A traffic mirroring method, device and product

Abstract

The embodiment of the present application provides a traffic mirroring method, device and product, the method is applied to a server, including: a user-mode setting module determines a target filtering condition in response to a user's setting operation; according to the target filtering condition, a target loading position of a data filtering module and a data replication module on the gateway of the server is determined, and the data filtering module and the data replication module are loaded at the target loading position; when the data filtering module obtains any data packet arriving at the gateway of the server that meets the target filtering condition, the data replication module copies and forwards the data packet to the tunnel encapsulation network card of the server; the tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the opposite end of the tunnel. The embodiment of the present application aims to provide a low-cost traffic mirroring method.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of data processing, and in particular, to a traffic mirroring method, device, and product. Background Art

[0002] In cloud-native scenarios, there is generally a need for traffic mirroring. Traffic mirroring (Mirroring / traffic-shadow), also known as shadow traffic, refers to copying real traffic to a mirror service to perform specific analysis on traffic or request content. It is mainly used in scenarios including network intrusion detection, traffic auditing, and network problem location.

[0003] Traditional methods of implementing traffic mirroring include mirroring ports or tap devices, that is, specifying a port through software or dedicated hardware, copying all incoming or outgoing traffic on the port, and forwarding it to a specific audit address. However, this method must be combined with bypass network or user-mode process processing, and can also be implemented through traffic mirroring solutions provided by public cloud vendors. However, the existing methods of implementing traffic mirroring require high additional costs and are costly. Summary of the invention

[0004] The embodiments of the present application provide a traffic mirroring method, device, and product, aiming to provide a low-cost traffic mirroring method.

[0005] In a first aspect, an embodiment of the present application provides a traffic mirroring method, which is applied to a server, and the method includes:

[0006] The user state setting module determines the target filtering condition in response to the user's setting operation;

[0007] Determine the target loading position of the data filtering module and the data replication module on the gateway of the server according to the target filtering condition, and load the data filtering module and the data replication module at the target loading position;

[0008] When the data filtering module obtains any data packet arriving at the gateway of the server and meets the target filtering condition, the data replication module replicates and forwards the data packet to the tunnel encapsulation network card of the server;

[0009] The tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the other end of the tunnel.

[0010] Optionally, the user state setting module determines the target filtering condition in response to the user's setting operation, including:

[0011] The user mode setting module obtains at least one parameter of a source IP address, a source port number, a destination IP address, a target port number, a protocol and a direction as the content of the target filtering condition in response to the user's setting operation.

[0012] Optionally, after the user state setting module determines the target filtering condition in response to the user's setting operation, the method further includes:

[0013] The user state setting module responds to the setting operation of the user, and when it is detected that the direction parameter is not obtained, the user state setting module sets the direction in the content of the target filtering condition as a default direction, and the default direction is entering.

[0014] Optionally, after the user state setting module determines the target filtering condition in response to the user's setting operation, the method further includes:

[0015] The user state setting module updates the ebpf Map according to the target filtering condition, wherein the ebpf Map includes the name of the target filtering condition and the content of the filtering condition, and the content of the target filtering condition is at least one of the source IP address, the source port number, the destination IP address, the target port number, the protocol and the direction; the ebpf Map is used by the data filtering module to obtain the target filtering condition.

[0016] Optionally, determining a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module at the target loading position comprises:

[0017] When the direction in the target filtering condition is entry, determining that the target loading position of the data filtering module and the data replication module on the gateway of the server is XDP or TC;

[0018] The data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0019] Optionally, determining a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module at the target loading position comprises:

[0020] When the direction in the target filtering condition is an exit, determining the target loading position of the data filtering module and the data replication module on the gateway of the server to be TC;

[0021] The data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0022] Optionally, the user state setting module determines the target filtering condition in response to the user's setting operation, including:

[0023] The user state setting module obtains multiple filtering conditions in response to the user's setting operation, and constructs an entry direction filtering condition set, wherein the directions of the multiple filtering conditions in the entry direction filtering condition set are all entry, and the content of any filtering condition includes at least one of a source IP address, a source port number, a destination IP address, a target port number, and a protocol;

[0024] The user state setting module takes each filter condition in the entry direction filter condition set as a target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the entry direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

[0025] Optionally, determining a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module at the target loading position comprises:

[0026] Determine that the target loading location of the data filtering module and the data replication module on the gateway of the server is XDP or TC;

[0027] The data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0028] Optionally, the user state setting module determines the target filtering condition in response to the user's setting operation, including:

[0029] The user state setting module obtains multiple filtering conditions in response to the user's setting operation, and constructs an export direction filtering condition set, wherein the directions of the multiple filtering conditions in the export direction filtering condition set are all exports, and the content of any filtering condition includes at least one of a source IP address, a source port number, a destination IP address, a target port number, and a protocol;

[0030] The user state setting module takes each filter condition in the export direction filter condition set as a target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the export direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

[0031] Optionally, determining a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module at the target loading position comprises:

[0032] Determine that the target loading location of the data filtering module and the data replication module on the gateway of the server is TC;

[0033] The data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0034] Optionally, after loading the data filtering module and the data replication module at the target loading position, the method further includes:

[0035] The data filtering module obtains any data packet arriving at the gateway of the server and parses the data information of the data packet;

[0036] The data filtering module obtains the target filtering condition in the ebpf Map;

[0037] The target filtering condition is compared with the data information of the data packet to determine whether any data packet on the gateway of the server meets the target filtering condition.

