Flow monitoring method, bypass monitoring device, storage medium and program product

Abstract

The embodiment of the invention provides a flow monitoring method, bypass monitoring equipment, a storage medium and a program product. The method comprises the following steps: acquiring network traffic in a bypass mode; screening target traffic from the network traffic according to a preset feature identifier; the target traffic is the traffic between the first node and the second node, and the feature identifier is added by the first node or the second node; based on a monitoring function corresponding to the feature identifier, analyzing the target traffic to obtain traffic information; and when the flow information does not meet the monitoring condition corresponding to the monitoring function, performing early warning prompt. According to the method, fine monitoring on the nodes is realized, and the diversity and expandability of flow monitoring are improved.

Description

Technical Field

[0001] The present application relates to the field of flow monitoring and computer network, and in particular to a flow monitoring method, bypass monitoring equipment, storage medium and program product. Background Art

[0002] With the increasing amount of business data, network data flow monitoring has become a core part of information technology management. Effective flow monitoring can ensure the normal operation of the business.

[0003] In the related technology, the traffic in the network can be monitored, and overall attention is paid to whether the traffic exceeds the threshold, whether there is anomaly, etc. This traffic monitoring method is difficult to perform fine-grained monitoring of network nodes. Summary of the invention

[0004] The embodiments of the present application provide a flow monitoring method, a bypass monitoring device, a storage medium and a program product to achieve refined monitoring of nodes and improve the diversity and scalability of flow monitoring.

[0005] In a first aspect, an embodiment of the present application provides a flow monitoring method, comprising:

[0006] Obtain network traffic in a bypass manner; filter target traffic from network traffic according to preset feature identifiers; target traffic is traffic between a first node and a second node, and the feature identifier is added by the first node or the second node; analyze target traffic based on a monitoring function corresponding to the feature identifier to obtain traffic information; issue an early warning when traffic information does not meet monitoring conditions corresponding to the monitoring function.

[0007] In a second aspect, an embodiment of the present application provides a flow monitoring device, comprising:

[0008] An acquisition module, used to acquire network traffic in a bypass manner;

[0009] A screening module, used for screening target traffic from network traffic according to a preset characteristic identifier; the target traffic is traffic between the first node and the second node, and the characteristic identifier is added by the first node or the second node;

[0010] An analysis module is used to analyze the target traffic based on the monitoring function corresponding to the feature identifier to obtain traffic information;

[0011] The early warning module is used to issue an early warning prompt when the traffic information does not meet the monitoring conditions corresponding to the monitoring function.

[0012] In a third aspect, an embodiment of the present application provides a bypass monitoring device, comprising: a memory, a processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect above and / or various possible implementations of the first aspect.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0016] Figure 1 A schematic diagram of a flow monitoring method provided in this application;

[0017] Figure 2 Schematic diagram of the flow monitoring method provided in this application Figure 1 ;

[0018] Figure 3 Schematic diagram of the flow monitoring method provided in this application Figure 2 ;

[0019] Figure 4 A schematic diagram of the structure of the flow monitoring device provided in this application;

[0020] Figure 5 A schematic diagram of the structure of the bypass monitoring device provided in this application.

[0021] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0022] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0023] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0024] The flow monitoring method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the node cluster includes a first node 102 and a second node 104, and the nodes in the node cluster communicate through a network; the bypass monitoring device 106 can monitor the traffic interacting between the node clusters.

[0025] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0026] Figure 2 Schematic diagram of the flow monitoring method provided in this application Figure 1 ,This method can be applied to bypass monitoring devices, such as Figure 2 As shown, the method includes:

[0027] S201. Obtain network traffic in a bypass manner.

[0028] Among them, bypass refers to a method of collecting or detecting network traffic. It does not directly participate in the main transmission path of network data, does not cause additional burden on network performance, and is easy to deploy.

