eBPF-based UDP Traffic and Packet Loss Observation Method, System and Medium

Abstract

The present invention relates to a field, and discloses a UDP traffic and packet loss observation method, system and medium based on eBPF. The method comprises: inserting a stub at the UDP message receiving processing function of the Linux kernel protocol stack; when the host receives the UDP message, obtaining key information in the UDP message and saving it to a ring buffer; reading the key information from the ring buffer and performing keyword matching to obtain a session record; performing traffic and packet loss statistics based on the key information and the session record, and updating the session record based on the statistical results. The present application only needs to transmit a small amount of data from the kernel, which does not affect the business system. In addition, no modifications are required to the Linux kernel and upper-layer applications, so it has strong practicality and versatility in engineering environments.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network traffic observability, and in particular to an eBPF-based UDP traffic and packet loss observation method, system, and medium. Background Art

[0002] In the field of field measurement and control engineering such as aerospace, satellite control, and the national power grid, UDP (User Datagram Protocol) technology is widely adopted to ensure the real-time and reliability of the system. Compared with TCP (Transmission Control Protocol), the UDP protocol eliminates the process of establishing and tearing down connections and cancels the retransmission check mechanism, greatly improving the real-time performance of data communication. At the same time, UDP multicast can simultaneously send data from the data acquisition end to multiple distributed servers for master / slave distributed computing. The master / slave distributed processing of multiple nodes not only improves data processing capabilities but also prevents the normal operation of the entire system from being affected by a single node failure, greatly improving the data processing capacity and reliability of the entire system.

[0003] eBPF (extended Berkeley Packet Filter) is a very flexible and efficient virtual machine-like component in the Linux kernel that can safely execute bytecode at many kernel hook points.

[0004] There are two traditional methods for monitoring UDP packet loss. The first involves using a network packet capture tool like tcpdump to capture all UDP network packets and generate a pcap file, which is then manually analyzed using Wireshark. This method requires transferring a large number of data packets from the kernel and saving them to a file, significantly impacting system performance and making it unsuitable for real-time monitoring of online systems. The second method involves the application numbering each UDP packet and then performing packet loss monitoring and processing at the application layer. This method requires application modifications, is labor-intensive, and is not universally applicable. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to overcome the deficiencies in the prior art and provide a UDP traffic and packet loss observation method, system and medium based on eBPF.

[0006] The present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present disclosure provides a method for observing UDP traffic and packet loss based on eBPF, the method comprising:

[0008] Insert the UDP packet receiving function of the Linux kernel protocol stack;

[0009] When the host receives a UDP message, it obtains key information in the UDP message and saves it in a ring buffer;

[0010] Read the key information from the ring buffer and perform keyword matching to obtain a session record;

[0011] Traffic and packet loss statistics are performed based on the key information and the session record, and the session record is updated based on the statistical results.

[0012] Furthermore, the inserting of a UDP message receiving processing function of the Linux kernel protocol stack includes:

[0013] Compile the data acquisition code through the observation tool to generate BPF bytecode, and load the BPF bytecode into the Linux kernel through the BPF system call;

[0014] Utilize the BPF virtual machine in the Linux kernel to parse the BPF bytecode and generate a corresponding data acquisition module and a ring buffer;

[0015] The data acquisition module is inserted into the beginning of the UDP message receiving processing function of the Linux kernel protocol stack through the BPF system call.

[0016] Furthermore, when the host receives the UDP message, obtaining key information in the UDP message includes:

[0017] Calculate the IP header address and the UDP header address using the UDP message receiving processing function;

[0018] Parse the IP header structure corresponding to the IP header address and the UDP header structure corresponding to the UDP header address to obtain key information in the UDP message, wherein the key information includes the source IP address, destination IP address, IP identifier, message length, source port number and destination port number.

[0019] Furthermore, the step of reading the key information from the ring buffer and performing keyword matching to obtain a session record includes:

[0020] Reading source four-tuple information in the key information from the ring buffer, and matching corresponding session records through the four-tuple information;

[0021] If no existing session record is matched, a new corresponding session record is created, wherein the session record includes the source IP address, destination IP address, source port number, destination port number, left boundary of the IP identifier sliding window, right boundary of the IP identifier sliding window, IP identifier sliding window status array, number of transmitted bytes, number of transmitted packet losses, number of transmitted out of order, and number of duplicate packets.

