Traffic mirroring method, device, computer equipment, and storage medium

Abstract

The present application relates to a traffic mirroring method, device, computer equipment, storage medium and computer program product. The method comprises: determining a source port and a mirror port; determining a virtual switch flow table based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port; mirroring the target traffic in the source port and transmitting it to the mirror port through the virtual switch flow table. The method can improve the efficiency of traffic mirroring processing.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a traffic mirroring method, apparatus, computer equipment, storage medium, and computer program product. Background Art

[0002] Traffic mirroring is a network technology that is used to copy network traffic to one or more monitoring interfaces in real time for analysis and monitoring.

[0003] In the traditional traffic mirroring method, the port traffic of the virtual machine port to be monitored is copied in the switch and transmitted to the mirror port in the switch, thereby realizing the analysis of abnormal traffic in the mirrored traffic and network monitoring.

[0004] However, in the traditional traffic mirroring method, the migration of virtual machines between different computing nodes causes the corresponding ports on the switch of the computing nodes after the migration of the virtual machines to change, and even the virtual machine ports are not in the original switch, so the switch configuration needs to be changed frequently. In the face of complex and changing cloud computing environments, the configuration of switches is difficult, resulting in low traffic mirroring efficiency. Summary of the invention

[0005] Based on this, it is necessary to provide a traffic mirroring method, apparatus, computer equipment, computer-readable storage medium and computer program product to address the above technical issues.

[0006] In a first aspect, the present application provides a traffic mirroring method, the method comprising:

[0007] Determine the source port and mirror port;

[0008] Determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of target traffic of the source port;

[0009] The target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table.

[0010] In this embodiment, the source port and the mirror port are determined; based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port, the virtual switch flow table is determined; the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table. With this method, there is no need to change the configuration of the physical switch, and the mirror traffic transmission from the source port to the mirror port is realized through the virtual switch flow table, thereby improving the efficiency of traffic mirroring.

[0011] In one embodiment, the determining of the direction of target traffic of the source port based on the positional relationship between the source port and the mirror port and the direction of target traffic of the source port includes:

[0012] If the source port and the mirror port are located on the same computing node, determining a same-node virtual switch flow table based on the flow direction of the target traffic of the source port;

[0013] If the source port and the mirror port are located in different computing nodes, a cross-node virtual switch flow table is determined based on the flow direction of the target traffic of the source port.

[0014] In this embodiment, for different traffic mirroring scenarios, matching virtual switch flow tables are determined, and then traffic mirroring of target traffic is implemented through the virtual switch flow tables, thereby improving the processing efficiency and reliability of traffic mirroring.

[0015] In one embodiment, determining the same-node virtual switch flow table based on the flow direction of the target traffic of the source port includes:

[0016] When the flow direction of the target flow of the source port is outbound, determining a mirror flow table, a flow directional flow table, and a port transmission flow table;

[0017] In the case that the flow direction of the target flow of the source port is inbound, the flow directional flow table and the port transmission flow table are determined.

[0018] In this embodiment, by properly configuring the mirror flow table, the traffic directional flow table and the port transmission flow table, the mirror replication and monitoring transmission of the target traffic of the source port can be realized, thereby achieving efficient traffic mirroring processing.

[0019] In one of the embodiments, when the flow direction of the target traffic of the source port is outbound, the virtual switch flow table includes the mirror flow table, the traffic directional flow table, and the port transmission flow table, and the mirroring of the target traffic in the source port to the mirror port through the virtual switch flow table includes:

[0020] Mirroring the target traffic through the mirror flow table to obtain mirror traffic, labeling the mirror traffic, and transmitting the labeled mirror traffic to the traffic directional flow table;

[0021] Performing target field processing on the marked mirrored traffic through the traffic directional flow table, and transmitting the processed mirrored traffic to the port transmission flow table;

[0022] The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

[0023] In this embodiment, by properly configuring the mirror flow table, the traffic directional flow table and the port transmission flow table, the mirror processing and directional transmission of the target traffic of the source port can be realized, thereby realizing efficient traffic mirror processing.

[0024] In one of the embodiments, when the flow direction of the target traffic of the source port is inbound, the virtual switch flow table includes the traffic directional flow table and the port transmission flow table, and the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table, including:

[0025] The target traffic is transmitted to the port transmission flow table, the target traffic is mirrored through the port transmission flow table to obtain mirrored traffic, the mirrored traffic is labeled, and the labeled mirrored traffic is transmitted to the traffic directional flow table;

[0026] Performing target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmitting the processed mirrored traffic to the port transmission flow table;

[0027] The processed mirrored traffic is transmitted to the mirrored port through the port transmission flow table.

[0028] In this embodiment, by properly configuring the traffic directional flow table and the port transmission flow table, the mirror processing and directional transmission of the target traffic of the source port can be realized, thereby realizing efficient traffic mirror processing.

[0029] In one embodiment, determining the cross-node virtual switch flow table based on the flow direction of the target traffic of the source port includes:

[0030] In the case where the flow direction of the target traffic of the source port is outbound, determining the mirror flow table, the traffic directional flow table, the cross-node port transmission flow table and the port transmission flow table;

[0031] In a case where the flow direction of the target traffic of the source port is inbound, the inter-node port transmission flow table, the traffic directional flow table and the port transmission flow table are determined.

