Method, device and storage medium for solving IPFIX hash conflict

Abstract

The application discloses a method, device and storage medium for solving IPFIX hash conflict, the method comprising receiving a data stream and enabling IPFIX function; obtaining a lookup key corresponding to the data stream and performing hash lookup, judging whether there is hash conflict according to the lookup result; when there is hash conflict, sending the lookup key to CPU, CPU calculating a new lookup key according to the lookup key and hash factor and performing hash lookup, judging whether there is hash conflict according to the lookup result; when there is hash conflict, continuing to calculate a new lookup key and performing lookup after adding one to the hash factor, until there is no hash conflict, CPU issuing a new ACL, which makes the matched data stream carry the hash factor; matching the data stream according to the new ACL, performing hash lookup according to the hash factor carried by the data stream and the lookup key corresponding to the data stream, and learning the data stream according to the lookup result. The application can solve the problem of IPFIX hash conflict.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network communication technology, and in particular to a method for solving IPFIX hash conflict, and a device and a storage medium for implementing the method. BACKGROUND

[0002] In order to improve the security of the network, the network data flow (Flow) is often detected to determine network anomalies and attacks. With real-time detection of network data flow information, by matching with historical records or matching with abnormal patterns, the network state can be viewed in real time, the possible bottleneck of network performance can be detected, and processing or warning can be performed, thereby ensuring efficient and reliable operation of the network.

[0003] IPFIX (IP Flow Information Export) is used for detecting network data flow information. In order to realize monitoring of a certain data flow, a keyword related to the data flow is configured. When a message is received, the keyword is found and matched, and according to the returned index, the table item for counting the data flow information is determined, including the number of messages, the number of message bytes, the timestamp, etc.

[0004] However, in some scenarios, the integrity of the data flow record is required to be high, and the flow record cannot be missing. If a conflict occurs during hash search, the complete data flow record cannot be recorded, that is, the data flow record will be lost. If a hash conflict occurs, the conflict can be solved by searching a CAM (Content Addressable Memory) table. Due to cost problems, the size of the CAM is limited, and therefore the hash conflict cannot be completely solved. SUMMARY

[0005] The present application aims to provide a method for solving IPFIX hash conflict, which can solve the problem of IPFIX hash conflict without expanding the CAM table, and further provides a device and a storage medium for implementing the method.

[0006] To achieve the above-mentioned purpose, the present application provides a method for solving IPFIX hash conflict, which comprises:

[0007] S100, receiving a data flow and enabling IPFIX function for the data flow by ACL;

[0008] S200, obtaining a search keyword corresponding to the data flow and performing hash search, and determining whether there is a hash conflict according to the search result;

[0009] S300, in response to the existence of hash conflict, sending the search keyword corresponding to the data flow to the CPU.

[0010] S400, obtaining a new search keyword calculated by the CPU according to the received search keyword and the hash factor, performing hash search according to the new search keyword, and judging whether there is hash conflict according to the search result;

[0011] S500, in response to the existence of hash conflict, executing step S400 after adding one to the hash factor, or in response to the non-existence of hash conflict, obtaining a new ACL issued by the CPU and executing S600, wherein the new ACL makes the matched data stream carry the hash factor when no hash conflict is generated;

[0012] S600, matching the data stream according to the new ACL, performing hash search according to the hash factor carried by the data stream and the search keyword corresponding to the data stream, and performing learning of the data stream according to the search result.

[0013] Preferably, judging whether there is hash conflict according to the search result comprises:

[0014] judging whether the entry of the statistical data stream information is occupied, and determining that there is hash conflict when the entry is occupied.

[0015] Preferably, the initial value of the hash factor is 1.

[0016] Preferably, in S300, the search keyword is sent to the CPU through DMA.

[0017] Preferably, in S600, the new ACL further comprises a matching keyword for matching the packet, and the matching keyword comprises five-tuple information.

[0018] The application further discloses a device for solving IPFIX hash conflict, which comprises:

[0019] A first processing module is configured to receive a data stream and enable IPFIX function on the data stream through an ACL.

[0020] A second processing module is configured to obtain a search keyword corresponding to the data stream and perform hash search, and judge whether there is hash conflict according to the search result.

[0021] A third processing module is configured to send the search keyword corresponding to the data stream to the CPU in response to the existence of hash conflict.

