Traffic playback method, device and equipment

Abstract

The invention provides a traffic playback method, device and equipment, which are used for solving the problem that the traffic playback cannot simulate the network communication behavior of multi-node interaction in a region in the related technology. The method comprises the following steps: firstly, dividing a traffic data packet to be played back into a plurality of sub-traffic data packets, then, distributing the plurality of sub-traffic data packets to a corresponding source virtual host and a target virtual host, and establishing a control channel and a data channel between the source virtual host and the target virtual host of the sub-traffic data packets; the source virtual host and the target virtual host transmit the corresponding relation between each session flow and the data channel through the control channel, and the source virtual host and the target virtual host carry out session flow playback through the data channel. According to the embodiment of the invention, the traffic data packet to be played back is divided into the plurality of sub-traffic data packets and is distributed to the plurality of virtual hosts, and the plurality of virtual hosts are dispatched and driven to receive and send the traffic data packets, so that traffic interaction and cooperative work among the plurality of virtual hosts are realized.

Description

Background Art

[0002] Traffic replay is an important application technology in the network range, which is used to simulate the traffic conditions in the real network environment and help security professionals conduct attack and defense drills and network security testing. It is a technology that captures the data traffic in network communication and resends the data traffic at a later time or in a different network environment to simulate the original communication process.

[0003] In the related art, the traffic replay device based on Tcpreplay is limited to the self-loop playback of a single node, using different network cards on the same host to act as the client and server of the traffic replay task respectively, and cannot simulate the network communication behavior of multiple nodes interacting in the area. Summary of the invention

[0004] The purpose of the present application is to provide a traffic playback method, device and equipment to solve the problem in the related art that traffic playback cannot simulate the network communication behavior of multiple nodes interacting in a region.

[0005] In a first aspect, an embodiment of the present application provides a traffic playback method, the method comprising:

[0006] In response to a traffic playback task request, a traffic data packet to be played back is divided into a plurality of sub-traffic data packets; each of the plurality of sub-traffic data packets contains at least one session flow, and each sub-traffic data packet has a corresponding source virtual host and a destination virtual host;

[0007] Distributing the plurality of sub-flow data packets to corresponding source virtual hosts and destination virtual hosts;

[0008] For each of the plurality of sub-flow data packets, perform the following operations respectively:

[0009] Establishing a control channel between the source virtual host and the destination virtual host of the sub-flow data packet, and establishing at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet; the at least one data channel has a corresponding relationship with the session flow in the sub-flow data packet;

[0010] After the source virtual host sends the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, the source virtual host is called to send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0011] In one possible implementation, the two IP addresses included in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses included in each session flow in each sub-flow data packet.

[0012] In a possible implementation manner, establishing at least one data channel between a source virtual host and a destination virtual host of the sub-flow data packet includes:

[0013] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0014] If the difference is greater than or equal to the set threshold, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet.

[0015] In a possible implementation, the method further includes:

[0016] If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0017] In a second aspect, an embodiment of the present application further provides a traffic playback method, which is applied to a source virtual host, and the method includes:

[0018] Receive multiple sub-flow data packets to be replayed; each of the multiple sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host;

[0019] Sending a control channel establishment request to the destination virtual host, establishing a connection between the first port of the source virtual host and the first port of the destination virtual host as a control channel for traffic playback;

[0020] Sending a data channel establishment request to the destination virtual host, establishing a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet;

[0021] The correspondence between each session flow and the data channel in the sub-traffic data packet is sent to the destination virtual host through the control channel, and the request packet of each session flow is sent to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0022] In one possible implementation, the two IP addresses included in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses included in each session flow in each sub-flow data packet.

[0023] In a possible implementation manner, before sending a data channel establishment request to a destination virtual host, the process includes:

[0024] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0025] If the difference is greater than or equal to the set threshold, a step of sending a data channel establishment request to the destination virtual host to establish a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback is executed.

[0026] In a possible implementation, the method further includes:

[0027] If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0028] In a third aspect, an embodiment of the present application further provides a traffic playback method, which is applied to a destination virtual host, and the method includes:

[0029] Receive multiple sub-flow data packets to be replayed; each of the multiple sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host;

[0030] In response to a control channel establishment request sent by the source virtual host, a connection is established between the first port of the destination virtual host and the first port of the source virtual host as a control channel for traffic playback;

[0031] In response to a data channel establishment request sent by the source virtual host, a second port of the destination virtual host is connected to the second port of the source virtual host as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet;

[0032] The correspondence between the session flow and the data channel in the sub-flow data packet of the source virtual host is received through the control channel, and the request packet of each session flow sent by the destination virtual host is received through the data channel corresponding to each session flow, and the response packet of each session flow is used to respond to the request packet sent by the source virtual host.

