Traffic telemetering method and device, computer equipment and storage medium
By introducing traffic statistics registers and matching rule sequence numbers into network equipment, real-time and efficient traffic statistics are achieved, solving the problems of high computational complexity and poor real-time performance in traditional methods, and improving the integrity and accuracy of traffic statistics.
Patent Information
- Application Number
- CN202411486386.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-23
- Publication Date
- 2025-01-24
AI Technical Summary
Traditional network equipment has high computational complexity and poor real-time performance in traffic statistics, especially in high traffic scenarios, which may lead to data loss and affect statistical accuracy.
By introducing traffic statistics registers and matching rule sequence numbers into network devices, real-time statistics of traffic packets are achieved. Specific steps include responding to traffic packets, filtering matching rules, sending statistical information to the corresponding storage area, and attaching timestamps for real-time statistics when necessary.
A significant reduction of calculation complexity, improving the processing efficiency, ensuring real -time statistics, reducing the risk of data loss, thereby improving the integrity and accuracy of traffic statistics.
Smart Images
Figure CN119363632A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of communication technology, and in particular to a flow telemetry method, device, computer equipment and storage medium. Background Art
[0002] With the rapid growth of network traffic, traffic statistics have become a key link in network management. Traditional network equipment manufacturers usually rely on upper-layer protocols to periodically request data from underlying hardware for traffic statistics. For example, traditional routers and switches collect statistical information through protocols such as SNMP (Simple Network Management Protocol).
[0003] However, the above method has several disadvantages: First, the acquisition of statistical data is limited by the frequency of upper-layer requests, resulting in poor real-time performance and possible statistical delays. Second, in high-traffic scenarios, upper-layer requests may cause data loss, affecting statistical accuracy. In addition, when processing large amounts of data, there are problems of high computational complexity and low processing efficiency. Summary of the invention
[0004] In view of this, the present disclosure proposes a flow telemetry method, apparatus, computer equipment and storage medium to solve the problems of high computational complexity and poor real-time performance of flow statistics in related technologies.
[0005] The first aspect of the present disclosure provides a flow telemetry method, the method comprising:
[0006] In response to receiving a traffic data packet, screening out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules;
[0007] Sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to a traffic statistics register, so that the traffic statistics register stores the traffic statistics information in a storage area corresponding to the first sequence number; the traffic statistics register includes a plurality of storage areas corresponding to a plurality of first sequence numbers one by one;
[0008] The target traffic statistics information in at least one storage area is read, and the target traffic statistics information and a timestamp of the current time are sent to a traffic statistics device, so that the traffic statistics device performs traffic statistics according to the target traffic statistics information and the timestamp.
[0009] The embodiment of the present disclosure establishes a correspondence between matching rules, storage areas and control messages through sequence numbers, and the above correspondence can significantly reduce the computational complexity when processing a large amount of data for traffic statistics, thereby improving the overall processing efficiency. In addition, by introducing a timestamp when sending a control message, the purpose of real-time statistics can be achieved to ensure that the network status is reflected in a timely manner.
[0010] The disclosed embodiment eliminates the risk of data loss and improves the integrity of traffic statistics by sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to the traffic statistics register, so that the traffic statistics register stores the traffic statistics information in the storage area corresponding to the first sequence number.
[0011] In the embodiment of the present disclosure, sending the target traffic statistics information and the timestamp of the current time to the traffic statistics device includes:
[0012] Loading the target traffic statistics information and the timestamp of the current time into the carrier field of the corresponding control message to obtain the target control message;
[0013] The target control message is sent to the traffic statistics device.
[0014] In the embodiment of the present disclosure, before filtering out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules, the method further includes:
[0015] A plurality of first control messages are generated in advance, each of which includes a second sequence number and a carrier field; wherein the plurality of second sequence numbers of the plurality of first control messages correspond one-to-one to the plurality of first sequence numbers.
[0016] In the embodiment of the present disclosure, the corresponding control message is a second control message, and the target traffic statistical information corresponds to a target first sequence number; the target traffic statistical information and a timestamp of the current time are loaded into a carrier field of the corresponding control message to obtain a target control message, including:
[0017] Filter out a target second sequence number corresponding to the target first sequence number from the plurality of second sequence numbers;
[0018] Using the first control message where the target second sequence number is located among the multiple first control messages as the second control message;
[0019] The target traffic statistics information and the timestamp of the current time are loaded into the carrier field of the second control message to obtain the target control message.
