Network measurement method and device, medium, electronic equipment and program product

Abstract

The invention relates to a network measurement method and device, a medium, electronic equipment and a program product, belongs to the technical field of networks, and aims to fully acquire a flow identifier of a to-be-measured flow and improve the accuracy of network measurement. The network measurement method comprises the following steps: detecting flow statistical characteristic information of a flow to be measured; detecting a key message of the to-be-measured flow to obtain a flow identifier of the to-be-measured flow, the key message being a message capable of identifying the to-be-measured flow; and determining a network measurement result based on the flow statistical feature information and the flow identifier.

Description

Technical Field

[0001] The present disclosure relates to the field of network technology, and in particular, to a network measurement method, device, medium, electronic device and program product. Background Art

[0002] Network measurement is the basis of network operation and maintenance, and is widely used in traffic engineering, anomaly detection, troubleshooting, network billing and other fields. Among the common network measurement solutions, Sketch solutions are widely used in the field of network measurement due to their packet-by-packet statistics, high accuracy, and support for multi-dimensional analysis. The Sketch-based network measurement method needs to combine the flow ID information and Sketch traffic statistics data to obtain the final network measurement results. However, there is currently no method to obtain the full amount of flow IDs, resulting in inaccurate final network measurement results. Summary of the invention

[0003] This section is provided to introduce the concepts in a brief form, which will be described in detail in the detailed implementation section below. This section is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to be used to limit the scope of the technical solution claimed for protection.

[0004] In a first aspect, the present disclosure provides a network measurement method, comprising: detecting traffic statistical characteristic information of a flow to be measured; detecting key messages of the flow to be measured to obtain a flow identifier of the flow to be measured, wherein the key messages are messages that can identify the flow to be measured; and determining a network measurement result based on the traffic statistical characteristic information and the flow identifier.

[0005] In a second aspect, the present disclosure provides a network measurement device, comprising: a traffic counter, used to detect traffic statistical characteristic information of a flow to be measured; a flow identification acquisition module, used to detect key messages of the flow to be measured and obtain the flow identification of the flow to be measured, wherein the key message is a message that can identify the flow to be measured; and a determination module, used to determine the network measurement result based on the traffic statistical characteristic information and the flow identification.

[0006] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of any one of the methods described in the first aspect.

[0007] In a fourth aspect, the present disclosure provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of any one of the methods described in the first aspect.

[0008] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0009] By adopting the above scheme, it is possible to detect the traffic statistical characteristic information of the flow to be measured, and detect the key message of the flow to be measured, and obtain the flow identifier of the flow to be measured, wherein the key message is a message that can identify the flow to be measured, and then determine the network measurement result based on the traffic statistical characteristic information and the flow identifier. Therefore, since the key message that can identify the flow to be measured is used as the flow identifier of the flow to be measured, it is possible to detect both the expected and known flow identifiers and the unknown flow identifiers, thereby achieving full acquisition of flow identifiers and improving the accuracy of network measurement. In addition, the full acquisition method of flow identifiers disclosed in the present invention does not need to rely on other systems.

[0010] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0012] Figure 1 The present invention is a flowchart of a network measurement method according to an embodiment of the present invention.

[0013] Figure 2 The present invention is a schematic flow chart of detecting key messages of a flow to be measured to obtain a flow identifier of the flow to be measured according to an embodiment of the present disclosure.

[0014] Figure 3 The present invention is a schematic flowchart of compressing a mirrored message according to an embodiment of the present invention.

[0015] Figure 4 This is another schematic flowchart of compressing a mirrored message according to an embodiment of the present disclosure.

[0016] Figure 5 This is another schematic flow chart of detecting key messages of a flow to be measured to obtain a flow identifier of the flow to be measured according to an embodiment of the present disclosure.

[0017] Figure 6 The schematic diagram shows the influence of the foreground and background switching period between the foreground traffic counter and the background traffic counter and the foreground and background switching period between the foreground first packet detector and the background first packet detector not being an integer multiple.

[0018] Figure 7 It is a schematic flow chart of using a register to control the foreground and background switching period between a foreground traffic counter and a background traffic counter to be an integer multiple of the foreground and background switching period between a foreground first packet detector and a background first packet detector according to an embodiment of the present disclosure.

[0019] Figure 8 The present invention is a schematic flowchart of determining a network measurement result based on traffic statistical feature information and a flow identifier according to an embodiment of the present invention.

[0020] Fig. 9 It is a schematic diagram of task allocation according to an embodiment of the present disclosure.

[0021] Fig.10 is another schematic diagram of task allocation according to an embodiment of the present disclosure.

[0022] Fig.11 It is a schematic diagram of the effect of the network measurement method according to an embodiment of the present disclosure.

[0023] Fig.12 is a schematic block diagram of a network measurement device according to an embodiment of the present disclosure.

[0024] Fig.13 is a schematic block diagram of a network measurement system according to an embodiment of the present disclosure.

[0025] Fig.14 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] All actions of acquiring signals, information or data in the present disclosure are carried out in compliance with the relevant data protection laws and policies of the country where they are located, and with the authorization given by the owner of the corresponding device.

[0033] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0034] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0035] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0036] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0037] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0038] Figure 1 This is a flow chart of a network measurement method according to an embodiment of the present disclosure. The network measurement method can be applied to various network measurement scenarios, such as traffic engineering, anomaly detection, troubleshooting, network billing, etc. The network measurement method can include the following steps S11 to S13.

[0039] In step S11, traffic statistics characteristic information of the flow to be measured is detected.

[0040] In some embodiments, a detection method based on the Sketch class or other detection methods can be used to detect traffic statistical feature information of the flow to be measured. The traffic statistical feature information may include at least one of the following: flow size estimation, large flow detection, flow number estimation, entropy estimation, flow distribution estimation, etc.

[0041] In some embodiments, Sketch may be deployed on a network element device in a data center. Thus, when the flow to be measured flows through the deployed Sketch, the Sketch will perform corresponding traffic statistics on each flow to be measured, and obtain corresponding traffic statistical feature information of each flow to be measured.

[0042] In step S12, a key message of the flow to be measured is detected to obtain a flow identifier of the flow to be measured, wherein the key message is a message that can identify the flow to be measured.

[0043] Taking the flow to be measured as a Transmission Control Protocol (TCP) flow as an example, the flow identifier may be a standard five-tuple. For another example, in addition to the standard five-tuple, the flow identifier may also include, for example, quality of service.

[0044] In step S13, a network measurement result is determined based on the traffic statistical feature information and the flow identifier.

[0045] If the traffic statistical characteristic information is obtained by Sketch deployed on the network element device, then, for example, a restoration algorithm corresponding to Sketch can be executed based on the traffic statistical characteristic information and the flow identifier to obtain the network measurement result.

[0046] By adopting the above scheme, it is possible to detect the traffic statistical characteristic information of the flow to be measured, and detect the key message of the flow to be measured, and obtain the flow identifier of the flow to be measured, wherein the key message is a message that can identify the flow to be measured, and then determine the network measurement result based on the traffic statistical characteristic information and the flow identifier. Therefore, since the key message that can identify the flow to be measured is used as the flow identifier of the flow to be measured, the present disclosure can detect both the expected and known flow identifiers and the unknown flow identifiers, thereby achieving full acquisition of flow identifiers and improving the accuracy of network measurement. In addition, the full acquisition method of flow identifiers disclosed in the present disclosure does not need to rely on other systems.

[0047] In some embodiments, detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured in step S12 may be implemented in the following manner.

[0048] First, it is determined whether there is a preset feature in the flow to be measured.

[0049] For example, the SYNFIN message in the TCP protocol identifies the start and end of the traffic, so the feature that identifies the start and end of the traffic belongs to the preset feature.

[0050] Then, if it is determined that the flow to be measured has the preset feature, that is, the flow to be measured is a characteristic flow to be measured, the message containing the preset feature is used as the key message of the flow to be measured to obtain the flow identifier of the flow to be measured. This ensures that the characteristic flow to be measured is detected, thereby increasing the success rate of detecting the overall flow to be measured.