[0032] In this embodiment, by reasonably configuring virtual switch flow tables such as mirror flow tables, traffic directional flow tables, cross-node port transmission flow tables and port transmission flow tables, it is possible to mirror the target traffic of the source port and transmit the mirror traffic across nodes to the computing node where the mirror port is located, until the mirror port, thereby achieving efficient traffic mirroring processing.

[0033] In one of the embodiments, when the flow direction of the target traffic of the source port is outbound, the virtual switch flow table includes the mirror flow table, the traffic directional flow table, the cross-node port transmission flow table and the port transmission flow table, and the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table, including:

[0034] Mirroring the target traffic through the mirror flow table to obtain mirror traffic, labeling the mirror traffic, and transmitting the labeled mirror traffic to the traffic directional flow table;

[0035] Performing target field processing on the mirrored traffic through the traffic directional flow table, and transmitting the processed mirrored traffic to the cross-node port transmission flow table;

[0036] Transmitting the mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table;

[0037] The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

[0038] In this embodiment, by reasonably configuring the mirror flow table, traffic directional flow table, cross-node port transmission flow table and port transmission flow table, it is possible to achieve mirror replication of the target traffic of the source port and transmit the mirror traffic across nodes to the computing node where the mirror port is located, until the mirror port, thereby achieving efficient traffic mirroring processing.

[0039] In one of the embodiments, when the flow direction of the target traffic of the source port is inbound, the virtual switch flow table includes the traffic directional flow table, the cross-node port transmission flow table and the port transmission flow table, and the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table, including:

[0040] The target traffic is transmitted to the port transmission flow table, the target traffic is mirrored through the port transmission flow table to obtain mirrored traffic, the mirrored traffic is labeled, and the labeled mirrored traffic is transmitted to the traffic directional flow table;

[0041] Performing target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmitting the processed mirrored traffic to the cross-node port transmission flow table;

[0042] Transmitting the processed mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table;

[0043] The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

[0044] In this embodiment, by reasonably configuring the traffic directional flow table, the cross-node port transmission flow table and the port transmission flow table, it is possible to achieve mirror replication of the target traffic of the source port and transmit the mirror traffic across nodes to the computing node where the mirror port is located, until the mirror port, thereby achieving efficient traffic mirroring processing.

[0045] In a second aspect, the present application also provides a traffic mirroring device, the device comprising:

[0046] A first determination module, used to determine a source port and a mirror port;

[0047] A second determination module is used to determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of a target flow of the source port;

[0048] The transmission module is used to transmit the target traffic in the source port to the mirror port after mirroring through the virtual switch flow table.

[0049] In this embodiment, the source port and the mirror port are determined; based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port, the virtual switch flow table is determined; the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table. With this method, there is no need to change the configuration of the physical switch, and the mirror traffic transmission from the source port to the mirror port is realized through the virtual switch flow table, thereby improving the efficiency of traffic mirroring.

[0050] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0051] Determine the source port and mirror port;

[0052] Determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of target traffic of the source port;

[0053] The target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table.

[0054] In this embodiment, the source port and the mirror port are determined; based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port, the virtual switch flow table is determined; the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table. With this method, there is no need to change the configuration of the physical switch, and the mirror traffic transmission from the source port to the mirror port is realized through the virtual switch flow table, thereby improving the efficiency of traffic mirroring.

[0055] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0056] Determine the source port and mirror port;

[0057] Determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of target traffic of the source port;

[0058] The target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table.

[0059] In this embodiment, the source port and the mirror port are determined; based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port, the virtual switch flow table is determined; the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table. With this method, there is no need to change the configuration of the physical switch, and the mirror traffic transmission from the source port to the mirror port is realized through the virtual switch flow table, thereby improving the efficiency of traffic mirroring.

[0060] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0061] Determine the source port and mirror port;

[0062] Determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of target traffic of the source port;

[0063] The target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table.

[0064] The above-mentioned traffic mirroring method, device, computer equipment, storage medium and computer program product determine the source port and the mirror port; determine the virtual switch flow table based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port; and transmit the target traffic in the source port to the mirror port after mirroring through the virtual switch flow table. With this method, there is no need to change the configuration of the physical switch, and the mirrored traffic transmission from the source port to the mirror port is realized in the form of a virtual switch flow table, thereby improving the efficiency of traffic mirroring. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 A flow chart of a traffic mirroring method in an embodiment;

[0067] Figure 2 A schematic diagram of a process for determining a flow table of a virtual switch on the same node in an embodiment;

[0068] Figure 3 A flowchart of a method for determining a virtual switch flow table under a same computing node in an embodiment;

[0069] Figure 4 A schematic diagram of a flow chart of a method for transmitting outbound mirrored traffic through a virtual switch flow table on the same node in an embodiment;

[0070] Figure 5 A schematic diagram of a flow chart of a method for mirroring outbound traffic of a same computing node in an embodiment;

[0071] Figure 6 A schematic diagram of a flow chart of a method for transmitting directed mirrored traffic through a virtual switch flow table at the same node in another embodiment;

[0072] Figure 7 A schematic diagram of a flow chart of a method for mirroring incoming traffic of a same computing node in an embodiment;

[0073] Figure 8 A schematic diagram of a process for determining a virtual switch flow table across computing nodes in an embodiment;

