Network flow sampling method, network device and storage medium

Abstract

The embodiment of the present invention provides a network flow sampling method, network device and storage medium, the method comprising: obtaining a sampled message and identifying the sampling template information of the sampled message; if the sampling template information does not match the preset standard template information, the sampled message is allocated to a target virtual processor among multiple virtual processors according to the sampled message and the sampling template information, so that the target virtual processor generates a network flow cache according to the sampled message. If a sampled message whose sampling template information does not match the standard template information is obtained, a unique virtual processor can be determined among multiple virtual processors to process the sampled message according to the sampled message and its sampling template information, so as to prevent multiple virtual processors in the network device from caching the same sampled message.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a network flow sampling method, a network device and a storage medium. Background Art

[0002] The Netflow (RFC3954 standard, such as RFC3954-Cisco Systems NetflowServices Export) protocol is a protocol for counting network traffic information. Therefore, network devices that support the Netflow protocol can collect and analyze messages in the network to achieve management and monitoring purposes. Currently, the central processors of network devices are becoming more and more integrated, that is, multiple virtual processors are integrated on a central processor. Although this has improved the processing speed of network devices to a certain extent, it will lead to the problem of multiple virtual processors caching the same message, causing abnormalities in the message collection and analysis process of network devices. Summary of the invention

[0003] Based on this, an embodiment of the present invention provides a network flow sampling method, a network device and a storage medium to prevent multiple virtual processors in a network device from caching the same message.

[0004] In a first aspect, an embodiment of the present invention provides a network flow sampling method, including:

[0005] Acquire a sampled message, and identify sampling template information of the sampled message;

[0006] Determine whether the sampling template information matches the preset standard template information;

[0007] If the sampling template information does not match the standard template information, the sampling message is allocated to a target virtual processor among multiple virtual processors according to the sampling message and the sampling template information, so that the target virtual processor generates a network flow cache according to the sampling message.

[0008] In a second aspect, an embodiment of the present invention provides a network device, comprising a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program and implement the network flow sampling method as described in the first aspect when executing the computer program.

[0009] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the network flow sampling method as described in the first aspect.

[0010] The embodiment of the present invention provides a network flow sampling method, network device and storage medium, the method comprising: obtaining a sampled message and identifying the sampling template information of the sampled message; if the sampling template information does not match the preset standard template information, the sampled message is allocated to a target virtual processor among multiple virtual processors according to the sampled message and the sampling template information, so that the target virtual processor generates a network flow cache according to the sampled message. If a sampled message whose sampling template information does not match the standard template information is obtained, a unique virtual processor can be determined among multiple virtual processors to process the sampled message according to the sampled message and its sampling template information, so as to prevent multiple virtual processors in the network device from caching the same sampled message. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of an optional application scenario of each embodiment of the present invention;

[0012] Figure 2 A schematic diagram of a flow chart of a network flow sampling method provided by an embodiment of the present invention;

[0013] Figure 3 A schematic diagram of a flow chart of determining a target virtual processor and allocating a sampled message to the target virtual processor in step S120 in an embodiment of the present invention;

[0014] Figure 4 A schematic diagram of a flow chart of determining an actual index value in step S121 in an embodiment of the present invention;

[0015] Figure 5 Another schematic diagram of a flow chart of a network flow sampling method provided by an embodiment of the present invention;

[0016] Figure 6 A schematic block diagram of the structure of a network device provided by an embodiment of the present invention;

[0017] Figure 7 for Figure 6 A schematic diagram of a flow chart of a network device applying an embodiment of the present invention;

[0018] Figure 8 A schematic block diagram of the structure of a network device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0020] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0021] In conjunction with the accompanying drawings, some implementation methods of this specification are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0022] The network flow sampling method in the embodiment of the present invention can be used for Figure 1 The network device shown includes a physical processor 10, i.e., a CPU, on which multiple virtual processors 20, i.e., VCPUs, are integrated, which may also be referred to as cores. Exemplarily, the network device includes a physical processor 10, on which eight virtual processors 20 are integrated, and of course, two, four, six, ten, or other numbers of virtual processors 20 may also be integrated.

[0023] In some embodiments, the network device can support the Netflow protocol, such as the Netflow V9 (Version 9) protocol, so the network device can collect messages in the network and generate a corresponding network flow cache, i.e., a Netflow cache, so that the network device or other traffic collection devices can perform further analysis and processing to achieve management and monitoring purposes. In some embodiments, the network device is provided with multiple network ports, each of which can receive or forward network data, so the network device can collect messages in the network through any network port. In some embodiments, the network device can assign the collected messages to a virtual processor, which obtains the assigned messages and generates a network flow cache. It can be understood that the method in the embodiment of the present invention can be executed by any virtual processor.

