Packet capturing method, white box switch, storage medium and program product

Abstract

The application provides a packet capturing method, a white-box switch, a storage medium and a program product, and relates to the technical field of basic networks. The method is applied to a white-box switch including a proxy module, a switching chip and a CPU. The method comprises the following steps: the proxy module acquires a first request of a control platform device, the first request is used for requesting to capture a target type of data packet within a first time length; in response to the first request, the proxy module triggers the switching chip to execute a first command, the first command is used for copying the target type of data packet to the CPU; the proxy module acquires a first file by accessing a storage space of the white-box switch, the first file is related to the target type of data packet copied to the CPU; and the proxy module sends the first file to the control platform device. In this way, the problems that the existing mode may cause traffic loss and the configuration of additional servers may increase workload are solved.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a packet capture method, a white-box switch, a storage medium, and a program product. Background Technology

[0002] As business products continue to increase and the number of users grows exponentially, the network traffic handled by core switches and aggregation switches in data centers is also increasing daily. At the same time, the number of problems in network transmission is also increasing. At this time, network administrators need an effective and feasible method to intercept, transfer, and analyze data packets transmitted in the network in order to quickly diagnose faults.

[0003] Current packet capture methods such as Figure 1 As shown, a traffic mirroring method is used to mirror traffic from one port of a switch (such as Ethernet 4) to another port (Ethernet X). This other port is then connected to a server (packet capture server) where packets are captured, transferred, and analyzed. However, this method requires maintenance personnel to configure an additional server, increasing their workload. Furthermore, this method requires the mirrored port (the aforementioned other port) to receive all traffic, which may result in traffic loss. Summary of the Invention

[0004] This application provides a packet capture method, a white-box switch, a storage medium, and a program product, which solves the problems of potential traffic loss in existing packet capture methods and the increased workload of maintenance personnel due to the configuration of additional servers.

[0005] Firstly, to achieve the above objectives, embodiments of this application provide a packet capture method applied to a white-box switch, the white-box switch comprising: a proxy module, a switching chip, and a central processing unit (CPU), the method comprising:

[0006] The proxy module obtains a first request from the control platform device, the first request being used to request the capture of data packets of the target type within a first time period;

[0007] In response to the first request, the proxy module triggers the switching chip to execute a first command, the first command being used to copy the target type data packet to the CPU;

[0008] The proxy module obtains a first file by accessing the storage space of the white-box switch. The first file is related to the data packet of the target type copied to the CPU.

[0009] The agent module sends the first file to the control platform device.

[0010] Optionally, the proxy module obtains a first request for controlling a platform device, comprising:

[0011] The proxy module obtains the first request transmitted by the control platform device to the proxy module through a representation state transfer application interface (Rest API) interface exposed by the proxy module.

[0012] Optionally, the proxy module sends the first file to the control platform device, comprising:

[0013] The proxy module feeds back the first file to the control platform device through the Rest API interface.

[0014] Optionally, before the proxy module obtains the first file by accessing the storage space of the white-box switch, the method further comprises:

[0015] The proxy module triggers the operating system of the white-box switch to run a first program through a first command line interpreter (shell) command, and the first program is used to obtain the target type of data packet copied to the CPU and convert the target type of data packet into the first file, wherein the first file is a packet capture (pcap) format file.

[0016] Optionally, the method further comprises:

[0017] At a second time, the proxy module triggers the operating system of the white-box switch to stop running the first program through a second shell command, wherein the time interval between the second time and the first time is the first duration, and the first time is the time when the proxy module triggers the switch chip to execute the first command.

[0018] Optionally, in response to the first request, the method further comprises:

[0019] At a second time, the proxy module triggers the switch chip to stop executing the first command, wherein the time interval between the second time and the first time is the first duration, and the first time is the time when the proxy module triggers the switch chip to execute the first command.

