An address group traffic statistics method and device

Abstract

The present invention relates to an address group traffic statistics method and apparatus. It includes obtaining an IP network segment linked list set according to all address groups to be statistically analyzed. In a statistical period, in response to determining that a traffic data packet is received, the IP address of the traffic data packet is obtained, and according to the longest prefix matching rule and the IP address of the traffic data packet, the statistical items of the IP network segments in the IP network segment linked list set are refreshed. According to the IP network segments in the IP network segment linked list set and the longest parent network segments of each IP network segment, the statistical items of the IP network segments in the IP network segment linked list set are refreshed, and the traffic statistical values of all address groups to be statistically analyzed in a statistical period are obtained. The present invention solves the problem that an IP address needs to be matched multiple times, greatly reduces the search and matching work, reduces the consumption of device performance, and improves the device performance. The present invention also relates to a device and a storage medium.

Description

Technical Field

[0001] The present invention relates to the field of network technologies, and in particular, to a method and device for traffic statistics of address groups. Background Art

[0002] In network communication devices such as switches and firewalls, network address groups are a commonly used configuration. There are complex situations such as address intersections, repetitions, and inclusions in the address groups configured by users. The prior art is to sequentially traverse the network segments in the address group using the addresses in the traffic packets. An IP address needs to be matched multiple times, and statistics are performed on all the hit address groups, resulting in a large amount of search and matching work when there are many address groups and many network segments in the address groups, which consumes a serious amount of device performance and leads to a reduction in device performance. Summary of the Invention

[0003] In order to solve the technical problem of serious consumption of device performance caused by a large amount of search and matching work when there are many address groups and many network segments in the address groups, the present invention provides a method and device for traffic statistics of address groups.

[0004] According to a first aspect, a method for traffic statistics of address groups is provided. The method includes:

[0005] Based on all address groups to be statistically analyzed, an IP network segment linked list set is obtained, where the address groups to be statistically analyzed are configured by customers, and the IP network segment linked list set is a set composed of multiple IP network segment linked lists, and each IP network segment linked list is a linked list composed of network segments belonging to the same mask;

[0006] In a statistical period, in response to determining that a received traffic data packet is received, the IP address of the traffic data packet is obtained, and according to the longest prefix matching rule and the IP address of the traffic data packet, the statistical items of the IP network segments in the IP network segment linked list set are refreshed;

[0007] Based on the IP network segments in the IP network segment linked list set and the longest parent network segments of each IP network segment, the statistical items of the IP network segments in the IP network segment linked list set are refreshed to obtain the traffic statistical values of all the address groups to be statistically analyzed in a statistical period.

[0008] In some embodiments, the obtaining of the IP network segment linked list set based on all address groups to be statistically analyzed specifically includes:

[0009] Converting the group elements in each address group to be statistically analyzed into the representation form of IP network segments to obtain corresponding IP network segment subsets, and summarizing all the IP network segment subsets to obtain a first IP network segment set;

[0010] Removing duplicate IP network segments and IP network segments with an inclusion relationship from the first IP network segment set to obtain a second IP network segment set;

[0011] Classify the second IP network segment set according to the mask to obtain the IP network segment linked list set.

[0012] In some more specific embodiments, the conversion of the group elements in each of the address groups to be counted into the representation form of IP network segments specifically includes:

[0013] Convert the group elements in the address group to be counted whose representation form is an IP address into group elements in the form of IP network segments;

[0014] Convert the group elements in the address group to be counted whose representation form is an IP range into group elements in the form of IP network segments.

[0015] The removal of duplicate network segments and network segments with inclusion relationships from the first IP network segment set to obtain the second IP network segment set specifically includes:

[0016] Determine whether there is an inclusion relationship between the IP network segments in each of the IP network segment subsets;

[0017] If so, remove the included IP network segments from the IP network segment subset;

[0018] Determine whether there are duplicate IP network segments in all the IP network segment subsets;

[0019] If so, remove the duplicate IP network segments from the IP network segment subset to obtain the second IP network segment set;

[0020] Number the IP network segments in the second IP network segment set, and associate the numbers of the IP network segments with the address groups to be counted.

[0021] In some more specific embodiments, the IP classification of the second IP network segment set according to the mask to obtain the IP network segment linked list set specifically includes:

[0022] Put the IP network segments with the same mask in the second IP network segment set into an IP network segment linked list, so as to obtain multiple IP network segment linked lists with different masks;

[0023] Put each of the IP network segment linked lists into a hash table, and the hash table is used to accelerate the search for the longest parent network segment of each IP network segment in the IP network segment linked list set.

[0024] In some embodiments, the refreshing of the statistical items of the IP network segments in the IP network segment linked list set according to the longest prefix matching rule and the IP address of the traffic data packet specifically includes:

[0025] Obtain the IP network segment to which the IP address of the traffic data packet belongs according to the longest prefix matching rule and the IP address of the traffic data packet, where the IP network segment is the IP network segment to which the IP address of the traffic data packet belongs obtained by matching in the IP network segment linked list set using the longest prefix matching rule;

[0026] Refresh the statistical item of the IP network segment in the IP network segment linked list set.