[0024] The network flow sampling method provided by the embodiment of the present invention is used for a network device, wherein the network device includes a plurality of virtual processors, such as Figure 2 As shown, the method includes but is not limited to steps S110 to S130.

[0025] Step S110: acquiring a sampled message and identifying sampling template information of the sampled message.

[0026] In some implementations, after the network device collects the sampled message at any network port, it can use a hardware allocation strategy to allocate the sampled message to the corresponding virtual processor according to the preset standard template information. In some implementations, after the virtual processor obtains the sampled message, it can identify the sampling template information by parsing the sampled message.

[0027] In some implementations, the sampling template information may indicate which fields the sampling message is configured according to, so the sampling template information may include several configuration fields, such as the sampling template information may include one or more fields in a five-tuple. It should be noted that the five-tuple includes five fields, namely, source IP address, source port, destination IP address, destination port, and transport layer protocol. Exemplarily, if the sampling message is configured according to the source IP address, source port, destination IP address, and destination port, the identified sampling template information includes these four configuration fields.

[0028] In some embodiments, step S110 includes but is not limited to the following.

[0029] Get the sampled message and determine whether the sampled message is a message sent on the network.

[0030] If the sampled message is a message sent on the network, the sampling template information of the sampled message is identified.

[0031] In some implementations, if the sampled message is a message sent on the network, it means that the sampled message obtained by the virtual processor is a message collected by the network device, and the sampling template information of the sampled message needs to be identified to perform further processing according to the sampling template information. In some implementations, if the sampled message is not a message sent on the network, it means that the sampled message obtained by the virtual processor is a message reallocated by any virtual processor, and no further processing is required, and the network flow cache can be directly generated according to the sampled message.

[0032] Step S120, determining whether the sampling template information matches the preset standard template information.

[0033] Step S130: if the sampling template information does not match the standard template information, the sampling message is allocated to a target virtual processor among the multiple virtual processors according to the sampling message and the sampling template information, so that the target virtual processor generates a network flow cache according to the sampling message.

[0034] In some implementations, after collecting the sampled message, the network device may adopt a hardware allocation strategy and allocate the sampled message to a corresponding virtual processor according to preset standard template information.

[0035] In some implementations, the virtual processor can determine whether the sampling template information matches the standard template information to make corresponding processing. If the sampling template information matches the standard template information, it can be explained that the sampled message is configured according to the standard field in the standard template information, so the network device assigns the sampled message to the correct virtual processor for processing, that is, the virtual processor can generate a network flow cache based on the sampled message. However, if the sampling template information does not match the standard template information, it means that the sampled message is not completely configured according to the standard field in the standard template information, so the sampled message may be assigned to the wrong virtual processor for processing, which may cause the problem of multiple virtual processors caching the same message, causing the network device to be abnormal during the message collection and analysis process. Based on this, if it is determined that the sampling template information does not match the standard template information, the virtual processor can reallocate the sampled message to a correct virtual processor, that is, the target virtual processor, based on the sampling message and the sampling template information. It can be understood that for the same sampled message, its sampling template information is naturally the same, so the virtual processor can assign the same sampled message to the same virtual processor, so there will be no problem of multiple virtual processors caching the same sampled message.

[0036] In some embodiments, if the target virtual processor is another virtual processor, the virtual processor can reallocate the sampled message to the target virtual processor so that the target virtual processor generates a network flow cache based on the sampled message; if the target virtual processor is the virtual processor itself, the virtual processor can reallocate the sampled message to itself and generate a network flow cache, or it can directly generate a network flow cache based on the sampled message.

[0037] In some embodiments, step S120 includes but is not limited to the following.

[0038] If the configuration fields in the sampling template information do not completely include the standard fields in the standard template information, it is determined that the sampling template information does not match the standard template information.

[0039] In some implementations, the sampling template information includes several configuration fields, and the standard template information also includes several standard fields. If the configuration fields in the sampling template information completely include the standard fields in the standard template information, then it is determined that the sampling template information matches the standard template information; if the configuration fields in the sampling template information do not completely include the standard fields in the standard template information, such as only a portion of them, then it is determined that the sampling template information does not match the standard template information, and therefore the virtual processor needs to perform further processing.

[0040] Exemplarily, assuming that the standard template information includes the five fields of the quintuple, if the sampling template information of the sampled message includes the five fields, it is determined that the sampling template information matches the standard template information, so the current virtual processor can directly generate a network flow cache based on the sampled message; if the sampling template information of the sampled message does not completely include the five fields, for example, it only includes the source IP address, source port, destination IP address and destination port, it is determined that the sampling template information does not match the standard template information, so the current virtual processor can allocate the sampled message to the target virtual processor based on the sampled message and the sampling template information.

[0041] In some embodiments, Figure 3 As shown, step S120 includes but is not limited to steps S121 to S123.