[0038] Optionally, when the data filtering module obtains any data packet arriving at the gateway of the server and meets the target filtering condition, the data replication module copies and forwards the data packet to the tunnel encapsulation network card of the server, including:

[0039] When the data filtering module obtains any data packet arriving at the gateway of the server and meets the target filtering condition, the data replication module is called;

[0040] The data replication module calls the ebpf_clone_redirect function to copy and forward the data packet to the tunnel encapsulation network card of the server.

[0041] Optionally, the tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the other end of the tunnel, including:

[0042] The tunnel encapsulation network card set on the server performs IPIP encapsulation on the data packet according to the IP address of the server and the IP address of the audit server deployed on the network card at the other end of the tunnel, and then sends it to the audit server at the other end of the tunnel, wherein the network card at the other end of the tunnel of the tunnel encapsulation network card is set on the audit server.

[0043] Optionally, the method further comprises:

[0044] The user state setting module determines the filtering condition to be deleted in response to the user's deletion operation on the filtering condition;

[0045] In the ebpf Map, delete the filter condition to be deleted.

[0046] Optionally, the method further comprises:

[0047] The user state setting module obtains the content of the new filtering condition in response to the user's update operation on the filtering condition;

[0048] Update the current target filtering condition in the ebpf Map to the new filtering condition.

[0049] Optionally, the method further comprises:

[0050] In response to an uninstallation instruction from a user, the data filtering module and the data replication module loaded on the target loading position are uninstalled.

[0051] In a second aspect, an embodiment of the present application provides a traffic mirroring device, which is applied to a server, and the device includes:

[0052] A user state setting module, used to determine a target filtering condition in response to a user's setting operation;

[0053] A loading module, used to determine the target loading position of the data filtering module and the data replication module on the gateway of the server according to the target filtering condition, and load the data filtering module and the data replication module at the target loading position;

[0054] A data filtering module, used to obtain any data packet arriving at the gateway of the server and determine whether the data packet meets the target filtering condition;

[0055] A data replication module, used for replicating and forwarding data packets that meet the target filtering conditions to the tunnel encapsulation network card of the server;

[0056] The tunnel encapsulation network card is used to encapsulate the data packet and send it to the audit server at the other end of the tunnel.

[0057] In a third aspect, an embodiment of the present application provides a server, on which a network card and a tunnel network card are deployed, and the network card at the tunnel opposite end of the tunnel network card is deployed on an audit server, and the server is used to execute a traffic mirroring method described in the first aspect of the embodiment.

[0058] In a fourth aspect, an embodiment of the present application provides a computing and processing device, including:

[0059] A memory storing a computer-readable code; and one or more processors. When the computer-readable code is executed by the one or more processors, the computing and processing device executes a traffic mirroring method described in the first aspect of the embodiment.

[0060] In a fifth aspect, an embodiment of the present application provides a non-volatile readable storage medium, wherein the non-volatile readable storage medium stores a computer program, wherein when the computer program is executed by a processor, a traffic mirroring method described in the first aspect of the embodiment is executed.

[0061] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements a traffic mirroring method described in the first aspect of the embodiment.

[0062] Beneficial effects:

[0063] In the method, a user-mode setting module determines a target filtering condition in response to a user's setting operation; based on the target filtering condition, a target loading position of a data filtering module and a data replication module on the gateway of the server is determined, and the data filtering module and the data replication module are loaded at the target loading position; when the data filtering module obtains any data packet arriving at the gateway of the server that meets the target filtering condition, the data replication module copies and forwards the data packet to the tunnel encapsulation network card of the server; the tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the other end of the tunnel.

[0064] The efficiency of the traffic mirroring process is improved by copying and forwarding the data packets that meet the target filtering conditions in the kernel, and the copied data packets are re-encapsulated through the tunnel encapsulation network card and sent to the audit server, so that the traffic mirroring forwarding process is based on a dedicated card and does not affect the bandwidth resources of the original business. In addition, this method does not need to be implemented based on special hardware, has a low deployment cost and high flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0066] Figure 1 A flow chart showing the steps of the traffic mirroring method provided by an embodiment of the present application is shown;

[0067] Figure 2 The following is a flowchart of the execution of the traffic mirroring method provided by the embodiment of the present application;

[0068] Figure 3 A functional module diagram of a traffic mirroring device provided in an embodiment of the present application is shown;

[0069] Figure 4 A schematic diagram of a server provided in an embodiment of the present application is shown;

[0070] Figure 5 A schematic diagram of a computing and processing device provided in an embodiment of the present application is shown;

[0071] Figure 6 A schematic diagram of a non-volatile readable storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0072] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0073] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, each embodiment of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in each embodiment of the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is for the convenience of description, and the specific implementation of the present application should not constitute any limitation, and the various embodiments can be combined with each other and referenced to each other without contradiction.

