WO2023134574A1 - Method for flow statistics, device, and system - Google Patents

Abstract

The present application belongs to the technical field of communication and provides a method for flow statistics, a device, and a system. In a solution provided by the present application, a network device obtains a target flow index and a target address index according to a target flow identifier of a data flow to which a target message belongs; then the network device updates, according to the target flow index, a packet count value and/or a flow index in a first storage unit among a plurality of storage units indicated by the target address index (104), and performs statistics on traffic of a data flow to which the target packet belongs on the basis of the updated packet count value in the first storage unit (105). In the described process for traffic statistics, the network device does not need to report a sampled packet to a control device, and thereby the efficiency for flow statistics is effectively improved, and same does not take up storage space of the control device. Furthermore, the target flow index can be obtained by means of a mapping function processing the target flow identifier, and therefore storage space occupied by a flow index can be reduced.

Description

Flow statistics method, device and system

This application claims the priority of the Chinese patent application with the application number 202210029639.7 and the title of the invention "A flow identification method, related device and network system" filed on January 12, 2022, and claims on March 1, 2022 The priority of the Chinese patent application submitted with the application number 202210195673.1 and the title of the invention is "Flow Statistics Method, Device and System", the entire content of which is incorporated in this application by reference.

technical field

The present application relates to the field of network technologies, and in particular to a flow statistics method, device and system.

Background technique

In order to ensure the transmission performance of each data flow in the network, operation and maintenance personnel need to closely monitor the relevant performance parameters (such as bandwidth and delay, etc.) of large flows in each data flow. Among them, the large flow refers to several data flows with the largest amount of packets (number or number of bytes) transmitted within a certain period of time.

In related technologies, in order to identify a large flow from a large number of data flows, a network device (such as a switch) may sample the packets of each data flow during the process of forwarding the packets of the data flow, and sample the The message is sent to a control device (eg analyzer). The control device may count the number of sampled packets corresponding to each data flow, and determine several data flows with the highest number of sampled packets as large flows.

However, the above method needs to report a large number of sampled messages to the control device, which not only occupies more storage space of the control device, but also has low statistical efficiency.

Contents of the invention

The present application provides a flow statistics method, device and system, which can solve the technical problem that the flow statistics method in the related art occupies more storage space of the control equipment and has low statistical efficiency.

In the first aspect, a flow statistics method is provided, which is applied to network equipment. The network device first obtains the target packet. Then, the network device obtains the target flow index according to the target flow identifier of the data flow to which the target packet belongs, and obtains the target address index according to the target flow identifier. The target address index is used to indicate a storage area in the storage space of the network device, the storage area includes a plurality of storage units, and each storage unit is used to store a flow index and a packet of the data flow indicated by the flow index count value. The network device also updates the flow index and/or packet count value in the first storage unit among the plurality of storage units according to the target flow index, and counts the packet count value based on the updated packet count value in the first storage unit Traffic of the data flow to which the target packet belongs. Specifically, the network device processes the target flow identifier of the data flow to which the target packet belongs through the first mapping function to obtain the target flow index, and processes the target flow identifier through the second mapping function to obtain the target address index.

Wherein, the traffic of the statistical data stream is not the real traffic of the statistical data stream, but a numerical value that can reflect the traffic volume of the data stream, such as a traffic statistics value. In the solution provided by the present application, the network device can record the flow index and packet count value of the data flow in the storage unit, and count the traffic of the data flow based on the packet count value. Since the network device does not need to report sampling packets to the control device, the efficiency of flow statistics is improved, and the storage space of the control device will not be occupied. Furthermore, since the stream index in the storage unit is obtained by processing the target stream identifier through the first mapping function, the storage space occupied by the stream index can be reduced.

Optionally, the manner in which the network device updates the flow index and/or the packet count value in the first storage unit among the multiple storage units according to the target flow index may include any of the following: Mode 1, if the If the target flow index is stored in the first storage unit, the packet count value in the first storage unit is increased by a first preset value. Method 2: If there is no storage unit that has stored the target flow index in the multiple storage units, store the target flow index and the initial message count value in a free storage unit among the multiple storage units, and the free storage unit is the first A storage unit, where an idle storage unit refers to a storage unit that does not store a flow index or a message count value. Method 3: If there is no storage unit that has stored the target flow index in the multiple storage units, and there is no free storage unit, then the flow index in a storage unit whose message count value is the initial value in the multiple storage units The target flow index is updated, and the storage unit whose packet count value is the initial value is the first storage unit.

In the third manner above, if the packet count value in the first storage unit is the initial value, the network device can determine the data flow indicated by the flow index stored in the first storage unit (hereinafter referred to as data flow 1) , the number of target packets of the data stream 1 that the network device has obtained is an initial value. Assuming that the data flow of the target packet currently obtained by the network device is data flow 2, it can be inferred that the number of target packets of the data flow 2 currently obtained by the network device is different from that of the data flow 1 obtained by the network device. The number of target packets is equivalent. Correspondingly, the network device uses the target stream index of data stream 2 to update the stream index of data stream 1 in the first storage unit, which can ensure that identification of a specific stream among the multiple data streams will not be affected. Wherein, the specific flow may refer to a data flow with a high flow rate or a high change amount of the flow rate.

Optionally, if there is no storage unit that has stored the target flow index among the multiple storage units, and the packet count value in each storage unit is greater than the initial packet count value, the network device can also store the multiple The packet count value in the storage unit with the smallest packet count value in the cell is reduced by a first preset value.

It can be understood that if the packet count value in the storage unit with the least packet count value is reduced to the initial value, when the network device obtains the target packet again, it can be updated using the method shown in the third method above The stream index in the storage unit with the smallest packet count value. Based on the above update method, it can be ensured that only when the number of target packets of a new data flow obtained by the network device is greater than or equal to the minimum packet count value in the plurality of storage units, the new data flow can be used. The flow index of the data flow replaces the flow index in the storage unit with the least packet count value. Therefore, in a scenario where the number of storage units in the network device is limited, reliable statistics of the packet count value of the data flow with high traffic can be realized.

Optionally, the process of the network device counting the traffic of the data flow to which the target packet belongs based on the updated packet count value in the first storage unit may include: if the updated packet count value in the first storage unit satisfies If the statistical condition is met, the target flow identifier is reported to the control device, so that the control device increases the traffic statistics value of the data flow indicated by the target flow identifier by a second preset value. Alternatively, if the updated packet count value in the first storage unit satisfies the statistics condition, then increase the traffic statistics value of the data flow indicated by the target flow identifier by a second preset value.

It can be understood that, after the network device processes different flow identifiers through the first mapping function, the same flow index may be obtained, that is, there may be a hash conflict between the flow indexes of different data flows. As a result, the packet count value stored in the first storage unit may be obtained by counting the number of target packets of different data flows. However, in the solution provided by the present application, when the packet count value satisfies the statistical condition, the currently acquired traffic statistics value of the data flow to which the target packet belongs is updated. Since the network device obtains a large number of target packets of the data flow with a large flow, the number of updates of the traffic statistics value of the data flow with a large flow will be more. However, the number of target packets obtained by the network device for the data flow with a small flow is small, so the number of updates of the traffic statistics value for the data flow with a small flow will be less. Based on this, relatively accurate statistics on the traffic of different data streams can be realized, and thus a specific stream among multiple data streams can be accurately identified.

Optionally, the process for the network device to report the target flow identifier to the control device may include: the network device encapsulates the target flow identifier in a statistical message, and reports the statistical message to the control device. Wherein, the network device can adopt the encapsulation method of encapsulating IP (IP encapsulation within IP, IPinIP) in the Internet Protocol (Internet Protocol, IP) to construct the statistical message. The outer destination IP address of the statistical message is the IP address of the control device.

