Traffic proportion statistics method, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides a traffic proportion statistics method, device, electronic device and storage medium, the method comprising: capturing a first domain name and its mapped IP address returned by a monitored domain name server in response to a domain name resolution request sent by a client, and network data packets transmitted between the client and other servers, parsing the network data packets, determining the IPv4 addresses, second domain names and IPv4 traffic values ​​corresponding to other servers, when the network data packets are parsed and the second domain name corresponding to the server cannot be determined, determining the second domain name corresponding to the IPv4 address according to the mapping relationship between the first domain name and the IP address, calculating the IPv4 traffic proportion of each second domain name according to the second domain name and its corresponding IPv4 traffic value, providing important reference data for optimizing and upgrading from IPv4 to IPv6, and solving the problem that the IPv4 traffic proportion cannot be analyzed by using third-party tools, resulting in the inability to provide reference data for optimizing and upgrading from IPv4 to IPv6.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a flow ratio statistics method, a flow ratio statistics device, an electronic device, and a computer storage medium. Background Art

[0002] With the continuous expansion of the network scale, the global IPV4 (Internet Protocol Version 4) addresses have been allocated. The transformation of the global Internet to the next-generation Internet based on IPV6 (Internet Protocol Version 6) is imminent. Therefore, it is necessary to effectively analyze which domain names use IPV4 and have a high proportion, so as to provide important reference data for the optimization and upgrade of IPV4 to IPV6.

[0003] Currently, third-party tools such as Charles or Wireshark are usually used to capture network data packets for analysis. However, the above-mentioned method of using third-party tools cannot analyze the proportion of IPV4 traffic of the domain name, resulting in the inability to provide important reference data for optimizing and upgrading IPV4 to IPV6. Summary of the invention

[0004] The embodiment of the present invention provides a traffic proportion statistics method, device, electronic device and storage medium to solve the problem that the IPV4 traffic proportion of a domain name cannot be analyzed by using a third-party tool, resulting in the inability to provide reference data for optimizing and upgrading IPV4 to IPV6.

[0005] The embodiment of the present invention discloses a method for calculating traffic proportion, which is characterized by comprising:

[0006] Capture the first domain name and its mapped IP address returned by the domain name server in response to the domain name resolution request sent by the client, and the network data packets transmitted between the client and other servers; wherein the IP address includes an IPV4 address;

[0007] Parsing the network data packet to determine the IPv4 address, the second domain name and the IPv4 flow value corresponding to the other server;

[0008] When the network data packet is parsed and the second domain name corresponding to the server cannot be determined, determining the second domain name corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address;

[0009] According to the second domain name and its corresponding IPV4 traffic value, the IPV4 traffic proportion of each second domain name is calculated; the IPV4 traffic proportion of the second domain name is the ratio of the IPV4 traffic value of the second domain name to the total IPV4 traffic value of the second domain name.

[0010] Optionally, the determining the second domain name corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address further includes:

[0011] When it is determined according to the mapping relationship between the first domain name and the IP address that there are multiple second domain names corresponding to the IPV4 address, the multiple second domain names corresponding to the IPV4 address are combined into a second domain name group;

[0012] According to the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value, calculate the IPV4 traffic proportion of each second domain name group and the IPV4 traffic proportion of each second domain name except the second domain name in the second domain name group.

[0013] Optionally, parsing the network data packet to determine the IPv4 address and IPv4 flow value corresponding to the other server includes:

[0014] Parsing the IP header of the network data packet to determine the IP address corresponding to the other server;

[0015] When the IP address corresponding to the network data packet is determined to be the IPV4 address, parsing the transport layer of the network data packet to obtain the IPV4 flow value of the network data packet;

[0016] The IPV4 flow values ​​of the network data packets corresponding to the IPV4 address are superimposed to obtain the IPV4 flow value of the IPV4 address.

[0017] Optionally, the IP address corresponding to the network data packet is determined to be the IPV4 address, including:

[0018] When the IP address corresponding to the network data packet is an address using 32 binary bits, the IP address corresponding to the network data packet is determined as the IPV4 address.

[0019] Optionally, parsing the network data packet to determine that the other server corresponds to the second domain name includes:

[0020] Parsing the application layer of the network data packet to obtain a handshake packet;

[0021] The second domain name corresponding to the other server is parsed from the handshake packet.