[0074] IP: Internet Protocol, Internet interconnection protocol;

[0075] TCP: Transmission Control Protocol, transmission control protocol;

[0076] eBPF (Extended Berkeley Packet Filter) is a powerful kernel technology that allows developers to safely run precompiled and sandboxed programs in the kernel; eBPF map is a key-value store that allows eBPF programs to store data persistently and share information between the kernel and user space; maps are global data in eBPF programs and can be accessed by different instances of the same program or different eBPF programs.

[0077] In cloud-native scenarios, there is generally a demand for traffic mirroring. The traffic mirroring function can copy production traffic to a specified location to implement security auditing, risk monitoring, troubleshooting, business analysis, etc. without affecting the actual production environment. It mainly addresses the following scenarios:

[0078] 1. Network intrusion detection: By analyzing the data of traffic mirroring to detect whether there is abnormal traffic or abnormal behavior, such as detecting a large number of connection attempts, unauthorized access, and malware propagation, timely discover and respond to potential network attacks;

[0079] 2. Audit service: It can transparently mirror instance traffic to a unified audit platform for analysis, thereby better understanding network usage and security status to meet audit needs;

[0080] 3. Network problem location: Operation and maintenance personnel can directly view the content of traffic transmission after mirroring, such as analyzing TCP retransmission, to troubleshoot network problems without entering the virtual machine to capture messages, which can greatly improve the efficiency and accuracy of troubleshooting.

[0081] There are two traditional ways to implement traffic mirroring:

[0082] 1. Mirror port, that is, specify a port through software or dedicated hardware, copy all the traffic in the inbound or outbound direction of the port, and forward it to a specific audit address. However, this method needs to be combined with bypass network or user-mode process processing, and the deployment process is complex and costly.

[0083] 2. This can be achieved through the traffic mirroring solution provided by public cloud vendors, but this method incurs high additional costs.

[0084] In order to provide a low-cost and easy-to-deploy traffic mirroring method, an embodiment of the present application provides a traffic mirroring method.

[0085] Reference Figure 1 , shows a flow chart of the steps of a traffic mirroring method provided by an embodiment of the present application, the method is applied to a server, and the method may include the following steps:

[0086] S101: The user mode setting module determines a target filtering condition in response to a setting operation of a user.

[0087] The user state setting module of the present method can be a user state ebpf program in the ebpf program. The Ebpf program is a program written by the user that can run in the Linux kernel. It is essentially a virtual machine running in the kernel state, which allows users to load and run custom programs in the kernel. The user and the kernel can exchange data on demand and manage the behavior of the kernel at any time.

[0088] In addition to the user-state eBPF program, an eBPF program also includes a kernel-state eBPF program, that is, the user-state eBPF program and the kernel-state eBPF program are one-to-one corresponding. In this embodiment, the user-state setting module is mainly used to obtain the target filtering conditions that the data object of the user-set traffic mirroring needs to meet.

[0089] In a feasible implementation, an eBPF program can only set one target filtering condition. When it is necessary to set target filtering conditions corresponding to multiple traffic data, multiple eBPF programs can be loaded in the server respectively, that is, set.

[0090] Specifically, when determining the target filtering condition, in response to the user's setting operation on the user-state setting module, the user-state setting module determines the target filtering condition, and the content of the target filtering condition is at least one of the source IP address (sip), the source port number (sport), the destination IP address (dip), the destination port number (dport), the protocol (protocol) and the direction (direction), wherein the direction includes ingress (ingress) and egress (egress).

[0091] That is, the user determines the filtering conditions that meet different needs through setting operations. The content of the filtering conditions can be a combination of the above-mentioned different parameters. For example, the user can only set filtering condition 1 to include the content of the source IP address, and can also set filtering condition 2 to include the source IP address, the source port number and the direction of ingress; or set filtering condition 3 to include the source IP address, the source port number, the destination IP address, the destination port number, the protocol and the direction of ingress.

[0092] Through the user-mode setting module, users can generate a variety of filtering conditions according to actual needs, thereby adapting to different data objects that need traffic mirroring.

[0093] In response to the user's setting operation, when the direction parameter is not obtained, the direction in the content of the target filtering condition can be set as a default direction, and the default direction is inbound, because most audit services perform traffic mirroring on data in the inbound direction.

[0094] After the user state setting module obtains the target filtering condition, the ebpf Map is updated, and the ebpf Map includes the name of the target filtering condition and the content of the filtering condition. The content of the target filtering condition is at least one of the source IP address, the source port number, the destination IP address, the target port number, the protocol and the direction. The ebpf Map is used by the data filtering module to obtain the target filtering condition.

