Stream-following detection method and device

Abstract

The invention provides a flow following detection method and device, and the method comprises the steps: obtaining a first timestamp and a second timestamp corresponding to a first message pair from the mirror image flow of network side access equipment, and carrying out the calculation according to the first timestamp and the second timestamp, thereby obtaining the round-trip time delay of a user side, the first timestamp is a timestamp when the first request message arrives at the user side access equipment, and the second timestamp is a timestamp when the first response message arrives at the user side access equipment; a third timestamp and a fourth timestamp corresponding to the second message pair are obtained from the mirror image flow of the network side access device, the network side round-trip delay is calculated according to the third timestamp and the fourth timestamp, the third timestamp is the timestamp when the second request message reaches the network side access device, and the fourth timestamp is the timestamp when the second request message reaches the network side access device. The fourth timestamp is a timestamp when the second response message arrives at the network side access equipment. Through the application, the service quality of the user side and the network side can be perceived, and the measured network performance index can truly feed back the network experience of the user.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a flow detection method and device. Background Art

[0002] In traditional broadband access networks, operators provide communication pipeline services. With the continuous evolution of broadband access technology, operators are paying more and more attention to network quality. In-situ Flow Information Telemetry (IFIT) is applied to network quality control. By inserting IFIT detection headers into real business messages for feature marking, it can directly detect network performance indicators such as latency, packet loss, and jitter. Compared with traditional network operation and maintenance technologies, it has the advantages of high precision, real-time performance, and visualization.

[0003] In broadband access networks, users mostly use routers or wireless APs (Access Points) to access the operator's network. These user-side devices are not under the control of the operator and may have problems such as aging or insufficient forwarding efficiency, resulting in a poor network experience. There may be faults in the network application service itself on the network side, and most users do not have the professional knowledge to distinguish them, which may lead to complaints.

[0004] The existing flow detection technology can monitor the communication quality between network devices, but cannot perceive the service quality on the user side and the network side. When customers complain, it is impossible to define the quality difference between the user side and the network side, resulting in low network operation and maintenance efficiency and high investment costs. Summary of the invention

[0005] The present application provides a flow detection method and device, which can solve the technical problem that the flow detection technology in the prior art cannot perceive the service quality of the user side and the network side.

[0006] In a first aspect, an embodiment of the present application provides a flow detection method, which is applied to a flow detection device connected to a network-side access device. The flow detection method includes:

[0007] Obtaining a first timestamp and a second timestamp corresponding to a first message pair from the mirrored traffic of a network-side access device, and calculating a user-side round-trip delay according to the first timestamp and the second timestamp, wherein the first message pair is composed of a first request message and a first response message with the same message group ID, the first request message and the first response message are respectively a request message from a network-side device and a response message from a user-side device in an Internet application protocol, the first timestamp is a timestamp when the first request message arrives at the user-side access device, and the second timestamp is a timestamp when the first response message arrives at the user-side access device;

[0008] A third timestamp and a fourth timestamp corresponding to the second message pair are obtained from the mirrored traffic of the network side access device, and a network side round-trip delay is calculated according to the third timestamp and the fourth timestamp, wherein the second message pair is composed of a second request message and a second response message with the same message group ID, the second request message and the second response message are respectively a request message from the user side device and a response message from the network side device in an Internet application protocol, the third timestamp is a timestamp when the second request message arrives at the network side access device, and the fourth timestamp is a timestamp when the second response message arrives at the network side access device.

[0009] Furthermore, in one embodiment, before the step of acquiring the first timestamp and the second timestamp corresponding to the first message pair from the mirrored traffic of the network side access device, the method further includes:

[0010] Detecting the mirrored traffic of the network side access device according to at least one pair of first detection rules and second detection rules, if the number of first message pairs hit by any pair of first detection rules and second detection rules in the mirrored traffic within a first preset time period is greater than or equal to a first threshold, sending the pair of first detection rules and second detection rules to the network side access device through a control channel, so that a network device between the network side device and the user side device configures the first detection rule, and the user side access device configures the second detection rule;

[0011] The first detection rule is used to identify the first request message according to the relevant information in the original message, and the second detection rule is used to identify the first response message according to the relevant information in the original message;

[0012] The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message;

[0013] When the first detection rule is configured on a network device upstream of the user-side access device, the network device adds a tag to the identified first request message so that the user-side access device can identify the first request message.

[0014] Furthermore, in one embodiment, before the step of acquiring the third timestamp and the fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, the step further includes:

[0015] Detecting the mirrored traffic of the network side access device according to at least one pair of the third detection rule and the fourth detection rule, if the number of second message pairs hit by any pair of the third detection rule and the fourth detection rule in the mirrored traffic within the second preset time period is greater than or equal to the second threshold, sending the pair of the third detection rule and the fourth detection rule to the network side access device through the control channel, so that a network device between the network side device and the user side device configures the third detection rule, and the network side access device configures the fourth detection rule;

[0016] The third detection rule is used to identify the second request message according to the relevant information in the original message, and the fourth detection rule is used to identify the second response message according to the relevant information in the original message;

[0017] The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message;

[0018] When the third detection rule is configured on a network device downstream of the network-side access device, the network device adds a tag to the identified second request message so that the network-side access device can identify the second request message.

[0019] Furthermore, in one embodiment, an aging time is set for the detection rule, so that the corresponding network device deletes the corresponding detection rule after the configuration time of the detection rule reaches the aging time.

[0020] Furthermore, in one embodiment, the step of obtaining a first timestamp and a second timestamp corresponding to the first message pair from the mirrored traffic of the network-side access device, and calculating the user-side round-trip delay according to the first timestamp and the second timestamp includes:

[0021] A first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to the first message pair are obtained from the mirrored traffic of the network side access device, and a user side round-trip delay is calculated according to the first timestamp and the second timestamp. A round-trip delay between devices is calculated according to the first timestamp, the second timestamp, the fifth timestamp, and the sixth timestamp, wherein the fifth timestamp is a timestamp when the first request message arrives at the network side access device, and the sixth timestamp is a timestamp when the first response message arrives at the network side access device.

