Protocol identification method and system in load balanced network environment and equipment

Abstract

The invention discloses a protocol identification method in a load balanced network environment. When a DPI (Deep Packet Inspection) device judges a protocol type of a received data stream, whether unidirectional message identification can be carried out or not is judged; if the unidirectional message identification can be carried out, the protocol identification of the data stream is directly finished through the DPI device; if the unidirectional message identification cannot be carried out, whether the DPI device receives the data stream which is in an opposite direction and has pairable fingerprint information or not is judged, so the protocol identification is finished; if the pairable fingerprint information does not exist in the opposite direction, the fingerprint information of thedata stream is sent to a fingerprint information synchronous identification device, the fingerprint information synchronous identification device finishes the protocol identification and then issues aprotocol identification result to the DPI device. According to the scheme, the hardware cost can be reduced, the networking complexity can be reduced, and the operation and maintenance cost can be reduced.

Description

technical field [0001] The invention belongs to the technical field of communication, and more specifically relates to a protocol identification method, equipment and system in a load balancing network environment. Background technique [0002] Such as figure 1 As shown, in the splitting traffic environment, the uplink and downlink data that often generate the same quintuple are split to different processing devices. For example, there are multiple links between two routers, and the routes of these links have the same Priority (equal-cost routing), the routing devices at both ends usually use load sharing to balance traffic on these multiple physical links. When splitting traffic on these links, the same five The uplink and downlink data of tuples are divided into different devices. When the processing devices belong to two manufacturers, some difficult problems will arise. For example, in the field of protocol identification, some protocols (such as Thunder, BT, eMule and...

AI Technical Summary

Problems solved by technology

However, this approach has its flaws and limitations:

[0004] (1) Increase the cost of hardware. This solution needs to add hardware aggregation and distribution equipment. The purchase of these equipment requires funds. After use, it will occupy the space in the computer room and consume continuous power, etc., which will obviously greatly increase the cost of a project;

[0005] (2) With the rapid expansion of the network scale, the total traffic of the same load domain also expands synchronously. In many scenarios, the total processing capacity of a single convergence and distribution device will be exceeded. At this time, multiple convergence and distribution devices are required to perform complex traffic interaction Forwarding and re-aggregation, the interconnection of such multiple devices will eventually form an extremely complex full mesh topology, which is very difficult to operate, maintain and troubleshoot

The failure of any port may cause the traffic synchronization failure of the entire network, and the troubleshooting work will make the administrator helpless due to the complex traffic direction, so this solution has not been used on a large scale

Images