[0022] Furthermore, performing traffic and packet loss statistics based on the key information and the session record includes:

[0023] Add the message length to the newly created session record or match it to the number of transmitted bytes in the existing session record to complete traffic statistics;

[0024] The packet loss and disorder situations are determined according to the IP identifier, the right boundary of the IP identifier sliding window, the left boundary of the IP identifier sliding window and the IP identifier sliding window state array.

[0025] Furthermore, judging packet loss and disorder based on the IP identifier, the right boundary of the IP identifier sliding window, the left boundary of the IP identifier sliding window, and the IP identifier sliding window state array includes:

[0026] If the IP identifier is greater than or equal to the right edge of the IP identifier sliding window, setting the corresponding data element of the IP identifier sliding window state array in the session record to 1, and then setting the right edge of the IP identifier sliding window to the IP identifier plus 1;

[0027] subtracting the left edge of the IP identifier sliding window from the adjusted right edge of the IP identifier sliding window, and if the value is greater than the sliding window threshold, shrinking the left edge of the IP identifier sliding window to the size of the sliding window threshold;

[0028] The value of the IP identifier sliding window state array is observed, and when it is 0, it is counted in the number of transmission packet losses.

[0029] Furthermore, judging packet loss and disorder based on the IP identifier, the right boundary of the IP identifier sliding window, the left boundary of the IP identifier sliding window, and the IP identifier sliding window state array includes:

[0030] If the IP identifier is smaller than the right boundary of the IP identifier sliding window and greater than or equal to the left boundary of the IP identifier sliding window, the corresponding data element of the IP identifier sliding window state array is set to 1, and the transmission disorder and the number of duplicate packets are both increased by 1;

[0031] If the IP identifier is smaller than the left boundary of the IP identifier sliding window, the IP identifier sliding window state array, the number of transmission packet losses, the transmission disorder and the number of duplicate packets remain unchanged.

[0032] Furthermore, after the session record is updated according to the statistical results, the method further includes:

[0033] A periodic timer is set, and when the periodic timer times out, the number of transmitted bytes, number of transmission loss packets, number of transmission disorder and number of duplicate packets in all session records are reported.

[0034] In a second aspect, an embodiment of the present disclosure provides a UDP traffic and packet loss observation system based on eBPF, the system including an instrumentation module, a data acquisition module and a data analysis module;

[0035] The plug-in module is used to insert a UDP message receiving processing function of the Linux kernel protocol stack;

[0036] The data acquisition module is used to obtain key information in the UDP message when the host receives the UDP message, and save it to the ring buffer;

[0037] The data analysis module is used to read the key information from the ring buffer and perform keyword matching to obtain the session record;

[0038] The data analysis module is further configured to perform traffic and packet loss statistics based on the key information and the session records, and update the session records based on the statistical results.

[0039] In a third aspect, an embodiment of the present disclosure provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the eBPF-based UDP traffic and packet loss observation method described in the first aspect are implemented.

[0040] The embodiments of the present application have the following advantages:

[0041] The embodiment of the present application provides an eBPF-based UDP traffic and packet loss observation method, which includes: inserting a stub at the UDP message receiving processing function of the Linux kernel protocol stack; when the host receives a UDP message, obtaining key information in the UDP message and saving it to a ring buffer; reading the key information from the ring buffer and performing keyword matching to obtain a session record; performing traffic and packet loss statistics based on the key information and the session record, and updating the session record based on the statistical results. This application only requires a small amount of data to be transmitted from the kernel, does not affect the business system, and does not require any modifications to the Linux kernel and upper-layer applications. Therefore, it has strong practicality and versatility in engineering environments.

[0042] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be considered as limiting the scope. A person of ordinary skill in the art can also derive other relevant drawings based on these drawings without inventive effort. Similar components are numbered similarly in the various drawings.

[0044] Figure 1 A flowchart of a method for observing UDP traffic and packet loss based on eBPF is shown in an embodiment of the present application;

[0045] Figure 2 A flowchart of another eBPF-based UDP traffic and packet loss observation method provided in an embodiment of the present application is shown;

[0046] Figure 3 A flowchart of another eBPF-based UDP traffic and packet loss observation method provided in an embodiment of the present application is shown;

[0047] Figure 4 A structural diagram of a UDP traffic and packet loss observation system based on eBPF provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0048] The following describes embodiments of the present invention in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and are not to be construed as limiting the present invention.

[0049] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be an intermediate element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be an intermediate element. Conversely, when an element is referred to as being "directly on" another element, there is no intermediate element. The terms "vertical," "horizontal," "left," "right," and similar expressions used herein are for illustrative purposes only.