[0022] Further, in one embodiment, the step of obtaining a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to the first message pair from the mirrored traffic of the network side access device includes:

[0023] Obtain a first detection header of a first response message from the mirrored traffic of a network-side access device, and for each first detection header, determine a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp in the first detection header as a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to a first message pair;

[0024] The network-side access device identifies the first request message according to the relevant information in the original message, adds a first detection header to the first request message, and adds a message group ID and a fifth timestamp of the first request message to the first detection header;

[0025] The user-side access device identifies the first request message according to the first detection header, adds a first timestamp to the first detection header, and caches the first detection header;

[0026] The user-side access device identifies the first response message according to the relevant information in the original message, adds a first detection header with the same message group ID to the first response message, and adds a second timestamp to the first detection header;

[0027] The network-side access device identifies the first response message according to the first detection header, adds a sixth timestamp to the first detection header, and adds the first response message to the mirrored traffic.

[0028] Furthermore, in one embodiment, after the step of obtaining the first detection header of the first response message from the mirrored traffic of the network side access device, the step further includes:

[0029] Determine the packet loss rate of the user-side response message according to the first packet loss mark in the first detection header;

[0030] When the user-side access device adds the first detection header in the first response message, it detects whether the first target ID exists, and if the first target ID exists, adds the first packet loss marker to the first detection header;

[0031] The first target ID is the message group ID before the message group ID of the first response message. The user-side access device has identified the first request message with the message group ID as the first target ID, but has not identified the first response message with the message group ID as the first target ID.

[0032] Further, in one embodiment, the step of obtaining a third timestamp and a fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculating the network side round trip delay according to the third timestamp and the fourth timestamp includes:

[0033] A third timestamp, a fourth timestamp, a seventh timestamp, and an eighth timestamp corresponding to the second message pair are obtained from the mirrored traffic of the network side access device, and a network side round-trip delay is calculated according to the third timestamp and the fourth timestamp. A round-trip delay between devices is calculated according to the third timestamp, the fourth timestamp, the seventh timestamp, and the eighth timestamp, wherein the seventh timestamp is a timestamp when the second request message arrives at the user side access device, and the eighth timestamp is a timestamp when the second response message arrives at the user side access device.

[0034] Further, in one embodiment, the step of obtaining the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device includes:

[0035] Obtain a second detection header of the second request message from the mirrored traffic of the network-side access device, and for two second detection headers with consecutive message group IDs, determine the third timestamp and the seventh timestamp in the previous second detection header and the fourth timestamp and the eighth timestamp in the next second detection header as the third timestamp, the fourth timestamp, the seventh timestamp, and the eighth timestamp corresponding to a second message pair;

[0036] The network-side access device identifies the second response message according to the relevant information in the original message, adds a second detection header to the second response message, and adds a message group ID and a fourth timestamp of the second response message to the second detection header;

[0037] The user-side access device identifies the second response message according to the second detection header, adds an eighth timestamp to the second detection header, and caches the second detection header;

[0038] The user-side access device identifies the second request message according to the relevant information in the original message, adds a second detection header with a continuous message group ID to the second request message, and adds a seventh timestamp to the second detection header;

[0039] The network-side access device identifies the second request message according to the second detection header, adds a third timestamp to the second detection header, and adds the second request message to the mirrored traffic.

[0040] Furthermore, in one embodiment, after the step of obtaining the second detection header of the second request message from the mirrored traffic of the network side access device, the step further includes:

[0041] Determine the packet loss rate of the network side response message according to the second packet loss mark in the second detection header;

[0042] When the network-side access device adds the second detection header in the second response message, it detects whether the second target ID exists, and if the second target ID exists, adds the second packet loss marker to the second detection header;

[0043] The second target ID is the message group ID before the message group ID of the second response message. The network side access device has identified the second request message with the message group ID as the second target ID, but has not identified the second response message with the message group ID as the second target ID.

[0044] In a second aspect, an embodiment of the present application further provides a flow detection device, the flow detection device comprising a first detection module and a second detection module, the first detection module and the second detection module are both arranged in a flow detection device connected to a network side access device;

[0045] The first detection module is used to obtain a first timestamp and a second timestamp corresponding to a first message pair from the mirrored traffic of the network-side access device, and calculate the user-side round-trip delay according to the first timestamp and the second timestamp, wherein the first message pair is composed of a first request message and a first response message with the same message group ID, the first request message and the first response message are respectively a request message from the network-side device and a response message from the user-side device in an Internet application protocol, the first timestamp is a timestamp when the first request message arrives at the user-side access device, and the second timestamp is a timestamp when the first response message arrives at the user-side access device;

[0046] The second detection module is used to obtain a third timestamp and a fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculate the network side round-trip delay according to the third timestamp and the fourth timestamp, wherein the second message pair is composed of a second request message and a second response message with the same message group ID, the second request message and the second response message are respectively a request message from the user side device and a response message from the network side device in an Internet application protocol, the third timestamp is the timestamp when the second request message arrives at the network side access device, and the fourth timestamp is the timestamp when the second response message arrives at the network side access device.

[0047] In the present application, the network performance is measured with the help of the request-response message pairs in the Internet application protocol, and the round-trip delay on the user side is calculated based on the timestamp when the request message from the network side device and the response message from the user side device arrive at the user side access device. The round-trip delay on the network side is calculated based on the timestamp when the request message from the user side device and the response message from the network side device arrive at the network side access device. Through the present application, the service quality on the user side and the network side can be perceived, and the measured network performance indicators can truly feedback the user's network experience, accurately demarcate the quality difference between the user side and the network side, thereby improving the efficiency of network operation and maintenance and reducing investment costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flow chart of a flow detection method in one embodiment of the present application;

[0049] Figure 2 This is an interactive schematic diagram of user-side round-trip delay detection in one embodiment of the present application;

[0050] Figure 3 This is an interactive schematic diagram of round-trip delay detection on the network side in one embodiment of the present application;

[0051] Figure 4 This is a schematic diagram of an application scenario of a flow detection method in an embodiment of the present application;

[0052] Figure 5This is a schematic diagram of an application scenario of a flow detection method in another embodiment of the present application;

[0053] Figure 6 This is a schematic diagram of the relationship between the timestamp corresponding to the first message pair and the network device in an embodiment of the present application;

[0054] Figure 7 This is a schematic diagram of the relationship between the timestamp corresponding to the second message pair and the network device in one embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0057] In a first aspect, an embodiment of the present application provides a flow-following detection method, which is applied to a flow-following detection device connected to a network-side access device.

