Flow collection method and network equipment

Abstract

The invention provides a flow collection method and network equipment, and relates to the technical field of communication, and the method comprises the steps: receiving a data packet of a to-be-sampled data flow; identifying a data packet of a large stream and a data packet of a small stream in the to-be-sampled data stream; the target parameter value of the large stream in the target time interval is greater than the target parameter value of the small stream in the target time interval; the target parameter value comprises a data packet number and / or a byte number; sampling the large-flow data packet to obtain a large-flow sampling result; sampling the data packet of the small flow to obtain a small flow sampling result; and determining flow statistical information according to the large flow sampling result and the small flow sampling result. According to the technical scheme provided by the invention, the resource overhead can be reduced while the sampling precision is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a traffic collection method and network equipment. Background Art

[0002] Network traffic monitoring is a commonly used method in network management. It can provide important data support for network performance optimization and network security maintenance. As the scale of networks continues to expand, the role of network traffic monitoring in network management is becoming increasingly important.

[0003] Current network traffic monitoring technologies primarily include mirroring and sampling. Mirroring replicates data flows that meet specific criteria and sends them to an observation port for statistics and analysis. This technology mirrors traffic from multiple ports onto a single port, which can easily lead to overload and packet loss, and requires significant processing resources. Sampling, on the other hand, samples data flows at a specific rate before performing statistics and analysis. Commonly used technologies include sampled flow (sFlow) and network traffic (NetStream). These sampling technologies typically sample packets at intervals at a specific rate, determine flow statistics based on the sampling results, and then send these statistics to monitoring and analysis equipment for analysis. Compared to mirroring, sampling can effectively alleviate issues such as overload, packet loss, and excessive resource usage. Therefore, sampling is currently the most widely used technology for network traffic monitoring.

[0004] However, current sampling technology cannot balance sampling accuracy and resource overhead. If the sampling rate is set too low, some data streams may be missed and accuracy may be lost. If the sampling rate is increased, more resource overhead will be added. Summary of the Invention

[0005] In view of this, the present application provides a traffic collection method and a network device for improving sampling accuracy while reducing resource overhead.

[0006] To achieve the above objectives, in a first aspect, an embodiment of the present application provides a traffic collection method, which is applied to a network device and includes:

[0007] receiving data packets of a data stream to be sampled;

[0008] Identify data packets of a large flow and data packets of a small flow in a data flow to be sampled; a target parameter value of the large flow in a target time interval is greater than a target parameter value of the small flow in the target time interval; the target parameter value includes the number of data packets and / or the number of bytes;

[0009] Sampling the data packets of the large flow to obtain the large flow sampling results;

[0010] Sampling the data packets of the small flow to obtain the small flow sampling result;

[0011] Determine flow statistics based on the large flow sampling results and the small flow sampling results.

[0012] The traffic collection method provided in the embodiment of the present application distinguishes between the data packets of large flows and small flows in the sampled data flow and samples them separately. Compared with the traditional method of sampling the data packets of all data flows together, this method can reduce the impact of the large flow data packets with a larger number of packets on the sampling probability of the small flow data packets, thereby improving the sampling accuracy of the small flow and reducing resource overhead.

[0013] In a possible implementation of the first aspect, the data packet carries flow marking information, where the flow marking information is used to indicate a flow category of the data flow to be sampled, where the flow category is a large flow or a small flow;

[0014] Identify the data packets of the large flow and the small flow in the data flow to be sampled, including:

[0015] The data packets of the large flow and / or the data packets of the small flow in the data flow to be sampled are identified according to the flow label information.

[0016] Through the above implementation, processing resources of the network device can be saved.

[0017] In a possible implementation of the first aspect, sampling data packets of a large flow to obtain a large flow sampling result includes:

[0018] Use fixed interval sampling or random sampling to sample the data packets of the large flow and obtain the large flow sampling results;

[0019] Sample the data packets of the small flow to obtain the small flow sampling results, including:

[0020] Sampling is performed according to the flow identification information of the data packets of the small flow to obtain a small flow sampling result.

[0021] In the above embodiment, for large flows in the sampled data stream, fixed interval sampling or random sampling is adopted, so that a relatively high sampling accuracy of the large flows can be obtained; for small flows in the data stream to be sampled, sampling is performed based on the flow identification information of the data packet. In this way, the sampling probability of the data packet is related to the flow identification information of the data packet. Compared with packet sampling in which the sampling probability is mainly related to the number of data packets in the data stream, this sampling method can effectively improve the sampling probability of small flows, thereby further improving the sampling accuracy of small flows without increasing the sampling rate and reducing resource overhead.

[0022] In a possible implementation of the first aspect, sampling according to flow identification information of a data packet of a small flow to obtain a small flow sampling result includes:

[0023] Performing a hash operation on at least part of the flow identification information of each data packet of the small flow to obtain a hash value;

[0024] The small flow sampling result is determined based on the data packets whose hash values are within the target value range.