[0095] Ebpf Map is one of the most important data structures in ebpf technology. It stores data in the form of key-value and can be operated in both user-mode and kernel-mode programs. It provides the function of sharing data between user-mode and kernel-mode programs.

[0096] In the actual implementation process, after the user writes the user-mode ebpf program of the user-mode setting module, during the initialization process, an ebpf Map named filter is created. The key of the ebpf Map is the name string of the filter condition, and the value is the content of the filter condition.

[0097] For example, during the operation of the user state setting module, through the setting operation of the user on the user state setting module, it is determined that the target filtering conditions include sip: 10.233.10.10, sport: 12345, dip: 192.168.1.3, dport: 6443, protocols: TCP, direction: ingress, and then the user state setting module updates the ebpf Map as shown below:

[0098] {

[0099] "sip": "10.233.10.10",

[0100] "sport": "12345",

[0101] "protocol":"TCP",

[0102] "dip": "192.168.1.3",

[0103] "dport": "6443",

[0104] “direction”: “ingress”

[0105] }

[0106] In a feasible implementation, in addition to one ebpf program corresponding to one filtering condition, in order to simplify the operation and further save resources and costs, multiple filtering conditions can also be divided into two categories according to the direction of the filtering conditions, namely, multiple filtering conditions in the entry direction and multiple filtering conditions in the exit direction, thereby enabling one ebpf program to filter and screen data packets according to multiple filtering conditions, further saving costs.

[0107] Specifically, when the user-state setting module determines the target filtering condition in response to the user's setting operation, the user-state setting module obtains multiple filtering conditions in response to the user's setting operation, filters out all filtering conditions with directions as entry directions from the multiple filtering conditions, and constructs an entry direction filtering condition set. The directions of the multiple filtering conditions in the entry direction filtering condition set are all entry, and the content of any filtering condition includes at least one of the source IP address, source port number, destination IP address, target port number and protocol.

[0108] Then, the user-state setting module takes each filter condition in the entry direction filter condition set as the target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the entry direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

[0109] Alternatively, when the user-state setting module determines the target filtering condition in response to the user's setting operation, the user-state setting module obtains multiple filtering conditions in response to the user's setting operation, filters out all filtering conditions with directions in the export direction from the multiple filtering conditions, and constructs an export direction filtering condition set. The directions of the multiple filtering conditions in the export direction filtering condition set are all exports, and the content of any filtering condition includes at least one of the source IP address, source port number, destination IP address, target port number and protocol.

[0110] Then, the user state setting module takes each filter condition in the export direction filter condition set as the target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the export direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

[0111] For example, when a user-state setting module is used to set the target filter condition for the ingress direction, the name of the ebpf Map corresponding to the user-state setting module is ingress, the key in the ebpf Map is filter1-n, the suffix number is accumulated according to the number of multiple filter conditions in the ingress direction filter condition set, and the value is the specific parameter of each filter condition. For example, the ingress direction filter condition set includes filter condition A and filter condition B, and the content of filter condition A includes sip: 1.1.1.1, sport: 1234, dip: 2.2.2.2, dport: 8080, protocols: TCP, and the content of filter condition B includes sip: 8.8.8.8, dip: 114.114.114.114, then the ebpf Map named ingress is as follows:

[0112] {

[0113] "filter1":"sip:1.1.1.1,sport:1234,dip:2.2.2.2,dport:8080,protocol:TCP",

[0114] "filter2":"sip:8.8.8.8,dip:114.114.114.114"

[0115] }

[0116] That is, in the actual implementation process, multiple user-state setting modules can be set, each user-state setting module can set a corresponding target filtering condition, or two user-state setting modules can be set, and the two user-state setting modules are used to set multiple target filtering conditions in the entry direction or multiple target filtering conditions in the exit direction respectively.

[0117] S102: Determine a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and load the data filtering module and the data replication module at the target loading position.

[0118] The data filtering module and the data replication module can be kernel-mode eBPF programs corresponding to the user-mode eBPF programs of the user-mode setting module.

[0119] XDP (eXpress Data Path) is an eBPF program hook in the Linux network processing flow, which can mount the eBPF program. It can process network data packets when they reach the network card driver layer; TC (Traffic Control) is a module in the Linux kernel, which is mainly used to control the sending and receiving of data packets in terms of rate and sequence. It also provides a mount point for the eBPF program, which can forward, discard, and release data packets.

[0120] When a user-state setting module corresponds to a target filtering condition, the data filtering module reads the ebpf map updated by the user-state setting module, and then determines the target loading position of the data filtering module and the data replication module on the gateway of the server according to the direction in the target filtering condition in the ebpf map, and loads the data filtering module and the data replication module at the target loading position.