Optionally, the statistical condition may include: the packet count value is an integer multiple of a statistical threshold, and the statistical threshold is an integer greater than 1. Compared with updating the traffic statistics value in real time based on the change of the packet count value, the solution provided by this application updates the traffic statistics value of the data flow at the statistics threshold as a statistical interval, which can effectively reduce the update frequency of the traffic statistics value. In this way, it is possible to avoid the excessively high update frequency of the traffic statistics value and the occupation of more processing resources.

Optionally, the network device may also output the flow identifiers of the top K data flows with the highest flow statistics. Alternatively, the network device may also output the flow identifiers of the top K data flows with the highest changes in traffic statistics within a set period of time. Wherein, K is an integer greater than or equal to 1.

In this application, the network device may periodically output flow identifiers of the first K data flows according to a preset statistical period. Wherein, the flow identifier of the data flow output by the network device may refer to: the network device displays the flow identifier of the data flow, or the network device sends the flow identifier of the data flow to another device for the other device to display.

Optionally, the second mapping function includes a first sub-mapping function and a second sub-mapping function. The process for the network device to process the target flow identifier through the second mapping function to obtain the target address index may include: processing the target flow identifier through the first sub-mapping function to obtain the first sub-index. The second sub-index of the target flow identifier is processed by the second sub-mapping function, and the target address index includes the first sub-index and the second sub-index. The storage area indicated by the target address index includes: a first sub-storage area indicated by the first sub-index, and a second sub-storage area indicated by the second sub-index. The plurality of storage units include storage units corresponding to the first sub-storage area and the second sub-storage area.

By using two different sub-mapping functions to process the target stream identifier, it can be ensured that two candidate sub-storage areas can be determined for one target stream index. Thus, the probability of determining the first storage unit satisfying the condition in the two sub-storage areas can be effectively increased, thereby effectively reducing the probability of hash collisions.

Optionally, if the flow index and packet count in the second storage unit among the plurality of storage units have not been updated for a set period of time, the network device may also store the flow index and packet count in the second storage unit The value is deleted. Thus, the storage space of the second storage unit can be released, so as to continue to store the stream index and packet count value of other data streams.

Optionally, the target message may be any message received by the network device, or the target message may be a message to be discarded by the network device. Wherein, if the target packet is any packet received by the network device, the traffic volume of the data flow counted by the network device may refer to the total packet volume of the data flow. If the target packet is a packet to be discarded by the network device, the traffic volume of the data flow collected by the network device may refer to the packet loss amount of the data flow.

In a second aspect, a network device is provided. The network device includes multiple functional units, and the multiple functional units interact to implement the methods in the above first aspect and various implementation manners thereof. The multiple functional units can be implemented based on software, hardware or a combination of software and hardware, and the multiple functional units can be combined or divided arbitrarily based on the specific implementation.

In a third aspect, a network device is provided. The network device includes: a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the methods in the above first aspect and its various implementation manners are realized.

In a fourth aspect, a flow statistics system is provided. The flow statistics system includes the network device provided in any one of the above aspects, and a control device. Wherein, the network device is configured to report the target flow identifier to the control device based on the updated packet count value in the first storage unit. The control device is configured to, based on the received target flow identifier, collect statistics on the traffic of the data flow indicated by the target flow identifier.

Optionally, the network device is configured to report the target flow identifier to the control device if the updated packet count value in the first storage unit satisfies a statistical condition. The control device is configured to increase the traffic statistics value of the data flow indicated by the target flow identifier by a second preset value.

Optionally, the control device is further configured to: output the flow identifiers of the top K data flows with the highest traffic statistics, or output the flow identifiers of the top K data flows with the highest changes in the traffic statistics within a set period of time; K is an integer greater than or equal to 1.

Optionally, the network device may be a first chip, and the control device may be a second chip. Wherein, the first chip is also called a data plane chip or a forwarding plane chip, and the second chip is also called a control plane chip.

In a fifth aspect, a computer-readable storage medium is provided. Instructions are stored in the computer-readable storage medium, and when the instructions are executed by the processor, the methods in the above first aspect and various implementation manners thereof are realized.

In a sixth aspect, a computer program product including instructions is provided. When the instructions in the computer program product are executed by the processor, the methods in the above first aspect and various implementation manners thereof are realized.

In a seventh aspect, a chip is provided, the chip includes a programmable logic circuit and/or program instructions, and when the chip is running, implements the method in the above first aspect and various implementation manners thereof.

The beneficial effects brought by the technical solution provided by the application at least include:

After the network device obtains the target packet, it can process the target flow identifier of the data flow to which the target packet belongs through the mapping function to obtain the target flow index and the target address index. Afterwards, the network device can update the flow index and/or packet count value in the first storage unit among the multiple storage units indicated by the target address index according to the target flow index, and based on the updated packet in the first storage unit Counting value, counting the traffic of the data flow to which the target packet belongs. Since the network device does not need to report sampling packets to the control device during the above flow statistics process, the efficiency of flow statistics is effectively improved, and the storage space of the control device will not be occupied. Furthermore, since the stream index stored in the first storage unit is obtained by processing the target stream ID through a mapping function, it is possible to avoid directly storing the target stream ID and occupying more storage space.

Description of drawings

FIG. 1 is a schematic structural diagram of a flow statistics system provided by an embodiment of the present application;

Fig. 2 is a schematic structural diagram of another flow statistics system provided by the embodiment of the present application;

FIG. 3 is a flow chart of a flow statistics method provided in an embodiment of the present application;

Fig. 4 is a schematic diagram of updating a first storage unit provided by an embodiment of the present application;

Fig. 5 is a schematic diagram of another first storage unit provided by the embodiment of the present application;

FIG. 6 is a schematic diagram of a correspondence between a flow identifier and a traffic statistics value provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a network device provided by an embodiment of the present application;

FIG. 8 is a schematic structural diagram of another network device provided by an embodiment of the present application;

FIG. 9 is a schematic structural diagram of another network device provided by an embodiment of the present application.

Detailed ways

The flow statistics method, device, and system provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a schematic structural diagram of a flow statistics system provided by an embodiment of the present application. As shown in FIG. 1 , the flow statistics system may include a network device 01 and a control device 02 . Wherein, the network device 01 is used to obtain the target message. The target flow identifier of the data flow to which the target message belongs is processed by the first mapping function to obtain the target flow index, and the target flow identifier is processed by the second mapping function to obtain the target address index. The target address index indicates a storage area of the network device 01, and the storage area includes multiple storage units, and each storage unit is used to store a flow index and a packet count value of the data flow indicated by the flow index. The network device 01 is further configured to update the flow index and/or packet count value in the first storage unit among the plurality of storage units according to the target flow index, and based on the updated packet count value in the first storage unit, set the target The flow identification is reported to the control device 02. The control device 02 is configured to collect statistics on the traffic of the data flow indicated by the target flow identifier.

It can be understood that the "statistics of data stream traffic" mentioned in the embodiment of the present application is not to count the real traffic of data streams, but to count the values that can reflect the traffic volume of the data streams. For example, this value could be the traffic statistics described below.

Optionally, after the control device 02 counts the traffic of multiple data flows based on the flow identifier reported by the network device 01 , it may further identify K specific flows from the multiple data flows. The K specific streams may be the top K data streams with the highest traffic among the multiple data streams, or may be the top K data streams with the highest traffic variation among the multiple data streams. Wherein, K is an integer greater than or equal to 1.