[0051] Taking the SYNFIN message in the TCP protocol as an example, since the SYNFIN message contains preset features for identifying the start and end of traffic, the SYNFIN message will be detected as a key message.

[0052] If it is determined that the flow to be measured does not have the preset feature, that is, the flow to be measured is a featureless flow to be measured, the first packet of the flow to be measured within a period of time is detected as a key message of the flow to be measured to obtain the flow identifier of the flow to be measured.

[0053] Taking the User Datagram Protocol (UDP) as an example, there is no preset feature in the flow to be measured based on the UDP protocol, which is a featureless flow to be measured. In this case, the first packet of the flow to be measured within a period of time, that is, the message that appears for the first time within a period of time, can be detected as the key message of the flow to be measured. Among them, a data structure such as a Bloom filter can be used to detect the first packet of the flow to be measured within a period of time.

[0054] By adopting the above technical solution, it is possible to detect key messages with preset features in characteristic flow to be measured as flow identifiers, and to detect the first packet of featureless flow to be measured within a period of time as flow identifiers. Therefore, it is possible to detect both expected and unknown flow identifiers, thereby achieving full acquisition of flow identifiers and improving the accuracy of network measurement results. In addition, the flow identifier of a flow to be measured composed of many messages is represented by several key messages, which reduces the generation of flow identifiers, reduces the overhead brought to the network by the introduction of network measurement from the source of data, and further achieves efficient and comprehensive network monitoring.

[0055] In some embodiments, the detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured described in step S12 may also include: if it is determined that the preset feature exists in the flow to be measured, further detecting the first packet of the flow to be measured within a period of time as the key message of the flow to be measured, and obtaining the flow identifier of the flow to be measured.

[0056] That is, for a flow to be measured with characteristics, in addition to detecting the message containing the preset characteristics as a key message, the first packet within a period of time is also detected as a key message.

[0057] By detecting the first packet of a characteristic flow to be measured within a period of time, the flow to be measured that has established a connection but has not been transmitted can be identified more accurately, thereby confirming the duration and interruption time of the flow to be measured, achieving full acquisition of flow identification and improving the accuracy of network measurement.

[0058] In some embodiments, detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured in step S12 may also be implemented in the following manner.

[0059] First, the flow size information in the flow statistical feature information is obtained.

[0060] Then, based on the flow size information, it is determined whether the flow to be measured is an extra-large flow, wherein the extra-large flow is a flow whose flow size is greater than or equal to a first threshold.

[0061] Then, if it is determined that the flow to be measured is the super-large flow, that is, if it is determined that the flow size of the flow to be measured is greater than or equal to the first threshold, a summary of the flow to be measured is obtained as the flow identifier of the flow to be measured. For example, a summary function used to implement Address Resolution Protocol (ARP) learning can be used to obtain a summary of the flow to be measured that is determined to be a super-large flow. The summary function can obtain the flow identifiers of newly added flows to be measured that are not repeated within a period of time, and can be error-free when the number of flows is small.

[0062] In addition, the detection of super-large flows may be performed only on the featureless flows to be measured, or may be performed on both the featureless flows to be measured and the featureful flows to be measured.

[0063] Traffic skewness in a data center will cause the traffic distribution in the data center to show the characteristics of large and small flows and small and large flows. For network measurement, the harm of missed detection of large flows far exceeds the harm of missed detection of small flows. In the present disclosure, by determining whether the flow to be measured is an ultra-large flow based on the flow size information in the traffic statistical feature information and obtaining the summary of the flow to be measured that is determined to be an ultra-large flow as the flow identifier of the flow to be measured, it is possible to reduce missed detection of the flow identifier of the ultra-large flow and improve the accuracy and overall effect of network measurement.

[0064] In some embodiments, the detecting of key messages of the flow to be measured and obtaining the flow identifier of the flow to be measured described in step S12 may also include: if the flow to be measured is determined to be a large flow based on the flow size information in the traffic statistical characteristic information, then using a first packet detector for the large flow to detect the first packet within the period of time to obtain the flow identifier of the flow to be measured; if the flow to be measured is determined to be a small flow based on the flow size information in the traffic statistical characteristic information, then using a first packet detector for the small flow to detect the first packet within the period of time to obtain the flow identifier of the flow to be measured, wherein the large flow is a flow whose flow size is less than the first threshold but greater than or equal to the second threshold, and the small flow is a flow whose flow size is less than the second threshold.

[0065] That is, the flow to be measured determined as a large flow and the flow to be measured determined as a small flow are each detected by an independent first packet detector for the first packet within a period of time.

[0066] In addition, the first packet detection for large flows and the first packet detection for small flows may be performed only on the featureless flows to be measured, or may be performed on both the featureless flows to be measured and the featureful flows to be measured.

[0067] By adopting the above technical solution, it is possible to avoid the situation where a large flow with a relatively small number of flows is occupied by a large number of small flows in the resources used for first packet detection, thereby achieving more accurate large flow statistics. In addition, it is possible to detect both expected and known flow identifiers and unknown flow identifiers, thereby ensuring the full acquisition of flow identifiers and improving the accuracy of network measurement.

[0068] Figure 2 FIG. 1 is a schematic flow chart of detecting key messages of a flow to be measured to obtain a flow identifier of the flow to be measured according to an embodiment of the present disclosure. Figure 2 As shown, detecting the key message of the flow to be measured to obtain the flow identifier of the flow to be measured may include the following steps S21 and S22.

[0069] In step S21, after the key message is detected, the key message is mirrored to obtain a mirrored message.

[0070] The purpose of mirroring the key message is to obtain a copy of the key message. In this way, on the one hand, the detected key message can maintain the original processing flow, thereby not affecting the original processing flow of the flow to be measured. On the other hand, the copy of the key message can be used to obtain the flow identifier, ensuring the smooth completion of the network measurement.

[0071] In addition, the following key messages can be mirrored: (1) key messages with preset features of the characteristic flow to be measured; (2) the first packet of the characteristic flow to be measured within a period of time; (3) the first packet of the featureless flow to be measured within a period of time. For the flow to be measured that is determined to be an ultra-large flow, the ultra-large flow can be not mirrored, thereby improving the efficiency of network measurement and saving the storage space used for mirroring.

[0072] In step S21, the mirror message is compressed to obtain the flow identifier of the flow to be measured. By compression, the flow identifier can be obtained with lower network overhead.

[0073] The specific implementation method of compressing the mirror message will be described in detail below.

[0074] By adopting the above technical solution, on the one hand, by mirroring the key messages, it is ensured that the flow identifier of the flow to be measured is obtained, and the original processing flow of the flow to be measured will not be affected; on the other hand, by compressing the mirror message to process the obtained flow identifier of the flow to be measured, the transmission overhead of the flow identifier is reduced, thereby reducing the overhead brought to the network by the introduction of network measurement from the aspect of the transmission process, and further realizing efficient and comprehensive network monitoring.

[0075] Figure 3 It is a schematic flow chart of compressing the mirror message according to an embodiment of the present disclosure.

[0076] like Figure 3 As shown, first, in step S31, the payload in the mirror message is removed to obtain a trimmed message. By removing the payload in the mirror message, a long packet can be trimmed into a short packet without the payload, thereby reducing the length of each mirror message and further reducing the bit rate (Bit Per Second, BPS).

[0077] Then, in step S32, the header information of the plurality of trimmed messages is combined into a single header. For example, the necessary header information of the plurality of trimmed messages is combined into a long header. In this way, the number of packets per second (PPS) can be mainly reduced, and the BPS can be slightly reduced.

[0078] Steps S31 and S32 may be collectively referred to as first-level compression, which may be performed on a network element device that is deployed with a traffic counter for detecting traffic statistical feature information of the flow to be measured. The traffic counter may be, for example, Sketch.

