Traffic based method and device implementing ipfix detection

Abstract

The invention discloses a traffic based method and device implementing ipfix detection. The method includes identifying to-be-detected traffic according to a first level flow table in a message head field matching chip in traffic; sending identified traffic into a second level flow table in the chip for matching and number statistics and learning matched new traffic into memory of the chip. According to the invention, ipfix is implemented by adopting the method of two level flow meters, so that ipfix has the capability of acting as a detection point based on traffic, the identification degreeof to-be-monitored traffic can be improved and thus excessive consumption of ipfix memory due to non-related traffic is reduced.

Description

technical field [0001] The invention relates to an ipfix detection technology, in particular to a method and device for realizing ipfix detection based on traffic. Background technique [0002] The basic principle of the switch chip to realize IPFIX (IP Flow Information Export, IP data flow information output) is: through the ipfix engine (ipfix engine) to realize the statistics and monitoring of various aspects of the IP data flow, wherein the ipfixengine mainly includes key (hash search to identify flow) and record (to perform relevant statistics on the flow, such as statistics on the number of packets). Every time a new data stream reaches the Ipfix engine, it will be learned into the chip memory, thus occupying a certain memory capacity. [0003] According to the RFC, the current monitoring point of Ipfix is ​​implemented based on the port, such as the statistics of the number of packets for the traffic of a certain port. With the rapid increase of the types of traffic...

AI Technical Summary

Problems solved by technology

With the rapid increase of traffic types, the memory occupied by the statistics of this port traffic will be huge

Images