[0074] Fig. 9 A schematic diagram of a process of transmitting outbound mirrored traffic through a virtual switch flow table in different computing nodes in one embodiment;

[0075] Fig.10 A schematic diagram of a flow chart of a method for mirroring outbound traffic of different computing nodes in an embodiment;

[0076] Fig.11 A schematic diagram of a flow chart of a method for transmitting directed mirrored traffic through a virtual switch flow table at different nodes in an embodiment;

[0077] Fig.12 A schematic diagram of a flow chart of a method for mirroring inbound traffic of different computing nodes in an embodiment;

[0078] Fig.13 is a structural block diagram of a traffic mirroring device in an embodiment;

[0079] Fig.14 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0080] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0081] In an exemplary embodiment, since a virtual machine may migrate between different computing nodes, the original traffic mirroring method uses a physical switch for traffic mirroring and traffic mirroring transmission, which often requires reconfiguring the switch. In order to improve the efficiency of traffic mirroring, Figure 1 As shown, a traffic mirroring method is provided, which is described by taking the method applied to a cloud platform as an example, and includes the following steps 102 to 106. Among them:

[0082] Step 102, determine the source port and the mirror port.

[0083] In the implementation, the traffic of the virtual machine is monitored in the cloud platform, mainly by monitoring and analyzing the mirrored traffic after mirroring the traffic of the virtual machine to determine whether there is any abnormality in the virtual machine traffic. A virtual machine may have multiple ports. The mirrored port is the output port after the traffic is mirrored, which is generally also the virtual machine port. In the process of monitoring the traffic of the virtual machine, the port that needs to be mirrored in the virtual machine is used as the source port. The cloud platform first determines the source port and the corresponding mirrored port.

[0084] Step 104: determine the virtual switch flow table based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port.

[0085] In implementation, the cloud platform determines the virtual switch flow table (i.e., OVS flow table, Open vSwitch, industrial-grade quality virtual switch) based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port. Specifically, the source port and mirror port of the virtual machine to be mirrored in the cloud platform can be in one computing node or distributed in two different computing nodes. Therefore, the cloud platform determines the virtual switch flow table required for traffic mirroring based on traffic mirroring scenarios such as whether the source port and the mirror port are in the same computing node, whether the flow direction of the target traffic to be mirrored is flowing into the source port of the virtual machine, or flowing out of the source port of the virtual machine.

[0086] Step 106: Mirror the target traffic in the source port through the virtual switch flow table and transmit it to the mirror port.

[0087] In the implementation, the target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table. Specifically, an OVS flow table for traffic mirroring is created on the cloud platform, and corresponding flow table rules are configured to match the traffic mirroring scenario of the virtual machine that needs to be mirrored. When a virtual switch flow table matching the traffic mirroring scenario is determined, the target traffic in the source port of the virtual machine is mirrored and transmitted to the mirror port through the determined virtual switch flow table.

[0088] The above traffic mirroring method determines the source port and the mirroring port; determines the virtual switch flow table based on the positional relationship between the source port and the mirroring port and the flow direction of the target traffic of the source port; and transmits the target traffic in the source port to the mirroring port after mirroring through the virtual switch flow table. With this method, there is no need to change the configuration of the physical switch, and the mirrored traffic transmission from the source port to the mirroring port is realized through the virtual switch flow table, thereby improving the efficiency of traffic mirroring.

[0089] In an exemplary embodiment, for different traffic mirroring scenarios, the required virtual switch flow table is as follows: Figure 2 As shown, step 104 includes steps 202 to 206. Among them:

[0090] Step 202: If the source port and the mirror port are located in the same computing node, determine the virtual switch flow table of the same node based on the flow direction of the target traffic of the source port.

[0091] In implementation, if the source port and the mirror port are located on the same computing node, the traffic mirroring process does not need to cross computing nodes. Therefore, only the direction of the target traffic needs to be considered. The cloud platform can determine the same-node virtual switch flow table that matches the traffic direction based on the direction of the target traffic of the source port.

[0092] Step 204: If the source port and the mirror port are located in different computing nodes, determine the cross-node virtual switch flow table based on the flow direction of the target traffic of the source port.

[0093] In implementation, if the source port and the mirror port are in different computing nodes, the traffic mirroring process needs to cross computing nodes. The cloud platform considers the needs of cross-node and target traffic flow direction and determines the matching cross-node virtual switch flow table.

[0094] In this embodiment, for different traffic mirroring scenarios, matching virtual switch flow tables are determined, and then traffic mirroring of target traffic is implemented through the virtual switch flow tables, thereby improving the processing efficiency and reliability of traffic mirroring.

[0095] In an exemplary embodiment, in the case of traffic mirroring on the same computing node, Figure 3 As shown, the specific processing process of step 106 includes steps 302 to 304. Among them:

[0096] Step 302: When the flow direction of the target traffic of the source port is outbound, determine a mirror flow table, a traffic directional flow table, and a port transmission flow table.

[0097] In implementation, when the flow direction of the target traffic of the source port is outbound, the cloud platform determines the mirror flow table, traffic directional flow table and port transmission flow table that match the traffic mirroring scenario based on the same computing node and the traffic mirroring scenario of the outbound traffic. Among them, the mirror flow table is used to mirror the target traffic of the source port, obtain the mirrored traffic, and mark the mirrored traffic. The traffic directional flow table is used to perform port directional processing on the mirrored traffic. The port transmission flow table is used to transmit the mirrored traffic to the mirrored port. The embodiment of the present application does not limit the number and type of virtual switch flow tables required in the traffic mirroring process, which can be determined based on specific business needs and traffic mirroring scenarios.

