100GOTN signal processing platform and processing method based on X86 board

Abstract

The present invention relates to a 100GOTN signal processing platform and processing method based on an X86 board, which can perform frame analysis, demapping and load identification on 100GOTN signals, and can switch and output to an X86 board for flow collection and analysis processing of different granularities according to different encapsulated flows carried, collect raw data at high speed for 10GSDH, perform SDH frame structure analysis and decapsulation processing on the raw data, dig out and strip out Ethernet data, obtain packet data files, adopt packet collection mode for 100GE and 10GE to obtain collected data, perform deep packet detection on the packet data files, perform Ethernet protocol analysis on the data to obtain IP quintuples and load information, and obtain statistical information on the behavior trend of network data according to a data cleaning module. The bypass access collection, decapsulation mapping, deep analysis, data cleaning statistics and other functions of 100GOTN signals are realized.

Description

Technical Field

[0001] The present invention relates to a 100GOTN signal acquisition, analysis and processing platform, and in particular to a 100GOTN signal processing platform and a processing method based on an X86 board. Background Art

[0002] Currently, emerging businesses such as personal IP services and enterprise IP services are developing rapidly, which has led to a rapid increase in bandwidth and a surge in IP traffic, with a global annual growth rate of 32%. International telecommunication standards are taking the lead. The 100G standard-setting organizations IEEE, ITU-T and OIF have issued 100G standards. There are already a large number of 100GOTN signals in backbone networks and metropolitan area networks. The encapsulation and mapping technology of OTU4 in the 100GOTN technical standard can encapsulate and map a variety of low-speed granularity signals to make full use of bandwidth. The 100GOTN system supports all customer-side service access from 100M to 100G, achieving all-in-one network services, compatible with 10GE_LAN and GE interfaces of IP data networks, compatible with STM-N services of the original MSTP network, and compatible with 100GE core router interfaces. Currently, most OTN signals for 100G bandwidth are transmission systems, and the need for technical reconnaissance of 100GOTN signal traffic bypass is gradually emerging. At present, there are few devices that receive 100GOTN signals, encapsulate and demultiplex 100GOTN signals, and perform polling analysis on all the effective data traffic of the low-speed granularity such as 10GSDH, 10GE and 100GE. This platform can disassemble and analyze all the multiplexed branch signals of 100GOTN, and is compatible with the decapsulation frame structure analysis of STM-N signals, stripping the bottom-level information of data services, and analyzing and statistically outputting the details of the 100GOTN line base for IP data, and obtaining situation information such as IP trend, port distribution, and regional trend. Summary of the invention

[0003] In order to meet the bypass analysis requirements of the current 100GOTN signal, the present invention provides a 100GOTN signal processing platform and a processing method based on an X86 board. According to the 100GOTN mapping multiplexing structure output by the analysis, the traffic of different granularities such as 10GE, 10GSDH, and 100GE can be polled and collected for in-depth analysis, and the data service distribution in the total bandwidth of 100GOTN can be displayed, and the proportion and regional distribution data can be obtained. The specific technical solution is that the 100GOTN signal processing platform based on the X86 board has a hardware form of an ATCA chassis architecture, including a main control board, a line board, a switch board, and an X86 computing blade, which is characterized in that: the main control board is connected to the A through a backplane All the network ports of the boards in the TCA chassis are connected for command control and communication with the equipment control network management. The line board is equipped with an external optical fiber for the line-side 100G optical module, an output interface for the 100G optical module and multiple 10G output optical ports. The 100G output optical module is connected to the 100G optical module input port of the switch board. Two 10G optical modules are connected to the two 10G optical module input ports on the front panel of the x86 board for data collection. The four 10G network ports on the backplane of the switch board are connected to the four 10G network ports on the backplane of the x86 board for data collection. The x86 board collects and analyzes the data according to the polling strategy. The backplane routing interconnects the boards in all slots in the chassis to achieve network port intercommunication.

[0004] The processing method includes demapping structure analysis of 100GOTN signal frame structure and automatic polling channel granularity flow collection analysis. The automatic polling channel granularity flow collection analysis is divided into analysis of 100GE, 10GSDH, and 10GE / 10GGFP flows according to the demapping bearer signal type of 100GOTN.