[0058] Figure 1 A schematic flow chart of a flow detection method in an embodiment of the present application is shown.

[0059] Reference Figure 1 In one embodiment, the flow detection method includes the following steps:

[0060] S11. Obtain a first timestamp and a second timestamp corresponding to a first message pair from the mirrored traffic of a network-side access device, and calculate a user-side round-trip delay based on the first timestamp and the second timestamp, wherein the first message pair is composed of a first request message and a first response message with the same message group ID, the first request message and the first response message are respectively a request message from a network-side device and a response message from a user-side device in an Internet application protocol, the first timestamp is a timestamp when the first request message arrives at the user-side access device, and the second timestamp is a timestamp when the first response message arrives at the user-side access device.

[0061] Specifically, the network side device and the user side device include at least a network side access device and a user side access device. The network side access device is the first network device downstream of the network side device, and the user side access device is the first network device upstream of the user device. The flow detection device is connected to the network side access device, and can obtain mirrored traffic from the network side access device, and can also send management information to the network side access device through the control channel.

[0062] Figure 2 An interactive schematic diagram of user-side round-trip delay detection in an embodiment of the present application is shown.

[0063] Reference Figure 2 , the network side access device receives the first request message from the network side device, forwards the first request message to the downstream network device, and directly forwards it to the user side access device if there is no other network device in the middle. The user side access device receives the first request message and forwards it to the user side device. After a period of time, the user side access device receives the first response message with the same message group ID, and forwards the first response message to the upstream network device. If there is no other network device in the middle, it is directly forwarded to the network side access device. The network side access device receives the first response message and forwards it to the network side device. It can be seen that in the first message pair, the difference between the timestamps of the first response message and the first request message arriving at the user side access device can feedback the round-trip delay on the user side.

[0064] Optionally, the flow detection device may periodically calculate and output an average value of user-side round-trip delays corresponding to multiple first message pairs.

[0065] It should be noted that in the round-trip delay detection on the user side, the user side access device needs to identify the first request message and the first response message, and pass the first timestamp and the second timestamp along with the message to the network side access device. The network side access device needs to add the message carrying the first timestamp and the second timestamp to the mirrored traffic. For these operations, the relevant technology provides a variety of feasible implementation methods, which are not limited in this embodiment.

[0066] S12. Obtain a third timestamp and a fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculate the network side round-trip delay according to the third timestamp and the fourth timestamp, wherein the second message pair is composed of a second request message and a second response message with the same message group ID, the second request message and the second response message are respectively a request message from the user side device and a response message from the network side device in an Internet application protocol, the third timestamp is a timestamp when the second request message arrives at the network side access device, and the fourth timestamp is a timestamp when the second response message arrives at the network side access device.

[0067] Figure 3 A schematic diagram of the interaction of round-trip delay detection on the network side in an embodiment of the present application is shown.

[0068] Reference Figure 3 , the user-side access device receives the second request message from the user-side device, forwards the second request message to the upstream network device, and directly forwards it to the network-side access device if there is no other network device in the middle. The network-side access device receives the second request message and forwards it to the network-side device. After a period of time, the network-side access device receives the second response message with the same message group ID, and forwards the second response message to the downstream network device. If there is no other network device in the middle, it is directly forwarded to the user-side access device. The user-side access device receives the second response message and forwards it to the user-side device. It can be seen that in the second message pair, the difference between the timestamps of the second response message and the second request message arriving at the network-side access device can feedback the round-trip delay on the network side.

[0069] Optionally, the flow detection device may periodically calculate and output an average value of user-side round-trip delays corresponding to multiple second message pairs.

[0070] It should be noted that in the round-trip delay detection on the network side, the network side access device needs to identify the second request message and the second response message, and add the message carrying the third timestamp and the fourth timestamp to the mirror traffic. For these operations, the relevant technology provides a variety of feasible implementation methods, which are not limited in this embodiment.

[0071] Therefore, in this embodiment, the network performance is measured with the help of the request-response message pair in the Internet application protocol, and the round-trip delay on the user side is calculated based on the timestamp when the request message from the network side device and the response message from the user side device arrive at the user side access device, and the round-trip delay on the network side is calculated based on the timestamp when the request message from the user side device and the response message from the network side device arrive at the network side access device. Through this embodiment, the service quality on the user side and the network side can be perceived, and the measured network performance indicators can truly feedback the actual user's network experience, accurately demarcate the quality difference between the user side and the network side, thereby improving the network operation and maintenance efficiency and reducing investment costs.

[0072] Optionally, the hardware types of the network-side access device and the user-side access device, as well as whether other network devices are set between the two and the hardware types of other network devices, need to be determined in combination with the application scenario, and this application does not limit this.

[0073] Figure 4 A schematic diagram of an application scenario of a flow detection method in an embodiment of the present application is shown.

[0074] Reference Figure 4In some PON (Passive Optical Network) broadband access network application scenarios, the network-side access device is the OLT (Optical Line Terminal) device, the user-side access device is the ONU (Optical Network Unit) device, and the flow detection device is the computing power board built into the OLT device.

[0075] Figure 5 A schematic diagram of an application scenario of a flow detection method in another embodiment of the present application is shown.

[0076] Reference Figure 5 In some application scenarios of PON broadband access networks, the network-side access device is an OLT device, the user-side access device is an FTTR (Fiber to the Room) sub-gateway, an ONU device (i.e., FTTR main gateway) is set between the network-side access device and the user-side access device, and the flow detection device is a computing power board built into the OLT device.

[0077] Furthermore, in one embodiment, before the step of acquiring the first timestamp and the second timestamp corresponding to the first message pair from the mirrored traffic of the network side access device, the method further includes:

[0078] Detecting the mirrored traffic of the network side access device according to at least one pair of first detection rules and second detection rules, if the number of first message pairs hit by any pair of first detection rules and second detection rules in the mirrored traffic within a first preset time period is greater than or equal to a first threshold, sending the pair of first detection rules and second detection rules to the network side access device through a control channel, so that a network device between the network side device and the user side device configures the first detection rule, and the user side access device configures the second detection rule;

[0079] The first detection rule is used to identify the first request message according to the relevant information in the original message, and the second detection rule is used to identify the first response message according to the relevant information in the original message;

[0080] The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message;

[0081] When the first detection rule is configured on a network device upstream of the user-side access device, the network device adds a tag to the identified first request message so that the user-side access device can identify the first request message.