[0050] In the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," "connect," "fixed," etc. should be understood broadly. For example, they may refer to fixed connection, detachable connection, or integration; mechanical connection or electrical connection; direct connection or indirect connection through an intermediate medium; internal communication between two components or interaction between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0051] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature identified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. The terms used in the template description herein are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0053] Example 1

[0054] like Figure 1 , which is a flow chart of a method for observing UDP traffic and packet loss based on eBPF in an embodiment of the present application. The method for observing UDP traffic and packet loss based on eBPF provided in an embodiment of the present application includes the following steps:

[0055] Step S110: inserting a stub at the UDP message receiving processing function of the Linux kernel protocol stack.

[0056] Specifically, the data acquisition code is compiled into BPF bytecode using an observation tool. This BPF bytecode is then loaded into the Linux kernel via a BPF system call. The Linux kernel's BPF virtual machine parses the BPF bytecode, generating the corresponding data acquisition module and ring buffer. The data acquisition module is then inserted into the very beginning of the UDP packet reception processing function of the Linux kernel protocol stack via a BPF system call.

[0057] In this embodiment, the observation tool used is the BBC tool. BCC is a tool set for tracing kernel and operating programs. Its software package includes several useful tools and examples. It extends BPF. BCC uses the C language for kernel instrumentation and uses Python and Lua as front-ends to simplify the writing of BPF programs. It is suitable for a variety of tasks, such as performance analysis and network traffic control. It is understood that the specific observation tool used can be set according to actual circumstances and is not limited in this embodiment of the application.

[0058] In an optional embodiment, as Figure 2 As shown, step S110 further includes:

[0059] Step S111, compiling the data acquisition code through the observation tool to generate BPF bytecode, and loading the BPF bytecode into the Linux kernel through the BPF system call;

[0060] Step S112, using the BPF virtual machine in the Linux kernel to parse the BPF bytecode and generate a corresponding data acquisition module and a ring buffer;

[0061] Step S113: inserting the data acquisition module into the beginning of the UDP message receiving processing function of the Linux kernel protocol stack through the BPF system call.

[0062] In this embodiment, before the data acquisition module is inserted, the first instruction code of the UDP message reception processing function is a nopl instruction that fills the space. After the data acquisition module is inserted, the nopl instruction is replaced with a function call instruction, which is the data acquisition module in this application. After the insertion is completed, when the host receives a UDP message, the UDP message reception processing function is called, and the UDP message reception processing function first calls the inserted data acquisition module.

[0063] Based on the current industry-leading eBPF technology, the data collection function is registered at the UDP packet receiving and processing function of the Linux kernel to be observed, realizing dynamic instrumentation without modifying or replacing the currently running Linux kernel.

[0064] Step S120: When the host receives the UDP message, it obtains key information in the UDP message and saves it to the ring buffer.

[0065] In this embodiment, the first parameter of the UDP message receiving and processing function udp_rcv(struct sk_buff *skb) is a pointer to sk_buff. First, the address of the IP header is calculated based on the header address of sk_buff and the address offset of the network_header. According to the structure of the IP header, the data is parsed and the source IP address, destination IP address, and IP identifier of the UDP message are obtained. Then, the address of the UDP header is calculated based on the header address of sk_buff and the address offset of the transport_header. According to the structure of the UDP header, the data is parsed and the message length, source port number, and destination port number of the UDP message are obtained. The above-mentioned source IP address, destination IP address, IP identifier, message length, source port number, and destination port number together constitute the key information in the UDP message.

[0066] The IP identifier occupies 16 bits and consists of a four-tuple consisting of the source IP address, destination IP address, source port number, and destination port number. The Linux kernel assigns an IP identifier to each network connection identified by this four-tuple. Each time a UDP packet is sent on this connection, the IP identifier increments by 1. This allows analysis of the session records corresponding to the four-tuple to determine whether the UDP packet has been lost or out of order.

[0067] Step S130 , reading the key information from the ring buffer and performing keyword matching to obtain a session record.

[0068] Furthermore, key information is extracted from the ring buffer and analyzed, and corresponding session records are matched based on the source IP address, the destination IP address, the source port number, and the destination port number. If no existing session record is matched, a new session record is created using the source IP address, the destination IP address, the source port number, and the destination port number as keywords. The fields of the session record include the source IP address, the destination IP address, the source port number, the destination port number, the left boundary of the IP identifier sliding window, the right boundary of the IP identifier sliding window, the IP identifier sliding window status array, the number of transmitted bytes, the number of transmitted packet losses, the number of transmitted out-of-order packets, and the number of duplicate packets.

