A flow sampling method, device, system, electronic equipment and medium

Abstract

The embodiment of the present application provides a flow sampling method, device, system, electronic device and medium, and relates to the field of data communication technology. The technical solution of the embodiment of the present application includes: the network device obtains the state parameters of each forwarding port through a hardware chip, wherein the state parameters are used to indicate the congestion degree of the forwarding port. Then, the hardware chip determines the forwarding state of each forwarding port based on the state parameters of the forwarding port. If there is a target forwarding port whose forwarding state is a congested state, a congestion alarm message is sent to the collection controller. Among them, the congestion alarm message is used to instruct the collection controller to notify the specified network device to increase the detection sampling rate of the target flow passing through the target forwarding port. Thereby, the measurement accuracy is improved while taking into account resource consumption.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a flow sampling method, device, system, electronic equipment and medium. Background Art

[0002] Sampling and testing the service flow can analyze the transmission conditions such as packet loss and delay of the service flow, so as to determine the network status and service level. Currently, the service flow is usually sampled at a fixed sampling rate.

[0003] Take the sampling detection method of flow measurement as an example. Figure 1 As shown, Figure 1 PE1 and PE2 as well as P1-P4 are all network devices that forward traffic. PE1 is connected to customer network 1, and PE2 is connected to customer network 2. When the measured traffic reaches PE1 from the customer network on the left, PE1 selects the sampled traffic according to a fixed sampling rate, and inserts measurement information into the Internet Protocol (IP) message header of the sampled traffic, and then forwards the sampled traffic carrying the measurement information to the next detection device. When the sampled traffic subsequently passes through other detection devices, the other detection devices will also insert their own detection measurement information into the IP message header of the sampled traffic, until the sampled traffic passes through PE2, PE2 reports all the measurement information to the analyzer together. Alternatively, each detection device through which the sampled traffic passes can report its own measurement information to the analyzer separately.

[0004] However, if the adoption rate is set too high, for example, all traffic passing through the first detection device is used as sampled traffic, it will consume too much processing and storage resources of the detection device, making the detection device's forwarding efficiency of traffic lower, resulting in reduced network performance, and the massive amount of measurement data will also consume a lot of processing and storage resources of the analyzer. Conversely, too low a sampling rate will result in too few periods of measurement data, and important measurement data may not be detected. For example, when the detection device is briefly congested, it is likely that no sampled traffic passes through, so no measurement data is obtained. Therefore, the measurement accuracy is low and cannot reflect the true status and service level of the network. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide a flow sampling method, device, system, electronic device and medium to improve measurement accuracy while taking into account resource consumption. The specific technical solution is as follows:

[0006] In a first aspect of an embodiment of the present application, a traffic sampling method is provided, which is applied to a network device. The method includes:

[0007] Acquiring a state parameter of each forwarding port through a hardware chip, wherein the state parameter is used to indicate a congestion degree of the forwarding port;

[0008] Determining the forwarding state of each forwarding port based on the state parameter of the forwarding port by the hardware chip;

[0009] If there is a target forwarding port whose forwarding state is a congested state, a congestion alarm message is sent to the collection controller; the congestion alarm message is used to instruct the collection controller to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0010] Optionally, the state parameter includes: a port flow count value and / or a port output queue length, wherein the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, and the port output queue length is a total flow size to be forwarded by the forwarding port;

[0011] The step of determining the forwarding state of the forwarding port based on the state parameter of the forwarding port includes:

[0012] For the forwarding port, if the traffic count difference between the port traffic count value read this time and the port traffic count value read last time meets the first preset condition, or the port output queue length read this time meets the second preset condition, or the traffic count difference meets the first preset condition and the port output queue length read this time meets the second preset condition, then it is determined that the forwarding state of the forwarding port is a congested state;

[0013] Otherwise, it is determined that the forwarding state of the forwarding port is a normal state.

[0014] Optionally, the first preset condition is: the flow count difference is greater than or equal to a first preset threshold; or, the port flow rate is greater than or equal to a second preset threshold, and the port flow rate is the ratio between the flow count difference and the reading time interval of the port flow count value; or, the port utilization is greater than or equal to a third preset threshold, and the port utilization is the ratio between the port flow rate and the rated bandwidth;

[0015] The second preset condition is: the port output queue length read this time is greater than or equal to the fourth preset threshold; or, the port output queue buffer occupancy is greater than or equal to the fifth preset threshold, and the port output queue buffer occupancy is the ratio between the port output queue length read this time and the maximum output queue.

[0016] Optionally, if there is a target forwarding port whose forwarding state is a congested state, a congestion alarm message is sent to the collection controller, including:

[0017] If there is a target forwarding port whose forwarding state is a congested state, and the target forwarding port is in the congested state for a specified period of time, the congestion alarm message is sent to the acquisition controller.

[0018] Optionally, after sending the congestion alarm message to the acquisition controller, the method further includes:

[0019] If the target forwarding port is converted from a congested state to a normal state, a congestion relief message is sent to the collection controller; wherein the congestion relief message is used to instruct the collection controller to notify the designated network device to reduce the detection sampling rate of the target traffic.

[0020] Optionally, the designated network device is a head node through which the target traffic passes in a flow detection network, and the target traffic is service traffic that needs to be forwarded by the target forwarding port; or,

[0021] The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0022] The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

[0023] A second aspect of the embodiment of the present application provides a flow sampling method, which is applied to a collection controller, and the method includes:

[0024] Receiving a congestion warning message sent by a target network device; the congestion warning message is a message sent by the target network device when, based on the status parameters of each forwarding port, the hardware chip detects that there is a target forwarding port whose forwarding state is a congested state;

[0025] In response to the congestion alarm message, a first notification message is sent to a designated network device, where the first notification message is used to notify the designated network device to increase a detection sampling rate of target traffic passing through the target forwarding port.

[0026] Optionally, before sending the first notification message to the designated network device, the method further includes:

[0027] Obtaining the pre-recorded forwarding port of the network device through which each measured flow passes; or, according to the source address and destination address of the measured flow, determining the forwarding port of the network device through which the measured flow passes;

[0028] According to the forwarding port of the network device through which the measured traffic passes, the target traffic passing through the target forwarding port is screened out from the measured traffic;

[0029] The network device that samples the target traffic is determined as the designated network device.

[0030] Optionally, after sending the first notification message to the designated network device, the method further includes:

[0031] Receiving a congestion relief message sent by the target network device, wherein the congestion relief message is a message sent by the target network device when detecting that the target forwarding port is converted from a congested state to a normal state;

[0032] In response to the congestion relief message, a second notification message is sent to the designated network device, where the second notification message is used to notify the designated network device to reduce a detection adoption rate for the target traffic.

[0033] Optionally, in response to the congestion relief message, sending a second notification message to the designated network device includes:

[0034] In response to the congestion relief message, after waiting for a preset period of time, the second notification message is sent to the designated network device.

[0035] Optionally, before sending the first notification message to the designated network device, the method further includes:

[0036] Determine whether the current detection sampling rate of the designated network device for the target traffic has been increased; if not, execute the step of sending the first notification message to the designated network device;

[0037] Before sending the second notification message to the designated network device, the method further includes:

[0038] Determine whether the forwarding ports of each network device through which the target traffic passes are all in normal status; if so, execute the step of sending the second notification message to the designated network device.