[0082] Specifically, the relevant information in the original message includes source IP, source port, destination IP, destination port, protocol type, message length, key fingerprint, etc. The source IP and source port indicate that the message is a downlink message for the network side device, and the destination IP and destination port indicate that the message is an uplink message for the network side device. In some types of Internet application protocols, request messages and response messages can be distinguished from each other and from other messages by message length, and they can be distinguished without the help of key fingerprints. The key fingerprint refers to the byte content that appears at a fixed position in the message, such as the 60th byte content is 0X6E. In this way, when the protocol type meets the requirements and the message is a downlink request message, the message is determined to be the first request message, and when the protocol type meets the requirements and the message is an uplink response message, the message is determined to be the first response message.

[0083] It can be understood that the first request message received by the user-side access device needs to be forwarded by the upstream network device, and can be identified based on the relevant information in the original message or the newly added tag. If it is not necessary to detect the timestamp of the first request message arriving at other network devices, the first detection rule can be configured on any network device between the network-side device and the user-side device. If it is also necessary to detect the timestamp of the first request message arriving at other network devices, the first detection rule needs to be configured on the most upstream network device. The first response message received by the user-side access device comes directly from the user-side device and is an original message. It can only be identified based on the relevant information in the original message. Therefore, the second detection rule needs to be configured on the user-side access device.

[0084] In an example, when the first detection rule is configured on the network side access device, after the network side access device receives the first detection rule and the second detection rule from the control channel, it configures the first detection rule, adds the second detection rule to the downlink message and forwards it to the downstream network device, and the user side access device obtains the second detection rule from the downlink message and configures the second detection rule.

[0085] In this embodiment, the first detection rule and the second detection rule are sent by the flow detection device to the corresponding network device for configuration. There is no need to preset rules in the corresponding network device, which helps to improve network operation and maintenance efficiency. In addition, when the network environment does not change significantly, the sent first detection rule and the second detection rule can ensure that the number of hit first message pairs is sufficient, thereby improving the reliability of user-side service quality detection.

[0086] Furthermore, in one embodiment, before the step of acquiring the third timestamp and the fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, the step further includes:

[0087] Detecting the mirrored traffic of the network side access device according to at least one pair of the third detection rule and the fourth detection rule, if the number of second message pairs hit by any pair of the third detection rule and the fourth detection rule in the mirrored traffic within the second preset time period is greater than or equal to the second threshold, sending the pair of the third detection rule and the fourth detection rule to the network side access device through the control channel, so that a network device between the network side device and the user side device configures the third detection rule, and the network side access device configures the fourth detection rule;

[0088] The third detection rule is used to identify the second request message according to the relevant information in the original message, and the fourth detection rule is used to identify the second response message according to the relevant information in the original message;

[0089] The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message;

[0090] When the third detection rule is configured on a network device downstream of the network-side access device, the network device adds a tag to the identified second request message so that the network-side access device can identify the second request message.

[0091] Specifically, when the protocol type meets the requirements and the message is an uplink request message, the message is determined to be a second request message; when the protocol type meets the requirements and the message is a downlink response message, the message is determined to be a second response message.

[0092] It can be understood that the second request message received by the network side access device needs to be forwarded by the downstream network device, and can be identified based on the relevant information in the original message or based on the newly added tag. If it is not necessary to detect the timestamp of the second request message arriving at other network devices, the third detection rule can be configured on any network device between the network side device and the user side device. If it is also necessary to detect the timestamp of the second request message arriving at other network devices, the third detection rule needs to be configured on the most downstream network device. The second response message received by the network side access device comes directly from the network side device and is an original message. It can only be identified based on the relevant information in the original message. Therefore, the fourth detection rule needs to be configured on the network side access device.

[0093] In an example, when the third detection rule is configured on the user-side access device, after the network-side access device receives the third detection rule and the fourth detection rule from the control channel, it configures the fourth detection rule, adds the third detection rule to the downlink message and forwards it to the downstream network device, and the user-side access device obtains the third detection rule from the downlink message and configures the third detection rule.

[0094] In this embodiment, the third detection rule and the fourth detection rule are sent by the flow detection device to the corresponding network device for configuration. There is no need to preset rules in the corresponding network device, which helps to improve network operation and maintenance efficiency. In addition, the sent third detection rule and the fourth detection rule can ensure that the number of hit second message pairs is sufficient when the network environment does not change significantly, thereby improving the reliability of network-side service quality detection.

[0095] Furthermore, in one embodiment, an aging time is set for the detection rule, so that the corresponding network device deletes the corresponding detection rule after the configuration time of the detection rule reaches the aging time.

[0096] This embodiment can prevent excessive detection rules from affecting the message forwarding performance.

[0097] Furthermore, in one embodiment, the step of obtaining a first timestamp and a second timestamp corresponding to the first message pair from the mirrored traffic of the network-side access device, and calculating the user-side round-trip delay according to the first timestamp and the second timestamp includes:

[0098] A first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to the first message pair are obtained from the mirrored traffic of the network side access device, and a user side round-trip delay is calculated according to the first timestamp and the second timestamp. A round-trip delay between devices is calculated according to the first timestamp, the second timestamp, the fifth timestamp, and the sixth timestamp, wherein the fifth timestamp is a timestamp when the first request message arrives at the network side access device, and the sixth timestamp is a timestamp when the first response message arrives at the network side access device.

[0099] Figure 6 A schematic diagram showing the relationship between the timestamp corresponding to the first message pair and the network device in an embodiment of the present application is shown.

[0100] Reference Figure 2 and Figure 6 , the first timestamp, second timestamp, fifth timestamp and sixth timestamp corresponding to a first message pair are expressed as t1, t2, t5, t6, the corresponding user-side round-trip delay is equal to t2-t1, and the corresponding device-to-device round-trip delay is equal to (t6-t5)-(t2-t1).

[0101] Optionally, the flow detection device may periodically calculate and output an average value of the user-side round-trip delays corresponding to a plurality of first message pairs and an average value of the inter-device round-trip delays.

[0102] It should be noted that in the detection of the round-trip delay on the user side and the round-trip delay between devices, the user-side access device needs to identify the first request message and the first response message, and pass the first timestamp and the second timestamp along with the message to the network-side access device. The network-side access device needs to identify the first request message and the first response message, and add the message carrying the first timestamp, the second timestamp, the fifth timestamp and the sixth timestamp to the mirrored traffic. For these operations, the relevant technology provides a variety of feasible implementation methods, which are not limited in this embodiment.