[0069] It should be noted that the source IP address, destination IP address, source port number and destination port number in the session record are equivalent to the source IP address, destination IP address, source port number and destination port number in the UDP message, and the left boundary of the IP identifier sliding window and the right boundary of the IP identifier sliding window in the session record are equal to the IP identifier in the UDP message. In the IP protocol, the length of the IP identifier is 16 bits, and its value range is 0 to 65535. The length of the IP identifier sliding window status array in the session record is also 65535 bytes. The working principle of the IP identifier sliding window status array is that the sequence number of the array corresponds to the IP identifier, and the value of the array element indicates whether the UDP message corresponding to the IP identifier has been received.

[0070] For example, assuming the name of the IP identifier sliding window state array is A, then the value of A

[10] represents whether the UDP packet with IP identifier 10 has been received. If A

[10] is 0, it means that the UDP packet with IP identifier 10 has not been received. If A

[10] is 1, it means that the UDP packet with IP identifier 10 has been received. Initially, the value of the entire IP identifier sliding window state array is 0, indicating that no UDP packets with any IP identifiers have been received. The number of transmitted bytes, number of lost packets, number of out-of-order packets, and number of duplicate packets in the new session record are all initialized to 0.

[0071] It cleverly utilizes the fact that the IP identifier is independent and continuous in each session record represented by keywords consisting of source IP address, destination IP address, source port number and destination port number, and realizes the judgment and observation of UDP packet loss and disorder without modifying the user application.

[0072] Step S140: Calculate traffic and packet loss statistics based on the key information and the session record, and update the session record based on the statistical results.

[0073] Specifically, the message length in the UDP message is added to the newly created session record or matched to the total number of transmitted bytes in the existing session record to complete the traffic statistics.

[0074] Furthermore, the core of the UDP packet loss and disorder observation is the left and right boundaries of the IP identifier sliding window and the IP identifier sliding window status array. Among them, the sequence number of the IP identifier sliding window status array corresponds to the IP identifier, and the value of the element corresponding to the sequence number in the IP identifier sliding window status array represents whether the UDP packet corresponding to the IP identifier has been received. Assuming that the name of the IP identifier sliding window status array is A, then the value of A

[10] represents the status of whether the packet with IP identifier equal to 10 has been received or not. Under normal circumstances, the IP identifier corresponding to the right boundary of the IP identifier sliding window is the IP identifier of the next UDP packet to be received. The specific judgment method is as follows:

[0075] (1) If the IP identifier is greater than or equal to the right boundary of the IP identifier sliding window, the data element corresponding to the IP identifier sliding window status array in the session record is set to 1, and then the right boundary of the IP identifier sliding window is set to the IP identifier plus 1; the left boundary of the IP identifier sliding window is subtracted from the adjusted right boundary of the IP identifier sliding window. If it is greater than the sliding window threshold, the left boundary of the IP identifier sliding window is shrunk to the size of the sliding window threshold. It should be noted that the size of the sliding window threshold can be set according to the actual application scenario, such as 5 means that the size of the sliding window threshold is 5 UDP packets. The value of the IP identifier sliding window status array is further observed, and when it is 0, it is counted in the number of transmission packet losses.

[0076] like Figure 3 In the example, if the left boundary of the IP identifier sliding window is shrunk, assuming that the name of the IP identifier sliding window state array is A and the left boundary of the IP identifier sliding window is 2, first determine whether the value of A[2] is 0. If it is 0, it means that the UDP message with IP identifier 2 was not received, and the number of packet losses in the session record needs to be increased by 1. Then, the left boundary of the IP identifier sliding window plus 1 is equal to 3, and then determine whether the value of A[3] is 0, and at the same time, clear the value of A[2] to 0. In this way, the left boundary is shrunk to the right by one UDP message.

[0077] (2) If the IP identifier is smaller than the right boundary of the IP identifier sliding window and greater than or equal to the left boundary of the IP identifier sliding window, it is a duplicate packet and out-of-order situation. The data element corresponding to the IP identifier sliding window status array is set to 1, and the transmission out-of-order and the number of duplicate packets are both increased by 1.

[0078] (3) If the IP identifier is smaller than the left boundary of the IP identifier sliding window, it is considered to be an expired UDP message and can be directly ignored. The IP identifier sliding window status array, the number of transmission packet losses, the transmission disorder and the number of duplicate packets remain unchanged.