[0039] Optionally, the designated network device is a head node through which the target traffic passes in a flow detection network, and the target traffic is service traffic that needs to be forwarded by the target forwarding port; or,

[0040] The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0041] The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

[0042] A third aspect of the embodiments of the present application provides a flow sampling device, which is applied to a network device, and the device includes:

[0043] An acquisition module, used for acquiring a state parameter of each forwarding port through a hardware chip, wherein the state parameter is used for indicating a congestion degree of the forwarding port;

[0044] A determination module, configured to determine, through the hardware chip, for each forwarding port, the forwarding state of the forwarding port based on the state parameter of the forwarding port acquired by the acquisition module;

[0045] The sending module is used to send a congestion alarm message to the collection controller if there is a target forwarding port whose forwarding state is a congested state; the congestion alarm message is used to instruct the collection controller to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0046] Optionally, the state parameter includes: a port flow count value and / or a port output queue length, wherein the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, and the port output queue length is a total flow size to be forwarded by the forwarding port;

[0047] The determination module is specifically used to: for the forwarding port, if the traffic count difference between the port traffic count value read this time and the port traffic count value read last time meets the first preset condition, or the port output queue length read this time meets the second preset condition, or the traffic count difference meets the first preset condition and the port output queue length read this time meets the second preset condition, then determine that the forwarding state of the forwarding port is a congested state;

[0048] Otherwise, it is determined that the forwarding state of the forwarding port is a normal state.

[0049] Optionally, the first preset condition is: the flow count difference is greater than or equal to a first preset threshold; or, the port flow rate is greater than or equal to a second preset threshold, and the port flow rate is the ratio between the flow count difference and the reading time interval of the port flow count value; or, the port utilization is greater than or equal to a third preset threshold, and the port utilization is the ratio between the port flow rate and the rated bandwidth;

[0050] The second preset condition is: the port output queue length read this time is greater than or equal to the fourth preset threshold; or, the port output queue buffer occupancy is greater than or equal to the fifth preset threshold, and the port output queue buffer occupancy is the ratio between the port output queue length read this time and the maximum output queue.

[0051] Optionally, the sending module is specifically used to:

[0052] If there is a target forwarding port whose forwarding state is a congested state, and the target forwarding port is in the congested state for a specified period of time, the congestion alarm message is sent to the acquisition controller.

[0053] Optionally, the sending module is also used to send a congestion relief message to the collection controller after sending a congestion alarm message to the collection controller, if the target forwarding port is converted from a congested state to a normal state; wherein the congestion relief message is used to instruct the collection controller to notify the designated network device to reduce the detection sampling rate of the target traffic.

[0054] Optionally, the designated network device is a head node through which the target traffic passes in a flow detection network, and the target traffic is service traffic that needs to be forwarded by the target forwarding port; or,

[0055] The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0056] The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

[0057] In a fourth aspect of the embodiments of the present application, a flow sampling device is provided, which is applied to a collection controller, and the device includes: a receiving module and a sending module;

[0058] A receiving module, used for receiving a congestion warning message sent by a target network device; the congestion warning message is a message sent by the target network device when the hardware chip detects that there is a target forwarding port whose forwarding state is congested based on the state parameters of each forwarding port;

[0059] The sending module is used to send a first notification message to a designated network device in response to the congestion alarm message received by the receiving module, wherein the first notification message is used to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0060] Optionally, the device further comprises:

[0061] An acquisition module, used for acquiring, before sending the first notification message to the designated network device, the pre-recorded forwarding port of the network device through which each measured flow passes; or, according to the source address and destination address of the measured flow, determining the forwarding port of the network device through which the measured flow passes;

[0062] A screening module, used for screening target traffic passing through the target forwarding port from the measured traffic according to the forwarding port of the network device through which the measured traffic passes;

[0063] The determination module is used to determine the network device that samples the target traffic as the designated network device.

[0064] Optionally, the receiving module is further used to receive a congestion relief message sent by the target network device after sending the first notification message to the designated network device, wherein the congestion relief message is a message sent by the target network device when detecting that the target forwarding port is converted from a congested state to a normal state;

[0065] The sending module is further used to send a second notification message to the designated network device in response to the congestion relief message received by the receiving module, wherein the second notification message is used to notify the designated network device to reduce the detection adoption rate of the target traffic.

[0066] Optionally, the sending module is specifically used to:

[0067] In response to the congestion relief message, after waiting for a preset period of time, the second notification message is sent to the designated network device.

[0068] Optionally, the device further comprises:

[0069] A judging module, used for judging whether the detection sampling rate of the target traffic of the designated network device has been increased before sending the first notification message to the designated network device; if not, calling the sending module to execute the step of sending the first notification message to the designated network device;

[0070] The judgment module is also used to judge whether the forwarding ports of each network device through which the target traffic passes are all in normal state before sending the second notification message to the designated network device. If so, calling the sending module to execute the step of sending the second notification message to the designated network device.

[0071] Optionally, the designated network device is a head node through which the target traffic passes in a flow detection network, and the target traffic is service traffic that needs to be forwarded by the target forwarding port; or,

[0072] The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0073] The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

[0074] In a fifth aspect of the embodiments of the present application, a flow sampling system is provided, the system comprising: a plurality of network devices and a collection controller, each network device being connected to the collection controller;

[0075] The network device is used to execute the traffic sampling method described in any one of the first aspects;

[0076] The acquisition controller is used to execute the flow sampling method described in any one of the second aspects.

[0077] According to a sixth aspect of the embodiments of the present application, an electronic device is provided, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0078] Memory, used to store computer programs;

[0079] The processor is used to implement the flow sampling method steps described in any one of the first aspect or the second aspect when executing the program stored in the memory.

[0080] A seventh aspect of an embodiment of the present application provides a computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the flow sampling method steps described in any one of the first aspect or the second aspect are implemented.

[0081] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above-described flow sampling methods.

[0082] Beneficial effects of the embodiments of the present application:

[0083] The flow sampling method, device, system, electronic device and medium provided by the embodiment of the present application, the network device can read the state parameters of each forwarding port through the built-in hardware chip, and judge whether each forwarding port is in a congested state. In the case of a target forwarding port in a congested state, a congestion alarm message is sent to the acquisition controller, so that the acquisition controller notifies the designated network device to increase the detection sampling rate of the target flow through the target forwarding port. Because the embodiment of the present application can increase the sampling rate of the flow through the forwarding port when the forwarding port of the network device is congested, so that the designated network device uses the increased detection sampling rate to sample the target flow, avoids the problem that the flow through the forwarding port is not measured when the forwarding port is temporarily congested, resulting in the inability to detect the congestion of the forwarding port, and can improve the measurement accuracy when the forwarding port is congested. Moreover, the embodiment of the present application is to flexibly increase the sampling rate when the forwarding port is congested, rather than using a higher sampling rate all the time, so that smaller resource consumption can be guaranteed. Therefore, the embodiment of the present application realizes the improvement of measurement accuracy on the basis of taking into account resource consumption, so that the measurement result can better reflect the real state and service level of the network.

[0084] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0086] Figure 1 It is a structural schematic diagram of a flow detection system in the related art;

[0087] Figure 2 A schematic diagram of the structure of a flow sampling system provided in an embodiment of the present application;

[0088] Figure 3 A flow chart of a flow sampling method provided in an embodiment of the present application;

[0089] Figure 4 An exemplary schematic diagram of the interaction process between a network device and a collection controller provided in an embodiment of the present application;

[0090] Figure 5 A flow chart of another flow sampling method provided in an embodiment of the present application;

[0091] Figure 6A flow chart of a method for determining a specified network device provided in an embodiment of the present application;

[0092] Figure 7 A schematic diagram of the structure of another flow sampling system provided in an embodiment of the present application;

[0093] Figure 8 A flow chart of another flow sampling method provided in an embodiment of the present application;

[0094] Fig. 9 A schematic diagram of the structure of a flow sampling device provided in an embodiment of the present application;

[0095] Fig.10 A schematic diagram of the structure of another flow sampling device provided in an embodiment of the present application;

[0096] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0097] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field based on this application belong to the scope of protection of the present invention.

[0098] The flow sampling method provided in the embodiment of the present application can be applied to a flow sampling system, such as Figure 2 As shown, the system includes: multiple network devices 201 and a collection controller 202, each network device 201 is connected to the collection controller 202, and the network devices 201 can be connected to each other according to networking requirements.

[0099] The network device 201 is used to forward traffic. The network device 201 may be a device such as a router or a switch that can forward traffic.

