SIP (Session Initiation Protocol) signaling flow control method and system based on Netfilter

Abstract

The SIP signaling flow control method based on the Netfilter comprises the following steps: setting a flow control rule according to a user demand, and sending the flow control rule to a management module; the management module issues the flow control rule to a Netfilter in a Linux kernel; and the application layer receives the SIP signaling flow from the network camera and the user client, and the Netfilter controls the SIP signaling flow according to the flow control rule and the SIP signaling flow. According to the embodiment of the invention, flow control can be carried out on the SIP signaling received by the central signaling control server, and stable operation of system functions is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a Netfilter-based SIP signaling flow control method and system. Background Art

[0002] At present, with the large-scale construction and interconnection of urban video surveillance network systems, a large number of camera devices are connected to the video surveillance network system using the GB / T 28181 protocol. When a large number of network cameras generate front-end alarm events at the same time, they will send thousands of alarm messages based on the SIP signaling format to the connected video surveillance network system within seconds, causing unprecedented processing pressure on the central signaling control server and signaling security routing gateway of the video surveillance network system. A large number of alarm messages have caused similar "DDoS distributed denial of service attacks", resulting in the exhaustion of bandwidth and buffer resources of the central signaling control server, and the platform cannot process normal user service requests. Based on the above reasons, it is urgent to control the flow of SIP signaling received by the central signaling control server to ensure the smooth operation of system functions. Summary of the invention

[0003] In view of the above problems, the present invention is proposed to provide a Netfilter-based SIP signaling flow control method and system that overcomes the above problems or at least partially solves the above problems.

[0004] In order to solve the above technical problems, the embodiments of the present application disclose the following technical solutions:

[0005] In a first aspect, an embodiment of the present invention discloses a SIP signaling flow control method based on Netfilter, comprising:

[0006] S100. Set flow control rules according to user needs and send the flow control rules to the management module;

[0007] S200 management module sends the flow control rules to Netfilter in the Linux kernel;

[0008] S300. The application layer receives the SIP signaling traffic from the network camera and the user client, and Netfilter controls the SIP signaling traffic according to the flow control rules and the SIP signaling traffic.

[0009] Furthermore, in S100, the flow control rules are divided into three levels, namely, the first flow control rule, the second flow control rule and the third flow control rule; wherein each level of flow control rules comprises a set of threshold ranges consisting of an upper flow limit and a lower flow limit.

[0010] Furthermore, in S200, the specific method by which the management module sends the flow control rules to the Netfilter in the Linux kernel includes: the management module calls the iptables interface, communicates with the Netfilter in the Linux kernel space through the libiptc library, sends the flow control rules to the Netfilter in the Linux kernel, and determines whether the rules are sent successfully according to the status code returned by the iptables interface. If the status code is equal to 0, it is determined to be successful, and if the status code is not equal to 0, it is determined to be a failure.

[0011] Further, in S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic, and the specific method includes: when the SIP signaling traffic receiving rate exceeds the lower limit range of the traffic set by the first flow control rule, but does not exceed the upper limit range of the traffic set by the first flow control rule, Netfilter sends the signaling to the SIP processing module, and the SIP processing module processes it.

[0012] Further, in S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic, and the specific method also includes: when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the first flow control rule, but does not exceed the traffic upper limit range set by the second flow control rule, Netfilter sends the signaling to the SIP queue module, and processes it through the SIP queue module.

[0013] Further, in S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic, and the specific method also includes: when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the second flow control rule, but does not exceed the traffic upper limit range set by the third flow control rule, Netfilter sends the signaling to the SIP rejection module, and the SIP rejection module processes it.

[0014] Further, in S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic, and the specific method also includes: when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the third flow control rule, Netfilter does not forward the signaling exceeding the threshold range to the application layer, but directly replies to the sender with an icmpportunreachable message.

[0015] Furthermore, the SIP processing module performs processing, and the specific method includes: the SIP processing module receives the signaling, processes the signaling and replies a 200OK message to the sender, indicating that the request has been processed.