[0005] 1. 100GOTN signal frame structure demapping analysis. The user controls and sends the MSA base analysis function button. The main control board receives the function instruction and controls the line board to collect and analyze the input line side optical signal to obtain the hierarchical mapping relationship of 100GOTN. The mapping relationship reflects all the fine-grained hierarchical encapsulation. The mapping information is directly entered into the database for maintenance and storage;

[0006] 2. Automatic polling channel granularity traffic collection and analysis: Based on the demapping related information of 100GOTN, it can be concluded whether the current 100GOTN contains the entire 100GE or a combination of 10GSDH, 10GE, and 10GGFP. Different control processes are adopted for traffic of different granularities.

[0007] I) The 100GOTN signal is processed as a whole 100GE. If the frame structure of 100GOTN is demapped to determine that it carries 100GE traffic, then after 100GOTN flows from the line card to the switch card, the switch card uses rules to reduce the speed of the 100GE traffic, and outputs 40GE bandwidth from the ATCA backplane to the 4*10G backplane of the x86 card for traffic processing. The X86 card uses the DPDK framework to collect data at high speed and form pcap packages. The deep packet inspection function module is applied to the collected pcap packages to perform packet analysis on the 100GE collected data to obtain IP five-tuple information, communication protocol information and related payload information. The parsed and processed output information is stored in the database. According to the database IP five-tuple information, after data cleaning and conversion, the national and regional trend statistics, IP proportion statistics, port proportion statistics, and protocol proportion statistics are obtained, reflecting the preliminary data statistical form information in the current 100GE traffic.

[0008] The high-performance DPDK data plane development kit framework is deployed in the x86 board, and secondary development is carried out under the high-speed acquisition framework. The system large page memory is configured, the network card binding is configured, the data acquisition working thread is set, and the generation of the acquisition pcap file is controlled according to the acquisition time and acquisition size.

[0009] The deep packet inspection analysis of the x86 board uses the DPI technology framework to implement custom-developed deep analysis of packets. It can poll and analyze the collected pcap files, parse out the IP five-tuple information according to the Ethernet structure, and classify the proto to mark the current protocol category, such as SIP for VOIP voice protocol and POP for EMAIL mail protocol. At the same time, it can perform a preliminary analysis of the payload of the data packet according to the protocol, and obtain information such as the names of the client and server, the url content in the http protocol, the domain name of the mail, etc. It also counts the number of bytes and traffic of a pair of streams.

[0010] The data cleaning and statistical analysis of deep packet inspection data is to clean and count the data as a whole when the relevant information output by deep packet inspection is stored in the database, develop database cleaning logic functions, and realize statistics such as the proportion of IP information, the proportion of port information, the proportion of protocol information, and the proportion of national and regional trends. It also has a data presentation interface to display it to users for viewing.

[0011] II) The 100GOTN signal includes 10GSDH processing. For the 10GSDH signal demapped and analyzed in 100GOTN, the 10GSDH traffic can be switched and output to the input port of the X86 board according to its time slot position in 100GOTN. The 10GSDH data is collected and output as a raw data byte stream through the high-speed acquisition module. The collected output file enters the SDH frame structure analysis module to obtain the mapping encapsulation structure details of the SDH frame structure. At the same time, the encapsulation containing Ethernet information is directly decapsulated and output as a pcap package. The SDH frame structure information is stored in the database. The decapsulated and output pcap package enters the deep packet inspection module to analyze and output the IP quintuple, protocol, load and other information. The relevant information is entered into the database. Finally, the data is cleaned and converted by the data cleaning and statistics module to obtain national and regional trend statistics, IP share statistics, port share statistics, and protocol share statistics.

