桥接收到第三数据流时，将其发送至流量监控平台。显然，通过该方法就可以对虚拟机之间的流量交互情况进行监控。

Description

Open Stack租户网络的流量监控方法、装置
本申请要求在2021年7月27日提交中国专利局、申请号为202110848075.5、发明名称为“Open Stack租户网络的流量监控方法、装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别涉及一种Open Stack租户网络的流量监控方法、装置、设备及介质。
背景技术
企业上云以后，很多企业已经不再大规模使用物理机进行业务部署，而是采用虚拟机化技术对计算资源进行统一池化管理。传统数据中心的流量监控方法已经十分成熟，但云环境下的流量采集面临着诸多挑战，云计算和虚拟化技术已经将网络的边界延伸到了物理服务器的内部，而不同虚拟机之间的流量交互已经不再经过物理交换机，因此传统的流量监控方法已经不能适用于虚拟机。
由此可见，如何对虚拟机之间的流量交互情况进行监控，是本领域技术人员亟待解决的技术问题。
发明内容
有鉴于此，本申请的目的在于提供一种Open Satck租户网络的流量监控方法、装置、设备及介质，以对虚拟机之间的流量交互情况进行监控。其具体方案如下：
一种Open Stack租户网络的流量监控方法，包括：
利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测；其中，所述回调函数为预先注册在所述第一Open Stack主机内Linux网桥中的函数；
当检测到所述第一虚拟机向所述第一Open Stack主机内的第二虚拟机发送第一流量时，则利用所述第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与所述第一流量相对应的第一数据流，并将复制后的所述第一数据流发送至流量监控平台，以对所述第一流量进行监控；
当检测到所述第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用所述目标流表规则匹配与所述第二流量相对应的第二数据流，并将复制后的所述第二数据流发送至所述第一Open Stack主机的物理网桥；
当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则对所述第二数据流进行反射学习，得到第三数据流，并将所述第三数据流发送至所述集成网桥；
当所述集成网桥接收到所述第三数据流时，则将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控。
优选的，所述当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则对所述第二数据流进行反射学习，得到第三数据流，并将所述第三数据流发送至所述集成网桥的过程，包括：
当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则将复制后的所述第二数据流反射至所述物理网桥的目标接收端口；
当所述目标接收端口接收到复制后的所述第二数据流时，则对复制后的所述第二数据流进行单播学习，得到所述第三数据流，并将所述第三数据流发送至所述集成网桥。
优选的，还包括：
利用所述流量监控平台对复制后的所述第一数据流和/或所述第三数据流的完整性进行校验。
优选的，还包括：
根据所述第一数据流将所述第一流量发送至所述第二虚拟机；
根据所述第二数据流将所述第二流量发送至所述第三虚拟机。
优选的，所述当所述集成网桥接收到所述第三数据流时，则将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控的过程，包括：
当所述集成网桥接收到所述第三数据流时，则将所述第三数据流中的vlan修改为与所述流量监控平台相对应的目标vlan，并通过所述目标vlan将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控。
优选的，还包括：
当利用所述流量监控平台监测到所述第一流量或第二流量出现异常时，则提示预警信息。
优选的，还包括：
当利用所述流量监控平台监测到所述第一虚拟机和/或所述第二虚拟机和/或所述第三虚拟机的IP地址和/或MAC地址和/或目标端口出现异常时，则禁用所述IP地址和/或所述MAC地址和/或所述目标端口。
相应的，本申请还公开了一种Open Stack租户网络的流量监控装置，包括：
状态检测模块，用于利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测；其中，所述回调函数为预先注册在所述第一Open Stack主机内Linux网桥中的函数；
第一监控模块，用于当检测到所述第一虚拟机向所述第一Open Stack主机内的第二虚拟机发送第一流量时，则利用所述第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与所述第一流量相对应的第一数据流，并将复制后的所述第一数据流发送至流量监控平台，以对所述第一流量进行监控；
数据发送模块，用于当检测到所述第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用所述目标流表规则匹配与所述第二流量相对应的第二数据流，并将复制后的所述第二数据流发送至所述第一Open Stack主机的物理网桥；