[0022] A fourth processing module is configured to obtain a new search keyword calculated by the CPU according to the received search keyword and the hash factor, perform hash search according to the new search keyword, and judge whether there is hash conflict according to the search result.

[0023] The fifth processing module is configured to execute the fourth processing module after adding one to the hash factor in response to the existence of the hash conflict, or acquire a new ACL issued by the CPU and execute the sixth processing module in response to the non-existence of the hash conflict, wherein the new ACL causes the matched data flow to carry the hash factor when the hash conflict does not occur;

[0024] The sixth processing module is configured to match the data flow according to the new ACL, perform hash search according to the hash factor carried by the data flow and the search key corresponding to the data flow, and perform learning of the data flow according to the search result.

[0025] Preferably, the second processing module determines whether the hash conflict exists according to whether the table entry of the statistical data flow information is occupied.

[0026] Preferably, the third processing module is sent to the CPU by DMA.

[0027] The application further discloses a device for solving IPFIX hash conflict, which comprises:

[0028] at least one processor;

[0029] and at least one memory coupled to the at least one processor and storing a computer program for execution by the at least one processor, which, when executed by the at least one processor, causes the device to perform the method described above.

[0030] The application further discloses a computer readable storage medium, which stores a computer program, and the computer program is executed by a machine to implement the method described above.

[0031] The application has the following beneficial effects:

[0032] The application solves the problem of IPFIX hash conflict without expanding the CAM table by setting the hash factor to form a new search key with the search key corresponding to the data flow, until the new search key does not exist in the hash search, thereby improving the reliability of IPFIX data flow monitoring and meeting the integrity requirement of data flow record in some scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a flow chart of the method for solving IPFIX hash conflict in an embodiment of the application;

[0034] Figure 2 is a schematic diagram of a data flow processing flow chart;

[0035] Figure 3 is a schematic diagram of a data flow processing flow chart;

[0036] Figure 4 is a device structure block diagram for solving IPFIX hash conflict in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The technical solutions of the embodiments of the present application will be described clearly and completely in combination with the drawings of the present application.

[0038] The method for solving IPFIX hash conflict disclosed in the present application can avoid IPFIX hash conflict and make IPFIX meet the integrity requirement of data stream record in some scenarios.

[0039] As shown in Figure 1 , the method for solving IPFIX hash conflict disclosed in the present application comprises the following steps:

[0040] S100, receiving a data stream and enabling IPFIX function for the data stream through ACL;

[0041] Specifically, in combination with Figure 2 and Figure 3 , when data stream learning is performed by using IPFIX, IPFIX function needs to be enabled for the received data stream (Flow). In implementation, ACL (Access Control List) is used to enable IPFIX function for the received data stream, for example, the port number in the ACL matching message, and the IPFIX function is enabled for the message matching the port number, and the IPFIX function is not enabled for the message not matching the port number. Of course, in other embodiments, the Action of ACL can also determine the lookup type of IPFIX and some fields of interest, which can be set according to actual requirements.

[0042] S200, obtaining the lookup key corresponding to the data stream and performing hash lookup, and judging whether there is hash conflict according to the lookup result;

[0043] S300, in response to the existence of hash conflict, sending the lookup key corresponding to the data stream to CPU;

[0044] Specifically, in combination with Figure 2 and Figure 3As shown, after the data stream passes through the ACL-enabled IPFIX function, the corresponding search key (Hash Key) of the data stream is further acquired. In implementation, the data stream can be parsed to acquire the information carried by the data stream, and the search key can be formed according to the information, which can be used for subsequent hash search. After the corresponding search key is acquired, hash search is further performed, and whether there is hash conflict is judged according to the hash search result. In implementation, when the index value obtained by hash calculation points to the memory that has been used, and the data of the current hash key is not equal to the data in the memory, it indicates that hash conflict occurs.

[0045] When there is hash conflict, the search key corresponding to the data stream is sent to the CPU. In implementation, the search key corresponding to the data stream is sent to the CPU by DMA. When there is no hash conflict, the data stream is learned, and the information of the data stream is learned to the corresponding table item.