[0020] In a second aspect, to achieve the above object, an embodiment of the present application provides a white-box switch, comprising a proxy module, a switch chip and a central processing unit (CPU), wherein the proxy module is used to perform the following steps:

[0021] obtaining a first request of a control platform device, the first request being used to request to capture a target type of data packet within a first time length;

[0022] in response to the first request, triggering the switch chip to execute a first command, the first command being used to copy the target type of data packet to the CPU;

[0023] obtaining a first file by accessing a storage space of the white box switch, the first file being related to the target type of data packet copied to the CPU;

[0024] sending the first file to the control platform device.

[0025] In a third aspect, to achieve the above object, an embodiment of the present application provides a white box switch, comprising a transceiver, a processor, a memory, and a program stored in the memory and executable on the processor; the processor executes the program to implement the packet capturing method in the first aspect.

[0026] In a fourth aspect, to achieve the above object, an embodiment of the present application provides a readable storage medium having a program or instruction stored thereon, the program or instruction being executable by a processor to implement the packet capturing method in the first aspect.

[0027] In a fifth aspect, to achieve the above object, an embodiment of the present application provides a computer program product comprising computer instructions, the computer instructions being executable by a processor to implement the packet capturing method in the first aspect.

[0028] The above technical solutions of the present application have the following beneficial effects:

[0029] The packet capturing method of the embodiment of the application is applied to a white box switch, and the white box switch comprises a proxy module, a switching chip and a central processing unit (CPU). The method comprises the following steps: the proxy module acquires a first request of a control platform device, the first request being used to request capturing a target type of data packet within a first time length; in response to the first request, the proxy module triggers the switching chip to execute a first command, the first command being used to copy the target type of data packet to the CPU; the proxy module acquires a first file by accessing a storage space of the white box switch, the first file being related to the target type of data packet copied to the CPU; and the proxy module sends the first file to the control platform device. In this way, the proxy module is deployed in the white box switch, so that the specific data packet is copied to the CPU by the interaction between the proxy module, the switching chip and the CPU, the packet capturing is performed by the proxy module, and the captured file is sent to the control platform device. Thus, the embodiment of the application does not need to capture all data packets, thereby avoiding the situation of traffic loss, and the embodiment of the application does not need to configure additional equipment and operate physical hardware, thereby reducing the workload of operation and maintenance personnel. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 A schematic diagram of existing packet capturing by port mirroring;

[0031] Figure 2 A schematic diagram of a user space mode of a white box switch;

[0032] Figure 3 A schematic diagram of a kernel space mode of a white box switch;

[0033] Figure 4 One of flowcharts of a packet capturing method according to an embodiment of the application;

[0034] Figure 5 A schematic diagram of packet flow in a switching chip according to an embodiment of the application;

[0035] Figure 6 A schematic diagram of a captured packet flow path according to an embodiment of the application;

[0036] Figure 7 Another of flowcharts of a packet capturing method according to an embodiment of the application;

[0037] Figure 8 An interaction schematic diagram of a white box switch and a control platform device according to an embodiment of the application;

[0038] Figure 9 A structural schematic diagram of a white box switch according to an embodiment of the application;

[0039] Figure 10Figure 2 is a structural schematic diagram of a white-box switch according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] To make the technical problems solved by the present application, technical solutions and advantages clearer, the following will be described in detail with reference to the drawings and specific embodiments.

[0041] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily mean the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner.

[0042] In various embodiments of the present application, it should be understood that the size of the serial number of the following processes does not mean the order of execution, and the execution order of the processes should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0043] In addition, the terms "system" and "network" are often used interchangeably herein.

[0044] In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that the determination of B according to A does not mean that B is determined only according to A, but B can also be determined according to A and / or other information.