[0079] In addition to the first-level compression, the second-level compression can also be performed on the Data Plane Development Kit (DPDK) server deployed near the network element device (described in detail below). Therefore, in order to send the first-level compressed flow identifier to the DPDK server, a tunnel to the DPDK server can also be configured for the first-level compressed flow identifier, and the first-level compressed flow identifier can be sent to the DPDK server through the tunnel. In addition, the first-level compressed flow identifier can be sent to the DPDK server through the low-level (e.g., S2-S1-S0) network.

[0080] Combining the packet header information of multiple trimmed messages into a single packet header can achieve two advantages: 1. The DPDK server has two bottlenecks, BPS and PPS. Simply trimming the payload will make the DPDK server easily reach the bottleneck of PPS and easily affect the throughput of the DPDK server. By combining the packet header information of multiple trimmed messages into a single packet header, more flow identifiers can be sent under the same hardware performance constraints; 2. The packet headers of multiple trimmed messages can share a tunnel header of the DPDK server, further reducing bandwidth usage.

[0081] By adopting the above compression operation, the transmission overhead of the flow identifier can be initially reduced, thereby reducing the overhead brought by the introduction of network measurement to the network from the aspect of the transmission process, and further realizing efficient and comprehensive network monitoring. In addition, the above compression method will not lose the accuracy of network measurement.

[0082] Figure 4 This is another schematic flowchart of compressing a mirrored message according to an embodiment of the present disclosure.

[0083] like Figure 4 As shown, in Figure 3 On the basis of, compressing the mirror message may further include steps S41 and S42.

[0084] In step S41, a packet header is extracted from the single packet header as needed.

[0085] For example, the packet header can be extracted according to the flow identifier of the network measurement. For example, for a TCP flow, when the standard five-tuple is used as the flow identifier of the network measurement, the Ethernet layer information will not be extracted. By extracting the packet header on demand, BPS can be reduced.

[0086] In step S42, for the key messages detected within the preset time period, the trimmed messages corresponding to the extracted packet headers are deduplicated to obtain deduplicated messages.

[0087] For example, the trimmed messages corresponding to the extracted packet headers can be deduplicated at a certain time scale (e.g., a preset period before the current time), thereby reducing BPS and PPS. The reason for deduplication is that, because the full coverage of the flow identifier must be considered, the monitoring and mirroring of key messages require relatively frequent updates to reduce missed detections, and relatively frequent updates will introduce redundant copies of the flow identifier. Therefore, deduplication can reduce the redundancy of the flow identifier.

[0088] Optionally, in step S43, the deduplicated message is processed into a message of a preset format, for example, a format required for network measurement, so as to alleviate the overhead of the downstream network measurement component (for example, the analysis system cluster) for centralized processing of the message format.

[0089] Steps S41, S42, and S43 may be collectively referred to as secondary compression, which may be performed on a DPDK server. The DPDK server may send the secondary compressed stream identifier to a downstream network measurement component (e.g., an analysis system cluster) through a high-level network (e.g., S0-S1-S2-S3).

[0090] Through the compression operation of steps S41 to S43, the flow identifier can be further compressed, further reducing the transmission overhead of the flow identifier, thereby reducing the overhead brought to the network by the introduction of network measurement from the perspective of the transmission process, and further realizing efficient and comprehensive network monitoring. In addition, the above compression method will not lose the accuracy of network measurement.

[0091] Figure 5 This is another schematic flow chart of detecting key messages of a flow to be measured to obtain a flow identifier of the flow to be measured according to an embodiment of the present disclosure.

[0092] like Figure 5 As shown, first, in step S51, it is determined whether there is a preset feature in the flow to be measured. The implementation method of this step has been described in detail in the previous text and will not be repeated here. If it is determined that there is a preset feature in the flow to be measured, then go to steps S52 and S53; if it is determined that there is no preset feature in the flow to be measured, then go to step S54.

[0093] In step S52, since it is determined in step S51 that the flow to be measured has a preset feature, a message containing the preset feature in the flow to be measured is detected in step S52 as a key message of the flow to be measured. Then the process proceeds to step S59. The implementation method of detecting the message containing the preset feature in the flow to be measured has been described in detail in the previous text and will not be repeated here.

[0094] In step S53, since it is determined in step S51 that there are preset features in the flow to be measured, in step S53, it is determined that the flow to be measured with features does not contain messages with preset features (i.e., non-feature packets), and then the process proceeds to step S54, so that in subsequent steps, the non-feature packets in the flow to be measured with features can continue to be processed to obtain enhanced perception of the flow identification. For example, in subsequent steps, for the non-feature packets in the flow to be measured with features, the first packet of the non-feature packets within a period of time is detected, so that a more accurate identification can be made for the flow that is connected but not transmitted. In addition, step S53 is optional, that is, the non-feature packets of the flow to be measured with features can be processed without subsequent processing.

[0095] In step S54, for the non-characteristic packets of the characteristic flow to be measured and the non-characteristic flow to be measured, it is determined whether the flow to be measured is an ultra-large flow, a large flow or a small flow. For example, for the non-characteristic flow to be measured, it is determined whether the non-characteristic flow to be measured is an ultra-large flow, a large flow or a small flow; for the non-characteristic packets of the characteristic flow to be measured, it is determined whether the flow to be measured to which the non-characteristic packets belong is an ultra-large flow, a large flow or a small flow.

[0096] In addition, the method for determining the super large flow, large flow, and small flow has been described in detail in the previous article and will not be repeated here.

[0097] If it is determined that the flow to be measured is an extra-large flow, the process proceeds to step S55. If it is determined that the flow to be measured is a large flow, the process proceeds to step S56. If it is determined that the flow to be measured is a small flow, the process proceeds to step S57.

[0098] In step S55, since it is determined in step S54 that the flow to be measured is an extra large flow, in step S55, a summary of the flow to be measured is obtained as the flow identifier of the flow to be measured. For example, the summary function used to implement ARP learning can be used to obtain the flow identifier of the flow to be measured that is determined to be an extra large flow. The summary function can obtain the flow identifier of the newly added flow that is not repeated within a period of time, and can be error-free when the number of flows is small.

[0099] In step S56, since the flow to be measured is determined to be a large flow in step S54, a first packet detector for large flows can be used to detect the first packet of the flow to be measured determined to be a large flow within a period of time in step S56, and then proceed to step S58. The first packet detector for large flows can be implemented using a Bloom filter.

[0100] In step S57, since the flow to be measured is determined to be a small flow in step S54, a first packet detector for small flows can be used to detect the first packet of the flow to be measured determined to be a small flow within a period of time in step S57, and then proceed to step S58. The first packet detector for small flows can be implemented using a Bloom filter.

[0101] In the present disclosure, the flow to be measured determined as a large flow and the flow to be measured determined as a small flow are each detected by an independent first packet detector within a period of time. In this way, it is possible to avoid the large flow, which has a relatively small number of flows, from being occupied by a large number of small flows in the resources used for first packet detection, thereby achieving more accurate large flow statistics, ensuring the full acquisition of flow identifiers, and improving the accuracy of network measurement.

[0102] In step S58, it is determined whether to mirror the detected message.

[0103] For example, whether to mirror the detected message can be determined according to the first packet mark. That is, if the message is detected as the first packet and marked with the first packet mark in steps S56 and S57, it is determined in step S58 that the detected message needs to be mirrored, and then the process proceeds to step S59.

[0104] For another example, it may also be determined whether to mirror the detected message according to the first packet mark and the preset mirroring requirement. The preset mirroring requirement may include, for example, that the service quality of the message is higher than a preset value. Then, for example, if the message is detected as the first packet and the service quality of the message is higher than the preset value, it is determined that the detected message needs to be mirrored.

[0105] In step S59, the message to be mirrored is mirrored and compressed to obtain the flow identifier of the flow to be measured. The implementation method of compression has been described in the previous text. Figure 2 , Figure 3 and Figure 4 It has been described in detail and will not be repeated here.