[0121] Specifically, when the direction in the target filtering condition is ingress, that is, when the direction of the target filtering condition is ingress, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be XDP or TC; and the data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0122] When the direction in the target filtering condition is egress, that is, the direction of the filtering condition is egress, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be TC, and the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0123] In an implementation method divided into two categories according to the direction of the filtering conditions, when the user-state setting module updates the ebpf Map based on each filtering condition in the entry direction filtering condition set as the target filtering condition, it is determined that the target loading position of the data filtering module and the data replication module on the gateway of the server is XDP or TC; the data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0124] The user-state setting module uses each filtering condition in the export direction filtering condition set as the target filtering condition. When updating the ebpf Map, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be TC; the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

[0125] S103: When the data filtering module obtains any data packet arriving at the gateway of the server and meets the target filtering condition, the data replication module replicates and forwards the data packet to the tunnel encapsulation network card of the server.

[0126] Specifically, after the data filtering module and the data replication module are loaded at the target loading position, the data filtering module obtains any data packet arriving at the gateway of the server and parses the data information of the data packet; the data filtering module obtains the target filtering condition in the ebpf Map, and compares the target filtering condition with the data information of the data packet to determine whether any data packet on the gateway of the server meets the target filtering condition.

[0127] The data information obtained by parsing any data packet includes the source IP address, source port number, destination IP address, destination port number and protocol corresponding to the data packet.

[0128] For example, if the target filtering condition obtained by the data filtering module in the ebpf Map is sip:8.8.8.8, dip:114.114.114.114, direction: egress, and the data information of the parsed data packet is: sip:1.1.1.1, dip: 2.2.2.2, direction: egress, then the data packet does not meet the target filtering condition and is ignored; when the data information of a data packet parsed is: sip:8.8.8.8, dip:114.114.114.114, direction: egress, the data information of the data packet hits the target filtering condition obtained by the data filtering module in the ebpf Map, then the data packet meets the target filtering condition, and the data packet needs to be copied and forwarded to the tunnel encapsulation network card of the server.

[0129] When the data filtering module obtains any data packet arriving at the gateway of the server and meets the target filtering condition, the data replication module is called to copy and forward the data packet. In this embodiment, the data replication module calls the ebpf_clone_redirect function to copy and forward the data packet to the tunnel encapsulation network card of the server. The ebpf_clone_redirect function can copy and forward the data packet to the tunnel encapsulation network card before the data packet enters the kernel network protocol stack, so that the data packet that meets the target filtering condition can be copied and forwarded in the kernel, thereby improving the efficiency of the traffic mirroring process.

[0130] S104: The tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the other end of the tunnel.

[0131] In this embodiment, considering that the source address and destination address of the original data packet cannot be received by the network card of the audit server, a tunnel encapsulation network card is used to encapsulate the data packet and send it to the audit server at the other end of the tunnel. Specifically, the tunnel encapsulation network card arranged on the server performs IPIP encapsulation on the data packet according to the IP address of the server and the IP address of the audit server deployed by the network card at the other end of the tunnel, and then sends it to the audit server at the other end of the tunnel. The network card at the other end of the tunnel of the tunnel encapsulation network card is arranged on the audit server, so that the audit server can audit and analyze the mirrored traffic data.

[0132] The process of IPIP encapsulation of copied and forwarded data packets is to encapsulate the original IP data packet in a new IP data packet to achieve transmission between different networks. Through IPIP encapsulation, transparent data transmission can be achieved between different networks without modifying or re-encapsulating the original data packet.

[0133] By setting up a tunnel encapsulation network card on the server dedicated to forwarding to the audit server, the purpose of dedicated card can be achieved, so as not to affect the original business, and not to compete with the original business for bandwidth resources, thereby improving the efficiency of traffic mirroring.

[0134] In a feasible implementation manner, the method may also perform processes such as deleting, adding, and updating the filtering conditions. Specifically, the user state setting module determines the filtering conditions to be deleted in response to the user's deletion operation on the filtering conditions; deletes the filtering conditions to be deleted in the ebpf Map; or obtains the content of the new filtering conditions in response to the user's update operation on the filtering conditions; and updates the filtering conditions in the ebpf Map to the new filtering conditions.

[0135] In the process of implementing traffic mirroring by this method, the user can dynamically load and unload the user-mode setting module, data filtering module and data replication module on the server according to the needs. Only one bash command needs to be executed for loading and unloading. Taking the data filtering module and data replication module at the TC position loaded in ingress as an example, only the following command needs to be executed: tcfilter add dev eth0 ingress bpf da obj test.o sec test, where eth0 is the network card to load the data filtering module and data replication module, and test.o is the compiled program of the data filtering module and data replication module. Moreover, loading and unloading will take effect immediately without restarting or other operations.

[0136] Reference Figure 2 , shows an execution flow chart of the traffic mirroring method provided in an embodiment of the present application. Specifically, a user-state setting module is created, and an ebpf Map is created; the user-state setting module updates the ebpf Map after obtaining the target filtering conditions set by the user; and a data filtering module and a data replication module are loaded at the target loading position according to the direction in the target filtering conditions.

[0137] When any data packet reaches the server's network card, the data filtering module is triggered to parse the data information of the data packet, query the ebpf Map to obtain the target filtering conditions, compare the data information and the target filtering conditions, and when the data packet meets the target filtering conditions, the data replication module is triggered to call the ebpf_clone_redirect function, copy and forward the data packet to the tunnel encapsulation network card for encapsulation and then send it to the audit server.