[0027] In some more specific embodiments, the refreshing the statistical item of the IP network segment in the IP network segment linked list set according to the IP network segment in the IP network segment linked list set and the longest parent network segment of each IP network segment to obtain the traffic statistical value of all the to-be-statistical address groups in a statistical period specifically includes:

[0028] Search for the longest parent network segment of each IP network segment in the IP network segment linked list set to obtain the longest parent network segment of each IP network segment;

[0029] Add the statistical item of each IP network segment to the statistical item of the longest parent IP network segment of the IP network segment;

[0030] According to the association relationship between the number of the IP network segment and each to-be-statistical address group, refresh the statistical item of the IP network segment in the IP network segment linked list set to the statistical item of the group element corresponding to each to-be-statistical address group, so as to obtain the statistical item of each to-be-statistical address group.

[0031] In some more specific embodiments, the searching for the longest parent network segment of each IP network segment in the IP network segment linked list set to obtain the longest parent network segment of each IP network segment specifically includes:

[0032] In the order of the mask of the IP network segment linked list from long to short, use the first IP network segment of the IP network segment linked list with the longest mask in the IP network segment linked list set as the sub-IP network segment, and start retrieving the longest parent network segment of the sub-IP network segment from the first IP network segment of the next IP network segment linked list of the IP network segment to which the sub-IP network segment belongs to obtain the longest parent network segment of the sub-IP network segment;

[0033] Record the number of the longest parent network segment of the sub-IP network segment to the sub-IP network segment.

[0034] According to a second aspect, there is provided an address group traffic statistics device, and the device includes:

[0035] A first processing module, configured to obtain an IP network segment linked list set according to all to-be-statistical address groups, where the to-be-statistical address groups are configured by a customer, the IP network segment linked list set is a set composed of multiple IP network segment linked lists, and each IP network segment linked list is a linked list composed of network segments belonging to the same mask;

[0036] A second processing module, configured to, in a statistical period, in response to determining that a traffic data packet is received, obtain the IP address of the traffic data packet, and refresh the statistical item of the IP network segment in the IP network segment linked list set according to the longest prefix matching rule and the IP address of the traffic data packet;

[0037] A third processing module, configured to refresh the statistical item of the IP network segment in the IP network segment linked list set according to the IP network segment in the IP network segment linked list set and the longest parent network segment of each IP network segment, so as to obtain the traffic statistical value of all the to-be-statistic address groups in a statistical period.

[0038] In some embodiments, the first processing module is specifically configured to convert the group elements in each of the to-be-statistic address groups into the representation form of an IP network segment, obtain a corresponding subset of IP network segments, and summarize all the subsets of IP network segments to obtain a first set of IP network segments;

[0039] Remove the duplicate IP network segments and the IP network segments with inclusion relationships from the first set of IP network segments to obtain a second set of IP network segments;

[0040] Classify the second set of IP network segments according to the mask to obtain the IP network segment linked list set.

[0041] In some more specific embodiments, the first processing module is specifically configured to convert the group elements in the to-be-statistic address groups whose representation form is an IP address into group elements in the form of an IP network segment;

[0042] Convert the group elements in the to-be-statistic address groups whose representation form is an IP range into group elements in the form of an IP network segment.

[0043] In some more specific embodiments, the first processing module is specifically configured to determine whether there is an inclusion relationship between the IP network segments in each of the subsets of IP network segments;

[0044] If so, remove the included IP network segments from the subset of IP network segments;

[0045] Determine whether there are duplicate IP network segments in all the subsets of IP network segments;

[0046] If so, remove the duplicate IP network segments from the subset of IP network segments to obtain the second set of IP network segments;

[0047] Number each IP network segment in the second set of IP network segments, and associate the number of the IP network segment with the to-be-statistic address group.

[0048] In some more specific embodiments, the first processing module is specifically configured to put the IP network segments with the same mask in the second IP network segment set into an IP network segment linked list, so as to obtain multiple IP network segment linked lists with different masks;

[0049] Put each of the IP network segment linked lists into a hash table, where the hash table is used to accelerate the search for the longest parent network segment of each IP network segment in the IP network segment linked list set.

[0050] In some embodiments, the second processing module is specifically configured to obtain the IP network segment to which the IP address of the traffic data packet belongs according to the longest prefix matching rule and the IP address of the traffic data packet, where the IP network segment is the IP network segment to which the IP address of the traffic data packet belongs obtained by matching in the IP network segment linked list set using the longest prefix matching rule;

[0051] Refresh the statistical item of the IP network segment in the IP network segment linked list set.