[0016] Further, the SIP queue module is used for processing, and the specific method includes: the SIP queue module receives the signaling and immediately replies with a 182Queued message to the sender of the signaling, indicating that the current SIP processing module is temporarily busy and the signaling has been added to the message queue for queuing; the SIP processing module continuously monitors the data in the queue module, and when the load is available, reads the SIP signaling from the queue module for processing, and after the processing is completed, sends a reply 200OK message to the sender of the SIP signaling, and synchronously notifies the queue module that the message has been processed, and the queue module removes the processed message from the queue.

[0017] In a second aspect, an embodiment of the present invention discloses a SIP signaling flow control system based on Netfilter, comprising: a flow control rule setting unit, a flow control rule issuing unit and a SIP signaling flow control unit; wherein:

[0018] A flow control rule setting unit, used to set flow control rules according to user needs and send the flow control rules to the management module;

[0019] A flow control rule issuing unit is used for the management module to issue the flow control rule to Netfilter in the Linux kernel;

[0020] The SIP signaling flow control unit is used for the SIP signaling flow received by the application layer from the network camera and the user client. Netfilter controls the SIP signaling flow according to the flow control rules and the SIP signaling flow.

[0021] The beneficial effects of the above technical solution provided by the embodiment of the present invention include at least:

[0022] 1. Compared with the traditional limit token bucket, the present invention adopts hashlimit hash bucket for rate matching, and has the ability to match the source IP, source port, destination IP, and destination port for packet rate matching, and has low overhead for maintaining the hash table and fast processing speed, and has no blocking or delay in the data exchange process between the upper application platform and the outside world;

[0023] 2. The present invention adopts the Netfilter module of the Linux kernel to perform flow control. The method and system provided by the present invention have strong portability. In theory, all devices driven by the Linux kernel can adopt the method and system to perform SIP signaling flow control;

[0024] 3. The present invention introduces a queue module, which has the ability to smooth traffic peaks and fill valleys, and provides an effective buffer for the SIP processing module when facing instantaneous large concurrent requests, thereby avoiding the processing module from being unable to process requests or even crashing, and ensuring business continuity.

[0025] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0027] Figure 1 This is a flow chart of a SIP signaling flow control method based on Netfilter in Embodiment 1 of the present invention;

[0028] Figure 2 The schematic diagram of the process of Netfilter processing SIP signaling according to the issued flow control rules in Embodiment 1 of the present invention;

[0029] Figure 3 This is a schematic diagram of the working process of the SIP processing module in Embodiment 1 of the present invention;

[0030] Figure 4 This is a schematic diagram of the working process of the SIP queue module in Embodiment 1 of the present invention;

[0031] Figure 5 This is a schematic diagram of the working process of the SIP rejection module in Embodiment 1 of the present invention;

[0032] Figure 6 This is a structural diagram of a SIP signaling flow control system based on Netfilter in Example 2 of the present invention. DETAILED DESCRIPTION

[0033] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0034] In order to solve the problems existing in the prior art, the embodiment of the present invention provides a SIP signaling flow control method and system based on Netfilter.

[0035] Example 1

[0036] The present invention discloses a SIP signaling flow control method based on Netfilter. Figure 1 ,include:

[0037] S100. Set flow control rules according to user needs, and send the flow control rules to the management module; wherein, flow control rules, i.e., flow control rules, are an important means to ensure high availability of applications. The principle is to monitor indicators such as QPS (query rate per second) or the number of concurrent threads of application traffic, and control the traffic when the specified threshold is reached to avoid the application being overwhelmed by the instantaneous traffic peak. In S100 of this embodiment, the flow control rules are divided into three levels, namely the first flow control rules, the second flow control rules, and the third flow control rules; wherein, each level of flow control rules consists of a set of threshold ranges consisting of an upper flow limit and a lower flow limit. For example, the threshold range in the first flow control rule is [AB], the threshold range in the second flow control rule is [BC], and the threshold range in the second flow control rule is [CD], where A<B<C<D, and the values ​​of A, B, C, and D are set according to user needs.

