A flow monitoring method and out-of-band controller

Abstract

The embodiment of the present application discloses a traffic monitoring method and an out-of-band controller, which is applied to the out-of-band controller of a computing device, and the method includes: in a first cycle, respectively obtaining unicast messages, multicast messages and broadcast messages, which are received through the management network port of the computing device; in the case of determining that there are abnormal unicast messages in the unicast messages, discarding the abnormal unicast messages; or, in the case of determining that there are abnormal multicast messages and / or broadcast messages in the multicast messages and the broadcast messages, reporting the abnormal traffic of the management network port. The embodiment of the present application can monitor the message traffic of the management network port, can detect malicious network attacks against the management network port in advance, so that isolation processing can be carried out in advance or the problem can be reported in time, thereby avoiding the unavailability of BMC management functions or abnormal BMC management functions.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a flow monitoring method and an out-of-band controller. Background Art

[0002] The server generally includes a baseboard management controller (BMC) management network port, which is mainly used to communicate with the upper-level management software. The BMC management software can be presented in the form of a web program or a desktop application (APP), which can provide various monitoring and management functions so that relevant personnel can easily understand the operating status of the server and remotely control the server.

[0003] Since the bandwidth of the BMC management network port is limited, in actual usage scenarios, if the BMC network port is attacked by malicious network attacks (such as broadcast flooding and multicast flooding attacks), it may cause serious packet loss on the BMC management network port, which may make users unable to log in to the BMC management system or use related management functions provided by the BMC (such as server reset, power on and off, etc.).

[0004] At present, for the above problems, only when the problem occurs (that is, when the user finds that he cannot log in to the BMC management system or cannot use the related management functions provided by the BMC), will the possible causes be analyzed and then corresponding adjustments be made to solve the problem. However, often at this time, the user may be in urgent need of using the related management functions. Therefore, how to detect or solve malicious network attacks against the BMC management network port in advance is a problem that technicians are concerned about. Summary of the invention

[0005] The embodiment of the present application discloses a traffic monitoring method and an out-of-band controller, which can detect malicious network attacks against the BMC management network port in advance, so that isolation processing can be carried out in advance or the problem can be reported in time, thereby avoiding the unavailability of BMC management functions or abnormalities of BMC management functions.

[0006] The first aspect discloses a traffic monitoring method, which can be applied to an out-of-band controller (such as a BMC) of a computing device (such as a server), or to a module (for example, a chip) in an out-of-band controller, or to a logic module or software that can implement all or part of the out-of-band controller function. The following description is given by applying to a BMC as an example. The traffic monitoring method may include: obtaining unicast messages, multicast messages, and broadcast messages within a first cycle; wherein the unicast messages, multicast messages, and broadcast messages are received through a management network port of the computing device; in the case of determining that an abnormal unicast message exists in the unicast message, discarding the abnormal unicast message; or, in the case of determining that an abnormal multicast message and / or broadcast message exists in the multicast message and the broadcast message, reporting the abnormal traffic of the management network port.

[0007] In the embodiment of the present application, the BMC can monitor the message traffic of the management network port, and can detect malicious network attacks against the BMC management network port in advance. Specifically, the BMC can analyze the unicast messages, multicast messages, and broadcast messages received in the first cycle. If there is an abnormality in the traffic of the unicast message (i.e., there are abnormal unicast messages in all unicast messages in the first cycle), isolation processing can be performed in advance, and the abnormal unicast message can be discarded. If there is an abnormality in the traffic of the multicast and / or broadcast messages (i.e., there are abnormal multicast messages and / or broadcast messages in all multicast messages and broadcast messages in the first cycle), the abnormal traffic of the management network port can be reported in time, and relevant personnel can be notified to conduct investigation. In this way, the problem of unavailability of the BMC management function or abnormality of the BMC management function can be avoided.

[0008] As a possible implementation, the method may further include: when it is determined that there is a unicast message in the unicast message whose destination media access control (MAC) address is not the MAC address of the out-of-band controller, determining that there is an abnormal unicast message in the unicast message.

[0009] In an embodiment of the present application, the BMC can determine a unicast message in which the destination MAC address is not the MAC address of the out-of-band controller as an abnormal unicast message. In this way, the abnormal unicast message can be accurately isolated and processed, thereby avoiding the problem of BMC management function being unavailable or BMC management function being abnormal.

[0010] As a possible implementation, before determining that the destination MAC address in the unicast message is not the MAC address of the out-of-band controller, the method may also include: determining that the difference between the data volume of the unicast message in the first cycle and the second standard data volume is greater than a fourth threshold.

[0011] In an embodiment of the present application, the BMC may first determine whether the difference between the data volume of the unicast message within the first cycle and the second standard data volume is greater than a fourth threshold value. If it is determined that it is greater than the fourth threshold value, it may determine whether there is a unicast message in the unicast message whose destination MAC address is not the MAC address of the out-of-band controller. In this way, the processing resources of the BMC may be saved.

[0012] As a possible implementation manner, the method may further include: when it is determined that there is no abnormal unicast message in the unicast message, updating the second standard data volume to the data volume of the unicast message in the first period.

[0013] In an embodiment of the present application, the BMC may update the second standard data volume to the data volume of the unicast messages within the first cycle when it is determined that the difference between the data volume of the unicast messages within the first cycle and the second standard data volume is greater than a fourth threshold value, and there are no abnormal unicast messages in the unicast messages within the first cycle. In this way, a more accurate second standard data volume can be obtained, thereby saving the processing resources of the BMC.

[0014] As a possible implementation, the method may further include: when it is determined that the difference between the maximum bandwidth in the first period and the bandwidth threshold is greater than a sixth threshold, determining that there are abnormal multicast messages and / or broadcast messages in the multicast messages and the broadcast messages.

[0015] In the embodiment of the present application, since the BMC cannot process all messages in time when the difference between the maximum bandwidth in the first cycle and the bandwidth threshold is greater than the sixth threshold, it will cause packet loss at the BMC management network port. Therefore, it can be considered that there are abnormal multicast messages and / or broadcast messages in the multicast message and the broadcast message. After that, the management network port traffic abnormality can be reported in time, and relevant personnel can be notified to investigate, thereby avoiding the problem of BMC management function being unavailable or BMC management function being abnormal.

[0016] As a possible implementation, before determining that the difference between the maximum bandwidth within the first period and the bandwidth threshold is greater than the sixth threshold, the method may also include: determining that the difference between the total data volume of the multicast message and the broadcast message within the first period and the third standard data volume is greater than the fifth threshold.

[0017] In an embodiment of the present application, the BMC may first determine whether the difference between the total data volume of multicast messages and broadcast messages in the first period and the third standard data volume is greater than the fifth threshold. If it is determined that it is greater than the fifth threshold, it may determine whether the difference between the maximum bandwidth in the first period and the bandwidth threshold is greater than the sixth threshold. In this way, the processing resources of the BMC may be saved, and it may be more accurately determined whether there are abnormal multicast messages and / or broadcast messages in the first period.

[0018] As a possible implementation, the method may further include: when it is determined that there are no abnormal multicast messages and broadcast messages in the multicast messages and the broadcast messages, updating the third standard data volume to the total data volume of the multicast messages and the broadcast messages in the first period.