[0138] Compared with the traditional implementation method, this method has the following advantages:

[0139] 1. Pure software implementation, no special hardware requirements, can significantly save costs;

[0140] 2. Implemented in kernel state, it is lightweight, high-performance and highly secure;

[0141] 3. You can set special filtering conditions to mirror only necessary traffic data, thus saving bandwidth resources;

[0142] 4. High flexibility, supporting dynamic loading and unloading.

[0143] Reference Figure 3 , shows a functional module diagram of a traffic mirroring device provided in an embodiment of the present application, the device is applied to a server, and the device includes:

[0144] A user mode setting module 100, for determining a target filtering condition in response to a setting operation of a user;

[0145] The loading module 200 is used to determine the target loading position of the data filtering module and the data replication module on the gateway of the server according to the target filtering condition, and load the data filtering module and the data replication module at the target loading position;

[0146] The data filtering module 300 is used to obtain any data packet arriving at the gateway of the server and determine whether the data packet meets the target filtering condition;

[0147] The data replication module 400 is used to replicate and forward the data packets that meet the target filtering condition to the tunnel encapsulation network card of the server;

[0148] The tunnel encapsulation network card 500 is used to encapsulate the data packet and send it to the audit server at the other end of the tunnel.

[0149] Optionally, the user mode setting module includes:

[0150] The first filtering condition setting unit is used to obtain at least one parameter of a source IP address, a source port number, a destination IP address, a target port number, a protocol and a direction as the content of the target filtering condition in response to a user's setting operation.

[0151] Optionally, the user mode setting module includes:

[0152] The direction default setting unit is used to respond to the user's setting operation. When it is detected that the direction parameter is not obtained, the user state setting module sets the direction in the content of the target filtering condition as the default direction, and the default direction is entering.

[0153] Optionally, the device further comprises:

[0154] The first update module is used for the user state setting module to update the ebpf Map according to the target filtering condition, the ebpf Map includes the name of the target filtering condition and the content of the filtering condition, and the content of the target filtering condition is at least one of the source IP address, the source port number, the destination IP address, the target port number, the protocol and the direction; the ebpf Map is used by the data filtering module to obtain the target filtering condition.

[0155] Optionally, the loading module includes:

[0156] The first loading unit is used to determine that the target loading position of the data filtering module and the data replication module on the gateway of the server is XDP or TC when the direction in the target filtering condition is entry; load the data filtering module and the data replication module on the XDP of the gateway of the server, or load the data filtering module and the data replication module on the TC of the gateway of the server.

[0157] Optionally, the loading module includes:

[0158] The second loading unit is used to determine that the target loading position of the data filtering module and the data replication module on the gateway of the server is TC when the direction in the target filtering condition is export; and load the data filtering module and the data replication module on the TC of the gateway of the server.

[0159] Optionally, the user mode setting module further includes:

[0160] A second filtering condition setting unit is used to obtain multiple filtering conditions in response to a setting operation of a user, and to construct an entry direction filtering condition set, wherein the directions of the multiple filtering conditions in the entry direction filtering condition set are all entry, and the content of any filtering condition includes at least one of a source IP address, a source port number, a destination IP address, a target port number, and a protocol;

[0161] The user state setting module takes each filter condition in the entry direction filter condition set as a target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the entry direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

[0162] Optionally, the loading module includes:

[0163] The third loading unit is used to determine that the target loading position of the data filtering module and the data replication module on the gateway of the server is XDP or TC; load the data filtering module and the data replication module on the XDP of the gateway of the server, or load the data filtering module and the data replication module on the TC of the gateway of the server.

[0164] Optionally, the user mode setting module further includes:

[0165] A third filtering condition setting unit is used to obtain multiple filtering conditions in response to a setting operation of a user, and to construct an egress direction filtering condition set, wherein the directions of the multiple filtering conditions in the egress direction filtering condition set are all ingress, and the content of any filtering condition includes at least one of a source IP address, a source port number, a destination IP address, a target port number, and a protocol;

[0166] The user state setting module takes each filter condition in the export direction filter condition set as a target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the export direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

[0167] Optionally, the loading module includes:

[0168] The fourth loading unit is used to determine that the target loading position of the data filtering module and the data replication module on the gateway of the server is TC; and load the data filtering module and the data replication module on the TC of the gateway of the server.

[0169] Optionally, the data filtering module is used to obtain any data packet arriving at the gateway of the server and parse the data information of the data packet; the data filtering module obtains the target filtering condition in the ebpf Map; and compares the target filtering condition with the data information of the data packet to determine whether any data packet on the gateway of the server meets the target filtering condition.

[0170] Optionally, the data replication module is used to: when the data filtering module obtains any data packet arriving at the gateway of the server and meets the target filtering condition, call the ebpf_clone_redirect function to copy and forward the data packet to the tunnel encapsulation network card of the server.