[0106] Traffic skewness in data centers will cause the traffic distribution in data centers to show the characteristics of large and small flows and small and large flows. For network measurement, the harm of missed detection of super-large flows and missed detection of large flows far exceeds the harm of missed detection of small flows. By adopting the above technical solution, not only can the missed detection of super-large flows and missed detection of large flows be reduced, and more accurate statistics of large flows can be achieved, but also key messages containing preset features and the first packet within a period of time can be detected, so that both expected and known flow identifiers can be detected, and unknown flow identifiers can be detected. Therefore, the full acquisition of flow identifiers is ensured, the accuracy of network measurement is improved, and the overall effect of network measurement is improved.

[0107] Typically, traffic statistics feature information of the flow to be measured can be obtained through the Sketch algorithm. When the introduction of network measurement affects the theoretical accuracy of the Sketch algorithm, the mathematical properties proven by the Sketch study may be affected. Therefore, it is very important to ensure that the introduction of network measurement does not introduce additional errors of the Sketch algorithm. Therefore, in some embodiments, the network measurement method according to the embodiment of the present disclosure may also include: controlling the foreground and background switching period between the foreground traffic counter and the background traffic counter to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector.

[0108] The foreground traffic counter is a traffic counter that works in the foreground to detect the traffic statistics characteristic information of the flow to be measured. The background traffic counter is a traffic counter that works in the background to read the traffic statistics characteristic information stored therein. The foreground first packet detector is a first packet detector that works in the foreground to detect the first packet within the period of time. The background first packet detector is a first packet detector that works in the background to clear the storage space therein.

[0109] In the present disclosure, a foreground traffic counter and a background traffic counter are used to work together in the foreground and the background, so that it can be ensured that the traffic statistical characteristic information of the flow to be measured is always detected. Both the foreground traffic counter and the background traffic counter can be implemented using Sketch deployed on the network element device.

[0110] In the present disclosure, a foreground first packet detector and a background first packet detector are used to work together in the foreground and the background, so that the first packet within a period of time can be detected. Both the foreground first packet detector and the background first packet detector can be implemented using Bloom filters.

[0111] The restoration of Sketch requires the coordination between the traffic statistics feature information obtained by Sketch and the flow identifier counted within the time window of Sketch's work. Figure 6The schematic diagram shows the impact of the front-end and back-end switching period between the foreground traffic counter and the back-end traffic counter and the front-end and back-end switching period between the foreground first packet detector and the back-end first packet detector not being an integer multiple. Figure 6 As shown, the traffic counter includes a first traffic counter and a second traffic counter, and the foreground and background switching period of the first traffic counter and the second traffic counter is T, that is, when the first traffic counter works in the foreground, the second traffic counter works in the background, and when the second traffic counter works in the foreground, the first traffic counter works in the background. The foreground and background switching period of the first packet detector is t. Since the foreground and background switching period T of the traffic counter is not an integer multiple of the foreground and background switching period t of the first packet detector, in terms of timing, the time point when the first packet detector starts to switch to the foreground operation must not correspond to the time point when each traffic counter starts to switch to the foreground operation, such as Figure 6 As shown, the time point when the first packet detector x starts to switch to the foreground is earlier than the time point when the second traffic counter starts to switch to the foreground by the time length indicated by the label 110. In this scenario, there will be many non-super-large flows similar to the flow to be measured indicated by the label 11, wherein the flow to be measured 11 is mirrored within the time window of the first traffic counter and ends within a working cycle of the first packet detector. For the flow to be measured 11, its first packet will be detected by the first packet detector x that is switched to the foreground during the time interval indicated by the slash of the first packet detector x, and thus the corresponding flow identifier will be obtained. In the time interval not indicated by the slash of the first packet detector x ( Figure 6 111), because the first packet mark of the flow 11 to be measured has been stored in the first packet detector x, no message belonging to the flow 11 to be measured will be marked as the first packet, and thus the flow identifier of the flow 11 to be measured cannot be detected within the time window when the second flow counter works in the foreground. Furthermore, because there is no flow identifier corresponding to the flow 11 to be measured within the time window when the second flow counter works, the flow 11 to be measured cannot be restored within the time window corresponding to the second flow counter, but can only be restored within the time window corresponding to the first flow counter, which leads to a restoration error in restoring the flow 11 to be measured within the time window corresponding to the second flow counter.

[0112] By controlling the foreground and background switching period between the foreground traffic counter and the background traffic counter to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector, the foreground and background switching between the foreground traffic counter and the background traffic counter can be aligned with the foreground and background switching between the foreground first packet detector and the background first packet detector, thereby ensuring that the traffic statistical feature information and the corresponding flow identifier of the flow to be measured exist within the working time window of each traffic counter, ensuring that the flow to be measured that is counted within the time window can be restored within the working time window of each traffic counter, eliminating the error introduced by the mismatch between the traffic statistical feature information and the flow identifier, and improving the accuracy of network measurement.

[0113] In some embodiments, the foreground and background switching period between the foreground traffic counter and the background traffic counter is controlled to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector, and may include: using the values ​​of some bits in the register to control the foreground and background switching period between the foreground traffic counter and the background traffic counter; using the values ​​of the remaining bits in the register to control the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the change period of the values ​​of the some bits is an integer multiple of the change period of the values ​​of the remaining bits.

[0114] That is, the same register is used to control both the foreground and background switching period between the foreground traffic counter and the background traffic counter, and the foreground and background switching period between the foreground first packet detector and the background first packet detector.

[0115] The following example is taken as an example that the register is a 32-bit register, the 30:0 bits of the register are marked as the flow statistics index value (SketchIndex) and are used to control the foreground and background switching of the flow counter, the 31st bit of the register is marked as BFEnable and is used to control the foreground and background switching of the first packet detector, the foreground and background switching period of the first packet detector is 1s, the foreground and background switching period of the flow counter is 5s, and the value of the register at 0s is 0x11010005. In addition, in this example, the flow counter may include a first flow counter and a second flow counter, which are switched alternately between the foreground and background; the first packet detector for a large flow may include a first large flow first packet detector and a second large flow first packet detector, which are switched alternately between the foreground and background; the first packet detector for a small flow may include a first small flow first packet detector and a second small flow first packet detector, which are switched alternately between the foreground and background. The first flow counter and the second flow counter may be Sketch-based flow counters, and the first large flow first packet detector and the second large flow first packet detector as well as the first small flow first packet detector and the second small flow first packet detector may be Bloom filters. In addition, in this example, the register value can be dynamically updated by the control plane and sent to the control module of the data plane, so that the control module of the data plane can control the front and back switching of the traffic counter and the first packet detector according to the received register value (this corresponds to Figure 7 In step S71 of FIG. 1 , the control plane may also record the register value sent to the data plane each time. For example, if the register is 32 bits, the control plane may use a 32-bit variable to record the sent register value.

[0116] Since in this example, the foreground and background switching period of the first packet detector is shorter than the foreground and background switching period of the traffic counter, the control plane will update the register value according to the clock time of the control plane and the foreground and background switching period of the first packet detector. For example, at 1s, the control plane updates the value of the register to 0x91010006; at 2s, the control plane updates the value of the register to 0x11010006; at 3s, the control plane updates the value of the register to 0x91010006; at 4s, the control plane updates the value of the register to 0x11010006; at 5s, the control plane updates the value of the register to 0x91010006; at 6s, the control plane updates the value of the register to 0x11010007; at 7s, the control plane updates the value of the register to 0x91010007; at 8s, the control plane updates the value of the register to 0x11010007; at 9s, the control plane updates the value of the register to 0x91010007; at 10s, the control plane updates the value of the register to 0x11010007, and so on. Thus, during the period of 1-5s, the value of SketchIndex is 0x11010006; during the period of 6-10s, the value of SketchIndex is 0x11010007. Then, during the period of 1-5s, the first traffic counter can be controlled to work in the foreground based on the value of SketchIndex (this corresponds to Figure 7 Therefore, the flow to be measured enters the first flow counter for statistics, while the second flow counter works in the background. The flow statistics feature information stored in the second flow counter is read. After the reading is completed, all registers of the second flow counter are set to 0. Similarly, during the 6-10s period, the second flow counter can be controlled to work in the foreground based on the value of SketchIndex (this corresponds to Figure 7 Therefore, the flow to be measured enters the second flow counter for statistics, and the first flow counter switches to the background, and the flow statistics feature information stored in the first flow counter is read. After the reading is completed, all registers of the first flow counter are set to 0.