[0098] Step 304: when the flow direction of the target flow of the source port is inbound, determine a flow directional flow table and a port transmission flow table.

[0099] In implementation, when the flow direction of the target traffic of the source port is inbound, the cloud platform determines the traffic directional flow table and port transmission flow table that match the traffic mirroring scenario based on the same computing node and the traffic mirroring scenario of the inbound traffic. Among them, the port transmission flow table is used to access the inbound target traffic flowing into the virtual machine, and mirror the target traffic to obtain the mirrored traffic. And, the port transmission flow table is also used to transmit the mirrored traffic to the mirrored port. During the transmission of the mirrored traffic, the traffic directional flow table is used to perform port directional processing on the mirrored traffic. The embodiment of the present application does not limit the number and type of virtual switch flow tables required in the traffic mirroring process, and can be determined based on specific business needs and traffic mirroring scenarios.

[0100] In this embodiment, by properly configuring the mirror flow table, the traffic directional flow table and the port transmission flow table, the mirror replication and monitoring transmission of the target traffic of the source port can be realized, thereby achieving efficient traffic mirroring processing.

[0101] In an exemplary embodiment, Figure 4 As shown, when the source port and the mirror port are located in the same computing node and the flow direction of the target flow of the source port is outbound, it is determined that the virtual switch flow table includes a mirror flow table, a flow directional flow table, and a port transmission flow table, and then, the process of performing flow mirroring based on the determined virtual switch flow table, that is, the specific processing process of step 104 includes steps 402 to 404. Among them:

[0102] Step 402: Mirror the target traffic through the mirror flow table to obtain mirror traffic, mark the mirror traffic with a label, and transmit the marked mirror traffic to the traffic directional flow table.

[0103] In the implementation, the cloud platform mirrors the target traffic through the mirror flow table to obtain the mirror traffic. During the mirror processing, the mirror traffic is labeled, that is, it is labeled with a geneve (a network encapsulation protocol) label. Then, the cloud platform transmits the labeled mirror traffic to the traffic directional flow table. Specifically, the virtual switch flow table in each traffic mirroring scenario in the cloud platform can be distinguished by scenario and function in the form of numbering, such as Figure 5 As shown in the figure, the mirror flow table is table 0, and the flow directional flow table is table 150. The target traffic of the virtual machine running on a computing node in the cloud platform comes out from the source port and enters table 0. The message is cloned (i.e., mirrored) in table 0 to obtain mirrored traffic. The mirrored traffic is marked with a geneve label and transmitted to table 150.

[0104] The geneve tag is planned in advance by SDN (Software Defined Networking) and is specifically used to mark mirrored traffic packets. One geneve corresponds to one mirrored port.

[0105] Step 404: Perform target field processing on the marked mirrored traffic through the traffic directional flow table, and transmit the processed mirrored traffic to the port transmission flow table.

[0106] In implementation, the cloud platform processes the marked mirror traffic with the target field through the traffic orientation flow table to achieve port orientation of the mirror traffic, and then the cloud platform transmits the processed mirror traffic to the port transmission flow table. Specifically, Figure 5 In the figure, the port transmission flow table is table 115. For the geneve label carried by the mirrored traffic, table 150 is matched first, and the reg6 field (representing the source port field) in the mirrored traffic is changed to field reg7 (representing the mirrored port field) through table 150. Then, the mirrored traffic message is submitted to table 115 (i.e., the port transmission flow table) to realize the transmission of the mirrored traffic.

[0107] Step 406: Send the processed mirrored traffic to the mirrored port through the port transmission flow table.

[0108] In the implementation, the cloud platform sends the processed mirrored traffic to the mirrored port through the port transmission flow table. Specifically, based on the reg7 field in the traffic mirror, the cloud platform directly sends the traffic mirror message to the mirrored port through table 115. At this point, all outbound traffic of the virtual machine will be sent to the mirrored port, and the traffic can be analyzed by the mirrored port of the virtual machine.

[0109] In this embodiment, by properly configuring the mirror flow table, the traffic directional flow table and the port transmission flow table, the mirror processing and directional transmission of the target traffic of the source port can be realized, thereby realizing efficient traffic mirror processing.

[0110] In an exemplary embodiment, Figure 6 As shown, when the source port and the mirror port are located in the same computing node and the flow direction of the target flow of the source port is inbound, it is determined that the virtual switch flow table includes a mirror flow table, a flow directional flow table, and a port transmission flow table, and then, the process of performing flow mirroring based on the determined virtual switch flow table, that is, the specific processing process of step 104 includes steps 602 to 606. Among them:

[0111] Step 602: transmit the target traffic to the port transmission flow table, mirror the target traffic through the port transmission flow table to obtain mirror traffic, mark the mirror traffic with a label, and transmit the marked mirror traffic to the traffic directional flow table.