[0100] The collection controller 202 is used to manage the sampling rate of each flow. The collection controller 202 can be a server or other equipment capable of data processing and message receiving and sending.

[0101] Figure 2 This is an example provided in an embodiment of the present application, and the number of devices in the flow sampling system is not limited thereto.

[0102] In order to improve the measurement accuracy while taking into account resource consumption, the present application embodiment provides a flow sampling method, which is applied to Figure 2 The network devices shown are Figure 3 As shown, the method comprises the following steps:

[0103] S301. Obtain status parameters of each forwarding port through a hardware chip.

[0104] Among them, the state parameter is used to indicate the congestion degree of the forwarding port. That is, the state parameter can indicate the busyness of the forwarding port, that is, the load of the forwarding port. For example, the state parameter is the amount of traffic forwarded by the forwarding port per unit time. The larger the traffic forwarded per unit time, the higher the load of the forwarding port, and therefore the higher the congestion degree; conversely, the smaller the traffic forwarded per unit time, the lower the load of the forwarding port, and therefore the lower the congestion degree.

[0105] In the embodiment of the present application, the hardware chip built into the network device can periodically read the status parameters of each forwarding port in the network device.

[0106] S302: Determine the forwarding state of each forwarding port through a hardware chip based on the state parameters of the forwarding port.

[0107] In the embodiment of the present application, the forwarding state of the forwarding port can be a normal state or a congested state, wherein the congested state indicates that the congestion level of the forwarding port is high, that is, the load of the forwarding port is high. Conversely, the normal state indicates that the congestion level of the forwarding port is low, that is, the load of the forwarding port is low.

[0108] Optionally, the forwarding state of the forwarding port can be determined by comparing the size relationship between the state parameter and a preset threshold value. For example, when the amount of traffic forwarded per unit time of the forwarding port is greater than or equal to the preset threshold value, the forwarding state of the forwarding port is determined to be a congested state; when the amount of traffic forwarded per unit time of the forwarding port is less than the preset threshold value, the forwarding state of the forwarding port is determined to be a normal state.

[0109] S303: If there is a target forwarding port whose forwarding state is a congested state, a congestion alarm message is sent to the collection controller.

[0110] The congestion alarm message is used to instruct the collection controller to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0111] In an embodiment of the present application, if there is a target forwarding port whose forwarding state is a congested state, the hardware chip can send congestion information to the central processing unit (CPU) of the network device to notify the CPU that the target forwarding port is in a congested state, for example, the congestion information includes the port identity identification number (Identity document, ID) of the target forwarding port. The CPU can send a congestion alarm message to the acquisition controller. The congestion alarm message carries the port ID of the target forwarding port and the device ID of the network device.

[0112] After receiving the congestion alarm message, the collection controller determines the target flow passing through the target forwarding port of the network device, and determines the designated network device for sampling the target flow. Then, a first notification message is sent to the designated network device to notify the designated network device to increase the detection sampling rate of the target flow, so that the designated network device uses the increased detection sampling rate to sample the target flow.

[0113] In the flow sampling method provided by the embodiment of the present application, the network device can read the state parameters of each forwarding port through the built-in hardware chip, and judge whether each forwarding port is in a congested state. In the case of a target forwarding port in a congested state, a congestion alarm message is sent to the collection controller, so that the collection controller notifies the designated network device to increase the detection sampling rate of the target flow through the target forwarding port. Because the embodiment of the present application can increase the sampling rate of the flow through the forwarding port when the forwarding port of the network device is congested, so that the designated network device uses the increased detection sampling rate to sample the target flow, avoids not measuring the flow through the forwarding port when the forwarding port is temporarily congested, resulting in the problem that the forwarding port cannot be detected, and can improve the measurement accuracy when the forwarding port is congested. Moreover, the embodiment of the present application is to flexibly increase the sampling rate when the forwarding port is congested, rather than using a higher sampling rate all the time, so that smaller resource consumption can be guaranteed. Therefore, the embodiment of the present application realizes the improvement of measurement accuracy on the basis of taking into account resource consumption, so that the measurement result can better reflect the real state and service level of the network.

[0114] In one embodiment of the present application, the state parameters of the forwarding port include: port traffic count value and / or port output queue length. The port traffic count value is the cumulative value of the traffic size forwarded by the forwarding port, and the port output queue length is the total traffic size to be forwarded by the forwarding port.

[0115] like Figure 4 As shown, in the embodiment of the present application, the network device includes a hardware chip, a CPU and n forwarding ports, each forwarding port includes a flow counter and / or a memory, Figure 4The flow counter or memory of port 1, the flow counter or memory of port 2 and the flow counter or memory of port n are exemplarily shown. The hardware chip can periodically read the count value of the flow counter of each forwarding port to obtain the port flow count value. The flow counter is used to record the cumulative value of the flow size forwarded by the forwarding port. And / or, the hardware chip can periodically read the usage of the memory of each forwarding port to obtain the port output queue length. The memory is used to store the total flow size to be forwarded by the forwarding port. The subsequent hardware chip can send a congestion alarm message to the acquisition controller through the CPU of the network device when there is a target forwarding port whose forwarding state is a congested state. So that the acquisition controller sends a first notification message to the designated network device.

[0116] It should be noted that the network device that sends the alarm message and the designated network device that samples the target traffic can be the same device. Figure 4 Let's take this situation as an example.

[0117] The manner in which the hardware chip of the network device in the above S302 determines the forwarding state of each forwarding port can be implemented as follows: for the forwarding port, if the flow count difference between the port flow count value read this time and the port flow count value read last time satisfies the first preset condition, or the port output queue length read this time satisfies the second preset condition, or the flow count difference satisfies the first preset condition and the port output queue length read this time satisfies the second preset condition, then the forwarding state of the forwarding port is determined to be a congested state. Otherwise, the forwarding state of the forwarding port is determined to be a normal state.

[0118] The traffic count difference between the port traffic count value read this time and the port traffic count value read last time can show the traffic forwarded by the forwarding port during the time period between the current reading time and the last reading time. The larger the traffic count difference, the more traffic is forwarded by the forwarding port, so the congestion level is higher; conversely, the smaller the traffic count difference, the less traffic is forwarded by the forwarding port, so the congestion level is lower.

[0119] The port output queue length read this time is the total amount of traffic to be forwarded by the forwarding port, which can reflect the amount of tasks to be completed by the forwarding port. Therefore, the larger the port output queue length, the more tasks to be completed by the forwarding port, and therefore the higher the congestion level. Conversely, the smaller the port output queue length, the smaller the amount of tasks to be completed by the forwarding port, and therefore the lower the congestion level.

[0120] In the embodiment of the present application, the hardware chip can read the state parameters of each forwarding port in real time and judge the state of the forwarding port. Since the microprocessor built into the hardware chip can quickly and periodically read the state parameters of each forwarding port at millisecond intervals and judge the forwarding state more quickly, the embodiment of the present application can sense the forwarding state of each forwarding port more quickly, so that when the forwarding port is in a congested state, the sampling rate of the target flow passing through the forwarding port is adjusted in time, so that the designated network device can use the adjusted detection sampling rate to sample the target flow, thereby increasing the measurement data collected when the forwarding port is in a congested state, so as to analyze a more realistic network state.

[0121] Optionally, the above-mentioned first preset condition is: the flow count difference is greater than or equal to a first preset threshold; or, the port flow rate is greater than or equal to a second preset threshold, and the port flow rate is the ratio between the flow count difference and the reading time interval of the port flow count value; or, the port utilization is greater than or equal to a third preset threshold, and the port utilization is the ratio between the port flow rate and the rated bandwidth.

[0122] The first preset threshold, the second preset threshold, and the third preset threshold can be set according to actual conditions. For example, when the flow count value is read once every one millisecond, the first preset threshold can be set to 8 megabits (Mbit). For example, when the rated bandwidth is 10 gigabits per second (Gigabit / second, Gb / s), the second preset threshold can be set to 8 Gb / s. For example, when the performance of the network device is high, the third preset threshold can be set to 80%.