[0012] The SDH frame analysis module, for SDH collection information, performs detailed encapsulation analysis and demapping of SDH frame data according to the ITU standard protocol definition of SDH, can identify the current high-order time slot encapsulation and low-order time slot encapsulation, and can mark the encapsulation information such as POS, HDLC, GFP, and E1. At the same time, it can decapsulate the corresponding encapsulation, strip off the Ethernet data carried inside the output, and obtain the corresponding pcap package. If it is the granularity of gfp encapsulation, it can parse the link adjustment information of data LCAS and obtain the grouping results of multiple gfp packets. It can also reorganize and decapsulate the grouped gfp data.

[0013] The high-speed acquisition of the original data of 10GSDH is also processed by the developed acquisition module framework. The pcap package output by 10GSDH analysis is analyzed and processed by the deep packet inspection module to analyze the Ethernet packet and output the relevant information into the database.

[0014] III) 100GOTN signal includes 10GE / 10GGFP processing. For the 10GE traffic obtained by demapping and analysis in the 100GOTN signal, the line card collects the routing switching through the time slot position of the 10GE in 100GOTN, and outputs the 10GE traffic to the x86 card. The x86 card uses the high-speed acquisition function module to collect and store the 10GE traffic to the disk, and obtains the pcap package. Since 10GE is directly a packet protocol, it directly enters the deep packet inspection module to analyze and output the IP quintuple, protocol, load and other information of the data. The relevant information is entered into the database. Finally, the data cleaning and statistical module cleans and converts the data to obtain the national and regional trend statistics, IP share statistics, port share statistics, and protocol share statistics.

[0015] If the granularity carried in 100GOTN is 10GGFP, the 10GGFP will be decapsulated and output as a 10GE packet structure through the line card, and the traffic will be directly imported into the x86 board through optical fiber.

[0016] The technical effect of the present invention is that it can be directly deployed on the rack of the computer room as a server device, can be directly inserted into the fiber access equipment platform of 100GOTN, can collect and analyze the original data frame structure of the 100GOTN signal, obtain the multiplexing granularity and mapping encapsulation type, can collect and deeply analyze the analyzed fine granularity, can collect packet data by reducing the speed according to the rules for the identified 100GE granularity traffic, obtain network user behavior information such as data IP five-tuple through deep packet detection, obtain the statistical distribution information of IP, port, protocol, and direction, complete the function of analyzing and exploring the network data carried in the 100GOTN signal, can bypass the traffic output for statistical analysis of network behavior, and is a high-speed collection and analysis platform for traffic bypass exploration and analysis. It provides a good solution and platform for the growing demand for large-capacity processing of 100GOTN, which allows users to quickly obtain effective information carried in 100GOTN and have a very intuitive understanding and data presentation of data distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a hardware ATCA chassis architecture diagram of the present invention;

[0018] Figure 2 It is a flow chart of automatic polling channel granularity flow collection and analysis of the present invention;

[0019] Figure 3 It is a flowchart of the overall 100GE processing of the 100GOTN signal of the present invention;

[0020] Figure 4 The 100GOTN signal of the present invention includes a 10GSDH processing flow chart;

[0021] Figure 5 The 100GOTN signal of the present invention includes a 10GE / 10GGFP processing flow chart. DETAILED DESCRIPTION

[0022] The present invention will be further described below in conjunction with the accompanying drawings.

[0023] like Figure 1As shown in the figure, the 100GOTN signal processing platform based on the X86 board has an ATCA chassis architecture in its hardware form, including a main control board, a line board, a switch board, and an X86 computing blade. The main control board is connected to all the board network ports in the ATCA chassis through the backplane to perform command control and communicate with the device control network management. The line board is equipped with a line-side 100G optical module external optical fiber, an output interface for the 100G optical module, and multiple 10G output optical ports. The 100G output optical module is connected to the 100G optical module input port of the switch board, and two 10G optical modules are connected to the two 10G optical module input ports on the front panel of the x86 board for data collection. The four 10G network ports on the switch board backplane are connected to the four 10G network ports on the x86 board backplane for data collection. The x86 board collects and analyzes the data according to the polling strategy. The backplane wiring interconnects the boards in all slots in the chassis to achieve network port intercommunication.