[0025] Through the above implementation, the sampling efficiency of small flows can be improved.

[0026] In a possible implementation of the first aspect, a hash seed of the hash operation is updated at a preset time interval, which can alleviate the problem of hash polarization and improve the accuracy of small flow sampling.

[0027] In a possible implementation of the first aspect, the flow category corresponding to the data packet is determined based on the service type to which the data packet belongs and / or the target parameter value of the data flow to which it belongs, wherein the target parameter value of the data flow is associated with the service type to which the data flow belongs.

[0028] In a possible implementation of the first aspect, data flows belonging to the same service type include large flows and small flows;

[0029] For large and small flows of the same service type, within the target time interval, the target parameter value of the large flow is greater than or equal to the flow size threshold corresponding to the service type, and the target parameter value of the small flow is less than the flow size threshold corresponding to the service type;

[0030] Different flow size thresholds correspond to different service types.

[0031] Through the above implementation, the accuracy of identifying flow categories can be improved.

[0032] In a possible implementation of the first aspect, at least one stream category includes multiple subcategories, and data streams of different subcategories use different sampling rates, which can further improve the sampling accuracy of the data stream.

[0033] In a possible implementation of the first aspect, the method further includes:

[0034] Receive flow collection control information;

[0035] The stream collection control information includes at least one of the following: a stream collection function switch control command, stream identification information of the data stream, sampling rates corresponding to large and small streams, and stream parameter information for distinguishing large and small streams.

[0036] Through the above implementation, the flow collection process of the network device can be controlled by the flow collection control information, thereby improving the flexibility of flow collection.

[0037] In a possible implementation of the first aspect, the sampling rate of the small flow is greater than the sampling rate of the large flow, which can improve the sampling accuracy of the small flow.

[0038] In a possible implementation of the first aspect, determining flow statistical information according to the large flow sampling result and the small flow sampling result includes:

[0039] Determine the statistics of the large flow based on the large flow sampling results and the large flow sampling rate;

[0040] Determine the small flow statistics based on the small flow sampling result and the small flow sampling rate;

[0041] Combine the large flow statistics and small flow statistics to obtain flow statistics.

[0042] In a possible implementation of the first aspect, the flow identification information includes quintuple information or septuple information, and the flow statistics information includes one or more of the following information: the number of data packets, the number of bytes, and flow collection time information of the data flow.

[0043] In a second aspect, an embodiment of the present application provides a traffic collection method, which is applied to a network device and includes:

[0044] Sampling each data packet of the data stream to be sampled by adopting a fixed-interval sampling method or a random sampling method to obtain a first sampling result;

[0045] Deleting sampling results corresponding to data flows whose target parameter values are less than a first threshold value in the first sampling results to obtain large flow sampling results, where the target parameter values include the number of packets and / or the number of bytes;

[0046] Sampling is performed according to the flow identification information of each data packet of the data flow to be sampled to obtain a second sampling result;

[0047] Deleting the sampling results corresponding to the data flow whose target parameter value is greater than or equal to the second threshold in the second sampling results to obtain the low-volume sampling results;

[0048] Determine flow statistics based on the large flow sampling results and the small flow sampling results.

[0049] The traffic collection method provided in the embodiment of the present application adopts fixed-interval sampling or random sampling to sample the data packets of the sampled data flow to obtain a first sampling result, and then determines the large flow sampling result based on the first sampling result, so that a relatively high large flow sampling accuracy can be obtained; based on the flow identification information of the data packet, the data packet of the sampled data flow is sampled to obtain a second sampling result. In this way, the sampling probability of the data packet is related to the flow identification information of the data packet. Compared with fixed-interval sampling and random sampling whose sampling probability is mainly related to the number of data packets in the data flow, this sampling method can effectively improve the sampling probability of small flows. Therefore, in this scheme, the small flow sampling result is determined based on the flow sampling result, which can effectively improve the sampling accuracy of small flows without increasing the sampling rate and reduce resource overhead.

[0050] In a possible implementation of the second aspect, sampling is performed according to flow identification information of each data packet of the data flow to be sampled to obtain a second sampling result, including:

[0051] Performing a hash operation on at least part of the flow identification information of each data packet in the sampled data flow to obtain a hash value;

[0052] A second sampling result is determined based on data packets whose hash values are within the target value range.

[0053] In a possible implementation of the second aspect, a hash seed of the hash operation is updated according to a preset time interval.

[0054] In a possible implementation of the second aspect, the method further includes:

[0055] Receive flow collection control information;

[0056] The flow collection control information includes at least one of the following: a flow collection function switch control command, flow identification information of the data flow, sampling rates corresponding to the first sampling result and the second sampling result, a first threshold value, and a second threshold value.