[0045] Before the embodiments of the present application are described, the related technical points are first described:

[0046] The operation mode of the central processing unit (CPU) and the switching chip includes the user space mode (User-Space Mode) as shown in Figure 2 and the kernel space mode (Kernel-Space Mode) as shown in Figure 3 ; wherein, in the User-Space Mode, the switching chip (such as Figure 2In Tofino (e.g., the bf_kdrv tool), the application running on the CPU uses the bf_pktAPIs (packet management interface) within the bf_kdrv tool to transmit data with the network ports (Ethernet0, Ethernet4, ..., Ethernet N, etc.) on the switching chip (e.g., Tofino). In Kernel-Space Mode, the kernel packet management driver module (e.g., the bf_kpkt tool) is used to connect the network ports on the switching chip (e.g., Tofino)... Figure 3 The solid lines indicating Ethernet0, Ethernet4, ..., Ethernet N, etc., map to the operating system (such as Linux) kernel. This mode allows all virtual network interfaces to be seen on the operating system (e.g., using the ip_addr command). Figure 3 The dashed lines indicate Ethernet0, Ethernet4, ..., Ethernet N, etc. Figure 3 bf_pci0 is a resource that maps the Peripheral Component Interconnect (PCI) interface at the system layer, and bf_knet is the kernel network module.

[0047] The following, in conjunction with the accompanying drawings, provides a detailed description of the packet capture method, white-box switch, storage medium, and program product implementation process of the embodiments of this application.

[0048] Embodiments of this application provide a packet capture method applied to a white-box switch. The white-box switch includes a proxy module, a switching chip, and a CPU. Figure 4 As shown, the method includes:

[0049] Step 401: The proxy module obtains a first request from the control platform device. The first request is used to request the capture of data packets of the target type within a first time period. Here, the control platform device is a device used to manage and control white-box switches. The control platform device is equipped with a visual interface (such as a web interface) for user interaction. Users can manage and control the white-box switches through operations on the visual interface, such as packet capture. That is, users can control the white-box switches to capture packets through "white-screen operation". Compared with the existing "black-screen operation", this method can eliminate the risk of user misoperation and reduce the unsafe factors of production equipment. In addition, the type of data packet in this step can be represented by the destination network protocol (Internet Protocol, IP) address of the data packet.

[0050] Step 402, in response to the first request, the agent module triggers the switch chip to execute a first command, and the first command is used to copy the data packet of the target type to the CPU; specifically, the agent module can issue a rule to the switch chip, and the rule is used to trigger the switch chip to execute the first command, wherein the rule can be expressed as: taking the target type in the first request as a matching condition, executing the copy_to_CPU method. For example, when the switch chip is the tofino mentioned above, specifically, the agent module can issue the rule to the tofino through the bfrt (Barefoot runtime, Barefoot developed runtime) mode, and the tofino executes the first command based on the received rule to copy the data packet of the target type. On this basis, the switch chip transmits the copied data packet to the CPU through the high-speed serial computer expansion (Peripheral Component Interconnect express, PCIe) bus between the CPU;

[0051] Step 403, the agent module obtains a first file by accessing the storage space of the white box switch, and the first file is related to the data packet of the target type copied to the CPU; here, the storage space is, for example, a region such as a disk / hard disk, a memory and the like of the white box switch that can store data; that is, after the data packet of the target type is copied to the CPU, the operating system running on the CPU can generate the first file according to the data packet of the target type, and store the first file in the storage space. Wherein, the first file can be composed of the data packet of the target type, and the first file can also be a file generated after processing the data packet of the target type;

[0052] Step 404, the agent module sends the first file to the control platform device.

[0053] The white box switch applying the packet capturing method of the embodiment of the present application comprises a proxy module, a switching chip and a CPU, wherein the packet capturing method comprises the following steps: firstly, the proxy module obtains a first request of a control platform device, the first request being used to request capturing data packets of a target type within a first time length; secondly, in response to the first request, the proxy module triggers the switching chip to execute a first command, the first command being used to copy the data packets of the target type to the CPU; thirdly, the proxy module obtains a first file by accessing a storage space of the white box switch, the first file being related to the data packets of the target type copied to the CPU; and finally, the proxy module sends the first file to the control platform device. In this way, the white box switch captures specific data packets (data packets of the target type) based on the first request of the control platform device, and feeds back the first file corresponding to the captured data packets to the control platform device, so that it is not necessary to capture all data packets, the situation of traffic loss is avoided, and it is not necessary to configure an additional server to capture packets, thereby saving the packet capturing cost and reducing the workload of operation and maintenance personnel.