[0024] like Figure 2 to Figure 5 As shown, the processing method includes demapping structure analysis of 100GOTN signal frame structure and automatic polling channel granularity flow collection analysis, wherein the automatic polling channel granularity flow collection analysis is further divided into flow analysis of 100GE, 10GSDH, and 10GE / 10GGFP according to the demapping bearer signal type of 100GOTN.

[0025] 1. 100GOTN signal frame structure demapping analysis. The user controls and sends the MSA base analysis function button. The main control board receives the function instruction and controls the line board to collect and analyze the input line side optical signal to obtain the hierarchical mapping relationship of 100GOTN. The mapping relationship reflects all the fine-grained hierarchical encapsulation. The mapping information is directly entered into the database for maintenance and storage;

[0026] 2. Automatic polling channel granularity traffic collection and analysis: Based on the demapping related information of 100GOTN, it can be concluded whether the current 100GOTN contains the entire 100GE or a combination of 10GSDH, 10GE, and 10GGFP. Different control processes are adopted for traffic of different granularities.

[0027] I) The 100GOTN signal is processed as a whole 100GE. If the frame structure of 100GOTN is demapped to determine that it carries 100GE traffic, then after 100GOTN flows from the line card to the switch card, the switch card uses rules to reduce the speed of the 100GE traffic, and outputs 40GE bandwidth from the ATCA backplane to the 4*10G backplane of the x86 card for traffic processing. The X86 card uses the DPDK framework to collect data at high speed and form pcap packages. The deep packet inspection function module is applied to the collected pcap packages to perform packet analysis on the 100GE collected data to obtain IP five-tuple information, communication protocol information and related payload information. The parsed and processed output information is stored in the database. According to the database IP five-tuple information, after data cleaning and conversion, the national and regional trend statistics, IP proportion statistics, port proportion statistics, and protocol proportion statistics are obtained, reflecting the preliminary data statistical form information in the current 100GE traffic.

[0028] The high-performance DPDK data plane development kit framework is deployed in the x86 board, and secondary development is carried out under the high-speed acquisition framework. The system large page memory is configured, the network card binding is configured, the data acquisition working thread is set, and the generation of the acquisition pcap file is controlled according to the acquisition time and acquisition size.

[0029] The deep packet inspection analysis of the x86 board uses the DPI technology framework to implement custom-developed deep analysis of packets. It can poll and analyze the collected pcap files, parse out the IP five-tuple information according to the Ethernet structure, and classify the proto to mark the current protocol category, such as SIP for VOIP voice protocol and POP for EMAIL mail protocol. At the same time, it can perform a preliminary analysis of the payload of the data packet according to the protocol, and obtain information such as the names of the client and server, the url content in the http protocol, the domain name of the mail, etc. It also counts the number of bytes and traffic of a pair of streams.

[0030] The data cleaning and statistical analysis of deep packet inspection data is to clean and count the data as a whole when the relevant information output by deep packet inspection is stored in the database, develop database cleaning logic functions, and realize statistics such as the proportion of IP information, the proportion of port information, the proportion of protocol information, and the proportion of national and regional trends. It also has a data presentation interface to display it to users for viewing.

[0031] II) The 100GOTN signal includes 10GSDH processing. For the 10GSDH signal demapped and analyzed in 100GOTN, the 10GSDH traffic can be switched and output to the input port of the X86 board according to its time slot position in 100GOTN. The 10GSDH data is collected and output as a raw data byte stream through the high-speed acquisition module. The collected output file enters the SDH frame structure analysis module to obtain the mapping encapsulation structure details of the SDH frame structure. At the same time, the encapsulation containing Ethernet information is directly decapsulated and output as a pcap package. The SDH frame structure information is stored in the database. The decapsulated and output pcap package enters the deep packet inspection module to analyze and output the IP quintuple, protocol, load and other information. The relevant information is entered into the database. Finally, the data is cleaned and converted by the data cleaning and statistics module to obtain national and regional trend statistics, IP share statistics, port share statistics, and protocol share statistics.