[0019] In an embodiment of the present application, the BMC can update the third standard data volume to the total data volume of the multicast messages and broadcast messages within the first cycle when it is determined that the difference between the total data volume of the multicast messages and broadcast messages within the first cycle and the third standard data volume is greater than the fifth threshold, and there are no abnormal multicast messages and broadcast messages in the multicast messages and broadcast messages within the first cycle. In this way, a more accurate third standard data volume can be obtained, thereby saving the processing resources of the BMC.

[0020] As a possible implementation mode, before determining that there are abnormal unicast messages in the unicast message, or before determining that there are abnormal multicast messages and / or broadcast messages in the multicast message and the broadcast message, the method may also include: determining that the difference between the total data volume of the unicast message, the multicast message and the broadcast message in the first period and the first standard data volume is greater than a first threshold.

[0021] In an embodiment of the present application, the BMC may first determine whether the difference between the total data volume of unicast messages, multicast messages and broadcast messages within the first cycle and the first standard data volume is greater than a first threshold value. If it is greater than the first threshold value, it may determine whether there are abnormal unicast messages in the unicast messages within the first cycle, and determine whether there are abnormal multicast messages and / or broadcast messages in the multicast messages and broadcast messages within the first cycle. In this way, the processing resources of the BMC may be saved.

[0022] As a possible implementation, the method may further include: obtaining multiple maximum bandwidths within the first period; when the difference between the maximum bandwidth within each of the first period and the first standard bandwidth is greater than a second threshold, and when packet loss occurs at the management network port within each of the first period, adding the maximum bandwidth within each of the first period to a bandwidth array to obtain a first bandwidth array; eliminating the second bandwidth value in the first bandwidth array to obtain a second bandwidth array, and the difference between the maximum bandwidth value in the first bandwidth array and the second bandwidth value is greater than a third threshold; determining a first proportion of the minimum bandwidth value in the second bandwidth array as the bandwidth threshold, and the first proportion is greater than 0 and less than 1.

[0023] In an embodiment of the present application, the BMC can save the maximum bandwidth value in each packet loss period into a bandwidth array, and can eliminate the bandwidth values ​​(i.e., the second bandwidth values) that are not caused by excessive packet traffic. Afterwards, the first proportion of the minimum bandwidth value in the remaining bandwidth values ​​in the bandwidth array can be determined as the bandwidth threshold. In this way, a more accurate bandwidth threshold can be obtained, which can facilitate timely reporting of management network port traffic anomalies before the management network port traffic reaches the bandwidth threshold, thereby avoiding the problem of BMC management function being unavailable or BMC management function being abnormal.

[0024] As a possible implementation, the method may further include: when the difference between the maximum bandwidth within the first period and the first standard bandwidth is greater than the second threshold and there is no packet loss at the management network port within the first period, updating the first standard bandwidth to the maximum bandwidth within the first period.

[0025] In an embodiment of the present application, the BMC may update the first standard bandwidth to the maximum bandwidth within the first cycle when it is determined that the difference between the maximum bandwidth within the first cycle and the first standard bandwidth is greater than the second threshold value and no packet loss occurs at the management network port within the first cycle. In this way, a more accurate first standard bandwidth may be obtained, thereby saving the processing resources of the BMC.

[0026] The second aspect discloses an out-of-band controller, which includes a processor, a memory and a communication interface, the communication interface is used to receive information from other electronic devices outside the out-of-band controller, and output information to other electronic devices outside the out-of-band controller, the processor calls the computer program stored in the memory to implement the method as claimed in any one of claims 1-10.

[0027] A third aspect discloses a computing device (such as a server), which includes the out-of-band controller disclosed in the second aspect.

[0028] A fourth aspect discloses a computer-readable storage medium having a computer program or computer instructions stored thereon. When the computer program or computer instructions are executed, the flow monitoring method disclosed in the above aspects is implemented.

[0029] A fifth aspect discloses a chip, including a processor for executing a program stored in a memory. When the program is executed, the chip executes the flow monitoring method disclosed in the above aspects.

[0030] As a possible implementation, the memory is located outside the chip.

[0031] A sixth aspect discloses a computer program product, which includes a computer program code. When the computer program code is run, the flow monitoring method disclosed in the above aspects is executed.

[0032] It can be understood that the out-of-band controller provided in the second aspect, the computing device provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, the chip provided in the fifth aspect, and the computer program product provided in the sixth aspect are all used to execute the flow monitoring method provided in the first aspect of the present application and any possible implementation of the first aspect. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0034] Figure 1 It is a schematic diagram of a system architecture disclosed in an embodiment of the present application;

[0035] Figure 2 It is another system architecture schematic diagram disclosed in the embodiment of the present application;

[0036] Figure 3 It is a flowchart of a solution disclosed in an embodiment of the present application;

[0037] Figure 4 It is a schematic diagram of a process for determining a bandwidth threshold disclosed in an embodiment of the present application;

[0038] Figure 5 It is a flow chart of a flow monitoring method disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The embodiment of the present application discloses a flow monitoring method and an out-of-band controller, which can detect malicious network attacks against the BMC management network port in advance, so that isolation processing can be carried out in advance or problems can be reported in time, thereby avoiding the unavailability of BMC management functions or abnormalities of BMC management functions. The technical solution in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application.

[0040] In order to better understand the embodiments of the present application, the system architecture used in the embodiments of the present application is first described below.

[0041] See also Figure 1 , Figure 1 Schematic diagram of a system architecture disclosed in the embodiment of this application. Figure 1 As shown, the system architecture can be the system architecture of the server 100, and the server 100 may include an out-of-band controller 101. The server 100 may also include a processor 102, a memory 103, etc. The server 100 is an electronic device with data processing capabilities, data receiving and sending capabilities, and data storage capabilities. Among them, the server 100 can be a file server, a database server, a mail server, a web server, a multimedia server, a communication server, a terminal server, an infrastructure server, etc. In some embodiments, the server can be a tower, a rack, a blade, etc. The server 100 may not be limited to using an X86 architecture, a reduced instruction set computer (RISC) architecture, an advanced reduced instruction set machine (ARM) architecture, etc.

[0042] An out-of-band controller is an out-of-band processor independent of the central processing unit (CPU). An out-of-band controller may include a monitoring management unit outside a computer device, a management system in a management chip outside a processor, a computer device baseboard management unit (baseboard management controller, BMC), a system management module (system management mode, SMM), etc.

[0043] The out-of-band controller 101 is mainly used to perform component management and asset management of the server 100, and supports remote management (such as server reset, power on and off, etc.) through the management network port. For example, the out-of-band controller 101 can monitor the status of each hardware device in the server 100 (such as humidity, temperature, voltage, current, etc.), and perform corresponding operations (such as power on and off control, fan speed regulation, etc.) according to the status of these hardware devices according to the preset strategy to ensure that the server 100 is in a healthy state. At the same time, when the out-of-band controller 101 detects that the server 100 is abnormal (such as the CPU temperature is too high), the out-of-band controller 101 can report relevant information (such as the abnormal device, the time of the abnormality, the abnormality description, the handling suggestion, etc.) to the upper management software through the simple network management protocol (SNMP), the simple mail transfer protocol (SMTP), the Redfish protocol, etc., so that relevant personnel can handle it in time to reduce the impact on the business.