[0112] In the implementation, the target traffic flowing into the virtual machine will first flow to the port transmission flow table, and the target traffic will be mirrored through the port transmission flow table to obtain the mirrored traffic. In the process of mirroring, the mirrored traffic is labeled, that is, it is labeled with a geneve (a network encapsulation protocol) label. Then, the cloud platform will transmit the labeled mirrored traffic to the traffic directional flow table based on the label. Specifically, Figure 7 As shown in the figure, the flow direction directional flow table is table 150, and the port transmission flow table is table 115. The incoming target traffic of the virtual machine on a computing node in the cloud platform first enters table 115, and the message is cloned (i.e., mirrored) in table 115 to obtain mirrored traffic. The mirrored traffic is marked with a geneve label. For the geneve label carried by the mirrored traffic, table 150 is matched first, and the labeled mirrored traffic is transmitted to table 150.

[0113] Step 604: Perform target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmit the processed mirrored traffic to the port transmission flow table.

[0114] In the implementation, the cloud platform processes the target field of the marked mirror traffic through the traffic orientation flow table to achieve port orientation of the mirror traffic, and then the cloud platform transmits the processed mirror traffic to the port transmission flow table. Specifically, Figure 7 The Zhongyun platform changes the reg6 field (representing the source port field) in the mirrored traffic to the reg7 field (representing the mirrored port field) through table 150, and then submits the mirrored traffic message to table 115 (i.e., the port transmission flow table) to realize the transmission of the mirrored traffic.

[0115] Step 606: Transmit the processed mirrored traffic to the mirrored port through the port transmission flow table.

[0116] In implementation, the cloud platform sends the processed mirrored traffic to the mirrored port through the port transmission flow table (eg, table 115). The specific mirrored traffic transmission process is similar to the process of step 406 above, and the present embodiment of the application will not be repeated here.

[0117] In this embodiment, by properly configuring the traffic directional flow table and the port transmission flow table, the mirror processing and directional transmission of the target traffic of the source port can be realized, thereby realizing efficient traffic mirror processing.

[0118] In an exemplary embodiment, Figure 8 As shown in the figure, for the case of traffic mirroring of different computing nodes, Figure 8 As shown, the specific processing process of step 106 includes steps 802 to 804. Among them:

[0119] Step 802: when the flow direction of the target traffic of the source port is outbound, determine a mirror flow table, a traffic directional flow table, an inter-node port transmission flow table, and a port transmission flow table.

[0120] In implementation, when the flow direction of the target traffic of the source port is outbound, the cloud platform determines the mirror flow table, traffic directional flow table, cross-node port transmission flow table and port transmission flow table that match the traffic mirroring scenario based on different computing nodes (cross-node) and traffic mirroring scenarios of outbound traffic. Among them, the mirror flow table is used to mirror the target traffic of the source port, obtain mirrored traffic, and mark the mirrored traffic. The cross-node port transmission flow table realizes the transmission of mirrored traffic across computing nodes through a tunnel (geneve tunnel). The traffic directional flow table is used to perform port-directional processing on the mirrored traffic. The port transmission flow table is used to transmit the mirrored traffic to the mirrored port. The embodiment of the present application does not limit the number and type of virtual switch flow tables required in the traffic mirroring process, which can be determined based on specific business needs and traffic mirroring scenarios.

[0121] Step 804 , when the flow direction of the target traffic of the source port is inbound, determine the cross-node port transmission flow table, the traffic directional flow table and the port transmission flow table.

[0122] In implementation, when the flow direction of the target traffic of the source port is inbound, the cloud platform determines the cross-node port transmission flow table, traffic directional flow table and port transmission flow table that match the traffic mirroring scenario based on different computing nodes (cross-node) and traffic mirroring scenarios of inbound traffic. Among them, the cross-node port transmission flow table realizes the transmission of mirrored traffic across computing nodes through a tunnel (geneve tunnel). The traffic directional flow table is used to perform port directional processing on the mirrored traffic. The port transmission flow table is used to access the inbound target traffic flowing to the virtual machine, and mirror the target traffic to obtain the mirrored traffic. And, the port transmission flow table is also used to transmit the mirrored traffic to the mirrored port. The embodiment of the present application does not limit the number and type of virtual switch flow tables required in the traffic mirroring process, and can be determined based on specific business needs and traffic mirroring scenarios.

[0123] In this embodiment, by reasonably configuring virtual switch flow tables such as mirror flow tables, traffic directional flow tables, cross-node port transmission flow tables and port transmission flow tables, it is possible to mirror the target traffic of the source port and transmit the mirror traffic across nodes to the computing node where the mirror port is located, until the mirror port, thereby achieving efficient traffic mirroring processing.

[0124] In an exemplary embodiment, Fig. 9 As shown, when the source port and the mirror port are located in different computing nodes and the flow direction of the target flow of the source port is outbound, it is determined that the virtual switch flow table includes a mirror flow table, a flow directional flow table, a cross-node port transmission flow table, and a port transmission flow table. Then, the process of performing flow mirroring based on the determined virtual switch flow table, that is, the specific processing process of step 104 includes steps 902 to 906. Among them:

[0125] Step 902: Mirror the target traffic through the mirror flow table to obtain mirror traffic, mark the mirror traffic with a label, and transmit the marked mirror traffic to the traffic directional flow table.

