A flow monitoring method and device

Abstract

The present application relates to the field of network communication technology, and in particular to a traffic monitoring method and device. The method is applied to the first Leaf mounted on the monitored target host, and the analysis host for monitoring the traffic of the target host is mounted on the second Leaf. The first Leaf is provided with a tunnel encapsulation strategy for forwarding the message sent by the target host to the analysis host, including: encapsulating the original message sent by the target host to the destination host based on the tunnel encapsulation strategy; sending the encapsulated message to the third Leaf, and after receiving the encapsulated message, the third Leaf decapsulates the encapsulated message. Since the tunnel header also includes the address information of the analysis host, the original message is encapsulated, and the encapsulated message is sent to the second Leaf, which decapsulates the original message to obtain the original message, and then sends the original message to the analysis host.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a flow monitoring method and device. Background Art

[0002] SDN (Software Defined Network) is a new type of innovative network architecture. Its core idea is to separate the control layer and forwarding layer of network devices to achieve flexible control of network traffic and provide a good platform for innovation of core networks and applications. SR (Segment Routing) adopts the source path selection mechanism, and pre-encapsulates the SID (Segment Identifier) ​​assigned by the node through which the path will pass in the source node. When the message passes through the SR node, the node forwards the message according to the SID of the message. SRv6 refers to the use of SR in an IPv6 network, and forwarding messages using the IPv6 address as the SID.

[0003] At present, when monitoring the traffic of the target host in the SRv6 campus network, the customer uses the network management software or controller to send policy configurations to the Leaf node where the target host is located to divert the traffic, and remotely mirror the messages sent by the target host to the Leaf node, as well as the messages forwarded by the Leaf node to the target host, to the Leaf node where the analysis host is located. Generally, ERSPAN is used for port mirroring or flow mirroring. After the analysis host receives the message, it parses and monitors it. When the analysis host finds that the message violates the rules, it can link the controller to issue an alarm or take further security measures.

[0004] However, there are many limitations in using the conventional ERSPAN mirroring method for traffic monitoring in SRv6 networks. On the one hand, the policy delivery needs to be adjusted in real time. When the target host migrates, such as from Leaf1 to Leaf2, the controller needs to migrate the ERAPAN configuration from Leaf1 to Leaf2, and the flexibility of policy delivery is very poor. On the other hand, when the analysis host monitors the target host, it cannot perform real-time security protection and can only perform passive monitoring. Summary of the invention

[0005] The present application provides a flow monitoring method and device.

[0006] In a first aspect, the present application provides a traffic monitoring method, which is applied to a first Leaf device mounted on a monitored target host, an analysis host for monitoring the traffic of the target host is mounted on a second Leaf device, a tunnel encapsulation strategy for forwarding a message sent by the target host to the analysis host is set on the first Leaf device, and an SRv6 tunnel is created between each Leaf device; the method includes:

[0007] Receiving an original message sent from the target host to the destination host;

[0008] Encapsulating the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the third Leaf device mounted on the destination host, and also includes address information instructing the third Leaf device to send the message to the analysis host;

[0009] The encapsulated message is sent to the third Leaf device, wherein after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0010] Optionally, the address information instructing the third Leaf device to send a message to the analysis host includes an IP address of the analysis host, address information of the second Leaf device mounted by the analysis host, and link information between the analysis host and the second Leaf device;

[0011] The steps of encapsulating the original message based on the tunnel encapsulation strategy to obtain the encapsulated message include:

[0012] The original message is encapsulated with an extended tunnel message header, wherein the extended tunnel message header defines a flag bit for identifying that the message needs to be subjected to traffic analysis, and the flag bit is set to 1, and the extended tunnel message header includes a Segment ID list for forwarding the encapsulated message to the third Leaf device mounted on the destination host, and also includes a Monitor Segment ID list for encapsulating and forwarding the original message to the second Leaf device mounted on the analysis host and the analysis host, wherein a Monitor Segment ID includes the IP address of the corresponding analysis host, the address information of the second Leaf device mounted on the analysis host, and the link information connecting the analysis host and the second Leaf device.

