Data packet sampling statistic method and apparatus

Abstract

The present invention discloses a data package sampling statistics method, wherein, the method comprises the following steps: distill the key words of the received data package to obtain the type of the data package; plus the aforesaid type data package counter value with one and delivery the latest counter value according to the preplaced sample alternation; sampling stat the data package if the counter value delivered result is the system preplaced sample value. The present invention samples the data package by classification, samples each type by bags or by time to make sure that each type of the data package can be chosen, which deoxidizes the true flux distributing circus as far as possible and decreases the sampling distortion degree. The present invention, corresponding to the aforesaid method, also provides a data package sampling statistics device.

Description

technical field [0001] The invention relates to the technical field of communication system flow statistics, in particular to a method and device for sampling and statistics of data packets. Background technique [0002] With the rapid development of the Internet, the scale of the network is unprecedentedly large, and there are more and more various network attacks. Therefore, it is necessary to monitor the distribution of network traffic on network devices, which provides the necessary information for preventing network attacks in a targeted manner. refer to. [0003] In order to count data packets, many technologies based on flow statistics have emerged. For example, these technologies can count the data packets and the number of bytes in a period of time, but these technologies are based on individual statistics for each data packet , will consume a large amount of CPU resources. In addition, due to the limitation of bandwidth resources used for statistics, the data pack...

AI Technical Summary

Problems solved by technology

[0004] For the statistics of traffic distribution, the main focus is on the distribution of data streams, but the above-mentioned sampling and statistical methods are only based on interfaces, which cannot distinguish the traffic distribution of various data packets very well.

For example, usually the concurrent data flow on an interface is very large, hundreds of thousands of data flows exist at the same time, and there are many millions or more at the same time, so it is easy for large flows to overwhelm small flows, resulting in a small amount of data It is difficult to select the data packets, which will lead to a large deviation between the statistics of small flow data packets and the actual data, which cannot well reflect the actual data flow distribution, resulting in sampling distortion

Images