Network traffic collection method, system, device and medium for multimodal networks

Abstract

The present application discloses a network traffic collection method, system, device, and medium for a multimodal network, relating to the technical field of network traffic collection. The method includes: forwarding a new modality description file to a programmable network node and a traffic analysis server via a controller; generating a forwarding program based on the new modality description file via the programmable network node and notifying the controller; creating a parsing field structure based on the new modality description file and creating a new statistical table via the traffic analysis server and notifying the controller; after the controller receives notification messages from the programmable network node and the traffic analysis server, issuing an update configuration instruction to the programmable network node in the new modality description file via the controller, causing the traffic analysis server to parse the newly recorded data sent by the programmable network node using the parsing field structure and store the parsed data in a new statistical table. The method enables flexible collection of network traffic.

Description

Technical Field

[0001] The present application relates to the technical field of network traffic collection, and in particular to a network traffic collection method, system, device, and medium for multimodal networks. Background Art

[0002] sFlow is a network monitoring technology jointly developed by three network equipment vendors: HP, InMon, and Foundry. It uses push technology to send reports to collectors and has established a standard network export protocol (RFC3176). This technology uses built-in chips rather than software-based technology, which eliminates the CPU and memory burden on devices. Furthermore, by embedding agents into routers or switches, sFlow can monitor and obtain basic network data information from large and ultra-large networks 24 hours a day, providing data for comprehensive network security analysis.

[0003] New Modal Networks aim to overcome the bottleneck in network service efficiency caused by the single IP bearer, addressing the mismatch between content location, geographic location, and identity location and IP identifiers. Drawing on the National Key R&D Program "Multimodal Intelligent Network Control Technology and System for Co-management and Co-governance," Academician Wu Jiangxing's team proposed a "Fully Dimensionally Defined Multimodal Intelligent Network PINet" for multimodal presentation at all network layers. This network system aims to transform traditional single-baseline technologies to meet the expansion of new addressing and routing mechanisms and the evolution of Internet technology. New Modal Networks emphasize customizability at the network layer, which means they are incompatible with TCP / IP. The sFlow protocol, based on IP networks, cannot be applied in new modal experimental environments. For example, in information-centric networks, such as NDN networks, the core content shifts from IP host interconnection to data content interconnection. The core object is information, and all information units are named by data names rather than host identifiers. Therefore, the sFlow agent cannot collect relevant data.

[0004] While sFlow already supports a wide range of packet content extraction capabilities, such as raw packet capture, IPv4 data, and IPv6 data, it only fully supports traffic collection for IPv4 and IPv6 on TCP / IP networks. New-modality networks have multiple identification spaces, such as "IP identification" and "content identification," enabling the coexistence of routing and addressing methods across multiple identification networks. Experimental environments built on new-modality network instances (such as NDN networks) cannot use sFlow technology to monitor traffic and devices in real time. Instead, sFlow processing logic must be customized for each device in the experimental environment, which results in high chip costs and requires the redevelopment of traffic monitoring systems. This makes it unsuitable for the emerging network architectures in future new-modality experimental environments.

[0005] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide a network traffic collection method, system, device and medium for multimodal networks, aiming to solve the technical problem that the experimental environment constructed by the new modality network instance cannot use sFlow technology to monitor the traffic and equipment of the experimental environment in real time.

[0007] To achieve the above objectives, the present application proposes a method for collecting network traffic for a multimodal network, the method comprising:

[0008] Applied to a network traffic collection system, the network collection system includes a controller, a programmable network node and a traffic analysis server; wherein the method includes:

[0009] forwarding the new modality description file to the programmable network node and the traffic analysis server via the controller;

[0010] Generating a forwarding program according to the new modality description file through the programmable network node and notifying the controller;

[0011] The traffic analysis server creates a parsing field structure according to the new modality description file, and notifies the controller after creating a new statistical table;

[0012] After the controller receives notification messages from the programmable network node and the traffic analysis server, the controller sends update configuration instructions to the programmable network node in the new modality description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modality network.

[0013] In one embodiment, the step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller includes:

[0014] Upon receiving a new modality description file submitted by a user, detecting, by the controller, whether a tag value in the new modality description file is consistent with an existing tag value;

[0015] When it is detected that the tag value in the new modality description file is inconsistent with the existing tag value, the new modality description file is forwarded to the programmable network node and the traffic analysis server through the controller.

