A method and device for counting TCP indicators in various dimensions, an electronic device and a medium

Abstract

The application relates to a method and device for counting TCP indicators in various dimensions, electronic equipment and a medium, and aims to solve the technical problem that the existing detection methods in the prior art are inaccurate in counting data due to network problems of external resources, and make real network condition analysis complex. The method comprises the following steps: obtaining first TCP connection snapshot information of a starting time of a counting window and second TCP connection snapshot information of an ending time; subscribing to TCP connection events disconnected in the counting window; comparing the information to obtain a TCP connection list information set; analyzing the TCP connection list information set to obtain categories of various TCP connection events in the TCP connection list information set; calculating a statistical value of the corresponding TCP connection event according to the category of the TCP connection event; based on the statistical value of each TCP connection event, corresponding labels are given to each TCP connection event; and the generated labels are aggregated to obtain TCP indicators of the counting window.

Description

Technical Field

[0001] This invention belongs to the field of Internet technology, and specifically relates to a method, device, electronic device and medium for statistically analyzing TCP metrics from various dimensions. Background Technology

[0002] Edge nodes are a logical abstraction of the basic common capabilities of various edge-side products such as edge gateways, edge controllers, and edge servers. In business scenarios such as CDN, real-time awareness of the network status of edge nodes is crucial.

[0003] In existing technologies, edge node network conditions are collected and statistically analyzed by deploying a large number of external probes to detect services on edge node devices; edge node devices actively detect services deployed in other places; and edge node devices directly collect some system indicators from their own machines to obtain edge node device indicator parameters.

[0004] The existing technology has the following technical problems:

[0005] 1. Deploying a large number of external probes requires deploying a large number of probe servers; actively probing services deployed in other locations via edge node devices requires deploying some open services for the devices to probe. Both of these probing methods can lead to inaccurate statistical data due to network issues of the external resources themselves, complicating the analysis of the actual network situation. Furthermore, both of these probing methods use small packets to save bandwidth consumption during the probing process, making it impossible to detect some network problems.

[0006] 2. By directly collecting some system indicators of the local machine through edge node devices, such as the total number of inbound packets, the number of erroneous packets, the total number of outbound packets, the number of retransmitted packets, etc., there is only a general statistic. When a network problem occurs, it is impossible to pinpoint the specific region or even the specific network card that is causing the problem, and it does not have the function of tracing the source. Summary of the Invention

[0007] This invention provides a method, apparatus, device, and medium for statistically analyzing TCP metrics across various dimensions. It aims to address the shortcomings of existing detection methods, such as inaccurate statistical data due to network issues with external resources, which complicates the analysis of the actual network situation. Furthermore, existing detection methods often use small packets to conserve bandwidth, and some network problems remain undetectable.

[0008] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A method for statistically analyzing TCP metrics across various dimensions, comprising:

[0009] S1: Obtain the first TCP connection snapshot information at the start time of the statistics window, and obtain the second TCP connection snapshot information at the end time of the statistics window;

[0010] S2: Subscribe to disconnected TCP connection events in the statistics window to obtain TCP connection disconnection information;

[0011] S3: Compare the first TCP connection snapshot information, the second TCP connection snapshot information, and the TCP connection disconnection information to obtain a TCP connection list information set. Analyze the TCP connection list information set to obtain the category of each TCP connection event in the TCP connection list information set. Calculate the statistical value of the corresponding TCP connection event based on the category of the TCP connection event.

[0012] S4: Based on the statistical values ​​of each TCP connection event, assign a corresponding label to each TCP connection event;

[0013] S5: Aggregate the tags generated between the start and end times of the statistical window to obtain the TCP metrics of the statistical window.

[0014] The beneficial effects of this invention are: by analyzing the dimensional requirements, this invention assigns a corresponding label to each TCP connection task, analyzes the category to which the TCP connection task belongs, and statistically analyzes the TCP indicators of the device in various dimensions within a fixed period. It can achieve the effect of real-time perception of the network status of edge nodes in service scenarios without the need for external servers, and the data accuracy is high.

[0015] Based on the above technical solution, the present invention can be further improved as follows.

[0016] Furthermore, the above defines the start and end times of the statistical window as a period, obtains the second TCP connection snapshot information of the current period, and uses the second TCP connection snapshot information of the current period as the first TCP connection snapshot information of the start time of the statistical window in the next period.

[0017] The beneficial effects of adopting the above-mentioned further solution are: the present invention facilitates source tracing by periodically acquiring TCP indicators of various dimensions, and uses the TCP connections that have not been disconnected in the previous period as the TCP connections that need to be acquired at the start time of the next period, thereby reducing the amount of computation required for data acquisition in the system.