[0013] Optionally, the method further comprises:

[0014] Receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain the initial message;

[0015] If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, the initial message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device. The second Leaf device decapsulates the re-encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0016] In a second aspect, the present application provides a traffic monitoring method, which is applied to a Leaf device, wherein the Leaf device is configured with a tunnel encapsulation strategy for forwarding messages sent by its subordinate host to a target host to an analysis host, and the analysis host is used to monitor the traffic of the target host, and an SRv6 tunnel is created between each Leaf device. The method includes:

[0017] If an original message sent to the target host by the host mounted thereunder is received, the original message is encapsulated based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the Leaf device mounted on the target host, and also includes address information for instructing the Leaf device mounted on the target host to send the original message to the analysis host;

[0018] The encapsulated message is sent to the Leaf device mounted on the target host, wherein after receiving the encapsulated message, the Leaf device mounted on the target host decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0019] Optionally, the method further comprises:

[0020] Receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain the initial message;

[0021] If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, the initial message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0022] In a third aspect, the present application provides a traffic monitoring device, which is applied to a first Leaf device mounted on a monitored target host, and an analysis host for monitoring the traffic of the target host is mounted on a second Leaf device, and a tunnel encapsulation strategy for forwarding a message sent by the target host to the analysis host is set on the first Leaf device, and an SRv6 tunnel is created between each Leaf device; the device includes:

[0023] A receiving unit, configured to receive an original message sent from the target host to the destination host;

[0024] an encapsulation unit, configured to encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to a third Leaf device mounted on the destination host, and also includes address information for instructing the third Leaf device to send the message to the analysis host;

[0025] A sending unit is used to send the encapsulated message to the third Leaf device, wherein after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0026] Optionally, the address information instructing the third Leaf device to send a message to the analysis host includes an IP address of the analysis host, address information of the second Leaf device mounted by the analysis host, and link information between the analysis host and the second Leaf device;

[0027] When encapsulating the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, the encapsulation unit is specifically used to:

[0028] The original message is encapsulated with an extended tunnel message header, wherein the extended tunnel message header defines a flag bit for identifying that the message needs to be subjected to traffic analysis, and the flag bit is set to 1, and the extended tunnel message header includes a Segment ID list for forwarding the encapsulated message to the third Leaf device mounted on the destination host, and also includes a Monitor Segment ID list for encapsulating and forwarding the original message to the second Leaf device mounted on the analysis host and the analysis host, wherein a Monitor Segment ID includes the IP address of the corresponding analysis host, the address information of the second Leaf device mounted on the analysis host, and the link information connecting the analysis host and the second Leaf device.

[0029] Optionally, the receiving unit is further configured to receive an encapsulated tunnel message sent by other Leaf devices, and perform decapsulation processing on the tunnel message to obtain an initial message;

[0030] If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, the encapsulation unit is also used to perform secondary encapsulation on the initial message, and the sending unit is also used to send the secondary encapsulated message to the second Leaf device, and the second Leaf device decapsulates the secondary encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0031] In a fourth aspect, the present application provides a traffic monitoring device, which is applied to a Leaf device, and a tunnel encapsulation strategy is configured on the Leaf device to forward the message sent by the host under it to the target host to the analysis host, and the analysis host is used to monitor the traffic of the target host, and an SRv6 tunnel is created between each Leaf device. The device includes:

[0032] A receiving unit, configured to receive an original message sent from a host connected thereto to the target host;

[0033] An encapsulation unit, configured to encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the Leaf device mounted on the target host, and also includes address information for instructing the Leaf device mounted on the target host to send the original message to the analysis host;

[0034] A sending unit is used to send the encapsulated message to the Leaf device mounted on the target host, wherein after receiving the encapsulated message, the Leaf device mounted on the target host decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0035] Optionally, the device further comprises a decapsulation unit:

[0036] The receiving unit is also used to receive encapsulated tunnel messages sent by other Leaf devices;

[0037] The decapsulation unit is used to perform decapsulation processing on the tunnel message to obtain an initial message;

[0038] If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, the encapsulation unit is also used to perform secondary encapsulation on the initial message, and the sending unit is also used to send the secondary encapsulated message to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the secondary encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0039] In a fifth aspect, an embodiment of the present application provides a flow monitoring device, the flow monitoring device comprising:

[0040] A memory for storing program instructions;

[0041] The processor is used to call the program instructions stored in the memory, and execute the steps of the method as described in any one of the first aspect / second aspect according to the obtained program instructions.

[0042] In a sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the first aspect / second aspect above.

