East-west network traffic mirroring collection method of cross-host tenants

Abstract

The invention provides an east-west network traffic mirroring collection method of cross-host tenants. The method comprises the following steps: 1) a traffic collection control server generates a traffic collection configuration parameter corresponding to a to-be-collected tenant according to a tenant name of the to-be-collected tenant, as well as network configuration information of the tenant and distribution information of a virtual machine of the tenant on a physical host obtained from a cloud service master control server; 2) the traffic collection control server issues the traffic collection configuration parameter to a traffic collection drive program through a traffic collection Agent of a cloud service host; and 3) the traffic collection drive program performs mirroring on the collected traffic specified by the traffic collection configuration parameter and sends the collected traffic subjected to the mirroring to the traffic collection Agent. By adoption of the method, east-west network traffic of the tenant can be dynamically collected in a Linux kernel drive program layer according to the tenant name, the network configuration information of the tenant and the distribution information of the virtual machine of the tenant on the physical host.

Description

technical field [0001] The invention relates to the security field of communication technology, in particular to a cross-host east-west network traffic mirror collection method. Background technique [0002] With the extensive development of cloud computing services, due to security needs, it is necessary to monitor the east-west network traffic in the cloud, which requires mirroring the east-west network traffic of tenants in the cloud. To complete the mirroring of east-west network traffic, the following functions need to be implemented: [0003] 1) Differentiate the network traffic of tenants; [0004] 2) Effectively mirror the tenant's network traffic and transmit it to the network data analysis center for analysis. [0005] Currently, network traffic mirroring is generally implemented by means of optical splitting or switch mirroring ports. The light splitting refers to cloning the light in the optical fiber through the optical splitter, which is actually to copy the...

AI Technical Summary

Problems solved by technology

Because a tenant's virtual machine may be distributed on multiple physical hosts, and network traffic may involve multiple racks, it is impossible to determine which physical interfaces the tenant's network traffic involves, and it is impossible to mirror all switch ports

Therefore, the above two methods are not applicable to the east-west network traffic of tenants in the cloud

Images