[0018] Furthermore, the process communicates with the kernel process via the Netlink interface to obtain a set of TCP connection list information.

[0019] The beneficial effects of adopting the above-mentioned further solution are: the present invention enables communication between user processes and kernel processes through the Netlink interface to obtain TCP connection information, eliminating the need to set up an external server to obtain TCP connection information, and avoiding the problem of inaccurate statistical data caused by network problems of external resources themselves.

[0020] Furthermore, each TCP connection event in the aforementioned TCP connection list information set is stored as a quadruple <source IP, source port, destination IP, destination port>.

[0021] The beneficial effect of adopting the above-mentioned further solution is that the present invention records the TCP connection through a quadruple, which plays an important role in ensuring the correct routing of data packets and the reliability of network communication.

[0022] Furthermore, the categories of each TCP connection event obtained in S3 above are as follows:

[0023] Iterate through the TCP connection events in the first TCP connection snapshot information and determine whether the TCP connection events in the first TCP connection snapshot information exist in the TCP connection events in the second TCP connection snapshot information.

[0024] If the TCP connection event in the first TCP connection snapshot information exists in the TCP connection event in the second TCP connection snapshot information, then the corresponding TCP connection event in the first TCP connection snapshot information that exists in the TCP connection event in the second TCP connection snapshot information is classified into the first category;

[0025] If the TCP connection events in the first TCP connection snapshot information do not exist in the TCP connection events in the second TCP connection snapshot information, iterate through the TCP connection disconnection information and determine whether the TCP connection events in the TCP connection disconnection information exist in the TCP connection events in the first TCP connection snapshot information.

[0026] If the TCP connection event in the TCP connection disconnection information exists in the TCP connection event in the first TCP connection snapshot information, then the corresponding TCP connection event in the TCP connection disconnection information that exists in the TCP connection event in the first TCP connection snapshot information is classified into the second category.

[0027] If the TCP connection event in the TCP connection disconnection information does not exist in the TCP connection events of the first TCP connection snapshot information, then the corresponding TCP connection event that does not exist in the TCP connection events of the first TCP connection snapshot information is classified into the third category.

[0028] The beneficial effects of adopting the above-mentioned further solution are: the present invention classifies TCP connection events into different categories based on the different statistical windows of the connection establishment time and connection disconnection time within a period, thereby realizing the sequentiality and integrity of TCP connection event data and ensuring the reliability of TCP connection data.

[0029] Furthermore, in S3 above, the specific calculation of the statistical values ​​for each TCP connection event is as follows:

[0030] The statistical value of the first category of TCP connection events is calculated by subtracting the start time from the end time.

[0031] The statistical value of TCP connection events in the second category is calculated by subtracting the start time from the connection disconnection time of each TCP connection event in the second category.

[0032] The statistical values ​​for the third category of TCP connection events are calculated by obtaining the connection disconnection time of each TCP connection event in the second category and then obtaining the statistical values ​​for the corresponding TCP connection events in the third category.

[0033] The beneficial effect of adopting the above-mentioned further solution is that the present invention calculates the statistical values ​​of each TCP connection event, which makes it easier to assign labels that conform to the actual situation based on the statistical values, thereby achieving the rationality of the subsequent generation of TCP indicators.

[0034] Secondly, in order to solve the above-mentioned technical problems, the present invention also provides a device for statistically analyzing TCP metrics across various dimensions, comprising:

[0035] The statistics window module is used to obtain the first TCP connection snapshot information at the start time of the statistics window, and the second TCP connection snapshot information at the end time of the statistics window;

[0036] The subscription module is used to subscribe to TCP connection disconnection events in the statistics window and obtain TCP connection disconnection information.

[0037] The classification and calculation module is used to compare the first TCP connection snapshot information, the second TCP connection snapshot information, and the TCP connection disconnection information to obtain a TCP connection list information set. The module analyzes the TCP connection list information set to obtain the category of each TCP connection event in the TCP connection list information set, and calculates the statistical value of the corresponding TCP connection event based on the category of the TCP connection event.

[0038] The tag module is used to assign corresponding tags to each TCP connection event based on the statistical values ​​of each TCP connection event.

[0039] The output metrics module is used to aggregate the tags generated between the start and end times of the statistical window to obtain the TCP metrics of the statistical window.

[0040] Thirdly, in order to solve the above-mentioned technical problems, the present invention also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method of statistical TCP metrics of various dimensions of the present application.

[0041] Fourthly, in order to solve the above-mentioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method for statistically analyzing TCP metrics of various dimensions as described in this application.