[0038] S200. The management module sends the flow control rules to Netfilter in the Linux kernel; wherein, as a part of the Linux kernel, Netfilter's main purpose is to provide a series of detection points (Hook points) in the process of data packets passing through the network protocol stack, allowing system administrators or users to register custom processing functions at these detection points, thereby implementing operations such as filtering, modifying, and forwarding data packets. The functions of Netfilter include at least:

[0039] Packet filtering: Netfilter allows you to define rules to decide whether to accept or reject network packets. By setting these rules, you can control which traffic is allowed in and out of the system, thereby protecting network security.

[0040] Network Address Translation (NAT): Netfilter supports NAT, which allows devices in a private network to share a public IP address to access the external network. This includes source address translation (SNAT) and destination address translation (DNAT).

[0041] Connection tracking: Netfilter can track the state of network connections, such as whether a connection is new, established, or related. This makes it possible to dynamically manage the connection state.

[0042] In S200 of this embodiment, the specific method for the management module to send the flow control rules to Netfilter in the Linux kernel includes: the management module calls the iptables interface, communicates with Netfilter in the Linux kernel space through the libiptc library, sends the flow control rules to Netfilter in the Linux kernel, and judges whether the rules are sent successfully according to the status code returned by the iptables interface. If the status code is equal to 0, it is judged to be successful, and if the status code is not equal to 0, it is judged to be failed. Specifically, the management module sends all flow control rules to the INPUT chain of filtertable, and finally registers them to the NF_IP_LOCAL_IN hook point of Netfilter; this embodiment uses the Netfilter module of the Linux kernel to perform flow control, and the method and system provided by the present invention have strong portability. In theory, all devices driven by the Linux kernel can use this method and system to perform SIP signaling flow control.

[0043] S300. The application layer receives the SIP signaling traffic from the network camera and the user client, and Netfilter controls the SIP signaling traffic according to the flow control rules and the SIP signaling traffic.

[0044] In S300 of this embodiment, if Figure 2 ,Netfilter controls the SIP signaling flow according to the flow control rule SIP signaling flow, and the specific method includes: when the SIP signaling flow receiving rate exceeds the flow lower limit range set by the first flow control rule, but does not exceed the flow upper limit range set by the first flow control rule, Netfilter sends the signaling to the SIP processing module for processing by the SIP processing module. Specifically, as shown in Figure ,3, when the signaling is forwarded to the SIP processing module, the signaling will be processed immediately and reply to the sender with a 200OK message, indicating that the request has been processed;

[0045] In some embodiments, when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the first flow control rule, but does not exceed the traffic upper limit range set by the second flow control rule, Netfilter sends the signaling to the SIP queue module for processing by the SIP queue module. Figure 4 When the signal is forwarded to the SIP queue module, the queue module immediately replies with a 182Queued message to the sender of the signal, indicating that the current SIP processing module is temporarily busy and the signal has been added to the message queue for queuing;

[0046] The SIP processing module continuously monitors the data in the queue module. When the load is available, it reads the SIP signaling from the queue module for processing. When the processing is completed, it sends a reply 200OK message to the sender of the SIP signaling and synchronously notifies the queue module that the message has been processed. The queue module removes the processed message from the queue.

[0047] This embodiment introduces a queue module with the ability to smooth traffic peaks and fill valleys, providing an effective buffer for the SIP processing module when facing instantaneous large concurrent requests, avoiding the processing module from being unable to process requests or even crashing, and ensuring business continuity.

[0048] In some embodiments, when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the second flow control rule, but does not exceed the traffic upper limit range set by the third flow control rule, Netfilter sends the signaling to the SIP rejection module for processing by the SIP rejection module. Figure 5 ,When the signaling is forwarded to the SIP rejection module, the rejection module immediately replies to the sender of the signaling with a 486 Busy Here message, indicating that all SIP processing modules are currently busy and can no longer process more requests;

[0049] In some embodiments, when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the third flow control rule, Netfilter does not forward the signaling exceeding the threshold range to the application layer, but directly replies to the sender with an icmpport unreachable message. Specifically, when the traffic receiving rate exceeds the threshold range set by the third preset rule, it is determined to be a SIP signaling storm. In order to protect the application layer from the impact of the signaling storm, Netfilter directly discards the signaling outside the threshold range at the kernel layer, and replies to the sender with an icmp port unreachable message, indicating that the SIP port is unreachable.