[0123] Optionally, the second preset condition is: the port output queue length read this time is greater than or equal to a fourth preset threshold; or the port output queue buffer occupancy is greater than or equal to a fifth preset threshold, and the port output queue buffer occupancy is the ratio between the port output queue length read this time and the maximum output queue. The maximum output queue is the maximum cache capacity of the memory of the forwarding port.

[0124] The fourth preset threshold and the fifth preset threshold can be set according to actual conditions. For example, when the performance of the network device is high, the fourth preset threshold can be set to 4 megabytes (Mb). When the maximum cache capacity of the memory is high, the fifth preset threshold can be set to 60%.

[0125] By setting the first preset condition and the second preset condition, the embodiment of the present application can determine the forwarding status of the forwarding port based on the traffic count difference and / or the port output queue length, thereby monitoring whether each forwarding port is congested in real time.

[0126] Optionally, in an embodiment of the present application, the congestion alarm message sent by the network device to the collection controller may also include parameters indicating the state of the forwarding port, such as flow count difference, port flow rate, port utilization, port output queue length, or port output queue buffer occupancy. This allows the collection controller to determine the increased detection sampling rate of the target traffic based on the parameters indicating the state of the forwarding port, and send a first notification message including the determined detection sampling rate to the designated network device, so that the designated network device samples the target traffic based on the detection sampling rate included in the first notification message.

[0127] Alternatively, in an embodiment of the present application, the congestion sampling rate and the regular sampling rate of each measured flow can be pre-recorded in the designated network device, wherein the congestion sampling rate is greater than the regular sampling rate, and each sampling rate has a corresponding identifier. In this case, the first notification message sent by the acquisition controller to the designated network device may include the identifier of the congestion sampling rate, so that the designated network device can set the detection sampling rate of the target flow to the congestion sampling rate corresponding to the identifier of the congestion sampling rate included in the first notification message, and then sample the target flow based on the congestion sampling rate.

[0128] In one embodiment of the present application, in the above S303, when the hardware chip of the network device determines that there is a target forwarding port, it can immediately send a congestion alarm message to the collection controller through the CPU of the network device.

[0129] Alternatively, in another embodiment of the present application, the hardware chip of the network device can send a congestion alarm message to the acquisition controller through the CPU when it is determined that there is a target forwarding port whose forwarding state is a congested state and the target forwarding port is in a congested state for a specified period of time.

[0130] The hardware chip can start timing for each forwarding port when it determines that the forwarding port has changed from a normal state to a congested state. If the timing reaches a specified time and the forwarding port continues to be in a congested state, a congestion alarm message is sent to the acquisition controller through the CPU.

[0131] Alternatively, the hardware chip can record the moment when the forwarding port changes from a normal state to a congested state for each forwarding port as the starting congestion moment. Each subsequent determination of the forwarding state of the forwarding port, if the forwarding state is still a congested state, calculate the time difference between the current moment and the starting congestion moment. If the time difference reaches a specified duration, send a congestion alarm message to the acquisition controller via the CPU. If the forwarding state of the forwarding interface determined subsequently is a normal state, delete the starting congestion moment.

[0132] The embodiment of the present application can send a congestion alarm message to the collection controller when the forwarding port is continuously in a congested state, thereby reducing false alarms.

[0133] In one embodiment of the present application, after the hardware chip of the network device sends a congestion alarm message to the collection controller through the CPU of the network device in the above S303, the hardware chip can also send a congestion relief message to the collection controller through the CPU when the target forwarding port is converted from a congested state to a normal state. The congestion relief message is used to instruct the collection controller to notify the specified network device to reduce the detection sampling rate of the target traffic.

[0134] Since the measurement data of the target forwarding port can be collected at a lower sampling rate when the target forwarding port changes from a congested state to a normal state, the specified network device can be instructed to lower the detection sampling rate of the target traffic, so that the specified network device samples the target traffic using the lowered detection sampling rate.

[0135] The embodiment of the present application can reduce the sampling rate of the traffic passing through the forwarding port of the network device when the congestion of the forwarding port of the network device is relieved. Since the port forwarding state is stable after the congestion is relieved, the difference between the measurement data is small, so a lower sampling rate can be used to collect the measurement data. In addition, a lower sampling rate can also save the processing resources consumed by the network device to collect the measurement data.

[0136] The flow sampling method provided in the embodiment of the present application can be applied in various flow detection scenarios, including active measurement, passive measurement and hybrid measurement. In different detection scenarios, the designated network devices for sampling the flow are different.

[0137] In the hybrid measurement flow detection scenario, the specified network device is the head node through which the target traffic passes in the flow detection network. In this case, the target traffic is the service traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received traffic and the sampled traffic, for example, the detection sampling rate is 1000:1.

[0138] In the flow detection scenario, when the target traffic passes through the first network device in the flow detection network, the network device samples the target traffic, which is the head node. The head node sets a measurement tag in the sampled traffic and inserts measurement information into the IP message header, so that when the subsequent network device receives the traffic, it can determine that the traffic is the sampled traffic based on the measurement tag and continue to insert measurement information into the IP message header. Until the traffic passes through the last network device in the flow detection network, the network device inserts measurement information into the IP message header, strips all measurement information from the IP message header, and reports it to the analyzer.

[0139] In the passive measurement scenario, the designated network devices are the detection devices in the detection domain that need to sample and detect the target traffic. In this case, the target traffic is the service traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received traffic and the sampled traffic.

[0140] In the passive measurement scenario, multiple network devices can be selected from the existing network as detection devices to form a detection domain. Each detection device in the detection domain can forward service traffic. At the same time, the detection device can also sample the received service traffic and forward it to the analyzer. Each service traffic passes through at least one detection device.

[0141] In the active measurement scenario, the network device is designated as a detection device for generating target traffic. In this case, the target traffic includes detection packets that need to be forwarded by the target forwarding port, and the detection sampling rate is the time interval for sending the detection packets, for example, the detection sampling rate is 10 milliseconds.

[0142] In the active measurement scenario, the detection server can send detection messages at a certain sampling rate. The detection server has a built-in measurement function, such as a measurement function based on the Two-Way Active Measurement Protocol (TWAMP). Alternatively, active measurement can be performed by externally plugging in a probe.

[0143] The embodiments of the present application can control the sampling rate of the flow in various detection scenarios. Therefore, the application scope of the embodiments of the present application is relatively wide, and both resource consumption and measurement accuracy can be taken into account in the scenarios of flow detection, active measurement and passive measurement.

[0144] Based on the same inventive concept, the present application also provides a flow sampling method, which is applied to Figure 2 The acquisition controller shown, such as Figure 5 As shown, the method comprises the following steps:

[0145] S501: Receive a congestion alarm message sent by a target network device.

[0146] The congestion alarm message is a message sent by the CPU of the target network device when the target network device detects that there is a target forwarding port whose forwarding state is congested based on the state parameters of each forwarding port through the hardware chip.

[0147] S502: In response to the congestion warning message, send a first notification message to a designated network device.

[0148] The first notification message is used to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0149] The congestion alarm message includes the device ID of the target network device and the port ID of the target forwarding port, so that the collection controller can determine the target forwarding port in the target network device. Then determine the target flow passing through the target forwarding port, and determine the designated network device for sampling the target flow. Then send a first notification message to the designated network device.

[0150] Optionally, the first notification message may include an increased detection sampling rate determined by the acquisition controller, so that the designated network device samples the target traffic according to the detection sampling rate included in the first notification message. The manner in which the acquisition controller increases the detection sampling rate can be set according to actual needs, and the embodiments of the present application do not specifically limit this. For example, the conventional sampling rate of the target traffic recorded in the acquisition controller is 1000:1, that is, one target traffic is collected from 1000. The acquisition controller can determine a detection sampling rate that is higher than the conventional sampling rate, for example 10:1.

