Network traffic mirroring method and device, electronic equipment and storage medium

Abstract

The invention provides a network traffic mirroring method and device, electronic equipment and a storage medium, and the network traffic mirroring method comprises the steps: determining a first storage address of mirroring traffic when traffic mirroring needs to be carried out on original network traffic, and pre-storing a second storage address of the original network traffic in a system memory in the first storage address; and based on a second storage address in the first storage address, obtaining the original network flow in the system memory, and determining the original network flow as the mirror image flow. The storage address, namely the second storage address, of the original network flow in the system memory is directly provided to the outside, so that the original network flow is directly accessed based on the second storage address, the mirroring of the original network flow is realized, the process of copying the original network flow from one memory area of the system to another memory area can be avoided, and the network flow mirroring efficiency is improved. Therefore, resources provided by the system for copying the original network traffic are saved, and the data processing efficiency of each service processing unit in the system is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network traffic mirroring method, device, electronic device and storage medium. Background Art

[0002] As network technology continues to deepen in production and life, network security has gradually become important. In order to maintain network security, one of the ways is to perform security detection on network traffic.

[0003] At present, in network traffic security detection, the main technology used is traffic mirroring, that is, the original network traffic is copied and distributed to different, decoupled, and heterogeneous business processing units for processing. In this way, the business processing units can be decoupled and work in parallel without interfering with each other. Specifically, after the system memory generates network traffic, the network traffic in the system memory needs to be copied from one area in the system memory to another area in the system memory. Then, different business processing units in the system obtain network traffic from another area in the system memory, and then perform various security checks on the obtained network traffic.

[0004] However, in the process of traffic mirroring, the prior art needs to copy the network traffic from one area of ​​the system memory to another area of ​​the system memory, that is, read the network traffic from one area of ​​the system memory, and write the network traffic to another area of ​​the system memory, which will occupy a large amount of resources in the system central processing unit (CPU), especially when the copied network traffic is large, the occupation of CPU resources is more obvious. The large amount of CPU resources occupied by the copy of network traffic will lead to a reduction in the CPU resources allocated to each business processing unit in the system, thereby reducing the data processing efficiency of each business processing unit in the system. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a network traffic mirroring method, device, electronic device and storage medium to improve the data processing efficiency of each business processing unit in the system.

[0006] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] A first aspect of the present application provides a network traffic mirroring method, the method comprising: when it is necessary to mirror the original network traffic, determining a first storage address of the mirrored traffic, wherein the first storage address pre-stores a second storage address of the original network traffic in a system memory; based on the second storage address in the first storage address, obtaining the original network traffic in the system memory, and determining the original network traffic as the mirrored traffic.

[0008] Compared with the prior art, the network traffic mirroring method provided in the first aspect of the present application, when it is necessary to mirror the original network traffic, no longer directly copies the original network traffic, but directly provides the storage address of the original network traffic in the system memory, that is, the second storage address, to the outside, so as to directly access the original network traffic based on the second storage address, thereby realizing the mirroring of the original network traffic. Compared with the traditional method of first reading from one area of ​​the system memory and writing the read original network traffic to another area of ​​the system memory, and then reading and processing the original network traffic from another area of ​​the system memory, the method provided in the embodiment of the present application can avoid the process of copying the original network traffic from one memory area of ​​the system to another memory area, thereby saving the resources provided by the system for the copying of the original network traffic, and then investing more system resources in the network traffic mirroring of each business processing unit, thereby improving the data processing efficiency of each business processing unit in the system.

[0009] In other embodiments provided by the first aspect of the present application, the first storage address includes a queue; before determining the first storage address of the mirrored traffic, the method further includes: recording the second storage address of the original network traffic in the queue, and configuring a reference count for the second storage address, the reference count being used to characterize the maximum number of times the mirror of the original network traffic is allowed to be obtained through the second storage address; obtaining the original network traffic in the system memory based on the second storage address in the first storage address includes: obtaining the second storage address from the queue; obtaining the original network traffic in the system memory based on the second storage address; the method further includes: each time after obtaining the original network traffic in the system memory based on the second storage address in the queue, reducing the reference count of the second storage address in the queue by 1 until the reference count is 0, releasing the second storage address from the queue.

[0010] By configuring a reference count for the second storage address of the original network traffic, and after the service processing unit accesses and processes the original network traffic through the second storage address, the reference count of the second storage address is reduced by 1 until the reference count of the second storage address becomes 0, and then the second storage address is released. In this way, it can be ensured that the original network traffic corresponding to the second storage address is processed by all service processing units before the second storage address is released, thereby ensuring the correctness and security of the original network traffic data processing.

[0011] In other embodiments provided in the first aspect of the present application, configuring a reference count for the second storage address includes: determining the number of business processing units in the system that need to perform traffic mirroring on the original network traffic; and configuring the number as a reference count for the second storage address.

[0012] By using the service processing unit of the original network traffic to determine the reference count of the second storage address of the original network traffic, the number of times the original network traffic is used can be accurately controlled, further improving the data security of the original network traffic.

[0013] In other embodiments provided in the first aspect of the present application, configuring a reference count for the second storage address includes: storing the reference count at a location pointed to by the second storage address.

[0014] By storing the reference count of the second storage address of the original network traffic at the location indicated by the second storage address of the original network traffic, once the original network traffic is used, the reference count can be immediately updated at that location, thereby improving the updating efficiency of the reference count of the second storage address of the original network traffic and improving the accuracy of the original network traffic usage control.