[0050] In order to better understand this embodiment, this embodiment describes in detail the functions of the management module, the SIP processing module, the SIP queue module, and the SIP rejection module in the above method, wherein:

[0051] The management module is used to formulate flow control rules and convert the flow control rules into iptables command lines, which are sent to Netfilter in the Linux kernel. It is also used to monitor the online status and business load of the processing module, and analyze the impact of different types of SIP signaling on the load of the processing module in real time, so as to provide decision support for formulating appropriate flow control rules. In the system disclosed in the present invention, when generating flow control rules, the management module uses the Hashlimit plug-in in iptables to match the SIP signaling rate, and uses the String plug-in to match the SIP signaling type.

[0052] The processing module is used to process the SIP signaling from the network camera and the user terminal, and to count the CPU time consumed in processing the SIP signaling, and to feed back the statistical information to the management module;

[0053] The queue module is used to store SIP signaling from the network camera and the user terminal, and when the processing module is available, the stored SIP signaling is passed to the processing module. In the system disclosed in the present invention, the queue module uses a priority queue as the underlying data structure, so that the system has the ability to give priority to key signaling;

[0054] The rejection module is used to receive SIP signaling that exceeds the threshold range of the flow control rule and reply to the signaling sender with a 486 Busy Here message to avoid SIP signaling storms in the system.

[0055] This embodiment discloses a SIP signaling flow control method based on Netfilter, including: setting flow control rules according to user needs, sending the flow control rules to the management module; the management module sends the flow control rules to the Netfilter in the Linux kernel; the application layer receives the SIP signaling flow from the network camera and the user client, and the Netfilter controls the SIP signaling flow according to the flow control rules and the SIP signaling flow. This embodiment can control the flow of the SIP signaling received by the central signaling control server to ensure the smooth operation of the system function.

[0056] Example 2

[0057] Based on the same inventive concept, the disclosed embodiment also provides a SIP signaling flow control system based on Netfilter, such as Figure 6 , including: a flow control rule setting unit, a flow control rule issuing unit and a SIP signaling flow control unit; wherein:

[0058] The flow control rule setting unit is used to set the flow control rules according to user needs and send the flow control rules to the management module; specifically, the flow control rules are divided into three levels, namely the first flow control rules, the second flow control rules and the third flow control rules; wherein each level of flow control rules consists of a set of threshold ranges consisting of an upper flow limit and a lower flow limit.

[0059] The flow control rule sending unit is used for the management module to send the flow control rules to the Netfilter in the Linux kernel; specifically, the specific method for the management module to send the flow control rules to the Netfilter in the Linux kernel includes: the management module calls the iptables interface, communicates with the Netfilter in the Linux kernel space through the libiptc library, sends the flow control rules to the Netfilter in the Linux kernel, and judges whether the rules are sent successfully according to the status code returned by the iptables interface. If the status code is equal to 0, it is judged to be successful, and if the status code is not equal to 0, it is judged to be failed.

[0060] The SIP signaling flow control unit is used for the SIP signaling flow received by the application layer from the network camera and the user client. Netfilter controls the SIP signaling flow according to the flow control rules and the SIP signaling flow.

[0061] Specifically, Netfilter controls the SIP signaling flow according to the flow control rule SIP signaling flow, and the specific method includes: when the SIP signaling flow receiving rate exceeds the flow lower limit range set by the first flow control rule, but does not exceed the flow upper limit range set by the first flow control rule, Netfilter sends the signaling to the SIP processing module, and the SIP processing module processes it. When the SIP signaling flow receiving rate exceeds the flow upper limit range set by the first flow control rule, but does not exceed the flow upper limit range set by the second flow control rule, Netfilter sends the signaling to the SIP queue module, and the SIP queue module processes it. When the SIP signaling flow receiving rate exceeds the flow upper limit range set by the second flow control rule, but does not exceed the flow upper limit range set by the third flow control rule, Netfilter sends the signaling to the SIP rejection module, and the SIP rejection module processes it. When the SIP signaling flow receiving rate exceeds the flow upper limit range set by the third flow control rule, Netfilter does not forward the signaling exceeding the threshold range to the application layer, but directly replies to the sender with an icmp port unreachable message.