[0043] In summary, the traffic monitoring method provided in the embodiment of the present application is applied to the first Leaf device mounted on the monitored target host, and the analysis host for monitoring the traffic of the target host is mounted on the second Leaf device. The first Leaf device is provided with a tunnel encapsulation strategy for forwarding the message sent by the target host to the analysis host, and an SRv6 tunnel is created between each Leaf device; the method comprises: receiving the original message sent by the target host to the destination host; encapsulating the original message based on the tunnel encapsulation strategy to obtain the encapsulated message, wherein the tunnel header of the encapsulated message includes a third Leaf device mounted on the destination host for sending the encapsulated message The SID list information also includes address information instructing the third Leaf device to send the message to the analysis host; the encapsulated message is sent to the third Leaf device, wherein after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0044] By using the traffic monitoring method provided in the embodiment of the present application, all traffic related to the monitored target host is first forwarded to the analysis host for analysis, and then forwarded to the target host / destination host. In an SRv6-based SDN network, without changing the original message forwarding path and scheduling attributes of the target host, the target host can be deeply monitored and managed by extending the functions of the SRv6 tunnel. Through the flexible configuration of the controller, the target host can be migrated at will, and the hosts that need to be monitored can be accurately controlled in real time, which greatly enhances the supervision capability of the SRv6 network. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments of the present application or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.

[0046] Figure 1 A detailed flow chart of a flow monitoring method provided in an embodiment of the present application;

[0047] Figure 2A schematic diagram of the format of an extended SRH header provided in an embodiment of the present application;

[0048] Figure 3 A detailed flow chart of another flow monitoring method provided in an embodiment of the present application;

[0049] Figure 4 A schematic diagram of a message forwarding method provided in an embodiment of the present application;

[0050] Figure 5 A schematic diagram of the structure of a flow monitoring device provided in an embodiment of the present application;

[0051] Figure 6 A schematic diagram of the structure of another flow monitoring device provided in an embodiment of the present application;

[0052] Figure 7 A schematic diagram of the hardware architecture of a flow monitoring device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, rather than limiting the present application. The singular forms of "a", "said" and "the" used in the present application and claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.

[0054] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at..." or "when..." or "in response to determination".

[0055] For example, see Figure 1 As shown, it is a detailed flow chart of a traffic monitoring method provided by an embodiment of the present application. The method is applied to a first Leaf device mounted on a monitored target host, and an analysis host for monitoring the traffic of the target host is mounted on a second Leaf device. A tunnel encapsulation strategy for forwarding messages sent by the target host to the analysis host is set on the first Leaf device, and an SRv6 tunnel is created between each Leaf device; the method comprises the following steps:

[0056] Step 100: Receive the original message sent from the target host to the destination host.

[0057] In an embodiment of the present application, the address information instructing the third Leaf device to send a message to the analysis host includes the IP address of the analysis host, the address information of the second Leaf device mounted by the analysis host, and the link information between the analysis host and the second Leaf device.

[0058] Specifically, after configuring the analysis host on the controller, configure the configuration information corresponding to the analysis host (such as monitoring SID information). The configuration information may include the IP address of the analysis host and relevant information of the Leaf device (such as monitoring Leaf) mounted on the analysis host (such as address information of the Leaf device and link information of the connection between the Leaf device and the analysis host). Then, the controller sends the configuration information to the monitoring Leaf device, and the Leaf device publishes it to other SR nodes through the internal gateway protocol. Each SR node will learn the configuration information, and each Leaf will save the SRv6 route with the destination address as the monitoring SID.

[0059] Furthermore, after configuring the monitored host (target host) address on the controller, the controller sends the target host address and the configuration information corresponding to the analysis host that monitors the target host traffic to all Leaf devices. After receiving the information, each Leaf device generates two policy routes (packet encapsulation policies) based on the original and destination IP addresses. That is, when creating an SRv6 tunnel between Leaf devices, two packet encapsulation policies need to be generated. One is a normal SRv6 tunnel encapsulation policy. The Segment ID List of the tunnel contains normal SR nodes and is used for the transmission of non-target host traffic. The other is an extended SRv6 tunnel encapsulation policy. In addition to the Segment ID List, the extended tunnel also carries a Monitor ID List. The Monitor ID List contains a monitoring SID list, which is used for the transmission of target host traffic. Each monitoring SID corresponds to an analysis host.

[0060] In actual applications, a target host can be configured with one or more monitoring hosts, and the process of each monitoring host monitoring the traffic of the same target host is independent, that is, there can be multiple analysis hosts in the network, and these analysis hosts can monitor different target hosts or monitor the same target host. In the embodiments of the present application, no specific limitations are made here.

[0061] In the embodiment of the present application, for the Leaf device mounted on the target host, the Leaf device is synchronized with the configuration information corresponding to the analysis host for monitoring the target host, that is, the Leaf device is provided with a tunnel encapsulation strategy for forwarding the message sent by the target host to the analysis host. When the target host sends a message to other hosts (destination hosts) in the network, the Leaf device mounted on the target host will first receive the original message sent by the target host.