[0022] The embodiment of the present invention further discloses a flow rate proportion statistics device, comprising:

[0023] A data capture module, used to capture the first domain name and its mapped IP address returned by the monitored domain name server in response to the domain name resolution request sent by the client, and the network data packets transmitted between the client and other servers; wherein the IP address includes an IPV4 address;

[0024] A data analysis module, used to analyze the network data packet to determine the IPv4 address, the second domain name and the IPv4 flow value corresponding to the other server;

[0025] A domain name determination module, used for determining the second domain name corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address when the second domain name corresponding to the server cannot be determined by parsing the network data packet;

[0026] The traffic calculation module is used to calculate the IPV4 traffic proportion of each second domain name according to the second domain name and its corresponding IPV4 traffic value; the IPV4 traffic proportion of the second domain name is the ratio of the IPV4 traffic value of the second domain name to the total IPV4 traffic value of the second domain name.

[0027] Optionally, it also includes:

[0028] A domain name combination module, configured to combine the plurality of second domain names corresponding to the IPV4 address into a second domain name group when it is determined that there are multiple second domain names corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address;

[0029] The traffic calculation module is also used to calculate the IPV4 traffic proportion of each second domain name group and the IPV4 traffic proportion of each second domain name except the second domain name in the second domain name group based on the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value.

[0030] Optionally, the data parsing module includes:

[0031] An IP address parsing submodule, used to parse the IP header of the network data packet to determine the IP address corresponding to the other server;

[0032] A flow value parsing submodule, for parsing the transport layer of the network data packet to obtain the IPV4 flow value of the network data packet when the IP address corresponding to the network data packet is determined to be the IPV4 address;

[0033] The flow value superposition submodule is used to superimpose the IPV4 flow values ​​of the network data packets corresponding to the IPV4 address to obtain the IPV4 flow value of the IPV4 address.

[0034] Optionally, the flow value parsing submodule includes:

[0035] The address determination unit is used to determine the IP address corresponding to the network data packet as the IPV4 address when the IP address corresponding to the network data packet is an address using 32 binary bits.

[0036] Optionally, the data parsing module includes:

[0037] A first data parsing submodule, used for parsing the application layer of the network data packet to obtain a handshake packet;

[0038] The second data parsing submodule is used to parse the handshake packet to obtain the second domain name corresponding to the other server.

[0039] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0040] The memory is used to store computer programs;

[0041] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0042] The embodiment of the present invention further discloses one or more computer storage media on which instructions are stored. When executed by one or more processors, the processors are enabled to execute the method described in the embodiment of the present invention.

[0043] The embodiment of the present invention further discloses a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the method described in the embodiment of the present invention.

[0044] The embodiment of the present invention includes the following advantages: the first domain name and its mapped IP address returned by the domain name server in response to the domain name resolution request sent by the client are captured, and the network data packet transmitted between the client and other servers is parsed to determine the IPV4 address, the second domain name and the IPV4 flow value corresponding to other servers. When the network data packet is parsed and the second domain name corresponding to the server cannot be determined, the second domain name corresponding to the IPV4 address is determined according to the mapping relationship between the first domain name and the IP address, and the IPV4 flow ratio of each second domain name is calculated according to the second domain name and the IPV4 flow value corresponding to it. In the embodiment of the present invention, the IPV4 address, the second domain name and the IPV4 flow value obtained by parsing the network data packet are combined with the captured first domain name and its mapped IP address to determine the second domain name corresponding to the IPV4 address, and then the IPV4 flow ratio of each second domain name is counted, providing important reference data for the optimization and upgrade of IPV4 to IPV6, solving the problem that the IPV4 flow ratio cannot be analyzed from the network data packet by using a third-party tool, resulting in the inability to provide reference data for the optimization and upgrade of IPV4 to IPV6.