[0042] Step S121, determining an actual index value according to the sampling message and the sampling template information.

[0043] Step S122: determining one of the multiple virtual processors as a target virtual processor according to the actual index value.

[0044] Step S123: distribute the sampled message to the target virtual processor.

[0045] In some implementations, an index value can be set for each virtual processor. For example, if the network device is integrated with four virtual processors, an index value can be set for each virtual processor, such as virtual processors 1, 2, 3, and 4. In some implementations, an actual index value can be determined based on the sampled message and the sampling template information, and the target virtual processor can be determined based on the actual index value, that is, the index value of the target virtual processor corresponds to the actual index value. It can be understood that for the same sampled message, its sampling template information is naturally the same, so the actual index value determined is unique, that is, the same sampled message will be assigned to the same virtual processor, so there will be no problem of multiple virtual processors caching the same message.

[0046] Exemplarily, assuming that the network device is integrated with virtual processors 1, 2, 3, and 4, when virtual processor 1 obtains the sampled message and identifies the sampled template information, assuming that the sampled template information does not match the standard template information, virtual processor 1 can determine an actual index value based on the sampled template and the sampled template information. For example, if the actual index value is 2, it can be determined that the target virtual processor is virtual processor 2, so virtual processor 1 can assign the sampled message to virtual processor 2, so that virtual processor 2 generates a network flow cache based on the sampled message. It can be understood that for the same sampled message, virtual processor 1 can assign such sampled message to virtual processor 2, so there will be no problem of multiple virtual processors caching the same message.

[0047] In some embodiments, Figure 4 As shown, step S121 includes but is not limited to steps S124 to S126.

[0048] Step S124: determine the fields commonly included in the sampling template information and the standard template information as the same fields.

[0049] Step S125, obtaining the field value corresponding to the same field in the sampled message;

[0050] Step S126, determining the actual index value according to the field value.

[0051] In some implementations, if the sampling template information does not match the standard template information, the configuration field in the sampling template information and the standard field in the standard template information may have several identical fields. The virtual processor can then determine these identical fields and obtain field values ​​corresponding to these identical fields in the sampling message. Based on this, the virtual processor can determine the actual index value according to these field values.

[0052] In some embodiments, step S126 includes but is not limited to the following.

[0053] Perform a hash operation on the field value to obtain the actual index value.

[0054] In some implementations, after obtaining several field values ​​in the sampled message, the virtual processor may perform a hash operation on the field values, and determine an actual index value based on the result of the hash operation, for example, by modulo or rounding the numerical range of the result of the hash operation, etc., to obtain an actual index value.

[0055] Exemplarily, it is assumed that the standard template information includes five fields corresponding to the five-tuple, and the sampling template information includes only one field in the five-tuple, such as only the source IP address; or, the sampling template information includes only two fields in the five-tuple, such as only the source IP address and the destination IP address; or, the sampling template information includes only four fields in the five-tuple, such as only the source IP address, the source port, the destination IP address, and the destination port. Based on this, the fields included in the sampling template information and the standard template information can be determined, such as the same fields are the source IP address and the destination IP address, so the field values ​​corresponding to the same fields in the sampling message can be obtained, such as obtaining the two field values ​​corresponding to the source IP address and the destination IP address, so that several field values ​​can be hashed to obtain an actual index value.

[0056] In some embodiments, Figure 5 As shown, the method may also include but is not limited to step S140.

[0057] Step S140: if the sampling template information does not match the standard template information, the sampled message is set as a non-network-sent message, so that the target virtual processor can determine that the sampled message is a non-network-sent message when acquiring the sampled message and directly generate a network flow cache according to the sampled message.

[0058] In some implementations, if it is determined that the sampling template information does not match the standard template information, the sampling message can be set as a non-network-sent message. In this way, when the target virtual processor obtains the sampling message, it can determine that the sampling message is a non-network-sent message, that is, the sampling message is a message reallocated by any virtual processor. Therefore, the target virtual processor can directly generate a network flow cache based on the sampling message, thereby improving processing efficiency.

[0059] Based on the above discussion, the embodiments of the present invention can be used for Figure 6 The network device shown in the figure includes at least one physical processor 10, on which four virtual processors 20 are integrated, and each of the four virtual processors 20 is provided with an index value, namely, virtual processors 1, 2, 3, and 4; the network device includes at least one network port 30, of which only one port is schematically drawn in the figure. In addition, it is assumed that the preset standard template information includes five fields corresponding to the five-tuple.