[0062] Step 110: Encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message.

[0063] In an embodiment of the present application, the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the third Leaf device mounted on the destination host, and also includes address information instructing the third Leaf device to send the message to the analysis host.

[0064] Specifically, in the embodiment of the present application, when the original message is encapsulated based on the tunnel encapsulation strategy to obtain the encapsulated message, a preferred implementation method is:

[0065] The original message is encapsulated with an extended tunnel message header, wherein the extended tunnel message header defines a flag bit for identifying that the message needs to be subjected to traffic analysis, and the flag bit is set to 1, and the extended tunnel message header includes a Segment ID list for forwarding the encapsulated message to the third Leaf device mounted on the destination host, and also includes a Monitor Segment ID list for encapsulating and forwarding the original message to the second Leaf device mounted on the analysis host and the analysis host, wherein a Monitor Segment ID includes the IP address of the corresponding analysis host, the address information of the second Leaf device mounted on the analysis host, and the link information connecting the analysis host and the second Leaf device.

[0066] For example, see Figure 2 As shown, a format diagram of an extended SRH header provided in an embodiment of the present application is provided with an identification bit for identifying whether it is necessary to perform traffic analysis on the received message. If the flag bit is set, it means that traffic analysis is required for the message. In addition to carrying a Segment ID list for forwarding the encapsulated message to the Leaf device mounted on the destination host, the extended SRH header also includes a MonitorSegment ID list for sending the original message to the Leaf device mounted on the analysis host and the Leaf device sending the message to the analysis host.

[0067] Step 120: Send the encapsulated message to the third Leaf device.

[0068] Among them, after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message. If it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device. The second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0069] For example, when the Leaf device mounted on the target host receives a user-side message sent by the target host and the destination address is the destination host, the message is tunnel encapsulated. The tunnel header includes the Segment ID List and the Monitor Segment ID of the analysis host corresponding to the target host. The Leaf device mounted on the target host first forwards the encapsulated tunnel message to the Leaf device mounted on the destination host according to the Segment ID List, and then the Leaf mounted on the destination host decapsulates the encapsulated tunnel message and determines that the encapsulated tunnel message carries the MonitorSegment ID of the analysis host. Then, the initial message is re-encapsulated and the message after the re-encapsulation is sent to the Leaf device mounted on the analysis host. Finally, the Leaf device mounted on the analysis host decapsulates the received tunnel message to obtain the initial message, and then forwards the initial message to the analysis host. After the analysis host processes the message, it returns it to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host forwards it to the Leaf device mounted on the destination host again. The reason why the monitored packets are forwarded along the path of the SRv6 tunnel is to ensure that the monitored packets also comply with the policy scheduling and statistics of the original SRv6 tunnel. The packets cannot be directly transmitted between the source leaf and the monitoring leaf.

[0070] Furthermore, in the embodiment of the present application, the above-mentioned flow monitoring method may also include the following steps:

[0071] Receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain the initial message; if it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, then re-encapsulate the initial message, and send the re-encapsulated message to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0072] For example, after the Leaf device mounted on the target host receives a tunnel message sent by other Leaf devices, it parses the tunnel message and determines that the destination address of the initial message is the destination address of the target host, and the tunnel message header includes the Monitor Segment ID of the analysis host corresponding to the target host. Then, the initial message is re-encapsulated based on the Monitor SegmentID of the analysis host, and the encapsulated message is sent to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the received tunnel message to obtain the initial message, and then forwards the initial message to the analysis host. The analysis host processes the message and returns it to the Leaf device mounted on the analysis host, which forwards it to the Leaf device mounted on the analysis host again. The Leaf device mounted on the analysis host forwards it to the Leaf device mounted on the target host. After decapsulation, the Leaf device mounted on the target host sends the initial message to the target host based on the destination address of the initial message.

[0073] In an embodiment of the present application, after receiving the traffic sent from the monitored target host to the destination host / other hosts to the monitored target host, the analysis host analyzes and inspects the traffic. At the same time, the traffic message may be modified based on preset rules, such as hiding the source address information of the traffic message, or desensitizing sensitive information carried by the traffic message, etc. The analysis host forwards the modified traffic message to the target host / destination host to improve the security of the information.

