Network protocol based vtap traffic distribution method and system

Abstract

The application discloses a vtap traffic distribution method and system based on a network protocol, and relates to the technical field of network communication.The technical scheme is as follows: a collection strategy including a network card list and vtap information is generated; network messages are obtained by packet capturing of interface traffic in the network card list according to the collection strategy, vtap information is written into the header of the network protocol corresponding to the forwarding network message, protocol encapsulation is carried out, and a forwarding message is obtained; an analyzer IP list and a message truncation length are obtained by analyzing the header of the received forwarding message; the network message is cut according to the message truncation length, encoding encapsulation is carried out, and the encapsulated distribution message is distributed according to the analyzer IP list; and the received distribution message is analyzed after being parsed.The application realizes flexible programmable control when completing traffic mirror distribution to the distribution target while reducing the bandwidth consumption of the collection node.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and more particularly to a VTAP traffic distribution method and system based on a network protocol. Background Art

[0002] When centrally monitoring, collecting, and analyzing network data packets from multiple nodes at the same time, if there are multiple analysis terminals with different purposes, then collecting a data packet requires forwarding multiple analysis terminals, which will cause a portion of traffic from the analyzed node to be forwarded multiple times, increasing the node's network bandwidth pressure.

[0003] The existing hard tap method directs traffic to a hardware tap device, configures port mirroring rules on the tap device, and mirrors traffic from one port to multiple ports, thereby forwarding a single copy of traffic to multiple analysis terminals. However, this requires manual configuration of port mirroring rules in the hardware tap device, which is inefficient and cannot be automated using software.

[0004] Therefore, how to research and design a vtap traffic distribution method and system based on network protocol that can overcome the above-mentioned defects is a problem that we urgently need to solve. Summary of the Invention

[0005] In order to address the deficiencies in the prior art, the purpose of the present invention is to provide a vtap traffic distribution method and system based on a network protocol, which realizes flexible programmable control when completing traffic mirror distribution to the distribution target while reducing the bandwidth consumption of the collection node.

[0006] The above technical objectives of the present invention are achieved through the following technical solutions:

[0007] In a first aspect, a vtap traffic distribution method based on a network protocol is provided, comprising the following steps:

[0008] Generate a collection strategy including network card list and vtap information;

[0009] According to the collection strategy, the interface traffic in the network card list is captured to obtain the network message, and the vtap information is written into the header of the network protocol corresponding to the forwarded network message, and then the protocol is encapsulated to obtain the forwarded message;

[0010] After parsing the header of the received forwarded message, the analyzer IP list and message truncation length are obtained. The network message is cut according to the message truncation length and then encoded and encapsulated. The encapsulated distribution message is then distributed according to the analyzer IP list.

[0011] Parse and analyze the received distribution message.

[0012] Furthermore, the vtap information includes the IP address of the vtap device, the IP list of analyzers that need to be forwarded, and the message truncation length.

[0013] Furthermore, the network protocol is any one of the Geneve protocol, the TCP protocol and the UDP protocol.

[0014] Furthermore, the forwarded message is sent to the vtap device via raw_socket.

[0015] Furthermore, the header of the network protocol may be configured as a plurality of independent information areas;

[0016] Each information area includes an address area in which the analyzer IP address can be written and a length area in which the truncation length can be written.

[0017] Furthermore, the method further comprises:

[0018] Generate identification based on vtap information;

[0019] Write the identification code into the type area in the header of the network protocol;

[0020] After the vtap device verifies the identification identifier in the forwarded message, it receives and parses the forwarded message.

[0021] Furthermore, the encoding encapsulation uses a VXLAN message format to encapsulate the payload.

[0022] Furthermore, the VNI information in the distribution message encapsulated in the VXLAN message format is directly integrated with the VNI information in the header of the network protocol.

[0023] Secondly, a vtap traffic distribution system based on network protocol is provided, including:

[0024] Controller, used to generate collection strategies including network card lists and vtap information;

[0025] The collector is used to capture the interface traffic in the network card list according to the collection strategy to obtain the network message, and write the vtap information into the header of the network protocol corresponding to the forwarded network message and perform protocol encapsulation to obtain the forwarded message;

[0026] The Vtap device is used to parse the header of the received forwarded message to obtain the analyzer IP list and the message truncation length, cut the network message according to the message truncation length, encode and encapsulate it, and distribute the encapsulated distribution message according to the analyzer IP list;

[0027] Multiple analyzers are used to parse and analyze received distribution messages.

[0028] Furthermore, the collection strategy generated by the controller is broadcast to all subordinate collectors in the form of gRPC broadcast.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. The network protocol-based vtap traffic distribution method provided by the present invention, based on the scalable header characteristics of the network protocol, encapsulates the collected network messages into data packets and forwards them to the vtap device. The header is used to describe the address information of multiple analysis terminals. The vtap device then parses this information, strips off the network protocol header, and forwards the data to the corresponding analysis terminal. While reducing the bandwidth consumption of the collection node, it also achieves flexible programmable control when completing traffic mirror distribution to the distribution target.