数据处理模块，用于当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则对所述第二数据流进行反射学习，得到第三数据流，并将所述第三数据流发送至所述集成网桥；
第二监控模块，用于当所述集成网桥接收到所述第三数据流时，则将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控。
相应的，本申请还公开了一种Open Stack租户网络的流量监控设备，包 括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序时实现如前述所公开的一种Open Stack租户网络的流量监控方法的步骤。
相应的，本申请还公开了一种计算机可读存储介质，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如前述所公开的一种Open Stack租户网络的流量监控方法的步骤。
可见，在本申请中，首先是在第一Open Stack主机内Linux网桥中注册回调函数，并利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测，当检测到第一虚拟机向第一Open Stack主机内的第二虚拟机发送第一流量时，则利用第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与第一流量相对应的第一数据流，并将复制后的第一数据流发送至流量监控平台，以利用流量监控平台对第一流量进行监控；当检测到第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用目标流表规则匹配与第二流量相对应的第二数据流，并将复制后的第二数据流发送至第一Open Stack主机的物理网桥；当第一Open Stack主机的物理网桥接收到复制后的第二数据流时，则根据目标流表规则对第二数据流进行反射学习，得到第三数据流，并将第三数据流发送至第一Open Stack主机内的集成网桥；当集成网桥接收到第三数据流时，则将第三数据流发送至流量监控平台，以利用流量监控平台对第二流量进行监控。显然，通过本申请所提供的方法就可以对虚拟机之间的流量交互情况进行监控。相应的，本申请所提供的一种Open Stack租户网络的流量监控装置、设备及介质，同样具有上述有益效果。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1为本申请实施例所提供的一种Open Stack租户网络的流量监控方法的 流程图；
图2为Open Stack租户网络的模型示意图；
图3为本申请实施例所提供的一种Open Stack租户网络的流量监控装置的结构图；
图4为本申请实施例所提供的一种Open Stack租户网络的流量监控设备的结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
请参见图1，图1为本申请实施例所提供的一种Open Stack租户网络的流量监控方法的流程图，该方法包括：
步骤S11：利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测；
其中，回调函数为预先注册在第一Open Stack主机内Linux网桥中的函数；
步骤S12：当检测到第一虚拟机向第一Open Stack主机内的第二虚拟机发送第一流量时，则利用第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与第一流量相对应的第一数据流，并将复制后的第一数据流发送至流量监控平台，以对第一流量进行监控；
步骤S13：当检测到第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用目标流表规则匹配与第二流量相对应的第二数据流，并将复制后的第二数据流发送至第一Open Stack主机的物理网桥；
步骤S14：当物理网桥接收到复制后的第二数据流时，则根据目标流表规则对第二数据流进行反射学习，得到第三数据流，并将第三数据流发送至集成网桥；
步骤S15：当集成网桥接收到第三数据流时，则将第三数据流发送至流量监控平台，以对第二流量进行监控。
在本实施例中，为了使得本领域技术人员能够更好的理解本申请的实现原理，先对Open Stack租户网络的模型进行介绍。请参见图2，图2为Open Stack租户网络的模型示意图。在图2中，Node1和Node2分别为Open Stack租户网络中两个物理主机，其中，VM1和VM2为第一Open Stack主机Node1中的两台虚拟机，VM3为第二Open Stack主机Node2中的一台虚拟机，它们均属于vlan(Virtual Local Area Network，虚拟局域网)100；br-int是集成网桥，br-phy是物理网桥，用于连接物理网络。
当VM1向VM3发送流量时，VM1的流量会通过虚拟网卡tap-xxx进入到Linux网桥qbr-xxx中，之后，Linux网桥会通过一对虚拟设备qvb-xxx和qvo-xxx将流量发送到集成网桥br-int中，集成网桥br-int会通过流表规则来指定如何对进入或离开集成网桥br-int的数据进行传输或转发，对于进入到物理网桥br-phy的流量，会通过流表规则完成内部vlan ID到外部vlan ID的转换，从而使得进入到物理网桥br-phy上的数据有正确的vlan ID；之后，流量会通过Node1中的物理网卡eth1直接发送到物理交换机上，物理交换机通过物理vlan设置再将流量转发到Node2的物理网卡eth1中，这样就将VM1中的流量发送到VM3中。
