A whole network traffic monitoring method

Abstract

The invention discloses a method for monitoring flow in the whole network, which comprises the following steps: 1. Select routers and collectors for monitoring flow in the whole network; 2. Obtain m OD flows, extract path information of OD flows, and construct OD flow flow matrix P. At the same time, OD encoding is carried out on the OD flow to form an OD-to-identification mapping table; three: use the OD flow flow matrix, the path information of the OD flow and the resource constraints of the router to calculate the sampling list of different ranges; four: assign the sampling list to Router, and distribute the OD pair identification mapping table at the same time at the entrance router; Five: The router and its collector monitor the data packets according to the OD pair identification mapping table and sampling list, and update the flow data in the flow table of the collector; Six: Collect The controller collects flow data and uploads it to form a monitoring report. In the monitoring method of the present invention, a large amount of redundancy will not be generated between routers, communication between collectors is not required, the network burden is small, the coverage rate of the entire network flow is large, and the processing efficiency is high.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a monitoring method for the entire network flow. Background technique [0002] In the prior art, network traffic monitoring relies on the number of flows at all levels collected on routers, but the monitoring capability of each router is limited, and network operators want to use the best way possible to utilize router monitoring capabilities. However, existing routers operate individually, and each router independently records the traffic it monitors. Not only does this approach not utilize router resources efficiently, but it also increases the network operator's impact on handling redundancy and data ambiguity due to multiple router monitoring. From a single point of view, the monitoring method in the prior art cannot achieve the purpose of directly specifying and realizing the whole network measurement by the network operator. And there is a primitive disconne...

AI Technical Summary

Problems solved by technology

[0003] The existing technology also conducts some improved research on the above-mentioned router sampling, but the current improvement method only focuses on the improvement of the solution of a single router, and is still not suitable for the monitoring of big data in the whole network.

In addition, these improved methods lack the generality of applications (e.g., different flow metrics require specific flow algorithms), and the fact that they do not take advantage of application

However, keeping track of a large number of flows increases router monitoring redundancy (each router tracks the same large set of flows), but does not increase flow coverage

Images