[0045] In addition, currently, for the captured network data packets, there are some network data packets that are damaged, abnormal, etc., which will cause the second domain name corresponding to the IPV4 address to be unable to be parsed from the data in the network data packet, thereby causing the part of the network data packet to be unable to participate in the statistics of the IPV4 flow rate, resulting in the problem that the accuracy of the IPV4 flow rate finally calculated is not high. In the embodiment of the present invention, the mapping relationship between the captured first domain name and the IP address is used to determine the second domain name corresponding to the IPV4 address, so that the damaged and abnormal network data packets can continue to participate in the statistics of the IPV4 flow rate, thereby improving the accuracy of the IPV4 flow rate finally calculated. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a schematic diagram of an application environment provided in an embodiment of the present invention;

[0047] Figure 2 It is a flow chart of the steps of a traffic proportion statistics method provided in an embodiment of the present invention;

[0048] Figure 3 is a schematic diagram of a domain name and its mapped IP address provided in an embodiment of the present invention;

[0049] Figure 4 It is a schematic diagram of a domain name and its corresponding IPv4 flow value provided in an embodiment of the present invention;

[0050] Figure 5It is a structural block diagram of a flow ratio statistics device provided in an embodiment of the present invention;

[0051] Figure 6 It is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] The traffic proportion statistics method provided by the embodiment of the present invention can be applied to Figure 1 In the application environment shown. Among them, the client 102 communicates with the domain name server 104 and other servers 106 respectively through the network. Specifically, in the process of the client 102 communicating with the domain name server 104 and other servers 106, the first domain name and its mapped IP address returned by the domain name server 104 in response to the domain name resolution request sent by the client 102, and the network data packets transmitted between the client 102 and other servers 104 are captured, and the network data packets are parsed to determine the IPV4 addresses, second domain names and IPV4 traffic values ​​corresponding to other servers. When the network data packets are parsed and the second domain name corresponding to the server cannot be determined, the second domain name corresponding to the IPV4 address is determined according to the mapping relationship between the first domain name and the IP address, and the IPV4 traffic proportion of each second domain name is calculated according to the second domain name and its corresponding IPV4 traffic value. The IPV4 traffic proportion of the second domain name is the ratio of the IPV4 traffic value of the second domain name to the total IPV4 traffic value of the second domain name.

[0054] In actual applications, the client 102 may include but is not limited to various personal computers, laptops, smart phones, tablet computers, vehicle-mounted terminals and portable wearable devices. The domain name server 104 and other servers 106 may be independently operated servers, or a server cluster composed of multiple servers, wherein the server may be a cloud server.

[0055] Reference Figure 2 , shows a flow chart of a method for calculating traffic proportion statistics provided in an embodiment of the present invention, which may specifically include the following steps:

[0056] Step 202: Capture the first domain name and its mapped IP address returned by the domain name server in response to the domain name resolution request sent by the client, and the network data packets transmitted between the client and other servers.

[0057] Among them, the domain name server is the Domain Name System (DNS) server, which is a basic core service of the Internet. It can match domain names and IP addresses with each other. The process of converting domain names into IP addresses is domain name resolution. In Internet applications, domain names and IP addresses are indispensable, because people must use the website IP address to search and log in, so they need to use the domain name server to find the IP address corresponding to the domain name.

[0058] The domain name resolution request includes the domain name, and the client can asynchronously and concurrently send the domain name resolution request to multiple domain name servers specified in the list according to a pre-set domain name server list;

[0059] The server is located at the remote end of the network and is used to provide computing or application services to the client. In the embodiment of the present invention, the server includes a domain name server and other servers;

[0060] IP addresses include IPV4 addresses and IPV6 addresses. On the Internet, you need to know the IP addresses of the client and other servers to achieve communication between the client and other servers;

[0061] Network Packet: Everything that flows through the network can be classified as part of the data contained in a network packet. A network packet can be called a unit of data (about 1KBS to 1.5KBS) that flows from the origin to the destination address (from the sender to the receiver) within the Internet or packet-switched network.

[0062] In actual applications, the communication between the client and the server (domain name server and other servers) is monitored.

[0063] When the client accesses other servers through the first domain name, it needs to know the IP addresses corresponding to the other servers. Therefore, the client sends a domain name resolution request containing the first domain name to the domain name server. The domain name server responds to the domain name resolution request and returns the IP address corresponding to the first domain name to the client. Therefore, when the first domain name and its mapped IP address returned to the client by the domain name server are monitored, the data of the first domain name and its mapped IP address are captured and recorded. Figure 3 , shows a schematic diagram of a domain name and its mapped IP address provided in an embodiment of the present invention, in which the captured first domain name HostName and the IP address address corresponding to the first domain name are shown.

