Method and device for detecting data flow

Abstract

An embodiment of the invention discloses a data flow detection method and device and relates to the technical field of communication. A problem that erroneous determination on a maximum flow is caused when different data flows are determined as the same data flow can be solved. The method comprise the following steps: according to identification information of a first data flow going through a router, an index for the first data flow and compression information of the first data flow are obtained; if at least one HT unit comprises a first HT unit, one is added to a message counting value stored in the first HT unit; when the message counting value stored in the first HT unit is greater than a first counting value, a first KT unit is determined in m keyword table KT units in the router; if an index stored in the first KT unit is not an invalid index and the identification information of the first data flow is the same as the identification information stored in the first KT unit, a message counting value of the first data flow is recorded in a counter corresponding to the first KT unit, and a data flow corresponding to a second KT unit is determined as the maximum flow.

Description

technical field [0001] The invention relates to the technical field of communications, in particular to a data flow detection method and device. Background technique [0002] Network traffic detection is a network management method used to implement applications such as traffic accounting, bandwidth planning, and route calculation. Current network traffic detection can be based on data flow, and data flow can be a group of messages with the same attribute passing through a certain sampling point in the network within a specific time, for example, five-tuple attribute (source Internet protocol (English: InternetProtocol) , referred to as: IP address, destination IP address, source port, destination port and protocol number) same message can be defined as the same data flow. Among them, the maximum flow detection is a commonly used network traffic detection method. The maximum flow refers to the data flow on the network link whose number is higher than a certain threshold. ...

AI Technical Summary

Problems solved by technology

[0004] However, there is a problem that in the prior art, a first-level filter algorithm cannot be set for each data flow in the network, but only when the message satisfies the judgment rule of the data flow corresponding to the filter algorithm, it can be considered as The message belongs to the data flow corresponding to the filter algorithm

In this way, due to the inaccurate setting of the judgment rules of the data flow corresponding to the above filter algorithm, different data flows may be judged as the same data flow, which may lead to misjudgment of the maximum flow

Images