[0171] Optionally, the tunnel encapsulation network card is used to:

[0172] The tunnel encapsulation network card set on the server performs IPIP encapsulation on the data packet according to the IP address of the server and the IP address of the audit server deployed on the network card at the other end of the tunnel, and then sends it to the audit server at the other end of the tunnel, wherein the network card at the other end of the tunnel of the tunnel encapsulation network card is set on the audit server.

[0173] Optionally, the user mode setting module further includes:

[0174] The deleting unit is used to determine the filtering condition to be deleted in response to the user's deletion operation on the filtering condition; and delete the filtering condition to be deleted in the ebpf Map.

[0175] Optionally, the user mode setting module further includes:

[0176] The updating unit is used to obtain the content of the new filtering condition in response to the user's update operation on the filtering condition; and update the current target filtering condition in the ebpf Map to the new filtering condition.

[0177] Optionally, the device further comprises:

[0178] The unloading module is used to unload the data filtering module and the data replication module loaded on the target loading position in response to the user's unloading instruction.

[0179] Reference Figure 4 , showing a schematic diagram of a server provided in an embodiment of the present application, a network card and a tunnel network card are deployed on the server, the network card at the tunnel opposite end of the tunnel network card is deployed on an audit server, and the server is used to execute a traffic mirroring method described in the embodiment.

[0180] The user-state setting module loaded on the server is used to obtain the target filtering conditions set by the user and update the ebpf Map. After the data filtering module and the data replication module are loaded at the target loading position according to the direction in the target filtering conditions, the data filtering module monitors whether any data packet meets the target filtering conditions. If the data packet meets the target filtering conditions, the data replication module is triggered to call the ebpf_clone_redirect function, and the data packet is copied and forwarded to the tunnel encapsulation network card of the server. The tunnel encapsulation gateway performs IPIP encapsulation on the data packet and sends it to the audit server at the other end of the tunnel.

[0181] If the data packet does not meet the target filtering conditions, the data packet can be sent normally based on the TCP / IP protocol.

[0182] Reference Figure 5 , showing a schematic diagram of a computing and processing device provided in an embodiment of the present application, including:

[0183] A memory 501 storing computer-readable codes; and one or more processors 502. When the computer-readable codes are executed by the one or more processors 502, the computing and processing device executes a traffic mirroring method described in the embodiment.

[0184] Reference Figure 6, shows a schematic diagram of a non-volatile readable storage medium provided in an embodiment of the present application, wherein the non-volatile readable storage medium 600 stores a computer program 601, wherein the computer program 601, when executed by a processor, performs a traffic mirroring method described in the embodiment.

[0185] An embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements a traffic mirroring method described in the embodiment.

Claims

1. A traffic mirroring method, characterized in that: Applied to a server, the method comprises: The user state setting module determines the target filtering condition in response to the user's setting operation, including obtaining at least one parameter of the source IP address, source port number, destination IP address, destination port number, protocol and direction as the content of the target filtering condition; According to the target filtering condition, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined, and the data filtering module and the data replication module are loaded at the target loading position, wherein when the direction in the target filtering condition is entry, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be XDP or TC, and the data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server; when the direction in the target filtering condition is exit, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be TC; and the data filtering module and the data replication module are loaded on the TC of the gateway of the server; When the data filtering module obtains any data packet arriving at the gateway of the server that meets the target filtering condition, the data replication module calls the ebpf_clone_redirect function to copy and forward the data packet to the tunnel encapsulation network card of the server, and the ebpf_clone_redirect function is used to copy and forward the data packet to the tunnel encapsulation network card before any data packet enters the kernel network protocol stack; The tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the other end of the tunnel, so that the data packet that meets the target filtering condition is forwarded without affecting the original business of the server.

2. The method according to claim 1, characterized in that After the user state setting module determines the target filtering condition in response to the user's setting operation, the method further includes: The user state setting module responds to the setting operation of the user, and when it is detected that the direction parameter is not obtained, the user state setting module sets the direction in the content of the target filtering condition as a default direction, and the default direction is entering.

3. The method according to claim 1, characterized in that After the user state setting module determines the target filtering condition in response to the user's setting operation, the method further includes: The user state setting module updates the ebpf Map according to the target filtering condition, wherein the ebpf Map includes the name of the target filtering condition and the content of the filtering condition, and the content of the target filtering condition is at least one of the source IP address, the source port number, the destination IP address, the target port number, the protocol and the direction; the ebpf Map is used by the data filtering module to obtain the target filtering condition.

4. The method according to claim 1, characterized in that: The user state setting module determines the target filtering conditions in response to the user's setting operation, including: The user state setting module obtains multiple filtering conditions in response to the user's setting operation, and constructs an entry direction filtering condition set, wherein the directions of the multiple filtering conditions in the entry direction filtering condition set are all entry, and the content of any filtering condition includes at least one of a source IP address, a source port number, a destination IP address, a target port number, and a protocol; The user state setting module takes each filter condition in the entry direction filter condition set as a target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the entry direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

5. The method according to claim 4, characterized in that Determining a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module at the target loading position, including: Determine that the target loading location of the data filtering module and the data replication module on the gateway of the server is XDP or TC; The data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server.