[0064] After the client obtains the IP address corresponding to the first domain name, it sends a network request (network data packet) to other servers corresponding to the IP address. Other servers respond to the network request and return corresponding data (network data packet) to the client. Therefore, when the network data packet is monitored to be transmitted between the client and other servers, the network data packet is captured and cached locally.

[0065] It should be noted that in order not to affect the normal transmission of network data, the mirror data of the network data packet is captured.

[0066] Step 204: Parse the network data packet to determine the IPv4 address, second domain name and IPv4 traffic value corresponding to the other server.

[0067] The IPV4 traffic value refers to the traffic value transmitted through the IPV4 address.

[0068] In practical applications, after capturing a network data packet, the network data packet can be parsed using the communication protocol used by the network data packet. For example, if the communication protocol used by the network data packet is the HTTP protocol, the network data packet is parsed based on the HTTP protocol. After parsing the network data packet, it is possible to determine that the IP address is a network data packet corresponding to the IPV4 address, and obtain the second domain name and IPV4 flow value (the size of the network data packet) corresponding to the network data packet.

[0069] Step 206: When the network data packet is parsed and the second domain name corresponding to the server cannot be determined, the second domain name corresponding to the IPV4 address is determined according to the mapping relationship between the first domain name and the IP address.

[0070] In actual applications, for the captured network data packets, there are some network data packets that are damaged, abnormal, etc., which will make it impossible to parse the second domain name corresponding to the IPV4 address from the data in the network data packet. Therefore, the mapping relationship between the first domain name and the IP address captured in step 202 is used to determine the second domain name corresponding to the IPV4 address of the network data packet, so as to avoid the network data packet being unable to participate in the statistics of the IPV4 traffic share of the domain name.

[0071] At present, for captured network data packets, there are some network data packets that cannot be parsed out from the data in the network data packets due to damage, abnormality, etc., which will cause the second domain name corresponding to the IPV4 address to be unable to be parsed out from the data in the network data packets, thus causing the part of the network data packets to be unable to participate in the statistics of the IPV4 flow ratio, resulting in the problem that the accuracy of the IPV4 flow ratio finally calculated is not high. In the embodiment of the present invention, the mapping relationship between the captured first domain name and the IP address is used to determine the second domain name corresponding to the IPV4 address, so that the damaged and abnormal network data packets can continue to participate in the statistics of the IPV4 flow ratio, thereby improving the accuracy of the IPV4 flow ratio finally calculated.

[0072] Step 208: Calculate the IPv4 traffic proportion of each of the second domain names according to the second domain names and their corresponding IPv4 traffic values.

[0073] The IPv4 traffic proportion of the second domain name is the ratio of the IPv4 traffic value of the second domain name to the total IPv4 traffic value of the second domain name.

[0074] In practical applications, after determining the IPv4 flow value of the network data packet corresponding to each IPv4 address and the second domain name, the IPv4 flow values ​​of one or more network data packets corresponding to the same second domain name can be superimposed to obtain the IPv4 flow value of each second domain name. Figure 4 , shows a schematic diagram of a domain name and its corresponding IPV4 traffic value provided in an embodiment of the present invention. The figure shows a second domain name using IPV4 and the corresponding IPV4 traffic value, such as the second domain name static.yximgs.com, and its corresponding IPV4 traffic value is 22.27092361Mb.

[0075] Further, the ratio of the IPV4 traffic value of each second domain name to the IPV4 traffic value of all second domain names can be determined, that is, the IPV4 traffic proportion of each second domain name. As an example, when there are second domain names A, B, and C using IPV4, and the IPV4 traffic value of the second domain name A is 200Mb, the IPV4 traffic value of the second domain name B is 300Mb, and the IPV4 traffic value of the second domain name C is 500Mb, then the total IPV4 traffic value is 1000Mb, the traffic proportion of the second domain name A is 0.2, the traffic proportion of the second domain name B is 0.3, and the traffic proportion of the second domain name C is 0.5.