[0044] In the embodiment of the present application, the out-of-band controller takes BMC as an example. BMC 101 can monitor the network traffic of the management network port in real time, and analyze the received unicast messages, multicast messages and broadcast messages. If there is an abnormality in the traffic of unicast messages, BMC 101 can isolate the unicast messages whose destination media access control (MAC) address is not the MAC address of BMC. If there is an abnormality in the traffic of multicast and broadcast messages, BMC 101 can report the abnormality of the management network port traffic to the upper-level management software and notify relevant personnel to investigate. In this way, malicious network attacks against the BMC management network port can be discovered in advance, so that isolation processing or reporting of problems can be carried out in advance, thereby avoiding the unavailability of BMC management functions or abnormalities of BMC management functions. For the structure of BMC 101, please refer to the following Figure 2 The specific implementation of BMC 101 monitoring network traffic can be found in the following Figure 5 The method embodiment shown will not be described in detail here.

[0045] It is understandable that the BMC 101 may be a chip integrated on the mainboard of the server 100 .

[0046] The processor 102 may be a general purpose processor, a microprocessor, an application specific integrated circuit, a field programmable gate array, or any combination thereof. In some embodiments, the processor may be a central processing unit (CPU).

[0047] The memory 103 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or portable read-only memory (CD-ROM), etc. In some embodiments, the memory may be a solid state drive or a mechanical hard disk.

[0048] It should be understood that the server 100 is not limited to only including Figure 1 In addition to the BMC 101, processor 102 and memory 103 shown in the figure, the server 100 may also include a basic input output system (BIOS), memory, network card, power supply, etc. The BIOS stores basic input output programs, including a self-check program after power-on and a system self-starting program, and can provide the lowest-level and most direct hardware setting and control for the server 100.

[0049] It should be noted that Figure 1 The system architecture shown is only an example and does not constitute a limitation. Figure 1 The system architecture shown may include more or fewer devices than shown, and is not limited to only Figure 1 The BMC 101, processor 102 and memory 103 shown in FIG.

[0050] See also Figure 2 , Figure 2 Schematic diagram of another system architecture disclosed in the embodiment of the present application. Figure 2 As shown, the system architecture may be the system architecture of the above-mentioned BMC 101, and the BMC 101 may include a processor 1011, a communication interface 1012, and a memory 1013. The processor 1011, the communication interface 1012, and the memory 1013 may be coupled to each other.

[0051] The memory 1013 is used to store computer programs (instructions) of the BMC 101, such as the operating system (OS) of the BMC 101. In addition, the memory 1013 can also store network traffic monitoring and analysis programs for the BMC management network port, etc. The processor 1011 can read the programs stored in the memory 1013 and execute the following Figure 4 and Figure 5The operations performed by the BMC in the method embodiment shown can be referred to the following related descriptions, which will not be repeated here. The memory 1013 may include but is not limited to random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM) or portable read only memory (CD-ROM).

[0052] The processor 1011 may be a CPU, a graphics processing unit (GPU), a complex programmable logic device, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. The processor may also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.

[0053] The communication interface 1012 is used to receive information from other electronic devices outside the BMC 101 , and output information to other electronic devices outside the BMC 101 .

[0054] It should be understood that the BMC 101 may use an embedded system, such as a Linux system, etc. The BMC 101 may adopt a layered architecture, which may include but is not limited to an application layer, a system layer, a driver layer, and a hardware layer, etc.

[0055] It should be noted that Figure 2 The BMC 101 shown is only one implementation of the embodiment of the present application. In practical applications, the BMC 101 may also include more or fewer components, which is not limited here.

[0056] In order to better understand the embodiments of the present application, the relevant terms and related technologies of the embodiments of the present application are described below.

[0057] Bandwidth (i.e. network bandwidth) refers to the amount of data that can be transmitted or received within a unit of time (generally 1 second). The unit of bandwidth can be bit / second (bit / s), which can also be written as bps (bit per second).

[0058] Unicast is a one-to-one communication method that can include a sender and a receiver. In computer network transmission, the unicast communication message usually includes the address of the receiver (such as the receiver's Internet Protocol (IP) address, MAC address).

[0059] Multicast is a one-to-many communication method that can include one sender and multiple receivers. In computer network transmission, a multicast communication message usually includes a multicast address, which generally corresponds to multiple receivers.

[0060] Broadcasting is a way to send information to all devices in a broadcast domain. Broadcasting can send a data packet to every host in a broadcast domain, regardless of whether these hosts want to receive the data packet.

[0061] It is understandable that the server generally includes at least one BMC management network port and one business network port, and the BMC management network port is mainly used to communicate with the upper-level management software (i.e., BMC out-of-band management software or management system). The BMC out-of-band management software can be presented in the form of a web program or a desktop application (application, APP), and can provide various monitoring and management functions so that relevant personnel can easily understand the operating status of the server and remotely control the server. It should be understood that the business network port can also be called a shared network port. In some embodiments, the BMC management network port and the business network port of the server can be the same network port.

[0062] Since the bandwidth of the BMC management network port is limited, in actual usage scenarios, if the BMC network port is attacked by malicious network attacks (such as broadcast flooding and multicast flooding attacks), it may cause serious packet loss on the BMC management network port, which may make users unable to log in to the BMC management system or use the related management functions provided by the BMC (such as server reset, power on and off, etc.). When a problem occurs, the relevant personnel need to check the possible factors such as the server's BMC and switch in turn, analyze the possible causes of the problem, and then make corresponding adjustments to observe whether the problem is solved. If not, it is necessary to continue to locate the possible causes of the problem, make adjustments, and then continue to observe whether the problem is solved.

[0063] Specifically, see Figure 3 , Figure 3 Schematic diagram of a solution disclosed in the embodiment of this application. Figure 3As shown in the figure, the whole solution can include three steps: problem identification, problem analysis and problem solving. First, when the user finds that the ping test packet is lost, the BMC management system cannot be logged in, or the BMC management function is abnormal, it can be determined that a related problem has occurred (such as a malicious network attack on the BMC management network port). After that, the relevant personnel can analyze the possible causes of the problem step by step and make corresponding adjustments. For example, you can first capture packets on the switch in the computer room and analyze the captured messages. At this time, you can compare the current message volume with the normal message volume to determine whether the current message volume is too large. If the current message volume is too large, you can analyze different types of messages (i.e., unicast, multicast and broadcast messages) respectively. When abnormal unicast, multicast or broadcast messages are analyzed, you can isolate the abnormal messages on the switch, or modify the server networking configuration, and then observe whether the problem is solved. If the problem is not solved or the current message volume is normal, you can continue to perform regular troubleshooting, troubleshoot or cross-verify the hardware equipment, etc. If you find that the hardware equipment is abnormal, you can first solve the abnormal problem of the hardware equipment, and then continue to observe whether the problem is solved. If the problem is not solved or the hardware device is not abnormal, you can continue to check the switch, confirm whether the BMC message is sent normally and whether the switch VLAN (virtual local area network) setting is correct. If it is determined that there is a problem on the switch side, you can modify the switch configuration and then continue to observe whether the problem is solved. If the problem is not solved or there is no problem on the switch side, you can continue to check other possible causes of the problem and make adjustments until the problem is solved.

[0064] It can be seen that in the above process, only when the problem occurs (that is, when the user finds that he cannot log in to the BMC management system or cannot use the relevant management functions provided by the BMC), will the possible causes be analyzed for the problem, and then corresponding adjustments will be made to solve the problem, which takes a long time. In addition, if the above problem is caused by server networking problems or malicious network attacks, the user perception is poor and may think that it is a quality problem of the server product. At the same time, for the problem of packet loss on the BMC management network port caused by malicious network attacks, it is generally necessary to capture and analyze the packet on the switch in the computer room, but most computer rooms are relatively remote, and packet capture is not very convenient, and it will increase the time for problem handling. In addition, in some cases, users may urgently need to control the server through the BMC management software, for example, to update the firmware of the solid-state hard disk in the server to solve the problem that the solid-state hard disk cannot read and write data correctly.