[0052] In some embodiments, the third processing module is specifically configured to search for the longest parent network segment of each IP network segment in the IP network segment linked list set to obtain the longest parent network segment of each IP network segment;

[0053] Add the statistical item of each IP network segment to the statistical item of the longest parent IP network segment of the IP network segment;

[0054] According to the association relationship between the number of the IP network segment and each of the address groups to be statistically analyzed, refresh the statistical item of the IP network segment in the IP network segment linked list set to the statistical item of the corresponding group element of each of the address groups to be statistically analyzed, so as to obtain the statistical item of each of the address groups to be statistically analyzed.

[0055] In some more specific embodiments, the third processing module is specifically configured to, in the order of the masks of the IP network segment linked lists from long to short, use the first IP network segment of the IP network segment linked list with the longest mask in the IP network segment linked list set as the sub-IP network segment, and retrieve the longest parent network segment of the sub-IP network segment starting from the first IP network segment of the next IP network segment linked list of the IP network segment to which the sub-IP network segment belongs, so as to obtain the longest parent network segment of the sub-IP network segment;

[0056] Record the number of the longest parent network segment of the sub-IP network segment to the sub-IP network segment.

[0057] In a third aspect, the present invention further provides a computer device, including a memory and a processor, where the memory stores a computer program, and when the processor executes the computer program, it implements an address group traffic statistics method according to any one of the above technical solutions.

[0058] Fourthly, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements an address group traffic statistics method according to any one of the above technical solutions.

[0059] An address group traffic statistics method and device provided by the present invention. It includes obtaining an IP network segment linked list set according to all address groups to be counted. In a statistical period, in response to determining that a traffic data packet is received, obtaining the IP address of the traffic data packet, refreshing the statistical items of the IP network segments in the IP network segment linked list set according to the longest prefix matching rule and the IP address of the traffic data packet, and obtaining the traffic statistics values of all address groups to be counted in a statistical period according to the statistical items of the IP network segments in the IP network segment linked list set. The present invention solves the problem that an IP address needs to be matched multiple times, greatly reduces the search and matching work, reduces the consumption of device performance, and improves the device performance. Brief Description of the Drawings

[0060] The specification drawings forming a part of the present invention are used to provide a further understanding of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation to the present invention. In the drawings:

[0061] Figure 1 is a schematic flowchart of an address group traffic statistics method provided by an embodiment of the present invention;

[0062] Figure 2 is a schematic flowchart of an address group traffic statistics method provided by an embodiment of the present invention;

[0063] Figure 3 is a schematic flowchart of an address group traffic statistics method provided by an embodiment of the present invention;

[0064] Figure 4 is a schematic diagram of an address group in an address group traffic statistics method provided by an embodiment of the present invention;

[0065] Figure 5 is a schematic diagram of address group preprocessing in an address group traffic statistics method provided by an embodiment of the present invention;

[0066] Figure 6 is a schematic diagram of address group preprocessing in an address group traffic statistics method provided by an embodiment of the present invention;

[0067] Figure 7 is a schematic diagram of address group preprocessing in an address group traffic statistics method provided by an embodiment of the present invention;

[0068] Figure 8 is a schematic diagram of sorting network segments in an address group traffic statistics method provided by an embodiment of the present invention;

[0069] Figure 9 Schematic diagram of the statistical value of the aggregated address group in an address group traffic statistics method provided by an embodiment of the present invention;

[0070] Figure 10 Schematic diagram of the statistical value of the aggregated address group in an address group traffic statistics method provided by an embodiment of the present invention;

[0071] Figure 11 Schematic diagram of the statistical value of the aggregated address group in an address group traffic statistics method provided by an embodiment of the present invention;

[0072] Figure 12 Module schematic diagram of an address group traffic statistics device provided by an embodiment of the present invention. Detailed implementation manners

[0073] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments. It should be noted that, without conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other.

[0074] The following detailed descriptions are all exemplary descriptions, aiming to provide further detailed descriptions of the present invention. Unless otherwise specified, all technical terms adopted by the present invention have the same meaning as commonly understood by those of ordinary skill in the art to which the present invention pertains. The terms used in the present invention are only for the purpose of describing specific implementation manners, and are not intended to limit the exemplary embodiments according to the present invention.

[0075] In network communication devices such as switches and firewalls, the internal hardware architecture of the device is for the purpose of being able to quickly forward network packets, while the statistics of network traffic metrics will have an impact on the performance of the device. At the same time, a large number of network addresses configured by customers will cause a significant impact on the performance of network communication devices.

[0076] For example, in order to be able to count network traffic metrics such as the number of packets, bandwidth, and the number of new sessions, etc., the traffic statistics are usually carried out in the form of address groups and reported to the database at regular statistical intervals.

[0077] An address group can include a single IP address such as 10.0.0.5, an IP network segment such as 10.0.0.0 / 16, and an IP range such as 10.0.0.4 - 10.0.0.10. At the same time, the device also supports the configuration of a large number of address groups, and the address network segments involved in a large number of address groups may have duplicate, overlapping, and inclusion relationships.

[0078] The usual practice is to use the IP address of the traffic data packet to traverse all the network segments in the address groups, which may require multiple matches and count all the hit IP address groups.