[0076] In the above embodiment, the first domain name and its mapped IP address returned by the domain name server in response to the domain name resolution request sent by the client are captured, and the network data packets transmitted between the client and other servers are parsed to determine the IPV4 address, the second domain name and the IPV4 flow value corresponding to the other servers. When the network data packet is parsed and the second domain name corresponding to the server cannot be determined, the second domain name corresponding to the IPV4 address is determined according to the mapping relationship between the first domain name and the IP address, and the IPV4 flow ratio of each second domain name is calculated according to the second domain name and its corresponding IPV4 flow value. In the embodiment of the present invention, the IPV4 address, the second domain name and the IPV4 flow value obtained by parsing the network data packet are combined with the captured first domain name and its mapped IP address to determine the second domain name corresponding to the IPV4 address, and then the IPV4 flow ratio of each second domain name is counted, which provides important reference data for the optimization and upgrade of IPV4 to IPV6, and solves the problem that the IPV4 flow ratio cannot be analyzed from the network data packet using a third-party tool, resulting in the inability to provide reference data for the optimization and upgrade of IPV4 to IPV6.

[0077] In addition, currently, for the captured network data packets, there are some network data packets that are damaged, abnormal, etc., which will cause the second domain name corresponding to the IPV4 address to be unable to be parsed from the data in the network data packet, thereby causing the part of the network data packet to be unable to participate in the statistics of the IPV4 flow rate, resulting in the problem that the accuracy of the IPV4 flow rate finally calculated is not high. In the embodiment of the present invention, the mapping relationship between the captured first domain name and the IP address is used to determine the second domain name corresponding to the IPV4 address, so that the damaged and abnormal network data packets can continue to participate in the statistics of the IPV4 flow rate, thereby improving the accuracy of the IPV4 flow rate finally calculated.

[0078] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0079] In an exemplary embodiment, the determining of the second domain name corresponding to the IPV4 address based on the mapping relationship between the first domain name and the IP address further includes: when it is determined that there are multiple second domain names corresponding to the IPV4 address based on the mapping relationship between the first domain name and the IP address, combining the multiple second domain names corresponding to the IPV4 address into a second domain name group; and calculating the IPV4 traffic proportion of each second domain name group and the IPV4 traffic proportion of each second domain name other than the second domain name in the second domain name group based on the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value.

[0080] In actual applications, when the second domain name corresponding to the IPV4 address is determined based on the mapping relationship between the first domain name and the IP address, there is a situation where one IPV4 address corresponds to multiple second domain names. At this time, the multiple second domain names corresponding to the IPV4 address can be combined into a second domain name group, and the second domain name group is used to calculate the IPV4 traffic share in the form of a second domain name, so that the IPV4 traffic share of each second domain name group and the IPV4 traffic share of each second domain name group except the second domain name in the second domain name group are calculated based on the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value.

[0081] As an example, when the mapping relationship between the first domain name and the IP address is used to determine that the IPV4 address corresponds to the second domain name A and the second domain name B at the same time, the second domain name A and the second domain name B are combined into a second domain name group, and the IPV4 traffic value of the second domain name group is the IPV4 traffic value corresponding to the IPV4 address, such as 400Mb. There are also second domain name C, second domain name D and second domain name E using IPV4, and the IPV4 traffic value of the second domain name C is 300Mb, the IPV4 traffic value of the second domain name D is 200Mb, and the IPV4 traffic value of the second domain name E is 100Mb. Then the total IPV4 traffic value is 1000Mb. At this time, the IPV4 traffic ratio of the second domain name group is 0.4, the IPV4 traffic ratio of the second domain name C is 0.3, the IPV4 traffic ratio of the second domain name D is 0.2, and the IPV4 traffic ratio of the second domain name E is 0.1.

[0082] In the above embodiment, multiple second domain names corresponding to the same IPV4 address are combined into a second domain name group, and the second domain name group is used to participate in the statistics of the IPV4 traffic share, thereby calculating the traffic share of each second domain name, providing important reference data for optimizing and upgrading IPV4 to IPV6.