[0126] In the implementation, the cloud platform mirrors the target traffic through the mirror flow table to obtain the mirror traffic, and labels the mirror traffic during the mirror processing, that is, it adds a geneve (a network encapsulation protocol) label, and then the cloud platform transmits the labeled mirror traffic to the traffic directional flow table. Specifically, Fig.10 As shown in the figure, the mirror flow table is table 0, and the flow directional flow table is table 150. The target traffic of the virtual machine running on a computing node in the cloud platform comes out from the source port and enters table 0. The message is cloned (i.e., mirrored) in table 0 to obtain mirrored traffic. The mirrored traffic is marked with a geneve label and matched with table 150 based on the geneve label. The marked mirrored traffic is transmitted to table 150.

[0127] Step 904: Perform target field processing on the mirrored traffic through the traffic directional flow table, and transmit the processed mirrored traffic to the cross-node port transmission flow table.

[0128] In the implementation, the cloud platform processes the target field of the labeled mirror traffic through the traffic orientation flow table to achieve port orientation of the mirror traffic. Then, the cloud platform transmits the processed mirror traffic to the cross-node port transmission flow table. Specifically, Fig.10 For the geneve label carried by the mirrored traffic, table 150 is first matched, and the reg6 field (representing the source port field) in the mirrored traffic is changed to field reg7 (representing the mirrored port field) through table 150. Then, the processed mirrored traffic message is submitted to table 75 (i.e., the cross-node port transmission flow table) to realize the transmission of the mirrored traffic across computing nodes.

[0129] Step 906: Transmit the mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table.

[0130] In implementation, the cloud platform transmits the mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table. Fig.10 As shown, based on the match of field reg7 to table 75, the processed mirrored traffic message is submitted to table 75 (i.e., the cross-node port transmission flow table), and in table 75, the mirrored traffic is transmitted to the computing node where the mirrored port is located through the transmission tunnel (geneve tunnel) to realize the transmission of the mirrored traffic across computing nodes.

[0131] Step 908: In the computing node where the mirror port is located, the processed mirror traffic is sent to the mirror port through the port transmission flow table.

[0132] In implementation, in the computing node where the mirror port is located, the cloud platform sends the processed mirror traffic to the mirror port through the port transmission flow table. Fig.10 As shown in the figure, the mirrored traffic carries the tun_id identifier, and matches table 0 based on the tun_id identifier. At this time, table 0 in the computing node where the mirrored port is located does not perform secondary mirroring on the mirrored traffic, but is only used for mirrored traffic transmission. Then, the cloud platform determines the mirrored port based on the reg7 field in the mirrored traffic. The cloud platform directly sends the traffic mirroring message to the mirrored port through table 115 (port transmission flow table).

[0133] In this embodiment, by reasonably configuring the mirror flow table, traffic directional flow table, cross-node port transmission flow table and port transmission flow table, it is possible to achieve mirror replication of the target traffic of the source port and transmit the mirror traffic across nodes to the computing node where the mirror port is located, until the mirror port, thereby achieving efficient traffic mirroring processing.

[0134] In an exemplary embodiment, Fig.11 As shown, when the source port and the mirror port are located in different computing nodes and the flow direction of the target flow of the source port is inbound, it is determined that the virtual switch flow table includes a flow directional flow table and a port transmission flow table, and then, the process of performing flow mirroring based on the determined virtual switch flow table, that is, the specific processing process of step 104 includes steps 1102 to 1108. Among them:

[0135] Step 1102, the target traffic is transmitted to the port transmission flow table, the target traffic is mirrored through the port transmission flow table to obtain mirrored traffic, and the mirrored traffic is labeled, and the labeled mirrored traffic is transmitted to the traffic directional flow table.

[0136] In practice, the target traffic flowing into the virtual machine will first flow to the port transmission flow table, and the cloud platform will mirror the target traffic through the port transmission flow table to obtain the mirrored traffic. In the process of mirroring, the mirrored traffic is labeled, that is, it is labeled with a geneve (a network encapsulation protocol) label. Then, the cloud platform will transmit the labeled mirrored traffic to the traffic directional flow table based on the label. Specifically, Fig.12 As shown in the figure, the incoming target traffic of a virtual machine on a computing node in the cloud platform first enters table 115 (port transmission flow table), and the message is cloned (i.e., mirrored) in table 115 to obtain mirrored traffic. The mirrored traffic is tagged with a geneve label. For the geneve label carried by the mirrored traffic, table 150 is first matched, and the tagged mirrored traffic is transmitted to table 150.

[0137] Step 1104 , performing target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmitting the processed mirrored traffic to the cross-node port transmission flow table.

[0138] In the implementation, the cloud platform processes the marked mirror traffic through the traffic directional flow table to obtain the processed mirror traffic. Then, the cloud platform transmits the processed mirror traffic to the port transmission flow table. Specifically, Fig.12 As shown in the figure, the cloud platform changes the reg6 field (representing the source port field) in the mirrored traffic to the reg7 field (representing the mirrored port field) through table 150 to obtain the processed mirrored traffic. Then, the processed mirrored traffic is submitted to table 75 (i.e., the cross-node port transmission flow table), which is used to realize the cross-node transmission of the mirrored traffic.

[0139] Step 1106 , transmit the processed mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table.

[0140] In implementation, the cloud platform transmits the mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table. Fig.12 As shown, the processed mirrored traffic message is submitted to table 75 (i.e., the cross-node port transmission flow table), and the mirrored traffic is transmitted to the computing node where the mirrored port is located through the transmission tunnel (geneve tunnel) in table 75 to realize the transmission of the mirrored traffic across computing nodes.