[0016] In one embodiment, the step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller includes:

[0017] The new modality description file is forwarded to the programmable network node and the traffic analysis server through the control channel of the controller, wherein the control channel is the control channel between the programmable network node and the controller, and sFlow related message types are added to the control channel.

[0018] In one embodiment, the programmable network node includes a forwarding module, an sFlow agent, and a control service module; wherein the step of generating a forwarding program according to the new modality description file by the programmable network node and notifying the controller includes:

[0019] Sending the new modality description file to the sFlow agent and the forwarding module simultaneously through the control service module;

[0020] Parsing the traffic collection field according to the new modality description file through the sFlow agent, constructing a new message structure, generating a forwarding program, and notifying the control service module;

[0021] Parsing the traffic collection field according to the new modality description file through the forwarding module, setting a new modality traffic buffer area according to the field length of the traffic collection field, and notifying the control service module;

[0022] The controller is notified of the parsing results of the sFlow agent and the forwarding module through the control service module.

[0023] In one embodiment, the forwarding module includes a first scalable function and a second scalable function; wherein the step of parsing the traffic collection field according to the new modality description file by the forwarding module and setting the new modality traffic buffer area according to the field length of the traffic collection field includes:

[0024] Parsing the new modality description file through the first scalable function and outputting a collection field structure;

[0025] A new modal traffic buffer area under a new network structure is created through the second scalable function according to the field length of the acquisition field structure and the adjustment parameters.

[0026] In one embodiment, the forwarding module further includes a third scalable function and a fourth scalable function; wherein, after the step of creating a new modal traffic buffer under the new network structure according to the field length and adjustment parameters of the acquisition field structure through the second scalable function, the step further includes:

[0027] Clear the acquisition cache of the previous network structure through the third scalable function;

[0028] The data packet to be forwarded is parsed by the fourth scalable function, and a collection field structure instance queue is output.

[0029] In one embodiment, the new modality description file includes a node IP description, a data header tag value, and a record type description structure.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a network traffic collection system for a multimodal network, the network traffic collection system for a multimodal network comprising:

[0031] A controller, configured to forward a new modality description file to the programmable network node and the traffic analysis server, wherein the new modality description file includes a node IP description, a data header tag value, and a record type description structure;

[0032] a programmable network node, configured to generate a forwarding program according to the new modality description file and notify the controller;

[0033] The traffic analysis server is configured to create a parsing field structure according to the new modality description file and notify the controller after creating a new statistical table;

[0034] The controller is used to send update configuration instructions to the programmable network node in the new modal description file after receiving notification messages from the programmable network node and the traffic analysis server, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a network traffic collection device for a multimodal network, wherein the device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network traffic collection method for a multimodal network as described above.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the network traffic collection method for a multimodal network are implemented as described above.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the network traffic collection method for a multimodal network as described above.

[0038] One or more technical solutions proposed in this application have at least the following technical effects:

[0039] The network traffic collection method, system, device and medium for multimodal networks proposed in the present application forward the new modal description file to the programmable network node and the traffic analysis server through the controller; the programmable network node generates a forwarding program according to the new modal description file and notifies the controller; the traffic analysis server creates a parsing field structure according to the new modal description file and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the new modal network. The traffic records of the network solve the technical problem that the experimental environment constructed by the new modality network instance cannot use sFlow technology to monitor the traffic and equipment of the experimental environment in real time. Compared with the existing technology, this application innovatively uses the idea of ​​SDN network controller, and sends the new modality description file to the programmable network node and the traffic analysis server at the same time through the control channel of the controller. After receiving the new modality description file, the programmable network node parses and constructs the traffic collection field structure and generates the corresponding forwarding program. At the same time, the traffic analysis server dynamically generates a new data table structure according to the new modality description file. When the programmable network node pushes the sFlow data packet to the traffic analysis server, the traffic analysis server can parse the meaning of each field in the sFlow data packet and save it to the relevant traffic statistics table, thereby solving the traffic collection problem of various new network structures in the experimental environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 A flowchart of a first embodiment of a method for collecting network traffic in a multimodal network according to the present invention;

[0043] Figure 2 A diagram describing the format of an sFlow data packet provided in Example 1 of the network traffic collection method for a multimodal network of this application;