当VM3向VM1返回流量时，VM3返回的流量会通过Node1的物理网卡eth1转发给物理网桥br-phy，物理网桥br-phy再将流量转发给集成网桥br-int，之后，集成网桥br-int会按照流表规则对流量进行转换，把外部vlan转换为内部vlan，并通过内部vlan标识将数据准确地发送到VM1所对应的虚拟设备qvb-xxx和qvo-xxx中，并将内部vlan标识去掉；当Linux网桥接收到虚拟设备qvb-xxx和qvo-xxx发送来的流量之后，会通过网络分流器tap设备将流量发送给VM1，VM1通过虚拟网卡就会接收到VM3所返回的流量，并完成数据的传输。
基于现有Open Stack租户网络的架构，本实施例提出了一种Open Stack租户网络的流量监控方法，通过该方法可以对虚拟机之间的流量交互情况进行监控。从上述Open Stack租户网络的架构中可以看出，虚拟机的关键网路设备为连接Linux网桥的tap-xxx设备。其中，Linux网桥是Linux上用来做 tcp/ip二层协议交换的设备，与现实世界中交换机的功能相似。Linux网桥可以和Linux上其它的网络设备进行连接，Linux网桥的功能主要在内核中实现。当一个从设备被连接到Linux网桥上时，相当于现实世界中交换机的端口被插入了一根连接有终端的网线。这时在内核程序里，netdev_rx_handler_register()被调用，一个用于接收数据的函数被注册，以后每当从这个设备接收到数据时都会调用这个函数，并通过这个函数将数据转发到Linux网桥上。
通过上述理论分析，在该监控方法中需要预先在第一Open Stack主机内的Linux网桥中注册回调函数，以利用该回调函数来对虚拟机的流量进出状态进行检测。具体的，当第一虚拟机VM1接收流量到或向其它设备发送流量时，会向回调函数上报心跳信息，并以此来表征第一虚拟机VM1正在接收或发送数据，这样就可以根据虚拟机的数据流以及流向监控虚拟机正在进行的数据传输情况。需要说明的是，回调函数仅仅只会完成一个简单的流量触发动作，并不会执行实际的数据操作，所以，该流量检测过程不会对虚拟网络的数据处理产生任何影响。当在Linux网桥中插入了回调函数之后，为了对虚拟机之间的网络交互情况进行监控，还需要在集成网桥br-int上插入目标流表规则，并在集成网桥中关联一个端口来将进出集成网桥的流量数据镜像至流量监控平台的目标端口上，从而达到对进出虚拟机的流量进行监控的目的。
具体的，在该流量监控方法中，首先是利用回调函数来对第一Open Stack主机内第一虚拟机VM1的流量进出状态进行检测，当检测到第一虚拟机VM1向同一物理主机内的第二虚拟机VM2发送第一流量时，则利用第一Open Stack主机内集成网桥br-int中所存储的目标流表规则匹配与第一流量相对应的第一数据流，并对第一数据流进行复制，之后，再将复制后的第一数据流发送到第三方的流量监控平台中，以利用流量监控平台来对第一虚拟机VM1和第二虚拟机VM2之间的第一流量进行监控。显然，通过这样的设置方式就可以实现对同一Open Stack主机内不同虚拟机之间的流量交互情况进行监控的目的。
能够想到的是，除了同一Open Stack主机内不同的虚拟机可以进行流量交互之外，不同Open Stack主机中的虚拟机也可以进行流量交互。因此，当利用第一Open Stack主机内Linux网桥所插入的回调函数检测到第一虚拟机VM1向第二Open Stack主机内的第三虚拟机VM3发送第二流量时，则利用 第一Open Stack主机内集成网桥br-int中所存储的目标流表规则匹配与第二流量相对应的第二数据流，并对第二数据流进行复制，得到复制后的第二数据流。
可以理解的是，当对第二数据流进行复制之后，根据第二数据流会发现第二流量的目的端口并不在本地主机中。因此，集成网桥br-int会将复制后的第二数据流发送到第一Open Stack主机内的物理网桥br-phy中，当物理网桥br-phy接收到复制后的第二数据流时，会根据目标流表规则对第二数据流进行反射学习，从而使得第二流量能够从第一虚拟机VM1发送至第三虚拟机VM3中。具体的，物理网桥br-phy根据目标流表规则对第二数据流进行反射学习之后，会得到第三数据流，之后，物理网桥br-phy会将第三数据流发送到集成网桥br-int中。当集成网桥br-int接收到第三数据流时，会将第三数据流发送至第三方的流量监控平台中，以利用第三方的流量监控平台来对第一虚拟机VM1和第三虚拟机VM3之间的第二流量进行监控。
显然，通过本实施例所提供的技术方案，不仅可以对同一Open Stack主机内虚拟机之间的流量交互情况进行监控，而且，也可以对远程Open Stack主机内虚拟机之间的流量交互情况进行监控，这样就可以达到对虚拟机流量进行监控的目的。并且，通过本实施例所提供的流量监控方法也可以有效提高Open Stack租户网络的问题定位以及排查效率。
具体的，在实际应用中，可以将流量监控平台设置为Traffic Monitor，因为Traffic Monitor不仅是一款开源免费的Windows平台流量监控软件，而且，Traffic Monitor还可以将监控到的信息实时显示在其任务栏或者是桌面的悬浮窗中，这样就方便用户能够实时查看到虚拟机之间的流量交互情况，由此就可以提高用户在使用流量监控平台时的便捷性。