[0033] In a fourth aspect, an embodiment of the present application further provides a traffic playback device, the device comprising:

[0034] A traffic data packet processing module, used for dividing the traffic data packet to be replayed into a plurality of sub-traffic data packets in response to a traffic replay task request; each of the plurality of sub-traffic data packets contains at least one session flow, and each sub-traffic data packet has a corresponding source virtual host and a destination virtual host;

[0035] A sub-flow data packet distribution module, used to distribute the multiple sub-flow data packets to the corresponding source virtual host and destination virtual host;

[0036] A channel establishment module, used to establish a control channel between the source virtual host and the destination virtual host of the sub-flow data packet, and to establish at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet; the at least one data channel has a corresponding relationship with the session flow in the sub-flow data packet;

[0037] The traffic replay execution module is used to call the source virtual host to send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow after the source virtual host sends the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0038] In one possible implementation, the two IP addresses included in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses included in each session flow in each sub-flow data packet.

[0039] In a possible implementation manner, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet, and the channel establishment module is used to:

[0040] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0041] If the difference is greater than or equal to the set threshold, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet.

[0042] In a possible implementation manner, the channel establishing module is further used for:

[0043] If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0044] In a fifth aspect, an embodiment of the present application further provides a traffic playback device, which is applied to a source virtual host, and the device includes:

[0045] A sub-flow data packet receiving module, used for receiving a plurality of sub-flow data packets to be played back; each of the plurality of sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host;

[0046] A control channel establishment module, used to send a control channel establishment request to the destination virtual host, and establish a connection between the first port of the source virtual host and the first port of the destination virtual host as a control channel for traffic playback;

[0047] A data channel establishment module, used to send a data channel establishment request to the destination virtual host, establish a connection between the second port of the source virtual host and the second port of the destination virtual host, as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet;

[0048] The traffic replay execution module is used to send the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, and send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0049] In one possible implementation, the two IP addresses included in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses included in each session flow in each sub-flow data packet.

[0050] In a possible implementation manner, before sending the data channel establishment request to the destination virtual host, the data channel establishment module is used to:

[0051] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0052] If the difference is greater than or equal to the set threshold, a step of sending a data channel establishment request to the destination virtual host to establish a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback is executed.

[0053] In a possible implementation manner, the data channel establishing module is further used to:

[0054] If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0055] In a sixth aspect, an embodiment of the present application further provides a traffic playback device, which is applied to a destination virtual host, and the device includes:

[0056] A sub-flow data packet receiving module, used for receiving a plurality of sub-flow data packets to be played back; each of the plurality of sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host;

[0057] A control channel establishment module, used to establish a connection between the first port of the destination virtual host and the first port of the source virtual host in response to a control channel establishment request sent by the source virtual host, as a control channel for traffic playback;

[0058] A data channel establishment module, configured to establish a connection between a second port of a destination virtual host and a second port of a source virtual host in response to a data channel establishment request sent by a source virtual host, as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with a session flow in the sub-traffic data packet;

[0059] The traffic replay execution module is used to receive the correspondence between the session flow and the data channel in the sub-traffic data packet of the source virtual host through the control channel, and receive the request packet of each session flow sent by the destination virtual host through the data channel corresponding to each session flow, and use the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0060] In the seventh aspect, another embodiment of the present application also provides an electronic device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes any traffic replay method in the embodiments of the present application.

[0061] In the eighth aspect, another embodiment of the present application further provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute any traffic replay method in the embodiments of the present application.

[0062] In the ninth aspect, another embodiment of the present application further provides a computer program product, including a computer program: when the computer program is executed by a processor, it implements any traffic playback method in the embodiments of the present application.

[0063] In an embodiment of the present application, first, the traffic data packet to be replayed is divided into multiple sub-traffic data packets, and then the multiple sub-traffic data packets are distributed to the corresponding source virtual host and the destination virtual host, and a control channel and a data channel are established between the source virtual host and the destination virtual host of the sub-traffic data packets. Finally, the source virtual host and the destination virtual host transmit the correspondence between each session flow and the data channel through the control channel, and the source virtual host and the destination virtual host replay the session flow through the data channel.

[0064] To summarize, the embodiment of the present application divides the traffic data packet to be replayed into multiple sub-traffic data packets and distributes them to multiple virtual hosts, schedules and drives multiple virtual hosts to receive and send traffic data packets, realizes traffic interaction and collaborative work between multiple virtual hosts, replays and analyzes network traffic between regions in a virtual topology, realizes traffic playback of complex network topologies, and during the traffic playback process, performs customized configuration based on the characteristics and requirements of the session flow, and can perform multi-strategy playback with session flow as the granularity.

[0065] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0067] Figure 1 A schematic diagram of an application scenario of a traffic playback method according to an embodiment of the present application;

[0068] Figure 2 The following is a schematic diagram of the overall flow of a traffic playback method according to an embodiment of the present application;

[0069] Figure 3 A schematic diagram of splitting a traffic data packet into multiple sub-traffic data packets according to an embodiment of the present application;

[0070] Figure 4 is a flow chart of a timing control method according to an embodiment of the present application;

[0071] Figure 5 A schematic diagram of a first time difference and a second time difference according to an embodiment of the present application;

[0072] Figure 6 The figure is a schematic diagram of the overall process of a traffic playback method applied to a source virtual host according to an embodiment of the present application;

[0073] Figure 7 It is a schematic diagram of the overall flow of a traffic playback method applied to a destination virtual host according to an embodiment of the present application;

[0074] Figure 8is a structural schematic diagram of a traffic playback device 800 according to an embodiment of the present application;

[0075] Fig. 9 Schematic diagram of the structure of a traffic playback device 900 according to an embodiment of the present application;

[0076] Fig.10 1 is a schematic diagram of the structure of a traffic playback device 1000 according to an embodiment of the present application;

[0077] Fig.11 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0079] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0080] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0081] Below, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0082] (1) Agent: In traffic replay technology, Agent is a software program that is responsible for driving the virtual machine network card to send and receive network traffic. It can be deployed in a distributed manner on different virtual machines in the topology to control the virtual machines to simulate real network environments and scenarios.