[0074] For example, see Figure 3 As shown, it is a detailed flow chart of a traffic monitoring method provided by an embodiment of the present application. The method is applied to a Leaf device. The Leaf device is configured with a tunnel encapsulation strategy for forwarding messages sent by its subordinate host to the target host to the analysis host. The analysis host is used to monitor the traffic of the target host. An SRv6 tunnel is created between each Leaf device. The method includes the following steps:

[0075] Step 300: If an original message is received from the host connected to the target host, the original message is encapsulated based on the tunnel encapsulation strategy to obtain an encapsulated message.

[0076] In the embodiment of the present application, the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the Leaf device mounted on the target host, and also includes address information for instructing the Leaf device mounted on the target host to send the original message to the analysis host;

[0077] Step 310: Send the encapsulated message to the Leaf device mounted on the target host.

[0078] In an embodiment of the present application, after receiving the encapsulated message, the Leaf device mounted on the target host decapsulates the encapsulated message to obtain the original message. If it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0079] Furthermore, in the embodiment of the present application, the above-mentioned flow monitoring method may also include the following steps:

[0080] Receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain the initial message; if it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, then re-encapsulate the initial message, and send the re-encapsulated message to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0081] The following describes in detail the message transmission process of the flow monitoring method provided by the embodiment of the present application in combination with specific application scenarios. Figure 4As shown, it is a process diagram of a message forwarding method provided in an embodiment of the present application; in the SRv6 network shown in the figure, Leaf and Spine are both SRv6 nodes, Leaf1 is connected to host host10, Leaf2 is connected to host host20, Leaf3 is connected to hosts host30 and host31, wherein host10, host20, and host30 are ordinary business hosts, host31 is an analysis host, on which message analysis software is running, which can parse, modify and monitor messages, the SRv6 addresses of Leaf1, Leaf2, and Leaf3 are respectively configured as 2001:DB8:A::1 / 64, 2001:DB8:B::1 / 64, and 2001:DB8:C::1 / 64, the address of Spine1 is 2001:DB8:D::1 / 64, and there are SRv6 tunnels between each Leaf.

[0082] An analysis host is added on the controller through configuration. The address of the analysis host is host31 (address is 2002::31), the access device is Leaf3, and Monitor SID is allocated (configuration address is 2001:DB8:C::31). The configuration information is sent to Leaf3, and Leaf3 publishes this SID information in the network. The target host is configured on the controller. The address of the target host is host10 (address is 2002::10). The analysis host associated with the target host is host31. The target host information and the corresponding policy are sent to all Leaf access devices. The monitoring process is explained using host10 accessing host20 as an example.

[0083] Step 1: host10 sends a request message with the source address being host10 (2002::10) and the destination address being host20 (2002::20).

[0084] Step 2: Leaf1 receives the message and matches the policy routing based on the source address. The policy specifies that the outbound interface tunnel is the extended SRv6 tunnel between Leaf1 and Leaf2. The SegmentID List in the SRH header is the SID of Spine1 and Leaf2, and carries the Monitor SegmentID List, which contains the SID of the analysis host (Leaf3's information). Leaf1 encapsulates the tunnel and forwards it to Spine1;

[0085] Step 3: Spine1 performs normal SRv6 forwarding and forwards the message to Leaf2.

[0086] Step 4: Leaf2 receives the SRv6 tunnel message and finds that it is the tail node. The "M" flag in the SRH is set and the Monitor Number is 1, indicating that the message needs to be forwarded to an analysis host. The original SRv6 tunnel header is stripped off, and the message is forwarded based on the Monitor SegmentID in the SRH (address is 2001:DB8:C::31). An SRv6 tunnel is re-encapsulated with the tunnel source address being Leaf2 and the tunnel destination address being the SID of the analysis host. The SegmentID List in the SRH contains only the Monitor SegmentID. The message is then forwarded to Spine1.

[0087] Step 5: Spine1 performs normal IPv6 forwarding as a passing message and forwards the message to Leaf3.

[0088] Step 6: Leaf3 receives the extended SRv6 tunnel message and finds that it is the tail node of the extended tunnel. It directly strips the SRv6 tunnel and forwards the inner message to host30 for analysis.

[0089] Step 7: The analysis host parses and checks the request message, and returns it to Leaf3 after completion. The IP address of the returned request message remains unchanged, and the destination MAC is replaced with the gateway MAC to ensure that IP forwarding is performed on Leaf3.

[0090] Step 8: Leaf3 receives the request message from the analysis interface, performs normal IP forwarding, encapsulates the Leaf3-Leaf2 SRv6 tunnel, and forwards the message to Spine1.

[0091] Step 9: Spine1 forwards the data to Leaf2 as an intermediate node.