可见，在本实施例中，首先是在第一Open Stack主机内Linux网桥中注册回调函数，并利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测，当检测到第一虚拟机向第一Open Stack主机内的第二虚拟机发送第一流量时，则利用第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与第一流量相对应的第一数据流，并将复制后的第一数据流发送至流量监控平台，以利用流量监控平台对第一流量进行监控；当检测到第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用目 标流表规则匹配与第二流量相对应的第二数据流，并将复制后的第二数据流发送至第一Open Stack主机的物理网桥；当第一Open Stack主机的物理网桥接收到复制后的第二数据流时，则根据目标流表规则对第二数据流进行反射学习，得到第三数据流，并将第三数据流发送至第一Open Stack主机内的集成网桥；当集成网桥接收到第三数据流时，则将第三数据流发送至流量监控平台，以利用流量监控平台对第二流量进行监控。显然，通过本实施例所提供的方法就可以对虚拟机之间的流量交互情况进行监控。
基于上述实施例，本实施例对技术方案作进一步的说明与优化，作为一种优选的实施方式，上述步骤：当物理网桥接收到复制后的第二数据流时，则根据目标流表规则对第二数据流进行反射学习，得到第三数据流，并将第三数据流发送至集成网桥的过程，包括：
当物理网桥接收到复制后的第二数据流时，则根据目标流表规则将复制后的第二数据流反射至物理网桥的目标接收端口；
当目标接收端口接收到复制后的第二数据流时，则对复制后的第二数据流进行单播学习，得到第三数据流，并将第三数据流发送至集成网桥。
具体的，当第一Open Stack主机内的物理网桥接收到复制后的第二数据流时，会根据目标流表规则将复制后的第二数据流发送至物理网桥的目标接收端口；当物理网桥的目标接收端口接收到第二数据流之后，会对第二数据流进行单播学习，从而得到能够将第二流量从第一虚拟机发送至第三虚拟机的第三数据流；当物理网桥获取得到第三数据流之后，会将第三数据流发送到集成网桥中，以通过集成网桥将复制后的第二流量发送至流量监控平台中。
显然，通过本实施例所提供的技术方案，就可以保证流量监控平台能够对第一虚拟机和第三虚拟机之间的流量交互情况进行监控。
基于上述实施例，本实施例对技术方案作进一步的说明与优化，作为一种优选的实施方式，上述Open Stack租户网络的流量监控方法还包括：
利用流量监控平台对复制后的第一数据流和/或第三数据流的完整性进行校验。
能够想到的是，数据在传输过程中有时会遇到被不法分子篡改或者数据发生丢失的情形，从而影响流量监控平台对虚拟机流量的监测结果。因此，在本实施例中，为了避免上述情况的发生，流量监控平台在接收到复制后的第一数据流或者是第三数据流时，还会对复制后的第一数据流以及第三数据流的完整性进行校验。
其中，流量监控平台对复制后的第一数据流和/或第三数据流进行完整性校验的方法包括但不限于奇偶校验法(Parity Check)、BBC(Block Check Character)、异或校验法、或者是CRC(Cyclic Redundancy Check，循环冗余校验)等。
并且，相较于流量监控平台直接对第一虚拟机所发送的第一流量或第二流量进行完整性校验而言，通过本实施例所提供的校验检测方法既可以达到对数据完整性进行校验的目的，而且，也不会影响流量数据的传输性能，这样就可以相对提高在对虚拟机流量进行监测时的效率。
可见，通过本实施例所提供的技术方案，就可以进一步保证流量监控平台对虚拟机流量进行监测时的准确性与可靠性。
基于上述实施例，本实施例对技术方案作进一步的说明与优化，作为一种优选的实施方式，上述Open Stack租户网络的流量监控方法还包括：
根据第一数据流将第一流量发送至第二虚拟机；
根据第二数据流将第二流量发送至第三虚拟机。
可以理解的是，因为利用目标流表规则能够匹配出与第一流量相对应的第一数据流，所以，第一数据流中会蕴含着第一流量从第一虚拟机到第二虚拟机的传输路径。因此，为了将第一虚拟机的第一流量发送至第二虚拟机，则需要根据第一数据流来将第一流量发送至第二虚拟机。
同理，当利用回调函数检测到第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，第一Open Stack主机内集成网桥中所存储的目标流表规则就会匹配与第二流量相对应的第二数据流。因此，当利用目标流表规则匹配出与第二流量相对应的第二数据流之后，就可以根据第二数据流中的传输路径与传输规则将第一虚拟机的第二流量发送至第二Open Stack主机内的第三虚拟机中。
可见，通过本实施例所提供的技术方案，不仅可以实现同一Open Stack主机内不同虚拟机之间的数据交互，而且，还可以实现远程Open Stack主机内不同虚拟机之间的数据交互。
基于上述实施例，本实施例对技术方案作进一步的说明与优化，作为一种优选的实施方式，上述步骤：当集成网桥接收到第三数据流时，则将第三数据流发送至流量监控平台，以对第二流量进行监控的过程，包括：
当集成网桥接收到第三数据流时，则将第三数据流中的vlan修改为与流量监控平台相对应的目标vlan，并通过目标vlan将第三数据流发送至流量监控平台，以对第二流量进行监控。