[0083] In an exemplary embodiment, the network data packet is parsed to determine the IP address and IPV4 traffic value corresponding to the other servers, including: parsing the IP header of the network data packet to determine the IP address corresponding to the other servers; when the IP address corresponding to the network data packet is determined to be the IPV4 address, parsing the transport layer of the network data packet to obtain the IPV4 traffic value of the network data packet; superimposing the IPV4 traffic values ​​of the network data packet corresponding to the IPV4 address to obtain the IPV4 traffic value of the IPV4 address.

[0084] Among them, network data packets can be divided into multiple layers (application layer, transport layer, network layer and data link layer). The data of each layer is composed of the data of the previous layer + the header information of this layer. Therefore, the desired data can be parsed by parsing the corresponding parts of the network data packet.

[0085] In actual applications, the IP address of the client and the IP addresses of other servers can be parsed from the IP header of the network layer of the network data packet. When it is determined that the IP addresses of other servers are IPV4 addresses, the transport layer of the network data packet is parsed to obtain the IPV4 flow value of the network data packet (the size of the data transmitted by the network data packet, such as IPV4 flow value = network data packet size - IP header size - TCP header size / UDP header size). Since the value of the data transmitted by a network data packet is fixed, files with relatively large data are usually transmitted through multiple network data packets. Therefore, an IPV4 address often corresponds to multiple network data packets. The IPV4 flow value of the IPV4 address is obtained by superimposing the IPV4 flow values ​​of the network data packets corresponding to the IPV4 address.

[0086] In an exemplary embodiment, the IP address corresponding to the network data packet is determined as the IPV4 address, including: when the IP address corresponding to the network data packet is an address using 32-bit binary bits, the IP address corresponding to the network data packet is determined as the IPV4 address.

[0087] In actual applications, the IPV4 address is an address using 32-bit binary bits, and the IPV6 address is an address using 128-bit binary bits. Therefore, when the IP address corresponding to a network data packet is an address using 32-bit binary bits, the IP address corresponding to the network data packet is determined to be an IPV4 address. When the IP address corresponding to the network data packet is an address using 128-bit binary bits, the IP address corresponding to the network data packet is determined to be an IPV6 address.

[0088] In an exemplary embodiment, parsing the network data packet to determine that the other server corresponds to the second domain name includes: parsing the application layer of the network data packet to obtain a handshake packet; and parsing the second domain name corresponding to the other server from the handshake packet.

[0089] In actual applications, the application layer of the network data packet is parsed, and the handshake packet with the SSL layer protocol type of "client hel1o" is screened out from the application layer. After the handshake packet is parsed out, it is checked whether the above handshake packet includes the SNI extension field. If it exists, the second domain name corresponding to the IPV4 address of other servers is parsed out from the handshake packet. If the handshake packet with the SSL layer protocol type of "client hel1o" cannot be screened out from the application layer, or the second domain name corresponding to the IPV4 address of other servers cannot be parsed out from the handshake packet, the mapping relationship between the first domain name and the IP address captured in step 202 is used to determine the second domain name corresponding to the IPV4 address of the network data packet, so as to avoid the network data packet being unable to participate in the statistics of the IPV4 traffic proportion of the domain name.

[0090] The above embodiment can parse the second domain names corresponding to other servers from the handshake packet in the network data packet, that is, can determine the IPV4 traffic value corresponding to the second domain name, and then count the IPV4 traffic proportion of each second domain name according to the IPV4 traffic value corresponding to the second domain name, providing important reference data for the optimization and upgrade of IPV4 to IPV6.

[0091] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0092] Reference Figure 5 , shows a structural block diagram of a flow proportion statistics device 500 provided in an embodiment of the present invention, which may specifically include the following modules:

[0093] The data capture module 502 is used to capture the first domain name and its mapped IP address returned by the domain name server in response to the domain name resolution request sent by the client, and the network data packets transmitted between the client and other servers; wherein the IP address includes an IPV4 address;

[0094] The data analysis module 504 is used to analyze the network data packet to determine the IPv4 address, the second domain name and the IPv4 flow value corresponding to the other server;

[0095] A domain name determination module 506, configured to determine the second domain name corresponding to the IPV4 address according to a mapping relationship between the first domain name and the IP address when the second domain name corresponding to the server cannot be determined by parsing the network data packet;

[0096] The traffic calculation module 508 is used to calculate the IPV4 traffic proportion of each second domain name based on the second domain name and its corresponding IPV4 traffic value; the IPV4 traffic proportion of the second domain name is the ratio of the IPV4 traffic value of the second domain name to the total IPV4 traffic value of the second domain name.