[0103] Through this embodiment, on the basis of sensing the service quality of the user side and the network side, the communication quality between network devices can also be monitored, thereby improving the comprehensiveness of detection.

[0104] Further, in one embodiment, the step of obtaining a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to the first message pair from the mirrored traffic of the network side access device includes:

[0105] Obtain a first detection header of a first response message from the mirrored traffic of a network-side access device, and for each first detection header, determine a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp in the first detection header as a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to a first message pair;

[0106] The network-side access device identifies the first request message according to the relevant information in the original message, adds a first detection header to the first request message, and adds a message group ID and a fifth timestamp of the first request message to the first detection header;

[0107] The user-side access device identifies the first request message according to the first detection header, adds a first timestamp to the first detection header, and caches the first detection header;

[0108] The user-side access device identifies the first response message according to the relevant information in the original message, adds a first detection header with the same message group ID to the first response message, and adds a second timestamp to the first detection header;

[0109] The network-side access device identifies the first response message according to the first detection header, adds a sixth timestamp to the first detection header, and adds the first response message to the mirrored traffic.

[0110] Through this embodiment, the flow detection device can obtain the first timestamp, the second timestamp, the fifth timestamp and the sixth timestamp corresponding to the first message pair in which the first response message is located from a first response message, thereby improving network operation and maintenance efficiency.

[0111] Optionally, if the user-side device cannot identify the in-flow detection header, the user-side access device needs to strip off the first detection header before forwarding the first request message to the user-side device, and forward the original message to the user-side device. If the network-side device cannot identify the in-flow detection header, the network-side access device needs to strip off the first detection header before forwarding the first response message to the network-side device, and forward the original message to the network-side device. Otherwise, it can be chosen not to strip off the header and forward it directly.

[0112] Furthermore, in one embodiment, after the step of obtaining the first detection header of the first response message from the mirrored traffic of the network side access device, the step further includes:

[0113] Determine the packet loss rate of the user-side response message according to the first packet loss mark in the first detection header;

[0114] When the user-side access device adds the first detection header in the first response message, it detects whether the first target ID exists, and if the first target ID exists, adds the first packet loss marker to the first detection header;

[0115] The first target ID is the message group ID before the message group ID of the first response message. The user-side access device has identified the first request message with the message group ID as the first target ID, but has not identified the first response message with the message group ID as the first target ID.

[0116] For example, assuming that the user-side access device has identified the first request message with message group IDs A1 and A2, when the user-side access device adds a first detection header to the first response message with message group ID A2, it is found that the first response message with message group ID A1 has not been identified, then it is considered that the first response message with message group ID A1 has been lost in the user-side device, and a first packet loss mark is added to the first detection header of the first response message with message group ID A2.

[0117] Through this embodiment, during the user-side service quality detection, the user-side response message packet loss rate can also be monitored, thereby improving the comprehensiveness of the detection.

[0118] Further, in one embodiment, the step of obtaining a third timestamp and a fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculating the network side round-trip delay according to the third timestamp and the fourth timestamp includes:

[0119] A third timestamp, a fourth timestamp, a seventh timestamp, and an eighth timestamp corresponding to the second message pair are obtained from the mirrored traffic of the network side access device, and a network side round-trip delay is calculated according to the third timestamp and the fourth timestamp. A round-trip delay between devices is calculated according to the third timestamp, the fourth timestamp, the seventh timestamp, and the eighth timestamp, wherein the seventh timestamp is a timestamp when the second request message arrives at the user side access device, and the eighth timestamp is a timestamp when the second response message arrives at the user side access device.

[0120] Figure 7 A schematic diagram showing the relationship between the timestamp corresponding to the second message pair and the network device in an embodiment of the present application is shown.

[0121] Reference Figure 3 and Figure 7 , the third timestamp, fourth timestamp, seventh timestamp and eighth timestamp corresponding to a second message pair are expressed as t3, t4, t7, t8, the corresponding network side round-trip delay is equal to t4-t3, and the corresponding device-to-device round-trip delay is equal to (t8-t7)-(t4-t3).

[0122] Optionally, the flow detection device may periodically calculate and output an average value of the user-side round-trip delays corresponding to a plurality of second message pairs and an average value of the inter-device round-trip delays.

[0123] It should be noted that in the detection of the round-trip delay on the network side and the round-trip delay between devices, the user-side access device needs to identify the second request message and the second response message, and pass the seventh timestamp and the eighth timestamp along with the message to the network-side access device. The network-side access device needs to identify the second request message and the second response message, and add the message carrying the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp to the mirrored traffic. For these operations, the relevant technology provides a variety of feasible implementation methods, which are not limited in this embodiment.

[0124] Through this embodiment, on the basis of sensing the service quality of the user side and the network side, the communication quality between network devices can also be monitored, thereby improving the comprehensiveness of detection.

[0125] Further, in one embodiment, the step of obtaining the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device includes:

[0126] Obtain a second detection header of the second request message from the mirrored traffic of the network-side access device, and for two second detection headers with consecutive message group IDs, determine the third timestamp and the seventh timestamp in the previous second detection header and the fourth timestamp and the eighth timestamp in the next second detection header as the third timestamp, the fourth timestamp, the seventh timestamp, and the eighth timestamp corresponding to a second message pair;

[0127] The network-side access device identifies the second response message according to the relevant information in the original message, adds a second detection header to the second response message, and adds a message group ID and a fourth timestamp of the second response message to the second detection header;

[0128] The user-side access device identifies the second response message according to the second detection header, adds an eighth timestamp to the second detection header, and caches the second detection header;

[0129] The user-side access device identifies the second request message according to the relevant information in the original message, adds a second detection header with a continuous message group ID to the second request message, and adds a seventh timestamp to the second detection header;

[0130] The network-side access device identifies the second request message according to the second detection header, adds a third timestamp to the second detection header, and adds the second request message to the mirrored traffic.

[0131] Through this embodiment, the flow detection device can obtain the third timestamp and the seventh timestamp corresponding to the second message pair in which it is located, as well as the fourth timestamp and the eighth timestamp of the previous second message pair from a second request message, and then extract the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp corresponding to a second message pair from two second detection headers with consecutive message group IDs, thereby improving network operation and maintenance efficiency.