[0054] Here, it should be noted that the premise of executing the packet capturing method of the embodiment of the present application is that the white box switch completes the initialization process, and the white box switch is in the Kernel-Space Mode after being initialized, so that the data packets copied to the CPU by the switching chip can be sent to the operating system through the corresponding virtual network port. Figure 6 For example, after tofino copies the data packets of the target type to the CPU through PCIe, the data packets of the target type are displayed in bf_pci0 by using a bf_kpkt tool, and the data packets of the target type in bf_pci0 are analyzed by using a bf_knet tool to obtain source port information (such as Ethernet4 indicated by a solid line in Figure 6 After that, the data packets of the target type are sent to the operating system through the virtual port (such as Figure 6The Ethernet 4 marked by a dashed line sends the data packet of the target type to the operating system running on the CPU. If the operating system (network operating system (NOS)) is a software for open networking in the cloud (SONiC), according to the relevant provisions of the SONiC, the agent needs to run in an open application container engine (docker) container. When the docker starts the agent, the host mode needs to be used, so that the network card mapped by the bf_kpkt to the operating system kernel can be viewed in the docker container. Therefore, the network parameter (net=host) needs to be added to the docker start parameter. The host mode is a network mode in the docker container. In the host mode, the docker container and the host share the same network namespace at the network layer. This means that the network configuration (such as the IP address) of the docker container is based on the host, rather than being set separately for each container as in other modes.

[0055] As an optional implementation, step 401 comprises:

[0056] The agent module obtains the first request transmitted to the agent module by the control platform device through calling the RestAPI interface exposed by the agent module.

[0057] That is, when the relevant personnel develop / write the agent (in the agent) in the agent module ( Figure 6 and Figure 8 ), the RestAPI will be encapsulated. Therefore, the agent will expose the RestAPI to the outside, that is, the agent will provide the RestAPI to the outside. In this way, the control platform device will call the RestAPI provided by the agent to the outside to transmit the first request to the agent. The first request includes one or more data packet types and packet capturing time. The data packet type can be identified by the destination IP address of the data packet. The packet capturing time is used to indicate the maximum value of the packet capturing time limit, such as 10 min. That is, the data packet with the destination IP address carried in the first request is captured within 10 min after the agent receives the first request.

[0058] It should be noted that, on the control platform device side, the operation and maintenance personnel can interact with the control platform device based on the visual interface of the control platform device, input the desired packet type and packet capture time, and click the packet capture icon / button in the visual interface, so as to trigger the control platform device to call the RestAPI provided by the agent. In this way, white screen packet capture is realized, and the risk of misoperation of the operation and maintenance personnel is reduced.

[0059] As an optional implementation, step 404 comprises:

[0060] The agent module feeds back the first file to the control platform device through the RestAPI interface. That is, after the agent module obtains the first file from the storage space, the agent module returns the first file to the control platform device through the RestAPI interface exposed by the agent module, so that the operation and maintenance personnel can view the first file through the control platform device, thereby quickly diagnosing the fault.

[0061] Further, as an optional implementation, before step 403, the method further comprises:

[0062] The agent module triggers the operating system of the white box switch to run a first program through a first shell command, and the first program is used to obtain the target type of data packet copied to the CPU and convert the target type of data packet into the first file, wherein the first file is a packet capture (pcap) format file.

[0063] Here, shell refers to a user-oriented command interface, which can also be understood as a command line interpreter. A program can be started through the shell. Specifically, in the present optional implementation, the agent module starts the first program through a first shell command. Specifically, the first program is a network packet analysis software, and the network packet analysis software can save the data packet as a (pcap) file.

