Distinguishing and positioning of mirror traffic

Abstract

The invention relates to distinguishing and positioning of mirror traffic, and belongs to the technical field of network traffic mirroring. A network mirror traffic monitoring system provided by the invention comprises a traffic convergence switch and a mirror traffic analysis device, wherein the traffic convergence switch is configured to perform message packaging on mirror traffic data receivedvia a corresponding access of the traffic convergence switch based on a QinQ technology to form the mirror traffic data with a second message format in which at least one VLAN label is added with respect to a first message format, the VLAN label comprises the identification information corresponding to the access for receiving the mirror traffic data with the first message format. A mirror trafficanalysis device distinguishes and positions the mirror traffic data according to the VLAN label in the mirror traffic data with the second message format.

Description

technical field [0001] The invention belongs to the technical field of network traffic mirroring, and relates to the distinction and positioning of mirrored traffic. Background technique [0002] Mirroring is the process of duplicating monitored traffic and forwarding the duplicated traffic (also referred to as "mirrored traffic") to a monitoring device including, for example, mirrored traffic analysis means. The port of the monitored traffic is the mirroring source port, and the monitoring device runs corresponding traffic monitoring software to monitor the network traffic of each mirroring source port, for example, in real time and visualized. Therefore, mirroring technology is currently a conventional technology for monitoring network traffic. [0003] figure 1 Shown is a schematic structural diagram of a network traffic monitoring system in the prior art. Wherein, the mirror traffic analysis device 130 is used to monitor the network traffic of multiple different produ...

AI Technical Summary

Problems solved by technology

[0004] However, as the production network deploys more and more network traffic mirroring points, the number of data sources becomes larger and larger, and the number of mirrored traffic becomes larger; therefore, relying on the data collection interface of the mirrored traffic analysis device 13 The linear increase to meet the significant increase in the number of mirrored traffic, like this, the data acquisition interface of the mirrored traffic analysis device 13 corresponds to a large increase in the number of data acquisition cards, and the hardware cost increases greatly; or, due to the data acquisition interface of the mirrored traffic analysis device 13 The number is limited, and more mirrored traffic analysis devices 13 need to be set up to analyze more data sources

[0005] And, in the case of figure 1 In the network flow monitoring system shown, since different services may not change the original IP address before and after passing through different devices, if these flows are processed through a data collection interface, it is difficult to mirror the flow 112 on the flow mirror flow analysis device 230 distinguish them, let alone locate them

In this way, it becomes very inconvenient to troubleshoot production network faults and manage network traffic.

Images