[0046] S400, acquiring a new search key calculated by the CPU according to the received search key and hash factor, performing hash search according to the new search key, and judging again whether there is hash conflict according to the search result;

[0047] Specifically, in combination with Figure 2 and Figure 3 As shown, when hash conflict occurs, the current hash conflict event and the search key corresponding to the data stream are sent to the CPU by DMA. When the CPU receives the DMA message of the hash conflict event, a hash factor (IpfixHashSalt) is determined, and a new search key is formed by using the hash factor and the search key, and hash search is further performed by using the new search key, and whether there is hash conflict is judged according to the search result. In implementation, whether there is hash conflict can be judged by judging whether the table item corresponding to the search key is occupied. When the table item is occupied, it indicates that there is hash conflict; when the table item is not occupied, it indicates that there is no hash conflict.

[0048] S500, in response to the existence of hash conflict, executing step S400 after the hash factor is increased by one, or in response to the non-existence of hash conflict, acquiring the new ACL issued by the CPU and executing S600, wherein the new ACL is used to make the matching data stream carry the hash factor when no hash conflict occurs;

[0049] Specifically, in combination with Figure 2 and Figure 3As shown, when a hash lookup is performed by using a new lookup key, and it is determined according to a lookup result that there is a hash collision, the hash factor is increased by one, and then the lookup key corresponding to the data flow is used to form a new lookup key, that is, the hash factor is increased by one, and then the hash factor and the lookup key corresponding to the data flow are combined to form a new lookup key. When the new lookup key is formed, a hash lookup is continued, and it is determined according to a lookup result whether there is a hash collision. When there is a hash collision, the hash factor is continuously increased by one, and then the hash factor and the lookup key corresponding to the data flow are combined to form a new lookup key, until there is no hash collision.

[0050] When there is no hash collision, the CPU issues a new ACL, and the new ACL is used to match the new data flow, so that the new data flow can carry a corresponding hash factor, and the hash factor is the hash factor selected when there is no hash collision. In this embodiment, the initial value of the hash factor is 1, and of course, the initial value of the hash factor can be set according to actual needs. At the same time, the new ACL can also include a matching key of a matching packet, and the matching key includes five-tuple information.

[0051] S600, according to the new ACL, the data flow is matched, and a hash lookup is performed according to the hash factor carried by the data flow and the key corresponding to the data flow, and learning of the data flow is performed according to a lookup result.

[0052] Specifically, when the CPU issues a new ACL, for the data flow, as shown in Figure 3 the data flow (Flow1) will be matched by using the new ACL, that is, matched by using the ACL2. After the new ACL is matched, a corresponding hash factor can be obtained. Further, a hash lookup is performed by using the hash factor and the lookup key corresponding to the data flow, and at this time, there is no hash collision. As shown, after the hash lookup is performed by using the hash factor and the lookup key corresponding to the data flow, IPFIX3 can be obtained, and the collision is effectively avoided.

[0053] As shown in Figure 4As shown, the application also discloses a device for solving IPFIX hash conflict, comprising a first processing module, a second processing module, a third processing module, a fourth processing module, a fifth processing module and a sixth processing module, wherein the first processing module is used for receiving data flow and enabling IPFIX function through ACL; the second processing module is used for obtaining the search key corresponding to the data flow and performing hash search, and judging whether there is hash conflict according to the search result; the third processing module is used for transmitting the search key corresponding to the data flow to CPU in response to the existence of hash conflict; the fourth processing module is used for obtaining the new search key calculated by CPU according to the received key and hash factor, and further performing hash search according to the new search key, and judging whether there is hash conflict according to the search result; the fifth processing module is used for increasing the hash factor by one in response to the existence of hash conflict, and obtaining the new ACL issued by CPU in response to the non-existence of hash conflict, wherein the new ACL makes the matched data flow carry the hash factor when there is no hash conflict; and the sixth processing module is used for matching data flow according to the new ACL, performing hash search according to the hash factor carried by the data flow and the search key corresponding to the data flow, and performing learning of the data flow according to the search result. How to realize the functions of each processing module is described above, and will not be repeated here.

[0054] The application also discloses a device for solving IPFIX hash conflict, comprising a memory, a processor and a computer program, wherein the computer program is stored in the processor and can be run in the processor, such as a program for solving IPFIX hash conflict. When the processor executes the computer program, each step in the above method can be realized, such as the step of receiving data flow and enabling IPFIX function through ACL.