[0029] Specifically, obtaining network traffic in a bypass manner may be through data acquisition. Exemplarily, a bypass monitoring device may support a data acquisition mode, such as SPAN (Switch Port Analyzer), and the bypass monitoring device obtains network traffic from a node (switch or router) through a data acquisition mode. Obtaining network traffic in a bypass manner may also be through configuring a traffic replication or mirroring function on a node, copying a copy of the network traffic in the firewall area where the node is located and sending the copy to the bypass monitoring device, so that the bypass monitoring device obtains the network traffic.

[0030] S202. Filter target traffic from network traffic according to a preset feature identifier; the target traffic is traffic between a first node and a second node, and the feature identifier is added by the first node or the second node.

[0031] Among them, the characteristic identifier can be used to represent a certain specific traffic, and the characteristic identifier can be a character string; in the embodiment of the present application, the characteristic identifier can represent the traffic between the first node and the second node; when the first node sends a data packet to the second node, the first node can add the characteristic identifier to the data packet, and when the second node sends a data packet to the first node, the second node can add the characteristic identifier to the data packet; the characteristic identifier can also represent the traffic between the first node and the second node that is related to the business function; different business functions correspond to different characteristic identifiers, and the target traffic of different business functions can be screened through the characteristic identifier.

[0032] Specifically, taking the data packet sent from the first node to the second node as an example, the first node adds a characteristic identifier to the data packet related to the business function sent to the second node; in this way, after the bypass monitoring device obtains the network traffic, for the data packet in the network traffic, based on whether the characteristic identifier exists in the data packet, it determines whether the data packet is a data packet between the first node and the second node, thereby filtering out the data packet between the first node and the second node from the network traffic, and the filtered data packet is a data packet related to the business function; the target traffic is determined based on the filtered data packet; the bypass monitoring device can filter the target traffic from the network traffic through the pattern matching algorithm and the identification library.

[0033] In an optional manner, a feature identifier can be used to mark traffic related to a certain business that is interacted between a first node and a second node. For example, in a possible business scenario, the first node needs to periodically send order data to the second node. The first node can add a feature identifier to the data packet of the order data and then send the data packet to the second node. After the bypass monitoring device obtains the network traffic, it can filter out the data packets of the order data through the feature identifier and obtain the target traffic corresponding to the order data.

[0034] S203: Analyze the target traffic based on the monitoring function corresponding to the feature identifier to obtain traffic information.

[0035] Among them, the monitoring function is used to indicate the category of monitoring; the number of monitoring functions can be at least one, that is, at least one category of monitoring can be performed on the target traffic; the traffic information can reflect the characteristics of the target traffic, and may include the number of data packets included in the target traffic, the bandwidth occupied by the target traffic, and the transmission volume of the target traffic.

[0036] The flow information is determined based on the monitoring function. Different monitoring functions may correspond to different flow information.

[0037] Specifically, the bypass monitoring device obtains the monitoring function corresponding to the characteristic identifier and obtains the switch state of the monitoring function. When the monitoring function is in the on state, the target flow is analyzed according to the monitoring function to obtain the flow information.

[0038] In an optional manner, the monitoring function is used to monitor whether the first node sends a data packet to the second node within a specified time period. For example, in a business scenario, the first node needs to periodically send order data to the second node. The monitoring function can monitor whether the first node periodically sends order data to the second node.

[0039] In an optional manner, the monitoring function is used to monitor the traffic interacting between the first node and the second node. For example, in a business scenario, the network bandwidth is limited based on the traffic interacting between the first node and the second node under normal circumstances. The monitoring function can monitor the real-time traffic between the first node and the second node to determine whether there is abnormal traffic on the link between the first node and the second node.

[0040] S204: When the flow information does not meet the monitoring conditions corresponding to the monitoring function, an early warning prompt is issued.

[0041] Among them, the monitoring conditions corresponding to the monitoring function are used to determine whether the target flow is abnormal under the category monitored by the monitoring function; in actual applications, different monitoring functions have corresponding monitoring conditions.

[0042] The early warning prompt is used to provide abnormal prompts to the equipment or personnel responsible for the monitoring function. The content of the early warning prompt is related to the monitoring function and the traffic information corresponding to the monitoring function.