在本实施例中，当集成网桥接收到第三数据流之后，会将第三数据流中的vlan修改为与流量监控平台相对应的目标vlan，这样就相当于建立了集成网桥与流量监控平台之间的通道连接。在此情况下，通过目标vlan就可以将第三数据流发送至流量监控平台中，并利用流量监控平台来对第一虚拟机和第三虚拟机之间的流量交互情况进行监控。
显然，通过本实施例所提供的技术方案，就可以保证流量监控平台在对第二流量进行监控过程中的整体可靠性。
基于上述实施例，本实施例对技术方案作进一步的说明与优化，作为一种优选的实施方式，上述Open Stack租户网络的流量监控方法还包括：
当利用流量监控平台监测到第一流量或第二流量出现异常时，则提示预警信息。
在实际应用中，如果流量监控平台监测到第一虚拟机向第二虚拟机所发送的第一流量或者第一虚拟机向第三虚拟机所发送的第二流量出现异常时，比如：第一流量或第二流量中出现大量的重发数据、无效数据以及错误数据等等，则说明系统中存在故障组件或者是异常线程。
在此情况下，就可以通过提示预警信息的方式来使得维修人员能够及时知悉到各虚拟机之间的流量传输情况，并采取相应的补救措施，这样就可以极大的降低用户所遭受的经济损失。
基于上述实施例，本实施例对技术方案作进一步的说明与优化，作为一种优选的实施方式，上述Open Stack租户网络的流量监控方法还包括：
当利用流量监控平台监测到第一虚拟机和/或第二虚拟机和/或第三虚拟机的IP地址和/或MAC地址和/或目标端口出现异常时，则禁用IP地址和/或MAC地址和/或目标端口。
可以理解的是，如果流量监控平台监测到第一虚拟机和/或第二虚拟机和/或第三虚拟机的IP地址和/或MAC地址和/或目标端口出现异常时，则说明第一虚拟机和/或第二虚拟机和/或第三虚拟机已经无法执行正常的数据传输工作。此时如果继续使用第一虚拟机和/或第二虚拟机和/或第三虚拟机的IP地址和/或MAC地址和/或目标端口来传输流量数据，不仅会增加错误数据的传输量，浪费虚拟机的资源，而且，也会增加第一Open Stack主机和/或第二Open Stack主机的安全风险。
所以，在本实施例中，为了避免上述情形的出现，是在流量监控平台监测到第一虚拟机和/或第二虚拟机和/或第三虚拟机的IP地址和/或MAC地址和/或目标端口出现异常时，禁用第一虚拟机和/或第二虚拟机和/或第三虚拟机的IP地址和/或MAC地址和/或目标端口，也即，暂停对发生故障的IP地址和/或MAC地址和/或目标端口的使用。
显然，通过本实施例所提供的技术方案，就可以进一步提高各虚拟机在进行数据交互时的整体可靠性。
请参见图3，图3为本申请实施例所提供的一种Open Stack租户网络的流量监控装置的结构图，该装置包括：
状态检测模块21，用于利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测；其中，回调函数为预先注册在第一Open Stack主机内Linux网桥中的函数；
第一监控模块22，用于当检测到第一虚拟机向第一Open Stack主机内的第二虚拟机发送第一流量时，则利用第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与第一流量相对应的第一数据流，并将复制后的第一数据流发送至流量监控平台，以对第一流量进行监控；
数据发送模块23，用于当检测到第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用目标流表规则匹配与第二流量相对应的第二数据流，并将复制后的第二数据流发送至第一Open Stack主机的物理网桥；
数据处理模块24，用于当物理网桥接收到复制后的第二数据流时，则根据目标流表规则对第二数据流进行反射学习，得到第三数据流，并将第三数据流发送至集成网桥；
第二监控模块25，用于当集成网桥接收到第三数据流时，则将第三数据流发送至流量监控平台，以对第二流量进行监控。
本申请实施例所提供的一种Open Stack租户网络的流量监控装置，具有前述所公开的一种Open Stack租户网络的流量监控方法所具有的有益效果。
请参见图4，图4为本申请实施例所提供的一种Open Stack租户网络的流量监控设备的结构图，该设备包括：
存储器31，用于存储计算机程序；
处理器32，用于执行计算机程序时实现如前述所公开的一种Open Stack租户网络的流量监控方法的步骤。
本申请实施例所提供的一种Open Stack租户网络的流量监控设备，具有前述所公开的一种Open Stack租户网络的流量监控方法所具有的有益效果。
相应的，本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质上存储有计算机程序，计算机程序被处理器执行时实现如前述所公开的一种Open Stack租户网络的流量监控方法的步骤。
本申请实施例所提供的一种计算机可读存储介质，具有前述所公开的一种Open Stack租户网络的流量监控方法所具有的有益效果。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其它实施例的不同之处，各个实施例之间相同或相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语 仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上对本申请所提供的一种Open Stack租户网络的流量监控方法、装置、设备及介质进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (10)