[0060] Based on this, Figure 7 As shown, when the network device collects sampled messages from the network port 30, the sampled messages can be allocated to the corresponding virtual processors using the hardware allocation strategy and according to the standard template information, that is, Figure 7In some embodiments, after the virtual processor X obtains the sampled message, it can be determined whether the sampled message is a message sent on the network. If it is a message sent on the network, the sampling template information of the sampled message is identified; if it is a message not sent on the network, the virtual processor X directly generates a network flow cache according to the sampled message. In some embodiments, after identifying the sampling template information, it can be determined whether the sampling template information matches the standard template information, that is, it is determined whether the configuration field in the sampling template completely includes the standard field in the standard template information. If the configuration field in the sampling template information does not completely include the standard field in the standard template information, such as the sampling template information only includes part of the fields in the five-tuple, the virtual processor X needs to perform further allocation processing; if the configuration field in the sampling template information completely includes the standard field in the standard template information, that is, the sampling template information completely includes the five-tuple, the virtual processor X directly generates a network flow cache according to the sampled message. In some embodiments, if it is determined that the virtual processor X needs to perform further allocation processing, the sampled message is set from a message sent on the network to a message not sent on the network. In some embodiments, if it is determined that virtual processor X needs to be further allocated, the same fields included in the sampling template information and the standard template information are determined, such as the same fields included in the source IP address, source port, destination IP address and destination port, so that the field values ​​corresponding to the four same fields in the sampled message can be obtained, such as the field value corresponding to the source IP address is 192.168.1.1, so that the four field values ​​can be hashed to obtain an actual index value, such as the actual index value is 2. Therefore, it can be determined that the target virtual processor is 2, and virtual processor X can allocate the sampled message to virtual processor 2. In some embodiments, after virtual processor 2 obtains the sampled message, since the obtained sampled message is not a message sent on the network, a network flow cache is directly generated according to the sampled message. It can be understood that the same sampled message as the above naturally has the same sampling template information, so virtual processor X will allocate this sampled message to virtual processor 2, so there will be no problem of multiple virtual processors caching the same message.

[0061] The embodiment of the present invention also provides a network device, such as Figure 8 As shown, it includes a processor 41 and a memory 42, the memory 42 is used to store computer programs; the processor 41 is used to execute the computer program and implement any network flow sampling method provided by the embodiments of the present invention when executing the computer program.

[0062] It should be understood that the processor 41 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0063] An embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements any network flow sampling method provided by the embodiment of the present invention.

[0064] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable storage medium, which may include a computer-readable storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0065] As is known to those of ordinary skill in the art, the term computer-readable storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium.

[0066] Exemplarily, the computer-readable storage medium may be an internal storage unit of the network device described in the foregoing embodiments, such as a hard disk or memory of the network device. The computer-readable storage medium may also be an external storage device of the network device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the network device.

[0067] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network flow sampling method, comprising: Acquire a sampled message, and identify sampling template information of the sampled message; Determine whether the sampling template information matches the preset standard template information; If the sampling template information does not match the standard template information, the sampling message is allocated to a target virtual processor among multiple virtual processors according to the sampling message and the sampling template information, so that the target virtual processor generates a network flow cache according to the sampling message.

2. The network flow sampling method according to claim 1, characterized in that: If the sampling template information does not match the standard template information, it includes: If the configuration fields in the sampling template information do not completely include the standard fields in the standard template information, it is determined that the sampling template information does not match the standard template information.

3. The network flow sampling method according to claim 1, characterized in that: The allocating the sampled message to a target virtual processor among the multiple virtual processors according to the sampled message and the sampling template information includes: Determine an actual index value according to the sampling message and the sampling template information; Determine one of the plurality of virtual processors as a target virtual processor according to the actual index value; The sampled message is allocated to the target virtual processor.

4. The network flow sampling method according to claim 3, characterized in that: The determining the actual index value according to the sampling message and the sampling template information includes: Determine the fields commonly included in the sampling template information and the standard template information as the same fields; Obtaining a field value corresponding to the same field in the sampled message; The actual index value is determined according to the field value.

5. The network flow sampling method according to claim 4, characterized in that: The determining the actual index value according to the field value includes: A hash operation is performed on the field value to obtain the actual index value.

6. The network flow sampling method according to claim 1, characterized in that: The method further comprises: If the sampling template information does not match the standard template information, the sampled message is set as a non-network-sent message, so that the target virtual processor can determine that the sampled message is a non-network-sent message when acquiring the sampled message and directly generate a network flow cache according to the sampled message.

7. The network flow sampling method according to claim 1, characterized in that: The acquiring of the sampled message and identifying the sampling template information of the sampled message includes: Obtain a sampled message, and determine whether the sampled message is a message sent on the network; If the sampled message is a message sent on a network, the sampling template information of the sampled message is identified.

8. A network device, characterized in that: including a processor and a memory; The memory is used to store computer programs; The processor is configured to execute the computer program and implement the network flow sampling method according to any one of claims 1 to 7 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the network flow sampling method according to any one of claims 1 to 7.

Images