[0043] Specifically, for the monitoring function, the bypass monitoring device obtains the monitoring conditions corresponding to the monitoring function, and determines whether the flow information corresponding to the monitoring function meets the monitoring conditions. If so, it means that the target flow is normal; if not, it means that the target flow is abnormal, and an early warning prompt is given based on the flow information corresponding to the monitoring function.

[0044] In the above-mentioned traffic monitoring method, the bypass monitoring device obtains network traffic in a bypass manner, and can obtain network traffic without occupying the network data transmission path, that is, obtaining network traffic in a bypass manner will not cause additional burden on network performance. The bypass monitoring device filters out the target traffic between the first node and the second node from the network traffic according to the preset feature identifier, and analyzes the target traffic according to the monitoring function corresponding to the feature identifier to obtain traffic information. When the traffic information does not meet the monitoring condition corresponding to the monitoring function, an early warning prompt is issued; that is, the target traffic that is end-to-end (between the first node and the second node) and related to the business function can be filtered out through the feature identifier, and the target traffic can be analyzed through the monitoring function corresponding to the feature identifier, and when the traffic information obtained by analysis does not meet the monitoring condition corresponding to the monitoring function, an early warning prompt is issued, which realizes refined monitoring of traffic at the node level and the business function level, improves the granularity of traffic monitoring, can be used in application scenarios for monitoring business operations between nodes, and improves the diversity and scalability of traffic monitoring functions.

[0045] In some embodiments, target traffic is filtered from network traffic based on preset feature identifiers, including: for data packets in the network traffic, extracting identification information of the data packets; using the data packets whose identification information includes the feature identifiers as target data packets; and determining target traffic based on the target data packets.

[0046] The identification information may be header information of a data packet, a code of a data packet, or a label of a data packet.

[0047] Specifically, the identification information is taken as an example of data packet header information; for all data packets in the acquired network traffic, the bypass monitoring device obtains the header information of the data packet. If the header information does not include the characteristic identifier, it is ignored. If the header information includes the characteristic identifier, the data packet is used as the target data packet, thereby filtering out the target traffic including the target data packet in the network traffic, and the target traffic is the traffic transmitted between the first node and the second node.

[0048] In the above embodiment, the end-to-end target traffic (between the first node and the second node) is screened out through feature identification, thereby achieving refined monitoring of the traffic at the node level.

[0049] In some embodiments, the monitoring function includes a data transmission monitoring function and an abnormal traffic monitoring function; based on the monitoring function corresponding to the feature identifier, the target traffic is analyzed to obtain traffic information, including: when the data transmission monitoring function is turned on, the number of data packets within a preset time period is obtained in the target traffic; the traffic information includes the number of data packets; when the abnormal traffic monitoring function is turned on, the target traffic is monitored to obtain the transmission volume; the traffic information includes the transmission volume.

[0050] Among them, the data transmission monitoring function is used to monitor whether data is transmitted between the first node and the second node in accordance with regulations, such as whether data is transmitted within a preset time period, and whether there are any abnormalities in the data transmitted during the preset time period; the abnormal traffic monitoring function is used to monitor whether the traffic between the first node and the second node is too large.

[0051] The transmission volume can be the total amount of data transmitted in a certain period of time, which can be measured in bytes or bits.

[0052] Specifically, the bypass monitoring device obtains the switch status of the data transmission detection function (the switch status is on or off), and obtains the switch status of the abnormal flow monitoring function. The switch status of the data transmission detection function and the switch status of the abnormal flow monitoring function can be synchronized to the bypass monitoring device by the control node; the switch status of the data transmission detection function and the flow monitoring function can be set through the control node and synchronized to the bypass monitoring device.

[0053] When the data transmission monitoring function is turned on, the data packets with timestamps within the preset time period are obtained in the target traffic, and the number of data packets with timestamps within the preset time period is counted; when the abnormal traffic monitoring function is turned on, the transmission volume of the target traffic is obtained.