In a first possible implementation manner, the network device 01 may be a first chip, and the control device 02 may be a second chip. The first chip and the second chip can be deployed in the same device. For example, the first chip and the second chip may be deployed in the same device for forwarding packets, such as a switch or a router, or the first chip and the second chip may be deployed in the same network card. That is, the flow statistics system may be a device for forwarding packets. Wherein, the first chip may also be called a data plane chip, a forwarding plane chip, or an interface board. The second chip may also be called a control plane chip or a main control board. Among them, the data plane chip is used to forward the message and count the message count value. The control plane chip is used to count the traffic of the data flow to which the message belongs based on the message count value. In this case, the switch, router or network card is equivalent to the flow statistics system shown in FIG. 1 .

In a second possible implementation manner, as shown in FIG. 2 , the network device 01 and the control device 02 may be two independent devices. Wherein, the network device 01 may be a device for forwarding packets, such as a switch or a router. The control device 02 may be a forwarding device such as a switch or a router for forwarding packets, or may be a server. The server may be an independent physical server, or a server cluster composed of multiple physical servers, or may be a cloud server (also called a cloud computing service center). The control device 02 may also be a software system running on a server.

Optionally, referring to FIG. 2 , the flow statistics system may include multiple network devices 01 . The control device 02 may receive the flow identifiers reported by the multiple network devices 01, and perform global statistics on the traffic of the data flows indicated by the flow identifiers reported by the multiple network devices 01.

In the second possible implementation manner, if the control device 02 is a device for forwarding packets, the control device 02 may be a forwarding device at an upper level of the multiple network devices 01 . For example, multiple network devices 01 may be access layer devices, and the control device 02 may be an aggregation layer device. Alternatively, multiple network devices 01 may be aggregation layer devices, and the control device 02 may be a core layer device. Alternatively, if the topology of the flow statistics system is a leaf-spine topology, the plurality of network devices 01 may be leaf devices in the leaf-spine topology, and the control device 02 may be spine devices in the leaf-spine topology .

Optionally, the flow statistics system provided in the embodiment of the present application may be applied to a data center network (data center network, DCN), a metropolitan area network, a wide area network, or a campus network.

The flow of the flow statistics method provided by the embodiment of the present application will be illustrated below with reference to FIGS. 1-3 .

FIG. 3 is a flow chart of a flow statistics method provided by an embodiment of the present application. The method can be applied to a network device, and the network device can be the network device 01 in the flow statistics system shown in FIG. 1 or FIG. 2 . Referring to Figure 3, the method includes:

Step 101, acquire the target message.

In the embodiment of the present application, the network device can obtain the target message during the process of forwarding the message of each data flow. Wherein, the target message may be any message received by the network device. Correspondingly, the packet count value of the data flow counted by the embodiment of the present application corresponds to the total amount of packets in the data flow. Alternatively, the target packet may be a packet to be discarded by the network device. Correspondingly, the packet count value of the data flow counted by the embodiment of the present application corresponds to the amount of packet loss in the data flow.

It can be understood that after a network device receives a message, if it detects any of the following situations, it can discard the message: message verification failure, network congestion, port or link failure of the network device, The forwarding entry of the packet has not been obtained.

Step 102, acquire the target flow index.

After the network device obtains the target packet, it can obtain the flow identifier of the data flow to which the target packet belongs (referred to as the target flow identifier in this application). The target flow identifier may be an identifier that can uniquely indicate the data flow to which the target packet belongs. The network device can then determine the target flow index for the data flow. The network device may use the target flow identifier as the target flow index, or, the network device processes the target flow identifier through its pre-configured first mapping function, so as to obtain the target flow index of the data flow to which the target packet belongs.

Wherein, the flow identifier of any data flow (such as the above-mentioned target flow identifier) may include part or all of the information in the 5-tuple of the data flow. For example, the flow identifier may include a source Internet Protocol (Internet Protocol, IP) address and a destination IP address in the five-tuple. The first mapping function may be a hash function (also referred to as a hash function), which can map the flow identifier of the data flow into a fixed-length flow index. Moreover, the length of the flow index is smaller than the length of the flow identifier. For example, the length of the flow identifier can range from 8 bytes (byte) to 13 bytes (byte). The length of the stream index obtained after being mapped by the first mapping function may be 1 byte. In this embodiment of the present application, the flow identifier of the data flow may also be referred to as a key value (key) of the data flow. A flow index of a data flow may also be called a flow fingerprint.

Step 103, acquire the target address index.

The target address index is obtained according to the target flow identifier.

For example, a second mapping function is pre-configured in the network device, and the second mapping function may also be a hash function. After the network device acquires the target flow identifier, it can also process the target flow identifier through the second mapping function to obtain the target address index. The target address index indicates a storage area of the network device. The storage area includes a plurality of storage units, and each storage unit is used to store a flow index and a packet count value of the data flow indicated by the flow index. That is, the data storage format of each storage unit may be [stream index, message count value].

Optionally, a hash table may be stored in the network device. Referring to FIG. 4, the hash table corresponds to storage units with M rows and N columns, and each storage unit may also be called a hash bucket. Wherein, both M and N can be integers greater than 1, and M and N can be flexibly configured according to the storage space of the network device and the number of data streams to be counted.

The target address index can indicate at least one row of storage units in the hash table. That is, the storage area indicated by the target address index includes at least one row of storage units in the hash table, where each row of storage units includes N storage units. Correspondingly, the target address index may also be called a row index (index). Certainly, the target address index may also indicate at least one column of storage units in the hash table. Correspondingly, the target address index may also be called a column index.

Optionally, referring to FIG. 4, the second mapping function H2 may include a first sub-mapping function H21 and a second sub-mapping function H22. The network device can process the target flow identifier through the first sub-mapping function H21 to obtain the first sub-index a1, and can process the second sub-index a2 of the target flow identifier through the second sub-mapping function H22. The target address index includes a first sub-index a1 and a second sub-index a2. Moreover, a storage area indicated by the target address index includes: a first sub-storage area S1 indicated by the first sub-index a1, and a second sub-storage area S2 indicated by the second sub-index a2. The multiple storage units in the storage area indicated by the target address index include: storage units corresponding to the first sub-storage area S1 and the second sub-storage area S2.

For example, it is assumed that both the first sub-index a1 and the second sub-index a2 are row indexes. Then, as shown in FIG. 4 , the storage unit corresponding to the first sub-storage area S1 is a row of storage units indicated by the first sub-index a1. The storage unit corresponding to the second sub-storage area S2 is a row of storage units indicated by the second sub-index a2. Correspondingly, the storage area indicated by the target address index includes two rows (that is, 2×N) storage units.

By using two different sub-mapping functions to process the target stream identifier, it can be ensured that two candidate sub-storage areas can be determined for one target stream index. Since the number of determined candidate storage units is large, the probability of determining the first storage unit meeting the condition among the plurality of storage units can be effectively increased.

It can be understood that the number of sub-mapping functions included in the second mapping function may also be greater than 2. For example, assuming that the second mapping function includes 4 sub-mapping functions, a storage area indicated by the target address index may include 4 sub-storage areas indicated by the 4 sub-mapping functions. In addition, the above-mentioned first mapping function and second mapping function may also be other mapping functions except the hash function, which is not limited in this embodiment of the present application.

Step 104: Update the flow index and/or packet count value in the first storage unit among the multiple storage units according to the target flow index.

Wherein, the updated flow index in the first storage unit is the target flow index, and the updated packet count value in the first storage unit can be used to count traffic of the data flow to which the target packet belongs.

In this embodiment of the present application, after the network device determines the target flow index and determines the multiple storage units indicated by the target address index, it may match the target flow index with the flow indices in the multiple storage units. According to different matching results, the network device may update the flow index and/or packet count value in the first storage unit among the multiple storage units in different ways. Wherein, the manner in which the network device updates the first storage unit may include any of the following manners:

Manner 1: If the target stream index is stored in the first storage unit among the plurality of storage units, the packet count value in the first storage unit is increased by a first preset value.