[0141] Step 1108: Send the processed mirrored traffic to the mirrored port through the port transmission flow table.

[0142] In implementation, in the computing node where the mirror port is located, the cloud platform sends the processed mirror traffic to the mirror port through the port transmission flow table. Fig.12As shown in the figure, the mirrored traffic carries the tun_id identifier, and matches table 0 based on the tun_id identifier. At this time, table 0 in the computing node where the mirrored port is located does not perform secondary mirroring on the mirrored traffic, but is only used for mirrored traffic transmission. Then, the cloud platform determines the mirrored port based on the reg7 field in the mirrored traffic. The cloud platform directly sends the traffic mirroring message to the mirrored port through table 115 (port transmission flow table).

[0143] In this embodiment, by reasonably configuring the traffic directional flow table, the cross-node port transmission flow table and the port transmission flow table, it is possible to achieve mirror replication of the target traffic of the source port and transmit the mirror traffic across nodes to the computing node where the mirror port is located, until the mirror port, thereby achieving efficient traffic mirroring processing.

[0144] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0145] Based on the same inventive concept, the embodiment of the present application also provides a traffic mirroring device for implementing the traffic mirroring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more traffic mirroring device embodiments provided below can refer to the limitations on the traffic mirroring method above, and will not be repeated here.

[0146] In an exemplary embodiment, Fig.13 As shown, a traffic mirroring device is provided, including: a first determination module 1301, a second determination module 1302 and a transmission module 1303, wherein:

[0147] A first determination module 1301 is used to determine a source port and a mirror port;

[0148] A second determination module 1302 is used to determine a virtual switch flow table based on a positional relationship between a source port and a mirror port and a flow direction of a target flow of the source port;

[0149] The transmission module 1303 is used to mirror the target traffic in the source port through the virtual switch flow table and transmit it to the mirror port.

[0150] In one of the embodiments, the second determination module 1302 is specifically configured to determine a same-node virtual switch flow table based on a flow direction of a target flow of the source port if the source port and the mirror port are located on the same computing node;

[0151] If the source port and the mirror port are in different computing nodes, the cross-node virtual switch flow table is determined based on the flow direction of the target traffic of the source port.

[0152] In one embodiment, the second determination module 1302 is specifically used to determine the mirror flow table, the flow directional flow table and the port transmission flow table when the flow direction of the target flow of the source port is outbound;

[0153] When the flow direction of the target flow of the source port is inbound, a flow directional flow table and a port transmission flow table are determined.

[0154] In one of the embodiments, when the flow direction of the target traffic of the source port is outbound, the virtual switch flow table includes a mirror flow table, a traffic directional flow table, and a port transmission flow table, and the transmission module 1303 is specifically used to mirror the target traffic through the mirror flow table to obtain the mirror traffic, and label the mirror traffic, and transmit the labeled mirror traffic to the traffic directional flow table;

[0155] Perform target field processing on the marked mirrored traffic through the traffic directional flow table, and transmit the processed mirrored traffic to the port transmission flow table;

[0156] The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

[0157] In one of the embodiments, when the flow direction of the target traffic of the source port is inbound, the virtual switch flow table includes a traffic directional flow table and a port transmission flow table, and the transmission module 1303 is specifically used to transmit the target traffic to the port transmission flow table, mirror the target traffic through the port transmission flow table to obtain the mirror traffic, label the mirror traffic, and transmit the labeled mirror traffic to the traffic directional flow table;

[0158] Performing target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmitting the processed mirrored traffic to the port transmission flow table;

[0159] The processed mirrored traffic is transmitted to the mirrored port through the port transmission flow table.

[0160] In one of the embodiments, the second determination module 1302 is specifically used to determine the mirror flow table, the flow directional flow table, the cross-node port transmission flow table and the port transmission flow table when the flow direction of the target flow of the source port is outbound;

[0161] When the flow direction of the target traffic of the source port is inbound, an inter-node port transmission flow table, a traffic directional flow table, and a port transmission flow table are determined.

[0162] In one of the embodiments, when the flow direction of the target traffic of the source port is outbound, the virtual switch flow table includes a mirror flow table, a traffic directional flow table, an inter-node port transmission flow table, and a port transmission flow table, and the transmission module 1303 is specifically used to mirror the target traffic through the mirror flow table to obtain the mirror traffic, label the mirror traffic, and transmit the labeled mirror traffic to the traffic directional flow table;

[0163] Perform target field processing on the mirrored traffic through the traffic directional flow table, and transmit the processed mirrored traffic to the cross-node port transmission flow table;

[0164] Transmit the mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table;

[0165] The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

[0166] In one of the embodiments, when the flow direction of the target traffic of the source port is inbound, the virtual switch flow table includes a traffic directional flow table, an inter-node port transmission flow table and a port transmission flow table, and the transmission module 1303 is specifically used to transmit the target traffic to the port transmission flow table, mirror the target traffic through the port transmission flow table to obtain the mirror traffic, label the mirror traffic, and transmit the labeled mirror traffic to the traffic directional flow table;

[0167] Perform target field processing on the marked mirror traffic through the traffic directional flow table to obtain the processed mirror traffic, and transmit the processed mirror traffic to the cross-node port transmission flow table;

[0168] The processed mirror traffic is transmitted to the computing node where the mirror port is located through the cross-node port transmission flow table;

[0169] The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

[0170] Each module in the above-mentioned traffic mirroring device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0171] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.14 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store network traffic and mirror traffic data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a traffic mirroring method is implemented.