[0064] Specifically, in the present optional implementation, the implementation process of the operating system is as follows: the operating system runs the first program to obtain the target type of data packet from the virtual network port (for example, Ethernet4 marked by a dashed line), and then converts the obtained data packet into a pcap file and stores the pcap file in a storage space (disk / hard disk or memory). Figure 6 For example, the virtual network port is Ethernet4 marked by a dashed line.

[0065] As a specific implementation, the first program comprises a packet capturing tool (for example, tcpdump software, which is a packet capturing tool running under a command line and used for capturing packets such as Transmission Control Protocol (TCP) packets, User Datagram Protocol (UDP) packets, Internet Control Message Protocol (ICMP) packets and other packets) or a network packet analysis software (for example, wireshark software). Specifically, in the embodiment of the present application, the tcpdump software or the wireshark software is used to convert the target type of data packet into a pcap file.

[0066] Further, as an optional implementation, the method further comprises:

[0067] At the second time, the agent module triggers the operating system of the white-box switch to stop running the first program through a second shell command, wherein the time interval between the second time and the first time is the first length, and the first time is the time when the agent module triggers the switch chip to execute the first command.

[0068] That is, when the packet capturing time reaches the packet capturing time set by the operation and maintenance personnel (for example, 10 min), the agent module interacts with the operating system through the second shell command to instruct the operating system to stop running the first program, thereby improving the performance of the white-box switch.

[0069] Further, as another optional implementation, after step 402, the method further comprises:

[0070] At the second time, the agent module triggers the switch chip to stop executing the first command, wherein the time interval between the second time and the first time is the first length, and the first time is the time when the agent module triggers the switch chip to execute the first command.

[0071] That is, after the agent module triggers the switch chip to execute the first command, the agent module starts timing (the timing duration is the packet capturing duration set by the operation and maintenance personnel (such as 10 minutes)), and after the timing ends, the agent module stops the operation of copy_to_CPU through the switch chip. In this way, the problem that the switch chip copies a large amount of data packets to the CPU for a long time, causing an impact on the performance of the white box switch due to the lack of stopping the operation of copy_to_CPU in the existing packet capturing mode can be solved. Specifically, one specific example of the optional implementation manner is that at the second moment, the agent module sends a first instruction to the switch chip, and the first instruction instructs the switch chip to stop executing the rule (executes the copy_to_CPU method with the target type in the first request as the matching condition) and delete the rule.

[0072] Next, the interaction process of the agent, the switch chip (taking tofino as an example), the CPU and the control platform device in the packet capturing method of the embodiments of the present application will be described in detail. Figure 5 , Figure 6 , Figure 7 and Figure 8 .

[0073] Step 701: The agent receives an API request; specifically, the agent receives an API request (the first request described above) sent by the control platform device through the RestAPI interface provided by the agent (as shown in Figure 8 ; wherein, after the operation and maintenance personnel input the type of the data packet to be captured and the capturing duration based on the visual operation interface, the control platform device sends the API request to the agent through the RestAPI in response to the operation of the operation and maintenance personnel clicking the packet capturing icon / button on the visual interface; in this way, the packet capturing process is implemented through "white screen operation", and the operation error of the operation and maintenance personnel is reduced.

[0074] Step 702: issuing a copy_to_CPU instruction to tofino through bfrt; specifically, after receiving the API request, the agent issues the copy_to_CPU instruction to the tofino in response to the API request, wherein the tofino executes the copy_to_CPU operation with the type of the data packet in the API request (such as the destination IP address of the data packet as described above) as the matching condition, that is, the copy_to_CPU instruction issued by the agent to the tofino is a conditional instruction (only specific data packets are copied to the CPU).