[0117] Similarly, for the first packet detector, you can control which first packet detector works in the foreground and which first packet detector works in the background based on the value of BFEnable. For example, at odd seconds such as 1, 3, 5, etc., the first packet detector of the first large flow and the first packet detector of the first small flow are controlled to work in the foreground to detect the first packet within a period of time (this corresponds to Figure 7The second largest flow first packet detector and the second smallest flow first packet detector work in the background to clear the storage space therein; at even seconds such as 2, 4, 6, etc., the second largest flow first packet detector and the second smallest flow first packet detector are controlled to work in the foreground according to the value of BFEnable to detect the first packet within a period of time (this corresponds to Figure 7 In steps S78 and S80 and S75 and S77), the first large flow first packet detector and the first small flow first packet detector work in the background to clear the storage space therein.

[0118] By adopting the above technical solution, the same register can be used to control both the foreground and background switching period between the foreground traffic counter and the background traffic counter, and the foreground and background switching period between the foreground first packet detector and the background first packet detector, and the same register can be used to make the foreground and background switching period between the foreground traffic counter and the background traffic counter and the foreground and background switching period between the foreground first packet detector and the background first packet detector an integer multiple relationship. Therefore, on the one hand, the foreground and background switching between the foreground traffic counter and the background traffic counter can be aligned with the foreground and background switching between the foreground first packet detector and the background first packet detector, thereby ensuring that the flow statistics feature information and the corresponding flow identifier of the flow to be measured exist within the time window of each flow counter, ensuring that the flow to be measured that is counted within the time window of each flow counter can be restored within the time window, eliminating the error introduced by the mismatch between the flow statistics feature information and the flow identifier, and improving the accuracy of network measurement. On the other hand, the clock tolerance is achieved. Even in the following situations, the match between the flow identifier and the traffic statistical feature information can still be guaranteed, and the theoretical accuracy of Sketch query will not be affected: 1. The control plane to the data plane is a non-exclusive communication channel, and the delay of sending the register value each time may be slightly deviated. For example, the register value of the control plane with an interval of 1s may become 1.000ls when sent to the data plane; 2. The clock of the control plane is based on CPU statistics, and there are certain errors in it. For example, the first register time interval of the control plane itself is recorded as 0.9999s, while the second time is recorded as 1.000ls.

[0119] In some embodiments, the network measurement method according to the embodiment of the present disclosure may further include:

[0120] Carrying a current traffic statistics index value in the flow identifier, wherein the current traffic statistics index value is a current value of the partial bits; and

[0121] The traffic statistics characteristic information read carries a traffic statistics index value previous to the current traffic statistics index value, wherein the traffic statistics index value previous to the current traffic statistics index value is a value previous to the current value of the partial bits.

[0122] Still taking the above 32-bit register as an example, the flow identifier obtained during the period of 6-10s (for example, the flow identifier for the super large flow, the flow identifier obtained based on the key message containing the preset characteristics in the characteristic flow to be measured, the flow identifier for the large flow, the flow identifier for the small flow, etc.) will carry the traffic statistics index value during the period of 6-10s, for example, 0x11010007, and the traffic statistics feature information read during the period of 6-10s will carry the previous traffic statistics index value of the traffic statistics index value during 6-10s, that is, the traffic statistics index value 0x11010006 during the period of 1-5s.

[0123] By carrying the corresponding traffic statistics index value in the flow identifier and traffic statistics feature information, it is possible to accurately match the flow identifier with the traffic statistics feature when determining the network measurement results based on the flow identifier and traffic statistics feature information in the future, thereby ensuring the accuracy of the restoration of the measured flow and improving the accuracy of the network measurement.

[0124] Figure 8 This is a schematic flow chart of determining network measurement results based on traffic statistical feature information and flow identifiers according to an embodiment of the present disclosure. The process can be executed on an analysis cluster system.

[0125] like Figure 8 As shown, in step S81, the flow identifier is obtained and stored, for example, the flow identifier is obtained regularly so that it can be quickly processed when the flow identifier is updated. In step S82, the traffic statistical feature information is obtained and stored, for example, the traffic statistical feature information is obtained regularly so that it can be quickly processed when the traffic statistical feature information is updated. In step S83, the stored content is pulled, for example, the flow identifier and the traffic statistical feature information are pulled. In step S84, the message format is shaped, for example, the flow identifier and the traffic statistical feature information are shaped into the format required for task processing. In step S85, task allocation is performed, for example, the task of restoring the flow to be measured based on the flow identifier and the traffic statistical feature information is allocated among the task processing units. In step S86, task processing is performed, that is, each task processing unit restores the flow to be measured based on the allocated flow identifier and traffic statistical feature information. In step S87, the result is stored, for example, the network measurement result of each task processing unit is stored in the memory.

[0126] Fig. 9 FIG. 1 is a schematic diagram of task allocation according to an embodiment of the present disclosure. Fig. 9As shown, the flow identifier and traffic statistics feature information with the same SketchIndex can be assigned to the same task processing unit based on the hash operation, so as to ensure data consistency. In addition, the flow identifier and traffic statistics feature information can be assigned to each task processing unit based on different SketchIndex using the hash operation to avoid congestion of a single task processing unit. For example, the flow identifier and traffic statistics feature information with SketchIndex1 are assigned to task processing unit 1, and the flow identifier and traffic statistics feature information with SketchIndex2 are assigned to task processing unit n.

[0127] By adopting the above technical solution, it is possible to ensure data consistency and avoid congestion of a single task processing unit.

[0128] In some cases, when the processing capacity of task processing units is uneven or the input amount of flow identifiers is uneven, Fig. 9 The task allocation strategy shown is prone to bottleneck problems of a single task processing unit, so the present disclosure also provides a Fig.10 The task allocation strategy shown.

[0129] The input required for restoring the measured flow usually includes a large number of flow identifiers and traffic statistical feature information that occupies a relatively small space. Fig.10 In the task allocation strategy shown, the traffic statistics feature information carrying the traffic statistics index value will be broadcast to all task processing units, and the flow identifier carrying the traffic statistics index value will be allocated to each task processing unit according to the resources of each task processing unit, that is, all flow identifiers are allocated to different task processing units in different numbers according to the resources of the task processing units. In this way, in each task processing unit, the flow to be measured can be restored according to the allocated flow identifier and the traffic statistics feature information with the same traffic statistics index value as the allocated flow identifier, and the network measurement result can be obtained.

[0130] Through the above task allocation strategy, the bottleneck of task processing units caused by uneven processing capabilities of task processing units or uneven input amounts of flow identifiers is avoided, and less processing delay can be achieved under limited task processing units, ensuring the timeliness of network measurement.

[0131] Fig.11 FIG. 1 is a schematic diagram showing the effect of the network measurement method according to an embodiment of the present disclosure. Fig.11 As shown, the maximum delay of the network measurement method according to the embodiment of the present disclosure is 55, and its flow identification perception capability is 10 times that of the commonly used active perception solution Sflow. Fig.11The detection capability of flow identification is also shown. When the switching period between the front-end and back-end of the first packet detector is constant, different flow identification detection capabilities are presented under different bandwidth inputs. Relatively speaking, the detection capability decreases slightly when the bandwidth increases, but it is still above 90%.

[0132] In addition, the network measurement method according to the embodiment of the present disclosure has a relatively controllable overhead when perceiving flow identification. Table 1 shows the flow identification overhead after the first-level compression processing under different input conditions. The second-level compression will produce different effects depending on the traffic characteristics. Generally, the bandwidth and PPS can be reduced by at least half after the first-level compression processing. Table 1 shows that the network measurement method according to the embodiment of the present disclosure can achieve comprehensive perception of flow identification while the overhead is relatively controllable.