  1. 一种Open Stack租户网络的流量监控方法，其特征在于，包括：
    利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测；其中，所述回调函数为预先注册在所述第一Open Stack主机内Linux网桥中的函数；
    当检测到所述第一虚拟机向所述第一Open Stack主机内的第二虚拟机发送第一流量时，则利用所述第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与所述第一流量相对应的第一数据流，并将复制后的所述第一数据流发送至流量监控平台，以对所述第一流量进行监控；
    当检测到所述第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用所述目标流表规则匹配与所述第二流量相对应的第二数据流，并将复制后的所述第二数据流发送至所述第一Open Stack主机的物理网桥；
    当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则对所述第二数据流进行反射学习，得到第三数据流，并将所述第三数据流发送至所述集成网桥；
    当所述集成网桥接收到所述第三数据流时，则将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控。
  2. 根据权利要求1所述的流量监控方法，其特征在于，所述当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则对所述第二数据流进行反射学习，得到第三数据流，并将所述第三数据流发送至所述集成网桥的过程，包括：
    当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则将复制后的所述第二数据流反射至所述物理网桥的目标接收端口；
    当所述目标接收端口接收到复制后的所述第二数据流时，则对复制后的所述第二数据流进行单播学习，得到所述第三数据流，并将所述第三数据流发送至所述集成网桥。
  3. 根据权利要求1所述的流量监控方法，其特征在于，还包括：
    利用所述流量监控平台对复制后的所述第一数据流和/或所述第三数据流的完整性进行校验。
  4. 根据权利要求1所述的流量监控方法，其特征在于，还包括：
    根据所述第一数据流将所述第一流量发送至所述第二虚拟机；
    根据所述第二数据流将所述第二流量发送至所述第三虚拟机。
  5. 根据权利要求1所述的流量监控方法，其特征在于，所述当所述集成网桥接收到所述第三数据流时，则将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控的过程，包括：
    当所述集成网桥接收到所述第三数据流时，则将所述第三数据流中的vlan修改为与所述流量监控平台相对应的目标vlan，并通过所述目标vlan将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控。
  6. 根据权利要求1所述的流量监控方法，其特征在于，还包括：
    当利用所述流量监控平台监测到所述第一流量或第二流量出现异常时，则提示预警信息。
  7. 根据权利要求1至6任一项所述的流量监控方法，其特征在于，还包括：
    当利用所述流量监控平台监测到所述第一虚拟机和/或所述第二虚拟机和/或所述第三虚拟机的IP地址和/或MAC地址和/或目标端口出现异常时，则禁用所述IP地址和/或所述MAC地址和/或所述目标端口。
  8. 一种Open Stack租户网络的流量监控装置，其特征在于，包括：
    状态检测模块，用于利用回调函数对第一Open Stack主机内第一虚拟机的流量进出状态进行检测；其中，所述回调函数为预先注册在所述第一Open Stack主机内Linux网桥中的函数；
    第一监控模块，用于当检测到所述第一虚拟机向所述第一Open Stack主机内的第二虚拟机发送第一流量时，则利用所述第一Open Stack主机内集成网桥中所存储的目标流表规则匹配与所述第一流量相对应的第一数据流，并将复制后的所述第一数据流发送至流量监控平台，以对所述第一流量进行监控；
    数据发送模块，用于当检测到所述第一虚拟机向第二Open Stack主机内的第三虚拟机发送第二流量时，则利用所述目标流表规则匹配与所述第二流量相对应的第二数据流，并将复制后的所述第二数据流发送至所述第一Open Stack主机的物理网桥；
    数据处理模块，用于当所述物理网桥接收到复制后的所述第二数据流时，则根据所述目标流表规则对所述第二数据流进行反射学习，得到第三数据流，并将所述第三数据流发送至所述集成网桥；
    第二监控模块，用于当所述集成网桥接收到所述第三数据流时，则将所述第三数据流发送至所述流量监控平台，以对所述第二流量进行监控。
  9. 一种Open Stack租户网络的流量监控设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序时实现如权利要求1至7任一项所述的一种Open Stack租户网络的流量监控方法的步骤。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至7任一项所述的一种Open Stack租户网络的流量监控方法的步骤。
PCT/CN2021/121906 2021-07-27 2021-09-29 Open Stack租户网络的流量监控方法、装置 WO2023004992A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/270,417 US20240048468A1 (en) 2021-07-27 2021-09-29 Traffic monitoring method and apparatus for open stack tenant network