[0151] Alternatively, the congestion sampling rate and regular sampling rate of each measured traffic can be pre-recorded in the designated network device, where the congestion sampling rate is greater than the regular sampling rate, and each sampling rate has a corresponding identifier. In this case, the first notification message sent by the acquisition controller to the designated network device may include the identifier of the congestion sampling rate, so that the designated network device can set the detection sampling rate of the target traffic to the congestion sampling rate corresponding to the identifier of the congestion sampling rate included in the first notification message.

[0152] In the flow sampling method provided by the embodiment of the present application, the network device can read the state parameters of each forwarding port through the built-in hardware chip, and judge whether each forwarding port is in a congested state. In the case of a target forwarding port in a congested state, a congestion alarm message is sent to the collection controller, so that the collection controller notifies the designated network device to increase the detection sampling rate of the target flow through the target forwarding port. Because the embodiment of the present application can increase the sampling rate of the flow through the forwarding port when the forwarding port of the network device is congested, so that the designated network device uses the increased detection sampling rate to sample the target flow, avoids not measuring the flow through the forwarding port when the forwarding port is temporarily congested, resulting in the problem that the forwarding port cannot be detected, and can improve the measurement accuracy when the forwarding port is congested. Moreover, the embodiment of the present application is to flexibly increase the sampling rate when the forwarding port is congested, rather than using a higher sampling rate all the time, so that smaller resource consumption can be guaranteed. Therefore, the embodiment of the present application realizes the improvement of measurement accuracy on the basis of taking into account resource consumption, so that the measurement result can better reflect the real state and service level of the network.

[0153] In one embodiment of the present application, Figure 6As shown, before the acquisition controller sends the first notification message to the designated network device in the above S502, it is also necessary to determine the designated network device, including the following steps:

[0154] S601, obtaining the pre-recorded forwarding port of the network device through which each measured flow passes; or determining the forwarding port of the network device through which the measured flow passes according to the source address and destination address of the measured flow.

[0155] In the embodiment of the present application, the forwarding port of each network device through which each measured flow passes can be pre-recorded in the acquisition controller. For example, for each measured flow, the ID of each network device through which the measured flow passes and the port ID of the network device through which the measured flow passes are recorded in order.

[0156] Alternatively, the source address and destination address of each measured flow can be pre-recorded in the collection controller. Before the first notification message needs to be sent, the collection controller can collect the topology information of the entire network to obtain a global topology view, and based on the Interior Gateway Protocol (IGP) algorithm, according to the source address and destination address of the measured flow, determine the network device through which the measured flow passes, and the port through which the network device passes. For example, the IGP algorithm can be an Open Shortest Path First (OSPF) algorithm.

[0157] Alternatively, in a flow detection scenario, the head node can be configured with a measured service flow identifier, and when the head node receives the measured service flow, it can obtain the source address and destination address of the measured service flow, and send the source address and destination address of the measured service flow to the collection controller, so that the collection controller can determine the network device through which the measured flow passes and the port through which the network device passes according to the shortest path algorithm.

[0158] S602: Filter out target traffic passing through a target forwarding port from the measured traffic according to the forwarding port of the network device through which the measured traffic passes.

[0159] Each type of measured traffic has one or more transmission paths. In the embodiment of the present application, the measured traffic that passes through any transmission path through the target forwarding port can be used as the target traffic.

[0160] For example, Figure 7 As shown, Figure 7PE1, PE2 and P1-P4 are all network devices for forwarding traffic. PE1, PE2 and P1-P4 are all connected to the acquisition controller. PE1 can also connect to customer network 1, and PE2 can also connect to customer network 2. Assume that there are two transmission paths for the measured traffic. The ports passed by the first transmission path include: port A of PE1, port B of P1, port C of P2 and port D of PE2; the ports passed by the second transmission path include port A of PE1, port E of P3, port F of P4 and port D of PE2. Assume that the target forwarding port is port B of P1. Since the first transmission path of the measured traffic passes through the target forwarding port, the measured traffic is determined as the target traffic.

[0161] S603: Determine the network device that samples the target traffic as the designated network device.

[0162] The flow sampling method provided in the embodiment of the present application can be applied in various flow detection scenarios, including active measurement, passive measurement and hybrid measurement. In different detection scenarios, the designated network devices for sampling the flow are different.

[0163] In the hybrid measurement flow detection scenario, the designated network device is the head node through which the target traffic passes in the flow detection network. When obtaining and determining the target traffic in S602, the acquisition controller can obtain the head node through which the target traffic passes in the flow detection network, and thus the head node is used as the designated network device. In this case, the target traffic is the business traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received traffic and the sampled traffic.

[0164] In the passive measurement scenario, the designated network devices are the detection devices within the detection domain that need to sample and detect the target traffic. The detection device identifier corresponding to each measured traffic can be pre-recorded in the acquisition controller, so that after determining the target traffic, the acquisition controller can obtain the detection device identifier corresponding to the target traffic, thereby determining the designated network device. In this case, the target traffic is the business traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received traffic and the sampled traffic.

[0165] In the active measurement scenario, the network device is designated as the detection device for generating the target traffic. The detection device that generates the measured traffic can be pre-recorded in the acquisition controller, so that after the target traffic is determined, the detection device that generates the target traffic can be determined. In this case, the target traffic includes the detection message that needs to be forwarded by the target forwarding port, and the detection sampling rate is the time interval for sending the detection message.

[0166] In the embodiment of the present application, the collection controller can determine the target flow passing through the target forwarding port, and determine the designated network device for sampling the target flow, so that the designated network device can be notified to increase the sampling rate of the target flow, so that the designated network device uses the increased detection sampling rate to sample the target flow. Moreover, the embodiment of the present application is applicable to various detection scenarios, so that the embodiment of the present application has a wide range of applications.

[0167] In one embodiment of the present application, after the acquisition controller sends the first notification message to the designated network device in S502, the acquisition controller can also restore the sampling rate of the target traffic when the target forwarding port is uncongested. The specific method includes the following two steps:

[0168] Step 1: Receive a congestion relief message sent by a target network device, wherein the congestion relief message is a message sent by the target network device when it detects that the target forwarding port is converted from a congested state to a normal state.

[0169] The congestion relief message may include the device ID of the target network device and the port ID of the target forwarding port, so that the collection controller can determine the target forwarding port in the target network device, further determine the target traffic passing through the target forwarding port, and determine the designated network device for sampling the target traffic.

[0170] Step 2: In response to the congestion relief message, a second notification message is sent to the designated network device, wherein the second notification message is used to notify the designated network device to reduce the detection adoption rate of the target traffic.

[0171] Optionally, the second notification message may include the reduced detection sampling rate determined by the acquisition controller, so that the designated network device samples the target traffic according to the detection sampling rate included in the first notification message. The manner in which the acquisition controller reduces the detection sampling rate can be set according to actual needs, and the embodiments of the present application do not specifically limit this. For example, the acquisition controller records the regular sampling rate of the target traffic, and the acquisition controller can use the regular sampling rate of the target traffic as the reduced detection sampling rate.

[0172] Alternatively, the congestion sampling rate and regular sampling rate of each measured flow can be pre-recorded in the designated network device, where the congestion sampling rate is greater than the regular sampling rate, and each sampling rate has a corresponding identifier. In this case, the second notification message sent by the acquisition controller to the designated network device may include the identifier of the regular sampling rate, so that the designated network device can set the detection sampling rate of the target flow to the regular sampling rate corresponding to the identifier of the regular sampling rate included in the second notification message, and then the designated network device can use the reduced detection sampling rate to sample the target flow.

[0173] In the embodiment of the present application, the acquisition controller may send a second notification message to the designated network device immediately after receiving the congestion relief message. Alternatively, the acquisition controller may respond to the congestion relief message and send a second notification message to the designated network device after waiting for a preset time, so as to obtain more measurement data within a period of time when the target forwarding port returns to a normal state, thereby facilitating the analysis of port status trends.