[0097] Optionally, it also includes:

[0098] A domain name combination module, configured to combine the plurality of second domain names corresponding to the IPV4 address into a second domain name group when it is determined that there are multiple second domain names corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address;

[0099] The traffic calculation module is also used to calculate the IPV4 traffic proportion of each second domain name group and the IPV4 traffic proportion of each second domain name except the second domain name in the second domain name group based on the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value.

[0100] Optionally, the data parsing module includes:

[0101] An IP address parsing submodule, used to parse the IP header of the network data packet to determine the IP address corresponding to the other server;

[0102] A flow value parsing submodule, for parsing the transport layer of the network data packet to obtain the IPV4 flow value of the network data packet when the IP address corresponding to the network data packet is determined to be the IPV4 address;

[0103] The flow value superposition submodule is used to superimpose the IPV4 flow values ​​of the network data packets corresponding to the IPV4 address to obtain the IPV4 flow value of the IPV4 address.

[0104] Optionally, the flow value parsing submodule includes:

[0105] The address determination unit is used to determine the IP address corresponding to the network data packet as the IPV4 address when the IP address corresponding to the network data packet is an address using 32 binary bits.

[0106] Optionally, the data parsing module includes:

[0107] A first data parsing submodule, used for parsing the application layer of the network data packet to obtain a handshake packet;

[0108] The second data parsing submodule is used to parse the handshake packet to obtain the second domain name corresponding to the other server.

[0109] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0110] In addition, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned data acquisition method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0111] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned data acquisition method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0112] Figure 6 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0113] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610, and a power supply 611. Those skilled in the art will appreciate that Figure 6 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0114] It should be understood that in the embodiment of the present invention, the radio frequency unit 601 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 610 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 601 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 601 can also communicate with the network and other devices through a wireless communication system.

[0115] The electronic device provides users with wireless broadband Internet access through the network module 602, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0116] The audio output unit 603 can convert the audio data received by the RF unit 601 or the network module 602 or stored in the memory 609 into an audio signal and output it as sound. Moreover, the audio output unit 603 can also provide audio output related to a specific function performed by the electronic device 600 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, a receiver, etc.

[0117] The input unit 604 is used to receive audio or video signals. The input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 606. The image frame processed by the graphics processor 6041 can be stored in the memory 609 (or other storage medium) or sent via the radio frequency unit 601 or the network module 602. The microphone 6042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 601 in the case of a telephone call mode.

[0118] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 6061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 6061 and / or the backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 605 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0119] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0120] The user input unit 607 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 606 includes a touch panel 6071 and other input devices 6072. The touch panel 6071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 6071 or near the touch panel 6071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 6071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact point coordinates, and then sends it to the processor 610, receives the command sent by the processor 610 and executes it. In addition, the touch panel 6071 can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 6071, the user input unit 607 may also include other input devices 6072. Specifically, other input devices 6062 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail here.

[0121] Furthermore, the touch panel 6071 may be overlaid on the display panel 6061. When the touch panel 6071 detects a touch operation on or near it, it is transmitted to the processor 610 to determine the type of touch event. Then, the processor 610 provides corresponding visual output on the display panel 6061 according to the type of touch event. Figure 6 In the figure, the touch panel 6071 and the display panel 6061 are used as two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 6071 and the display panel 6061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0122] The interface unit 608 is an interface for connecting an external device to the electronic device 600. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 608 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 600 or may be used to transmit data between the electronic device 600 and an external device.

[0123] The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 609 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0124] The processor 610 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 609 and calling data stored in the memory 609, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 610 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 610.

[0125] The electronic device 600 may also include a power supply 611 (such as a battery) for supplying power to each component. Preferably, the power supply 611 may be logically connected to the processor 610 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0126] In addition, the electronic device 600 includes some functional modules not shown, which will not be described in detail here.