[0054] It should be noted that if the data transmission monitoring function is turned off, the number of data packets in the target traffic within the preset time period will not be monitored; if the abnormal traffic monitoring function is turned off, the transmission volume in the target traffic will not be monitored.

[0055] In the above embodiment, the flow information of the target flow is determined according to the switch state of the monitoring function. Different monitoring functions correspond to different flow information. Different analyses can be performed on the target flow according to different monitoring functions, thereby improving the flexibility of flow monitoring.

[0056] In some embodiments, when the traffic information does not meet the monitoring conditions corresponding to the monitoring function, an early warning prompt is issued, including: when the data transmission monitoring function is in the turned-on state, obtaining the quantity interval corresponding to the data transmission monitoring function; when the number of data packets does not belong to the quantity interval, sending a first early warning information to the control node.

[0057] The first warning information is used to indicate that there is an abnormality in the data transmission between the first node and the second node; in practical applications, the first warning information may include the number of data packets and the number interval.

[0058] Specifically, the quantity interval corresponding to the data monitoring function can be synchronized from the control node to the bypass monitoring device; that is, the quantity interval corresponding to the data monitoring function can be set through the control node and synchronized to the bypass monitoring device; when the data transmission monitoring function is in the turned-on state, the bypass monitoring device obtains the quantity interval corresponding to the data monitoring function, and when the number of data packets does not belong to the quantity interval, the first warning information is sent to the control node, so that the control node can promptly check the data transmission status of the first node and the second node according to the first warning information; the first warning information can also be sent to the management personnel via a SMS server or email.

[0059] If possible, when the number of data packets does not belong to the number range, the first warning information may also be sent to at least one of the first node, the second node or the control node.

[0060] In actual applications, the first node is set to send the previous day's transaction data to the second node before 8 a.m. every day. Usually, the number of data packets of transaction data is stable within a range, and a quantity interval is set based on the range. The preset time period can be from 8 a.m. of the previous day to 8 a.m. of the current day; the bypass monitoring device screens the target traffic (traffic corresponding to the transaction data) sent by the first node to the second node according to the feature identifier, and determines the number of data packets between 8 a.m. of the previous day and 8 a.m. of the current day in the target traffic. If the number of data packets is not within the quantity interval, it means that the first node did not send the previous day's transaction data to the second node before 8 a.m., or the sent transaction data is abnormal.

[0061] In the above embodiment, based on the quantity interval corresponding to the data transmission monitoring function, it is determined whether there is any abnormality in the data transmission between the first node and the second node. If there is any abnormality, a first warning message is sent to facilitate timely checking of the data transmission status of the first node and the second node.

[0062] In some embodiments, when the traffic information does not meet the monitoring conditions corresponding to the monitoring function, an early warning prompt is issued, including: when the abnormal traffic monitoring function is in the turned-on state, obtaining the preset traffic threshold corresponding to the abnormal traffic monitoring function; when the transmission volume is greater than the preset traffic threshold, sending a second early warning information to the control node.

[0063] The second warning information is used to prompt that there is an abnormality in the traffic between the first node and the second node; the second warning information may include a preset traffic threshold and transmission volume.

[0064] Specifically, the preset traffic threshold corresponding to the abnormal traffic monitoring function can be synchronized from the control node to the bypass monitoring device, that is, the preset traffic threshold corresponding to the abnormal traffic monitoring function can be set through the control node and synchronized to the bypass monitoring device. When the abnormal traffic monitoring function is turned on, the bypass monitoring device determines whether the transmission volume is greater than the preset traffic threshold. If so, it sends a second warning message to the control node, so that the control node can check the link status of the first node and the second node in time according to the second warning message to avoid network congestion or even system crash caused by abnormal traffic; the second warning message can also be sent to the management personnel through a SMS server or email.

[0065] If possible, if the transmission volume is greater than a preset traffic threshold, a second warning message may also be sent to at least one of the first node, the second node or the control node.