6. The method according to claim 1, characterized in that The user state setting module determines the target filtering conditions in response to the user's setting operation, including: The user state setting module obtains multiple filtering conditions in response to the user's setting operation, and constructs an export direction filtering condition set, wherein the directions of the multiple filtering conditions in the export direction filtering condition set are all exports, and the content of any filtering condition includes at least one of a source IP address, a source port number, a destination IP address, a target port number, and a protocol; The user state setting module takes each filter condition in the export direction filter condition set as a target filter condition and updates the ebpf Map, wherein the ebpf Map includes the names of the multiple filter conditions in the export direction filter condition set and the contents of the filter conditions; the ebpf Map is used by the data filtering module to obtain the target filter condition.

7. The method according to claim 6, characterized in that Determining a target loading position of a data filtering module and a data replication module on a gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module at the target loading position, including: Determine that the target loading location of the data filtering module and the data replication module on the gateway of the server is TC; The data filtering module and the data replication module are loaded on the TC of the gateway of the server.

8. The method according to any one of claims 3, 4 and 6, characterized in that After loading the data filtering module and the data replication module at the target loading position, the method further includes: The data filtering module obtains any data packet arriving at the gateway of the server and parses the data information of the data packet; The data filtering module obtains the target filtering condition in the ebpf Map; The target filtering condition is compared with the data information of the data packet to determine whether any data packet on the gateway of the server meets the target filtering condition.

9. The method according to claim 1, characterized in that: The tunnel encapsulation network card encapsulates the data packet and sends it to the audit server at the other end of the tunnel, including: The tunnel encapsulation network card set on the server performs IPIP encapsulation on the data packet according to the IP address of the server and the IP address of the audit server deployed on the network card at the other end of the tunnel, and then sends it to the audit server at the other end of the tunnel, wherein the network card at the other end of the tunnel of the tunnel encapsulation network card is set on the audit server.

10. The method according to any one of claims 3, 4 and 6, characterized in that The method further comprises: The user state setting module determines the filtering condition to be deleted in response to the user's deletion operation on the filtering condition; In the ebpf Map, delete the filter condition to be deleted.

11. The method according to claim 10, characterized in that The method further comprises: The user state setting module obtains the content of the new filtering condition in response to the user's update operation on the filtering condition; Update the current target filtering condition in the ebpf Map to the new filtering condition.

12. The method according to claim 1, characterized in that The method further comprises: In response to an uninstallation instruction from a user, the data filtering module and the data replication module loaded on the target loading position are uninstalled.

13. A traffic mirroring device, characterized in that: Applied to a server, the device comprises: A user-mode setting module, for determining a target filtering condition in response to a user's setting operation, including obtaining at least one parameter of a source IP address, a source port number, a destination IP address, a destination port number, a protocol, and a direction as content of the target filtering condition; A loading module, used for determining the target loading position of the data filtering module and the data replication module on the gateway of the server according to the target filtering condition, and loading the data filtering module and the data replication module on the target loading position, wherein when the direction in the target filtering condition is entry, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be XDP or TC, and the data filtering module and the data replication module are loaded on the XDP of the gateway of the server, or the data filtering module and the data replication module are loaded on the TC of the gateway of the server; when the direction in the target filtering condition is exit, the target loading position of the data filtering module and the data replication module on the gateway of the server is determined to be TC; and the data filtering module and the data replication module are loaded on the TC of the gateway of the server; A data filtering module, used to obtain any data packet arriving at the gateway of the server and determine whether the data packet meets the target filtering condition; A data replication module, used for calling the ebpf_clone_redirect function to copy and forward the data packets that meet the target filtering condition to the tunnel encapsulation network card of the server, wherein the ebpf_clone_redirect function is used for copying and forwarding the data packets to the tunnel encapsulation network card before any data packet enters the kernel network protocol stack; The tunnel encapsulation network card is used to encapsulate the data packet and send it to the audit server at the other end of the tunnel, so that the data packet that meets the target filtering condition is forwarded without affecting the original business of the server.

14. A server, characterized in that: A network card and a tunnel network card are deployed on the server, the network card at the tunnel opposite end of the tunnel network card is deployed on the audit server, and the server is used to execute a traffic mirroring method as described in any one of claims 1-12.

15. A computing device, characterized in that: include: A memory storing a computer-readable code; and one or more processors, wherein when the computer-readable code is executed by the one or more processors, the computing and processing device executes a traffic mirroring method according to any one of claims 1 to 12.

16. A non-volatile readable storage medium, characterized in that: The non-volatile readable storage medium stores a computer program, wherein the computer program, when executed by a processor, executes a traffic mirroring method according to any one of claims 1 to 12.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, a traffic mirroring method as described in any one of claims 1 to 12 is implemented.

Images