[0044] Figure 3 A diagram showing the meaning of the fields in the Flow data header in sFlow, provided in Example 1 of the network traffic collection method for multimodal networks of this application;

[0045] Figure 4 A network traffic collection system deployment diagram provided for the first embodiment of the network traffic collection method for a multimodal network of the present application;

[0046] Figure 5 A flowchart of the second embodiment of the method for collecting network traffic for a multimodal network provided by this application;

[0047] Figure 6 A schematic diagram of a network traffic collection process for a multimodal network according to a second embodiment of the present invention;

[0048] Figure 7 This is a schematic diagram of the module structure of a network traffic collection system for a multimodal network according to an embodiment of the present application;

[0049] Figure 8 Schematic diagram of the device structure of the hardware operating environment involved in the network traffic collection method for multimodal networks in the embodiment of the present application.

[0050] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of the embodiment of the present application is: forwarding the new modality description file to the programmable network node and the traffic analysis server through the controller, wherein the new modality description file includes a node IP description, a data header tag value and a record type description structure; the programmable network node generates a forwarding program according to the new modality description file and notifies the controller; the traffic analysis server creates a parsing field structure according to the new modality description file, and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modality description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the traffic recording of the new modality network.

[0054] From the above embodiment, it can be seen that the new modal description file is forwarded to the programmable network node and the traffic analysis server by the controller; the programmable network node generates a forwarding program according to the new modal description file and notifies the controller; the traffic analysis server creates a parsing field structure according to the new modal description file and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the traffic record of the new modal network, thereby solving the problem caused by The experimental environment constructed by the new modal network instance cannot use sFlow technology to perform real-time monitoring of the traffic and equipment in the experimental environment. Compared with the existing technology, this application innovatively uses the idea of ​​SDN network controller, and sends the new modal description file to the programmable network node and the traffic analysis server at the same time through the control channel of the controller. After receiving the new modal description file, the programmable network node parses and constructs the traffic collection field structure and generates the corresponding forwarding program. At the same time, the traffic analysis server dynamically generates a new data table structure according to the new modal description file. When the programmable network node pushes the sFlow data packet to the traffic analysis server, the traffic analysis server can parse the meaning of each field in the sFlow data packet and save it to the relevant traffic statistics table, thereby solving the traffic collection problem of various new network structures in the experimental environment.

[0055] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device capable of implementing the above functions, a network traffic collection device for multimodal networks, etc. The following describes this embodiment and the following embodiments using network traffic collection for multimodal networks as an example.

[0056] Based on this, the embodiment of the present application provides a network traffic collection method for a multimodal network. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the network traffic collection method for multimodal networks of the present application.

[0057] In this embodiment, the network traffic collection method for a multimodal network includes steps S10 to S40:

[0058] Step S10: forwarding the new modality description file to the programmable network node and the traffic analysis server through the controller;

[0059] It should be noted that the new modal description file is designed based on the sFlow v5 data format and uses the new modal description file to import new sFlow datagram definitions. sFlow packets are encapsulated using UDP and use the well-known port 6343 for communication by default.

[0060] It should be noted that if Figure 2 As shown in the figure, the sFlow data packet is divided into a packet header and an sFlow datagram. The datagram is further divided into a datagram header and sampling data. The sampling data includes a sampling header and sampling records. There are multiple types of sFlow datagrams, and each sFlow datagram contains multiple sampling records. This nested definition allows the sFlow data packet to contain rich sampling information.

[0061] It should be noted that in order to utilize existing sFlow collection tools, the sFlow datagram header type and record type in the new modality description file must not conflict with existing types.

[0062] It should be noted that for the header of the sFlow data packet, the control protocol of the new mode network is still through the IP network, and the sFlow header part remains unchanged. For the sFlow datagram header, there are two types of datagram headers: flow and counter. Figure 3The Flow datagram header information is displayed. The first field is the datagram tag, which needs to be defined in the new mode description file. The first 20 bits are the company number, and the 12 bits are the format number. The company number cannot be defined as 0. The other fields follow the sFlow definition. For the Counting type header, the first tag field also needs to be redefined, while the other fields follow the sFlow definition. Therefore, in the datagram header, the description file only needs to define the tag value, but it cannot conflict with previously defined ones.