[0020] In the embodiment of the present disclosure, before filtering out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules, the method further includes:
[0021] Predefine a plurality of matching rules, wherein the plurality of matching rules define attribute information of different traffic data packets;
[0022] A corresponding first sequence number is assigned to each matching rule.
[0023] In an embodiment of the present disclosure, reading target traffic statistics information in at least one storage area includes:
[0024] Receiving an information reading instruction sent by a user terminal; the information reading instruction includes a sub-target first sequence number of at least one storage area to be read;
[0025] Filter out at least one target storage area corresponding to at least one sub-target first serial number from the plurality of storage areas;
[0026] Read traffic statistics in each target storage area.
[0027] In an embodiment of the present disclosure, the attribute information of the traffic data packet includes at least one of an IP address, a port number, a network protocol, a time range, and a user identity.
[0028] The second aspect of the present disclosure provides a flow remote sensing device, including:
[0029] A rule matching module, configured to, in response to receiving a traffic data packet, screen out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules;
[0030] An information storage module, used for sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to a traffic statistics register, so that the traffic statistics register stores the traffic statistics information in a storage area corresponding to the first sequence number; the traffic statistics register includes a plurality of storage areas corresponding to a plurality of first sequence numbers one by one;
[0031] The traffic statistics module is used to read the target traffic statistics information in at least one storage area, and send the target traffic statistics information and a timestamp of the current time to the traffic statistics device, so that the traffic statistics device performs traffic statistics according to the target traffic statistics information and the timestamp.
[0032] An embodiment of the third aspect of the present disclosure provides an electronic device, which includes a memory and a processor, wherein the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the flow telemetry method described in the first aspect by executing the computer instructions.
[0033] An embodiment of the fourth aspect of the present disclosure provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to execute the flow telemetry method described in the first aspect.
[0034] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will become apparent from the following description or be learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] By reading the detailed description of the preferred embodiment below, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only used for the purpose of illustrating the preferred embodiment and are not considered to be limitations of the present disclosure. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings.
[0036] In the attached picture:
[0037] Figure 1 A flow chart of a flow telemetry method provided by an embodiment of the present disclosure is shown;
[0038] Figure 2 A flow chart of another flow telemetry method provided by an embodiment of the present disclosure is shown;
[0039] Figure 3 A schematic structural diagram of a flow remote sensing device provided by an embodiment of the present disclosure is shown;
[0040] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure is shown;
[0041] Figure 5 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION
[0042] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0043] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in the present disclosure should have the common meanings understood by those skilled in the art to which the present disclosure belongs.
[0044] The following describes the technical scenarios involved in the embodiments of the present disclosure.
[0045] In order to solve the limitations of the traditional flow telemetry method in the background technology, the present invention proposes a flow statistics method based on P4 programmable switch. The method makes full use of the flexible programming capabilities of P4 programmable switch to achieve flow statistics in an efficient and real-time manner. Compared with the prior art, the present invention has the following novelties and advantages:
[0046] 1. Efficiency: Traffic statistics are directly implemented at the hardware level, avoiding the high computational complexity and low efficiency of traditional software solutions, making data processing faster.
[0047] 2. High precision: Supports nanosecond-level traffic statistics, which can effectively identify micro-burst traffic, provide more accurate data support for network management, and improve the sensitivity of traffic monitoring.
[0048] 3. Scalability: By decoupling the traffic statistics device from the switch, statistical processing can be performed independently of the hardware, thus bringing stronger statistical capabilities and flexibility. This not only improves statistical accuracy, but also allows for easy adaptation and expansion in different network environments.
[0049] The present invention is intended to provide an efficient, reliable and flexible traffic telemetry method for modern networks (telemetry can be understood as a process of first counting traffic and then transmitting it, such as steps S101 to S103 in the following embodiments), thereby improving the utilization of network resources, reducing network operating costs, and improving overall network performance.