[0132] Optionally, if the network side device cannot identify the in-flow detection header, the network side access device needs to strip off the second detection header before forwarding the second request message to the network side device, and forward the original message to the network side device. If the user side device cannot identify the in-flow detection header, the user side access device needs to strip off the second detection header before forwarding the second response message to the user side device, and forward the original message to the user side device. Otherwise, it can be chosen not to strip it and forward it directly.

[0133] Furthermore, in one embodiment, after the step of obtaining the second detection header of the second request message from the mirrored traffic of the network side access device, the step further includes:

[0134] Determine the packet loss rate of the network side response message according to the second packet loss mark in the second detection header;

[0135] When the network-side access device adds the second detection header in the second response message, it detects whether the second target ID exists, and if the second target ID exists, adds the second packet loss marker to the second detection header;

[0136] The second target ID is the message group ID before the message group ID of the second response message. The network side access device has identified the second request message with the message group ID as the second target ID, but has not identified the second response message with the message group ID as the second target ID.

[0137] For example, assuming that the network side access device has identified the second request message with message group IDs B1 and B2, when the network side access device adds a second detection header in the second response message with message group ID B2, it is found that the second response message with message group ID B1 has not been identified, then it is considered that the second response message with message group ID B1 has been lost in the network side device, and a second packet loss mark is added to the second detection header of the second response message with message group ID B2.

[0138] Through this embodiment, during the network side service quality detection, the network side response message packet loss rate can also be monitored, thereby improving the comprehensiveness of the detection.

[0139] It should be noted that the similarities between the two schemes corresponding to the first detection head and the second detection head mentioned above are that both use the detection header of an uplink message to transmit four timestamps from the user-side access device to the flow detection device, with high transmission efficiency and only requiring caching operations on the user-side access device, with few new operations.

[0140] The difference is that the uplink message in the first message pair is the first response message, and the uplink message in the second message pair is the second request message, and the user-side device can only receive the request message first and then receive the response message with the same message group ID. Therefore, in the process of forming the first detection header, the user-side access device can add the first timestamp and the fifth timestamp of the previously cached first request message to the first response message with the same message group ID, that is, to the first response message of the same first message group, while in the process of forming the second detection header, the user-side access device can only add the fourth timestamp and the eighth timestamp of the previously cached second response message to the second request message with a continuous message group ID, that is, to the second request message of the next second message group.

[0141] In a second aspect, an embodiment of the present application also provides a flow detection device.

[0142] In one embodiment, the flow detection device includes a first detection module and a second detection module, and the first detection module and the second detection module are both arranged in a flow detection device connected to a network-side access device;

[0143] The first detection module is used to obtain a first timestamp and a second timestamp corresponding to a first message pair from the mirrored traffic of the network-side access device, and calculate the user-side round-trip delay according to the first timestamp and the second timestamp, wherein the first message pair is composed of a first request message and a first response message with the same message group ID, the first request message and the first response message are respectively a request message from the network-side device and a response message from the user-side device in an Internet application protocol, the first timestamp is a timestamp when the first request message arrives at the user-side access device, and the second timestamp is a timestamp when the first response message arrives at the user-side access device;

[0144] The second detection module is used to obtain a third timestamp and a fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculate the network side round-trip delay according to the third timestamp and the fourth timestamp, wherein the second message pair is composed of a second request message and a second response message with the same message group ID, the second request message and the second response message are respectively a request message from the user side device and a response message from the network side device in an Internet application protocol, the third timestamp is the timestamp when the second request message arrives at the network side access device, and the fourth timestamp is the timestamp when the second response message arrives at the network side access device.

[0145] Further, in one embodiment, the flow detection device further includes a first sending module, and the first sending module is arranged in the flow detection device;

[0146] The first sending module is used to detect the mirror traffic of the network side access device according to at least one pair of first detection rules and second detection rules. If the number of first message pairs hit by any pair of first detection rules and second detection rules in the mirror traffic within the first preset time period is greater than or equal to the first threshold, the pair of first detection rules and second detection rules are sent to the network side access device through the control channel, so that a network device between the network side device and the user side device configures the first detection rule, and the user side access device configures the second detection rule;

[0147] The first detection rule is used to identify the first request message according to the relevant information in the original message, and the second detection rule is used to identify the first response message according to the relevant information in the original message;

[0148] The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message;

[0149] When the first detection rule is configured on a network device upstream of the user-side access device, the network device adds a tag to the identified first request message so that the user-side access device can identify the first request message.

[0150] Further, in one embodiment, the flow detection device further includes a second sending module, and the second sending module is arranged in the flow detection device;

[0151] The second sending module is used to detect the mirror traffic of the network side access device according to at least one pair of the third detection rule and the fourth detection rule. If the number of second message pairs hit by any pair of the third detection rule and the fourth detection rule in the mirror traffic within the second preset time period is greater than or equal to the second threshold, the pair of the third detection rule and the fourth detection rule are sent to the network side access device through the control channel, so that a network device between the network side device and the user side device configures the third detection rule, and the network side access device configures the fourth detection rule;

[0152] The third detection rule is used to identify the second request message according to the relevant information in the original message, and the fourth detection rule is used to identify the second response message according to the relevant information in the original message;

[0153] The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message;

[0154] When the third detection rule is configured on a network device downstream of the network-side access device, the network device adds a tag to the identified second request message so that the network-side access device can identify the second request message.

[0155] Furthermore, in one embodiment, an aging time is set for the detection rule, so that the corresponding network device deletes the corresponding detection rule after the configuration time of the detection rule reaches the aging time.

[0156] Furthermore, in one embodiment, the first detection module is used to obtain a first timestamp, a second timestamp, a fifth timestamp and a sixth timestamp corresponding to the first message pair from the mirrored traffic of the network side access device, calculate the user side round-trip delay based on the first timestamp and the second timestamp, and calculate the round-trip delay between devices based on the first timestamp, the second timestamp, the fifth timestamp and the sixth timestamp, wherein the fifth timestamp is the timestamp when the first request message arrives at the network side access device, and the sixth timestamp is the timestamp when the first response message arrives at the network side access device.