In mode one, since the target flow index matches the flow index in the first storage unit among the plurality of storage units, the network device can directly increase the packet count value in the first storage unit by a first preset value . Wherein, the first preset value may be a fixed value pre-configured in the network device. Optionally, the first preset value may be a minimum counting unit of the packet count value. For example, the first preset value may be 1.

For example, referring to FIG. 4 , it is assumed that the target stream index calculated by the network device through the first mapping function H1 is K5, and the target address index calculated through the first sub-mapping function H21 and the second sub-mapping function H22 includes the first sub-index a1 and the second sub-index a2. It can be seen from FIG. 4 that there is a first storage unit in the first sub-storage area S1 indicated by the first sub-index a1, and the stream index stored in the first storage unit is K5. Thus, the network device may increase the packet count value C5 in the first storage unit by the first preset value. For example, the network device may update the packet count value C5 to: C5=C5+1.

Method 2: If there is no storage unit that has stored the target flow index among the multiple storage units, store the target flow index and the initial message count value in a free storage unit among the multiple storage units, and the free storage unit is is the first storage unit.

Wherein, the free storage unit refers to a storage unit that does not store the flow index and the packet count value. In mode 2, since the target flow index does not match the flow index in any storage unit of the plurality of storage units, the network device may store the target flow index in a free storage unit of the plurality of storage units and the initial packet count value. That is, the network device may select an idle storage unit from the multiple storage units as the first storage unit. Wherein, the initial packet count value may be an initial value of a packet count value pre-configured in the network device. For example, the initial packet count value may be 1.

Optionally, in the second manner above, if there are multiple free storage units among the multiple storage units, the network device may randomly select an idle storage unit to store the target flow index and the initial packet count value. Alternatively, the network device may also select a free storage unit traversed first to store the target flow index and the initial packet count value.

For example, referring to FIG. 5 , it is assumed that the target stream index calculated by the network device through the first mapping function H1 is K0, and the target address index calculated through the first sub-mapping function H21 and the second sub-mapping function H22 includes the first sub-index a1 and the second sub-index a2. It can be seen from Fig. 5 that there is no storage unit that already stores the target flow index K0 in the two sub-storage areas indicated by the first sub-index a1 and the second sub-index a2, and there is free storage in the second sub-storage area S2 unit. Therefore, the network device can store the target flow index K0 and the initial packet count value C0 in a free storage unit in the second sub-storage area S2. Wherein, the initial message count value C0 may be equal to 1.

Method 3: If there is no storage unit that has stored the target flow index in the multiple storage units, and there is no free storage unit, then the flow index in a storage unit whose message count value is the initial value in the multiple storage units It is updated as the target flow index, and the storage unit whose packet count value is the initial value is the first storage unit.

In mode 3, since the target stream index does not match the stream index in any of the multiple storage units, and there is no idle storage unit in the multiple storage units, the network device needs to use the target stream index Replace the stream index already stored in a storage unit. In order to ensure the accuracy of counting the packet count value, the network device may update the flow index in a storage unit whose packet count value is an initial value among the plurality of storage units to the target flow index. In addition, the network device may keep the packet count value in the first storage unit unchanged, that is, the packet count value in the first storage unit is still an initial value. Wherein, the initial value may be a fixed value preconfigured in the network device, for example, the initial value may be 1.

It can be understood that, each time a network device acquires a target packet, it can update the stream index and/or packet count value of a certain storage unit in the storage space through the method shown in the above steps. If the packet count value in the first storage unit is the initial value, it indicates that for the data flow indicated by the flow index in the first storage unit (hereinafter referred to as data flow 1), the data flow currently acquired by the network device The number of target packets of 1 is an initial value (for example, only one target packet of the data flow 1 has been obtained). Based on this, after the network device obtains a target packet of data flow 2, if it detects that the matching result of the target flow index of data flow 2 is the situation in the above method 3, it can use the target flow index of data flow 2 to replace Stream index of data stream 1 stored in the first storage unit. Moreover, since the number of target packets of the data flow 2 acquired by the network device is also an initial value, there is no need to update the packet count value in the first storage unit.

Based on the above analysis, it can be seen that in the third mode, the number of target packets of data flow 1 currently obtained by the network device is equivalent to the number of target packets of data flow 2 currently obtained. Therefore, updating the stream index of data stream 1 in the first storage unit by the network device to the target stream index of data stream 2 will not affect identification of a specific stream among the multiple data streams. It can be seen that the method provided by the embodiment of the present application can effectively reduce the number of storage units occupied by the flow index and packet statistics under the premise of accurately identifying the specific flow, thereby reducing the impact on the storage capacity of the network device. Require.

It can be understood that, based on the target stream index, the network device may also fail to obtain the first storage unit that meets the condition from the multiple storage units. That is, there may be the following scenario: among the multiple storage units indicated by the target address index, there is no storage unit that has already stored the target flow index, and the packet count value in each storage unit is greater than the initial packet count value. For this scenario, the network device may decrease the packet count value in the storage unit with the smallest packet count value among the multiple storage units by a first preset value. In addition, the network device does not need to update the flow index in the storage unit with the least packet count value.

It can be understood that if the packet count value in the storage unit with the least packet count value is reduced to the initial value, then when the network device obtains the target packet again, the method shown in the above method 3 can be used to update the packet count value. Flow index in the storage unit with the least packet count value.

Based on the above update method, it can be seen that after the network device obtains the target message of a certain data flow (hereinafter referred to as data flow 5), if there is no first storage unit, only when the number of target packets of data flow 5 obtained by the network device is greater than or equal to the minimum packet count value in the plurality of storage units, the flow index of the data flow 5 can be used to replace the packet The stream index in the storage unit with the least file count value.

Assuming that the data flow indicated by the flow index in the storage unit with the least packet count value is data flow 6, the above update method can be understood as: when the number of target packets of data flow 5 acquired by the network device is greater than or equal to the network The device will replace the stream index of data stream 6 with the stream index of data stream 5 only when the number of target packets of data stream 6 has been obtained by the device. Based on this, in a scenario where the number of storage units is limited, it is possible to realize reliable statistics of packet count values of data streams with high traffic.

Step 105: Based on the updated packet count value in the first storage unit, collect statistics on the traffic of the data flow to which the target packet belongs.

In this embodiment of the application, after the network device updates the flow index and/or the packet count value in the first storage unit, it can count the number of streams the target packet belongs to based on the updated packet count value in the first storage unit. flow of data streams. Wherein, counting the traffic of the data stream to which the target message belongs refers to: counting a traffic statistical value that can reflect the traffic volume of the data stream to which the target message belongs.

As a first possible implementation, if the updated packet count value in the first storage unit satisfies the statistical condition, the network device can report the target flow identifier to the control device, so that the control device can indicate the target flow identifier The traffic statistics value of the data flow is increased by a second preset value.

Wherein, the second preset value may be the minimum counting unit of the traffic statistics value, for example, the second preset value may be equal to 1. In the first implementation manner, the network device may encapsulate the target flow identifier in a statistical message, and report the statistical message to the control device. For example, the network device may use IPinIP encapsulation to construct a statistical message, and the outer destination IP address of the statistical message is the IP address of the control device.

As shown in FIG. 6 , the control device may store the corresponding relationship between the flow identifier of the data flow and the traffic statistics value. Each time the control device receives a flow identifier (for example, a target flow identifier) of a data flow reported by the network device, the traffic statistics value corresponding to the flow identifier may be increased by a second preset value. Wherein, the traffic statistics value may be, for example, the number of reports.