[0092] Step 10: After receiving the message, Leaf2 removes the SRv6 tunnel and forwards the message based on the inner message. The destination IP of the inner message is host20, so Leaf2 forwards the message to host20.

[0093] Step 11: host20 receives the request message and responds. The source address of the response message is host20, and the destination address is host10. The message is forwarded to Leaf2.

[0094] Step 12: Leaf2 receives the message and matches the policy routing based on the destination address. The policy specifies that the outbound interface tunnel is the extended SRv6 tunnel between Leaf2 and Leaf1. The SegmentID List in the SRH header is the SID of Spine1 and Leaf1, and carries the Monitor SegmentID List, which includes the SID of the analysis host. Leaf2 encapsulates the tunnel and forwards it to Spine1.

[0095] Step 13: Spine1 performs normal SRv6 forwarding and forwards the message to Leaf1.

[0096] Step 14: Leaf1 receives the SRv6 tunnel message and finds that it is the tail node. The "M" flag in the SRH is set and the Monitor Number is 1, indicating that the message needs to be forwarded to an analysis host. The original SRv6 tunnel header is stripped off, and the message is forwarded based on the Monitor SegmentID in the SRH (the address is 2001:DB8:C::31). An SRv6 tunnel is re-encapsulated, and the tunnel source address is Leaf1. The tunnel destination address is the SID of the analysis host. The SegmentID List in the SRH only contains the Monitor SegmentID. Then the message is forwarded to Spine1.

[0097] Step 15: Spine1 performs normal IPv6 forwarding as a passing message and forwards the message to Leaf3.

[0098] Step 16: Leaf3 receives the extended SRv6 tunnel message and finds that it is the tail node of the extended tunnel. It directly strips the SRv6 tunnel and forwards the inner message to host30 for analysis.

[0099] Step 17: The analysis host parses and checks the request message, and returns it to Leaf3 after completion. The IP address of the returned request message remains unchanged, and the destination MAC is replaced with the gateway MAC to ensure that IP forwarding is performed on Leaf3.

[0100] Step 18: Leaf3 receives the response message from the analysis interface, performs normal IP forwarding, encapsulates the Leaf3-Leaf1 SRv6 tunnel, and forwards the message to Spine1.

[0101] Step 19: Spine1 forwards the data to Leaf1 as an intermediate node.

[0102] Step 20: After receiving the message, Leaf1 strips off the SRv6 tunnel and forwards it based on the inner message. The destination IP of the inner message is host10. The message is forwarded to host10. At this point, an interaction between host10 and host20 is completed. The request message and response message of the interaction are processed by the analysis host before being sent to the other party for processing.

[0103] In this way, any network behavior of the target host in the SRv6 network is strictly controlled, and all messages related to the target host are processed by the analysis host before forwarding. At the same time, the business message still follows the original SRv6 tunnel path during the forwarding process. After the monitoring is implemented, the forwarding of any message of the target host on the SRv6 tunnel will not change, which can minimize the impact of monitoring on the business.

[0104] For example, see Figure 5 As shown, it is a structural schematic diagram of a traffic monitoring device provided in an embodiment of the present application, the device is applied to a first Leaf device mounted on a monitored target host, an analysis host for monitoring the traffic of the target host is mounted on a second Leaf device, a tunnel encapsulation strategy for forwarding a message sent by the target host to the analysis host is set on the first Leaf device, and an SRv6 tunnel is created between each Leaf device; the device includes:

[0105] The receiving unit 50 is used to receive the original message sent by the target host to the destination host;

[0106] An encapsulation unit 51 is used to encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the third Leaf device mounted on the destination host, and also includes address information instructing the third Leaf device to send the message to the analysis host;

[0107] The sending unit 52 is used to send the encapsulated message to the third Leaf device, wherein after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0108] Optionally, the address information instructing the third Leaf device to send a message to the analysis host includes an IP address of the analysis host, address information of the second Leaf device mounted by the analysis host, and link information between the analysis host and the second Leaf device;

[0109] When encapsulating the original message based on the tunnel encapsulation strategy to obtain the encapsulated message, the encapsulation unit 51 is specifically used to:

[0110] The original message is encapsulated with an extended tunnel message header, wherein the extended tunnel message header defines a flag bit for identifying that the message needs to be subjected to traffic analysis, and the flag bit is set to 1, and the extended tunnel message header includes a Segment ID list for forwarding the encapsulated message to the third Leaf device mounted on the destination host, and also includes a Monitor Segment ID list for encapsulating and forwarding the original message to the second Leaf device mounted on the analysis host and the analysis host, wherein a Monitor Segment ID includes the IP address of the corresponding analysis host, the address information of the second Leaf device mounted on the analysis host, and the link information connecting the analysis host and the second Leaf device.