[0079] The algorithm based on the left and right boundaries of the IP identifier sliding window and the IP identifier sliding window status array can further correctly analyze and judge the situations of packet loss, disorder and duplicate packets.

[0080] Finally, after the statistical results are updated to the session records, a periodic timer is also set. When the periodic timer expires, the number of transmitted bytes, number of transmitted packets lost, number of transmitted packets out of order, and number of duplicate packets in all session records are reported. It is understood that in the embodiment of the present application, the timeout period of the periodic timer is configurable, such as 1 second or 1 minute. The specific timeout period can be set according to actual conditions and is not limited in the embodiment of the present application.

[0081] The embodiment of the present application provides an eBPF-based UDP traffic and packet loss observation method, which includes: inserting a stub at the UDP message receiving processing function of the Linux kernel protocol stack; when the host receives a UDP message, obtaining key information in the UDP message and saving it to a ring buffer; reading the key information from the ring buffer and performing keyword matching to obtain a session record; performing traffic and packet loss statistics based on the key information and the session record, and updating the session record based on the statistical results. This application only requires a small amount of data to be transmitted from the kernel, does not affect the business system, and does not require any modifications to the Linux kernel and upper-layer applications. Therefore, it has strong practicality and versatility in engineering environments.

[0082] Example 2

[0083] like Figure 4 , which is a structural diagram of a UDP traffic and packet loss observation system based on eBPF in an embodiment of the present application, wherein the system includes an instrumentation module 10, a data acquisition module 20, and a data analysis module 30;

[0084] The plugging module 10 is used to perform plugging at the UDP message receiving processing function of the Linux kernel protocol stack;

[0085] The data acquisition module 20 is used to obtain key information in the UDP message when the host receives the UDP message and save it to the ring buffer;

[0086] The data analysis module 30 is used to read the key information from the ring buffer and perform keyword matching to obtain the session record;

[0087] The data analysis module 30 is further configured to perform traffic and packet loss statistics based on the key information and the session records, and update the session records based on the statistical results.

[0088] Optionally, the system further comprises a result reporting module 40;

[0089] The result reporting module 40 is used to set a periodic timer and report the number of transmitted bytes, number of transmission loss packets, number of transmission disorder and number of duplicate packets in all session records when the periodic timer times out.

[0090] Optionally, the system further comprises a BPF virtual machine, a ring buffer, and a UDP message receiving processing function of a Linux kernel protocol stack;

[0091] like Figure 4 As shown, the entire system consists of two parts of code running in Linux user state and Linux kernel state, wherein the BPF virtual machine, the ring buffer and the UDP message receiving processing function of the Linux kernel protocol stack are all native modules of the Linux kernel state, and the data acquisition module 20 is in the Linux kernel state; the insertion module 10, the data analysis module 30 and the result reporting module 40 are in the Linux user state.

[0092] The eBPF-based UDP traffic and packet loss observation system provided in the embodiment of the present application only needs to transmit a small amount of data from the kernel, does not affect the business system, and does not require any modifications to the Linux kernel and upper-level applications. Therefore, it has strong practicality and versatility in engineering environments.

[0093] In an embodiment of the present application, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of the eBPF-based UDP traffic and packet loss observation method described in Example 1 are implemented.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or flowchart, and the combination of boxes in the structure diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0095] In addition, the functional modules or units in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0096] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0097] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be covered by the scope of protection of the present invention.

Claims

1. A UDP traffic and packet loss observation method based on eBPF, characterized in that: include: Insert the UDP packet receiving function of the Linux kernel protocol stack; When the host receives a UDP message, it obtains key information in the UDP message and saves it in a ring buffer; Read the key information from the ring buffer and perform keyword matching to obtain a session record; Performing traffic and packet loss statistics based on the key information and the session record, and updating the session record based on the statistical results; The step of inserting a stub at the UDP message receiving processing function of the Linux kernel protocol stack includes: Compile the data acquisition code through the observation tool to generate BPF bytecode, and load the BPF bytecode into the Linux kernel through the BPF system call; Utilize the BPF virtual machine in the Linux kernel to parse the BPF bytecode and generate a corresponding data acquisition module and a ring buffer; The data acquisition module is inserted into the beginning of the UDP message receiving processing function of the Linux kernel protocol stack through the BPF system call.