As an example, assume that the updated packet count value in the first storage unit satisfies the statistical condition, and the target flow identifier of the data flow to which the target packet currently acquired by the network device is FID-1. Then the network device may report the target flow identifier FID-1 to the control device, and the control device may then identify the target flow as FID-1 and increase the traffic statistics value corresponding to FID-1 by 1. Referring to FIG. 6 , the control device may update the traffic statistics value corresponding to the target flow identifier as FID-1 from 10 to 11.

Optionally, in the first implementation manner, the control device may receive flow identifiers reported by multiple network devices, and may collect statistics on traffic statistics of the data flows indicated by the received flow identifiers. In addition, the control device may also identify K specific flows from the plurality of data flows based on the counted traffic statistics values of the plurality of data flows. That is, the control device can perform global statistics on the traffic of multiple data flows passing through multiple network devices, and thus can identify K specific flows globally. Further, the control device may also output the K specific streams through an output device, for example, the output device may be a display screen or an interface connected to a network management system.

As a second possible implementation, if the updated packet count value in the first storage unit satisfies the statistical condition, the network device may directly increase the traffic statistical value of the data flow indicated by the target flow identifier by a second preset value .

In the second implementation manner, the network device itself has a traffic statistics function. For example, the network device also stores the corresponding relationship between the flow identifier and the traffic statistics value of the data flow as shown in FIG.

Optionally, the network device may include a data plane chip and a control plane chip. Among them, the data plane chip is used to forward the message and count the message count value, that is, the data plane chip is used to maintain the hash table. The data plane chip is further configured to report the target flow identifier to the control plane chip if it is detected that the updated packet count value in the first storage unit satisfies the statistical condition. The control plane chip is used to increase the traffic statistic value of the data flow indicated by the target flow identifier by a second preset value, that is, the control plane chip is used to count the traffic statistic value of each data flow.

It can be understood that, after the network device processes different flow identifiers through the first mapping function, the same flow index may be obtained, that is, there may be a hash conflict between the flow indexes of different data flows. As a result, the packet count value stored in the first storage unit may be obtained by counting the number of target packets of different data flows. In the above two implementation manners, the network device or the data plane chip can report the target flow identifier of the data flow to which the currently acquired target packet belongs when the count value of the packet meets the statistical condition. For the scenario where there is a hash conflict between the flow index of the data flow with a large traffic (hereinafter referred to as data flow 3) and the flow index of a data flow with a small traffic (hereinafter referred to as data flow 4), due to the network device or data plane chip The number of target packets of the obtained data flow 3 is large, so the number of times of reporting the flow identifier of the data flow 3 is large. However, the number of target packets of the data flow 4 obtained by the network device or the data plane chip is relatively small, so the number of times to report the flow identifier of the data flow 4 is relatively small. The control device or the control plane chip can then accurately count the traffic of the data flows indicated by each flow identifier according to the number of received flow identifiers, and thus can accurately identify a specific flow among multiple data flows. It can be seen that the method provided by the embodiment of the present application can not only realize the multiplexing of the storage resources of the storage unit (that is, the packet count values of different data streams can be recorded in the same storage unit), but also realize the multiplexing of the storage resources of different data streams. Accurate statistics of traffic.

Optionally, the statistical conditions described in the above two implementation manners may include: the packet count value is an integer multiple of the statistical threshold. Based on this statistical condition, it can be seen that if the network device detects that the packet count value in the first storage unit after the update satisfies: packet count value% statistical threshold==0, then the above-mentioned first or second implementation method can be used Update the traffic statistics value of the data flow indicated by the target flow identifier. Wherein, the statistical threshold may be an integer greater than 1, such as 128.

Compared with updating the traffic statistics in real time based on the change of the packet count value, the method provided by the embodiment of the present application updates the traffic statistics of the data flow with the statistical threshold as the statistical interval, which can effectively reduce the update frequency of the traffic statistics, thereby reducing the Resource occupation of control devices or control plane chips. Moreover, for the data flow 4 with a small traffic, after the network device acquires the target packet of the data flow 4 and updates the packet count value in the first storage unit, the packet count value is exactly an integer multiple of the statistical threshold low probability. Therefore, reporting the target flow identifier after the packet count value satisfies the statistical condition can further reduce the probability of reporting the flow identifier of the data flow with small traffic. In this way, it can be ensured that the traffic statistical value obtained through statistics can more accurately reflect the traffic volume of each data flow in the network.

Optionally, the statistics threshold may be a fixed value pre-configured in the network device. That is to say, during the flow statistics process, the statistics threshold always remains unchanged. Alternatively, the statistical threshold may also vary with changes in packet count values. For example, the statistics threshold may increase as the packet count increases.

For example, if the updated packet count value in the first storage unit is within the first numerical range, the network device can update the traffic statistical value with the statistical threshold of the first numerical value as the statistical interval. If the updated packet count value in the first storage unit is within the second numerical range, the network device can update the traffic statistical value with the statistical threshold of the second numerical value as the statistical interval. Wherein, the lower limit of the second numerical range is greater than the upper limit of the first numerical range, and the second numerical value is greater than the first numerical value.

Step 106, if the flow index and packet count value in the second storage unit among the plurality of storage units have not been updated for a set period of time, delete the flow index and packet count value stored in the second storage unit.

In the embodiment of the present application, an aging mechanism of the storage unit is also configured in the network device. Based on the aging mechanism, the network device can delete the flow index and the packet count value in the second storage unit that have not been updated for a set period of time. That is, the network device can age the second storage unit, and the aged second storage unit is an idle storage unit. Based on the aging mechanism, the network device can release the storage space of the second storage unit in time, so as to store flow indexes and packet count values of other data flows. Wherein, the set duration may be a fixed value pre-configured in the network device, for example, it may be equal to 1 second.

Optionally, after updating the flow index and/or packet count value in a storage unit each time, the network device may record the update timestamp of the storage unit. If the network device detects that the time between the update timestamp of the second storage unit and the current time exceeds the set time period, it may determine that the flow index and packet count in the second storage unit have not been updated beyond the set time period.

Step 107: Based on the traffic statistics of each data flow, output the flow identifiers of the top K data flows.

After the network device counts the traffic statistics of each data flow based on the second implementation manner in step 105, it may also sort the flow identifiers of each data flow based on the traffic statistics of each data flow every statistical period. In addition, the network device may output flow identifiers of the top K data flows based on the sorting result. Wherein, the duration of the statistical period may be pre-configured in the network device. For example, the duration of the statistical period may be 100 milliseconds or 1 second.

Optionally, the top K data streams may be the top K data streams with the highest traffic statistics. That is, the network device can identify and output flow identifiers of the top K data flows with the highest traffic among the multiple data flows. Alternatively, the top K data streams may be flow identifiers of the top K data streams with the highest variation in traffic statistics within a set period of time. That is, the network device can identify and output flow identifiers of the top K data flows with the largest traffic changes among the multiple data flows. Wherein, the set period of time may be the previous statistical period, or may also refer to the period from the initial statistical moment to the current statistical moment.

Optionally, the network device outputting the flow identifiers of the first K data flows may refer to: the network device displays the flow identifiers of the first K data flows on its display screen. Alternatively, the network device sends the flow identifiers of the first K data flows to another device for display by the other device. Wherein, the other device may be a control device, or may be a user device.

It can be understood that, for the first implementation manner in step 105 above, the control device may also execute the method shown in step 107 above after counting the traffic statistics of each data flow. That is, the control device may output flow identifiers of the first K data flows based on the traffic statistics of each data flow. In the solution provided by the embodiment of the present application, since the network device or the control device can automatically output the flow identifiers of the first K data streams according to the statistical period, it is not necessary to query the data stored in the network device when the first K data streams need to be counted. Packet count value in the unit. Thus, the efficiency of flow statistics is effectively improved.