[0111] Optionally, the receiving unit 50 is further configured to receive an encapsulated tunnel message sent by other Leaf devices, and perform decapsulation processing on the tunnel message to obtain an initial message;

[0112] If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, the encapsulation unit 51 is also used to perform secondary encapsulation on the initial message, and the sending unit 52 is also used to send the secondary encapsulated message to the second Leaf device, and the second Leaf device decapsulates the secondary encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0113] For example, see Figure 6 As shown, it is a structural schematic diagram of a traffic monitoring device provided in an embodiment of the present application, the device is applied to a Leaf device, the Leaf device is configured with a tunnel encapsulation strategy for forwarding a message sent by a host connected to the target host to an analysis host, the analysis host is used to monitor the traffic of the target host, and an SRv6 tunnel is created between each Leaf device. The device includes:

[0114] The receiving unit 60 is used to receive the original message sent by the host connected to the target host;

[0115] An encapsulation unit 61 is used to encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information used to send the encapsulated message to the Leaf device mounted on the target host, and also includes address information instructing the Leaf device mounted on the target host to send the original message to the analysis host;

[0116] The sending unit 62 is used to send the encapsulated message to the Leaf device mounted on the target host, wherein after receiving the encapsulated message, the Leaf device mounted on the target host decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

[0117] Optionally, the device further comprises a decapsulation unit:

[0118] The receiving unit 60 is also used to receive encapsulated tunnel messages sent by other Leaf devices;

[0119] The decapsulation unit is used to perform decapsulation processing on the tunnel message to obtain an initial message;

[0120] If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a Monitor Segment ID list, the encapsulation unit 61 is also used to perform secondary encapsulation on the initial message, and the sending unit 62 is also used to send the secondary encapsulated message to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host decapsulates the secondary encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

[0121] The above units may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a certain unit above is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processors that can call program codes. For another example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0122] Furthermore, the flow monitoring device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the flow monitoring device can be seen in Figure 7 As shown, the flow monitoring device may include: a memory 70 and a processor 71,

[0123] The memory 70 is used to store program instructions; the processor 71 calls the program instructions stored in the memory 70 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.

[0124] Optionally, the present application also provides a Leaf device, comprising at least one processing element (or chip) for executing the above method embodiment.

[0125] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above method embodiments.

[0126] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0127] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0128] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0129] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0130] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] Moreover, these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0133] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A flow monitoring method, characterized in that: A first Leaf device mounted on a monitored target host, an analysis host for monitoring the traffic of the target host mounted on a second Leaf device, a tunnel encapsulation policy for forwarding messages sent by the target host to the analysis host is set on the first Leaf device, and an SRv6 tunnel is created between the Leaf devices; The method comprises: Receiving an original message sent from the target host to the destination host; Encapsulating the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the third Leaf device mounted on the destination host, and also includes address information instructing the third Leaf device to send the message to the analysis host; The encapsulated message is sent to the third Leaf device, wherein after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

2. The method according to claim 1, characterized in that The address information for instructing the third Leaf device to send a message to the analysis host includes the IP address of the analysis host, the address information of the second Leaf device mounted by the analysis host, and the link information between the analysis host and the second Leaf device; The steps of encapsulating the original message based on the tunnel encapsulation strategy to obtain the encapsulated message include: The original message is encapsulated with an extended tunnel message header, wherein the extended tunnel message header defines a flag bit for identifying that the message needs to be subjected to traffic analysis, and the flag bit is set to 1, and the extended tunnel message header includes a Segment ID list for forwarding the encapsulated message to the third Leaf device mounted on the destination host, and also includes a Monitor Segment ID list for encapsulating and forwarding the original message to the second Leaf device mounted on the analysis host and the analysis host, wherein a Monitor Segment ID includes the IP address of the corresponding analysis host, the address information of the second Leaf device mounted on the analysis host, and the link information connecting the analysis host and the second Leaf device.