[0127] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0128] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0129] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0130] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0131] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0132] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0133] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0134] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0135] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0136] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A traffic proportion statistics method, characterized in that: include: Capture the first domain name and its mapped IP address returned by the domain name server in response to the domain name resolution request sent by the client, and the network data packets transmitted between the client and other servers; wherein the IP address includes an IPV4 address; Parsing the network data packet to determine the IPv4 address, the second domain name and the IPv4 flow value corresponding to the other server; When the network data packet is parsed and the second domain name corresponding to the server cannot be determined, determining the second domain name corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address; According to the second domain name and its corresponding IPV4 traffic value, the IPV4 traffic proportion of each second domain name is calculated; the IPV4 traffic proportion of the second domain name is the ratio of the IPV4 traffic value of the second domain name to the total IPV4 traffic value of the second domain name.

2. The method according to claim 1, characterized in that The determining the second domain name corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address also includes: When it is determined according to the mapping relationship between the first domain name and the IP address that there are multiple second domain names corresponding to the IPV4 address, the multiple second domain names corresponding to the IPV4 address are combined into a second domain name group; According to the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value, calculate the IPV4 traffic proportion of each second domain name group and the IPV4 traffic proportion of each second domain name except the second domain name in the second domain name group.

3. The method according to claim 1, characterized in that Parsing the network data packet to determine the IPv4 address and IPv4 flow value corresponding to the other server includes: Parsing the IP header of the network data packet to determine the IP address corresponding to the other server; When the IP address corresponding to the network data packet is determined to be the IPV4 address, parsing the transport layer of the network data packet to obtain the IPV4 flow value of the network data packet; The IPV4 flow values ​​of the network data packets corresponding to the IPV4 address are superimposed to obtain the IPV4 flow value of the IPV4 address.

4. The method according to claim 3, characterized in that The IP address corresponding to the network data packet is determined to be the IPV4 address, including: When the IP address corresponding to the network data packet is an address using 32 binary bits, the IP address corresponding to the network data packet is determined as the IPV4 address.

5. The method according to claim 1, characterized in that Parsing the network data packet to determine that the other server corresponds to the second domain name includes: Parsing the application layer of the network data packet to obtain a handshake packet; The second domain name corresponding to the other server is parsed from the handshake packet.

6. A flow rate proportion statistics device, characterized in that: include: A data capture module, used to capture the first domain name and its mapped IP address returned by the monitored domain name server in response to the domain name resolution request sent by the client, and the network data packets transmitted between the client and other servers; wherein the IP address includes an IPV4 address; A data analysis module, used to analyze the network data packet to determine the IPv4 address, the second domain name and the IPv4 flow value corresponding to the other server; A domain name determination module, used for determining the second domain name corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address when the second domain name corresponding to the server cannot be determined by parsing the network data packet; The traffic calculation module is used to calculate the IPV4 traffic proportion of each second domain name according to the second domain name and its corresponding IPV4 traffic value; the IPV4 traffic proportion of the second domain name is the ratio of the IPV4 traffic value of the second domain name to the total IPV4 traffic value of the second domain name.

7. The device according to claim 6, characterized in that Also includes: A domain name combination module, configured to combine the plurality of second domain names corresponding to the IPV4 address into a second domain name group when it is determined that there are multiple second domain names corresponding to the IPV4 address according to the mapping relationship between the first domain name and the IP address; The traffic calculation module is also used to calculate the IPV4 traffic proportion of each second domain name group and the IPV4 traffic proportion of each second domain name except the second domain name in the second domain name group based on the second domain name group and its corresponding IPV4 traffic value, and the second domain name and its corresponding IPV4 traffic value.

8. The device according to claim 6, characterized in that The data parsing module comprises: An IP address parsing submodule, used to parse the IP header of the network data packet to determine the IP address corresponding to the other server; A flow value parsing submodule, for parsing the transport layer of the network data packet to obtain the IPV4 flow value of the network data packet when the IP address corresponding to the network data packet is determined to be the IPV4 address; The flow value superposition submodule is used to superimpose the IPV4 flow values ​​of the network data packets corresponding to the IPV4 address to obtain the IPV4 flow value of the IPV4 address.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 5 when executing the program stored in the memory.

10. One or more computer storage media having instructions stored thereon, which when executed by one or more processors cause the processors to perform the method of any one of claims 1 to 5.

Images