[0063] It should be noted that sampling records can be formatted in a variety of formats. The sFlow protocol defines the formats for raw packets, Ethernet frame data, IPv4 data, and IPv6 data in flow sample datagrams. For new network structures, you must customize the relevant structures and parse and implement them in the sFlow agent. The record format must be described in the new mode description file.

[0064] In a feasible implementation manner, the new modality description file includes a node IP description, a data header tag value, and a record type description structure.

[0065] It should be noted that the new modal description file includes three aspects:

[0066] 1. Node IP description. The purpose of configuring this is to avoid sFlowAgent modification for nodes not participating in the experiment.

[0067] 2. Datagram header tag (i.e., datagram header tag value), which can describe the types of flow and counter respectively;

[0068] 3. Record type description structure.

[0069] In a feasible embodiment, the step of forwarding the new modality description file to the programmable network node and the traffic analysis server through the controller includes: when receiving a new modality description file submitted by a user, detecting by the controller whether the tag value in the new modality description file is consistent with the existing tag value; when it is detected that the tag value in the new modality description file is inconsistent with the existing tag value, forwarding the new modality description file to the programmable network node and the traffic analysis server through the controller.

[0070] In the specific implementation, after the controller is initialized, the user submits a new modal description file on the controller. The controller parses the new modal description file and detects whether the newly defined Tag value in the new modal description file conflicts with the existing datagram type and record type (that is, the newly defined Tag value is the same as the existing Tag value). If there is a conflict, the new modal description file needs to be redefined based on the conflict information and resubmitted by the user on the controller; if there is no conflict, the controller will issue the new modal description file to the programmable network nodes and sFlow Collector (that is, the traffic analysis server) specified by the new modal description file.

[0071] Step S20, generating a forwarding program according to the new modality description file through the programmable network node and notifying the controller;

[0072] It should be noted that if the programmable network node and the traffic analysis server receive a new modality description file, they need to return a successful reception message to the controller through the control channel between the controller and the programmable network node; otherwise, an error message is reported.

[0073] Step S30, creating a parsing field structure according to the new modality description file through the traffic analysis server, and notifying the controller after creating a new statistical table;

[0074] It should be noted that the Collector (i.e., the traffic analysis server) parses the new modality description file, creates a structure of parsed fields, creates related statistical tables, and notifies the controller.

[0075] Step S40, after the controller receives the notification messages from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modal network.

[0076] It should be noted that after the controller receives the message that the forwarding modules and sFlow Agents (i.e., sFlow agents) of all programmable network nodes and the traffic analysis server are successfully configured, it generates a configuration completion message; after the user receives the configuration completion message, the controller sends a command to update the sFlow configuration to the programmable network nodes specified in the new modality description file. The programmable network nodes do not need to be restarted and can directly start sFlow collection for the new modality network; the traffic analysis server receives the sFlow containing new records, uses the new structure to parse the UDP data packet, stores it in the new statistical table, and finally completes the traffic record of the new modality network.

[0077] In the specific implementation, Figure 4 As shown in the network traffic collection system deployment diagram, the new modality description file is sent to the programmable network node and the sFlow collector (i.e., the traffic analysis server) through the control channel of the controller.

[0078] In this embodiment, the controller forwards the new modality description file to the programmable network node and the traffic analysis server; the programmable network node generates a forwarding program according to the new modality description file and notifies the controller; the traffic analysis server creates a parsing field structure according to the new modality description file and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modality description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the traffic record of the new modality network, thereby solving the problem of traffic recording caused by the new modality. The experimental environment constructed by the network instance cannot use sFlow technology to perform real-time monitoring of the traffic and equipment in the experimental environment. Compared with the existing technology, this application innovatively uses the idea of ​​SDN network controller to uniformly send the new modal description file to the programmable network node and the traffic analysis server through the control channel of the controller. After receiving the new modal description file, the programmable network node parses and constructs the traffic collection field structure and generates the corresponding forwarding program. At the same time, the traffic analysis server dynamically generates a new data table structure based on the new modal description file. When the programmable network node pushes the sFlow data packet to the traffic analysis server, the traffic analysis server can parse the meaning of each field in the sFlow data packet and save it to the relevant traffic statistics table, thereby solving the traffic collection problem of various new network structures in the experimental environment.