[0032] The SDH frame analysis module, for SDH collection information, performs detailed encapsulation analysis and demapping of SDH frame data according to the ITU standard protocol definition of SDH, can identify the current high-order time slot encapsulation and low-order time slot encapsulation, and can mark the encapsulation information such as POS, HDLC, GFP, and E1. At the same time, it can decapsulate the corresponding encapsulation, strip off the Ethernet data carried inside the output, and obtain the corresponding pcap package. If it is the granularity of gfp encapsulation, it can parse the link adjustment information of data LCAS and obtain the grouping results of multiple gfp packets. It can also reorganize and decapsulate the grouped gfp data.

[0033] The high-speed acquisition of the original data of 10GSDH is also processed by the developed acquisition module framework. The pcap package output by 10GSDH analysis is analyzed and processed by the deep packet inspection module to analyze the Ethernet packet and output the relevant information into the database.

[0034] III) 100GOTN signal includes 10GE / 10GGFP processing. For the 10GE traffic obtained by demapping and analysis in the 100GOTN signal, the line card collects the routing switching through the time slot position of the 10GE in 100GOTN, and outputs the 10GE traffic to the x86 card. The x86 card uses the high-speed acquisition function module to collect and store the 10GE traffic to the disk, and obtains the pcap package. Since 10GE is directly a packet protocol, it directly enters the deep packet inspection module to analyze and output the IP quintuple, protocol, load and other information of the data. The relevant information is entered into the database. Finally, the data cleaning and statistical module cleans and converts the data to obtain the national and regional trend statistics, IP share statistics, port share statistics, and protocol share statistics.

[0035] If the granularity carried in 100GOTN is 10GGFP, the 10GGFP will be decapsulated and output as a 10GE packet structure through the line card, and the traffic will be directly imported into the x86 board through optical fiber.

Claims

1. A processing method of a 100GOTN signal processing platform based on an X86 board, characterized in that: The hardware form of the 100GOTN signal processing platform is an ATCA chassis architecture, including a main control board, a line board, a switch board, and an X86 computing blade. The main control board is connected to all the board network ports in the ATCA chassis through the backplane to perform command control and communicate with the device control network management. The line board is equipped with a line-side 100G optical module external optical fiber, an output interface for the 100G optical module and multiple 10G output optical ports. The 100G output optical module is connected to the 100G optical module input port of the switch board, and two 10G optical modules are connected to the two 10G optical module input optical ports on the front panel of the x86 board. Data collection: The four 10G network ports on the backplane of the switch board are connected to the four 10G network ports on the backplane of the x86 card for data collection. The x86 card collects and analyzes the data according to the polling strategy. The backplane wiring interconnects the cards in all slots in the chassis to achieve network port intercommunication. The processing module includes the demapping structure analysis of the 100GOTN signal frame structure and the automatic polling channel granularity flow collection and analysis. The automatic polling channel granularity flow collection and analysis is divided into the analysis of 100GE, 10GSDH, and 10GE / 10GGFP flows according to the demapping bearer signal type of 100GOTN.