[0050] According to an embodiment of the present disclosure, a flow telemetry method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0051] In this embodiment, a flow telemetry method is provided, which can be used in a switch (such as a P4 programmable switch). Figure 1 is a flow chart of a flow telemetry method according to an embodiment of the present disclosure, such as Figure 1 As shown, the process includes the following steps:
[0052] Step S101, in response to receiving a traffic data packet, screening out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules.
[0053] In the disclosed embodiment, when the switch receives a data packet of network traffic sent from the outside, it will filter out a target matching rule that matches the attribute information (also called traffic type) of the data packet from the predefined multiple matching rules. For example, if the IP address of a data packet matches the IP address defined by matching rule A, then matching rule A can be used as the target matching rule.
[0054] In some specific embodiments, the attribute information of the above-mentioned traffic data packet includes at least one of an IP address, a port number, a network protocol, a time range, and a user identity.
[0055] Before the above step S101, the method further includes steps a1 and a2:
[0056] Step a1, pre-defining a plurality of matching rules, wherein the plurality of matching rules define attribute information of different traffic data packets;
[0057] In the disclosed embodiment, the predefined matching rule can be understood as an ACL (Access Control List) rule, which is used to classify packets of network traffic based on various attribute information. The matching rule can allow or deny packets of specific network traffic based on various attribute information.
[0058] Step a2: assign a corresponding first serial number to each matching rule.
[0059] In the embodiment of the present disclosure, a corresponding number of first sequence numbers can be allocated according to the number of predefined matching rules. For example, 1000 matching rules are generated, the first sequence numbers include 1-1000, matching rule 1 corresponds to the first sequence number 1, matching rule 2 corresponds to the first sequence number 2... matching rule 1000 corresponds to the first sequence number 1000, and so on.
[0060] Step S102: Send the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to a traffic statistics register, so that the traffic statistics register stores the traffic statistics information in a storage area corresponding to the first sequence number.
[0061] In the embodiment of the present disclosure, the traffic statistics register will store the traffic statistics information in the corresponding storage area according to the first serial number corresponding to the target matching rule. For example, when the first serial number corresponding to the target matching rule is 55, the traffic statistics information will be stored in the storage area corresponding to 55.
[0062] In some specific embodiments, the traffic statistics register includes multiple storage areas corresponding to multiple first sequence numbers. For example, when there are 1000 first sequence numbers, there are 1000 storage areas in the traffic statistics register, where storage area 1 corresponds to first sequence number 1, storage area 2 corresponds to first sequence number 2, ... storage area 1000 corresponds to first sequence number 1000, and so on.
[0063] Step S103, reading target traffic statistics information in at least one storage area, and sending the target traffic statistics information and a timestamp of the current time to a traffic statistics device, so that the traffic statistics device performs traffic statistics according to the target traffic statistics information and the timestamp.
[0064] In some specific embodiments, the target traffic statistics information in at least one storage area can be read automatically in real time, or the traffic statistics information of a specific storage area can be read according to the instruction of the user end. For example: receiving an information reading instruction sent by the user end; the information reading instruction includes the first sub-target sequence number of at least one storage area to be read; screening out at least one target storage area corresponding to the first sub-target sequence number of at least one storage area from the multiple storage areas; reading the traffic statistics information in each target storage area.
[0065] In some specific embodiments, before the above step S101, the method further includes:
[0066] A plurality of first control messages are generated in advance.
[0067] In a disclosed embodiment, each first control message includes a second sequence number and a carrier field; wherein, the multiple second sequence numbers of the multiple first control messages correspond one-to-one to the multiple first sequence numbers. For example, when there are 1000 first sequence numbers, i.e., 1-1000, 1000 first control messages need to be generated in advance, and the first control message 1 includes the second sequence number 1, the first control message 2 includes the second sequence number 2... the first control message 1000 includes the second sequence number 1000; wherein, the second sequence number 1 corresponds to the first sequence number 1, the second sequence number 2 corresponds to the first sequence number 2, the second sequence number 1000 corresponds to the first sequence number 1000, and so on.