[0031] 2. The present invention encapsulates an identification mark in the network protocol header that can be used for identification and verification by the vtap device, thereby reducing the occurrence of erroneous data forwarding by the vtap device and enhancing the security and reliability of traffic distribution;

[0032] 3. When the analyzer changes, the present invention only needs to directly update the vtap information through the controller API, and all changes can be completed without any manual intervention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0034] Figure 1 This is a flowchart of Example 1 of the present invention;

[0035] Figure 2 This is a system block diagram in Example 2 of the present invention. DETAILED DESCRIPTION

[0036] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with examples and drawings. The exemplary embodiments of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0037] Example 1: vtap traffic distribution method based on network protocol, such as Figure 1 As shown, the following steps are included:

[0038] Step S1: Generate a collection strategy including a network card list and vtap information; wherein the vtap information includes the IP address of the vtap device, the list of analyzer IP addresses to be forwarded, and the message truncation length;

[0039] Step S2: Capture the interface traffic in the network card list according to the collection strategy to obtain network messages, write the vtap information into the header of the network protocol corresponding to the forwarded network message, and then perform protocol encapsulation to obtain a forwarded message;

[0040] Step S3: After parsing the header of the received forwarded message, the analyzer IP list and the message truncation length are obtained, the network message is cut according to the message truncation length and then encoded and encapsulated, and the encapsulated distribution message is distributed according to the analyzer IP list;

[0041] Step S4: parse and analyze the received distribution message.

[0042] The present invention provides a VTAP traffic distribution method based on a network protocol. Based on the scalable header feature of the network protocol, the collected network messages are encapsulated into data packets and then forwarded to the VTAP device. The header is used to describe the address information of multiple analysis terminals. The VTAP device then parses the information, strips off the network protocol header, and forwards the data to the corresponding analysis terminal. This method reduces the bandwidth consumption of the collection node and realizes flexible programmable control when completing traffic mirror distribution for the distribution target.

[0043] VTAP information includes the IP address of the VTAP device, the list of analyzer IP addresses that need to be forwarded, and the message truncation length.

[0044] The forwarded message is sent to the vtap device through raw_socket. Raw_socket, that is, the original socket, can receive data frames or data packets on the local network card, which is very useful for monitoring network traffic and analysis.

[0045] In this embodiment, the header of the network protocol can be configured as multiple independent information areas; each information area includes an address area where the analyzer IP address can be written and a length area where the truncation length can be written.

[0046] In addition, in order to reduce the occurrence of erroneous data forwarding by vtap devices and enhance the security and reliability of traffic distribution, the vtap traffic distribution method in the present invention also includes: generating an identification identifier based on vtap information; writing the identification identifier into the type area in the header of the network protocol; and the vtap device receiving and parsing the forwarded message after verifying the identification identifier in the forwarded message.

[0047] Encoding encapsulation uses the VXLAN message format to encapsulate the payload. The VNI information in the distribution message encapsulated in the VXLAN message format is directly integrated with the VNI information in the header of the network protocol.

[0048] The network protocol is any one of a geneve protocol, a tcp protocol, and a udp protocol. The geneve protocol is taken as an example for detailed description.

[0049] The following is a header format of a geneve packet obtained after encapsulation using the geneve protocol:

[0050]

[0051] The following is a format of Variable-Length Option:

[0052]

[0053] In order to distinguish the geneve packet sent after collection from a real service packet by the vtap device, when the geneve packet is encapsulated, the Option Class design value is 0xFF64. When the vtap device analyzes the geneve packet that is not the value, the geneve packet is directly discarded without further processing. Type 0b 0000 0010 is used to indicate that Variable-Length Option Data (hereinafter referred to as VLOD) represents an analyzer information. When the Type is 0b 0000 0010, the length of VLOD is fixed at 64 bits, of which the high 32 bits represent the IPv4 address of the analyzer, and the low 32 bits represent the packet truncation length. A geneve packet can carry multiple Variable-Length Option data, so multiple analyzer IP addresses can be carried at a time, and these addresses will be encapsulated into the packet header. After the header is assembled, the collected data packet is directly sent to the specified vtap device as the load of the geneve through the raw_socket.

[0054] The vtap device listens to the data packet through the raw_socket, discovers the geneve packet, and analyzes the geneve packet. If the packet with the Option Class of 0xFF64 is analyzed, the VLOD is analyzed to obtain the analyzer IP list and the packet truncation length. After the geneve header is analyzed, the real load is obtained. Then, the load is encapsulated in the VXLAN packet format and sent to the analyzer IP list specified in the geneve header. When encapsulating, the packet length is cut, and each specific analyzer can only obtain the original load length of the set truncation length. At the same time, the VNI information of the encapsulated VXLAN packet is directly integrated into the VNI information of the geneve header.

[0055] Embodiment 2: A vtap traffic distribution system based on a network protocol, which is used to implement the vtap traffic distribution method based on a network protocol as described in Embodiment 1, such asFigure 2 As shown, it includes a controller, a collector, a Vtap device, and an analyzer.