1. 100GOTN signal frame structure demapping analysis. The user controls and sends the MSA base analysis function button. The main control board receives the function instruction and controls the line board to collect and analyze the input line side optical signal to obtain the hierarchical mapping relationship of 100GOTN. The mapping relationship reflects all the fine-grained hierarchical encapsulation. The mapping information is directly entered into the database for maintenance and storage; 2. Automatic polling channel granularity traffic collection and analysis: Based on the demapping related information of 100GOTN, it can be concluded that the current 100GOTN contains the entire 100GE or a combination of 10GSDH, 10GE, and 10GGFP. Different granularity traffic adopts different control processing procedures. I) The 100GOTN signal is processed as a whole 100GE. If the frame structure of 100GOTN is demapped to determine that it carries 100GE traffic, then after 100GOTN flows from the line card to the switch card, the switch card uses rules to reduce the speed of the 100GE traffic, and outputs 40GE bandwidth from the ATCA backplane to the x86 card's backplane 4*10G for traffic processing. The X86 card uses the DPDK framework to collect data at high speed and form pcap packages. The deep packet inspection function module is applied to the collected pcap packages to perform packet analysis on the 100GE collected data, and obtain IP five-tuple information, communication protocol information, and related payload information. The parsed and processed output information is stored in the database. According to the database IP five-tuple information, after data cleaning and conversion, the national and regional trend statistics, IP share statistics, and port share statistics are obtained. The statistical data and protocol proportion statistical data reflect the preliminary data statistical morphological information of the current 100GE traffic. The high-performance DPDK data plane development kit framework is deployed in the x86 board, and secondary development is carried out under the high-speed acquisition framework. The system large page memory is configured, the network card binding is configured, and the data acquisition work thread is set. The generation of the collected pcap file is controlled according to the acquisition time and size. The deep packet detection analysis of the x86 board adopts the DPI technology framework to realize the custom developed deep analysis of the packet, and the collected pcap file is polled and analyzed. According to the Ethernet structure, the IP five-tuple information is parsed, and the proto is classified and marked in the current protocol category. SIP is the VOIP voice protocol and POP is the EMAIL mail protocol. At the same time, the payload part of the data packet can be preliminarily analyzed according to the protocol to obtain the client The name of the server, the URL content in the http protocol, the domain name information of the email, and the byte count and traffic volume of a pair of streams are counted. The deep packet inspection data is cleaned and statistically analyzed. When the relevant information output by the deep packet inspection is stored in the database, the data is cleaned and statistically analyzed as a whole. The database cleaning logic function is developed to realize the statistics of the proportion of IP information, the proportion of port information, the proportion of protocol information, and the proportion of national and regional trends. It also has a data presentation interface to display it to users for viewing; II) The 100GOTN signal includes 10GSDH processing. For the 10GSDH signal demapped and analyzed in 100GOTN, according to its time slot position in 100GOTN, the 10GSDH traffic is switched and output to the input port of the X86 board. The 10GSDH data is collected and output as a raw data byte stream through the high-speed acquisition module. For the collected output file, it enters the SDH frame structure analysis module to obtain the mapping encapsulation structure details of the SDH frame structure. At the same time, the encapsulation containing Ethernet information is directly decapsulated and output as a pcap package. The SDH frame structure information is stored in the database. The decapsulated output pcap package enters the deep packet inspection module for IP five The tuple, protocol and load information are analyzed and output, and the relevant information is entered into the database. Finally, the data is cleaned and converted by the data cleaning and statistical module to obtain national and regional trend statistics, IP share statistics, port share statistics, and protocol share statistics. Among them, the SDH frame analysis module, based on the SDH collection information, performs detailed encapsulation analysis and demapping of the SDH frame data according to the ITU standard protocol definition of SDH, and can identify the current high-order time slot encapsulation and low-order time slot encapsulation, and can mark the POS, HDLC, GFP, and E1 encapsulation information. At the same time, it can decapsulate the corresponding encapsulation, strip off the Ethernet data carried inside the output, and obtain the corresponding pcap package. If it is g fp encapsulation granularity, parse out the link adjustment information of the data LCAS, obtain the grouping results of multiple gfp, reorganize and decapsulate the grouped gfp data, and the high-speed acquisition of the original data of 10GSDH is also applicable to the developed acquisition module framework for processing. The pcap package output by the 10GSDH analysis uses a deep packet inspection module to analyze and process the Ethernet package and output the relevant information into the database; III) The 100GOTN signal includes 10GE / 10GGFP processing. For the 10GE traffic obtained by the demapping analysis in the 100GOTN signal, the line card collects the routing switching method through the time slot position of the 10GE in 100GOTN to achieve the output of 10GE traffic to x86 card, the x86 card uses the high-speed acquisition function module to collect and store 10GE traffic to the disk, and obtains the pcap package. Since 10GE is directly the protocol of the packet, it directly enters the deep packet inspection module to analyze and output the IP quintuple, protocol and load information of the data, and the relevant information is entered into the database. Finally, the data cleaning and statistical module cleans and converts the data to obtain national and regional trend statistics, IP share statistics, port share statistics, and protocol share statistics. Among them, if the granularity carried in 100GOTN is 10GGFP, the 10GGFP will be decapsulated and output through the line card to output the 10GE packet structure, and the traffic will be directly imported into the x86 card through the optical fiber.

Images