[0083] (2) Pcap: A network data packet capture file format used to store data packets captured from the network. It is usually generated by network packet capture tools, such as Wireshark, Tcpdump, etc. These tools can capture data packets passing through the network interface and save them as Pcap files for subsequent analysis and processing. The flow data packets and sub-flow data packets in the embodiments of the present application are Pcap packets.

[0084] (3) Scapy: used to operate network data packets. It can be used to capture, parse, edit and send network data packets, and supports multiple network protocols such as IP, TCP, UDP, ICMP, etc. Scapy has flexible functions and easy-to-use interfaces, allowing users to easily build complex network tools and applications. Its main principle is to construct data packets by editing the messages layer by layer, and its core function is to edit and construct message fields. It is convenient for message parsing and modification during traffic playback and generation.

[0085] (4) PyInstaller: A tool for packaging Python applications into executable files. It can package Python scripts and their dependencies (including the Python interpreter, third-party libraries, etc.) into a single executable file, allowing Python applications to run on computers that do not have a Python interpreter installed. PyInstaller supports cross-platform and can be used on Windows, Linux, and macOS.

[0086] (5) Qemu-ga: It is a part of QEMU (Quick EMUlator) and is an agent program used to communicate with virtual machines (VMs). The Qemu-ga agent program runs inside the virtual machine and can communicate with the host or hypervisor, providing file upload and command execution functions and services. In traffic playback technology, Qemu-ga is used in the deployment phase to upload the Agent to the virtual machine and run the Agent by executing the command function.

[0087] (6) Traffic replay: In the security field, traffic replay is often used to simulate network attacks and malicious behaviors. Security experts can use traffic replay tools to reproduce known attack scenarios to test the effectiveness of network defense devices and security policies. Traffic replay can also be used to detect potential security vulnerabilities in the network and discover abnormal traffic and malicious behaviors.

[0088] Traffic replay is an important application technology in the network range, which is used to simulate the traffic conditions in the real network environment and help security professionals conduct attack and defense drills and network security testing. It is a technology that captures the data traffic in network communication and resends the data traffic at a later time or in a different network environment to simulate the original communication process.

[0089] In the related art, the traffic replay device based on Tcpreplay is limited to the self-loop playback of a single node, using different network cards on the same host to act as the client and server of the traffic replay task respectively, and cannot simulate the network communication behavior of multiple nodes interacting in the area.

[0090] In view of this, the embodiments of the present application provide a traffic playback method, apparatus and device for solving the problem in the related art that traffic playback cannot simulate the network communication behavior of multiple nodes interacting in a region.

[0091] First, the traffic data packet to be replayed is divided into multiple sub-traffic data packets, and then the multiple sub-traffic data packets are distributed to the corresponding source virtual host and the destination virtual host, and a control channel and a data channel are established between the source virtual host and the destination virtual host of the sub-traffic data packet. Finally, the source virtual host and the destination virtual host transmit the corresponding relationship between each session flow and the data channel through the control channel, and the source virtual host and the destination virtual host replay the session flow through the data channel. In summary, the embodiment of the present application divides the traffic data packet to be replayed into multiple sub-traffic data packets and distributes them to multiple virtual hosts, schedules and drives multiple virtual hosts to receive and send traffic data packets, realizes traffic interaction and collaborative work between multiple virtual hosts, replays and analyzes network traffic between regions in the virtual topology, realizes traffic replay of complex network topology, and in the process of traffic replay, performs customized configuration according to the characteristics and requirements of the session flow, and can replay multiple strategies with session flow as the granularity.

[0092] After introducing the design ideas of the embodiments of the present application, the following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0093] Figure 1 It is a schematic diagram of an application scenario according to an embodiment of the present application.

[0094] like Figure 1 As shown, the application environment may include, for example, a storage system 10, a server 20, and an electronic device 30. The electronic device 30 may be any suitable electronic device for network access, including but not limited to a computer, a laptop, or other types of devices. The storage system 10 can store accessed data resources, such as traffic data packets, etc.

[0095] It should be noted that Figure 1 The electronic devices 30 shown (for example, between 30_1 and 30_2 or 30_N) can also communicate with each other via the network 40. The network 40 can be a network for information transmission in a broad sense, and can include one or more communication networks, such as a wireless communication network, the Internet, a private area network, a local area network, a metropolitan area network, a wide area network, or a cellular data network.