[0066] In the above embodiment, based on the preset traffic threshold corresponding to the abnormal traffic monitoring function, it is determined whether there is any abnormality in the traffic transmission between the first node and the second node. If there is any abnormality, a first warning message is sent to facilitate timely checking of the link status between the first node and the second node to avoid network congestion or even system crash caused by abnormal traffic.

[0067] In some embodiments, the traffic monitoring method also includes: receiving a setting instruction sent by a control node; the setting instruction is generated by the control node in response to a setting operation, obtaining a feature identifier in a setting page, a monitoring function corresponding to the feature identifier, and a monitoring condition of the monitoring function, and based on the feature identifier, the monitoring function and the monitoring condition; obtaining the feature identifier included in the setting instruction, the monitoring function corresponding to the feature identifier and the monitoring condition of the monitoring function.

[0068] Specifically, the control node displays a setting page, and the user interacts with the setting page to input a feature identifier and a monitoring function corresponding to the feature identifier on the setting page; for example, the monitoring function includes a data transmission monitoring function and an abnormal flow monitoring function, and the switch state, preset time period and quantity interval of the data transmission monitoring function, as well as the switch state and preset flow threshold of the abnormal flow monitoring function can be set on the setting page; in response to a setting operation triggered on the setting page, the control node generates a setting instruction based on the feature identifier, the switch state, preset time period and quantity interval of the monitoring function data transmission monitoring function corresponding to the feature identifier, and the switch state and preset flow threshold of the abnormal flow monitoring function, and sends the setting instruction to the bypass monitoring device to synchronize the feature identifier, the switch state, preset time period and quantity interval of the monitoring function data transmission monitoring function corresponding to the feature identifier, and the switch state and preset flow threshold of the abnormal flow monitoring function to the bypass monitoring device.

[0069] In the above embodiment, the user sets the characteristic identifiers and corresponding monitoring functions that the bypass monitoring device needs to pay attention to through the control node, thereby improving the flexibility and diversity of the flow monitoring method of the bypass monitoring device.

[0070] In some embodiments, the traffic monitoring method also includes: screening first concern traffic from network traffic according to the first address set, the first concern traffic is traffic whose source address or destination address belongs to the first address set; judging whether the first concern traffic is greater than a target threshold, and if it is greater than the first threshold, sending a third warning information to the control node; screening second concern traffic from network traffic according to the second address set, the second concern traffic is traffic whose source address or destination address does not belong to the second address set, and sending interception information to the control node based on the second concern traffic.

[0071] Specifically, the addresses included in the first address set are the addresses of nodes that need attention. The first concern traffic is filtered out through the first address set, and the transmission volume of the first concern traffic is monitored. When the first concern traffic is greater than the target threshold, it indicates that the first concern traffic is too large, and a third early warning information is sent to the control node so that the traffic problem of the first concern traffic can be checked through the control node. Since the first address set can include multiple addresses, the traffic of more nodes can be monitored in this way.

[0072] The addresses included in the second address set are the addresses of nodes that are allowed to be accessed. If it is detected that the source address or destination address of the second traffic does not belong to the second address set, the second traffic may be sent from a node that is not allowed to be accessed. The bypass monitoring device sends interception information to the control node to intercept the traffic whose source address or destination address does not belong to the second address set, thereby ensuring the security of the node. Since the second address set can include multiple addresses, more nodes can be protected in this way.

[0073] In some embodiments, the traffic monitoring method also includes: periodically deleting the acquired network traffic, or periodically acquiring unencrypted network traffic, and encrypting the unencrypted network traffic to obtain encrypted network traffic; the encrypted network traffic can be stored in local memory or an external storage device, and data security can be ensured through encryption.