[0068] In some specific embodiments, the above step S103 includes steps S1031 to S1021:
[0069] Step S1031, loading the target traffic statistics information and the timestamp of the current time into the carrier field of the corresponding control message to obtain the target control message.
[0070] In some specific embodiments, the corresponding control message is a second control message, and the target traffic statistical information corresponds to a target first sequence number; the above step S1031 includes steps b1 to b:3:
[0071] Step b1, selecting a target second sequence number corresponding to the target first sequence number from the multiple second sequence numbers.
[0072] In the disclosed embodiment, the target first sequence number refers to the first sequence number corresponding to the target traffic statistics information read from the storage area. According to the target first sequence number, the corresponding target second sequence number can be screened from multiple second sequence numbers. For example, when the target first sequence number is 55, it is necessary to screen out the target second sequence number that is 55 from multiple second sequence numbers.
[0073] Step b2: Use the first control message in which the target second sequence number is located among the multiple first control messages as the second control message.
[0074] In the disclosed embodiment, the second control message can be screened out from multiple first control messages based on the target second sequence number. For example, when the target second sequence number is 55, it is necessary to screen out the first control message containing the second sequence number of 55 from the multiple first control messages as the second control message.
[0075] Step b3: Load the target traffic statistics information and the timestamp of the current time into the carrier field of the second control message to obtain the target control message.
[0076] Step S1032: Send the target control message to the traffic statistics device.
[0077] In the embodiment of the present disclosure, after receiving the target control message, the traffic statistics device performs traffic statistics according to the traffic statistics information in the target control message and the timestamp.
[0078] The disclosed embodiment establishes a correspondence between matching rules, storage areas and control messages through serial numbers. The above correspondence can significantly reduce the computational complexity and improve the overall processing efficiency when processing a large amount of data for traffic statistics.
[0079] The disclosed embodiment can achieve the purpose of real-time statistics by introducing a timestamp when sending a control message, so as to ensure that the network status is reflected in a timely manner.
[0080] The disclosed embodiment eliminates the risk of data loss and improves the integrity of traffic statistics by sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to the traffic statistics register, so that the traffic statistics register stores the traffic statistics information in the storage area corresponding to the first sequence number.
[0081] Corresponding to the implementation of the above flow telemetry method, the present disclosure also provides a specific embodiment, such as Figure 2 As shown, the details are as follows:
[0082] Control message generation module: A component used to generate control messages in the present invention, which can effectively transmit management and control information.
[0083] ACL matching rule module: used in the present invention to generate a hit ID by defining specific rules.
[0084] Traffic Statistics Register: Obtain traffic statistics information and transmit traffic statistics for telemetry purposes.
[0085] Timestamp generation module: Generates the timestamp of the current moment and loads the timestamp into the corresponding storage pool, and transmits it to the backend for processing.
[0086] Specific implementation steps:
[0087] In the control message generation module, configure the corresponding control message type and message sequence ID. In this example, it is assumed that the message sequence ID is 1-1000 and generate the corresponding carrier field.
[0088] In the ACL matching rule module, configure the required matching rules and the statistical ID after matching. This example assumes that there are 1000 ACL rules and the matching IDs are 1-1000.
[0089] The hit ID is used as the ID index of the traffic statistics register, and then the traffic statistics register writes the information of the traffic to be counted, and generates an index ID of 1-1000.
[0090] The control message generation module of ASIC is triggered to read the flow statistics register accordingly, and the control message sequence ID is used as the index ID of the flow statistics register, and the corresponding field in the control message is used as the carrier of the statistical information, thereby realizing the telemetry of the statistical information.
[0091] The timestamp generation module is triggered so that the timestamp generation module can load the timestamp (nanosecond level) of the current moment into the corresponding field of the control message, and then transmit it to the back-end processing together with the above statistical information.
[0092] The technical effects of the embodiments of the present disclosure are:
[0093] 1. No consumption of CPU resources: Flexible decoupling capability enables the decoupling design of the management plane and statistical functions in the present invention, and multi-core servers can be easily used to complete rate statistics. Control messages are generated in batches through the flow generation module of ASIC, and a message generation rate of 1 million per second can be easily achieved. More importantly, thanks to the line-speed processing performance of the chip, these 1 million messages can be sent to the back-end analysis equipment at line speed. This innovative method not only significantly improves the efficiency of data statistics, but also makes full use of the high-performance characteristics of ASIC chips, providing more real-time and accurate data support for network monitoring and analysis, and showing huge application potential in complex network environments, without consuming too many CPU resources.