[0042] Additional aspects and advantages of this application will be set forth in part in the description which follows, and will become apparent from the description or may be learned by practice of this application. Attached Figure Description

[0043] Figure 1 A flowchart illustrating a method for statistically analyzing TCP metrics across various dimensions, provided as an embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram of the structure of a device for statistically analyzing TCP metrics across various dimensions, provided as an embodiment of the present invention.

[0045] Figure 3 This is a schematic diagram of the structure of an electronic device provided in one embodiment of the present invention. Detailed Implementation

[0046] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0047] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0048] This invention provides a possible implementation, such as... Figure 1 The diagram illustrates a method for statistically analyzing TCP metrics across various dimensions. This method may include the following steps:

[0049] S1: Obtain the first TCP connection snapshot information at the start time of the statistics window, and obtain the second TCP connection snapshot information at the end time of the statistics window;

[0050] S2: Subscribe to disconnected TCP connection events in the statistics window to obtain TCP connection disconnection information;

[0051] S3: Compare the first TCP connection snapshot information, the second TCP connection snapshot information, and the TCP connection disconnection information to obtain a TCP connection list information set. Analyze the TCP connection list information set to obtain the category of each TCP connection event in the TCP connection list information set. Calculate the statistical value of the corresponding TCP connection event based on the category of the TCP connection event.

[0052] S4: Based on the statistical values ​​of each TCP connection event, assign a corresponding label to each TCP connection event;

[0053] S5: Aggregate the tags generated between the start and end times of the statistical window to obtain the TCP metrics of the statistical window.

[0054] This invention assigns corresponding tags to each TCP connection task based on the analysis of dimensional requirements, analyzes the category to which the TCP connection task belongs, and statistically analyzes the TCP indicators of the device in various dimensions within a fixed period. It can achieve the effect of real-time perception of the network status of edge nodes in service scenarios without the need for external servers, and the data accuracy is high.

[0055] Optionally, the start and end times of the statistical window are defined as a period, the second TCP connection snapshot information of the current period is obtained, and the second TCP connection snapshot information of the current period is used as the first TCP connection snapshot information of the start time of the statistical window in the next period.

[0056] This invention facilitates source tracing by periodically acquiring TCP metrics of various dimensions, and uses TCP connections that were not disconnected in the previous period as the TCP connections to be acquired at the start time of the next period, thereby reducing the computational workload of the system in acquiring data.

[0057] Optionally, the TCP connection list information set can be obtained by communicating with the kernel process through the Netlink interface.

[0058] This invention enables communication between user processes and kernel processes through the Netlink interface to obtain TCP connection information. This eliminates the need to set up an external server to obtain TCP connection information, thus avoiding inaccurate statistical data caused by network issues of external resources themselves.

[0059] Optionally, each TCP connection event in the TCP connection list information set is stored as a quadruple <source IP, source port, destination IP, destination port>.

[0060] In this embodiment, for TCP retransmission of the network card, it is only necessary to tag the connection with the corresponding network card according to the source IP of which network card. For TCP retransmission of different regions and operators, it is only necessary to tag the corresponding connection with the corresponding region according to the destination IP.

[0061] In this invention, the TCP connection is recorded using a quadruple, which plays an important role in ensuring the correct routing of data packets and the reliability of network communication.

[0062] Optionally, the specific categories of each TCP connection event obtained in S3 are as follows:

[0063] Iterate through the TCP connection events in the first TCP connection snapshot information and determine whether the TCP connection events in the first TCP connection snapshot information exist in the TCP connection events in the second TCP connection snapshot information.

[0064] If the TCP connection event in the first TCP connection snapshot information exists in the TCP connection event in the second TCP connection snapshot information, then the corresponding TCP connection event in the first TCP connection snapshot information that exists in the TCP connection event in the second TCP connection snapshot information is classified into the first category;

[0065] If the TCP connection events in the first TCP connection snapshot information do not exist in the TCP connection events in the second TCP connection snapshot information, iterate through the TCP connection disconnection information and determine whether the TCP connection events in the TCP connection disconnection information exist in the TCP connection events in the first TCP connection snapshot information.

[0066] If the TCP connection event in the TCP connection disconnection information exists in the TCP connection event in the first TCP connection snapshot information, then the corresponding TCP connection event in the TCP connection disconnection information that exists in the TCP connection event in the first TCP connection snapshot information is classified into the second category.

[0067] If the TCP connection event in the TCP connection disconnection information does not exist in the TCP connection events of the first TCP connection snapshot information, then the corresponding TCP connection event that does not exist in the TCP connection events of the first TCP connection snapshot information is classified into the third category.