[0074] Figure 3 Schematic diagram of the flow monitoring method provided in this application Figure 2 ,like Figure 3 As shown, in this embodiment Figure 2 Based on the embodiment, the flow monitoring method is described in detail, and the method includes:

[0075] S301, receiving a setting instruction sent by a control node; the setting instruction is generated by the control node in response to a setting operation, obtaining a feature identifier in a setting page, a monitoring function corresponding to the feature identifier, and a monitoring condition of the monitoring function, and based on the feature identifier, the monitoring function and the monitoring condition; the monitoring function includes a data transmission monitoring function and an abnormal traffic monitoring function;

[0076] S302, obtaining a feature identifier, a monitoring function corresponding to the feature identifier, and a monitoring condition of the monitoring function included in the setting instruction;

[0077] S303, obtaining network traffic in a bypass manner;

[0078] S304, extracting identification information of a data packet in the network traffic; taking a data packet whose identification information includes a preset characteristic identification as a target data packet; determining a target traffic according to the target data packet; the target traffic is the traffic between the first node and the second node, and the characteristic identification is added by the first node or the second node;

[0079] S305, when the data transmission monitoring function corresponding to the characteristic identifier is in an on state, obtaining the number of data packets within a preset time period in the target traffic; obtaining the number interval corresponding to the data transmission monitoring function; when the number of data packets does not belong to the number interval, sending a first warning information to the control node;

[0080] S306. When the abnormal traffic monitoring function corresponding to the characteristic identifier is in an on state, the target traffic is monitored to obtain the transmission volume and the preset traffic threshold corresponding to the abnormal traffic monitoring function is obtained; when the transmission volume is greater than the preset traffic threshold, a second warning information is sent to the control node.

[0081] In the above-mentioned traffic monitoring method, the bypass monitoring device obtains network traffic in a bypass manner, and can obtain network traffic without occupying the network data transmission path, that is, obtaining network traffic in a bypass manner will not cause additional burden on network performance. The bypass monitoring device filters out the target traffic between the first node and the second node from the network traffic according to the preset feature identifier, and analyzes the target traffic according to the monitoring function corresponding to the feature identifier to obtain traffic information. When the traffic information does not meet the monitoring condition corresponding to the monitoring function, an early warning prompt is issued; that is, the target traffic that is end-to-end (between the first node and the second node) and related to the business function can be filtered out through the feature identifier, and the target traffic can be analyzed through the monitoring function corresponding to the feature identifier, and when the traffic information obtained by analysis does not meet the monitoring condition corresponding to the monitoring function, an early warning prompt is issued, which realizes refined monitoring of traffic at the node level and the business function level, improves the granularity of traffic monitoring, can be used in application scenarios for monitoring business operations between nodes, and improves the diversity and scalability of traffic monitoring functions.

[0082] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0083] Figure 4 The schematic diagram of the flow monitoring device provided in this application is as follows: Figure 4 As shown, the flow monitoring device 40 provided in this embodiment includes:

[0084] An acquisition module 401 is used to acquire network traffic in a bypass manner;

[0085] The screening module 402 is used to screen the target traffic from the network traffic according to the preset characteristic identifier; the target traffic is the traffic between the first node and the second node, and the characteristic identifier is added by the first node or the second node;

[0086] An analysis module 403 is used to analyze the target flow based on the monitoring function corresponding to the feature identifier to obtain flow information;

[0087] The early warning module 404 is used to issue an early warning prompt when the flow information does not meet the monitoring conditions corresponding to the monitoring function.

[0088] In a possible implementation, the screening module 402 is used to extract identification information of data packets in network traffic; take data packets whose identification information includes a preset characteristic identification as target data packets; and determine target traffic based on the target data packets.

[0089] In one possible implementation, the monitoring function includes a data transmission monitoring function and an abnormal traffic monitoring function; the screening module 402 is used to obtain the number of data packets within a preset time period in the target traffic when the data transmission monitoring function is turned on; the traffic information includes the number of data packets; when the abnormal traffic monitoring function is turned on, the target traffic is monitored to obtain the transmission volume; the traffic information includes the transmission volume.

[0090] In a possible implementation, the warning module 404 is used to obtain a quantity interval corresponding to the data transmission monitoring function when the data transmission monitoring function is in an on state; when the number of data packets does not belong to the quantity interval, send a first warning message to the control node.