[0015] In other embodiments provided by the first aspect of the present application, before reducing the reference count of the second storage address in the queue by 1, the method also includes: determining whether there is a business processing unit in a preset list that generates a signal indicating that the processing of the original network traffic is completed, and the preset list stores all business processing units that need to perform traffic mirroring on the original network traffic; if so, deleting the business processing unit that generates the signal from the preset list, and executing the step of reducing the reference count of the second storage address by 1; if not, maintaining the reference count of the second storage address unchanged.

[0016] Before reducing the reference count of the second storage address by 1, it is determined whether a business processing unit has generated a network traffic mirroring completion signal, thereby determining whether a certain business processing unit has processed the original network traffic. Only after it is determined that a certain business processing unit has processed the original network traffic, the reference count of the second storage address of the original network traffic is reduced by 1, ensuring that each business processing unit that needs to process the original network traffic can complete the processing of the original network traffic, thereby ensuring the integrity of the original network traffic processing.

[0017] In other embodiments provided by the first aspect of the present application, before determining the first storage address of the mirrored traffic, the method also includes: applying for the second storage address from a memory pool, the memory pool containing multiple storage addresses in the system memory; storing the original network traffic at the second storage address; after determining the original network traffic as mirrored traffic, the method also includes: when the original network traffic completes all mirroring, putting the second storage address back into the memory pool.

[0018] By applying for a second storage address in the system memory for the original network traffic from the memory pool and releasing the second storage address of the original network traffic after the original network traffic is processed, the second storage address in the memory pool can be recycled, avoiding system memory exhaustion and ensuring sustainable mirroring processing of the original network traffic in the system memory.

[0019] In other embodiments provided by the first aspect of the present application, before determining the original network traffic as mirror traffic, the method also includes: determining whether the original network traffic needs to be saved, whether it needs to be used in new original network traffic processing, or whether the original network traffic needs to be modified; if at least one is yes, copying the original network traffic from the system memory to a specified location through a memcpy function, and using the original network traffic stored at the specified location as mirror traffic; if both are no, executing the step of determining the original network traffic as mirror traffic.

[0020] Before processing the original network traffic of the mirror, it is determined whether the original network traffic needs to be saved, reused or modified. When it is determined that the original network traffic needs to be saved, reused or modified, the original network traffic is copied from the system memory to the specified location through the memcpy function, and the original network traffic is saved, reused or stored at the specified location. This can avoid the original network traffic in the system memory from being modified, ensure that the original network traffic obtained and processed by each business processing unit is the original traffic, and improve the accuracy of original network traffic processing.

[0021] A second aspect of the present application provides a network traffic mirroring method, the method comprising: determining a second storage address of the original network traffic in the system memory; storing the second storage address in a first storage address corresponding to the mirrored traffic, so that when it is necessary to mirror the original network traffic, the original network traffic in the system memory can be obtained based on the second storage address in the first storage address, and the original network traffic can be determined as the mirrored traffic.

[0022] The third aspect of the present application provides a network traffic mirroring device, which includes: a determination module, which is used to determine a first storage address of the mirrored traffic when it is necessary to mirror the original network traffic, and the first storage address is pre-stored with a second storage address of the original network traffic in the system memory; a mirroring module, which is used to obtain the original network traffic in the system memory based on the second storage address in the first storage address, and determine the original network traffic as the mirrored traffic.

[0023] A fourth aspect of the present application provides a network traffic mirroring device, which includes: a storage module, used to store a second storage address of the original network traffic in the system memory in a first storage address, so that when it is necessary to mirror the original network traffic, the original network traffic in the system memory can be obtained based on the second storage address in the first storage address, and the original network traffic can be determined as mirrored traffic.

[0024] The fifth aspect of the present application provides an electronic device, which includes: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other through the bus; and the processor is used to call program instructions in the memory to execute the method in the first aspect or the second aspect.

[0025] A sixth aspect of the present application provides a computer-readable storage medium, the storage medium comprising: a stored program; wherein, when the program is executed, the device where the storage medium is located is controlled to execute the method in the first aspect or the second aspect.

[0026] The network traffic mirroring method provided in the second aspect of the present application, the network traffic mirroring devices provided in the third and fourth aspects, the electronic device provided in the fifth aspect, and the computer-readable storage medium provided in the sixth aspect have the same or similar beneficial effects as the network traffic mirroring method provided in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0028] Figure 1 It is a schematic diagram of the architecture of the traditional network traffic mirroring method;

[0029] Figure 2 The schematic diagram of the network traffic mirroring method in the embodiment of the present application is shown in FIG. Figure 1 ;

[0030] Figure 3 The flow diagram of the network traffic mirroring method in the embodiment of the present application is as follows: Figure 1 ;

[0031] Figure 4 The flow diagram of the network traffic mirroring method in the embodiment of the present application is as follows: Figure 2 ;

[0032] Figure 5 The flow diagram of the network traffic mirroring method in the embodiment of the present application is as follows: Figure 3 ;

[0033] Figure 6 The structure of the network traffic mirroring device in the embodiment of the present application is shown as follows: Figure 1 ;

[0034] Figure 7 The structure of the network traffic mirroring device in the embodiment of the present application is shown as follows: Figure 2 ;

[0035] Figure 8 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0037] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0038] Currently, to perform security inspections on network traffic, it is necessary to first copy the original network traffic from one area of ​​the system memory to another area of ​​the system memory, and then obtain and process the traffic data from the other area of ​​the system memory. Copying the original network traffic from one area of ​​the system memory to another area of ​​the system memory requires the system to allocate a large amount of CPU resources for it, which in turn reduces the CPU resources allocated to other business processing units in the system, thereby reducing the data processing efficiency of each business processing unit in the system.