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110848075.5 2021-07-27
CN202110848075.5A CN113300917B (zh) 2021-07-27 2021-07-27 Open Stack租户网络的流量监控方法、装置

Publications (1)

Publication Number Publication Date
WO2023004992A1 true WO2023004992A1 (zh) 2023-02-02

Family

ID=77331126

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/121906 WO2023004992A1 (zh) 2021-07-27 2021-09-29 Open Stack租户网络的流量监控方法、装置

Country Status (3)

Country Link
US (1) US20240048468A1 (zh)
CN (1) CN113300917B (zh)
WO (1) WO2023004992A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116684204A (zh) * 2023-08-03 2023-09-01 北京立思辰安科技术有限公司 一种用于工控防火墙单机热备的处理方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113300917B (zh) * 2021-07-27 2021-10-15 苏州浪潮智能科技有限公司 Open Stack租户网络的流量监控方法、装置
CN115834291B (zh) * 2022-11-16 2024-04-09 中国联合网络通信集团有限公司 分布式内网服务数据获取方法、装置、设备及存储介质

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107276800A (zh) * 2017-06-12 2017-10-20 郑州云海信息技术有限公司 一种用于云数据中心的网络流量追踪方法及装置
CN107996023A (zh) * 2016-11-23 2018-05-04 华为技术有限公司 监测虚拟网络的方法、设备和虚拟网络系统
CN108494657A (zh) * 2018-04-08 2018-09-04 苏州云杉世纪网络科技有限公司 基于Open vSwitch的OpenStack云平台虚拟探针镜像方法
US20190171474A1 (en) * 2017-12-01 2019-06-06 At&T Intellectual Property I, L.P. Flow management and flow modeling in network clouds
CN109981613A (zh) * 2019-03-11 2019-07-05 北京启明星辰信息安全技术有限公司 一种用于云环境的流量检测方法与资源池系统
CN111431757A (zh) * 2020-02-18 2020-07-17 平安科技（深圳）有限公司 虚拟网络的流量采集方法及装置
CN111913782A (zh) * 2020-07-29 2020-11-10 上海云轴信息科技有限公司 一种基于隧道技术实现虚拟机流量镜像的方法与设备
CN113300917A (zh) * 2021-07-27 2021-08-24 苏州浪潮智能科技有限公司 Open Stack租户网络的流量监控方法、装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105743734B (zh) * 2016-01-22 2019-02-01 北京航空航天大学 虚拟机镜像流量传输的控制方法和装置
US9906401B1 (en) * 2016-11-22 2018-02-27 Gigamon Inc. Network visibility appliances for cloud computing architectures
CN107623611B (zh) * 2017-09-22 2021-03-02 国云科技股份有限公司 一种云平台虚拟机的流量监控系统