[0065] In order to solve the above problems, the embodiment of the present application proposes a traffic monitoring method, which includes: monitoring the message traffic of the management network port, analyzing the received unicast messages, multicast messages and broadcast messages, if the traffic of the unicast messages is abnormal, the unicast messages whose destination MAC address is not the MAC address of the BMC can be isolated, if the traffic of the multicast and broadcast messages is abnormal, the BMC 101 can report the abnormal traffic of the management network port to the upper-level management software, and notify the relevant personnel to conduct investigation. Through the above method, malicious network attacks against the BMC management network port can be discovered in advance, so that isolation processing or problem reporting can be carried out in advance, thereby avoiding the unavailability of the BMC management function or the abnormality of the BMC management function.

[0066] It is understandable that the BMC management network port generally has a rated maximum bandwidth (i.e., the bandwidth announced by the BMC chip manufacturer). However, in the actual working process, since the BMC needs to perform tasks such as server hardware management and monitoring in addition to processing messages, the BMC's computing resources or processing resources cannot be fully used for message processing, resulting in the BMC management network port not being able to reach the rated maximum bandwidth. For example, the rated bandwidth of the BMC management network port may be 1Gbps, but in the actual working process, since the BMC also needs to handle other management and monitoring tasks, the BMC management network port can actually reach a maximum of 200Mbps, that is, it can only handle 200Mbps of message traffic. When the traffic of the management network port is greater than 200Mbps, the BMC may not be able to process all messages in time, and packet loss may occur, which may cause users to be unable to log in to the BMC management system or users to be unable to use the related management functions provided by the BMC.

[0067] In an embodiment of the present application, the BMC can monitor the traffic and packet loss of the BMC management network port, count the maximum bandwidth during the packet loss period, and then filter the maximum bandwidths collected during these different packet loss periods to remove the maximum bandwidths that are not caused by excessive data volume. After that, a certain proportion of the smallest bandwidth in the filtered bandwidth can be determined as the bandwidth threshold, such as 90%, 85% or 80% of the minimum bandwidth. This bandwidth threshold can be used as the maximum bandwidth that the BMC management network port can actually reach. Based on this bandwidth threshold, the BMC can report the management network port traffic anomaly to the upper-level management software in advance before the management network port traffic reaches the bandwidth threshold, and notify relevant personnel to conduct investigations, thereby avoiding the unavailability of the BMC management function or the abnormality of the BMC management function.

[0068] The following describes the process of determining the bandwidth threshold. Figure 4 , Figure 4 is a schematic diagram of a flow chart of determining a bandwidth threshold value disclosed in an embodiment of the present application. Figure 4As shown, the method for determining the bandwidth threshold may include but is not limited to the following steps:

[0069] 401. The BMC obtains the received messages according to the collection period, and counts the maximum bandwidth and the total message data volume in the current collection period.

[0070] Specifically, the BMC can continuously collect messages received by the BMC management network port, and count the messages received by the BMC management network port in units of a fixed collection period to obtain the maximum bandwidth and total message data volume in the current collection period (i.e., the first period). In some embodiments, the collection period can be 3 minutes, 5 minutes, 10 minutes, etc. The collection period can also be obtained through testing according to actual conditions, or set according to the rated maximum bandwidth of the management network port, which is not limited here.

[0071] It should be understood that the messages received by the BMC management network port may include unicast messages, multicast messages, and broadcast messages.

[0072] In order to better understand the embodiments of the present application, the following is an example of a collection cycle of 5 minutes. When the collection cycle is 5 minutes, the BMC can continuously collect messages received within 5 minutes from the initial collection time. During the continuous collection process, the BMC can determine the maximum bandwidth within these 5 minutes. For example, if the bandwidth at the 2nd minute and 20 seconds within these 5 minutes is 150Mbit / s, which is greater than the bandwidth at any other time within these 5 minutes, then the BMC can determine 150Mbit / s as the maximum bandwidth within the current 5 minutes. And, at the end of these 5 minutes, the BMC can count the total amount of message data received within the current 5 minutes. After that, the BMC can continue to count the maximum bandwidth and total message data within the next five minutes. It can be understood that in each collection cycle, the BMC can repeat step 401. The above-mentioned initial collection time can be the time when the BMC is powered on or the server is powered on.

[0073] 402. The BMC determines whether the difference between the total message data volume in the current collection cycle and the first standard data volume is greater than a first threshold. If it is determined to be greater than the first threshold, step 403 is executed; if it is determined to be less than or equal to the first threshold, step 401 is executed.

[0074] Specifically, the first standard data volume can be the maximum total message data volume that the management network port can reach in a collection cycle under normal circumstances (i.e., when the management network port is not attacked). Therefore, if the BMC determines that the difference between the total message data volume in the current collection cycle and the first standard data volume is less than or equal to the first threshold, it can be considered that the difference between the maximum bandwidth in the current collection cycle and the first standard bandwidth is also less than or equal to the second threshold. Therefore, the BMC does not need to execute step 403, and can directly wait for the next collection cycle, and count the maximum bandwidth and total message data volume in the next collection cycle, that is, execute step 401. If the BMC determines that the difference between the total message data volume in the current collection cycle and the first standard data volume is greater than the first threshold, it is impossible to determine whether the difference between the maximum bandwidth in the current collection cycle and the first standard bandwidth is less than or equal to the second threshold. Therefore, the BMC can execute step 403.

[0075] It is understandable that a reasonable initial value can be set for the first standard data volume first, and then the value of the first standard data volume can be updated according to the actual situation (i.e., updated when a specific condition is met in each acquisition cycle), and as the number of updates increases, the first standard data volume will approach the maximum total message data volume that the BMC management network port can reach in a collection cycle under normal circumstances. The initial value of the first standard data volume can be set according to the rated maximum bandwidth of the BMC management network port. In some embodiments, the initial value of the first standard data volume can be set to the total message data volume of the first collection cycle.

[0076] The first threshold is an integer greater than 0 and can be set according to actual conditions. In some embodiments, the first threshold can be set to 3-5 megabytes (MB). It can be understood that the smaller the first threshold is set, the easier it is to meet the difference between the total message data volume and the first standard data volume in one acquisition cycle, which can make the update of the bandwidth threshold and the first standard bandwidth more refined. Conversely, the larger the first threshold is set, the less likely it is to meet the difference between the total message data volume and the first standard data volume in one acquisition cycle, which can save BMC processing resources.

[0077] In some embodiments, the BMC may not perform step 402, but directly perform step 403. Accordingly, in step 401, the BMC may not count the total amount of message data in the current collection period, but only needs to count the maximum bandwidth in the current collection period.

[0078] 403. The BMC determines whether the difference between the maximum bandwidth in the current acquisition period and the first standard bandwidth is greater than the second threshold. If it is determined to be greater than the second threshold, step 404 is executed; if it is determined to be less than or equal to the second threshold, step 401 is executed.