[0055] For example, the computer program can be divided into one or more units, which are stored in the memory and executed by the memory to complete the application. One or more units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the device for solving IPFIX hash conflict.

[0056] The application further discloses a computer readable storage medium, which stores a computer program, and the computer program can realize the method for solving the IPFIX hash conflict when executed by a processor. The computer program comprises computer program codes, which can be in the form of source codes, executable files or some intermediate forms, and the computer readable medium can comprise any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM) and the like capable of carrying the computer program codes.

[0057] The application solves the IPFIX hash conflict without expanding the CAM table by setting a hash factor to form a new search key with the search key corresponding to the data flow, until the new search key does not exist in the hash search, thereby improving the reliability of the IPFIX data flow monitoring and meeting the completeness requirement of the data flow record in some scenes.

[0058] The technical content and technical features of the application have been disclosed above, however, those skilled in the art can make various replacements and modifications based on the teachings and disclosures of the application without departing from the spirit of the application, therefore, the protection scope of the application should not be limited to the disclosed content of the embodiments, but should include various replacements and modifications without departing from the application, and be covered by the claims of the patent application.

Claims

1. A method for resolving IPFIX hash collisions, characterized in that, The method includes: S100, Receive the data stream and enable the IPFIX function for the data stream through ACL; S200, obtain the search keyword corresponding to the data stream and perform a hash search, and determine whether there is a hash collision based on the search result; S300, in response to the existence of a hash collision, sends the current hash collision event and the lookup key corresponding to the data stream to the CPU via a DMA message; S400: Obtain a new search keyword calculated by the CPU based on the received search keyword and hash factor, perform a hash search based on the new search keyword, and determine whether there is a hash collision based on the search result. The hash factor is determined by the CPU when it receives a DMA message of a hash collision event. S500, in response to the existence of a hash collision, increment the hash factor by one and execute step S400, or in response to the absence of a hash collision, obtain the new ACL issued by the CPU and execute S600, wherein the new ACL makes the matching data stream carry the hash factor when no hash collision occurs; S600 matches the data stream according to the new ACL, obtains the corresponding hash factor, and then performs a hash lookup based on the hash factor and the lookup keyword of the data stream. Based on the lookup results, it learns the data stream.

2. The method according to claim 1, characterized in that, Determining whether a hash collision exists based on the search results includes: Determine whether an entry in the statistical data stream is occupied, and if it is occupied, determine that a hash collision exists.

3. The method according to claim 1, characterized in that, The initial value of the hash factor is 1.

4. The method according to claim 1, characterized in that, In S600, the new ACL also includes a matching keyword for matching packets, and the matching keyword includes five-tuple information.

5. An apparatus for resolving IPFIX hash collisions, characterized in that, The device includes: The first processing module is used to receive the data stream and enable the IPFIX function for the data stream through ACL; The second processing module is used to obtain the search keyword corresponding to the data stream and perform a hash search, and determine whether there is a hash collision based on the search result. The third processing module is used to send the current hash collision event and the lookup key corresponding to the data stream to the CPU via a DMA message in response to the existence of a hash collision. The fourth processing module is used to obtain a new search key calculated by the CPU based on the received search key and hash factor, perform a hash search based on the new search key, and determine whether there is a hash collision based on the search result. The hash factor is determined by the CPU when it receives a DMA message of a hash collision event. The fifth processing module is used to increment the hash factor by one and execute the fourth processing module in response to the existence of a hash collision, or to obtain a new ACL issued by the CPU and execute the sixth processing module in response to the absence of a hash collision. The new ACL makes the matching data stream carry the hash factor when no hash collision occurs. The sixth processing module is used to match the data stream according to the new ACL, obtain the corresponding hash factor, and further perform a hash lookup based on the hash factor and the lookup keyword of the data stream. Based on the lookup results, the data stream is learned.

6. The apparatus according to claim 5, characterized in that, The second processing module determines whether there is a hash collision based on whether the table entries of the statistical data stream information are occupied.

7. An apparatus for resolving IPFIX hash collisions, characterized in that, The device includes: At least one processor; And at least one memory coupled to the at least one processor and storing a computer program for execution by the at least one processor, the computer program, when executed by the at least one processor, causing the apparatus to perform the method according to any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a machine, implements the method according to any one of claims 1 to 4.

Images