[0133] Input (Mpps) Input(Mbps) Flow ID (Mpps) Flow ID (Mbps) 52.68 354482 3.39 1360 45.18 304127 2.89 1122 37.65 253389 2.36 811 30.25 2014166 1.84 661 22.69 153076 1.37 494 14.96 103350 0.85 404 7.45 53108 0.44 154

[0134] Table 1

[0135] Table 2 shows the resource occupation of the task processing unit under different flow inputs. As shown in Table 2, the task allocation strategy according to the embodiment of the present disclosure has better efficiency, can ensure that there will be no mismatch between the flow identifier and the flow statistical feature information in any message, and avoids the error introduced in the process of restoring the flow to be measured.

[0136] Input (Mpps) Input(Mbps) Virtual Processor Memory (GB) 52.68 354482 122 385 45.18 304127 105 386 37.65 253389 85.4 386 30.25 2014166 66.6 384 22.69 153076 47.2 386 14.96 103350 33.0 387 7.45 53108 16.8 388

[0137] Table 2

[0138] Fig.12 The present invention is a schematic block diagram of a network measurement device according to an embodiment of the present invention. The network measurement device can be applied to various network measurement scenarios, such as traffic engineering, anomaly detection, troubleshooting, network billing, etc.

[0139] like Fig.12 As shown, the network measurement device according to the embodiment of the present disclosure may include: a traffic statistics device 100, which is used to detect the traffic statistics characteristic information of the flow to be measured; a flow identification acquisition module 101, which is used to detect the key message of the flow to be measured and obtain the flow identification of the flow to be measured, wherein the key message is a message that can identify the flow to be measured; and a determination module 102, which is used to determine the network measurement result based on the traffic statistics characteristic information and the flow identification.

[0140] By adopting the above scheme, it is possible to detect the traffic statistical characteristic information of the flow to be measured, and detect the key message of the flow to be measured, and obtain the flow identifier of the flow to be measured, wherein the key message is a message that can identify the flow to be measured, and then determine the network measurement result based on the traffic statistical characteristic information and the flow identifier. Therefore, since the key message that can identify the flow to be measured is used as the flow identifier of the flow to be measured, it is possible to detect both the expected and known flow identifiers and the unknown flow identifiers, thereby achieving full acquisition of flow identifiers and improving the accuracy of network measurement. In addition, the full acquisition method of flow identifiers disclosed in the present invention does not need to rely on other systems.

[0141] Optionally, the flow identifier acquisition module 101 detects a key message of the flow to be measured to obtain the flow identifier of the flow to be measured, including:

[0142] Determining whether there is a preset feature in the flow to be measured;

[0143] If it is determined that the preset feature exists in the flow to be measured, the message containing the preset feature is used as a key message of the flow to be measured, and the flow identifier of the flow to be measured is obtained;

[0144] If it is determined that the preset feature does not exist in the flow to be measured, the first packet of the flow to be measured within a period of time is detected as a key message of the flow to be measured, and the flow identifier of the flow to be measured is obtained.

[0145] Optionally, the flow identifier acquisition module 101 detects a key message of the flow to be measured to obtain the flow identifier of the flow to be measured, and further includes:

[0146] If it is determined that the preset feature exists in the flow to be measured, the first packet of the flow to be measured within a period of time is further detected as a key message of the flow to be measured, and the flow identifier of the flow to be measured is obtained.

[0147] Optionally, the flow identifier acquisition module 101 detects a key message of the flow to be measured to obtain the flow identifier of the flow to be measured, and further includes:

[0148] Obtaining flow size information from the flow statistical feature information;

[0149] Based on the flow size information, determining whether the flow to be measured is an ultra-large flow, wherein the ultra-large flow is a flow whose flow size is greater than or equal to a first threshold;

[0150] If it is determined that the flow to be measured is the super large flow, a summary of the flow to be measured is obtained as a flow identifier of the flow to be measured.

[0151] Optionally, the flow identifier acquisition module 101 detects a key message of the flow to be measured to obtain the flow identifier of the flow to be measured, and further includes:

[0152] If it is determined that the flow to be measured is a large flow, a first packet detector for the large flow is used to detect a first packet within the period of time to obtain a flow identifier of the flow to be measured;

[0153] If it is determined that the flow to be measured is a small flow, a first packet detector for the small flow is used to detect the first packet within the period of time to obtain the flow identifier of the flow to be measured, wherein the large flow is a flow whose flow size is less than the first threshold but greater than or equal to the second threshold, and the small flow is a flow whose flow size is less than the second threshold.

[0154] Optionally, the flow identifier acquisition module 101 detects a key message of the flow to be measured to obtain the flow identifier of the flow to be measured, and further includes:

[0155] After detecting the key message, mirroring the key message to obtain a mirrored message;

[0156] The mirrored message is compressed to obtain a flow identifier of the flow to be measured.

[0157] Optionally, the flow identifier acquisition module 101 compresses the mirror message, including:

[0158] Removing the payload from the mirrored message to obtain a trimmed message;

[0159] The packet header information of the plurality of clipped messages is combined into a single packet header.

[0160] Optionally, the flow identifier acquisition module 101 compresses the mirror message, further comprising:

[0161] Extracting a packet header from the single packet header as needed;

[0162] For key messages detected within a preset time period, duplicated messages corresponding to the extracted packet headers are deduplicated to obtain deduplicated messages.

[0163] Optionally, the flow identifier acquisition module 101 compresses the mirror message, further comprising:

[0164] The deduplicated messages are processed into messages in a preset format.

[0165] Optionally, the network measurement device further includes a control module, configured to:

[0166] The foreground and background switching period between the foreground traffic counter and the background traffic counter is controlled to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the foreground traffic counter is a traffic counter working in the foreground to detect the traffic statistical characteristic information of the flow to be measured, the background traffic counter is a traffic counter working in the background to read the traffic statistical characteristic information stored therein, the foreground first packet detector is a first packet detector working in the foreground to detect the first packet within the period of time, and the background first packet detector is a first packet detector working in the background to clear the storage space therein.

[0167] Optionally, the control module controls the foreground and background switching period between the foreground traffic counter and the background traffic counter to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector, including:

[0168] Using the values ​​of some bits in the register to control the foreground and background switching period between the foreground traffic counter and the background traffic counter;

[0169] The values ​​of the remaining bits in the register are used to control the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the change period of the values ​​of some bits is an integer multiple of the change period of the values ​​of the remaining bits.

[0170] Optionally, the network measurement device further includes a transmission module, configured to:

[0171] Carrying a current traffic statistics index value in the flow identifier, wherein the current traffic statistics index value is a current value of the partial bits; and

[0172] The traffic statistics characteristic information read carries a traffic statistics index value previous to the current traffic statistics index value, wherein the traffic statistics index value previous to the current traffic statistics index value is a value previous to the current value of the partial bits.

[0173] Optionally, the determining module 102 determines the network measurement result based on the traffic statistical feature information and the flow identifier, including:

[0174] Broadcasting the traffic statistics feature information carrying the traffic statistics index value to all task processing units;

[0175] Allocating a flow identifier carrying the traffic statistics index value to each of the task processing units according to the resources of each of the task processing units;

[0176] Each of the task processing units determines a network measurement result according to the allocated flow identifier and the traffic statistics feature information having the same traffic statistics index value as the allocated flow identifier.

[0177] The specific implementation of the operations performed by each module in the network measurement device according to the embodiment of the present disclosure has been described in detail in the relevant network measurement method, and will not be repeated here.

[0178] Fig.13 is a schematic block diagram of a network measurement system according to an embodiment of the present disclosure.

[0179] like Fig.13 As shown, the network measurement system may include a data plane control module 106, a traffic counter 100, a flow identification acquisition module 101, a flow identification reading module 102, a traffic statistics feature information reading module 103, a control plane control module 104, and an analysis system cluster 105. The flow identification acquisition module 101 may include a key message detection module 1011, a key message mirroring module 1012, a primary compression module 1013, and a secondary compression module 1014.