[0075] Here, in combination with Figure 5 , the process of performing the copy_to_CPU operation on tofino is described. As shown in Figure 5 , tofino is mainly composed of a packet ingress module, a packet replication engine (PRE) and a traffic manager (TM) module (i.e. the PRE&TM module in Figure 5 ), a packet egress module. The general transmission process of a data packet in tofino is as follows: the data packet first passes through the packet ingress module for packet header disassembly and analysis, then enters the PRE&TM module, and finally is reassembled by the egress module and output to the corresponding port. On this basis, after receiving the copy_to_CPU instruction sent by the agent, the packet ingress module can filter the data packet to be captured, and mark the filtered data packet (target type data packet) with the copy_to_CPU method. When passing through the PRE&TM module, tofino will copy the marked data packet and mark the output port as a port connected to the CPU (such as Port64 in Figure 5 ), and add source port information (such as Ethernet4 in Figure 6 ) to the copied data packet. After passing through the packet egress module, the data packet will be copied to the CPU. Since this packet capture process uploads the copied data packet to the CPU, this operation will not affect the original business traffic.

[0076] Step 703, obtaining the message by tcpdump and saving the pcap file; this step is specifically: the agent runs tcpdump through the first shell command to convert the data packet copied to the CPU into a pcap file, and places the pcap file in the specified disk path.

[0077] Here, it should be noted that the operating system (such as linux) runs on the CPU, as shown in Figure 3 , the kernel packet management driver module (bf_kpkt) runs in the operating system. When the CPU receives the data packet uploaded by tofino, the data packet will appear in bf_pci0 under the processing of the bf_kpkt tool, and the bf_knet tool will analyze the source port information (such as the solid line Ethernet4 in Figure 6 ) in the data packet, and through the mapped virtual port (such as Figure 6The dashed line in the Ethernet4) sends to the operating system, and the operating system runs the tcpdump software to store the received data packet as a pcap file when receiving the first shell command, and then stores the pcap file in the storage space of the white box switch.

[0078] On the contrary, if the operating system sends a data packet (the data packet is in Figure 6 the dashed line Ethernet4) to the mapped Ethernet4( Figure 6 The bf_knet also adds port information in the data packet, and the data packet is transmitted to the tofino through the bf_pci0 and the bf_kpkt, so that the tofino can obtain the port information of the source.

[0079] Step 704, timing according to a given time; here, the given time is the packet capturing time carried in the API request; specifically, after the agent issues the copy_to_CPU instruction to the tofino through the bfrt and runs the tcpdump through the first shell command, the timing starts, and the timing duration is the packet capturing time carried in the API request.

[0080] Step 705, stopping the tcpdump after timing; specifically, the agent stops the operating system running the tcpdump through the second shell command after timing.

[0081] Step 706, deleting the copy_to_CPU rule in the tofino through the bfrt; specifically, after timing, the agent deletes the copy_to_CPU rule in the tofino through the bfrt to instruct the tofino to stop sending the copied data packet to the CPU; it should be noted that steps 705 and 706 are steps executed after timing, and the execution order of the two is not limited, which can be executed as shown in Figure 7 , step 705 is executed first, step 706 is executed second, or steps 705 and 706 are executed simultaneously.

[0082] Step 707, returning the captured pcap file; specifically, the agent returns the captured pcap file to the control platform device through the RestAPI.

[0083] The embodiment of the application also provides a white box switch, as shown in Figure 9 , the white box switch comprises a proxy module 901, a switch chip 902 and a central processing unit CPU 903, wherein the proxy module 901 is configured to execute the following steps:

[0084] obtaining a first request for a control platform device, the first request being used to request to capture a target type of data packet within a first time length;

[0085] in response to the first request, triggering the switch chip 902 to execute a first command, the first command being used to copy the target type of data packet to the CPU 903;

[0086] obtaining a first file by accessing a storage space of the white box switch, the first file being related to the target type of data packet copied to the CPU 903;

[0087] sending the first file to the control platform device.

[0088] Optionally, when the proxy module 901 is used to obtain the first request for the control platform device, the proxy module 901 is specifically used to obtain the first request transmitted by the control platform device to the proxy module 901 by calling a representation state transfer application interface (Rest API) interface exposed by the proxy module.