[0079] For example, if an IP address hits both address group A and address group B, then the statistical value of this IP address will be counted on both address group A and address group B. In the case of a large number of address groups and a large number of network segments in the address groups, a large amount of search and matching work will consume the device performance severely, resulting in a decrease in device performance.

[0080] The following will be combined with the attached Figures 1 to 3 , to illustrate a method for statistical address group traffic provided by an embodiment of the present invention. The method includes:

[0081] 110. Obtain an IP network segment linked list set according to all address groups to be counted, where the address groups to be counted are configured by customers, and the IP network segment linked list set is a set composed of multiple IP network segment linked lists, and each IP network segment linked list is a linked list composed of network segments belonging to the same mask.

[0082] Specifically, the address groups to be counted are configured by customers, and there are various representation forms of the address groups configured by customers, such as a single address 10.1.0.1, 10.1.0.0 / 16, and 10.0.0.4 - 10.0.0.10.

[0083] In some embodiments, step 110 specifically includes:

[0084] 111. Convert the group elements in each address group to be counted into the representation form of IP network segments to obtain corresponding IP network segment subsets, and summarize all IP network segment subsets to obtain a first IP network segment set;

[0085] 112. Remove duplicate IP network segments and IP network segments with inclusion relationships from the first IP network segment set to obtain a second IP network segment set;

[0086] 113. Classify the second IP network segment set according to the mask to obtain an IP network segment linked list set.

[0087] In some more specific embodiments, step 111 specifically includes:

[0088] Convert the group elements in the address group to be counted whose representation form is an IP address into group elements in the form of IP network segments;

[0089] Convert the group elements in the address group to be counted whose representation form is an IP range into group elements in the form of IP network segments.

[0090] In some more specific embodiments, step 112 specifically includes:

[0091] Determine whether there is an inclusion relationship between the IP network segments in each IP network segment subset;

[0092] If it exists, remove the included IP network segment from the IP network segment subset;

[0093] Determine whether there are duplicate IP network segments in all IP network segment subsets;

[0094] If so, remove the duplicate IP network segments from the IP network segment subset to obtain a second IP network segment set;

[0095] Number each IP network segment in the second IP network segment set, and associate the number of the IP network segment with the address group to be counted.

[0096] In some more specific embodiments, step 113 specifically includes:

[0097] Put the IP network segments with the same mask in the second IP network segment set into an IP network segment linked list, so as to obtain multiple IP network segment linked lists with different masks;

[0098] Put each IP network segment linked list into a hash table, and the hash table is used to accelerate the search for the longest parent network segment of each IP network segment in the IP network segment linked list set.

[0099] 120. During a statistical period, in response to determining that a traffic data packet is received, obtain the IP address of the traffic data packet, and refresh the statistical item of the IP network segment in the IP network segment linked list set according to the longest prefix matching rule and the IP address of the traffic data packet.

[0100] In some more specific embodiments, step 120 specifically includes:

[0101] 121. According to the longest prefix matching rule and the IP address of the traffic data packet, obtain the IP network segment to which the IP address of the traffic data packet belongs, where the IP network segment is the IP network segment to which the IP address of the traffic data packet belongs obtained by matching in the IP network segment linked list set using the longest prefix matching rule.

[0102] Specifically, in this application, the longest prefix matching rule is used to match the IP address of the traffic data packet, and the IP address of the traffic data packet is extracted. The IP address includes the sending end IP address, the receiving end IP address, or the IP address in the message payload.

[0103] Compare the extracted IP address with all entries in the IP network segment linked list set to find the best match.

[0104] Each entry contains a network address and a subnet mask. The subnet mask defines the length of the network address, that is, the prefix length. For example, for the IPv4 address 192.0.2.0 / 24, the prefix length is 24 bits, indicating that the first 24 bits are the network part.

[0105] Find the entry with the longest matching prefix. If there are multiple entries with the same prefix, select the one with the longest prefix length.

[0106] The longest prefix match can be implemented using different data structures and techniques, such as Trie trees (dictionary trees), binary search trees, PATRICIA trees (Prefix Tree with Compressed Interior Nodes), etc., which are not limited in this application.

[0107] 122. Refresh the statistical items of the IP network segments in the IP network segment linked list set.

[0108] 130. According to the IP network segments in the IP network segment linked list set and the longest parent network segments of each IP network segment, refresh the statistical items of the IP network segments in the IP network segment linked list set to obtain the traffic statistical values of all the address groups to be statistically counted in a statistical period.

[0109] In some more specific embodiments, step 130 specifically includes:

[0110] 131. Find the longest parent network segments of each IP network segment in the IP network segment linked list set to obtain the longest parent network segments of each IP network segment;

[0111] 132. Add the statistical item of each IP network segment to the statistical item of the longest parent IP network segment of the IP network segment;

[0112] 133. According to the association relationship between the numbers of the IP network segments and each address group to be statistically counted, refresh the statistical items of the IP network segments in the IP network segment linked list set to the statistical items of the corresponding group elements of each address group to be statistically counted, so as to obtain the statistical items of each address group to be statistically counted.