It can also be understood that the order of the steps of the flow statistics method provided in the embodiment of the present application can be adjusted appropriately, and the steps can also be increased or decreased accordingly according to the situation. For example, the above step 103 may be performed before step 102 . Alternatively, the above step 106 may be deleted according to circumstances, that is, the network device may not need to age the storage unit that has not been updated for a long time. Alternatively, the above step 107 may be performed before step 106, or may be deleted according to circumstances.

To sum up, the embodiment of the present application provides a flow statistics method. After the network device obtains the target packet, it can process the target flow identifier of the data flow to which the target packet belongs through the mapping function to obtain the target flow index and the target address index. Afterwards, the network device can update the flow index and/or packet count value in the first storage unit among the multiple storage units indicated by the target address index according to the target flow index, and based on the updated packet in the first storage unit Counting value, counting the traffic of the data flow to which the target packet belongs. Since the network device does not need to report sampling packets to the control device during the above flow statistics process, the efficiency of flow statistics is effectively improved, and the storage space of the control device will not be occupied. Furthermore, since the stream index stored in the first storage unit is obtained by processing the target stream ID through a mapping function, it is possible to avoid directly storing the target stream ID and occupying more storage space.

FIG. 7 is a schematic structural diagram of a network device provided by an embodiment of the present application. The network device can be applied to the flow statistics system shown in FIG. 1 or FIG. 2 , and can be used to implement the flow statistics method provided in the foregoing method embodiments. As shown in Figure 7, the network equipment includes:

The obtaining unit 011 is configured to obtain the target message. For the function implementation of the acquiring unit 011, reference may be made to the related description of the above-mentioned step 101.

The processing unit 012 is configured to obtain a target flow index according to the target flow identifier of the data flow to which the target packet belongs; and obtain a target address index according to the target flow identifier. The target address index indicates a storage area of the network device, and the storage area includes a plurality of storage units, and each storage unit is used to store a flow index and a packet count value of the data flow indicated by the flow index. For example, the processing unit 012 processes the target flow identifier of the data flow to which the target packet belongs through the first mapping function to obtain the target flow index, and processes the target flow identifier through the second mapping function to obtain the target address index.

For the function implementation of the processing unit 012, reference may be made to the related descriptions of the above-mentioned step 102 and step 103.

An updating unit 013, configured to update the flow index and/or packet count value in the first storage unit among the plurality of storage units according to the target flow index. For the function implementation of the updating unit 013, reference may be made to the relevant description of the above step 104.

The statistics unit 014 is configured to, based on the updated packet count value in the first storage unit, count the traffic of the data flow to which the target packet belongs. For the function realization of the statistical unit 014, reference may be made to the relevant description of the above-mentioned step 105.

Optionally, the updating unit 013 can be used for:

If the target stream index is stored in the first storage unit among the plurality of storage units, increasing the packet count value in the first storage unit by a first preset value;

If there is no storage unit that has stored the target flow index in the plurality of storage units, then store the target flow index and the initial message count value in an idle storage unit among the plurality of storage units, and the idle storage unit is the first storage unit, and the free storage unit refers to a storage unit that does not store the flow index and the packet count value;

If there is no storage unit that has stored the target flow index in the plurality of storage units, and there is no free storage unit, then the flow index in a storage unit whose message count value is the initial value in the plurality of storage units The target flow index is updated, and the storage unit whose packet count value is an initial value is the first storage unit.

Optionally, the update unit 013 may also be used for: if there is no storage unit that has stored the target stream index among the plurality of storage units, and the message count value in each storage unit is greater than the initial message count value, then the packet count value in the storage unit with the smallest packet count value among the plurality of storage units is reduced by a first preset value.

Optionally, the statistics unit 014 may be configured to: if the updated packet count value in the first storage unit satisfies the statistics condition, report the target flow identifier to the control device for the control device to The traffic statistics value of the data flow indicated by the target flow identifier is increased by a second preset value; or, if the updated packet count value in the first storage unit satisfies the statistical condition, then the traffic statistics value of the data flow indicated by the target flow identifier is The traffic statistical value is increased by a second preset value.

Optionally, the statistical condition includes: the packet count value is an integer multiple of a statistical threshold, and the statistical threshold is an integer greater than 1.

Optionally, continuing to refer to FIG. 7 , the network device may further include an output unit 015, which is configured to: output flow identifiers of the top K data flows with the highest traffic statistics; or output the traffic statistics at the set The stream identifiers of the top K data streams with the highest variation within the time period; where K is an integer greater than or equal to 1.

For the function implementation of the output unit 015, reference may be made to the relevant description of the above-mentioned step 107.

Optionally, the second mapping function includes a first sub-mapping function and a second sub-mapping function; the processing unit 012 may be configured to: use the first sub-mapping function to process the target flow identifier to obtain the first sub-index; and use the second The second sub-mapping function processes the target stream to identify the second sub-index, and the target address index includes the first sub-index and the second sub-index; correspondingly, the storage area includes: the first sub-storage area indicated by the first sub-index, and the second sub-storage area indicated by the second sub-index, the plurality of storage units include storage units corresponding to the first sub-storage area and the second sub-storage area.

Optionally, the updating unit 013 can also be used to: if the flow index and packet count value in the second storage unit among the plurality of storage units have not been updated for a set period of time, then store in the second storage unit The stream index and packet count value of the stream are deleted. For the function implementation of the update unit 013, reference may also be made to the relevant description of the above-mentioned step 106.

Optionally, the target message is any message received by the network device, or the target message is a message to be discarded by the network device.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the network device and each unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

It can be understood that the network equipment provided in the embodiment of the present application can also be realized by application-specific integrated circuit (application-specific integrated circuit, ASIC), or programmable logic device (programmable logic device, PLD). The above-mentioned PLD can be complex Program logic device (complex programmable logical device, CPLD), field-programmable gate array (field-programmable gate array, FPGA), general array logic (generic array logic, GAL) or any combination thereof. In addition, the flow statistics method provided by the above method embodiment may also be implemented by software, and when the flow statistics method provided by the above method embodiment is implemented by software, each functional unit in the network device may also be a software module.

FIG. 8 is a schematic structural diagram of another network device provided by an embodiment of the present application. The network device can be applied to the flow statistics system shown in FIG. 1 or FIG. 2 , and can be used to implement the flow statistics method provided in the foregoing method embodiments. As shown in FIG. 8 , the network device includes: a processor 201 , a memory 202 , a network interface 203 and a bus 204 .

Wherein, a computer program 2021 is stored in the memory 202, and the computer program 2021 is used to realize various application functions. The processor 201 is configured to execute the computer program 2021 to implement the flow statistics method provided by the foregoing method embodiments.

The processor 201 can be a central processing unit (central processing unit, CPU), and the processor 201 can also be other general-purpose processors, a digital signal processor (digital signal processor, DSP), ASIC, FPGA, graphics processing unit (graphics processing unit, GPU) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor can be a microprocessor or any conventional processor.

Memory 202 can be volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory. Among them, the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of RAM are available such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data date SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM ) and direct memory bus random access memory (direct rambus RAM, DR RAM).

There may be multiple network interfaces 203, and the network interfaces 203 are used to implement communication connections with other devices (which may be wired or wireless). Wherein, in the embodiment of the present application, the network interface 203 is used to send and receive messages. Wherein, other devices may be devices such as terminals, servers, VMs, or other network devices.