[0091] In a possible implementation, the warning module 404 is used to obtain a preset traffic threshold corresponding to the abnormal traffic monitoring function when the abnormal traffic monitoring function is turned on; when the transmission volume is greater than the preset traffic threshold, send a second warning message to the control node.

[0092] In one possible implementation, the flow monitoring device also includes: a setting module, which is used to receive setting instructions sent by the control node; the setting instructions are generated by the control node in response to the setting operation, obtaining the feature identifier in the setting page, the monitoring function corresponding to the feature identifier, and the monitoring conditions of the monitoring function, and are based on the feature identifier, the monitoring function and the monitoring conditions; obtaining the feature identifier included in the setting instruction, the monitoring function corresponding to the feature identifier, and the monitoring conditions of the monitoring function.

[0093] The flow monitoring device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0094] Figure 5 This is a schematic diagram of the bypass monitoring device provided in this application. Figure 5 As shown, the bypass monitoring device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0095] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0096] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0097] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0098] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0099] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0100] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0101] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0102] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0103] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0104] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0105] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0107] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0108] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0109] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A flow monitoring method, characterized in that: Applied to bypass monitoring equipment, including: Obtain network traffic in a bypass manner; Filtering target traffic from the network traffic according to a preset feature identifier; the target traffic is traffic between a first node and a second node, and the feature identifier is added by the first node or the second node; Based on the monitoring function corresponding to the characteristic identifier, the target flow is analyzed to obtain flow information; When the flow information does not meet the monitoring conditions corresponding to the monitoring function, an early warning prompt is issued.

2. The method according to claim 1, characterized in that The step of filtering target traffic from the network traffic according to a preset feature identifier includes: For a data packet in the network traffic, extract identification information of the data packet; Taking the data packet whose identification information includes a preset characteristic identification as a target data packet; The target flow is determined according to the target data packet.

3. The method according to claim 1, characterized in that The monitoring function includes a data transmission monitoring function and an abnormal flow monitoring function; The analyzing the target flow based on the monitoring function corresponding to the characteristic identifier to obtain flow information includes: When the data transmission monitoring function is turned on, the number of data packets within a preset time period is obtained in the target flow; the flow information includes the number of data packets; When the abnormal flow monitoring function is turned on, flow monitoring is performed on the target flow to obtain the transmission volume; the flow information includes the transmission volume.

4. The method according to claim 3, characterized in that When the flow information does not meet the monitoring condition corresponding to the monitoring function, an early warning prompt is issued, including: When the data transmission monitoring function is in an on state, obtaining a quantity interval corresponding to the data transmission monitoring function; When the number of data packets does not belong to the number range, a first warning message is sent to the control node.

5. The method according to claim 3, characterized in that: When the flow information does not meet the monitoring condition corresponding to the monitoring function, an early warning prompt is issued, including: When the abnormal flow monitoring function is in an on state, obtaining a preset flow threshold corresponding to the abnormal flow monitoring function; When the transmission volume is greater than the preset flow threshold, a second warning message is sent to the control node.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Receiving a setting instruction sent by a control node; the setting instruction is generated by the control node in response to a setting operation, obtaining a feature identifier in a setting page, a monitoring function corresponding to the feature identifier, and a monitoring condition of the monitoring function, and based on the feature identifier, the monitoring function, and the monitoring condition; The feature identifier, the monitoring function corresponding to the feature identifier, and the monitoring condition of the monitoring function included in the setting instruction are obtained.

7. A flow monitoring device, characterized in that: include: An acquisition module, used to acquire network traffic in a bypass manner; A screening module, used for screening target traffic from the network traffic according to a preset feature identifier; The target traffic is the traffic between the first node and the second node, and the characteristic identifier is added by the first node or the second node; An analysis module, used to analyze the target flow based on the monitoring function corresponding to the feature identifier to obtain flow information; The early warning module is used to issue an early warning prompt when the flow information does not meet the monitoring conditions corresponding to the monitoring function.

8. A bypass monitoring device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The method comprises computer-executable instructions, which implement the method according to any one of claims 1 to 6 when executed by a processor.

Images