[0079] Specifically, the first standard bandwidth may be the maximum bandwidth at which the BMC management network port will not generate packet loss. Therefore, if the BMC determines that the difference between the maximum bandwidth in the current collection cycle and the first standard bandwidth is less than or equal to the second threshold, it can be considered that there will be no packet loss at the BMC management network port in the current collection cycle, and the first standard bandwidth does not need to be updated at this time. Accordingly, the BMC does not need to execute step 404, and can directly wait for the next collection cycle, and count the maximum bandwidth and the total amount of message data in the next collection cycle, that is, execute step 401. If the BMC determines that the difference between the maximum bandwidth in the current collection cycle and the first standard bandwidth is greater than the second threshold, it can be determined that there may be packet loss at the BMC management network port in the current collection cycle, and therefore, the BMC can execute step 404.

[0080] It is understandable that the first standard bandwidth can be set to a reasonable initial value first, and then the value of the first standard bandwidth can be updated according to actual conditions (i.e., updated when specific conditions are met in each acquisition cycle), and as the number of updates increases, the first standard bandwidth will approach the maximum bandwidth under normal circumstances where the BMC management network port will not cause packet loss. The initial value of the first standard bandwidth can be set according to the rated maximum bandwidth of the BMC management network port.

[0081] The second threshold is an integer greater than 0 and can be set according to actual conditions. In some embodiments, the second threshold can be set to 3-5Mbps. It can be understood that the smaller the second threshold is set, the easier it is to meet the difference between the maximum bandwidth and the first standard bandwidth is greater than the second threshold in one acquisition cycle, which can make the update of the bandwidth threshold and the first standard bandwidth more refined. Conversely, the larger the second threshold is set, the less likely it is to meet the difference between the maximum bandwidth and the first standard bandwidth is greater than the second threshold in one acquisition cycle, which can save BMC processing resources.

[0082] 404. The BMC determines whether packet loss occurs in the current collection cycle. If packet loss does not occur, step 405 is executed. If packet loss does not occur, step 406 is executed.

[0083] Specifically, the BMC can determine whether packet loss occurs at the BMC management network port in the current collection cycle through the network card. If packet loss does not occur, it indicates that the BMC can process message traffic that is less than or equal to the maximum bandwidth in the current collection cycle, and the BMC can execute step 405. If packet loss occurs, it indicates that the BMC cannot process message traffic that is greater than or equal to the maximum bandwidth in the current collection cycle, and the BMC can execute step 406.

[0084] 405. The BMC updates the first standard bandwidth to the maximum bandwidth in the current collection period.

[0085] Since the first standard bandwidth may be the maximum bandwidth of the BMC management network port without causing packet loss, when the BMC determines that no packet loss occurs in the current collection cycle, the first standard bandwidth may be updated to the maximum bandwidth in the current collection cycle.

[0086] 406. The BMC adds the maximum bandwidth in the current collection period to the bandwidth array.

[0087] When the BMC determines that packet loss occurs on the BMC management network port in the current collection period, the maximum bandwidth in the current collection period is added to the bandwidth array.

[0088] 407. The BMC determines whether the number of packet losses is greater than N. If it is greater than N, execute step 408; if it is less than or equal to N, execute step 401.

[0089] Since the reason for packet loss at the BMC management network port may not be due to excessive message traffic, but may be due to reasons such as the inability to identify messages, the BMC needs to eliminate the bandwidth in the bandwidth array that is not caused by excessive message traffic. In an embodiment of the present application, the method for eliminating the bandwidth that is not caused by excessive message traffic is: compare the maximum value in the bandwidth array with other bandwidth values. If the difference between the maximum value and a certain bandwidth value is greater than the third threshold, it can be determined that the bandwidth value is not the bandwidth that causes packet loss due to excessive message traffic, and it can be deleted from the bandwidth array. See step 410 below. It can be seen that if there is only one value in the bandwidth array, it cannot be screened, and at least two values ​​are required to screen and eliminate the bandwidth values ​​that do not meet the requirements. Therefore, N can be an integer greater than or equal to 2, for example, N can be 5. The above-mentioned third threshold can be set according to actual conditions and is not limited here. In one embodiment, the third threshold can be 10Mbps.

[0090] Specifically, the BMC can record whether the BMC management network port has packet loss in each collection cycle. If packet loss has occurred in N collection cycles before the current collection cycle, it can be determined that the number of packet losses is greater than N, and step 408 can be executed. Otherwise, it can be determined that the number of packet losses is less than or equal to N, and the next collection cycle can be directly waited for to count the maximum bandwidth and total message data volume in the next collection cycle, that is, step 401 is executed.

[0091] 408. The BMC determines whether there is M-bit data in the bandwidth array. If there is M-bit data, execute step 409; if there is no M-bit data, execute step 410.

[0092] As more and more acquisition cycles are experienced, the data in the bandwidth array will also increase. Therefore, in order to avoid too much data stored in the bandwidth array and occupy too much storage space, the BMC can set a storage upper limit for the bandwidth array. When the data stored in the bandwidth array exceeds the storage upper limit (that is, when the data in the bandwidth array is greater than M-1 bits), the intermediate value in the bandwidth array can be deleted, that is, step 409 is executed. When the amount of data stored in the bandwidth array does not exceed the storage upper limit, step 410 can be executed. The above M can be an integer greater than or equal to 3, for example, N can be 5. In some embodiments, M can be greater than N.

[0093] 409.BMC deletes the middle value in the bandwidth array.

[0094] Specifically, when M bits of data are stored in the bandwidth array, the BMC can delete the intermediate values ​​in the bandwidth array. For example, assuming that M is 5 and the values ​​in the bandwidth array are (13, 17, 19, 20, 21), the intermediate value 19 can be deleted, and then the bandwidth array remains (13, 17, 20, 21). For another example, assuming that M is 4 and the values ​​in the bandwidth array are (13, 17, 19, 21), either the intermediate value 17 or 19 can be deleted, and then the bandwidth array remains (13, 19, 21) or (13, 17, 21).

[0095] 410. The BMC calculates the difference between the maximum value in the bandwidth array and other bandwidth values, and deletes the bandwidth values ​​whose difference is greater than the third threshold.

[0096] The BMC needs to remove the bandwidth in the bandwidth array that is not caused by excessive message traffic and causes packet loss. Therefore, the BMC can calculate the difference between the maximum value in the bandwidth array and other bandwidth values, and then determine the bandwidth value (i.e., the second bandwidth value) whose difference is greater than the third threshold as the bandwidth value that is not caused by excessive message traffic and delete these bandwidth values ​​from the bandwidth array. After that, the BMC can determine the bandwidth threshold based on the remaining bandwidth values. At this time, the bandwidth array after screening can be called the second bandwidth array.

[0097] In some embodiments, after the BMC executes step 407, it may not execute steps 408 and 409, but directly execute step 410, and only eliminate the bandwidth in the bandwidth array that does not cause packet loss due to excessive message traffic in step 410.

[0098] 411. The BMC determines a certain proportion of the minimum bandwidth value in the bandwidth array as the bandwidth threshold.

[0099] After the BMC screens the bandwidth values ​​in the bandwidth array, a certain proportion (i.e., a first proportion) of the minimum bandwidth value in the bandwidth array can be determined as the bandwidth threshold. The first proportion is greater than 0 and less than 1, and can be artificially specified, for example, it can be 90%, 85% or 80%, etc., which is not limited here. It should be understood that the first standard data volume and bandwidth threshold can be different for different acquisition cycles.

[0100] It should be noted that, in some embodiments, the BMC may also determine the first standard bandwidth or a certain percentage of the first standard bandwidth as the bandwidth threshold. Therefore, in some embodiments, the BMC may not perform the above steps 406-411.

