Traffic mirroring method and device, electronic equipment, medium and product

Abstract

The invention provides a traffic mirroring method and device, electronic equipment, a medium and a product, and the method comprises the steps: obtaining virtual switch information corresponding to all virtual switches in a virtualization operation system; respectively creating a mirror image port group in a promiscuous mode for each virtual switch in the virtualized operating system according to the virtual switch information; according to the virtual switch information, setting a virtual network card for an IDS virtual machine pre-deployed in a virtualization operation system, and respectively connecting the set virtual network card with a mirror image port group of each virtual switch in the virtualization operation system; and the IDS virtual machine obtains the flow of all service virtual machines in the virtualization operation system through the mirror image port group connected with the virtual network card. The flow mirror image configuration can be completed in the IDS virtual machine network card setting process, manual configuration of each network card is not needed, and a large amount of tedious manual configuration work is reduced.

Description

technical field [0001] The present invention relates to the technical field of data communication monitoring, and in particular, to a traffic mirroring method, device, electronic device, medium and product. Background technique [0002] Traffic mirroring is to copy part or all of the data involved in one or more ports on the device to another port, and judge and analyze whether the network is safe according to the copied data. If malicious traffic is detected, it can be quickly located. corresponding device. [0003] Currently, in the vpshere environment, traffic mirroring is mainly divided into port mirroring and port group promiscuous mode mirroring. Among them, port mirroring (Port Mirroring) is to forward the data traffic of one or more source virtual ports in the virtual machine to a certain destination virtual port through a switch or router, and monitor the source virtual port in real time through the destination virtual port. However, port mirroring only supports d...

AI Technical Summary

Problems solved by technology

However, port mirroring only supports distributed switches, and the implementation of traffic mirroring needs to configure the virtual network card of each virtual machine in advance, so that the virtual machine can communicate with the switch

In the case of too many virtual machines, manual configuration is required one by one, which is too cumbersome and wastes time and energy

[0004] Port group promiscuous mode mirroring supports both distributed switches and standard switches, but there are still too many configuration steps in the interface configuration process, and the overall configuration is relatively cumbersome

Images