[0180] The data plane control module 106, the traffic counter 100, the key message detection module 1011, the key message mirroring module 1012 and the compression module 1013 can be arranged on the data plane 1001 of the network element device 1003. The control plane control module 104, the traffic statistics feature information reading module 103 and the flow identification reading module 102 can be deployed on the control plane 1002 of the network element device 1003. The data plane and the control plane can be divided according to the hardware running the logic on the network element device. For example, if the hardware running the logic is a CPU, it belongs to the control plane, and if the hardware running the logic is a switch chip, it belongs to the data plane. The secondary compression module 1014 can be deployed on the DPDK server 1004. The DPDK server 1004 can be deployed near the network element device 1003.

[0181] The traffic counter 100 may be a Sketch-based traffic counter, and may be used to perform the operations related to the detection of traffic feature statistical information described above.

[0182] The key message detection module 1011 can perform the operations described above related to flow identification detection for characteristic to-be-measured flows, characteristicless to-be-measured flows, super large flows, large flows, small flows, etc.

[0183] The critical message mirroring module 1012 can perform the operations described above related to the mirroring of critical messages.

[0184] The first-level compression module 1013 can perform the operations related to the first-level compression described above.

[0185] The secondary compression module 1014 can perform the operations related to the secondary compression described above. The primary compression module 1013 and the secondary compression module 1014 can communicate with each other through a low-level network.

[0186] The flow identifier reading module 102 can read the flow identifier for the super large flow described above, and transmit the read flow identifier to the analysis system cluster 105. Since the flow identifier reading module 102 is located in the control plane 1002 of the network element device 1003, the flow identifier for the super large flow is reported to the analysis system cluster 105 from the control plane path with higher reliability, thereby improving the transmission reliability of the flow identifier for the super large flow.

[0187] The traffic statistics characteristic information reading module 103 can read the traffic statistics characteristic information stored in the traffic counter in the background under the control of the control plane control module 104, and transmit the read traffic statistics characteristic information to the analysis system cluster 105. The bandwidth required for the transmission of traffic statistics characteristic information is very small, and only reliable transmission needs to be ensured.

[0188] The control plane control module 104 can dynamically update the register value described above and send it to the data plane control module 106. The data plane control module 106 can control the front and back switching of the traffic counter 100 to align with the front and back switching of the first packet detector in the key message detection module 1011 based on the received register value. The control plane control module 104 can also control the storage space of the background traffic counter 100 and the background first packet detector to be cleared based on the register value.

[0189] The analysis system cluster 105 may perform the operations described above related to determining network measurement results based on flow identifiers and traffic statistics feature information. The secondary compression module 1014 may communicate with the analysis cluster system 105 via a high-level network.

[0190] By adopting the network measurement system as described above, both expected and unknown flow identifiers can be detected, thereby achieving full acquisition of flow identifiers and improving the accuracy of network measurement. In addition, the full acquisition method of flow identifiers disclosed in the present invention does not need to rely on other systems.

[0191] The present disclosure also provides a computer-readable medium having a computer program stored thereon, which implements the steps of any method described in the present disclosure when the program is executed by a processing device.

[0192] The present disclosure also provides an electronic device, comprising:

[0193] a storage device having at least one computer program stored thereon;

[0194] At least one processing device is used to execute the at least one computer program in the storage device to implement the steps of any method described in the present disclosure.

[0195] The present disclosure also provides a computer program product, comprising a computer program, which implements the steps of any one of the methods of the present disclosure when executed by a processor.

[0196] Reference below Fig.14 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.14 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0197] like Fig.14 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0198] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.14 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0199] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0200] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0201] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0202] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0203] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: detects the traffic statistical characteristic information of the flow to be measured; detects the key message of the flow to be measured, and obtains the flow identifier of the flow to be measured, wherein the key message is a message that can identify the flow to be measured; and determines the network measurement result based on the traffic statistical characteristic information and the flow identifier.

[0204] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0205] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0206] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, a traffic counter may also be described as a "module for detecting traffic statistical feature information of a flow to be measured".

[0207] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0208] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0209] According to one or more embodiments of the present disclosure, Example 1 provides a network measurement method, including: detecting traffic statistical characteristic information of a flow to be measured; detecting key messages of the flow to be measured to obtain a flow identifier of the flow to be measured, wherein the key messages are messages that can identify the flow to be measured; and determining a network measurement result based on the traffic statistical characteristic information and the flow identifier.

[0210] According to one or more embodiments of the present disclosure, Example 2 provides the network measurement method of Example 1, wherein the detecting the key message of the flow to be measured to obtain the flow identifier of the flow to be measured includes: determining whether there is a preset feature in the flow to be measured; if it is determined that the preset feature exists in the flow to be measured, then using the message containing the preset feature as the key message of the flow to be measured to obtain the flow identifier of the flow to be measured; if it is determined that the preset feature does not exist in the flow to be measured, then detecting the first packet of the flow to be measured within a period of time as the key message of the flow to be measured to obtain the flow identifier of the flow to be measured.

[0211] According to one or more embodiments of the present disclosure, Example 3 provides the network measurement method of Example 2, wherein the detecting the key message of the flow to be measured to obtain the flow identifier of the flow to be measured also includes: if it is determined that the preset feature exists in the flow to be measured, the first packet of the flow to be measured within a period of time is also detected as the key message of the flow to be measured to obtain the flow identifier of the flow to be measured.

[0212] According to one or more embodiments of the present disclosure, Example 4 provides the network measurement method of Example 2 or 3, wherein the detecting of the key messages of the flow to be measured and obtaining the flow identifier of the flow to be measured also includes: obtaining the flow size information in the traffic statistical feature information; based on the flow size information, determining whether the flow to be measured is an extra-large flow, wherein the extra-large flow is a flow whose flow size is greater than or equal to a first threshold; if it is determined that the flow to be measured is the extra-large flow, obtaining a summary of the flow to be measured as the flow identifier of the flow to be measured.

[0213] According to one or more embodiments of the present disclosure, Example 5 provides the network measurement method of Example 4, wherein the detecting the key messages of the flow to be measured to obtain the flow identifier of the flow to be measured also includes: if it is determined that the flow to be measured is a large flow, using the first packet detector for the large flow to detect the first packet within the period of time to obtain the flow identifier of the flow to be measured; if it is determined that the flow to be measured is a small flow, using the first packet detector for the small flow to detect the first packet within the period of time to obtain the flow identifier of the flow to be measured, wherein the large flow is a flow whose flow size is less than the first threshold but greater than or equal to the second threshold, and the small flow is a flow whose flow size is less than the second threshold.

[0214] According to one or more embodiments of the present disclosure, Example 6 provides the network measurement method of Example 2 or 3, wherein the detecting the key message of the flow to be measured to obtain the flow identifier of the flow to be measured further includes: after detecting the key message, mirroring the key message to obtain a mirror message; compressing the mirror message to obtain the flow identifier of the flow to be measured.

[0215] According to one or more embodiments of the present disclosure, Example 7 provides the network measurement method of Example 5, wherein compressing the mirror message includes: removing the payload in the mirror message to obtain a trimmed message; and combining the header information of multiple trimmed messages into a single header.

[0216] According to one or more embodiments of the present disclosure, Example 8 provides the network measurement method of Example 7, wherein the compressing the mirrored message further includes: extracting the packet header from the single packet header on demand; for key messages detected within a preset time period, deduplicating the trimmed messages corresponding to the extracted packet headers to obtain deduplicated messages.

[0217] According to one or more embodiments of the present disclosure, Example 9 provides the network measurement method of Example 8, wherein compressing the mirror message further includes: processing the deduplicated message into a message in a preset format.

[0218] According to one or more embodiments of the present disclosure, Example 10 provides the network measurement method of Example 5, wherein the network measurement method further includes: controlling the foreground and background switching period between the foreground traffic counter and the background traffic counter to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the foreground traffic counter is a traffic counter working in the foreground to detect the traffic statistical characteristic information of the flow to be measured, the background traffic counter is a traffic counter working in the background to read the traffic statistical characteristic information stored therein, the foreground first packet detector is a first packet detector working in the foreground to detect the first packet within the period of time, and the background first packet detector is a first packet detector working in the background to clear the storage space therein.