[0113] In some more specific embodiments, step 131 specifically includes:

[0114] In the order of the masks of the IP network segment linked list from long to short, use the first IP network segment of the IP network segment linked list with the longest mask in the IP network segment linked list set as the sub-IP network segment, and start retrieving the longest parent network segment of the sub-IP network segment from the first IP network segment of the next IP network segment linked list of the IP network segment to which the sub-IP network segment belongs to obtain the longest parent network segment of the sub-IP network segment;

[0115] Record the number of the longest parent network segment of the sub-IP network segment to the sub-IP network segment.

[0116] An address group traffic statistics method related to the above embodiments. It includes obtaining an IP network segment linked list set according to all address groups to be statistically analyzed. In a statistical period, in response to determining that a traffic data packet is received, the IP address of the traffic data packet is obtained, and according to the longest prefix matching rule and the IP address of the traffic data packet, the statistical items of the IP network segments in the IP network segment linked list set are refreshed. According to the statistical items of the IP network segments in the IP network segment linked list set, the traffic statistical values of all address groups to be statistically analyzed in a statistical period are obtained.

[0117] The present invention solves the problem that an IP address needs to be matched multiple times, greatly reduces the search and matching work, reduces the consumption of device performance, and improves the device performance.

[0118] The following will combine the attached Figure 4 to illustrate an address group traffic statistics method provided by an embodiment of the present invention. It includes an address group processing module, a network segment sorting module, an IP address matching module, and a module for summarizing the statistical values of address groups. The brief description of each part is as follows.

[0119] The address group preprocessing mainly splits the address group into IP network segments. Sort the network segments, classify the network segments with the same mask, and create an LPM table. Use the LPM algorithm to determine the network segment hit by the IP address. Summarize the statistical values of each network segment under the address group into the address group.

[0120] 1. The address group preprocessing module includes the following steps:

[0121] 1.1 Convert the IP addresses, IP network segments, and IP ranges included in the address group into the form of IP network segments.

[0122] As Figure 2 shown, address group A includes 10.1.0.1, 10.1.0.0 / 16, and 10.0.0.4 - 10.0.0.10, then it is converted into the following network segments: 10.1.0.1 / 32, 10.1.0.0 / 16, 10.0.0.4 / 30, 10.0.0.8 / 31, 10.0.0.10 / 32.

[0123] Specifically, convert the different address representation forms in the address group into the form of network segments, or it can also be converted into the form of IP addresses or IP ranges.

[0124] 1.2 Inside each address group, if there are network segments with an inclusion relationship, remove the included network segments.

[0125] As Figure 5, for the network segments obtained through transformation in step 1.1, since 10.1.0.0 / 16 contains 10.1.0.1 / 32, 10.1.0.1 / 32 is removed. The following network segments are obtained: 10.1.0.0 / 16, 10.0.0.4 / 30, 10.0.0.8 / 31, 10.0.0.10 / 32.

[0126] Specifically, it is possible to determine whether there are network segments with an inclusion relationship through mask operations, and remove the included network segments. The specific mask operation method is a prior art and will not be elaborated in this embodiment.

[0127] 1.3. Aggregate all network segments of all address groups and remove duplicates.

[0128] Such as Figure 6 , address group A contains 10.1.0.0 / 16, 10.0.0.4 / 30, 10.0.0.8 / 31, 10.0.0.10 / 32;

[0129] After processing address group B through steps 1 and 2, it contains 10.2.0.0 / 16, 10.0.0.4 / 30, 10.0.0.9 / 32;

[0130] After processing address group C through steps 1 and 2, it contains 10.0.0.8 / 30, 9.8.0.0 / 16.

[0131] The duplicate network segment between address group A and address group B is 10.0.0.4 / 30. After removing the duplicate network segments in address group A or address group B, the network segments after aggregating address groups A, B, and C are: 10.1.0.0 / 16, 10.0.0.4 / 30, 10.0.0.8 / 31, 10.0.0.10 / 32, 10.2.0.0 / 16, 10.0.0.9 / 32, 10.0.0.8 / 30, 9.8.0.0 / 16.

[0132] Thus, it can be obtained that among the network segments generated after processing in steps 1.1 - 1.3, two network segments with an inclusion relationship must belong to different address groups.

[0133] 1.4. As Figure 7 shown. Assign an integer ID to each network segment, allocate a structure to record this ID and statistical items; and record which network segments each address group contains and their corresponding IDs.

[0134] 2. Network segment sorting module

[0135] 2.1 For IPv4 addresses, there is a 32-bit mask. The network segments with the same mask in each address group are classified together. The network segments with the same mask are connected together to form linked lists, namely List1, List2, List3... List32.

[0136] As Figure 8 shown, for faster subsequent lookup, the network segments with the same mask can also be added to the same HASH table.

[0137] 2.2 Add all IP network segments to the longest prefix match rule LPM. The next hop of LPM is the ID of the network segment.