[0174] The embodiment of the present application can reduce the sampling rate of the traffic passing through the forwarding port of the network device when the congestion of the forwarding port of the network device is relieved. Since the port forwarding state is stable after the congestion is relieved, the difference between the measurement data is small, so a lower sampling rate can be used to collect the measurement data. In addition, a lower sampling rate can also save the processing resources consumed by the network device to collect the measurement data.

[0175] In the embodiment of the present application, since the measured traffic passes through the forwarding ports of multiple network devices, the forwarding port of each network device may be in a congested state.

[0176] In one embodiment of the present application, the collection controller may send a first notification message to a designated network device upon receiving a congestion alarm message sent by any network device.

[0177] In this case, the collection controller may send a second notification message to the designated network device upon receiving a congestion relief message sent by any network device.

[0178] Alternatively, in another embodiment of the present application, the collection controller may also determine whether the current detection sampling rate of the designated network device for the target traffic has been increased after receiving the congestion alarm message sent by the target network device. If not, a first notification message is sent to the designated network device.

[0179] That is, after receiving the congestion alarm message sent by any network device, the collection controller can determine whether other network devices through which the target flow passes have previously indicated to increase the detection sampling rate of the target flow, and if so, the detection sampling rate of the target flow is not repeatedly increased. If not, the detection sampling rate of the target flow is increased by sending a second notification message.

[0180] In this case, after receiving the congestion relief message sent by the target network device, the collection controller can determine whether the forwarding ports of each network device through which the target traffic passes are all in normal status. If so, it sends a second notification message to the designated network device.

[0181] That is, after receiving the congestion release message sent by any network device, the collection controller can determine that all forwarding ports through which the target traffic passes are in normal state. If so, the sampling rate of the target traffic is reduced by sending a second notification message. If not, the second notification message is not sent.

[0182] In the embodiment of the present application, the collection controller can maintain the designated network device to use a higher sampling rate to sample the target traffic when at least one forwarding port through which the target traffic passes is in a congested state. When all forwarding ports through which the target traffic passes are in a normal state, the designated network device is controlled to use a lower sampling rate to sample the target traffic. Thus, more detection data of the target traffic is obtained on the basis of ensuring resource consumption to improve measurement accuracy.

[0183] See also Figure 8 , the flow sampling method provided by the embodiment of the present application is described below in combination with specific application scenarios:

[0184] S801. The hardware chip of the network device periodically reads the status parameters of each forwarding port.

[0185] The state parameter may be a port traffic count value or a port output queue length.

[0186] S802: The hardware chip determines whether there is a target forwarding port in a congested state. If so, S803 is executed; otherwise, the process returns to S801.

[0187] In one implementation, the hardware chip can calculate the port utilization based on the port traffic count value of each forwarding port, and determine whether the port utilization reaches a third preset threshold; or calculate the port output queue buffer occupancy based on the port output queue length of each forwarding port, and determine whether the port output queue buffer occupancy reaches a fifth preset threshold.

[0188] S803, the hardware chip determines whether the target forwarding port is in a congested state for a specified period of time. If so, execute S804; otherwise, return to S801.

[0189] S804: The hardware chip sends congestion information to the CPU. The congestion information includes the port ID of the target forwarding port and the port utilization or the port output queue buffer occupancy.

[0190] S805: The CPU sends a congestion alarm message to the collection controller, wherein the congestion alarm message includes the device ID of the network device, the port ID of the target forwarding port, and the port utilization rate or the port output queue buffer occupancy rate.

[0191] S806. The collection controller sends a first notification message to a designated network device in response to the congestion alarm message.

[0192] S807: The designated network device samples the target traffic using the increased detection sampling rate in response to the first notification message.

[0193] By the above method, when the forwarding port of the network device is congested, the sampling rate of the traffic passing through the forwarding port can be improved, so that the designated network device uses the increased detection sampling rate to sample the target traffic, and avoids not measuring the traffic passing through the forwarding port when the forwarding port is temporarily congested, resulting in the problem that the forwarding port is congested and the measurement accuracy when the forwarding port is congested can be improved. Moreover, the embodiment of the present application is to flexibly improve the sampling rate when the forwarding port is congested, rather than using a higher sampling rate all the time, so that less resource consumption can be guaranteed. Therefore, the embodiment of the present application realizes that on the basis of taking into account resource consumption, the measurement accuracy is improved, so that the measurement result can better reflect the real state and service level of the network.

[0194] Based on the same inventive concept, corresponding to the above method embodiment, the present application embodiment provides a flow sampling device, which is applied to a network device, such as Fig. 9 As shown, the device includes: an acquisition module 901, a determination module 902 and a sending module 903;

[0195] An acquisition module 901 is used to acquire a state parameter of each forwarding port through a hardware chip, where the state parameter is used to indicate the congestion degree of the forwarding port;

[0196] The determination module 902 is used to determine the forwarding state of each forwarding port through the hardware chip based on the state parameter of the forwarding port obtained by the acquisition module 901;

[0197] The sending module 903 is used to send a congestion alarm message to the collection controller if there is a target forwarding port whose forwarding state is a congested state; the congestion alarm message is used to instruct the collection controller to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0198] Optionally, the state parameters include: a port flow count value and / or a port output queue length, wherein the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, and the port output queue length is a total flow size to be forwarded by the forwarding port;

[0199] The determination module 902 is specifically used to: for the forwarding port, if the traffic count difference between the port traffic count value read this time and the port traffic count value read last time meets the first preset condition, or the port output queue length read this time meets the second preset condition, or the traffic count difference meets the first preset condition and the port output queue length read this time meets the second preset condition, then determine that the forwarding state of the forwarding port is a congested state;

[0200] Otherwise, it is determined that the forwarding state of the forwarding port is a normal state.

[0201] Optionally, the first preset condition is: the flow count difference is greater than or equal to a first preset threshold; or, the port flow rate is greater than or equal to a second preset threshold, and the port flow rate is the ratio between the flow count difference and the reading time interval of the port flow count value; or, the port utilization is greater than or equal to a third preset threshold, and the port utilization is the ratio between the port flow rate and the rated bandwidth;

[0202] The second preset condition is: the port output queue length read this time is greater than or equal to the fourth preset threshold; or, the port output queue buffer occupancy is greater than or equal to the fifth preset threshold, and the port output queue buffer occupancy is the ratio between the port output queue length read this time and the maximum output queue.

[0203] Optionally, the sending module 903 is specifically configured to:

[0204] If there is a target forwarding port whose forwarding state is a congested state, and the target forwarding port is in the congested state for a specified period of time, a congestion alarm message is sent to the collection controller.

[0205] Optionally, the sending module 903 is also used to send a congestion relief message to the collection controller if the target forwarding port is converted from a congested state to a normal state after sending a congestion alarm message to the collection controller; wherein the congestion relief message is used to instruct the collection controller to notify the specified network device to reduce the detection sampling rate of the target traffic.

[0206] Optionally, the designated network device is a head node through which the target traffic in the flow detection network passes, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0207] The designated network devices are the detection devices in the detection domain that need to sample and detect the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0208] The specified network device is a detection device for generating target traffic, and the target traffic includes detection packets that need to be forwarded by the target forwarding port.

[0209] Based on the same inventive concept, corresponding to the above method embodiment, the present application embodiment also provides a flow sampling device, which is applied to a collection controller, such as Fig.10 As shown, the device includes: a receiving module 1001 and a sending module 1002;

[0210] The receiving module 1001 is used to receive a congestion alarm message sent by a target network device; the congestion alarm message is a message sent by the target network device when the hardware chip detects that there is a target forwarding port whose forwarding state is congested based on the state parameters of each forwarding port;

[0211] The sending module 1002 is used to send a first notification message to a designated network device in response to the congestion alarm message received by the receiving module 1001, wherein the first notification message is used to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port.