[0056] The controller is deployed on non-business nodes, exposes the API interface through the REST API, sets vtap information, and issues control instructions to the collector. Specifically, the controller is used to generate a collection policy that includes a list of network cards and vtap information.

[0057] The collector is deployed at the user service node, capturing packets from the node's network interface card (NIC) and forwarding them to the vtap device. Specifically, the collector captures traffic from the interfaces in the NIC list according to the collection policy, obtains network packets, writes the vtap information into the header of the network protocol corresponding to the forwarded network packet, and then performs protocol encapsulation to obtain the forwarded packet.

[0058] Vtap devices are deployed at non-service nodes, receiving geneve traffic from collectors, parsing it, and distributing it to analyzers. Specifically, Vtap devices parse the header of received forwarded messages to obtain the analyzer IP list and message cutoff length. They then cut network messages based on the cutoff length, encode and encapsulate them, and distribute the encapsulated messages based on the analyzer IP list.

[0059] The analyzer is deployed on a non-service node and is responsible for receiving and analyzing traffic from the vtap device. Specifically, the analyzer parses and analyzes the received distribution messages.

[0060] In this embodiment, the collection strategy generated by the controller is broadcast to all subordinate collectors in the form of gRPC broadcast.

[0061] Working principle: Based on the scalable characteristics of the network protocol header, the present invention encapsulates the collected network messages into data packets and forwards them to the vtap device. The header is used to describe the address information of multiple analysis terminals. The vtap device then parses this information, strips off the network protocol header, and forwards the data to the corresponding analysis terminal. While reducing the bandwidth consumption of the collection node, it achieves flexible programmable control when completing traffic mirror distribution to the distribution target.

[0062] In addition, the present invention encapsulates an identification mark in the network protocol header that can be used for identification and verification by the vtap device, thereby reducing the occurrence of erroneous data forwarding by the vtap device and enhancing the security and reliability of traffic distribution.

[0063] In addition, when the analyzer changes, the present invention only needs to directly update the vtap information through the controller API, and all changes can be completed without any manual intervention.

[0064] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0065] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0066] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0067] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0068] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. The vtap traffic distribution method based on network protocol is characterized by: The following steps are involved: Generate a collection strategy including network card list and vtap information; According to the collection strategy, the interface traffic in the network card list is captured to obtain the network message, and the vtap information is written into the header of the network protocol corresponding to the forwarded network message, and then the protocol is encapsulated to obtain the forwarded message; After parsing the header of the received forwarded message, the analyzer IP list and message truncation length are obtained. The network message is cut according to the message truncation length and then encoded and encapsulated. The encapsulated distribution message is then distributed according to the analyzer IP list. Parse and analyze the received distribution message; The encoding encapsulation uses the VXLAN message format to encapsulate the load; the VNI information in the distribution message encapsulated using the VXLAN message format is directly integrated with the VNI information in the header of the network protocol.

2. The vtap traffic distribution method based on network protocol according to claim 1 is characterized in that: The vtap information includes the IP address of the vtap device, the IP list of the analyzers that need to be forwarded, and the message truncation length.

3. The vtap traffic distribution method based on network protocol according to claim 1 is characterized in that: The network protocol is any one of the Geneve protocol, the TCP protocol and the UDP protocol.

4. The vtap traffic distribution method based on network protocol according to claim 1 is characterized in that: The forwarded message is sent to the vtap device via raw_socket.

5. The vtap traffic distribution method based on network protocol according to claim 1 is characterized in that: The header of the network protocol can be configured into multiple independent information areas; Each information area includes an address area in which the analyzer IP address can be written and a length area in which the truncation length can be written.

6. The vtap traffic distribution method based on network protocol according to claim 1 is characterized in that: The method further includes: Generate identification based on vtap information; The identification identifier is written into the type area in the header of the network protocol; after the vtap device verifies the identification identifier in the forwarded message, it receives the forwarded message and parses it.

7. The vtap traffic distribution system based on network protocol is characterized by: include: Controller, used to generate collection strategies including network card lists and vtap information; The collector is used to capture the interface traffic in the network card list according to the collection strategy to obtain the network message, and write the vtap information into the header of the network protocol corresponding to the forwarded network message and perform protocol encapsulation to obtain the forwarded message; The Vtap device is used to parse the header of the received forwarded message to obtain the analyzer IP list and the message truncation length, cut the network message according to the message truncation length, encode and encapsulate it, and distribute the encapsulated distribution message according to the analyzer IP list; the encoding and encapsulation uses the VXLAN message format to encapsulate the payload; the VNI information in the distribution message encapsulated in the VXLAN message format is directly integrated with the VNI information in the header of the network protocol; Multiple analyzers are used to parse and analyze received distribution messages.

8. The VTAP traffic distribution system based on network protocol according to claim 7 is characterized in that: The collection strategy generated by the controller is broadcast to all subordinate collectors in the form of gRPC broadcast.

Images