[0101] Through the above processing flow, BMC can obtain the bandwidth threshold. Based on this bandwidth threshold, BMC can perform traffic monitoring, and then report the abnormal management network port traffic to the upper-level BMC management system in advance before the management network port traffic reaches the bandwidth threshold. In addition, while monitoring the traffic, BMC can also extract the destination MAC address in the message header of the unicast message, so as to isolate those unicast messages whose destination MAC address is not the MAC address of BMC, thereby avoiding abnormal BMC management functions.

[0102] Based on the above system architecture, please refer to Figure 5 , Figure 5 Schematic diagram of a flow monitoring method disclosed in the embodiment of the present application. Figure 5 As shown, the flow monitoring method may include but is not limited to the following steps:

[0103] 501. The BMC obtains received messages according to the collection period, and counts the maximum bandwidth, the data volume of unicast messages, the data volume of broadcast messages, and the data volume of multicast messages in the current collection period.

[0104] Specifically, the BMC can continuously collect messages received by the BMC management network port, and count the messages received by the BMC management network port in units of a fixed collection period to obtain the maximum bandwidth in the current collection period. In addition, the BMC can classify the received messages to obtain the data volume of unicast messages, the data volume of broadcast messages, the data volume of multicast messages, and the total data volume of messages in the current collection period. For unicast messages, the BMC can extract the destination MAC address in the message header. The description of the collection period can refer to the relevant description of step 401 above. It should be understood that the collection period size in step 401 and step 501 can be different, for example, it can be 3 minutes in step 401 and 5 minutes in step 501, which is not limited here.

[0105] It should be understood that the above unicast message, multicast message, and broadcast message can be an Ethernet message, and the Ethernet message header includes a destination MAC address. It should also be understood that in each collection cycle, the BMC can repeat step 501. The above initial collection time can be the time when the BMC is powered on or the server is powered on.

[0106] 502. The BMC determines whether the difference between the total data volume of unicast messages, multicast messages and broadcast messages in the current collection period and the first standard data volume is greater than a first threshold. If it is determined that the difference is greater than the first threshold, step 503 and step 507 are executed; if it is determined that the difference is less than or equal to the first threshold, step 501 is executed.

[0107] Specifically, the first standard data volume can be the maximum total message data volume that the management network port can reach in a collection cycle under normal circumstances (i.e., when the management network port is not attacked). Therefore, if the BMC determines that the difference between the total message data volume (i.e., the sum of the data volume of unicast messages, multicast messages, and broadcast messages) in the current collection cycle and the first standard data volume is less than or equal to the first threshold, it can be considered that there is no malicious network attack in the current collection cycle, and the BMC management function will not be abnormal. Therefore, the BMC can directly wait for the next collection cycle, and count the maximum bandwidth, the data volume of unicast messages, the data volume of broadcast messages, and the data volume of multicast messages in the next collection cycle, that is, execute step 501. If the BMC determines that the difference between the total message data volume in the current collection cycle and the first standard data volume is greater than the first threshold, it is impossible to determine whether there is a malicious network attack in the current collection cycle, so the BMC can execute steps 503 and 507. The relevant description of the first standard data volume and the first threshold can refer to the relevant description of the above step 401.

[0108] In some embodiments, the BMC may not execute step 502, and directly execute step 503 and step 507 after step 501. It should be understood that the branch corresponding to step 503 and the branch corresponding to step 507 may be executed in parallel or in series, that is, step 503, 504, 505 or 506 may be executed first, and then step 507, 508, 509 or 510 may be executed, or step 507, 508, 509 or 510 may be executed first, and then step 503, 504, 505 or 506 may be executed.

[0109] 503. The BMC determines whether the difference between the data volume of the unicast message and the second standard data volume is greater than a fourth threshold. If it is not greater than the fourth threshold, the BMC executes step 501; if it is greater than the fourth threshold, the BMC executes step 504.

[0110] Specifically, the second standard data volume can be the maximum total unicast message data volume that the management network port can reach in a collection cycle under normal circumstances. Therefore, if the BMC determines that the difference between the data volume of unicast messages in the current collection cycle and the second standard data volume is less than or equal to the fourth threshold, it can be determined that the data volume of unicast messages in the current collection cycle is within a normal range, and there are no abnormal unicast messages, which will not cause abnormal BMC management functions. Therefore, the BMC can directly wait for the next collection cycle, and count the maximum bandwidth, the data volume of unicast messages, the data volume of broadcast messages, and the data volume of multicast messages in the next collection cycle, that is, execute step 501. If the BMC determines that the difference between the data volume of unicast messages in the current collection cycle and the second standard data volume is greater than the fourth threshold, it is impossible to determine whether there are abnormal unicast messages in the current collection cycle, so the BMC can execute step 504.

[0111] It is understandable that a reasonable initial value can be set for the second standard data volume first, and then the value of the second standard data volume can be updated according to the actual situation (i.e., updated when each acquisition cycle meets specific conditions), and, as the number of updates increases, the second standard data volume will approach the maximum unicast message data volume that the management network port can reach in one acquisition cycle under normal circumstances. The initial value of the second standard data volume can be set according to the rated maximum bandwidth of the BMC management network port. In some embodiments, the initial value of the second standard data volume can be set to the unicast message data volume of the first acquisition cycle.

[0112] The fourth threshold is an integer greater than 0 and can be set according to actual conditions. In some embodiments, the fourth threshold can be set to 3-5 megabytes (MB). It can be understood that the smaller the fourth threshold is set, the easier it is to meet the difference between the data volume of the unicast message and the second standard data volume in one acquisition cycle is greater than the fourth threshold, which can make the update of the second standard data volume more refined. Conversely, the larger the fourth threshold is set, the less likely it is to meet the difference between the data volume of the unicast message and the second standard data volume is greater than the fourth threshold in one acquisition cycle, which can save BMC processing resources.

[0113] 504. The BMC determines whether the destination MAC address of all unicast messages in the current collection period is the MAC address of the BMC. If the destination MAC address of all unicast messages is the MAC address of the BMC, step 505 is executed. If not the destination MAC address of all unicast messages is the MAC address of the BMC, step 506 is executed.

[0114] Specifically, when the destination MAC address of the unicast message is not the MAC address of the BMC, the BMC can determine that the unicast message is an abnormal unicast message (i.e., an attack message). Therefore, the BMC can determine whether there are abnormal unicast messages in the current collection period through the destination MAC addresses of all unicast messages in the current collection period. When the destination MAC addresses of all unicast messages are the MAC address of the BMC, it can be determined that there are no abnormal unicast messages in the current collection period, and step 505 can be executed. Otherwise, it can be determined that there are abnormal unicast messages in the current collection period, and step 506 can be executed.

[0115] In some embodiments, the BMC may also determine whether a unicast message is an abnormal unicast message by the IP address of the BMC. If the destination IP address of the unicast message is the IP address of the BMC, it can be determined that the unicast message is a normal unicast message, and if the destination IP address of the unicast message is not the IP address of the BMC, it can be determined that the unicast message is an abnormal unicast message.

[0116] 505. The BMC updates the second standard data volume to the data volume of the unicast message in the current collection period.

[0117] When the BMC determines that there is no abnormal unicast message in the current collection cycle, since the data volume of the unicast messages in the current collection cycle is greater than the second standard data volume, the BMC can update the second standard data volume to the data volume of the unicast messages in the current collection cycle, which facilitates the processing of subsequent collection cycles.