[0079] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above embodiment 1 can be referred to the above introduction and will not be described in detail later. Figure 5 The programmable network node includes a forwarding module, an sFlow agent, and a control service module; the step S20 further includes:

[0080] Step S201: Sending the new modality description file to the sFlow agent and the forwarding module simultaneously through the control service module;

[0081] It should be noted that, within a programmable network node, the node device management control service module (i.e., the control service module) sends a new modality description file to both the sFlow Agent (i.e., the sFlow agent) and the data packet forwarding module (i.e., the forwarding module) at the same time.

[0082] Step S202: parsing the traffic collection field according to the new modality description file through the sFlow agent, constructing a new message structure, generating a forwarding program, and notifying the control service module;

[0083] It should be noted that the Agent parser in the sFlow agent can parse the new modality description file, create a structure of the collection field, modify the sFlow datagram encapsulation algorithm, and notify the node device management control service module.

[0084] Step S203: parsing the traffic collection field according to the new modality description file through the forwarding module, setting a new modality traffic buffer according to the field length of the traffic collection field, and notifying the control service module;

[0085] It should be noted that the data packet forwarding module parses the new modality description file, creates a structure of parsed fields, destroys the previous collection field cache, creates a traffic collection field cache adapted to the new structure, and notifies the node device management and control service module.

[0086] Step S204: Notify the controller of the parsing results of the sFlow agent and the forwarding module through the control service module.

[0087] It should be noted that the node device management control service module notifies the controller of the parsing results of the Agent parser and the data packet forwarding module.

[0088] In the specific implementation, Figure 6 As shown in the figure, the new modality network traffic collection process is specifically as follows:

[0089] 1. Controller initialization;

[0090] 2. The user submits a new modal description file on the controller;

[0091] 3. Parse the new modal file and check whether it conflicts with the existing datagram type and record type (the newly defined tag value is the same as the existing tag value). If there is no conflict, continue to step 4. If there is a conflict, redefine the modal description file based on the conflict information and return to step 2 to submit;

[0092] 4. The controller distributes the description file to the programmable network nodes and sFlow Collector (i.e., traffic analysis server) specified in the description file;

[0093] 5. If the programmable network node and Collector receive the description file, they return a successful reception message to the controller through the control channel; otherwise, an error is reported;

[0094] 6. Within the programmable network node, the node device management and control service module sends the new modality description file to both the sFlow Agent and the packet forwarding module.

[0095] 7. The Agent parser parses the description file, creates a structure for the collection field, modifies the sFlow datagram encapsulation algorithm, and notifies the node device management and control service module;

[0096] 8. The data packet forwarding module parses the description file, creates a structure of the parsed fields, destroys the previous collection field cache, creates a flow collection field cache that adapts to the new structure, and notifies the node device management and control service module;

[0097] 9. The node device management and control service module notifies the controller of the parsing results of the agent parser and data packet forwarding module;

[0098] 10. Collector parses the description file, creates a structure of the parsed fields, creates relevant statistics tables, and notifies the controller;

[0099] 11. After receiving the successful configuration messages from the forwarding modules, sFlow Agents, and Collectors of all nodes, the controller generates a configuration completion message.

[0100] 12. After receiving the configuration completion message, the user sends the sFlow configuration update command to the nodes specified in the description file through the controller. The nodes do not need to be restarted and directly start sFlow collection for the new modality network.

[0101] 13. The Colletor receives the sFlow containing the new record, uses the new structure to parse the UDP packet, stores it in the new statistics table, and completes the traffic recording of the new modal network.

[0102] In a feasible embodiment, the forwarding module includes a first expandable function and a second expandable function; wherein, the step of parsing the traffic collection field according to the new modality description file by the forwarding module and setting the new modality traffic cache according to the field length of the traffic collection field includes: parsing the new modality description file by the first expandable function and outputting a collection field structure; creating a new modality traffic cache under the new network structure according to the field length and adjustment parameters of the collection field structure by the second expandable function. The forwarding module also includes a third expandable function and a fourth expandable function; wherein, after the step of creating the new modality traffic cache under the new network structure according to the field length and adjustment parameters of the collection field structure by the second expandable function, the step further includes: clearing the collection cache of the previous network structure by the third expandable function; parsing the data packet to be forwarded by the fourth expandable function and outputting a collection field structure instance queue.

[0103] It should be noted that programmable network nodes are composed of programmable switches. Traffic field collection methods can be inserted into the forwarding modules of programmable network nodes to achieve dynamic collection of traffic fields. This includes four scalable functions. They are described below:

[0104] (1) The first extensible function:

[0105] Method: Description file parsing

[0106] Description: Parse the received description file and add the required operations to the data packet processing process.