[0096] The description in this application only details a single server or electronic device, but those skilled in the art should understand that the single server 20, electronic device 30 and storage system 10 or 11 shown are intended to indicate that the technical solution of this application involves the operation of electronic devices, servers and storage systems. The single electronic device and the single server and storage system are described in detail at least for the convenience of explanation, and do not imply any limitation on the number, type or location of the electronic devices and servers. It should be noted that adding additional modules to the illustrated environment or removing individual modules from it does not change the underlying concepts of the example embodiments of this application. In addition, although for the convenience of explanation, Figure 1 A bidirectional arrow from the storage system to the server is shown in the figure, but those skilled in the art can understand that the sending and receiving of the above data can also be achieved through the network 40.

[0097] The storage system 10 may be, for example, a cache system, a hard disk storage, a memory storage, etc. Of course, the method provided in the embodiment of the present application is not limited to Figure 1 The application scenarios shown can also be used in other possible application scenarios, and the embodiments of the present application are not limited thereto. Figure 1 The functions that can be implemented by each device in the application scenario shown will be described in the subsequent method embodiments, and will not be described in detail here.

[0098] Server 20 can be a single server, a server cluster consisting of several servers, or a cloud computing center. Server 20 can be an independent physical server, or a server cluster or distributed system consisting of multiple physical servers, or a server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services,

[0099] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application.

[0100] The system for traffic playback of the present application is composed of a client, a server and a virtual host. The client provides a user interaction interface, the server is mainly responsible for editing the original pcap package and scheduling the virtual host, and the virtual host is responsible for sending and receiving traffic. It should be added that the embodiment of the present application also installs a simulation program (agent) on the relevant virtual host (file upload and command execution functions provided by the virtualization control service), and the simulation program has a built-in traffic playback algorithm, which is controlled and scheduled by the traffic playback module to drive the virtual host to send / receive packets, thereby completing the traffic playback simulation.

[0101] refer to Figure 2 The present invention provides an overall flow chart of a traffic playback method applied to a server, including the following steps:

[0102] In step 201, in response to a traffic replay task request, the traffic data packet to be replayed is divided into multiple sub-traffic data packets; each of the multiple sub-traffic data packets contains at least one session flow, and each sub-traffic data packet has a corresponding source virtual host and a destination virtual host.

[0103] In a possible implementation, the embodiment of the present application splits the traffic data packet (pcap packet) according to the source IP address and the destination IP address to obtain multiple sub-traffic data packets (small pcap packets) containing two IP addresses, and then uploads them to the corresponding virtual host.

[0104] For example, refer to Figure 3 Schematic diagram of splitting a traffic data packet into multiple sub-traffic data packets. The edited pcap package (traffic data packet) contains multiple TCP session flows, each of which has a source IP address and a destination IP address. For example, the source IP address of session flow 1 is 192.168.1.3, and the destination IP address is 192.168.2.3. The source IP address of session flow 4 is 192.168.2.3, and the destination IP address is 192.168.1.3. The embodiment of the present application splits the traffic data packet into multiple sub-traffic data packets. The basis of the package is: make the IP address contained in each session flow in the same sub-flow data packet the same. Since the IP addresses contained in session flow 1 and session flow 4 are both 192.168.1.3 and 192.168.2.3, session flow 1 and session flow 4 are classified into the same small pcap packet (sub-flow data packet). The IP addresses of the virtual hosts corresponding to the small pcap packet are 192.168.1.3 and 192.168.2.3. Similarly, the edited pcap packet is split into multiple small pcap packets.

[0105] In step 202, a plurality of sub-flow data packets are distributed to corresponding source virtual hosts and destination virtual hosts.

[0106] In a possible implementation, in a network target range, the host IP of the real environment involved in the traffic data packet is different from the host IP of the virtual topology. If the host IP of the real environment is used directly, the route cannot be matched in the virtual topology, resulting in the inability to replay the traffic. The present application modifies the IP address involved in the traffic data packet to the IP address in the virtual topology, and reconstructs the traffic data packet through traffic editing, including modifying the IP address, port number, checksum and other information. For example, use Scapy to edit the traffic data packet, modify the IP address of each traffic data packet to the IP address of the corresponding virtual host in the network topology, assuming that the source IP of the pcap packet is 192.168.1.10 and the target IP is 192.168.2.20, and the traffic edit is saved as a new pcap packet, encrypted and uploaded to the 192.168.1.10 and 192.168.2.20 virtual hosts.

[0107] In a possible implementation, since each session flow in each sub-flow data packet contains only two IP addresses, such as 192.168.1.10 and 192.168.2.20, the same IP address can be both the source IP and the destination IP for different session flows. Therefore, in the process of distributing multiple sub-flow data packets to the corresponding source virtual host and the destination virtual host, no matter whether the virtual host is the source virtual host or the destination virtual host, as long as the IP address of the virtual host is the same as the IP address contained in the session flow in the sub-flow data packet, the sub-flow data packet is distributed to the virtual host with the corresponding IP address. For example, if the IP address contained in the session flow in the sub-flow data packet is 192.168.1.10, the sub-flow data packet is distributed to the source virtual host with the IP address of 192.168.1.10 and the destination virtual host with the IP address of 192.168.1.10.