3. The method according to claim 2, characterized in that The method further comprises: Receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain the initial message; If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a MonitorSegment ID list, the initial message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device. The second Leaf device decapsulates the re-encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

4. A flow monitoring method, characterized in that: Applied to a Leaf device, the Leaf device is configured with a tunnel encapsulation strategy for forwarding messages sent by a host connected to the target host to an analysis host, the analysis host is used to monitor the traffic of the target host, and an SRv6 tunnel is created between each Leaf device. The method includes: If an original message sent to the target host by the host mounted thereunder is received, the original message is encapsulated based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the Leaf device mounted on the target host, and also includes address information for instructing the Leaf device mounted on the target host to send the original message to the analysis host; The encapsulated message is sent to the Leaf device mounted on the target host, wherein after receiving the encapsulated message, the Leaf device mounted on the target host decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

5. The method according to claim 4, characterized in that The method further comprises: Receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain the initial message; If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a MonitorSegment ID list, the initial message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

6. A flow monitoring device, characterized in that: A first Leaf device mounted on a monitored target host, an analysis host for monitoring the traffic of the target host mounted on a second Leaf device, a tunnel encapsulation policy for forwarding messages sent by the target host to the analysis host is set on the first Leaf device, and an SRv6 tunnel is created between the Leaf devices; The device comprises: A receiving unit, configured to receive an original message sent from the target host to the destination host; an encapsulation unit, configured to encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to a third Leaf device mounted on the destination host, and also includes address information for instructing the third Leaf device to send the message to the analysis host; A sending unit is used to send the encapsulated message to the third Leaf device, wherein after receiving the encapsulated message, the third Leaf device decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the second Leaf device, and the second Leaf device decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

7. The device according to claim 6, characterized in that The address information for instructing the third Leaf device to send a message to the analysis host includes the IP address of the analysis host, the address information of the second Leaf device mounted by the analysis host, and the link information between the analysis host and the second Leaf device; When encapsulating the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, the encapsulation unit is specifically used to: The original message is encapsulated with an extended tunnel message header, wherein the extended tunnel message header defines a flag bit for identifying that the message needs to be subjected to traffic analysis, and the flag bit is set to 1, and the extended tunnel message header includes a Segment ID list for forwarding the encapsulated message to the third Leaf device mounted on the destination host, and also includes a Monitor Segment ID list for encapsulating and forwarding the original message to the second Leaf device mounted on the analysis host and the analysis host, wherein a Monitor Segment ID includes the IP address of the corresponding analysis host, the address information of the second Leaf device mounted on the analysis host, and the link information connecting the analysis host and the second Leaf device.

8. The device according to claim 7, characterized in that The receiving unit is also used to receive the encapsulated tunnel message sent by other Leaf devices, and decapsulate the tunnel message to obtain an initial message; If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a MonitorSegment ID list, the encapsulation unit is also used to perform secondary encapsulation on the initial message, and the sending unit is also used to send the secondary encapsulated message to the second Leaf device, and the second Leaf device decapsulates the secondary encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

9. A flow monitoring device, characterized in that: Applied to Leaf devices, the Leaf devices are configured with a tunnel encapsulation strategy for forwarding messages sent by the host connected to the target host to the analysis host, the analysis host is used to monitor the traffic of the target host, and an SRv6 tunnel is created between the Leaf devices. The device includes: A receiving unit, configured to receive an original message sent from a host connected thereto to the target host; An encapsulation unit, configured to encapsulate the original message based on the tunnel encapsulation strategy to obtain an encapsulated message, wherein the tunnel header of the encapsulated message includes SID list information for sending the encapsulated message to the Leaf device mounted on the target host, and also includes address information for instructing the Leaf device mounted on the target host to send the original message to the analysis host; A sending unit is used to send the encapsulated message to the Leaf device mounted on the target host, wherein after receiving the encapsulated message, the Leaf device mounted on the target host decapsulates the encapsulated message to obtain the original message, and if it is determined that the tunnel header of the encapsulated message also includes the address information of the analysis host, the original message is re-encapsulated and the re-encapsulated message is sent to the Leaf device mounted on the analysis host, and the Leaf device mounted on the analysis host decapsulates the re-encapsulated message to obtain the original message, and sends the original message to the analysis host.

10. The device according to claim 9, characterized in that The device also includes a decapsulation unit: The receiving unit is also used to receive encapsulated tunnel messages sent by other Leaf devices; The decapsulation unit is used to perform decapsulation processing on the tunnel message to obtain an initial message; If it is determined that the flag bit in the extended message header of the tunnel message is 1, and the extended message header includes a MonitorSegment ID list, the encapsulation unit is also used to perform secondary encapsulation on the initial message, and the sending unit is also used to send the secondary encapsulated message to the Leaf device mounted on the analysis host. The Leaf device mounted on the analysis host decapsulates the secondary encapsulated message to obtain the initial message, and sends the initial message to the analysis host.

Images