[0107] Input: New modal description file

[0108] Output: Collection field structure

[0109] (2) The second scalable function:

[0110] Method: Create a field collection buffer

[0111] Note: Under the new network structure, the size of the buffer area should be set to N times the total length of the collection field. N is much larger than the total length of the collection field. The setting of N is related to the storage capacity of the collection node and can be adjusted according to the setting adjustment parameters.

[0112] Input: Collection field structure

[0113] Output: Suitable buffer

[0114] (3) The third extensible function:

[0115] Method: Field collection buffer destruction

[0116] Description: Clear the collection cache of the previous network structure.

[0117] Input: None

[0118] Output: Is it cleared?

[0119] (4) The fourth scalable function:

[0120] Method: Collect traffic

[0121] Description: Analyze the collected fields of the forwarded data packets and store them in the queue.

[0122] Input: Each forwarded packet

[0123] Output: Collection field structure instance queue

[0124] It should be noted that the first expandable function, the second expandable function and the third expandable function are used for parsing the modal description of the new modal file, and the fourth expandable function is used for collecting sFlow related field data during data packet processing.

[0125] It should be noted that the new modality description file specifies information such as the node range, sFlow message types, record types, and record structure of the new modality network. These detailed specifications can be directly parsed into the corresponding sFlow Agent structure and can be conveniently parsed into the Collator's flow record table structure. This makes the new modality network environment scalable while reducing the development cost of new systems. Transmitting various new modality configuration files through the controller's control channel reduces the overhead of configuring each node individually. Existing control channel message routines can be leveraged to quickly expand a single message type without redeveloping configuration submission procedures. Leveraging the node's programmability, the Agent parser constructs the sFlow message header and record structure described in the description file. Furthermore, during data channel forwarding, it can perform layered parsing of packets while collecting traffic fields and storing them in the data channel's buffer, achieving efficient data collection without consuming additional data forwarding resources. Deploying related new data collection tasks through the controller facilitates testing of new network system experimental environments and measurement of new applications. New applications can be rapidly deployed in the new modality network, and detailed information such as their traffic usage and traffic paths can be measured. In this way, when various new network structures are deployed in the experimental environment, the collector can perform traffic collection and device monitoring simply by creating some new tables and extending some processing functions.

[0126] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the network traffic collection method for multimodal networks of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0127] This application also provides a network traffic collection system for multimodal networks, please refer to Figure 7 , the network traffic collection system for multimodal networks includes:

[0128] The controller 10 is configured to forward the new modality description file to the programmable network node and the traffic analysis server;

[0129] a programmable network node 20, configured to generate a forwarding program according to the new modality description file and notify the controller;

[0130] The traffic analysis server 30 is configured to create a parsed field structure according to the new modality description file and notify the controller after creating a new statistical table;

[0131] The controller 10 is used to send update configuration instructions to the programmable network node in the new modal description file after receiving notification messages from the programmable network node and the traffic analysis server, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

[0132] The network traffic collection system for multimodal networks provided in this application, which utilizes the network traffic collection method for multimodal networks described in the aforementioned embodiments, can resolve the technical issue of an experimental environment constructed using a new modality network instance being unable to use sFlow technology to monitor the traffic and devices of the experimental environment in real time. Compared to the prior art, the beneficial effects of the network traffic collection system for multimodal networks provided in this application are the same as those of the network traffic collection method for multimodal networks provided in the aforementioned embodiments. Other technical features of the network traffic collection system for multimodal networks are the same as those disclosed in the aforementioned embodiments and are not further elaborated here.

[0133] The present application provides a network traffic collection device for a multimodal network. The network traffic collection device for a multimodal network includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the network traffic collection method for a multimodal network in the above-mentioned embodiment 1.

[0134] Reference below Figure 8 , which shows a schematic diagram of the structure of a network traffic collection device for a multimodal network suitable for implementing an embodiment of the present application. The network traffic collection device for a multimodal network in the embodiment of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 8 The network traffic collection device for a multimodal network shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0135] like Figure 8 As shown, the network traffic collection device for multimodal networks may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the network traffic collection device for multimodal networks. Processing device 1001, ROM 1002, and RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, hard disk, etc.; and communication devices 1009. The communication devices 1009 can allow the network traffic collection device for a multimodal network to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a network traffic collection device for a multimodal network with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems may be implemented or have instead.