[0108] For each of the multiple sub-flow data packets, perform the following operations respectively:

[0109] In step 203, a control channel is established between the source virtual host and the destination virtual host of the sub-flow data packet, and at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet, wherein the at least one data channel has a corresponding relationship with the session flow in the sub-flow data packet.

[0110] Among them, during the traffic playback process, the control channel is responsible for transmitting the synchronization signal between the two virtual hosts, and the data channel is responsible for transmitting the session flow between the two virtual hosts.

[0111] In a possible implementation, before starting the traffic playback, the source virtual host and the destination virtual host of the sub-traffic data packet establish a connection with the service receiving the flow signal of the other party through the TCP protocol as a control channel for the traffic playback. For example, the service receiving the flow signal listens on port 8090 by default (which can be set to other non-occupied ports through the configuration file), and the connection can be established using the built-in socket library of Python based on the IP addresses and port numbers of the two virtual hosts.

[0112] Moreover, in order to achieve a more realistic simulation of session flows, all session flows cannot be transmitted through one data channel, because the traffic simulated in this way is actually one session flow, which is very different from the actual traffic. The number of session flows in the sub-flow data packet is equal to the number of session flows that need to be simulated. When the traffic is played back, these session flows are transmitted through different data channels, thereby simulating more realistic traffic.

[0113] It should be added that the execution time for establishing the control channel is after the Agent receives the playback task, and the execution time for establishing the data channel is before starting to play back a TCP / UDP session stream.

[0114] In step 204, after the source virtual host sends the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, the source virtual host is called to send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0115] In one possible implementation, after the data channel is successfully established, the embodiment of the present application informs the destination virtual host through the control channel which data channel a certain session flow will be sent through. The destination virtual host has a mapping table of source IP: source port and flow characteristics, and can match the flow characteristics according to the source IP: source port of the data channel, so as to find the corresponding response queue for response. The flow characteristics are: playback hash:: source IP: source port:: destination IP: destination port:: transport layer protocol, which plays the role of uniquely identifying the session flow during the playback process. The playback hash is generated when the host sends a playback task to the virtual host, which means that each playback request will have a unique hash value so that the traffic data packet can be played back multiple times and simultaneously on the virtual machine.

[0116] For example, the content of the notification to the destination virtual host through the control channel in the embodiment of the present application is a fixed structure, similar to the network packet header, which contains three data: synchronization type, key, and value. In this step, the three data are as follows:

[0117] (1) Synchronization type: fixed to simulate_port_sync;

[0118] (2) Key: flow feature (a string that uniquely identifies the session flow, with the structure of simulate_hash||{tcp|udp}-src_ip:src_port-dst_ip:dst_port), where simulate_hash is generated during the current playback task to prevent the same data packet from being played back multiple times and causing the flow features to overlap;

[0119] (3) Value: source IP:source port (for example, 192.168.1.1:65534);

[0120] After receiving the notification content, the destination virtual host parses it according to the agreed format (the above structure) and stores the content to obtain a mapping table of source IP: source port and flow characteristics. The mapping table means as follows:

[0121] Session stream 1 features: 65534;

[0122] Session flow 2 features: 65533;

[0123] Session flow 3 features: 65532;

[0124] The destination virtual host can match the session flow characteristics according to the source IP:source port of the obtained data channel. For example, the source port of the data port corresponding to session flow 1 is 65534, so as to find the response queue corresponding to the session flow and respond through the data channel.

[0125] When multiple virtual hosts interact, there are two problems: first, the packet timestamp is a fixed value, and a certain strategy must be adopted according to the current virtual host time to control the flow playback speed. The second is that multiple virtual hosts may have inconsistent times. If the virtual host timestamp is directly used for calculation, the packet sending / receiving time between virtual hosts will be inconsistent, resulting in playback failure. The embodiment of the present application adopts a timing control method to solve the above two problems.

[0126] In a possible implementation manner, before establishing at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet, the timing control method of the embodiment of the present application is as follows: Figure 4 As shown, it can be implemented as:

[0127] In step 401, the difference between the first time difference and the second time difference is determined; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet.

[0128] In step 402, if the difference is greater than or equal to the set threshold, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet.

[0129] In step 403, if the difference is less than the set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0130] For example, the time Ti of the first message of the current i-th session flow, the time T1 of the first message in the first session flow of the original pcap package, the current system time Ai of the virtual host, the system time A1 when the virtual host receives the playback task, Ai–A1 represents the first time difference between the current time and the time when the playback task is received, Ti–T1 represents the second time difference between the current session of the pcap package and the first session flow. If (Ai–A1)-(Ti–T1)>=0, the data channel corresponding to the session flow is established and the playback of the current i-th session flow begins. If not, the thread sleeps and waits for the preset time length of 0.5s. Figure 5 If the first time difference (Ai–A1) minus the second time difference (Ti–T1) is less than the preset threshold value 0, the virtual host waits for a preset time of 0.5s until (Ai–A1)-(Ti–T1)>=0, and the virtual host establishes the data channel corresponding to the session flow and starts to replay the current i-th session flow.