[0157] Further, in one embodiment, the first detection module is used to obtain a first detection header of the first response message from the mirrored traffic of the network side access device, and for each first detection header, determine the first timestamp, the second timestamp, the fifth timestamp and the sixth timestamp in the first detection header as the first timestamp, the second timestamp, the fifth timestamp and the sixth timestamp corresponding to a first message pair;

[0158] The network-side access device identifies the first request message according to the relevant information in the original message, adds a first detection header to the first request message, and adds a message group ID and a fifth timestamp of the first request message to the first detection header;

[0159] The user-side access device identifies the first request message according to the first detection header, adds a first timestamp to the first detection header, and caches the first detection header;

[0160] The user-side access device identifies the first response message according to the relevant information in the original message, adds a first detection header with the same message group ID to the first response message, and adds a second timestamp to the first detection header;

[0161] The network-side access device identifies the first response message according to the first detection header, adds a sixth timestamp to the first detection header, and adds the first response message to the mirrored traffic.

[0162] Further, in one embodiment, the flow detection device further includes a third detection module, and the third detection module is arranged in the flow detection device;

[0163] The third detection module is used to determine the packet loss rate of the user-side response message according to the first packet loss mark in the first detection header;

[0164] When the user-side access device adds the first detection header in the first response message, it detects whether the first target ID exists, and if the first target ID exists, adds the first packet loss marker to the first detection header;

[0165] The first target ID is the message group ID before the message group ID of the first response message. The user-side access device has identified the first request message with the message group ID as the first target ID, but has not identified the first response message with the message group ID as the first target ID.

[0166] Furthermore, in one embodiment, the second detection module is used to obtain a third timestamp, a fourth timestamp, a seventh timestamp and an eighth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, calculate the network side round-trip delay based on the third timestamp and the fourth timestamp, and calculate the round-trip delay between devices based on the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp, wherein the seventh timestamp is the timestamp when the second request message arrives at the user side access device, and the eighth timestamp is the timestamp when the second response message arrives at the user side access device.

[0167] Further, in one embodiment, the second detection module is used to obtain a second detection header of the second request message from the mirrored traffic of the network side access device, and for two second detection headers with consecutive message group IDs, determine the third timestamp and the seventh timestamp in the previous second detection header and the fourth timestamp and the eighth timestamp in the next second detection header as the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp corresponding to a second message pair;

[0168] The network-side access device identifies the second response message according to the relevant information in the original message, adds a second detection header to the second response message, and adds a message group ID and a fourth timestamp of the second response message to the second detection header;

[0169] The user-side access device identifies the second response message according to the second detection header, adds an eighth timestamp to the second detection header, and caches the second detection header;

[0170] The user-side access device identifies the second request message according to the relevant information in the original message, adds a second detection header with a continuous message group ID to the second request message, and adds a seventh timestamp to the second detection header;

[0171] The network-side access device identifies the second request message according to the second detection header, adds a third timestamp to the second detection header, and adds the second request message to the mirrored traffic.

[0172] Furthermore, in one embodiment, the flow detection device further includes a fourth detection module, and the fourth detection module is disposed in the flow detection device;

[0173] The fourth detection module is used to determine the packet loss rate of the network side response message according to the second packet loss mark in the second detection header;

[0174] When the network-side access device adds the second detection header in the second response message, it detects whether the second target ID exists, and if the second target ID exists, adds the second packet loss marker to the second detection header;

[0175] The second target ID is the message group ID before the message group ID of the second response message. The network side access device has identified the second request message with the message group ID as the second target ID, but has not identified the second response message with the message group ID as the second target ID.

[0176] Among them, the functional implementation of each module in the above-mentioned flow detection device corresponds to the various steps in the above-mentioned flow detection method embodiment, and its functions and implementation processes are no longer repeated here one by one.

[0177] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0178] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0179] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0180] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0181] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0182] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, Flash) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0183] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A flow detection method, characterized in that: Applicable to a flow detection device connected to a network side access device, the flow detection method includes: Obtaining a first timestamp and a second timestamp corresponding to a first message pair from the mirrored traffic of a network-side access device, and calculating a user-side round-trip delay according to the first timestamp and the second timestamp, wherein the first message pair is composed of a first request message and a first response message with the same message group ID, the first request message and the first response message are respectively a request message from a network-side device and a response message from a user-side device in an Internet application protocol, the first timestamp is a timestamp when the first request message arrives at the user-side access device, and the second timestamp is a timestamp when the first response message arrives at the user-side access device; A third timestamp and a fourth timestamp corresponding to the second message pair are obtained from the mirrored traffic of the network side access device, and a network side round-trip delay is calculated according to the third timestamp and the fourth timestamp, wherein the second message pair is composed of a second request message and a second response message with the same message group ID, the second request message and the second response message are respectively a request message from the user side device and a response message from the network side device in an Internet application protocol, the third timestamp is a timestamp when the second request message arrives at the network side access device, and the fourth timestamp is a timestamp when the second response message arrives at the network side access device.

2. The flow detection method according to claim 1, characterized in that: Before the step of acquiring the first timestamp and the second timestamp corresponding to the first message pair from the mirrored traffic of the network side access device, the method further includes: Detecting the mirrored traffic of the network side access device according to at least one pair of first detection rules and second detection rules, if the number of first message pairs hit by any pair of first detection rules and second detection rules in the mirrored traffic within a first preset time period is greater than or equal to a first threshold, sending the pair of first detection rules and second detection rules to the network side access device through a control channel, so that a network device between the network side device and the user side device configures the first detection rule, and the user side access device configures the second detection rule; The first detection rule is used to identify the first request message according to the relevant information in the original message, and the second detection rule is used to identify the first response message according to the relevant information in the original message; The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message; When the first detection rule is configured on a network device upstream of the user-side access device, the network device adds a tag to the identified first request message so that the user-side access device can identify the first request message.

3. The flow detection method according to claim 1, characterized in that: Before the step of acquiring the third timestamp and the fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, the method further includes: Detecting the mirrored traffic of the network side access device according to at least one pair of the third detection rule and the fourth detection rule, if the number of second message pairs hit by any pair of the third detection rule and the fourth detection rule in the mirrored traffic within the second preset time period is greater than or equal to the second threshold, sending the pair of the third detection rule and the fourth detection rule to the network side access device through the control channel, so that a network device between the network side device and the user side device configures the third detection rule, and the network side access device configures the fourth detection rule; The third detection rule is used to identify the second request message according to the relevant information in the original message, and the fourth detection rule is used to identify the second response message according to the relevant information in the original message; The network-side access device adds the detection rules that the downstream network device needs to configure to the downlink message; When the third detection rule is configured on a network device downstream of the network-side access device, the network device adds a tag to the identified second request message so that the network-side access device can identify the second request message.