[0136] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0137] The network traffic collection device for multimodal networks provided in this application, which utilizes the network traffic collection method for multimodal networks described in the aforementioned embodiments, can resolve the technical issue of an experimental environment constructed using a new modality network instance being unable to use sFlow technology to monitor the traffic and devices of the experimental environment in real time. Compared to the prior art, the beneficial effects of the network traffic collection device for multimodal networks provided in this application are the same as those of the network traffic collection method for multimodal networks provided in the aforementioned embodiments. The other technical features of the network traffic collection device for multimodal networks are the same as those disclosed in the aforementioned embodiments and are not further elaborated here.

[0138] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0139] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A network traffic collection method for a multimodal network, characterized in that: Applied to a network traffic collection system, the network collection system includes a controller, a programmable network node and a traffic analysis server; wherein the method includes: forwarding the new modality description file to the programmable network node and the traffic analysis server via the controller; Generating a forwarding program according to the new modality description file through the programmable network node and notifying the controller; The traffic analysis server creates a parsing field structure according to the new modality description file, and notifies the controller after creating a new statistical table; After the controller receives notification messages from the programmable network node and the traffic analysis server, the controller sends update configuration instructions to the programmable network node in the new modality description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modality network.

2. The method according to claim 1, wherein The step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller includes: Upon receiving a new modality description file submitted by a user, the controller detects whether a tag value in the new modality description file is consistent with an existing tag value; When it is detected that the tag value in the new modality description file is inconsistent with the existing tag value, the new modality description file is forwarded to the programmable network node and the traffic analysis server through the controller.

3. The method according to claim 1, wherein The step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller includes: The new modality description file is forwarded to the programmable network node and the traffic analysis server through the control channel of the controller, wherein the control channel is the control channel between the programmable network node and the controller, and sFlow related message types are added to the control channel.

4. The method according to claim 1, wherein The programmable network node includes a forwarding module, an sFlow agent, and a control service module. The step of generating a forwarding program according to the new modality description file by the programmable network node and notifying the controller includes: Sending the new modality description file to the sFlow agent and the forwarding module simultaneously through the control service module; Parsing the traffic collection field according to the new modality description file through the sFlow agent, constructing a new message structure, generating a forwarding program, and notifying the control service module; Parsing the traffic collection field according to the new modality description file through the forwarding module, setting a new modality traffic buffer area according to the field length of the traffic collection field, and notifying the control service module; The controller is notified of the parsing results of the sFlow agent and the forwarding module through the control service module.

5. The method according to claim 4, wherein The forwarding module includes a first expandable function and a second expandable function; wherein the step of parsing the traffic collection field according to the new modality description file by the forwarding module and setting the new modality traffic buffer area according to the field length of the traffic collection field includes: Parsing the new modality description file through the first scalable function and outputting a collection field structure; A new modal traffic buffer area under a new network structure is created through the second scalable function according to the field length of the acquisition field structure and the adjustment parameters.

6. The method according to claim 5, wherein The forwarding module further includes a third scalable function and a fourth scalable function; wherein, after the step of creating a new modal traffic buffer under the new network structure according to the field length and adjustment parameters of the acquisition field structure through the second scalable function, the step further includes: Clear the acquisition cache of the previous network structure through the third scalable function; The data packet to be forwarded is parsed by the fourth scalable function, and a collection field structure instance queue is output.

7. The method according to claim 1, wherein The new modality description file includes a node IP description, a datagram header tag value, and a record type description structure.

8. A network traffic collection system for multimodal networks, characterized in that: The system comprises: A controller, configured to forward the new modality description file to the programmable network node and the traffic analysis server; a programmable network node, configured to generate a forwarding program according to the new modality description file and notify the controller; The traffic analysis server is configured to create a parsing field structure according to the new modality description file and notify the controller after creating a new statistical table; The controller is used to send update configuration instructions to the programmable network node in the new modal description file after receiving notification messages from the programmable network node and the traffic analysis server, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

9. A network traffic collection device for multimodal networks, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for collecting network traffic for a multimodal network according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the network traffic collection method for a multimodal network are implemented as described in any one of claims 1 to 7.

Images