[0094] 2. High-precision telemetry statistics: The statistical time and statistical data are directly marked into the message by the ASIC chip, thus avoiding the delay between the upper statistical time and the actual underlying statistical time caused by periodically reading the underlying counter data through the PCIE channel and other methods. In addition, since the minimum time scale of the ASIC chip is nanoseconds, it can achieve nanosecond-level statistics that are much higher than the microsecond level of the conventional Linux kernel, thereby achieving high-precision and high-real-time statistical telemetry of the data plane.
[0095] Corresponding to the implementation of the above flow telemetry method, the present disclosure also provides a flow telemetry device for executing the above Figure 1 to Figure 2 The flow telemetry method described in any of the embodiments shown in the figure. Figure 3 As shown, the flow remote sensing device includes:
[0096] A rule matching module, configured to, in response to receiving a traffic data packet, screen out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules;
[0097] An information storage module, used for sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to a traffic statistics register, so that the traffic statistics register stores the traffic statistics information in a storage area corresponding to the first sequence number; the traffic statistics register includes a plurality of storage areas corresponding to a plurality of first sequence numbers one by one;
[0098] The traffic statistics module is used to read the target traffic statistics information in at least one storage area, and send the target traffic statistics information and a timestamp of the current time to the traffic statistics device, so that the traffic statistics device performs traffic statistics according to the target traffic statistics information and the timestamp.
[0099] Optionally, the traffic statistics module is further used to: load the target traffic statistics information and the timestamp of the current time into the carrier field of the corresponding control message to obtain the target control message; and send the target control message to the traffic statistics device.
[0100] Optionally, the device also includes: a first control message generation module, used to pre-generate multiple first control messages, each first control message includes a second sequence number and a carrier field; wherein the multiple second sequence numbers of the multiple first control messages correspond one-to-one to the multiple first sequence numbers.
[0101] Optionally, the traffic statistics module is also used to: filter out the target second sequence number corresponding to the target first sequence number from the multiple second sequence numbers; use the first control message in the multiple first control messages where the target second sequence number is located as the second control message; load the target traffic statistics information and the timestamp of the current time into the carrier field of the second control message to obtain the target control message.
[0102] Optionally, the device also includes: a rule predefinition module, used to predefine multiple matching rules, wherein the multiple matching rules define attribute information of different traffic data packets; and assign a corresponding first serial number to each matching rule.
[0103] Optionally, the traffic statistics module is also used to: receive an information reading instruction sent by a user terminal; the information reading instruction includes a sub-target first serial number of at least one storage area to be read; filter out at least one target storage area corresponding one-to-one to at least one sub-target first serial number from the multiple storage areas; and read the traffic statistics information in each target storage area.
[0104] The flow telemetry device provided by the above-mentioned embodiment of the present disclosure and the flow telemetry method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.
[0105] The present disclosure also provides an electronic device to perform the above-mentioned flow telemetry method. Figure 4 , which shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure. Figure 4 As shown, the electronic device 4 includes: a processor 400, a memory 401, a bus 402 and a communication interface 403, wherein the processor 400, the communication interface 403 and the memory 401 are connected via the bus 402; the memory 401 stores a computer program that can be run on the processor 400, and the processor 400 executes the aforementioned Figure 1 to Figure 2 A flow telemetry method is provided in any of the illustrated embodiments.
[0106] The memory 401 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 403 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.
[0107] The bus 402 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 401 is used to store programs. After receiving the execution instruction, the processor 400 executes the program. Figure 1 to Figure 2 The flow telemetry method disclosed in any of the illustrated embodiments may be applied to the processor 400 or implemented by the processor 400 .
[0108] The processor 400 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 400 or the instruction in the form of software. The above processor 400 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor to be executed, or a combination of hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 401, and the processor 400 reads the information in the memory 401 and completes the steps of the above method in combination with its hardware.