[0062] In some preferred embodiments, the SIP processing module receives the signaling, processes the signaling and replies a 200OK message to the sender, indicating that the request has been processed. The SIP queue module receives the signaling and immediately replies a 182Queued message to the sender of the signaling, indicating that the current SIP processing module is temporarily busy and the signaling has been added to the message queue for queuing; the SIP processing module continuously monitors the data in the queue module, and when the load is available, reads the SIP signaling from the queue module for processing, and when the processing is completed, replies a 200OK message to the sender of the SIP signaling, and simultaneously notifies the queue module that the message has been processed, and the queue module removes the processed message from the queue. The SIP rejection module receives the signaling, and the SIP rejection module immediately replies a 486Busy Here message to the sender of the signaling, indicating that all current SIP processing modules are busy and can no longer process more requests.

[0063] Among them, other working methods of the flow control rule setting unit, the flow control rule issuing unit and the SIP signaling flow control unit have been described in detail in Example 1, and will not be repeated in this embodiment.

[0064] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process can be rearranged without departing from the scope of protection of the present disclosure. The attached method claims present the elements of the various steps in an exemplary order and are not intended to be limited to the specific order or hierarchy described.

[0065] In the above detailed description, various features are grouped together in a single embodiment to simplify the disclosure. This method of disclosure should not be interpreted as reflecting an intention that the embodiments of the claimed subject matter require more features than are clearly stated in each claim. On the contrary, as reflected in the appended claims, the invention is in a state of having less than all the features of the disclosed individual embodiments. Therefore, the appended claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

[0066] Those skilled in the art will also appreciate that the various illustrative logic blocks, modules, circuits, and algorithmic steps described in conjunction with the embodiments herein can all be implemented as electronic hardware, computer software, or a combination thereof. In order to clearly illustrate the interchangeability between hardware and software, various illustrative components, blocks, modules, circuits, and steps are generally described above around their functions. Whether such functions are implemented as hardware or software depends on specific applications and the design constraints imposed on the entire system. A skilled person can implement the described functions in an alternative manner for each specific application, but such implementation decisions should not be interpreted as departing from the scope of protection of the present disclosure.

[0067] The steps of the method or algorithm described in conjunction with the embodiments herein may be directly embodied as hardware, a software module executed by a processor, or a combination thereof. The software module may be located in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a mobile disk, a CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and the storage medium may be located in an ASIC. The ASIC may be located in a user terminal. Of course, the processor and the storage medium may also be present in a user terminal as discrete components.

[0068] For software implementation, the techniques described in this application can be implemented with modules (e.g., procedures, functions, etc.) that perform the functions described in this application. These software codes can be stored in a memory unit and executed by a processor. The memory unit can be implemented within the processor or outside the processor. In the latter case, it is coupled to the processor in a communication manner via various means, which are well known in the art.

[0069] The above description includes examples of one or more embodiments. Of course, it is impossible to describe all possible combinations of components or methods for the purpose of describing the above embodiments, but it should be recognized by those skilled in the art that the various embodiments may be further combined and arranged. Therefore, the embodiments described herein are intended to cover all such changes, modifications and variations that fall within the scope of protection of the appended claims. In addition, with respect to the term "comprising" used in the specification or claims, the word is covered in a manner similar to the term "including", just as "including," is explained as a transitional word in the claims. In addition, any term "or" used in the specification of the claims is intended to mean "non-exclusive or".