The bus 204 is used to connect the processor 201 , the memory 202 and the network interface 203 . Moreover, the bus 204 may include a power bus, a control bus, a status signal bus, etc. in addition to a data bus. However, for clarity of illustration, the various buses are labeled as bus 204 in the figure.

FIG. 9 is a schematic structural diagram of another network device provided by an embodiment of the present application. The network device can be applied to the flow statistics system shown in FIG. 1 or FIG. 2 , and can be used to implement the flow statistics method provided in the foregoing method embodiments. As shown in FIG. 9 , the network device includes: a main control board 301 and at least one interface board (an interface board is also called a line card or a service board), for example, an interface board 302 and an interface board 303 are shown in FIG. 9 . In the case of multiple interface boards, the network device may further include a switching fabric board 304, and the switching fabric board 304 is used to complete data exchange between the interface boards.

Wherein, the main control board 301 is also called a main processing unit (main processing unit, MPU) or a route processing card (route processor card), and the main control board 301 is used to complete functions such as system management, equipment maintenance, and protocol processing. There are mainly three types of functional units on the main control board 301: a system management control unit, a system clock unit and a system maintenance unit. The main control board 301 includes: a CPU 3011 and a memory 3012 .

The interface boards 302 and 303 are also called line interface unit cards (line processing unit, LPU), line cards (line card) or service boards, and the interface boards are used to provide various service interfaces and realize message forwarding. Wherein, the service interfaces provided by the interface board may include: SONET/SDH-based packet (packet over SONET/SDH, POS) interface, Gigabit Ethernet (gigabit Ethernet, GE) interface and asynchronous transfer mode (asynchronous transfer mode, ATM) interface, etc. Among them, SONET refers to synchronous optical network (synchronous optical network), and SDH refers to synchronous digital hierarchy (synchronous digital hierarchy). The main control board 301 , the interface board 302 and the interface board 303 are connected to the system backplane through a system bus to realize intercommunication. As shown in FIG. 9 , the interface board 302 includes one or more central processing units 3021 . The central processing unit 3021 is used to control and manage the interface board 302 and communicate with the central processing unit 3011 on the main control board 301 and the interface board 302 . The memory 3024 on the interface board 302 is used to store forwarding entries, and the network processor 3022 can forward packets by looking up the forwarding entries stored in the memory 3024 . Memory 3024 can also be used to store program codes.

The interface board 302 also includes one or more physical interface cards 3023, the one or more physical interface cards 3023 are used to receive the message sent by the previous hop node, and send the message to the next hop node according to the instructions of the central processing unit 3021 processed message.

In addition, it can be understood that the central processing unit 3021 and/or network processor 3022 in the interface board 302 in FIG. The forwarding plane is processed by dedicated hardware or chips. In another implementation manner, the central processing unit 3021 and/or the network processor 3022 may also use a general-purpose processor, such as a general-purpose CPU, to implement the functions described above.

In addition, it should be understood that there may be one or more main control boards 301, and when there are multiple main control boards, it may include an active main control board and a standby main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards it provides. As shown in FIG. 9 , the network device includes an interface board 302 and an interface board 303 . When the distributed forwarding mechanism is adopted, the structure of the interface board 303 is basically the same as that of the interface board 302 , and the operations on the interface board 303 are basically similar to those of the interface board 302 , which are not repeated for brevity. When the network device has multiple interface boards, the multiple interface boards can communicate through one or more switching fabric boards 304, and can realize load sharing and redundant backup to provide large-capacity data exchange and processing capabilities .

Under the centralized forwarding architecture, the network device may not need the switching fabric board 304, and the interface board undertakes the processing function of the service data of the whole system. Therefore, the data access and processing capabilities of network devices with a distributed architecture are greater than those with a centralized architecture. Which architecture to use depends on the specific networking deployment scenario, and there is no limitation here.

In this embodiment of the application, the memory 3012 and the memory 3024 can be ROM or other types of static storage devices that can store static information and instructions, or RAM or other types of dynamic storage devices that can store information and instructions, or Is EEPROM, compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk or other magnetic storage devices , or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 3024 in the interface board 302 may exist independently and be connected to the central processing unit 3021 through a communication bus; or, the memory 3024 may also be integrated with the central processing unit 3021 . The memory 3012 in the main control board 301 can exist independently and be connected with the central processing unit 3011 through a communication bus; or, the memory 3012 can also be integrated with the central processing unit 3011 .

The program codes stored in the memory 3024 are executed under the control of the CPU 3021 , and the program codes stored in the memory 3012 are executed under the control of the CPU 3011 . The central processing unit 3021 and/or the central processing unit 3011 may implement the flow statistics method provided in the foregoing embodiments by executing program codes. One or more software units may be included in the program code stored in memory 3024 and/or memory 3012 . The one or more software units may be functional units in the embodiment shown in FIG. 7 . For example, the acquisition unit 011 , processing unit 012 and update unit 013 in FIG. 7 can all be deployed in the forwarding board 302 , and the statistics unit 014 and output unit 015 can be deployed in the main control board 301 .

In the embodiment of the present application, the physical interface card 3023 may use any device such as a transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (radio access network, RAN), Wireless local area networks (wireless local area networks, WLAN), etc.

The embodiment of the present application also provides a computer-readable storage medium, where an instruction is stored in the computer-readable storage medium, and when the instruction is executed by a processor, the flow statistics method provided by the foregoing method embodiment can be implemented.

The embodiment of the present application also provides a computer program product containing instructions. When the instructions in the computer program product are executed by a processor, the flow statistics method provided by the above method embodiment can be implemented.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware, and can also be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

In the embodiments of the present application, the terms "first", "second" and "third" are used for description purposes only, and cannot be understood as indicating or implying relative importance.

The term "and/or" in this application is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and A and B exist alone. There are three cases of B. In addition, the character "/" in this article generally indicates that the contextual objects are an "or" relationship.

The above are only optional embodiments of the application, and are not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the concept and principles of the application shall be included in the protection of the application. within range.

Claims (26)

1. A flow statistics method, characterized in that it is applied to a network device, the method comprising:

   Get the target message;

   Obtaining a target flow index according to the target flow identifier of the data flow to which the target packet belongs;

   Obtain a target address index according to the target flow identifier, where the target address index is used to indicate a storage area in the storage space of the network device, where the storage area includes a plurality of storage units, and each storage unit is used to store a A flow index, and a packet count value of the data flow indicated by the flow index;

   updating the flow index and/or packet count value in the first storage unit among the plurality of storage units according to the target flow index;

   Based on the updated packet count value in the first storage unit, count the traffic of the data flow to which the target packet belongs.
2. The flow statistics method according to claim 1, wherein,

   The acquiring the target flow index according to the target flow identifier of the data flow to which the target message belongs includes: using the target flow identifier as the target flow index, or processing the target flow identifier through a first mapping function to obtain the target flow index;

   The acquiring the target address index according to the target flow identifier includes: processing the target flow identifier through a second mapping function to obtain the target address index.
3. The method according to claim 1 or 2, wherein the updating the flow index and/or packet count value in the first storage unit among the plurality of storage units according to the target flow index includes any of the following A sort of:

   If the target stream index is stored in the first storage unit among the plurality of storage units, increasing the packet count value in the first storage unit by a first preset value;

   If there is no storage unit that has stored the target flow index in the plurality of storage units, storing the target flow index and the initial packet count value in a free storage unit among the plurality of storage units, The free storage unit is the first storage unit, and the free storage unit refers to a storage unit that does not store flow indexes and message count values;