[0172] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0173] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0174] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0175] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0176] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0177] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0178] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A traffic mirroring method, characterized in that: The method comprises: Determine the source port and mirror port; Determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of target traffic of the source port; The target traffic in the source port is mirrored and transmitted to the mirror port through the virtual switch flow table; In a case where the flow direction of the target traffic of the source port is outbound, mirroring the target traffic in the source port through the virtual switch flow table and transmitting the mirrored traffic to the mirrored port includes: Mirroring the target traffic through the mirror flow table to obtain mirror traffic, marking the mirror traffic with a label, and transmitting the marked mirror traffic to the traffic directional flow table; Performing target field processing on the marked mirrored traffic through the traffic directional flow table, and transmitting the processed mirrored traffic to the port transmission flow table; The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

2. The method according to claim 1, characterized in that The determining of the virtual switch flow table based on the positional relationship between the source port and the mirror port and the flow direction of the target traffic of the source port includes: If the source port and the mirror port are located on the same computing node, determining a same-node virtual switch flow table based on the flow direction of the target traffic of the source port; If the source port and the mirror port are located in different computing nodes, a cross-node virtual switch flow table is determined based on the flow direction of the target traffic of the source port.

3. The method according to claim 2, characterized in that The determining of the same-node virtual switch flow table based on the flow direction of the target traffic of the source port includes: When the flow direction of the target flow of the source port is outbound, determining a mirror flow table, a flow directional flow table, and a port transmission flow table; In the case that the flow direction of the target flow of the source port is inbound, the flow directional flow table and the port transmission flow table are determined.

4. The method according to claim 1, characterized in that In the case where the flow direction of the target traffic of the source port is inbound, the method further includes: The target traffic is transmitted to the port transmission flow table, the target traffic is mirrored through the port transmission flow table to obtain mirrored traffic, the mirrored traffic is labeled, and the labeled mirrored traffic is transmitted to the traffic directional flow table; Performing target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmitting the processed mirrored traffic to the port transmission flow table; The processed mirrored traffic is transmitted to the mirrored port through the port transmission flow table.

5. The method according to claim 2, characterized in that: The cross-node virtual switch flow table includes a mirror flow table, a flow directional flow table, a cross-node port transmission flow table, and a port transmission flow table. The flow direction of the target flow of the source port is determined to determine the cross-node virtual switch flow table, including: In the case where the flow direction of the target traffic of the source port is outbound, determining the mirror flow table, the traffic directional flow table, the cross-node port transmission flow table and the port transmission flow table; In a case where the flow direction of the target traffic of the source port is inbound, the inter-node port transmission flow table, the traffic directional flow table and the port transmission flow table are determined.

6. The method according to claim 1, characterized in that In the case where the flow direction of the target traffic of the source port is outbound, the virtual switch flow table further includes a cross-node port transmission flow table, and the method further includes: Mirroring the target traffic through the mirror flow table to obtain mirror traffic, labeling the mirror traffic, and transmitting the labeled mirror traffic to the traffic directional flow table; Performing target field processing on the mirrored traffic through the traffic directional flow table, and transmitting the processed mirrored traffic to the cross-node port transmission flow table; Transmitting the mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table; The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

7. The method according to claim 1, characterized in that In the case where the flow direction of the target traffic of the source port is inbound, the virtual switch flow table further includes a cross-node port transmission flow table, and the method further includes: The target traffic is transmitted to the port transmission flow table, the target traffic is mirrored through the port transmission flow table to obtain mirrored traffic, the mirrored traffic is labeled, and the labeled mirrored traffic is transmitted to the traffic directional flow table; Performing target field processing on the marked mirrored traffic through the traffic directional flow table to obtain processed mirrored traffic, and transmitting the processed mirrored traffic to the cross-node port transmission flow table; Transmitting the processed mirrored traffic to the computing node where the mirrored port is located through the cross-node port transmission flow table; The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

8. A traffic mirroring device, characterized in that: The device comprises: A first determination module, used to determine a source port and a mirror port; A second determination module is used to determine a virtual switch flow table based on a positional relationship between the source port and the mirror port and a flow direction of a target flow of the source port; A transmission module, used for mirroring the target traffic in the source port and transmitting it to the mirror port through the virtual switch flow table; In the case where the flow direction of the target traffic of the source port is outbound, the transmission module is specifically used to mirror the target traffic through the mirror flow table to obtain the mirror traffic, label the mirror traffic, and transmit the labeled mirror traffic to the traffic directional flow table; Performing target field processing on the marked mirrored traffic through the traffic directional flow table, and transmitting the processed mirrored traffic to the port transmission flow table; The processed mirrored traffic is sent to the mirrored port through the port transmission flow table.

9. The device according to claim 8, characterized in that The second determination module is specifically configured to determine a same-node virtual switch flow table based on a flow direction of a target flow of the source port if the source port and the mirror port are located on the same computing node; If the source port and the mirror port are located in different computing nodes, a cross-node virtual switch flow table is determined based on the flow direction of the target traffic of the source port.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images