[0118] 506. BMC isolates unicast messages whose destination MAC address is not the BMC's MAC address.

[0119] When the BMC determines that there are abnormal unicast messages in the current collection period, since the BMC does not need to process these abnormal messages, the BMC can isolate (ie, discard) the unicast messages in which the destination MAC address is not the MAC address of the BMC.

[0120] In addition, since the current collection cycle also includes unicast messages whose destination MAC address is the MAC address of the BMC, and the data volume of these normal messages may be large, in some embodiments, the BMC can further determine whether the data volume of the unicast messages whose destination MAC address is the MAC address of the BMC is greater than the second standard data volume. If it is greater than the second standard data volume, the second standard data volume is updated to the total data volume of the unicast messages whose destination MAC address is the MAC address of the BMC. If it is less than or equal to the second standard data volume, no processing is performed.

[0121] 507. The BMC determines whether the difference between the total data volume of multicast messages and broadcast messages in the current collection period and the third standard data volume is greater than the fifth threshold. If it is not greater than the fifth threshold, step 501 is executed; if it is greater than the fifth threshold, step 508 is executed.

[0122] Specifically, the third standard data volume can be the maximum total data volume of multicast messages and broadcast messages that can be reached by the management network port in a collection cycle under normal circumstances. Therefore, if the BMC determines that the difference between the total data volume of multicast messages and broadcast messages in the current collection cycle and the third standard data volume is less than or equal to the fifth threshold, it can be determined that the total data volume of multicast messages and broadcast messages in the current collection cycle is within a normal range, and there are no abnormal multicast messages and broadcast messages, which will not cause abnormal BMC management functions. Therefore, the BMC can directly wait for the next collection cycle, and count the maximum bandwidth, the data volume of unicast messages, the data volume of broadcast messages, and the data volume of multicast messages in the next collection cycle, that is, execute step 501. If the BMC determines that the difference between the total data volume of multicast messages and broadcast messages in the current collection cycle and the third standard data volume is greater than the fifth threshold, it is impossible to determine whether there are abnormal multicast messages and abnormal broadcast messages in the current collection cycle, so the BMC can execute step 508.

[0123] It is understandable that the third standard data volume can be set to a reasonable initial value first, and then the value of the third standard data volume can be updated according to the actual situation (that is, updated when each acquisition cycle meets specific conditions), and as the number of updates increases, the third standard data volume will approach the maximum total data volume of multicast messages and broadcast messages that can be reached by the management network port in a collection cycle under normal circumstances. The initial value of the third standard data volume can be set according to the rated maximum bandwidth of the BMC management network port. In some embodiments, the initial value of the third standard data volume can be set to the total data volume of multicast messages and broadcast messages in the first collection cycle.

[0124] The fifth threshold is an integer greater than 0 and can be set according to actual conditions. In some embodiments, the fifth threshold can be set to 3-5 megabytes (MB). It can be understood that the smaller the fifth threshold is set, the easier it is to meet the difference between the total data volume of multicast messages and broadcast messages and the third standard data volume in one collection cycle is greater than the fifth threshold, which can make the update of the third standard data volume and the management network port flooding alarm more refined. Conversely, the larger the fifth threshold is set, the less likely it is to meet the difference between the total data volume of multicast messages and broadcast messages and the third standard data volume is greater than the fifth threshold in one collection cycle, which can save BMC processing resources.

[0125] It should be understood that the first standard data volume can be larger than the second standard data volume and the third standard data volume, respectively. Moreover, the sizes of the first standard data volume, the second standard data volume and the third standard data volume can be different when the acquisition period is different. The larger the acquisition period, the larger the first standard data volume, the second standard data volume and the third standard data volume, and the smaller the acquisition period, the smaller the first standard data volume, the second standard data volume and the third standard data volume.

[0126] 508. The BMC determines whether the difference between the maximum bandwidth in the current collection period and the bandwidth threshold is greater than the sixth threshold. If it is greater than the sixth threshold, step 509 is executed; if it is not greater than the sixth threshold, step 510 is executed.

[0127] Since the BMC cannot directly filter out abnormal multicast and broadcast messages, the BMC can only determine whether the current message traffic will cause abnormal BMC management functions based on the bandwidth threshold, thereby providing timely alarms.

[0128] Specifically, when the BMC determines that the difference between the maximum bandwidth in the current collection cycle and the bandwidth threshold is less than or equal to the sixth threshold, the BMC can determine that all messages can be processed at this time, and no packet loss will be caused at the BMC management network port. Therefore, it can be considered that there are no abnormal multicast messages and broadcast messages in the current collection cycle, and step 510 can be executed. When the BMC determines that the difference between the maximum bandwidth in the current collection cycle and the bandwidth threshold is greater than the sixth threshold, the BMC can determine that all messages cannot be processed in time at this time, which will cause packet loss at the BMC management network port. Therefore, it can be considered that there are abnormal multicast messages or abnormal broadcast messages (i.e., attack messages) in the current collection cycle, or it can be considered that there are abnormal multicast messages and abnormal broadcast messages at the same time, and step 509 can be executed.

[0129] The sixth threshold is an integer greater than 0 and can be set according to actual conditions. In some embodiments, the sixth threshold can be set to 3-5 Mbps. It can be understood that the smaller the sixth threshold is set, the easier it is to meet the difference between the maximum bandwidth and the bandwidth threshold greater than the sixth threshold in a collection cycle, which can make the management network port flooding alarm more refined.

[0130] It is understandable that the first threshold, the fourth threshold, and the fifth threshold may be the same (ie, all the same or partly the same), or different (ie, all different or partly different). The second threshold, the third threshold, and the sixth threshold may be the same, or different.

[0131] 509.BMC alarm: BMC management network port flooding.

[0132] When the BMC determines that the difference between the maximum bandwidth in the current collection cycle and the bandwidth threshold is greater than the sixth threshold, the BMC can promptly report the abnormal management network port traffic to the upper-level management software (i.e., the management network port may have broadcast flooding and multicast flooding), and can issue an alarm to notify relevant personnel to conduct investigations, thereby avoiding the unavailability of the BMC management function or the abnormality of the BMC management function. Afterwards, if the management network port traffic returns to normal, the BMC can report the alarm to remove the abnormal management network port traffic.

[0133] 510. The BMC updates the third standard data volume to the total data volume of the multicast message and the broadcast message in the current collection period.

[0134] When the BMC determines that the difference between the maximum bandwidth and the bandwidth threshold in the current collection cycle is less than or equal to the sixth threshold, it can be considered that there are no abnormal multicast messages and broadcast messages in the current collection cycle. Since the total data volume of multicast messages and broadcast messages in the current collection cycle is greater than the third standard data volume, the BMC can update the third standard data volume to the total data volume of multicast messages and broadcast messages in the current collection cycle, which is convenient for processing in subsequent collection cycles.