[0138] Specifically, the longest prefix match rule LPM is a general network technology and will not be elaborated here.

[0139] 3. IP Address Matching Module

[0140] During per-flow statistics, obtain the IP address in each data flow. Perform an LPM query on this IP address to obtain the network segment ID and update the statistical value of the network segment.

[0141] 4. Module for Summarizing Statistical Values of Address Groups

[0142] In a set of network segments, if there is an inclusion relationship between two network segments, for example, network segment 1 includes network segment 2, then network segment 1 is called the parent network segment and network segment 2 is called the sub-network segment. Assume that network segment 3 is the parent network segment with the longest mask of network segment 2, then network segment 3 is called the longest parent network segment of network segment 2.

[0143] After a statistical period, the statistical values during this statistical period need to be summarized and reported. Since an IP address that belongs to a sub-network segment must also belong to the parent network segment, and the LPM algorithm will hit the sub-network segment, the statistical value of the sub-network segment needs to be summarized to the statistical value of the parent network segment. Then, the statistical values of all network segments are summarized to the corresponding address groups.

[0144] First, process the network segments in List32. A certain network segment in List32 is denoted as net32. Sequentially search for the longest parent network segment in List31, List30... List1. If found, summarize the statistical value of net32 to the longest parent network segment.

[0145] As Figure 9 shown, for the network segment 10.0.0.9 / 32, the network segment 10.0.0.8 / 31 is found in List31 as its longest parent network segment, and the statistical value of the network segment 10.0.0.9 / 32 is summarized to 10.0.0.8 / 31.

[0146] Process the network segments in List31, List30... List1 in sequence. Find their longest parent network segments and summarize the statistical values to the longest parent network segments.

[0147] As Figure 10 shown, for the network segment 10.0.0.8 / 31 in List31, its longest parent network segment 10.0.0.8 / 30 is found in List30, and the statistical value of the 10.0.0.8 / 31 network segment is summarized to the statistical value of 10.0.0.8 / 30.

[0148] After all the network segments in List32 to List1 are processed, the statistical values of each network segment include the statistical values of its sub-network segments.

[0149] In addition, to avoid repeatedly searching for parent network segments during each statistics, the integer ID of the longest parent network segment of each sub-network segment can be recorded in the network segment sorting module. When summarizing, directly summarize the statistical value of the sub-network segment to the longest parent network segment.

[0150] As Figure 11 shown, for each address group, finally summarize the statistical values of all the network segments included in the address group to obtain the statistical value of the address group.

[0151] As Figure 12 shown, provide a traffic statistics device for an address group, the device includes:

[0152] A first processing module, configured to obtain an IP network segment linked list set according to all address groups to be statistically analyzed, where the address groups to be statistically analyzed are configured by a customer, and the IP network segment linked list set is a set composed of multiple IP network segment linked lists, and each IP network segment linked list is a linked list composed of network segments belonging to the same mask;

[0153] A second processing module, configured to, in a statistical period, in response to determining that a received traffic data packet is received, obtain the IP address of the traffic data packet, and refresh the statistical items of the IP network segments in the IP network segment linked list set according to the longest prefix matching rule and the IP address of the traffic data packet;

[0154] A third processing module, configured to refresh the statistical items of the IP network segments in the IP network segment linked list set according to the IP network segments in the IP network segment linked list set and the longest parent network segments of each IP network segment, and obtain the traffic statistical values of all the address groups to be statistically analyzed in a statistical period.

[0155] In some embodiments, the first processing module is specifically configured to convert the group elements in each address group to be statistically analyzed into the representation form of IP network segments, obtain the corresponding IP network segment subsets, and summarize all the IP network segment subsets to obtain a first IP network segment set;

[0156] Remove duplicate IP network segments and IP network segments with inclusion relationships from the first IP network segment set to obtain a second IP network segment set;

[0157] Classify the second IP network segment set according to the mask to obtain the IP network segment linked list set.

[0158] In some more specific embodiments, the first processing module is specifically configured to convert the group elements in the address group to be counted that are in the form of IP addresses into group elements in the form of IP network segments;

[0159] Convert the group elements in the address group to be counted that are in the form of IP ranges into group elements in the form of IP network segments.

[0160] In some more specific embodiments, the first processing module is specifically configured to determine whether there is an inclusion relationship between the IP network segments in each of the IP network segment subsets;

[0161] If there is, remove the included IP network segments from the IP network segment subsets;

[0162] Determine whether there are duplicate IP network segments in all the IP network segment subsets;

[0163] If so, remove the duplicate IP network segments from the IP network segment subsets to obtain the second IP network segment set;

[0164] Number each IP network segment in the second IP network segment set, and associate the number of the IP network segment with the address group to be counted.

[0165] In some more specific embodiments, the first processing module is specifically configured to put the IP network segments with the same mask in the second IP network segment set into an IP network segment linked list, so as to obtain multiple IP network segment linked lists with different masks;

[0166] Put each of the IP network segment linked lists into a hash table, and the hash table is used to accelerate the search for the longest parent network segment of each IP network segment in the IP network segment linked list set.