[0039] However, if the original network traffic is no longer copied from one area of ​​the system memory to another, and the original network traffic is directly obtained and processed from this area of ​​the system memory, the system will no longer need to provide a large amount of CPU resources for the copying of the original network traffic. These CPU resources can be allocated to various business processing units within the system, thereby improving the data processing efficiency of each business processing unit within the system.

[0040] In view of this, the embodiments of the present application provide a network traffic mirroring method, device, electronic device and storage medium, which provide a second storage address of the original network traffic in the system memory, and subsequently directly obtain the original network traffic from the system memory through the second storage address, and give it to different business processing units for processing, thereby realizing the mirroring of the original network traffic. In this way, it is possible to avoid the process of copying the original network traffic from one memory area of ​​the system to another memory area, thereby saving the resources provided by the system for the copying of the original network traffic, and then investing more system resources in the network traffic mirroring of each business processing unit, thereby improving the data processing efficiency of each business processing unit in the system.

[0041] First, the overall architecture of the network traffic mirroring method provided in the embodiment of the present application is described.

[0042] Figure 1 This is a schematic diagram of the architecture of the traditional network traffic mirroring method. Figure 1 As shown, the architecture is located in a system, and the system may include a CPU 11, a first memory area 12, a second memory area 13, and a business processing unit 14. Among them, the CPU 11 is connected to the first memory area 12, the second memory area 13, and the business processing unit 14 respectively, and the first memory area 12, the second memory area 13, and the business processing unit 14 are connected in sequence. When the business processing unit 14 needs to process the network traffic, after the original network traffic enters the first memory area 12 of the system, the CPU 11 will first copy the original network traffic from the first memory area 12 to the second memory area 13, that is, the original network traffic is mirrored in the second memory area 13, and then the CPU 11 enables the business processing unit 14 to obtain the mirrored traffic from the second memory area 13, and then the business processing unit 14 processes the obtained mirrored traffic. Since the original network traffic is copied from the first memory area 12 of the system to the second memory area 13, the CPU 11 of the system will provide resources for the copying process, which will result in a reduction in the CPU 11 resources obtained by the business processing unit 14, thereby reducing the data processing efficiency of the business processing unit 14 in the system.

[0043] Figure 2 The schematic diagram of the network traffic mirroring method in the embodiment of the present application is shown in FIG. Figure 1 , see Figure 2As shown, the architecture is located in a system, and the system may include a CPU 21, a first memory area 22, a second memory area 23, and a business processing unit 24. Among them, the CPU 21, the first memory area 22, the second memory area 23, and the business processing unit 24 are interconnected. When the business processing unit 24 needs to process the network traffic, after the original network traffic enters the first memory area 22 of the system, the CPU 21 first stores the storage address of the original network traffic in the first memory area 22 in the second memory area 23, and then the CPU 21 enables the business processing unit 24 to obtain the storage address of the original network traffic from the second memory area 23, and then the business processing unit 24 obtains and processes the original network traffic from the first memory area 22 according to the obtained storage address. At this time, the original network traffic is no longer copied from the first memory area 22 of the system to the second memory area 23, and only the storage address of the original network traffic in the first memory area 22 is stored in the second memory area 23. The storage of the storage address will not consume too many resources of the CPU 21, and almost all of the resources of the CPU 21 can be provided to the service processing unit 24, thereby improving the data processing efficiency of the service processing unit 24 in the system.

[0044] Next, the storage and use of the storage address of the original network traffic in the system memory to achieve the mirroring of the network traffic, these two processes are combined together to explain in detail the network traffic mirroring method provided in the embodiment of the present application.

[0045] Figure 3 The flow diagram of the network traffic mirroring method in the embodiment of the present application is as follows: Figure 1 , see Figure 3 As shown, the method may include:

[0046] S31: Determine a second storage address of the original network traffic in the system memory.

[0047] Original network traffic may refer to data transmitted in the network, i.e., messages. Original network traffic may refer to one original network traffic message or a collection of multiple original network traffic messages. The specific content and form of original network traffic are not limited here.

[0048] After the original network traffic is generated, it will first enter the system memory. An area in the system memory will store the original network traffic. The storage location of the original network traffic in this area is the second storage address. The second storage address can be allocated by the system memory after the application, or it can be specified to the system memory.

[0049] S32: Store the second storage address in the first storage address corresponding to the mirrored traffic.

[0050] When it is necessary to mirror the original network traffic, the second storage address is stored in the first storage address corresponding to the mirrored traffic, and the first storage address can be in the system memory or outside the system memory. In this way, the service processing unit in the subsequent system can obtain the second storage address of the original network traffic from the first storage address, and then obtain the original network traffic from the system memory based on the second storage address, and process the original network traffic.

[0051] S33: When it is necessary to mirror the original network traffic, determine a first storage address of the mirrored traffic.

[0052] It should be noted that the above steps S31-S32 can be completed in advance before the traffic mirroring is required, so that the second storage address is pre-stored in the first storage address, so that when the traffic mirroring is required, the traffic mirroring of the original network traffic can be realized by directly executing steps S33-S34. Of course, in some other embodiments, the traffic mirroring of the original network traffic can also be realized by completely executing steps S31-S34.

[0053] The original network traffic needs to be mirrored. Generally speaking, it is necessary to perform security detection and other processing on the network traffic in the system memory. At this time, the original network traffic in the system memory is no longer directly copied from one memory area to another memory area, but the second storage address of the original network traffic in the system memory is directly obtained. The second storage address has been stored in the first storage address in advance. Therefore, the first storage address is determined first.

[0054] The first storage address may be variable. The first storage address stored in the second storage address may be different for different types of original network traffic involving different objects. The first storage address may be pre-stored in a certain location and retrieved when needed. The first storage address may also be fixed. The first storage address is made known to each business processing unit in advance, so that when the business processing unit needs the original network traffic, the second storage address of the original network traffic can be directly obtained from the first storage address.

[0055] S34: Based on the second storage address in the first storage address, original network traffic in the system memory is obtained, and the original network traffic is determined as mirror traffic.

[0056] After determining the first storage address, the second storage address can be obtained from the first storage address, and the service processing unit in the system can find the specific storage location of the original network traffic in the system memory according to the second storage address, and then directly read the original network traffic from the location. The specific method of accessing and obtaining the original network traffic in the system memory based on the second storage address is the same as the specific implementation method of accessing and obtaining data through the conventional address, and will not be repeated here.

[0057] As can be seen from the above content, the network traffic mirroring method provided in the embodiment of the present application no longer directly copies the original network traffic when it is necessary to mirror the original network traffic. Instead, the storage address of the original network traffic in the system memory, i.e., the second storage address, is directly provided to the outside so as to directly access the original network traffic based on the second storage address, thereby realizing the mirroring of the original network traffic. Compared with the traditional method of first reading from one area of ​​the system memory and writing the read original network traffic to another area of ​​the system memory, and then reading and processing the original network traffic from another area of ​​the system memory, the method provided in the embodiment of the present application can avoid the process of copying the original network traffic from one memory area of ​​the system to another memory area, thereby saving the resources provided by the system for the copying of the original network traffic, and then investing more system resources in the network traffic mirroring of each business processing unit, thereby improving the data processing efficiency of each business processing unit in the system.

[0058] Furthermore, as a Figure 3 As a refinement and extension of the method shown, an embodiment of the present application also provides a network traffic mirroring method.

[0059] Figure 4 The flow diagram of the network traffic mirroring method in the embodiment of the present application is as follows: Figure 2 , see Figure 4 As shown, the method may include:

[0060] S41: Apply for a second storage address from the memory pool.

[0061] The memory pool includes multiple storage addresses in the system memory.

[0062] In the system memory, a portion of storage space is reserved. The address corresponding to the reserved storage space can be placed in the memory pool, so that when the space in the memory is needed to store data later, the address can be obtained from the memory pool and the data can be stored at the address.

[0063] For example, assume that the system memory includes storage space a, storage space b, and storage space c. First, storage space a can be reserved for use by other modules in the system. Then, storage address b corresponding to storage space b and storage address c corresponding to storage space c are placed in the memory pool. The memory pool now has storage address b and storage address c. When raw network traffic is generated in the system, the system can apply for a storage address from the memory pool to store the raw network traffic.

[0064] The specific storage addresses and quantities that the memory pool sends to the system can be determined based on the original network traffic to be stored and the size of the storage space corresponding to each storage address. For example, the memory pool contains storage address a, storage address b, and storage address c. The storage space size of the system memory corresponding to storage address a is 1MB, the storage space size of the system memory corresponding to storage address b is 1MB, and the storage space size of the system memory corresponding to storage address c is 2MB. When the data size of the original network traffic to be stored is 2MB, the memory pool can give storage address a and storage address b to the system to store network traffic, or it can give storage address c to the system to store network traffic.

[0065] S42: Store the original network traffic at the second storage address.

[0066] After receiving the application from the system, the memory pool will give one or several storage addresses therein as the second storage address to the system. The system can then store the generated original network traffic at the location corresponding to the second storage address.

[0067] S43: Record the second storage address of the original network traffic in a queue, and configure a reference count for the second storage address.

[0068] The reference count is used to represent the maximum number of times that the mirror image of the original network traffic is allowed to be obtained through the second storage address. What is obtained from the system memory is actually the mirror image of the original network traffic.

[0069] After the original network traffic is stored in the system memory according to the second storage address, the second storage address can be recorded in the queue, so that when the business processing unit in the subsequent system needs to process the original network traffic, the second storage address can be obtained from the queue, and the original network traffic can be obtained from the system memory according to the second storage address, thereby processing the original network traffic.

[0070] Since the original network traffic is generated in real time and may not be processed immediately after it is generated, the queue generally stores multiple second storage addresses of the original network traffic. In addition, different original network traffic may sometimes be processed in parallel, so the number of queues in the system may not be just one. For example: After the original network traffic 1 is generated, the second storage address 1 of the original network traffic 1 in the system memory is stored in queue 1. After the original network traffic 2 is generated, the second storage address 2 of the original network traffic 2 in the system memory is stored in queue 1, and the second storage address 2 is stored after the second storage address 1. After the original network traffic 3 is generated, the second storage address 3 of the original network traffic 3 in the system memory is stored in queue 2. For the second storage address in the queue, in principle, it is first-in-first-out. The specific number of queues is not limited here.

[0071] In actual applications, the storage space size of the memory pool needs to be larger than the space size corresponding to the second storage address in the queue. This is because: when the production capacity of raw network traffic is greater than the processing capacity, that is, the production of raw network traffic is faster and the processing of raw network traffic is slower, even if there is a backlog in the queue or even a full queue, the memory pool can still provide enough space to store the newly generated raw network traffic, ensuring that the newly generated raw network traffic will not be lost due to the full queue. When the queue reaches the full queue, the second storage address that requests to enter the queue will be rejected to ensure that the existing second storage address in the queue will not be squeezed out, thereby ensuring that the raw network traffic that has not been processed earlier can be processed.

[0072] There can be multiple queues, but the storage space corresponding to each queue cannot be greater than N / n, where N is the total storage space of the memory pool and n is the number of queues. This ensures that each queue has a sufficiently large storage space.

[0073] After the second storage address is recorded in the queue, in order to avoid unlimited acquisition and processing of the original network traffic from the system memory through the second storage address, a reference count can be configured for the second storage address, that is, the reference count is configured to the number of times the original network traffic in the system memory needs to be limited to be processed.

[0074] In practical applications, the reference count can be configured according to the number of service processing units that process the original network traffic. Specifically, the above step S43 may include:

[0075] Step A1: Determine the number of service processing units in the system that need to perform traffic mirroring on original network traffic.

[0076] Not all service processing units in the system need to use the mirror image of the original network traffic. Therefore, it is necessary to first determine the service processing units in the system that need to use the mirror image of the original network traffic, and then count the number of these service processing units.

[0077] When determining the service processing unit that needs to use a certain original network traffic mirror in the system, the service processing unit may report to the system which original network traffic it needs to process, so that the system determines the service processing unit that needs to process the original network traffic based on the content reported by each service processing unit, and then determines the number. Alternatively, the system may directly determine the service processing unit that processes the original network traffic based on the preset functions of each service processing unit, and then determines the number.

[0078] Step A2: configuring the quantity as a reference count of the second storage address.

[0079] After the number of service processing units that need to process the original network traffic is determined, the number can be used as a reference count of the second storage address of the original network traffic.

[0080] For example, assume that the system includes business processing unit 1, business processing unit 2, and business processing unit 3. Among them, business processing unit 1 is used to detect threats on original network traffic, business processing unit 2 is used to detect sensitive information on original network traffic, and business processing unit 3 is used to forward emails. For original network traffic, only business processing unit 1 and business processing unit 2 need to process the original network traffic. Therefore, the number of business processing units that need to use the original network traffic mirror in the system is 2, and the reference count of the second storage address of the original network traffic is configured to 2.

[0081] After configuring the reference count for the second storage address of the original network traffic, the reference count needs to be stored in a place that is convenient for obtaining the access status of the original network traffic and for modifying the reference count. This place can be the location pointed to by the second storage address, that is, the storage space corresponding to the storage location in the system memory.

[0082] Specifically, the above step S43 may include:

[0083] Step B1: Store the reference count at the location pointed to by the second storage address.

[0084] That is, the reference count of the second storage address of the original network traffic in the system memory is stored in the system memory and is stored in the same location as the original network traffic. In this way, after a service processing unit obtains and processes the original network traffic, the reference count of the second storage address of the original network traffic can be modified at a minimum cost without using other storage space or using other modules for monitoring and interaction.

[0085] Of course, the reference count can also be stored in other locations inside or outside the system, which is not specifically limited here.

[0086] S44: Obtain a second storage address from the queue.

[0087] The queue stores multiple second storage addresses of original network traffic. Based on the first-in-first-out principle, the earliest second storage address entering the queue is obtained.

[0088] S45: Acquire original network traffic in the system memory based on the second storage address, and determine the original network traffic as mirror traffic.

[0089] The specific implementation method of the above step S45 is the same as that of the above step S33, which will not be repeated here.

[0090] S46: Process the original network traffic.

[0091] After obtaining the original network traffic from the system memory, the original network traffic can be processed by security detection, traffic distribution, etc. When the specific processing is security detection, the business processing unit is the security detection module, and the security detection module will perform security detection on the original network traffic. When the specific processing is traffic distribution, the business processing unit is the traffic distribution module, and the traffic distribution module will distribute the original network traffic to different modules in the system for consumption. For example: the traffic distribution module obtains traffic message A and traffic message B from the system memory, and the traffic distribution module distributes traffic message A to consumption module 1 and distributes traffic message B to consumption module 2. The same traffic message can only be distributed to one consumption module and cannot be distributed to different consumption modules at the same time. This is to ensure load balancing.

[0092] S47: Determine whether there is a service processing unit in the preset list that generates a signal indicating that the original network traffic processing is completed. If yes, execute S48; if no, execute S49.

[0093] The preset list stores all the service processing units that need to perform traffic mirroring on the original network traffic.

[0094] After each service processing unit has processed the original network traffic, a signal is generated to let the system know that the service processing unit has processed the original network traffic. After the system sees the signal, it will know that the service processing unit has processed the corresponding original network traffic. The signal may include the identification of the service processing unit and the identification of the original network traffic. In this way, after obtaining the signal, the system can know which service processing unit in the system has processed the original network traffic through the identification of the service processing unit in the signal, and can know which original network traffic has been processed through the identification of the original network traffic in the signal.

[0095] The service processing unit that generates the above signal needs to be a service processing unit in the preset list. Because in the preset list, the various service processing units in the system that need to use the original network traffic mirror are pre-counted. Only when the service processing unit in the preset list generates the above signal, can it be said that one or several service processing units in the system that really need to process the original network traffic have processed the original network traffic. If the system detects that a service processing unit outside the preset list generates the above signal, it is necessary to generate and output an alarm message to inform the system administrator that the service processing unit that processes the original network traffic is in chaos and needs to be corrected.

[0096] S48: Deleting the service processing unit that generates the signal from the preset list.

[0097] After a service processing unit has processed the original network traffic, the service processing unit can be deleted from the preset list. In this way, the preset list can be used to monitor in real time which service processing units have not processed the original network traffic, and the service processing unit that has processed the original network traffic can be avoided when judging the service processing unit that sends the signal later, thereby improving the efficiency of finding the service processing unit in the preset list.

[0098] S49: Maintain the reference count of the second storage address unchanged.

[0099] When the service processing unit that has processed the original network traffic is not a service processing unit in the preset list, it means that the service processing unit is not a service processing unit that is pre-planned to process the original network traffic. In order to ensure that the service processing units that are pre-planned to process the original network traffic can process the original network traffic, the reference count of the second storage address is no longer reduced by 1 at this time, so as to avoid the second storage address being released too early and causing some service processing units that really need to process the original network traffic to be unable to process the original network traffic. Then, the next process of obtaining the original network traffic based on the second storage address in the queue is performed, that is, the above-mentioned step S45.

[0100] S410: After acquiring the original network traffic in the system memory based on the second storage address in the queue each time, subtract 1 from the reference count of the second storage address.

[0101] When the original network traffic in the system memory is obtained through the second storage address in the queue and the original network traffic is processed by the business processing unit in the preset list, it means that the original network traffic is processed according to the pre-set requirements. The reference count of the second storage address of the original network traffic can be reduced by 1, so that the reference count of the second storage address is normally reduced when each business processing unit processes the original network traffic normally.

[0102] After the original network traffic is processed by each business processing unit in the system, the reference count of the second storage address will become 0, and the second storage address of the original network traffic in the system memory needs to be released so that the address in the system memory can be recycled. Once the second storage address is released, the original network traffic no longer exists in the system memory. Therefore, before releasing the second storage address, it is also necessary to determine whether the original network traffic stored in the released address will be used later or needs to be modified.

[0103] S411: When the reference count of the second storage address is 0, determine whether the original network traffic needs to be saved, whether it needs to be used in the new original network traffic processing, or whether the original network traffic needs to be modified. If at least one of them is yes, execute S412 first, then execute S413, if both are no, directly execute S413.

[0104] After the second storage address of the original network traffic is used up, once the second storage address is released, the original network traffic will no longer be stored in the location corresponding to the address in the system memory, and the original network traffic may even be deleted. However, in some cases, the original network traffic needs to be backed up. For example: the original network traffic needs to be stored for a long time, or the current original network traffic needs to be used to process the next original network traffic, or even to process one or several subsequent original network traffic, or the current original network traffic needs to be modified, but the original network traffic cannot be modified directly in the system memory because it will affect the correctness of other business processing units obtaining the original network traffic. Therefore, it is necessary to determine whether the current original network traffic belongs to the above situation in order to determine whether the original network traffic needs to be copied from the system memory to ensure that the original network traffic can continue to be used in subsequent processes.

[0105] S412: The original network traffic is copied from the system memory to the specified location through the memcpy function, and the original network traffic stored in the specified location is used as the mirror traffic.

[0106] When the original network traffic needs to be stored for a long time, needs to be used in subsequent network traffic mirroring, or needs to be modified but cannot be modified directly in the system memory, the original network traffic needs to be copied from the system memory to a specified location.

[0107] In the process of copying, the memcpy(dst,src) function can be used. src represents the second storage address of the original network traffic in the system memory, and dst represents the second storage address of the copied original network traffic, which can be outside the system memory or in the system memory. The memcpy function will copy the original network traffic pointed to by the src address to the dst address, thereby copying the original network traffic.

[0108] S413: Release the second storage address, and put the second storage address back into the memory pool.

[0109] After a business processing unit processes the original network traffic, the reference count of the second storage address of the original network traffic is reduced by 1. After all the planned business processing units have processed the original network traffic, the reference count of the second storage address of the original network traffic becomes 0. At this time, it means that the business processing units pre-planned in the system to process the original network traffic have all processed the original network traffic, and the second storage address of the original network traffic can be released, that is, returned to the memory pool, so that new original network traffic can be stored in the system memory and continue to be used.

[0110] Finally, the network traffic mirroring method provided in the embodiment of the present application is further explained with a specific example.

[0111] Figure 5 The flow diagram of the network traffic mirroring method in the embodiment of the present application is as follows: Figure 3 , see Figure 5 As shown, the process is executed by multiple devices, which may include: an original traffic production device 51, a mirror traffic production device 52, a mirror traffic cache device 53, a mirror traffic consumption device 54, and a memory pool and management device 55.

[0112] After the original traffic production device 51 produces the original message, the method may perform the following steps:

[0113] Step 1: The original traffic production device 51 applies to the memory pool and management device 55 (which includes a memory pool, and the memory pool contains the address of the pre-applied system memory) for the address used to carry the original message.

[0114] Step 2: The memory pool and management device 55 returns address A to the original traffic production device 51.

[0115] Step 3: The original traffic production device 51 stores the original message according to address A.

[0116] Step 4: The original traffic production device 51 reports address A to the mirrored traffic production device 52.

[0117] Step 5: The mirrored traffic production device 52 sends address A to each mirrored traffic cache device 53 and increases the reference count of address A by 1.

[0118] Step 6: Each mirrored traffic caching device 53 removes address A from the queue and sends address A to the corresponding mirrored traffic consuming device 54 .

[0119] Step 7: Each mirrored traffic consumption device 54 obtains the original message through address A, consumes the original message, and reduces the reference count of the corresponding address A by 1.

[0120] Step 8: When the reference count of address A is 0, the mirror traffic consumption device 54 releases address A to the memory pool and management device 55.

[0121] At this point, the network traffic mirroring method provided in the embodiment of the present application has been fully described.

[0122] Based on the same inventive concept, as an implementation of the above method, an embodiment of the present application also provides a network traffic mirroring device.

[0123] Figure 6 The structure of the network traffic mirroring device in the embodiment of the present application is shown as follows: Figure 1 , see Figure 6 As shown, the device may include: a first determination module 61, a storage module 62, a second determination module 63 and a mirror module 64. The first determination module 61, the storage module 62, the second determination module 63 and the mirror module 64 are connected in sequence.

[0124] The first determining module 61 is used to determine a second storage address of the original network traffic in the system memory.

[0125] The storage module 62 is used to store the second storage address in the first storage address corresponding to the mirrored traffic, so that when it is necessary to mirror the original network traffic, the original network traffic in the system memory can be obtained based on the second storage address in the first storage address, and the original network traffic can be determined as the mirrored traffic.

[0126] The second determination module 63 is used to determine a first storage address of the mirrored traffic when it is necessary to mirror the original network traffic, wherein the first storage address pre-stores a second storage address of the original network traffic in the system memory.

[0127] The mirroring module 64 is used to obtain the original network traffic in the system memory based on the second storage address in the first storage address, and determine the original network traffic as the mirrored traffic.

[0128] Furthermore, as a Figure 6 As a refinement and expansion of the device shown, an embodiment of the present application also provides a network traffic mirroring device.

[0129] Figure 7 The structure of the network traffic mirroring device in the embodiment of the present application is shown as follows: Figure 2 , see Figure 7 As shown, the device may include: an application module 71, a storage module 72, a recording module 73, an acquisition module 74, a mirroring module 75, a processing module 76, a first judgment module 77, a deletion module 78, a maintenance module 79, a subtract module 710, a second judgment module 711, a backup module 712 and a release module 713. Among them, the application module 71, the storage module 72, the recording module 73, the acquisition module 74, the mirroring module 75, the processing module 76, the first judgment module 77, the deletion module 78, the subtract module 710, the second judgment module 711, the backup module 712 and the release module 713 are connected in sequence. The first judgment module 77 is connected to the maintenance module 79. The second judgment module 711 is connected to the release module 713.

[0130] The application module 71 is used to apply for the second storage address from a memory pool, where the memory pool contains multiple storage addresses in the system memory.

[0131] The storage module 72 is used to store the original network traffic at the second storage address.

[0132] The recording module 73 is used to record the second storage address of the original network traffic in the queue included in the first storage address, and configure a reference count for the second storage address, wherein the reference count is used to represent the maximum number of times the mirror of the original network traffic is allowed to be obtained through the second storage address.

[0133] The recording module 73 may include: a determination unit 731 , a configuration unit 732 and a storage unit 733 . The determination unit 731 is connected to the configuration unit 732 .

[0134] The determination unit 731 is used to determine the number of service processing units in the system that need to perform traffic mirroring on the original network traffic.

[0135] The configuration unit 732 is used to configure the number as a reference count of the second storage address.

[0136] The storage unit 733 is used to store the reference count at the location pointed to by the second storage address.

[0137] The acquisition module 74 is used to acquire the second storage address from the queue.

[0138] The mirroring module 75 is used to obtain the original network traffic in the system memory based on the second storage address.

[0139] The processing module 76 is used to process the original network traffic.

[0140] The first judgment module 77 is used to judge whether there is a service processing unit in the preset list that generates a signal indicating that the processing of the original network traffic is completed, and the preset list stores all the service processing units that need to perform traffic mirroring on the original network traffic. If so, it enters the deletion module 78 and then enters the subtraction module 710. If not, it enters the maintenance module 79.

[0141] The deleting module 78 is used to delete the service processing unit that generates the signal from the preset list.

[0142] The maintaining module 79 is used to maintain the reference count of the second storage address unchanged.

[0143] The decrement module 710 is configured to decrement the reference count of the second storage address by 1 each time after acquiring the original network traffic in the system memory based on the second storage address in the queue.

[0144] The second judgment module 711 is used to judge whether the original network traffic needs to be saved, whether it needs to be used in the new original network traffic processing, or whether the original network traffic needs to be modified. If at least one of them is yes, the backup module 712 is first entered, and then the release module 713 is entered. If both are no, the release module 713 is directly entered.

[0145] The backup module 712 is used to copy the original network traffic from the system memory to a specified location through a memcpy function.

[0146] If the original network traffic needs to be modified, the original network traffic stored in the designated location is used as the mirror traffic and then enters the processing module 76.

[0147] If the above situations are all no, the original network traffic is mirrored through the second storage address, that is, the original network traffic accessed through the second storage address can be considered as mirrored traffic.

[0148] The release module 713 is used to release the second storage address from the queue until the reference count is 0, and put the second storage address back into the memory pool.

[0149] It should be noted here that the description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0150] Based on the same inventive concept, an embodiment of the present application also provides an electronic device. Figure 8 This is a schematic diagram of the structure of the electronic device in the embodiment of the present application, see Figure 8 As shown, the electronic device may include: a processor 81, a memory 82, and a bus 83; wherein the processor 81 and the memory 82 communicate with each other via the bus 83; the processor 81 is used to call program instructions in the memory 82 to execute the methods in one or more of the above embodiments.

[0151] It should be noted that the description of the above electronic device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the electronic device embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0152] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method in one or more of the above embodiments.

[0153] It should be noted here that the description of the above storage medium embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the storage medium embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0154] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network traffic mirroring method, characterized in that: The method comprises: When it is necessary to mirror the original network traffic, determine a first storage address of the mirrored traffic, wherein the first storage address pre-stores a second storage address of the original network traffic in the system memory; Based on a second storage address in the first storage address, the original network traffic in the system memory is acquired, and the original network traffic is determined as mirror traffic.

2. The method according to claim 1, characterized in that The first storage address includes a queue; before determining the first storage address of the mirrored traffic, the method further includes: Recording the second storage address of the original network traffic in the queue, and configuring a reference count for the second storage address, wherein the reference count is used to represent a maximum number of times that the mirror image of the original network traffic is allowed to be obtained through the second storage address; The acquiring the original network traffic in the system memory based on the second storage address in the first storage address includes: Obtaining the second storage address from the queue; Acquire the original network traffic in the system memory based on the second storage address; The method further comprises: Each time after the original network traffic in the system memory is obtained based on the second storage address in the queue, the reference count of the second storage address in the queue is reduced by 1 until the reference count is 0, and the second storage address is released from the queue.

3. The method according to claim 2, characterized in that The configuring a reference count for the second storage address includes: Determine the number of service processing units in the system that need to perform traffic mirroring on the original network traffic; The number is configured as a reference count of the second storage address.

4. The method according to claim 2, characterized in that: The configuring a reference count for the second storage address includes: The reference count is stored at the location pointed to by the second storage address.

5. The method according to claim 2, characterized in that: Before decrementing the reference count of the second storage address in the queue by 1, the method further comprises: Determine whether there is a service processing unit in a preset list that generates a signal indicating that the processing of the original network traffic is completed, wherein the preset list stores all service processing units that need to perform traffic mirroring on the original network traffic; If yes, deleting the service processing unit that generates the signal from the preset list, and performing the step of reducing the reference count of the second storage address by 1; If not, the reference count of the second storage address is maintained unchanged.

6. The method according to any one of claims 1 to 5, characterized in that Before determining the first storage address of the mirrored traffic, the method further includes: Applying for the second storage address from a memory pool, where the memory pool contains multiple storage addresses in the system memory; storing the original network traffic at the second storage address; After determining the original network traffic as mirror traffic, the method further includes: When all mirroring of the original network traffic is completed, the second storage address is put back into the memory pool.

7. The method according to any one of claims 1 to 5, characterized in that Before determining the original network traffic as mirror traffic, the method further includes: Determining whether the original network traffic needs to be saved, whether it needs to be used in new original network traffic processing, or whether the original network traffic needs to be modified; If at least one of them is yes, copying the original network traffic from the system memory to a specified location through a memcpy function, and using the original network traffic stored in the specified location as mirror traffic; If both are negative, the step of determining the original network traffic as mirror traffic is performed.

8. A network traffic mirroring method, characterized in that: The method comprises: determining a second storage address of the original network traffic in the system memory; The second storage address is stored in the first storage address corresponding to the mirrored traffic, so that when the original network traffic needs to be mirrored, the original network traffic in the system memory can be obtained based on the second storage address in the first storage address, and the original network traffic can be determined as the mirrored traffic.

9. A network traffic mirroring device, characterized in that: The device comprises: A determination module, used for determining a first storage address of the mirrored traffic when it is necessary to mirror the original network traffic, wherein the first storage address pre-stores a second storage address of the original network traffic in the system memory; The mirroring module is used to obtain the original network traffic in the system memory based on the second storage address in the first storage address, and determine the original network traffic as the mirroring traffic.

10. A network traffic mirroring device, characterized in that: The device comprises: A storage module is used to store the second storage address of the original network traffic in the system memory in the first storage address, so that when it is necessary to mirror the original network traffic, the original network traffic in the system memory can be obtained based on the second storage address in the first storage address, and the original network traffic can be determined as mirrored traffic.

11. An electronic device, characterized in that: The electronic device comprises: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute the method as claimed in any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: The storage medium comprises: a stored program; wherein, when the program is running, the device where the storage medium is located is controlled to execute the method as claimed in any one of claims 1 to 8.

Images