[0089] Optionally, when the proxy module 901 is used to send the first file to the control platform device, the proxy module 901 is specifically used to feed back the first file to the control platform device through the Rest API interface.

[0090] Before the proxy module 901 obtains the first file by accessing the storage space of the white box switch, the proxy module 901 is further used to:

[0091] triggering, by a first shell command, an operating system of the white box switch to run a first program, the first program being used to obtain the target type of data packet copied to the CPU 903 and store the target type of data packet as the first file, wherein the first file is a packet capture (pcap) format file.

[0092] Optionally, the proxy module 901 is further used to: at a second time, trigger, by a second shell command, the operating system of the white box switch to stop running the first program, wherein a time interval between the second time and a first time is the first time length, and the first time is a time when the proxy module 901 triggers the switch chip 902 to execute the first command.

[0093] Optionally, the first program includes a packet capturing tool or network packet analysis software.

[0094] Optionally, after the proxy module 901 triggers the switch chip to execute the first command in response to the first request, the proxy module 901 is further used to:

[0095] At the second moment, the switching chip 902 is triggered to stop executing the first command, wherein the time interval between the second moment and the first moment is the first duration, and the first moment is the moment when the proxy module 901 triggers the switching chip 902 to execute the first command.

[0096] It should be noted that the white-box switch provided in this application embodiment can implement all the method steps implemented in the above packet capture method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0097] Embodiments of this application also provide a white-box switch, such as Figure 10 As shown, it includes a transceiver 1010, a processor 1000, a memory 1020, and a program or instructions stored in the memory 1020 and executable on the processor 1000; when the processor 1000 executes the program or instructions, it implements the above-mentioned packet capture method.

[0098] The transceiver 1010 is used to receive and send data under the control of the processor 1000.

[0099] Among them, Figure 10 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 1000) and memory (memory 1020). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1010 may be multiple elements, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium. The processor 1000 is responsible for managing the bus architecture and general processing, and the memory 1020 may store data used by the processor 1000 during operation.

[0100] It should be noted that the white-box switch provided in this application embodiment can implement all the method steps implemented in the above packet capture method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0101] An embodiment of this application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the steps in the packet capture method described above and achieve the same technical effect. To avoid repetition, this will not be repeated here.

[0102] The processor is the processor in the white box switch in the above embodiments. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0103] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and a necessary general hardware platform, and of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. According to such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for causing a white box switch to execute the method described in the embodiments of the present application.

[0104] Therefore, the embodiments of the present application also provide a computer program product including computer instructions, which, when executed by a processor, implement the steps in the packet capturing method described above and achieve the same technical effects. To avoid repetition, details are not described here.

[0105] In addition, in the embodiments of the present application, the modules can be implemented by software to be executed by various types of processors. For example, an identified executable code module can include one or more physical or logical blocks of computer instructions. For example, it can be constructed as an object, a procedure, or a function. However, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different locations which, when logically combined, constitute the module and achieve the specified purpose of the module.

[0106] In fact, an executable code module can be a single instruction, or many instructions, and can even be distributed over several different code segments, among different programs, and across several memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable type of data structure. The operational data can be collected as a single data set, or distributed over different locations including over different storage devices, and can exist at least in part only as electronic signals on a system or network.

[0107] When the modules can be implemented in software, the modules in software are loaded into a memory and executed by a suitable instruction execution system. The system can be a stand alone system, or can be part of a larger system. The modules can be stored on any computer readable storage medium, various examples of which include magnetic, optical or semiconductor storages.

[0108] The foregoing exemplary embodiments are described in detail with reference to the drawings. The scope of the application should not be construed as being limited to the exemplary embodiments described herein. Rather, the exemplary embodiments are provided so that the scope of the application will be complete and fully conveyed by the exemplary embodiments to those skilled in the art. Since the scope of the application is defined only by the appended claims, the description of the exemplary embodiments is purely for the purposes of illustration and will be summarized as follows. In the drawings, the size and relative sizes of components can be exaggerated for illustration purposes. Also, the terms "first", "second", and the like, do not necessarily denote any ordinal, but can be used to distinguish one component from another. The terms "include", "comprise", "comprising", "have", "having", "contain", "containing", "carry", "carrying", "hold", "holding", "provide", "providing", etc., are used inclusively and not exclusivity. Unless otherwise indicated, a value range includes the upper and lower limits of the range and any sub-range therebetween.