[0167] In some embodiments, the second processing module is specifically configured to obtain the IP network segment to which the IP address of the traffic data packet belongs according to the longest prefix matching rule and the IP address of the traffic data packet, where the IP network segment is the IP network segment to which the IP address of the traffic data packet belongs obtained by matching in the IP network segment linked list set using the longest prefix matching rule;

[0168] Refresh the statistical items of the IP network segments in the IP network segment linked list set.

[0169] In some embodiments, the third processing module is specifically configured to find the longest parent network segment of each IP network segment in the IP network segment linked list set, so as to obtain the longest parent network segment of each IP network segment;

[0170] Add the statistical item of each IP network segment to the statistical item of the longest parent IP network segment of the IP network segment;

[0171] According to the association relationship between the numbers of the IP network segments and each address group to be statistically counted, refresh the statistical items of the IP network segments in the IP network segment linked list set to the statistical items of the group elements corresponding to each address group to be statistically counted, so as to obtain the statistical items of each address group to be statistically counted.

[0172] In some more specific embodiments, the third processing module is specifically configured to, in the order of the masks of the IP network segment linked lists from long to short, use the first IP network segment of the IP network segment linked list with the longest mask in the IP network segment linked list set as the sub-IP network segment, and retrieve the longest parent network segment of the sub-IP network segment starting from the first IP network segment of the next IP network segment linked list of the IP network segment to which the sub-IP network segment belongs, so as to obtain the longest parent network segment of the sub-IP network segment;

[0173] Record the number of the longest parent network segment of the sub-IP network segment to the sub-IP network segment.

[0174] An address group traffic statistics device related to the above embodiments. It includes obtaining an IP network segment linked list set according to all address groups to be statistically counted. In a statistical period, in response to determining that a traffic data packet is received, obtaining the IP address of the traffic data packet, refreshing the statistical items of the IP network segments in the IP network segment linked list set according to the longest prefix matching rule and the IP address of the traffic data packet, and obtaining the traffic statistical values of all address groups to be statistically counted in a statistical period according to the statistical items of the IP network segments in the IP network segment linked list set. The present invention solves the problem that an IP address needs to be matched multiple times, greatly reduces the search and matching work, reduces the consumption of device performance, and improves the device performance.

[0175] The present invention also provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements an address group traffic statistics method according to any one of the above technical solutions.

[0176] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements an address group traffic statistics method according to any one of the above technical solutions.

[0177] The functional blocks shown in the above-described structural block diagrams can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, and so on. When implemented in software, the elements of the present application are programs or code segments for performing the required tasks. The program or code segment can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via a data signal carried in a carrier wave. A "machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and so on. The code segment can be downloaded via a computer network such as the Internet, an intranet, and so on.

[0178] It should also be noted that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be executed in the order mentioned in the embodiments, or different from the order in the embodiments, or several steps can be executed simultaneously.

[0179] Aspects of the present application have been described above with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present application. It should be understood that each block in the flowcharts and / or block diagrams, and the combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the functions / actions specified in one or more blocks of the flowcharts and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each block in the block diagrams and / or flowcharts, and the combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware for performing the specified functions or actions, or by a combination of dedicated hardware and computer instructions.

[0180] As described above, this is only the specific implementation manner of the present application. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be elaborated herein. It should be understood that the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered within the protection scope of the present application.

Claims

1. A method for collecting traffic statistics of an address group, characterized in that: The method comprises: According to all the address groups to be counted, an IP network segment linked list set is obtained, wherein the address groups to be counted are configured by the customer, and the IP network segment linked list set is a set consisting of multiple IP network segment linked lists, and each IP network segment linked list is a linked list consisting of network segments belonging to the same mask; In a statistical cycle, in response to determining that a traffic data packet is received, an IP address of the traffic data packet is obtained, and according to a longest prefix matching rule and the IP address of the traffic data packet, a statistical item of the IP network segment in the IP network segment linked list is refreshed; According to the IP network segments in the IP network segment linked list and the longest parent network segment of each IP network segment, the statistical items of the IP network segments in the IP network segment linked list are refreshed to obtain the traffic statistical values ​​of all the address groups to be counted in a statistical cycle; The method of refreshing the statistical items of the IP network segments in the IP network segment linked list according to the IP network segments in the IP network segment linked list and the longest parent network segment of each IP network segment, and obtaining the traffic statistical values ​​of all the address groups to be counted in a statistical cycle, specifically includes: Find the longest parent network segment of each IP network segment in the IP network segment linked list to obtain the longest parent network segment of each IP network segment; Adding the statistical items of each of the IP network segments to the statistical items of the longest parent IP network segment of the IP network segment; According to the association between the number of the IP network segment and each of the address groups to be counted, the statistical items of the IP network segment in the IP network segment linked list are refreshed into the statistical items of the corresponding group elements of each of the address groups to be counted, so as to obtain the statistical items of each of the address groups to be counted; The method of obtaining an IP network segment linked list set according to all the address groups to be counted specifically includes: Converting the group elements in each of the address groups to be counted into a representation of an IP network segment to obtain a corresponding IP network segment subset, and summarizing all IP network segment subsets to obtain a first IP network segment set; Remove duplicate IP network segments and IP network segments with inclusion relationships from the first IP network segment set to obtain a second IP network segment set; The second IP network segment set is classified according to the mask to obtain the IP network segment linked list set.