Claims

1. A SIP signaling flow control method based on Netfilter, characterized in that: include: S100. Set flow control rules according to user needs and send the flow control rules to the management module; S200 management module sends the flow control rules to Netfilter in the Linux kernel; S300. The application layer receives the SIP signaling traffic from the network camera and the user client, and Netfilter controls the SIP signaling traffic according to the flow control rules and the SIP signaling traffic.

2. A Netfilter-based SIP signaling flow control method as claimed in claim 1, characterized in that: In S100, the flow control rules are divided into three levels, namely the first flow control rule, the second flow control rule and the third flow control rule; wherein each level of flow control rules comprises a set of threshold ranges consisting of an upper flow limit and a lower flow limit.

3. A SIP signaling flow control method based on Netfilter as claimed in claim 1, characterized in that: In S200, the specific method for the management module to send the flow control rules to the Netfilter in the Linux kernel includes: the management module calls the iptables interface, communicates with the Netfilter in the Linux kernel space through the libiptc library, sends the flow control rules to the Netfilter in the Linux kernel, and determines whether the rules are sent successfully according to the status code returned by the iptables interface. If the status code is equal to 0, it is determined to be successful, and if the status code is not equal to 0, it is determined to be a failure.

4. A SIP signaling flow control method based on Netfilter as claimed in claim 2, characterized in that: In S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic, and the specific method includes: when the SIP signaling traffic receiving rate exceeds the lower limit range of the traffic set by the first flow control rule, but does not exceed the upper limit range of the traffic set by the first flow control rule, Netfilter sends the signaling to the SIP processing module, and the SIP processing module processes it.

5. A SIP signaling flow control method based on Netfilter as claimed in claim 2, characterized in that: In S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic. The specific method also includes: when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the first flow control rule but does not exceed the traffic upper limit range set by the second flow control rule, Netfilter sends the signaling to the SIP queue module for processing by the SIP queue module.

6. A Netfilter-based SIP signaling flow control method as claimed in claim 2, characterized in that: In S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic. The specific method also includes: when the SIP signaling traffic receiving rate exceeds the flow upper limit range set by the second flow control rule but does not exceed the flow upper limit range set by the third flow control rule, Netfilter sends the signaling to the SIP rejection module, which is processed by the SIP rejection module.

7. A Netfilter-based SIP signaling flow control method as claimed in claim 2, characterized in that: In S300, Netfilter controls the SIP signaling traffic according to the flow control rule SIP signaling traffic. The specific method also includes: when the SIP signaling traffic receiving rate exceeds the traffic upper limit range set by the third flow control rule, Netfilter does not forward the signaling exceeding the threshold range to the application layer, but directly replies with an icmp port unreachable message to the sender.

8. A Netfilter-based SIP signaling flow control method as claimed in claim 4, characterized in that: The SIP processing module is used for processing. The specific method includes: the SIP processing module receives the signaling, processes the signaling and replies a 200OK message to the sender, indicating that the request has been processed.

9. A Netfilter-based SIP signaling flow control method as claimed in claim 5, characterized in that: The SIP queue module is used for processing. The specific method includes: the SIP queue module receives the signaling and immediately replies with a 182Queued message to the sender of the signaling, indicating that the current SIP processing module is temporarily busy and the signaling has been added to the message queue for queuing; the SIP processing module continuously monitors the data in the queue module, and when the load is available, reads the SIP signaling from the queue module for processing, and when the processing is completed, sends a 200OK message to the sender of the SIP signaling, and synchronously notifies the queue module that the message has been processed, and the queue module removes the processed message from the queue.

10. A SIP signaling flow control system based on Netfilter, characterized in that: include: Flow control rule setting unit, flow control rule issuing unit and SIP signaling flow control unit; wherein: A flow control rule setting unit, used to set flow control rules according to user needs and send the flow control rules to the management module; A flow control rule issuing unit is used for the management module to issue the flow control rule to Netfilter in the Linux kernel; The SIP signaling flow control unit is used for the SIP signaling flow received by the application layer from the network camera and the user client. Netfilter controls the SIP signaling flow according to the flow control rules and the SIP signaling flow.

Images