[0212] Optionally, the device further comprises:

[0213] An acquisition module, used for acquiring, before sending a first notification message to a designated network device, a pre-recorded forwarding port of a network device through which each measured flow passes; or, according to a source address and a destination address of the measured flow, determining a forwarding port of a network device through which the measured flow passes;

[0214] A screening module is used to screen out target traffic passing through a target forwarding port from the tested traffic according to the forwarding port of the network device through which the tested traffic passes;

[0215] The determination module is used to determine the network device for sampling the target traffic as the designated network device.

[0216] Optionally, the receiving module 1001 is further configured to receive a congestion relief message sent by a target network device after sending the first notification message to the designated network device, where the congestion relief message is a message sent by the target network device when detecting that the target forwarding port is converted from a congested state to a normal state;

[0217] The sending module 1002 is further used to send a second notification message to the designated network device in response to the congestion relief message received by the receiving module 1001, where the second notification message is used to notify the designated network device to reduce the detection adoption rate of the target traffic.

[0218] Optionally, the sending module 1002 is specifically configured to:

[0219] In response to the congestion relief message, after waiting for a preset period of time, a second notification message is sent to the designated network device.

[0220] Optionally, the device further comprises:

[0221] A judgment module, used for judging whether the current detection sampling rate of the designated network device for the target traffic has been increased before sending the first notification message to the designated network device; if not, calling the sending module 1002 to execute the step of sending the first notification message to the designated network device;

[0222] The judgment module is also used to judge whether the forwarding ports of each network device through which the target traffic passes are all in normal state before sending the second notification message to the specified network device. If so, calling the sending module 1002 to execute the step of sending the second notification message to the specified network device.

[0223] Optionally, the designated network device is a head node through which the target traffic in the flow detection network passes, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0224] The designated network devices are the detection devices in the detection domain that need to sample and detect the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or,

[0225] The specified network device is a detection device for generating target traffic, and the target traffic includes detection packets that need to be forwarded by the target forwarding port.

[0226] The embodiment of the present invention further provides an electronic device, such as Fig.11 As shown, it includes a processor 1101, a communication interface 1102, a memory 1103 and a communication bus 1104, wherein the processor 1101, the communication interface 1102, and the memory 1103 communicate with each other through the communication bus 1104.

[0227] Memory 1103, used for storing computer programs;

[0228] The processor 1101 is used to implement the method steps executed by the network device or the acquisition controller in the above method embodiment when executing the program stored in the memory 1103.

[0229] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0230] The communication interface is used for communication between the above electronic device and other devices.

[0231] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0232] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0233] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned flow sampling methods are implemented.

[0234] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any flow sampling method in the above embodiments.

[0235] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0236] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0237] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0238] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A flow sampling method, characterized in that: Applied to a network device, the method comprises: The hardware chip is used to obtain the status parameters of each forwarding port in real time at millisecond intervals, and the status parameters are used to indicate the congestion degree of the forwarding port; Determining the forwarding state of each forwarding port based on the state parameter of the forwarding port by the hardware chip; If there is a target forwarding port whose forwarding state is a congested state, a congestion alarm message is sent to the collection controller; the congestion alarm message is used to instruct the collection controller to notify the designated network device to increase the detection sampling rate of the target traffic passing through the target forwarding port; Wherein, the congestion alarm message carries a parameter indicating the state of the forwarding port, and the detection sampling rate is determined by the acquisition controller based on the parameter indicating the state of the forwarding port; the state parameters include: a port flow count value and / or a port output queue length, the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, the port output queue length is the sum of the flow size to be forwarded by the forwarding port, and the parameters indicating the state of the forwarding port include: a flow count difference, a port flow rate, a port utilization rate, a port output queue length, or a port output queue buffer occupancy rate; Wherein, the detection sampling rate of the target traffic of the target forwarding port includes: For hybrid measurement in-flow detection, the target traffic is the business traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received target traffic and the sampled traffic; for active measurement, the target traffic includes the probe message that needs to be forwarded by the target forwarding port, and the detection sampling rate is the time interval for sending the probe message.

2. The method according to claim 1, characterized in that The step of determining the forwarding state of the forwarding port based on the state parameter of the forwarding port includes: For the forwarding port, if the traffic count difference between the port traffic count value read this time and the port traffic count value read last time meets the first preset condition, or the port output queue length read this time meets the second preset condition, or the traffic count difference meets the first preset condition and the port output queue length read this time meets the second preset condition, then it is determined that the forwarding state of the forwarding port is a congested state; Otherwise, it is determined that the forwarding state of the forwarding port is a normal state.

3. The method according to claim 2, characterized in that The first preset condition is: the flow count difference is greater than or equal to a first preset threshold; or the port flow rate is greater than or equal to a second preset threshold, and the port flow rate is the ratio between the flow count difference and the reading time interval of the port flow count value; Alternatively, the port utilization is greater than or equal to a third preset threshold, and the port utilization is a ratio between the port flow rate and the rated bandwidth; The second preset condition is: the port output queue length read this time is greater than or equal to the fourth preset threshold; or, the port output queue buffer occupancy is greater than or equal to the fifth preset threshold, and the port output queue buffer occupancy is the ratio between the port output queue length read this time and the maximum output queue.

4. The method according to any one of claims 1 to 3, characterized in that: If there is a target forwarding port whose forwarding state is congested, a congestion alarm message is sent to the collection controller, including: If there is a target forwarding port whose forwarding state is a congested state, and the target forwarding port is in the congested state for a specified period of time, the congestion alarm message is sent to the acquisition controller.

5. The method according to any one of claims 1 to 3, characterized in that: After sending the congestion alarm message to the acquisition controller, the method further includes: If the target forwarding port is converted from a congested state to a normal state, a congestion relief message is sent to the collection controller; wherein the congestion relief message is used to instruct the collection controller to notify the designated network device to reduce the detection sampling rate of the target traffic.

6. The method according to any one of claims 1 to 3, characterized in that: The designated network device is a head node through which the target traffic passes in the flow detection network, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or, The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

7. A flow sampling method, characterized in that: Applied to an acquisition controller, the method comprises: Receiving a congestion alarm message sent by a target network device; the congestion alarm message is a message sent by the target network device when the hardware chip detects that there is a target forwarding port whose forwarding state is in a congested state based on the state parameters obtained by each forwarding port in real time at millisecond intervals; In response to the congestion alarm message, sending a first notification message to a designated network device, wherein the first notification message is used to notify the designated network device to increase a detection sampling rate of target traffic passing through the target forwarding port; Wherein, the congestion alarm message carries a parameter indicating the state of the forwarding port, and the detection sampling rate is determined by the acquisition controller based on the parameter indicating the state of the forwarding port; the state parameters include: a port flow count value and / or a port output queue length, the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, the port output queue length is the sum of the flow size to be forwarded by the forwarding port, and the parameters indicating the state of the forwarding port include: a flow count difference, a port flow rate, a port utilization rate, a port output queue length, or a port output queue buffer occupancy rate; Wherein, the detection sampling rate of the target traffic of the target forwarding port includes: For mixed measurement flow detection, the target flow is the service flow that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received target flow and the sampled flow; For active measurement, the target traffic includes a probe message that needs to be forwarded by a target forwarding port, and the detection sampling rate is a time interval for sending the probe message.

8. The method according to claim 7, characterized in that Before sending the first notification message to the designated network device, the method further includes: Obtaining the pre-recorded forwarding port of the network device through which each measured flow passes; or, according to the source address and destination address of the measured flow, determining the forwarding port of the network device through which the measured flow passes; According to the forwarding port of the network device through which the measured traffic passes, the target traffic passing through the target forwarding port is screened out from the measured traffic; The network device that samples the target traffic is determined as the designated network device.

9. The method according to claim 7 or 8, characterized in that: After sending the first notification message to the designated network device, the method further includes: Receiving a congestion relief message sent by the target network device, wherein the congestion relief message is a message sent by the target network device when detecting that the target forwarding port is converted from a congested state to a normal state; In response to the congestion relief message, a second notification message is sent to the designated network device, where the second notification message is used to notify the designated network device to reduce a detection adoption rate for the target traffic.