2. The method according to claim 1, characterized in that The converting of the group elements in each of the address groups to be counted into a representation of an IP network segment specifically includes: Converting the group elements in the address group to be counted, which are in the form of IP addresses, into group elements in the form of IP network segments; Converting the group elements in the address group to be counted, which are in the form of IP range, into group elements in the form of IP network segment; The step of removing duplicate network segments and network segments with a containment relationship from the first IP network segment set to obtain a second IP network segment set specifically includes: Determine whether there is an inclusion relationship between the IP network segments in each of the IP network segment subsets; If so, remove the included IP network segment from the IP network segment subset; Determine whether there are duplicate IP network segments in all the IP network segment subsets; If so, remove the duplicate IP network segments from the IP network segment subset to obtain the second IP network segment set; Number each IP network segment in the second IP network segment set, and associate the number of the IP network segment with the address group to be counted.

3. The method according to claim 1, characterized in that The step of performing IP classification on the second IP network segment set according to the mask to obtain the IP network segment linked list set specifically includes: Putting the IP network segments with the same mask in the second IP network segment set into an IP network segment linked list, thereby obtaining a plurality of the IP network segment linked lists with different masks; Each of the IP network segment linked lists is put into a hash table, and the hash table is used to accelerate the search for the longest parent network segment of each IP network segment in the IP network segment linked list.

4. The method according to claim 1, characterized in that: The step of refreshing the statistical items of the IP network segments in the IP network segment linked list according to the longest prefix matching rule and the IP address of the traffic data packet specifically includes: According to the longest prefix matching rule and the IP address of the traffic data packet, the IP network segment to which the IP address of the traffic data packet belongs is obtained by matching the IP network segment linked list set using the longest prefix matching rule; Refresh the statistical items of the IP network segment in the IP network segment linked list.

5. The method according to claim 1, characterized in that The searching for the longest parent network segment of each IP network segment in the IP network segment linked list to obtain the longest parent network segment of each IP network segment specifically includes: According to the order of the masks of the IP network segment chain list from long to short, the first IP network segment of the IP network segment chain list with the longest mask in the IP network segment chain list set is used as the sub-IP network segment, and the longest parent network segment of the sub-IP network segment is retrieved from the first IP network segment of the next IP network segment chain list of the IP network segment chain list to which the sub-IP network segment belongs, to obtain the longest parent network segment of the sub-IP network segment; Record the longest parent network segment number of the sub-IP network segment to the sub-IP network segment.

6. An address group traffic statistics device, characterized in that: The device comprises: A first processing module is used to obtain an IP network segment linked list set according to all the address groups to be counted, wherein the address groups to be counted are configured by the customer, the IP network segment linked list set is a set consisting of multiple IP network segment linked lists, and each IP network segment linked list is a linked list consisting of network segments belonging to the same mask; A second processing module is used for, in a statistical cycle, in response to determining that a received traffic data packet is received, obtaining an IP address of the traffic data packet, and refreshing the statistical items of the IP network segment in the IP network segment linked list according to the longest prefix matching rule and the IP address of the traffic data packet; The third processing module is used to refresh the statistical items of the IP network segments in the IP network segment linked list according to the IP network segments in the IP network segment linked list and the longest parent network segment of each IP network segment, so as to obtain the traffic statistical values ​​of all the address groups to be counted in a statistical cycle; The third processing module is specifically used to find the longest parent network segment of each IP network segment in the IP network segment linked list, and obtain the longest parent network segment of each IP network segment; Adding the statistical items of each of the IP network segments to the statistical items of the longest parent IP network segment of the IP network segment; According to the association between the number of the IP network segment and each of the address groups to be counted, the statistical items of the IP network segment in the IP network segment linked list are refreshed into the statistical items of the corresponding group elements of each of the address groups to be counted, so as to obtain the statistical items of each of the address groups to be counted; The first processing module is specifically used to convert the group elements in each of the address groups to be counted into the representation form of IP network segments, obtain the corresponding IP network segment subsets, and summarize all IP network segment subsets to obtain the first IP network segment set; Remove duplicate IP network segments and IP network segments with inclusion relationships from the first IP network segment set to obtain a second IP network segment set; The second IP network segment set is classified according to the mask to obtain the IP network segment linked list set.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, an address group traffic statistics method according to any one of claims 1 to 6 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, an address group traffic statistics method according to any one of claims 1 to 5 is implemented.

Images