[0219] According to one or more embodiments of the present disclosure, Example 11 provides the network measurement method of Example 10, wherein the foreground and background switching period between the foreground traffic counter and the background traffic counter is controlled in an integer multiple relationship with the foreground and background switching period between the foreground first packet detector and the background first packet detector, including: using the values ​​of some bits in the register to control the foreground and background switching period between the foreground traffic counter and the background traffic counter; using the values ​​of the remaining bits in the register to control the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the change period of the values ​​of the some bits is controlled in an integer multiple relationship with the change period of the values ​​of the remaining bits.

[0220] According to one or more embodiments of the present disclosure, Example 12 provides the network measurement method of Example 11, wherein the network measurement method further includes: carrying a current traffic statistics index value in the flow identifier, wherein the current traffic statistics index value is the current value of the partial bits; and carrying a previous traffic statistics index value of the current traffic statistics index value in the traffic statistics feature information being read, wherein the previous traffic statistics index value of the current traffic statistics index value is the previous value of the current value of the partial bits.

[0221] According to one or more embodiments of the present disclosure, Example 13 provides the network measurement method of Example 12, wherein the network measurement result is determined based on the traffic statistical characteristic information and the flow identifier, including: broadcasting the traffic statistical characteristic information carrying the traffic statistical index value to all task processing units; allocating a flow identifier carrying the traffic statistical index value to each task processing unit based on the resources of each task processing unit; and each task processing unit determines the network measurement result based on the allocated flow identifier and the traffic statistical characteristic information having the same traffic statistical index value as the allocated flow identifier.

[0222] According to one or more embodiments of the present disclosure, Example 14 provides a network measurement device, including: a traffic counter, used to detect traffic statistical characteristic information of the flow to be measured; a flow identification acquisition module, used to detect the key message of the flow to be measured and obtain the flow identification of the flow to be measured, wherein the key message is a message that can identify the flow to be measured; a determination module, used to determine the network measurement result based on the traffic statistical characteristic information and the flow identification.

[0223] According to one or more embodiments of the present disclosure, Example 15 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-13 when executed by a processing device.

[0224] According to one or more embodiments of the present disclosure, Example 16 provides an electronic device, comprising: a storage device on which at least one computer program is stored; and at least one processing device for executing the at least one computer program in the storage device to implement the steps of any one of the methods described in Examples 1-13.

[0225] According to one or more embodiments of the present disclosure, Example 17 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1 to 13 when executed by a processor.

[0226] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0227] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0228] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A network measurement method, characterized in that: include: Detecting traffic statistics characteristic information of the flow to be measured; Detecting a key message of the flow to be measured to obtain a flow identifier of the flow to be measured, wherein the key message is a message that can identify the flow to be measured; A network measurement result is determined based on the traffic statistical feature information and the flow identifier.

2. The network measurement method according to claim 1, characterized in that: The detecting the key message of the flow to be measured to obtain the flow identifier of the flow to be measured includes: Determining whether there is a preset feature in the flow to be measured; If it is determined that the preset feature exists in the flow to be measured, the message containing the preset feature is used as a key message of the flow to be measured, and the flow identifier of the flow to be measured is obtained; If it is determined that the preset feature does not exist in the flow to be measured, the first packet of the flow to be measured within a period of time is detected as a key message of the flow to be measured, and the flow identifier of the flow to be measured is obtained.

3. The network measurement method according to claim 2, characterized in that: The detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured further includes: If it is determined that the preset feature exists in the flow to be measured, the first packet of the flow to be measured within a period of time is further detected as a key message of the flow to be measured, and the flow identifier of the flow to be measured is obtained.

4. The network measurement method according to claim 2 or 3, characterized in that: The detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured further includes: Obtaining flow size information from the flow statistical feature information; Based on the flow size information, determining whether the flow to be measured is an ultra-large flow, wherein the ultra-large flow is a flow whose flow size is greater than or equal to a first threshold; If it is determined that the flow to be measured is the super large flow, a summary of the flow to be measured is obtained as a flow identifier of the flow to be measured.

5. The network measurement method according to claim 4, characterized in that: The detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured further includes: If it is determined that the flow to be measured is a large flow, a first packet detector for the large flow is used to detect a first packet within the period of time to obtain a flow identifier of the flow to be measured; If it is determined that the flow to be measured is a small flow, a first packet detector for the small flow is used to detect the first packet within the period of time to obtain the flow identifier of the flow to be measured, wherein the large flow is a flow whose flow size is less than the first threshold but greater than or equal to the second threshold, and the small flow is a flow whose flow size is less than the second threshold.

6. The network measurement method according to claim 2 or 3, characterized in that: The detecting the key message of the flow to be measured and obtaining the flow identifier of the flow to be measured further includes: After detecting the key message, mirroring the key message to obtain a mirrored message; The mirrored message is compressed to obtain a flow identifier of the flow to be measured.

7. The network measurement method according to claim 6, characterized in that: The compressing the mirror message includes: Removing the payload from the mirrored message to obtain a trimmed message; The packet header information of the plurality of clipped messages is combined into a single packet header.

8. The network measurement method according to claim 7, characterized in that: The compressing the mirrored message further includes: Extracting a packet header from the single packet header as needed; For key messages detected within a preset time period, duplicated messages corresponding to the extracted packet headers are deduplicated to obtain deduplicated messages.

9. The network measurement method according to claim 8, characterized in that: The compressing the mirrored message further includes: The deduplicated messages are processed into messages in a preset format.

10. The network measurement method according to claim 5, characterized in that: The network measurement method further includes: The foreground and background switching period between the foreground traffic counter and the background traffic counter is controlled to be an integer multiple of the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the foreground traffic counter is a traffic counter working in the foreground to detect the traffic statistical characteristic information of the flow to be measured, the background traffic counter is a traffic counter working in the background to read the traffic statistical characteristic information stored therein, the foreground first packet detector is a first packet detector working in the foreground to detect the first packet within the period of time, and the background first packet detector is a first packet detector working in the background to clear the storage space therein.

11. The network measurement method according to claim 10, characterized in that: The control of the foreground and background switching period between the foreground traffic counter and the background traffic counter and the foreground and background switching period between the foreground first packet detector and the background first packet detector to be an integer multiple relationship includes: Using the values ​​of some bits in the register to control the foreground and background switching period between the foreground traffic counter and the background traffic counter; The values ​​of the remaining bits in the register are used to control the foreground and background switching period between the foreground first packet detector and the background first packet detector, wherein the change period of the values ​​of some bits is an integer multiple of the change period of the values ​​of the remaining bits.

12. The network measurement method according to claim 11, characterized in that: The network measurement method further includes: Carrying a current traffic statistics index value in the flow identifier, wherein the current traffic statistics index value is a current value of the partial bits; and The traffic statistics characteristic information read carries a traffic statistics index value previous to the current traffic statistics index value, wherein the traffic statistics index value previous to the current traffic statistics index value is a value previous to the current value of the partial bits.

13. The network measurement method according to claim 12, characterized in that: The determining of the network measurement result based on the traffic statistical feature information and the flow identifier includes: Broadcasting the traffic statistics feature information carrying the traffic statistics index value to all task processing units; Allocating a flow identifier carrying the traffic statistics index value to each of the task processing units according to the resources of each of the task processing units; Each of the task processing units determines a network measurement result according to the allocated flow identifier and the traffic statistics feature information having the same traffic statistics index value as the allocated flow identifier.

14. A network measurement device, characterized in that: include: A flow counter, used to detect flow statistics characteristic information of the flow to be measured; A flow identification acquisition module, used to detect the key message of the flow to be measured, and obtain the flow identification of the flow to be measured, wherein the key message is a message that can identify the flow to be measured; The determination module is used to determine the network measurement result based on the traffic statistical feature information and the flow identifier.

15. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processing device, the steps of the method described in any one of claims 1 to 13 are implemented.

16. An electronic device, characterized in that: include: a storage device having at least one computer program stored thereon; At least one processing device, configured to execute the at least one computer program in the storage device to implement the steps of the method according to any one of claims 1 to 13.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 13 are implemented.

Images