[0135] It should be noted that, in some embodiments, when the BMC executes the above step 504 but does not execute the above step 508, if the BMC determines in step 504 that the destination MAC addresses of all unicast messages are the MAC address of the BMC, then the BMC can update the first standard data volume to the total data volume of messages in the current collection cycle. Alternatively, when the BMC executes the above step 508 but does not execute the above step 504, if the BMC determines in step 508 that the difference between the maximum bandwidth in the current collection cycle and the bandwidth threshold is less than or equal to the sixth threshold, then the BMC can also update the first standard data volume to the total data volume of messages in the current collection cycle. Alternatively, when the BMC executes both the above step 508 and the above step 504, if the BMC determines in step 504 that the destination MAC addresses of all unicast messages are the MAC address of the BMC, and in step 508, the BMC determines that the difference between the maximum bandwidth in the current collection cycle and the bandwidth threshold is less than or equal to the sixth threshold, then the BMC can also update the first standard data volume to the total data volume of messages in the current collection cycle. In other embodiments, the BMC may also use the sum of the second standard data volume and the third standard data volume as the first standard data volume, which is not limited here. The execution of steps 503-504 and the execution of steps 507-508 have no temporal order and may be executed simultaneously or sequentially.

[0136] Since both step 401 and step 501 need to continuously acquire received messages according to a collection cycle and then perform statistical analysis based on the messages of the current collection cycle, in some embodiments, the BMC may perform step 401 and step 501 simultaneously.

[0137] It is understandable that the above traffic monitoring is for the management network port. Accordingly, the above traffic monitoring method can also be used for the service network port so that the attack message can be isolated and the service network port traffic anomaly can be reported to the upper-level BMC management system in advance before the service network port traffic reaches the bandwidth threshold of the service network port. It is also understandable that the above-mentioned bandwidth is used to measure the data volume of the management network port per unit time. In some embodiments, the data volume of the management network port per unit time can also be measured by packets per second (PPS) or other standards, which are not limited here.

[0138] It should be noted that the relevant information (ie, the same information or similar information) and the relevant descriptions in the above different embodiments may refer to each other.

[0139] It should be understood that the above Figure 4 and Figure 5 In the example, BMC is used as the execution subject of the interaction diagram to illustrate the above processing flow, but the present application does not limit the execution subject of the interaction diagram. Figure 4 and Figure 5 The BMC in the method may also be a chip, a chip system, or a processor that supports the BMC to implement the method, or may be a logic module or software that can implement all or part of the BMC functions.

[0140] The embodiment of the present application also discloses a computer-readable storage medium having instructions stored thereon, and when the instructions are executed, the method in the above method embodiment is executed.

[0141] The embodiment of the present application also discloses a computer program product including instructions, which, when executed, execute the method in the above method embodiment.

[0142] Obviously, the embodiments described above are only part of the embodiments of the present application, rather than all the embodiments. The reference to "embodiment" herein means that the specific features, structures or characteristics described in conjunction with the embodiments may be included in at least one embodiment of the present embodiment application. The phrase appearing in various positions in the specification is not necessarily the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. It can be understood by those skilled in the art explicitly and implicitly that the embodiments described herein can be combined with other embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application. The terms "first", "second", "third", etc. in the specification and claims of the present application and the drawings are distinguished from different objects, rather than used to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a series of steps or units are included, or alternatively, steps or units not listed are also included, or other steps or units inherent to these processes, methods, products or devices are also included. It can be understood that the equal sign of the above conditional judgment can be greater than one end or less than one end. For example, the above conditional judgment that a threshold is greater than, less than or equal to can also be changed to the conditional judgment that the threshold is greater than or equal to, or less than, and this is not limited here.

[0143] It is to be understood that only the part relevant to the present application but not all the contents are shown in the accompanying drawings. It should be understood that some exemplary embodiments are described as the processing or method described as a flow chart. Although the flow chart describes each operation (or step) as a sequential processing, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of each operation can be rearranged. When its operation is completed, the processing can be terminated, but it can also have additional steps not included in the accompanying drawings. The processing can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0144] As used in this specification, the terms "component", "module", "system", "unit", etc. are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a unit can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or distributed between two or more computers. In addition, these units can be executed from various computer-readable media having various data structures stored thereon. Units can communicate through local and / or remote processes, for example, based on signals having one or more data packets (e.g., data from a second unit interacting with another unit in a local system, a distributed system, and / or a network. For example, the Internet interacts with other systems via signals).

[0145] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation methods of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the scope of protection of the present application.

Claims

1. A flow monitoring method, characterized in that: An out-of-band controller applied to a computing device, the method comprising: In a first cycle, a unicast message, a multicast message and a broadcast message are respectively obtained; wherein the unicast message, the multicast message and the broadcast message are received through the management network port of the computing device; In the case where it is determined that an abnormal unicast message exists in the unicast message, the abnormal unicast message is discarded; or, in the case where it is determined that an abnormal multicast message and / or broadcast message exists in the multicast message and the broadcast message, the abnormal traffic of the management network port is reported; In the case of determining that there is a unicast message whose destination media access control MAC address is not the MAC address of the out-of-band controller in the unicast message, determining that there is an abnormal unicast message in the unicast message; Before determining that there is a unicast message whose destination MAC address is not the MAC address of the out-of-band controller in the unicast message, the method further includes: determining that a difference between a data volume of the unicast message in the first period and a second standard data volume is greater than a fourth threshold; The method further includes: when it is determined that there is no abnormal unicast message in the unicast message, updating the second standard data volume to the data volume of the unicast message in the first period.

2. The method according to claim 1, characterized in that The method further comprises: When it is determined that the difference between the maximum bandwidth in the first period and the bandwidth threshold is greater than a sixth threshold, it is determined that abnormal multicast messages and / or broadcast messages exist in the multicast messages and the broadcast messages.

3. The method according to claim 2, characterized in that Before determining that the difference between the maximum bandwidth in the first period and the bandwidth threshold is greater than a sixth threshold, the method further includes: It is determined that a difference between a total data volume of the multicast message and the broadcast message in the first period and a third standard data volume is greater than a fifth threshold.

4. The method according to claim 3, characterized in that The method further comprises: When it is determined that there are no abnormal multicast messages and broadcast messages in the multicast messages and the broadcast messages, the third standard data volume is updated to the total data volume of the multicast messages and the broadcast messages in the first period.

5. The method according to any one of claims 1 to 4, characterized in that: Before determining that an abnormal unicast message exists in the unicast message, or determining that an abnormal multicast message and / or broadcast message exists in the multicast message and the broadcast message, the method further includes: It is determined that a difference between a total data volume of the unicast message, the multicast message, and the broadcast message in the first period and a first standard data volume is greater than a first threshold.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: obtaining a maximum bandwidth within a plurality of the first periods; When the difference between the maximum bandwidth in each of the first cycles and the first standard bandwidth is greater than the second threshold value and packet loss occurs at the management network port in each of the first cycles, the maximum bandwidth in each of the first cycles is added to the bandwidth array to obtain a first bandwidth array; Eliminating the second bandwidth value in the first bandwidth array to obtain a second bandwidth array, wherein a difference between a maximum bandwidth value in the first bandwidth array and the second bandwidth value is greater than a third threshold; A first proportion of minimum bandwidth values ​​in the second bandwidth array is determined as the bandwidth threshold, where the first proportion is greater than 0 and less than 1.

7. The method according to claim 6, characterized in that The method further comprises: When the difference between the maximum bandwidth in the first period and the first standard bandwidth is greater than the second threshold and no packet loss occurs on the management network port in the first period, the first standard bandwidth is updated to the maximum bandwidth in the first period.

8. An out-of-band controller, characterized in that: The out-of-band controller includes a processor, a memory and a communication interface, wherein the communication interface is used to receive information from other electronic devices outside the out-of-band controller and output information to other electronic devices outside the out-of-band controller, and the processor calls the computer program stored in the memory to implement the method described in any one of claims 1-7.

Images