2. The eBPF-based UDP traffic and packet loss observation method according to claim 1, characterized in that: When the host receives the UDP message, obtaining key information in the UDP message includes: Calculate the IP header address and the UDP header address using the UDP message receiving processing function; Parse the IP header structure corresponding to the IP header address and the UDP header structure corresponding to the UDP header address to obtain key information in the UDP message, wherein the key information includes the source IP address, destination IP address, IP identifier, message length, source port number and destination port number.

3. The eBPF-based UDP traffic and packet loss observation method according to claim 2, characterized in that: The step of reading the key information from the ring buffer and performing keyword matching to obtain a session record includes: Reading source four-tuple information in the key information from the ring buffer, and matching corresponding session records through the four-tuple information; If no existing session record is matched, a new corresponding session record is created, wherein the session record includes the source IP address, destination IP address, source port number, destination port number, left boundary of the IP identifier sliding window, right boundary of the IP identifier sliding window, IP identifier sliding window status array, number of transmitted bytes, number of transmitted packet losses, number of transmitted out of order, and number of duplicate packets.

4. The eBPF-based UDP traffic and packet loss observation method according to claim 3, characterized in that: The performing traffic and packet loss statistics according to the key information and the session record includes: Add the message length to the newly created session record or match it to the number of transmitted bytes in the existing session record to complete traffic statistics; The packet loss and disorder situations are determined according to the IP identifier, the right boundary of the IP identifier sliding window, the left boundary of the IP identifier sliding window and the IP identifier sliding window state array.

5. The eBPF-based UDP traffic and packet loss observation method according to claim 4, characterized in that: The determining of packet loss and packet disorder based on the IP identifier, the right boundary of the IP identifier sliding window, the left boundary of the IP identifier sliding window, and the IP identifier sliding window state array includes: If the IP identifier is greater than or equal to the right edge of the IP identifier sliding window, setting the corresponding data element of the IP identifier sliding window state array in the session record to 1, and then setting the right edge of the IP identifier sliding window to the IP identifier plus 1; subtracting the left edge of the IP identifier sliding window from the adjusted right edge of the IP identifier sliding window, and if the value is greater than the sliding window threshold, shrinking the left edge of the IP identifier sliding window to the size of the sliding window threshold; The value of the IP identifier sliding window state array is observed, and when it is 0, it is counted in the number of transmission packet losses.

6. The eBPF-based UDP traffic and packet loss observation method according to claim 4, characterized in that: The determining of packet loss and packet disorder based on the IP identifier, the right boundary of the IP identifier sliding window, the left boundary of the IP identifier sliding window, and the IP identifier sliding window state array includes: If the IP identifier is smaller than the right boundary of the IP identifier sliding window and greater than or equal to the left boundary of the IP identifier sliding window, the corresponding data element of the IP identifier sliding window state array is set to 1, and the transmission disorder and the number of duplicate packets are both increased by 1; If the IP identifier is smaller than the left boundary of the IP identifier sliding window, the IP identifier sliding window state array, the number of transmission packet losses, the transmission disorder and the number of duplicate packets remain unchanged.

7. The eBPF-based UDP traffic and packet loss observation method according to claim 3, characterized in that: After the session record is updated according to the statistical results, the method further includes: A periodic timer is set, and when the periodic timer times out, the number of transmitted bytes, number of transmission loss packets, number of transmission disorder and number of duplicate packets in all session records are reported.

8. A UDP traffic and packet loss observation system based on eBPF, characterized in that: The system includes an instrumentation module, a data acquisition module and a data analysis module; The plug-in module is used to insert a UDP message receiving processing function of the Linux kernel protocol stack; The data acquisition module is used to obtain key information in the UDP message when the host receives the UDP message, and save it to the ring buffer; The data analysis module is used to read the key information from the ring buffer and perform keyword matching to obtain the session record; The data analysis module is further configured to perform traffic and packet loss statistics based on the key information and the session record, and update the session record based on the statistical results; The step of inserting a stub at the UDP message receiving processing function of the Linux kernel protocol stack includes: Compile the data acquisition code through the observation tool to generate BPF bytecode, and load the BPF bytecode into the Linux kernel through the BPF system call; Utilize the BPF virtual machine in the Linux kernel to parse the BPF bytecode and generate a corresponding data acquisition module and a ring buffer; The data acquisition module is inserted into the beginning of the UDP message receiving processing function of the Linux kernel protocol stack through the BPF system call.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the eBPF-based UDP traffic and packet loss observation method according to any one of claims 1 to 7 are implemented.

Images