[0131] refer to Figure 6 The overall flow diagram of a traffic playback method applied to a source virtual host provided in an embodiment of the present application includes the following steps:

[0132] In step 601, a plurality of sub-flow data packets to be played back are received; each of the plurality of sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host.

[0133] In a possible implementation, the Agent in the virtual host can receive traffic replay tasks issued by the target range platform on the server side and receive multiple sub-traffic data packets to be replayed. The principle is to listen to port 4560 when the Agent is started (other non-occupied ports can be set through the configuration file). The port service provides a Restful interface. The URL address of the interface is: http: / / localhost:4560 / traffic. When the interface is called, the Agent can parse the interface parameters and start traffic replay.

[0134] The server-side range platform uses Qemu-ga to implement the platform-driven virtual host execution command capability. When scheduling virtual machines, the range platform executes the following instructions on the virtual machine through the command execution capability:

[0135] curl -X POST -H "Content-Type: application / json" -d "parameter json" "http: / / localhost:4560 / traffic". The parameters of this command are explained as follows:

[0136] -X POST: specifies the request method as POST;

[0137] -H "Content-Type: application / json": declare the transmission format as json in the request header;

[0138] -d "parameter json": pass the parameters required for traffic playback, including the playback packet (encrypted) location, the timestamp of the first message in the original pcap packet, the hash of the playback request, the playback mode, the playback rate, etc., and pass them to the interface in json format

[0139] "http: / / localhost:4560 / traffic": specifies access to port 4560 and the traffic path on the virtual host to call the traffic playback interface.

[0140] In step 602, a control channel establishment request is sent to the destination virtual host, and a connection is established between the first port of the source virtual host and the first port of the destination virtual host as a control channel for traffic playback.

[0141] In step 603, a data channel establishment request is sent to the destination virtual host, and a connection is established between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback; at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet.

[0142] In a possible implementation manner, before establishing at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet, the timing control method of the embodiment of the present application may be implemented as follows:

[0143] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0144] If the difference is greater than or equal to the set threshold, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet;

[0145] If the difference is less than the set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0146] In step 604, the correspondence between each session flow and the data channel in the sub-traffic data packet is sent to the destination virtual host through the control channel, and the request packet of each session flow is sent to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0147] refer to Figure 7 The overall flow diagram of a traffic playback method applied to a destination virtual host provided in an embodiment of the present application includes the following steps:

[0148] In step 701, a plurality of sub-flow data packets to be played back are received; each of the plurality of sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host.

[0149] In step 702, in response to a control channel establishment request sent by the source virtual host, a connection is established between the first port of the destination virtual host and the first port of the source virtual host as a control channel for traffic playback.

[0150] In step 703, in response to a data channel establishment request sent by the source virtual host, a connection is established between the second port of the destination virtual host and the second port of the source virtual host as at least one data channel for traffic playback; at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet.

[0151] In step 704, the correspondence between the session flow and the data channel in the sub-flow data packet of the source virtual host is received through the control channel, and the request packet of each session flow sent by the destination virtual host is received through the data channel corresponding to each session flow, and the response packet of each session flow is used to respond to the request packet sent by the source virtual host.

[0152] In a possible implementation, when the Agent of the virtual host receives a playback task request and receives a sub-traffic data packet, it decrypts and reads the data, and identifies the role played by the virtual machine where the Agent is located in this playback task (client or server, the client is the source virtual host, and the server is the destination virtual host). When the IP address of the virtual machine where the Agent is located is different from the source IP address of the sub-traffic data packet, the virtual machine acts as a server in this playback task; when the IP address of the virtual machine where the Agent is located is the same as the source IP address of the traffic packet, the virtual machine acts as a client in this playback task. For example, the IP address of the virtual machine where the Agent is located is 192.168.2.20, and the source IP address of the traffic packet is 192.168.1.10. The IP address of the virtual machine is different from the source IP of the traffic packet, then the virtual machine where the current Agent is located plays the role of a server during the playback process.

[0153] After receiving the sub-flow data packet, the Agent of the virtual host will build the request queue and response queue of the sub-flow data packet. The request queue is the data packet to be sent by the virtual machine where the current Agent is located, and the response queue is the data packet to be received by the virtual machine where the current Agent is located. Both the request queue and the response queue are nested queues (the element type of the queue is also a queue, which is called a nested queue). The rule for building queues is: first create request queue A and response queue B, and traverse from the sub-flow data packet from beginning to end. When the data packet is a request packet, create a sub-queue A1, put this request packet into queue A1, and then iterate the next data packet. If the next data packet is also a request packet, then put the next data packet into queue A1, and iterate backwards. If it is a request packet, put it into A1 until the next data packet is a response packet, then create a sub-queue B1, put the data packet into B1, and continue to iterate. If it is a response packet, put it into B1 until the next data packet is a request packet, then create a sub-queue A2, put the data packet into A2... and so on. The cycle ends until the iteration of the sub-flow data packet ends, and the request queue and response queue can be built.

[0154] To summarize, the embodiment of the present application divides the traffic data packet to be replayed into multiple sub-traffic data packets and distributes them to multiple virtual hosts, schedules and drives multiple virtual hosts to receive and send traffic data packets, realizes traffic interaction and collaborative work between multiple virtual hosts, replays and analyzes network traffic between regions in a virtual topology, realizes traffic playback of complex network topologies, and during the traffic playback process, performs customized configuration based on the characteristics and requirements of the session flow, and can perform multi-strategy playback with session flow as the granularity.

[0155] Based on the same inventive concept, an embodiment of the present application also provides a traffic playback device. Figure 8 is a schematic diagram of a flow playback device according to an exemplary embodiment. Figure 8 , the device 800 comprises:

[0156] The traffic data packet processing module 801 is used to divide the traffic data packet to be replayed into multiple sub-traffic data packets in response to the traffic playback task request; each of the multiple sub-traffic data packets contains at least one session flow, and each sub-traffic data packet has a corresponding source virtual host and a destination virtual host;

[0157] The sub-flow data packet distribution module 802 is used to distribute the plurality of sub-flow data packets to the corresponding source virtual host and the destination virtual host;

[0158] A channel establishment module 803 is used to establish a control channel between the source virtual host and the destination virtual host of the sub-flow data packet, and to establish at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet; the at least one data channel has a corresponding relationship with the session flow in the sub-flow data packet;

[0159] The traffic replay execution module 804 is used to call the source virtual host to send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow after the source virtual host sends the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0160] In one possible implementation, the two IP addresses included in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses included in each session flow in each sub-flow data packet.

[0161] In a possible implementation manner, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet, and the channel establishment module is used to:

[0162] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0163] If the difference is greater than or equal to the set threshold, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet.

[0164] In a possible implementation manner, the channel establishing module is further used for:

[0165] If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0166] Based on the same inventive concept, an embodiment of the present application also provides a traffic playback device. Fig. 9 is a schematic diagram of a flow playback device according to an exemplary embodiment, which is applied to a source virtual host. Fig. 9 , the device 900 comprises:

[0167] The sub-flow data packet receiving module 901 is used to receive multiple sub-flow data packets to be played back; each of the multiple sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host;

[0168] A control channel establishment module 902 is used to send a control channel establishment request to the destination virtual host, and establish a connection between the first port of the source virtual host and the first port of the destination virtual host as a control channel for traffic playback;

[0169] A data channel establishment module 903 is used to send a data channel establishment request to the destination virtual host, establish a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet;

[0170] The traffic replay execution module 904 is used to send the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, and send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0171] In one possible implementation, the two IP addresses included in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses included in each session flow in each sub-flow data packet.

[0172] In a possible implementation manner, the data channel establishment module sending a data channel establishment request to the destination virtual host is used to:

[0173] Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet;

[0174] If the difference is greater than or equal to the set threshold, a step of sending a data channel establishment request to the destination virtual host to establish a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback is executed.

[0175] In a possible implementation manner, the data channel establishing module is further used to:

[0176] If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

[0177] Based on the same inventive concept, an embodiment of the present application also provides a traffic playback device. Fig.10 is a schematic diagram of a flow playback device according to an exemplary embodiment, which is applied to a destination virtual host, and refers to Fig.10 , the device 1000 comprises:

[0178] The sub-flow data packet receiving module 1001 is used to receive a plurality of sub-flow data packets to be played back; each of the plurality of sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host;

[0179] A control channel establishment module 1002 is used to establish a connection between the first port of the destination virtual host and the first port of the source virtual host in response to a control channel establishment request sent by the source virtual host, as a control channel for traffic playback;

[0180] The data channel establishment module 1003 is used to establish a connection between the second port of the destination virtual host and the second port of the source virtual host in response to the data channel establishment request sent by the source virtual host, as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet;

[0181] The traffic replay execution module 1004 is used to receive the correspondence between the session flow and the data channel in the sub-traffic data packet of the source virtual host through the control channel, and receive the request packet of each session flow sent by the destination virtual host through the data channel corresponding to each session flow, and use the response packet of each session flow to respond to the request packet sent by the source virtual host.

[0182] The implementation and beneficial effects of each operation in the traffic playback device can be found in the description of the method above, which will not be repeated here.

[0183] After introducing the traffic playback method and device according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0184] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0185] In some possible implementations, the electronic device according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps in the firmware file parsing method according to various exemplary implementations of the present application described above in this specification. For example, the processor may execute the steps in the firmware file parsing method.

[0186] Refer to the following Fig.11 The electronic device 130 according to this embodiment of the present application is described. Fig.11 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0187] like Fig.11 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0188] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0189] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0190] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0191] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0192] In some possible implementations, various aspects of a traffic replay method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product runs on a computer device, the program code is used to enable the computer device to execute the steps of a traffic replay method according to various exemplary implementations of the present application described above in this specification.