   If there is no storage unit in which the target flow index has been stored in the plurality of storage units, and there is no free storage unit, store the message count value in the plurality of storage units in a storage unit with an initial value The flow index of is updated to the target flow index, and the storage unit whose packet count value is an initial value is the first storage unit.
4. The method according to claim 3, characterized in that the method further comprises:

   If there is no storage unit that has stored the target flow index in the plurality of storage units, and the packet count value in each storage unit is greater than the initial packet count value, then in the plurality of storage units The message count value in the storage unit with the smallest message count value is reduced by a first preset value.
5. The method according to any one of claims 1 to 4, wherein the counting the traffic of the data flow to which the target message belongs based on the updated message count value in the first storage unit includes:

   If the updated packet count value in the first storage unit satisfies the statistical condition, report the target flow identifier to the control device, so that the control device can report the flow rate of the data flow indicated by the target flow identifier the statistical value is incremented by a second preset value; or,

   If the updated packet count value in the first storage unit satisfies the statistical condition, the traffic statistical value of the data flow indicated by the target flow identifier is increased by a second preset value.
6. The method according to claim 5, wherein the statistical condition includes: the packet count value is an integer multiple of a statistical threshold, and the statistical threshold is an integer greater than 1.
7. The method according to claim 5 or 6, wherein the method further comprises:

   Output the stream IDs of the top K data streams with the highest traffic statistics; or,

   Output the stream identifiers of the top K data streams with the highest change in traffic statistics within a set period of time;

   K is an integer greater than or equal to 1.
8. The method according to any one of claims 1 to 7, wherein the second mapping function comprises a first sub-mapping function and a second sub-mapping function;

   The step of processing the target flow identifier through the second mapping function to map to obtain the target address index includes:

   Processing the target flow identifier through the first sub-mapping function to obtain a first sub-index;

   processing the target flow identification second sub-index by the second sub-mapping function, the target address index includes the first sub-index and the second sub-index;

   The storage area includes: a first sub-storage area indicated by the first sub-index, and a second sub-storage area indicated by the second sub-index, and the plurality of storage units include the first sub-storage area and the second sub-storage area A storage unit corresponding to the second sub-storage area.
9. The method according to any one of claims 1 to 8, wherein the method further comprises:

   If the flow index and the packet count value in the second storage unit among the plurality of storage units have not been updated beyond a set period of time, then delete the flow index and packet count value stored in the second storage unit.
10. The method according to any one of claims 1 to 9, characterized in that,

    The target message is any message received by the network device, or the target message is a message to be discarded by the network device.
11. A network device, characterized in that the network device includes:

    an acquisition unit, configured to acquire the target message;

    A processing unit, configured to obtain a target flow index according to the target flow identifier of the data flow to which the target packet belongs, and obtain a target address index according to the target flow identifier, where the target address index is used to indicate the storage of the network device A storage area in the space, the storage area includes a plurality of storage units, each storage unit is used to store a flow index, and a packet count value of the data flow indicated by the flow index;

    An updating unit, configured to update the flow index and/or packet count value in the first storage unit among the plurality of storage units according to the target flow index;

    A statistical unit, configured to count the traffic of the data flow to which the target message belongs based on the updated message count value in the first storage unit.
12. The network device according to claim 11, characterized in that,

    When obtaining the target flow index according to the target flow identifier of the data flow to which the target packet belongs, the processing unit is configured to: use the target flow identifier as the target flow index, or process the The target flow identifier is obtained by the target flow index;

    When obtaining the target address index according to the target flow identifier, the processing unit is configured to: process the target flow identifier through a second mapping function to obtain the target address index.
13. The network device according to claim 11 or 12, wherein the updating unit is configured to:

    If the target stream index is stored in the first storage unit among the plurality of storage units, increasing the packet count value in the first storage unit by a first preset value;

    If there is no storage unit that has stored the target flow index in the plurality of storage units, storing the target flow index and the initial packet count value in a free storage unit among the plurality of storage units, The free storage unit is the first storage unit, and the free storage unit refers to a storage unit that does not store flow indexes and message count values;

    If there is no storage unit in which the target flow index has been stored in the plurality of storage units, and there is no free storage unit, store the message count value in the plurality of storage units in a storage unit with an initial value The flow index of is updated to the target flow index, and the storage unit whose packet count value is an initial value is the first storage unit.
14. The network device according to claim 13, wherein the updating unit is further configured to:

    If there is no storage unit that has stored the target flow index in the plurality of storage units, and the packet count value in each storage unit is greater than the initial packet count value, then in the plurality of storage units The message count value in the storage unit with the smallest message count value is reduced by a first preset value.
15. The network device according to any one of claims 11 to 14, wherein the statistical unit is configured to:

    If the updated packet count value in the first storage unit satisfies the statistical condition, report the target flow identifier to the control device, so that the control device can report the flow rate of the data flow indicated by the target flow identifier the statistical value is incremented by a second preset value; or,

    If the updated packet count value in the first storage unit satisfies the statistical condition, the traffic statistical value of the data flow indicated by the target flow identifier is increased by a second preset value.
16. The network device according to claim 15, wherein the statistical condition includes: the packet count value is an integer multiple of a statistical threshold, and the statistical threshold is an integer greater than 1.
17. The network device according to claim 15 or 16, wherein the network device further comprises an output unit, the output unit is used for:

    Output the stream IDs of the top K data streams with the highest traffic statistics; or,

    Output the stream identifiers of the top K data streams with the highest change in traffic statistics within a set period of time;

    K is an integer greater than or equal to 1.
18. The network device according to any one of claims 11 to 17, wherein the second mapping function includes a first sub-mapping function and a second sub-mapping function; the processing unit is configured to:

    Processing the target flow identifier through the first sub-mapping function to obtain a first sub-index;

    processing the target flow identifier through the second sub-mapping function to identify a second sub-index, the target address index including the first sub-index and the second sub-index;

    The storage area includes: a first sub-storage area indicated by the first sub-index, and a second sub-storage area indicated by the second sub-index, and the plurality of storage units include the first sub-storage area and the second sub-storage area A storage unit corresponding to the second sub-storage area.
19. The network device according to any one of claims 11 to 18, wherein the updating unit is further configured to:

    If the flow index and the packet count value in the second storage unit among the plurality of storage units have not been updated beyond a set period of time, then delete the flow index and packet count value stored in the second storage unit.
20. The network device according to any one of claims 11 to 19, characterized in that,

    The target message is any message received by the network device, or the target message is a message to be discarded by the network device.
21. A flow statistics system, characterized in that the flow statistics system comprises: the network device according to any one of claims 11-20, and a control device;

    The network device is configured to report the target flow identifier to the control device based on the updated message count value in the first storage unit;

    The control device is configured to, based on the received target flow identifier, collect statistics on the traffic of the data flow indicated by the target flow identifier.
22. The flow statistics system according to claim 21, wherein,

    The network device is configured to report the target flow identifier to the control device if the updated packet count value in the first storage unit satisfies a statistical condition;

    The control device is configured to increase the traffic statistics value of the data flow indicated by the target flow identifier by a second preset value.
23. The flow statistics system according to claim 21 or 22, wherein the control device is further used for:

    Output the stream IDs of the top K data streams with the highest traffic statistics; or,

    Output the stream identifiers of the top K data streams with the highest change in traffic statistics within a set period of time;

    K is an integer greater than or equal to 1.
24. The flow statistics system according to any one of claims 21-23, wherein the network device is a first chip, and the control device is a second chip.
25. A network device, characterized in that the network device includes: a memory, a processor, and a computer program stored on the memory and capable of running on the processor, and the processor implements the computer program when executing the computer program The method according to any one of claims 1 to 10.
26. A computer-readable storage medium, characterized in that instructions are stored in the computer-readable storage medium, and when the instructions are executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images