Network flow mirroring system and method based on EtherCAT slave station chip

Abstract

The invention provides a flow mirroring system and method realized by hardware and based on an EtherCAT network, and aims to realize undisturbed replication of network flow. According to the method, link layer data in a standard Ethernet model is shunted, and then different processing flows are respectively executed on the two paths of the link layer data, so that the abnormal flow in the networkis monitored while the normal communication requirement of an industrial control system is met. The method is achieved through hardware, the mirroring efficiency is high, processing resources of network communication equipment are not occupied, and the situation that normal communication of the industrial control network is affected by flow mirroring can be effectively avoided; an EtherCAT networkflow undisturbed interception device can be used as a slave station to be directly accessed to a standard EtherCAT network without changing the topological structure of the standard EtherCAT network;compared with a port mirroring mode based on a switch, the number of used ports is reduced, the bandwidth of mirroring ports is not limited, a flow undisturbed interception device does not need to carry out complex configuration operation, and the complexity of flow replication is simplified.

Description

Technical field [0001] The present invention belongs to the field of industrial control technology, and more particularly to the network flow mirror system and method based on EtherCAT slave chips. Background technique [0002] In the field of industrial control, network communication between controllers and field devices presents strong regularity when system is operating, and network congestion, DOS attack, network scan, abnormal operation, etc., local events, or network routing exceptions. This regularity will be destroyed, which provides a basis for operation through monitoring network traffic judgment system. Therefore, network traffic monitoring and analysis is extremely important to network failure repair and security emergency response. [0003] Flow mirroring is to analyze traffic in the network to a specific destination to perform tasks such as fault location, network detection, abnormal identification. At present, network traffic mirror mainly includes port mirroring, ...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to overcome the deficiencies in the prior art, provide a kind of network traffic mirroring system and method based on EtherCAT slave station chip, utilize the flow of EtherCAT slave station chip Loopback feature, the network traffic is "distributed" at the link layer of the EtherCAT network, one data is transmitted normally through the traffic loopback unit, and the other data is forwarded to the monitoring center through the data packet distribution unit, so as to realize the EtherCAT network traffic. Non-disruptive listening to solve the problems of complex configuration, high resource usage, and poor real-time performance in network traffic replication technologies such as port mirroring

Images