10. The method according to claim 9, characterized in that The sending a second notification message to the designated network device in response to the congestion relief message includes: In response to the congestion relief message, after waiting for a preset period of time, the second notification message is sent to the designated network device.

11. The method according to claim 9, characterized in that Before sending the first notification message to the designated network device, the method further includes: Determine whether the current detection sampling rate of the designated network device for the target traffic has been increased; if not, execute the step of sending the first notification message to the designated network device; Before sending the second notification message to the designated network device, the method further includes: Determine whether the forwarding ports of each network device through which the target traffic passes are all in normal status; if so, execute the step of sending the second notification message to the designated network device.

12. The method according to claim 7 or 8, characterized in that: The designated network device is a head node through which the target traffic passes in the flow detection network, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or, The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

13. A flow sampling device, characterized in that: Applied to network equipment, the device comprises: An acquisition module, used to acquire the state parameters of each forwarding port in real time at millisecond intervals through a hardware chip, wherein the state parameters are used to indicate the congestion degree of the forwarding port; A determination module, configured to determine, through the hardware chip, for each forwarding port, the forwarding state of the forwarding port based on the state parameter of the forwarding port acquired by the acquisition module; A sending module, used for sending a congestion alarm message to the collection controller if there is a target forwarding port whose forwarding state is a congested state; the congestion alarm message is used to instruct the collection controller to notify the designated network device to increase the detection sampling rate of the target flow passing through the target forwarding port; Wherein, the congestion alarm message carries a parameter indicating the state of the forwarding port, and the detection sampling rate is determined by the acquisition controller based on the parameter indicating the state of the forwarding port; the state parameters include: a port flow count value and / or a port output queue length, the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, the port output queue length is the sum of the flow size to be forwarded by the forwarding port, and the parameters indicating the state of the forwarding port include: a flow count difference, a port flow rate, a port utilization rate, a port output queue length, or a port output queue buffer occupancy rate; Among them, the sending module is also used for in-flow detection for hybrid measurement, the target traffic is the business traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received target traffic and the sampled traffic; for active measurement, the target traffic includes the probe message that needs to be forwarded by the target forwarding port, and the detection sampling rate is the time interval for sending the probe message.

14. The device according to claim 13, characterized in that The determination module is specifically used to: for the forwarding port, if the traffic count difference between the port traffic count value read this time and the port traffic count value read last time meets the first preset condition, or the port output queue length read this time meets the second preset condition, or the traffic count difference meets the first preset condition and the port output queue length read this time meets the second preset condition, then determine that the forwarding state of the forwarding port is a congested state; Otherwise, it is determined that the forwarding state of the forwarding port is a normal state.

15. The device according to claim 14, characterized in that The first preset condition is: the flow count difference is greater than or equal to a first preset threshold; or the port flow rate is greater than or equal to a second preset threshold, and the port flow rate is the ratio between the flow count difference and the reading time interval of the port flow count value; Alternatively, the port utilization is greater than or equal to a third preset threshold, and the port utilization is a ratio between the port flow rate and the rated bandwidth; The second preset condition is: the port output queue length read this time is greater than or equal to the fourth preset threshold; or, the port output queue buffer occupancy is greater than or equal to the fifth preset threshold, and the port output queue buffer occupancy is the ratio between the port output queue length read this time and the maximum output queue.

16. The device according to any one of claims 13 to 15, characterized in that: The sending module is specifically used for: If there is a target forwarding port whose forwarding state is a congested state, and the target forwarding port is in the congested state for a specified period of time, the congestion alarm message is sent to the acquisition controller.

17. The device according to any one of claims 13 to 15, characterized in that: The sending module is also used to send a congestion relief message to the collection controller if the target forwarding port is converted from a congested state to a normal state after sending a congestion alarm message to the collection controller; wherein the congestion relief message is used to instruct the collection controller to notify the designated network device to reduce the detection sampling rate of the target traffic.

18. The device according to any one of claims 13 to 15, characterized in that: The designated network device is a head node through which the target traffic passes in the flow detection network, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or, The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

19. A flow sampling device, characterized in that: Applied to an acquisition controller, the device comprises: A receiving module, used for receiving a congestion alarm message sent by a target network device; the congestion alarm message is a message sent by the target network device when the hardware chip detects that there is a target forwarding port whose forwarding state is congested based on the state parameters obtained by each forwarding port in real time at millisecond intervals; a sending module, configured to send a first notification message to a designated network device in response to the congestion alarm message received by the receiving module, wherein the first notification message is used to notify the designated network device to increase a detection sampling rate of a target flow passing through the target forwarding port; Wherein, the congestion alarm message carries a parameter indicating the state of the forwarding port, and the detection sampling rate is determined by the acquisition controller based on the parameter indicating the state of the forwarding port; the state parameters include: a port flow count value and / or a port output queue length, the port flow count value is a cumulative value of the flow size forwarded by the forwarding port, the port output queue length is the sum of the flow size to be forwarded by the forwarding port, and the parameters indicating the state of the forwarding port include: a flow count difference, a port flow rate, a port utilization rate, a port output queue length, or a port output queue buffer occupancy rate; Among them, the sending module is also used for in-flow detection for hybrid measurement, the target traffic is the business traffic that needs to be forwarded by the target forwarding port, and the detection sampling rate is the ratio between the received target traffic and the sampled traffic; for active measurement, the target traffic includes the probe message that needs to be forwarded by the target forwarding port, and the detection sampling rate is the time interval for sending the probe message.

20. The device according to claim 19, characterized in that The device also includes: An acquisition module, used for acquiring, before sending the first notification message to the designated network device, the pre-recorded forwarding port of the network device through which each measured flow passes; or, according to the source address and destination address of the measured flow, determining the forwarding port of the network device through which the measured flow passes; A screening module, used for screening target traffic passing through the target forwarding port from the measured traffic according to the forwarding port of the network device through which the measured traffic passes; The determination module is used to determine the network device that samples the target traffic as the designated network device.

21. The device according to claim 19 or 20, characterized in that The receiving module is further configured to receive a congestion relief message sent by the target network device after sending the first notification message to the designated network device, wherein the congestion relief message is a message sent by the target network device when detecting that the target forwarding port is converted from a congested state to a normal state; The sending module is further used to send a second notification message to the designated network device in response to the congestion relief message received by the receiving module, wherein the second notification message is used to notify the designated network device to reduce the detection adoption rate of the target traffic.

22. The device according to claim 21, characterized in that The sending module is specifically configured to: in response to the congestion relief message, send the second notification message to the designated network device after waiting for a preset period of time.

23. The device according to claim 21, characterized in that The device also includes: A judging module, used for judging whether the detection sampling rate of the target traffic of the designated network device has been increased before sending the first notification message to the designated network device; if not, calling the sending module to execute the step of sending the first notification message to the designated network device; The judgment module is also used to judge whether the forwarding ports of each network device through which the target traffic passes are all in normal state before sending the second notification message to the designated network device. If so, calling the sending module to execute the step of sending the second notification message to the designated network device.

24. The device according to claim 19 or 20, characterized in that The designated network device is the head node through which the target flow passes in the flow detection network, and the target flow is required Business traffic to be forwarded by the target forwarding port; or, The designated network device is each detection device in the detection domain that needs to perform sampling detection on the target traffic, and the target traffic is the service traffic that needs to be forwarded by the target forwarding port; or, The designated network device is a detection device used to generate the target traffic, and the target traffic includes a detection message that needs to be forwarded by the target forwarding port.

25. A flow sampling system, characterized in that: The system comprises: a plurality of network devices and a collection controller, each network device being connected to the collection controller; The network device is used to execute the method according to any one of claims 1 to 6; The acquisition controller is used to execute the method according to any one of claims 7 to 12.

26. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 6 or 7 to 12 when executing a program stored in a memory.

27. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 or 7 to 12 are implemented.

Images