[0068] In this invention, the connection establishment time and connection termination time of each TCP connection event are divided into different categories based on the different statistical windows within a period, thereby ensuring the sequentiality and integrity of TCP connection event data and guaranteeing the reliability of TCP connection data.

[0069] Optionally, in S3, the statistical values ​​for each TCP connection event are calculated as follows:

[0070] The statistical value of the first category of TCP connection events is calculated by subtracting the start time from the end time.

[0071] The statistical value of TCP connection events in the second category is calculated by subtracting the start time from the connection disconnection time of each TCP connection event in the second category.

[0072] The statistical values ​​for the third category of TCP connection events are calculated by obtaining the connection disconnection time of each TCP connection event in the second category and then obtaining the statistical values ​​for the corresponding TCP connection events in the third category.

[0073] In this invention, by calculating the statistical values ​​of each TCP connection event, it is easier to assign labels that conform to the actual situation based on the statistical values, thereby achieving the rationality of the subsequent generation of TCP metrics.

[0074] Based on and Figure 1 Using the same principle as the method shown, this embodiment of the invention also provides a device for statistically analyzing TCP metrics across various dimensions, such as... Figure 2 As shown, the TCP metrics device that calculates various dimensions may include:

[0075] The statistics window module is used to obtain the first TCP connection snapshot information at the start time of the statistics window, and the second TCP connection snapshot information at the end time of the statistics window;

[0076] The subscription module is used to subscribe to TCP connection disconnection events in the statistics window and obtain TCP connection disconnection information.

[0077] The classification and calculation module is used to compare the first TCP connection snapshot information, the second TCP connection snapshot information, and the TCP connection disconnection information to obtain a TCP connection list information set. The module analyzes the TCP connection list information set to obtain the category of each TCP connection event in the TCP connection list information set, and calculates the statistical value of the corresponding TCP connection event based on the category of the TCP connection event.

[0078] The tag module is used to assign corresponding tags to each TCP connection event based on the statistical values ​​of each TCP connection event.

[0079] The output metrics module is used to aggregate the tags generated between the start and end times of the statistical window to obtain the TCP metrics of the statistical window.

[0080] The TCP indicator counting device of various dimensions in this embodiment can execute the TCP indicator counting method of various dimensions provided in this embodiment. The implementation principle is similar. The actions performed by each module and unit in the TCP indicator counting device of various dimensions in each embodiment of this invention correspond to the steps in the TCP indicator counting method of various dimensions in each embodiment of this invention. For detailed functional descriptions of each module of the TCP indicator counting device of various dimensions, please refer to the descriptions of the corresponding TCP indicator counting methods of various dimensions shown above, which will not be repeated here.

[0081] The aforementioned device for calculating TCP metrics across various dimensions can be a computer program (including program code) running on a computer device. For example, the device for calculating TCP metrics across various dimensions can be an application software. The device can be used to execute the corresponding steps in the method provided in the embodiments of the present invention.

[0082] In some embodiments, the TCP metric counting device for various dimensions provided in this invention can be implemented using a combination of hardware and software. As an example, the TCP metric counting device for various dimensions provided in this invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the TCP metric counting method for various dimensions provided in this invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0083] In other embodiments, the TCP metrics counting device of various dimensions provided in this invention can be implemented in software. Figure 2 A device for calculating TCP metrics across various dimensions, stored in memory, is shown. This device can be software in the form of programs and plugins, and includes a series of modules, including a statistics window module, a subscription module, a classification calculation module, a label module, and an output metrics module, for implementing the method provided in the embodiments of the present invention.

[0084] The modules described in the embodiments of the present invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0085] Based on the same principles as the methods shown in the embodiments of the present invention, the embodiments of the present invention also provide an electronic device, which may include, but is not limited to: a processor and a memory; the memory for storing computer programs; and the processor for executing the methods shown in any embodiment of the present invention by invoking the computer programs.

[0086] In one alternative embodiment, an electronic device is provided, such as Figure 3 As shown, Figure 3 The illustrated electronic device includes a processor and a memory. The processor and memory are connected, for example, via a bus. Optionally, the electronic device may also include a transceiver, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver is not limited to one unit, and the structure of this electronic device does not constitute a limitation on the embodiments of the present invention.

[0087] The processor can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. The processor 4001 can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0088] A bus can include a pathway for transmitting information between the aforementioned components. The bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0089] The memory may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited to these.

[0090] The memory stores application code (computer program) that executes the present invention, and its execution is controlled by a processor. The processor executes the application code stored in the memory to implement the content shown in the foregoing method embodiments.

[0091] Among these, electronic devices can also be terminal devices. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0092] This invention provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the corresponding content in the aforementioned method embodiments.