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107996023A (zh) * 2016-11-23 2018-05-04 华为技术有限公司 监测虚拟网络的方法、设备和虚拟网络系统
CN107276800A (zh) * 2017-06-12 2017-10-20 郑州云海信息技术有限公司 一种用于云数据中心的网络流量追踪方法及装置
US20190171474A1 (en) * 2017-12-01 2019-06-06 At&T Intellectual Property I, L.P. Flow management and flow modeling in network clouds
CN108494657A (zh) * 2018-04-08 2018-09-04 苏州云杉世纪网络科技有限公司 基于Open vSwitch的OpenStack云平台虚拟探针镜像方法
CN109981613A (zh) * 2019-03-11 2019-07-05 北京启明星辰信息安全技术有限公司 一种用于云环境的流量检测方法与资源池系统
CN111431757A (zh) * 2020-02-18 2020-07-17 平安科技（深圳）有限公司 虚拟网络的流量采集方法及装置
CN111913782A (zh) * 2020-07-29 2020-11-10 上海云轴信息科技有限公司 一种基于隧道技术实现虚拟机流量镜像的方法与设备
CN113300917A (zh) * 2021-07-27 2021-08-24 苏州浪潮智能科技有限公司 Open Stack租户网络的流量监控方法、装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116684204A (zh) * 2023-08-03 2023-09-01 北京立思辰安科技术有限公司 一种用于工控防火墙单机热备的处理方法
CN116684204B (zh) * 2023-08-03 2023-09-29 北京立思辰安科技术有限公司 一种用于工控防火墙单机热备的处理方法

Also Published As

Publication number Publication date
CN113300917A (zh) 2021-08-24
US20240048468A1 (en) 2024-02-08
CN113300917B (zh) 2021-10-15

Similar Documents

Publication Publication Date Title
WO2023004992A1 (zh) Open Stack租户网络的流量监控方法、装置
AU2019261814B2 (en) Networking technologies
CN101446936B (zh) 改良式远程通用序列总线存取方法
US9019978B2 (en) Port mirroring at a network interface device
TWI458314B (zh) 傳送遠端封包至主機的伺服器系統及其管理方法
US9423956B2 (en) Emulating a stretched storage device using a shared storage device
TW200404432A (en) Memory management offload for RDMA enabled adapters
CN106027511A (zh) 一种基于Modbus/TCP深度解析的协议隔离方法
US8547845B2 (en) Soft error recovery for converged networks
US20150113112A1 (en) Managing Network Connection of a Network Node
CN107729190B (zh) 一种io路径故障转移处理方法和系统
US9442811B2 (en) Emulating a stretched storage device using a shared replicated storage device
WO2013019339A1 (en) Hardware failure mitigation
WO2015058711A1 (zh) 故障快速检测方法及装置
US8923114B2 (en) Start-up delay for event-driven virtual link aggregation
US9654421B2 (en) Providing real-time interrupts over ethernet
WO2024001251A1 (zh) 一种芯片测试系统、方法、设备及介质
US10659348B2 (en) Holding of a link in an optical interface by a lower level processor until authorization is received from an upper level processor
US8880956B2 (en) Facilitating processing in a communications environment using stop signaling
US20090158300A1 (en) Network redundancy check application program management method
JP2004110801A (ja) 再初期化したチャネル間接続の妥当性を検査するための技法
JP5333789B2 (ja) 端末検知装置、サーバ装置、端末検知方法、及びプログラム
CN113760459A (zh) 虚拟机故障检测方法、存储介质和虚拟化集群
WO2020244067A1 (zh) 故障检测方法及相关设备
WO2024087692A1 (zh) 设备管理方法、设备、系统和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21951564

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18270417

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE