Flow collection method and collection system based on eBPF

By combining eBPF and VXLAN virtual appliances in a Kubernetes environment, a lightweight traffic collection method was implemented, which solved the problem of traffic collection under high concurrency and high change frequency, met the needs of traffic analysis and security detection, and supported the expansion of the collection end.

CN122137794APending Publication Date: 2026-06-02HANGZHOU HARMONYCLOUD TECH CO LTD
1 Cites 1 Cited by

Patent Information

Application Number
CN202610287829.7
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2026-03-10
Publication Date
2026-06-02

AI Technical Summary

Technical Problem

In a Kubernetes environment, existing traffic collection methods suffer from low performance, high resource consumption, high policy linkage complexity, and difficult operation and maintenance in high-concurrency and high-change-frequency scenarios, making it difficult to efficiently achieve traffic guidance and analysis under cloud virtual network conditions.

Method used

The traffic collection method based on eBPF is adopted. Traffic identification and filtering are performed in kernel space through mapping table to generate tunnel metadata. The encapsulation and transmission are completed in kernel space using VXLAN virtual device, avoiding the resource overhead caused by user space transfer and copying, and realizing lightweight traffic encapsulation and forwarding.

Benefits of technology

It reduces the complexity of BPF, lowers CPU and memory overhead, avoids bandwidth pressure on cloud virtual networks, supports traffic analysis and security detection needs in Kubernetes environments, and supports horizontal scaling of the data collection end.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention discloses a flow collection method and system based on eBPF, and belongs to the technical field of digital information transmission, and the method comprises the steps: screening first metadata according to a mapping relation between an index and a network identifier and a target position, and obtaining second metadata, and a network identifier and a target position of the second metadata; generating tunnel metadata; and sending the tunnel metadata to a VXLAN virtual device. Screening and marking the first metadata through a mapping table; identification and drainage of the first metadata are completed in the kernel mode, and resource overhead caused by carrying and copying of the user mode is avoided; only the screened traffic is sent in a mirroring manner, so that the bandwidth pressure of the virtual network on the cloud caused by full mirroring is avoided; the message encapsulation is uniformly processed by the VXLAN virtual equipment in a kernel mode, so that the complexity and the fault risk of head processing are reduced; the object change of the first node is updated through the mapping table, and manual maintenance is reduced; and the requirements of flow analysis, auditing and security detection are met.
Need to check novelty before this filing date? Find Prior Art