4. The flow detection method according to claim 2 or 3, characterized in that: The detection rule is provided with an aging time, so that the corresponding network device can delete the corresponding detection rule after the configuration time of the detection rule reaches the aging time.

5. The flow detection method according to claim 1, characterized in that: The step of obtaining a first timestamp and a second timestamp corresponding to the first message pair from the mirrored traffic of the network-side access device, and calculating the user-side round-trip delay according to the first timestamp and the second timestamp comprises: A first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to the first message pair are obtained from the mirrored traffic of the network side access device, and a user side round-trip delay is calculated according to the first timestamp and the second timestamp. A round-trip delay between devices is calculated according to the first timestamp, the second timestamp, the fifth timestamp, and the sixth timestamp, wherein the fifth timestamp is a timestamp when the first request message arrives at the network side access device, and the sixth timestamp is a timestamp when the first response message arrives at the network side access device.

6. The flow detection method according to claim 5, characterized in that: The step of obtaining a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to the first message pair from the mirrored traffic of the network side access device comprises: Obtain a first detection header of a first response message from the mirrored traffic of a network-side access device, and for each first detection header, determine a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp in the first detection header as a first timestamp, a second timestamp, a fifth timestamp, and a sixth timestamp corresponding to a first message pair; The network-side access device identifies the first request message according to the relevant information in the original message, adds a first detection header to the first request message, and adds a message group ID and a fifth timestamp of the first request message to the first detection header; The user-side access device identifies the first request message according to the first detection header, adds a first timestamp to the first detection header, and caches the first detection header; The user-side access device identifies the first response message according to the relevant information in the original message, adds a first detection header with the same message group ID to the first response message, and adds a second timestamp to the first detection header; The network-side access device identifies the first response message according to the first detection header, adds a sixth timestamp to the first detection header, and adds the first response message to the mirrored traffic.

7. The flow detection method according to claim 6, characterized in that: After the step of obtaining the first detection header of the first response message from the mirrored traffic of the network side access device, the method further includes: Determine the packet loss rate of the user-side response message according to the first packet loss mark in the first detection header; When the user-side access device adds the first detection header in the first response message, it detects whether the first target ID exists, and if the first target ID exists, adds the first packet loss marker to the first detection header; The first target ID is the message group ID before the message group ID of the first response message. The user-side access device has identified the first request message with the message group ID as the first target ID, but has not identified the first response message with the message group ID as the first target ID.

8. The flow detection method according to claim 1, characterized in that: The step of obtaining the third timestamp and the fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculating the network side round trip delay according to the third timestamp and the fourth timestamp comprises: A third timestamp, a fourth timestamp, a seventh timestamp, and an eighth timestamp corresponding to the second message pair are obtained from the mirrored traffic of the network side access device, and a network side round-trip delay is calculated according to the third timestamp and the fourth timestamp. A round-trip delay between devices is calculated according to the third timestamp, the fourth timestamp, the seventh timestamp, and the eighth timestamp, wherein the seventh timestamp is a timestamp when the second request message arrives at the user side access device, and the eighth timestamp is a timestamp when the second response message arrives at the user side access device.

9. The flow detection method according to claim 8, characterized in that: The step of obtaining the third timestamp, the fourth timestamp, the seventh timestamp and the eighth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device comprises: Obtain a second detection header of the second request message from the mirrored traffic of the network-side access device, and for two second detection headers with consecutive message group IDs, determine the third timestamp and the seventh timestamp in the previous second detection header and the fourth timestamp and the eighth timestamp in the next second detection header as the third timestamp, the fourth timestamp, the seventh timestamp, and the eighth timestamp corresponding to a second message pair; The network-side access device identifies the second response message according to the relevant information in the original message, adds a second detection header to the second response message, and adds a message group ID and a fourth timestamp of the second response message to the second detection header; The user-side access device identifies the second response message according to the second detection header, adds an eighth timestamp to the second detection header, and caches the second detection header; The user-side access device identifies the second request message according to the relevant information in the original message, adds a second detection header with a continuous message group ID to the second request message, and adds a seventh timestamp to the second detection header; The network-side access device identifies the second request message according to the second detection header, adds a third timestamp to the second detection header, and adds the second request message to the mirrored traffic.

10. The flow detection method according to claim 9, characterized in that: After the step of obtaining the second detection header of the second request message from the mirrored traffic of the network side access device, the method further includes: Determine the packet loss rate of the network side response message according to the second packet loss mark in the second detection header; When the network-side access device adds the second detection header in the second response message, it detects whether the second target ID exists, and if the second target ID exists, adds the second packet loss marker to the second detection header; The second target ID is the message group ID before the message group ID of the second response message. The network side access device has identified the second request message with the message group ID as the second target ID, but has not identified the second response message with the message group ID as the second target ID.

11. A flow detection device, characterized in that: The flow detection device includes a first detection module and a second detection module, and the first detection module and the second detection module are both arranged in a flow detection device connected to a network side access device; The first detection module is used to obtain a first timestamp and a second timestamp corresponding to a first message pair from the mirrored traffic of the network-side access device, and calculate the user-side round-trip delay according to the first timestamp and the second timestamp, wherein the first message pair is composed of a first request message and a first response message with the same message group ID, the first request message and the first response message are respectively a request message from the network-side device and a response message from the user-side device in an Internet application protocol, the first timestamp is a timestamp when the first request message arrives at the user-side access device, and the second timestamp is a timestamp when the first response message arrives at the user-side access device; The second detection module is used to obtain a third timestamp and a fourth timestamp corresponding to the second message pair from the mirrored traffic of the network side access device, and calculate the network side round-trip delay according to the third timestamp and the fourth timestamp, wherein the second message pair is composed of a second request message and a second response message with the same message group ID, the second request message and the second response message are respectively a request message from the user side device and a response message from the network side device in an Internet application protocol, the third timestamp is the timestamp when the second request message arrives at the network side access device, and the fourth timestamp is the timestamp when the second response message arrives at the network side access device.

Images