[0193] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0194] The program product for the traffic playback method of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on an electronic device. However, the program product of the present application is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0195] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0196] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0197] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or entirely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0198] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0199] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0200] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0201] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable image scaling device to produce a machine, so that the instructions executed by the processor of the computer or other programmable image scaling device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0202] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable image scaling device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, the instruction device being implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0203] These computer program instructions may also be loaded onto a computer or other programmable image scaling device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0204] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0205] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A traffic playback method, characterized in that: The method comprises: In response to a traffic playback task request, a traffic data packet to be played back is divided into a plurality of sub-traffic data packets; each of the plurality of sub-traffic data packets contains at least one session flow, and each sub-traffic data packet has a corresponding source virtual host and a destination virtual host; Distributing the plurality of sub-flow data packets to corresponding source virtual hosts and destination virtual hosts; For each of the plurality of sub-flow data packets, perform the following operations respectively: Establishing a control channel between the source virtual host and the destination virtual host of the sub-flow data packet, and establishing at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet; the at least one data channel has a corresponding relationship with the session flow in the sub-flow data packet; After the source virtual host sends the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, the source virtual host is called to send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

2. The method according to claim 1, characterized in that: The two IP addresses contained in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses contained in each session flow in each sub-flow data packet.

3. The method according to claim 1, characterized in that The step of establishing at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet comprises: Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet; If the difference is greater than or equal to the set threshold, at least one data channel is established between the source virtual host and the destination virtual host of the sub-flow data packet.

4. The method according to claim 3, characterized in that: The method further comprises: If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

5. A traffic playback method, characterized in that: Applied to a source virtual host, the method comprises: Receive multiple sub-flow data packets to be replayed; each of the multiple sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host; Send a control channel establishment request to the destination virtual host, and establish a connection between the first port of the source virtual host and the first port of the destination virtual host as a control channel for traffic playback; Sending a data channel establishment request to the destination virtual host, establishing a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet; The correspondence between each session flow and the data channel in the sub-traffic data packet is sent to the destination virtual host through the control channel, and the request packet of each session flow is sent to the destination virtual host through the data channel corresponding to each session flow, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

6. The method according to claim 5, characterized in that The two IP addresses contained in each session flow in the same sub-flow data packet are the same; the IP address of the source virtual host and the IP address of the destination virtual host corresponding to each sub-flow data packet are the same as the two IP addresses contained in each session flow in each sub-flow data packet.

7. The method according to claim 5, characterized in that Before sending a data channel establishment request to the destination virtual host, the method includes: Determine the difference between the first time difference and the second time difference; the first time difference refers to the difference between the current system time of the source virtual host and the system time when the source virtual host receives the playback task, and the second time difference refers to the difference between the time of the first message in the current session flow in the sub-flow data packet and the time of the first message in the first session flow in the sub-flow data packet; If the difference is greater than or equal to the set threshold, a step of sending a data channel establishment request to the destination virtual host to establish a connection between the second port of the source virtual host and the second port of the destination virtual host as at least one data channel for traffic playback is executed.

8. The method according to claim 7, characterized in that The method further comprises: If the difference is less than a set threshold, the step of determining the difference between the first time difference and the second time difference is repeated at every preset time interval until the determined time difference is greater than or equal to the set threshold.

9. A traffic playback method, characterized in that: Applied to the destination virtual host, the method comprises: Receive multiple sub-flow data packets to be replayed; each of the multiple sub-flow data packets contains at least one session flow, and each sub-flow data packet has a corresponding source virtual host and a destination virtual host; In response to a control channel establishment request sent by the source virtual host, a connection is established between the first port of the destination virtual host and the first port of the source virtual host as a control channel for traffic playback; In response to a data channel establishment request sent by the source virtual host, a second port of the destination virtual host is connected to the second port of the source virtual host as at least one data channel for traffic playback; the at least one data channel has a corresponding relationship with the session flow in the sub-traffic data packet; The correspondence between the session flow and the data channel in the sub-flow data packet of the source virtual host is received through the control channel, and the request packet of each session flow sent by the destination virtual host is received through the data channel corresponding to each session flow, and the response packet of each session flow is used to respond to the request packet sent by the source virtual host.

10. A flow playback device, characterized in that: The device comprises: A traffic data packet processing module, used for dividing the traffic data packet to be replayed into a plurality of sub-traffic data packets in response to a traffic replay task request; each of the plurality of sub-traffic data packets contains at least one session flow, and each sub-traffic data packet has a corresponding source virtual host and a destination virtual host; A sub-flow data packet distribution module, used to distribute the multiple sub-flow data packets to the corresponding source virtual host and destination virtual host; A channel establishment module, used to establish a control channel between the source virtual host and the destination virtual host of the sub-flow data packet, and to establish at least one data channel between the source virtual host and the destination virtual host of the sub-flow data packet; the at least one data channel has a corresponding relationship with the session flow in the sub-flow data packet; The traffic replay execution module is used to call the source virtual host to send the request packet of each session flow to the destination virtual host through the data channel corresponding to each session flow after the source virtual host sends the correspondence between each session flow and the data channel in the sub-traffic data packet to the destination virtual host through the control channel, so that the destination virtual host uses the response packet of each session flow to respond to the request packet sent by the source virtual host.

11. An electronic device, characterized in that: It comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method according to any one of claims 1 to 9.

12. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that Computer programs include: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images