[0109] The electronic device provided by the embodiment of the present disclosure and the flow telemetry method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented by them.
[0110] The present disclosure also provides a computer-readable storage medium corresponding to the flow telemetry method provided in the above embodiment. Figure 5 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, it executes the flow telemetry method provided by any of the aforementioned embodiments.
[0111] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.
[0112] The computer-readable storage medium provided by the above-mentioned embodiments of the present disclosure and the flow telemetry method provided by the embodiments of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.
[0113] It should be noted that:
[0114] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present disclosure can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.
[0115] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present disclosure, the various features of the present disclosure are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following schematic diagram: the claimed disclosure requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, the inventive aspects lie in less than all the features of the single embodiment disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present disclosure.
[0116] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of this disclosure and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.
[0117] The above is only a preferred specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.
Claims
1. A flow remote sensing method, characterized in that: The method comprises: In response to receiving a traffic data packet, screening out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules; Sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to a traffic statistics register, so that the traffic statistics register stores the traffic statistics information in a storage area corresponding to the first sequence number; the traffic statistics register includes a plurality of storage areas corresponding to a plurality of first sequence numbers one by one; The target traffic statistics information in at least one storage area is read, and the target traffic statistics information and a timestamp of the current time are sent to a traffic statistics device, so that the traffic statistics device performs traffic statistics according to the target traffic statistics information and the timestamp.
2. The method according to claim 1, characterized in that Sending the target traffic statistics information and the timestamp of the current time to the traffic statistics device includes: Loading the target traffic statistics information and the timestamp of the current time into the carrier field of the corresponding control message to obtain the target control message; The target control message is sent to the traffic statistics device.
3. The method according to claim 2, characterized in that Before selecting a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules, the method further includes: A plurality of first control messages are generated in advance, each of which includes a second sequence number and a carrier field; wherein the plurality of second sequence numbers of the plurality of first control messages correspond one-to-one to the plurality of first sequence numbers.
4. The method according to claim 3, characterized in that The corresponding control message is a second control message, and the target traffic statistics information corresponds to a target first sequence number; Loading the target traffic statistics information and the timestamp of the current time into the carrier field of the corresponding control message to obtain the target control message, including: Filter out a target second sequence number corresponding to the target first sequence number from the plurality of second sequence numbers; Using the first control message where the target second sequence number is located among the multiple first control messages as the second control message; The target traffic statistics information and the timestamp of the current time are loaded into the carrier field of the second control message to obtain the target control message.
5. The method according to claim 1 or 2, characterized in that: Before selecting a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules, the method further includes: Predefine a plurality of matching rules, wherein the plurality of matching rules define attribute information of different traffic data packets; A corresponding first sequence number is assigned to each matching rule.
6. The method according to claim 1 or 2, characterized in that: Read target traffic statistics in at least one storage area, including: Receiving an information reading instruction sent by a user terminal; the information reading instruction includes a sub-target first sequence number of at least one storage area to be read; Filter out at least one target storage area corresponding to at least one sub-target first serial number from the plurality of storage areas; Read traffic statistics in each target storage area.
7. The method according to claim 1 or 2, characterized in that: The attribute information of the traffic data packet includes at least one of an IP address, a port number, a network protocol, a time range, and a user identity.
8. A flow remote sensing device, characterized in that: The device comprises: A rule matching module, configured to, in response to receiving a traffic data packet, screen out a target matching rule that matches the attribute information of the traffic data packet from a plurality of matching rules; An information storage module, used for sending the first sequence number corresponding to the target matching rule and the traffic statistics information of the traffic data packet to a traffic statistics register, so that the traffic statistics register stores the traffic statistics information in a storage area corresponding to the first sequence number; the traffic statistics register includes a plurality of storage areas corresponding to a plurality of first sequence numbers one by one; The traffic statistics module is used to read the target traffic statistics information in at least one storage area, and send the target traffic statistics information and a timestamp of the current time to the traffic statistics device, so that the traffic statistics device performs traffic statistics according to the target traffic statistics information and the timestamp.
9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the flow telemetry method according to any one of claims 1 to 7 by executing the computer instructions.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the flow telemetry method according to any one of claims 1 to 7.