[0093] According to another aspect of the present invention, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various embodiments described above.

[0094] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0095] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0096] The computer-readable storage medium provided in this invention can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0097] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0098] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for statistically analyzing TCP metrics across various dimensions, characterized in that, include: S1: Obtain the first TCP connection snapshot information at the start time of the statistics window, and obtain the second TCP connection snapshot information at the end time of the statistics window; S2: Subscribe to disconnected TCP connection events in the statistics window to obtain TCP connection disconnection information; S3: Compare the first TCP connection snapshot information, the second TCP connection snapshot information, and the TCP connection disconnection information to obtain a TCP connection list information set. Analyze the TCP connection list information set to obtain the category of each TCP connection event in the TCP connection list information set. Calculate the statistical value of the corresponding TCP connection event based on the category of the TCP connection event. S4: Based on the statistical values ​​of each TCP connection event, assign a corresponding label to each TCP connection event; S5: Aggregate the tags generated between the start and end times of the statistical window to obtain the TCP metrics of the statistical window.

2. The method for statistically analyzing TCP metrics across various dimensions according to claim 1, characterized in that, Define the start and end times of the statistical window as a period, obtain the second TCP connection snapshot information of the current period, and use the second TCP connection snapshot information of the current period as the first TCP connection snapshot information of the start time of the statistical window in the next period.

3. The method for statistically analyzing TCP metrics across various dimensions according to claim 1, characterized in that, It communicates with the kernel process through the Netlink interface to obtain a set of TCP connection list information.

4. The method for statistically analyzing TCP metrics across various dimensions according to claim 1, characterized in that, Each TCP connection event in the TCP connection list information set is stored as a quadruple <source IP, source port, destination IP, destination port>.

5. The method for statistically analyzing TCP metrics across various dimensions according to claim 1, characterized in that, The specific categories of each TCP connection event obtained in S3 are as follows: Iterate through the TCP connection events in the first TCP connection snapshot information and determine whether the TCP connection events in the first TCP connection snapshot information exist in the TCP connection events in the second TCP connection snapshot information. If the TCP connection event in the first TCP connection snapshot information exists in the TCP connection event in the second TCP connection snapshot information, then the corresponding TCP connection event in the first TCP connection snapshot information that exists in the TCP connection event in the second TCP connection snapshot information is classified into the first category; If the TCP connection events in the first TCP connection snapshot information do not exist in the TCP connection events in the second TCP connection snapshot information, iterate through the TCP connection disconnection information and determine whether the TCP connection events in the TCP connection disconnection information exist in the TCP connection events in the first TCP connection snapshot information. If the TCP connection event in the TCP connection disconnection information exists in the TCP connection event in the first TCP connection snapshot information, then the corresponding TCP connection event in the TCP connection disconnection information that exists in the TCP connection event in the first TCP connection snapshot information is classified into the second category. If the TCP connection event in the TCP connection disconnection information does not exist in the TCP connection events of the first TCP connection snapshot information, then the corresponding TCP connection event that does not exist in the TCP connection events of the first TCP connection snapshot information is classified into the third category.

6. The method for statistically analyzing TCP metrics across various dimensions according to claim 5, characterized in that, In S3, the statistical values ​​for each TCP connection event are calculated as follows: The statistical value of the first category of TCP connection events is calculated by subtracting the start time from the end time. The statistical value of TCP connection events in the second category is calculated by subtracting the start time from the connection disconnection time of each TCP connection event in the second category. The statistical values ​​for the third category of TCP connection events are calculated by obtaining the connection disconnection time of each TCP connection event in the second category and then obtaining the statistical values ​​for the corresponding TCP connection events in the third category.

7. A device for statistically analyzing TCP metrics across various dimensions, characterized in that, include: The statistics window module is used to obtain the first TCP connection snapshot information at the start time of the statistics window, and the second TCP connection snapshot information at the end time of the statistics window; The subscription module is used to subscribe to TCP connection disconnection events in the statistics window and obtain TCP connection disconnection information. The classification and calculation module is used to compare the first TCP connection snapshot information, the second TCP connection snapshot information, and the TCP connection disconnection information to obtain a TCP connection list information set. The module analyzes the TCP connection list information set to obtain the category of each TCP connection event in the TCP connection list information set, and calculates the statistical value of the corresponding TCP connection event based on the category of the TCP connection event. The tag module is used to assign corresponding tags to each TCP connection event based on the statistical values ​​of each TCP connection event. The output metrics module is used to aggregate the tags generated between the start and end times of the statistical window to obtain the TCP metrics of the statistical window.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images