[0109] The above description is considered that the preferred embodiments of the present application. It should be noted that for those skilled in the art, without departing from the principles described in the present application, can make a number of improvements and refinements, these improvements and refinements should also be considered as the scope of protection of the present application.

Claims

1. A method of grabbing a packet, characterized by, The method is applied to a white box switch, and the white box switch comprises an agent module, a switching chip and a central processing unit (CPU). The method comprises the following steps: The agent module obtains a first request of a control platform device, and the first request is used to request to capture data packets of a target type within a first time length. In response to the first request, the agent module triggers the switching chip to execute a first command, and the first command is used to copy the data packets of the target type to the CPU. The agent module triggers an operating system of the white box switch to run a first program through a first shell command, and the first program is used to obtain the data packets of the target type copied to the CPU and convert the data packets of the target type into a first file, wherein the first file is a packet capture (pcap) format file. At a second time, the agent module triggers the operating system of the white box switch to stop running the first program through a second shell command, wherein a time interval between the second time and a first time is the first time length, and the first time is a time when the agent module triggers the switching chip to execute the first command. The agent module obtains the first file by accessing a storage space of the white box switch, and the first file is related to the data packets of the target type copied to the CPU. The agent module sends the first file to the control platform device.

2. The method of claim 1, wherein, The agent module obtains a first request of a control platform device, and the first request is used to request to capture data packets of a target type within a first time length. The agent module obtains the first request transmitted by the control platform device to the agent module through a representation state transfer (REST) application programming interface (API) exposed by the agent module.

3. The method of claim 2, wherein, The agent module sends the first file to the control platform device, and the method comprises the following steps: The agent module feeds back the first file to the control platform device through the REST API.

4. The method of claim 1, wherein, After the agent module triggers the switching chip to execute the first command in response to the first request, the method further comprises the following steps: At a second time, the agent module triggers the switching chip to stop executing the first command, wherein a time interval between the second time and a first time is the first time length, and the first time is a time when the agent module triggers the switching chip to execute the first command.

5. A white box switch, comprising: The white box switch comprises an agent module, a switching chip and a central processing unit (CPU), and the agent module is used to perform the following steps: Obtain a first request of a control platform device, and the first request is used to request to capture data packets of a target type within a first time length. In response to the first request, trigger the switching chip to execute a first command, and the first command is used to copy the data packets of the target type to the CPU. The agent module triggers the operating system of the white-box switch to run a first program through a first command-line interpreter shell command, the first program being used to acquire the target type of data packet copied to the CPU and store the target type of data packet as a first file, wherein the first file is a data packet capture (pcap) format file; At a second time, the agent module triggers the operating system of the white-box switch to stop running the first program through a second shell command, wherein the time interval between the second time and the first time is the first time length, and the first time is the time when the agent module triggers the switch chip to execute the first command; The first file is acquired by accessing the storage space of the white-box switch, and the first file is related to the target type of data packet copied to the CPU; The first file is sent to the control platform device.

6. A white box switch comprising a transceiver, a processor, a memory, and a program or instructions stored on the memory and executable on the processor; characterized in that, The processor executes the program or instruction to implement the packet capturing method in any one of claims 1 to 4.

7. A readable storage medium, on which a program or instructions are stored, characterized in that, The program or instruction is executed by the processor to implement the packet capturing method in any one of claims 1 to 4.

8. A computer program product, characterised in that, The computer program product comprises computer instructions, and the computer instructions are executed by the processor to implement the packet capturing method in any one of claims 1 to 4.

Images