[0057] In a possible implementation of the second aspect, the sampling rate of the small flow is greater than the sampling rate of the large flow.

[0058] In a possible implementation of the second aspect, determining flow statistics information according to the large flow sampling result and the small flow sampling result includes:

[0059] Determine the statistics of the large flow based on the large flow sampling results and the large flow sampling rate;

[0060] Determine the small flow statistics based on the small flow sampling result and the small flow sampling rate;

[0061] Combine the large flow statistics and small flow statistics to obtain flow statistics.

[0062] In a possible implementation of the second aspect, the flow identification information includes quintuple information or septuple information, and the flow statistics information includes one or more of the following information: the number of data packets, the number of bytes, and flow collection time information of the data flow.

[0063] In a third aspect, an embodiment of the present application provides a network device, comprising: a communication module, a processing module, a first sampling module and a second sampling module;

[0064] The communication module is used to: receive data packets of the data stream to be sampled;

[0065] The processing module is used to: identify data packets of a large flow and data packets of a small flow in the data flow to be sampled; the target parameter value of the large flow in the target time interval is greater than the target parameter value of the small flow in the target time interval; the target parameter value includes the number of data packets and / or the number of bytes;

[0066] The first sampling module is used to: sample the data packets of the large flow to obtain the large flow sampling result;

[0067] The second sampling module is used to: sample the data packets of the small flow to obtain the small flow sampling result;

[0068] The processing module is further configured to determine flow statistics information according to the large flow sampling result and the small flow sampling result.

[0069] In a possible implementation of the third aspect, the data packet carries flow marking information, where the flow marking information is used to indicate a flow category of the data flow to be sampled, where the flow category is a large flow or a small flow;

[0070] The processing module is specifically configured to: identify data packets of a large flow and / or data packets of a small flow in the data flow to be sampled according to the flow label information.

[0071] In a possible implementation of the third aspect, the first sampling module is specifically configured to: sample data packets of the large flow using a fixed-interval sampling method or a random sampling method to obtain a large flow sampling result;

[0072] The second sampling module is specifically configured to perform sampling according to the flow identification information of the data packets of the small flow to obtain a small flow sampling result.

[0073] In a possible implementation manner of the third aspect, the second sampling module is specifically configured to:

[0074] Performing a hash operation on at least part of the flow identification information of each data packet of the small flow to obtain a hash value;

[0075] The small flow sampling result is determined based on the data packets whose hash values are within the target value range.

[0076] In a possible implementation of the third aspect, a hash seed of the hash operation is updated according to a preset time interval.

[0077] In a possible implementation of the third aspect, the flow category corresponding to the data packet is determined based on the service type to which the data packet belongs and / or the target parameter value of the data flow to which it belongs, wherein the target parameter value of the data flow is associated with the service type to which the data flow belongs.

[0078] In a possible implementation of the third aspect, data flows belonging to the same service type include large flows and small flows;

[0079] For large and small flows of the same service type, within the target time interval, the target parameter value of the large flow is greater than or equal to the flow size threshold corresponding to the service type, and the target parameter value of the small flow is less than the flow size threshold corresponding to the service type;

[0080] Different flow size thresholds correspond to different service types.

[0081] In a possible implementation of the third aspect, at least one stream category includes multiple subcategories, and data streams of different subcategories use different sampling rates.

[0082] In a possible implementation manner of the third aspect, the communication module is further configured to:

[0083] Receive flow collection control information;

[0084] The stream collection control information includes at least one of the following: a stream collection function switch control command, stream identification information of the data stream, sampling rates corresponding to large and small streams, and stream parameter information for distinguishing large and small streams.

[0085] In a possible implementation of the third aspect, the sampling rate of the small flow is greater than the sampling rate of the large flow.

[0086] In a possible implementation manner of the third aspect, the processing module is specifically configured to:

[0087] Determine the statistics of the large flow based on the large flow sampling results and the large flow sampling rate;

[0088] Determine the small flow statistics based on the small flow sampling result and the small flow sampling rate;

[0089] Combine the large flow statistics and small flow statistics to obtain flow statistics.

[0090] In a possible implementation of the third aspect, the flow identification information includes quintuple information or septuple information, and the flow statistics information includes one or more of the following information: the number of data packets, the number of bytes, and flow collection time information of the data flow.

[0091] In a fourth aspect, an embodiment of the present application provides a network device, comprising: a first sampling module, a second sampling module, and a processing module; wherein:

[0092] The first sampling module is used to: sample each data packet of the sampled data stream using a fixed interval sampling method or a random sampling method to obtain a first sampling result;

[0093] The processing module is configured to: delete the sampling results corresponding to the data flows whose target parameter values are less than the first threshold value in the first sampling results, and obtain the large flow sampling results, where the target parameter values include the number of packets and / or the number of bytes;

[0094] The second sampling module is used to: perform sampling according to the flow identification information of each data packet of the data flow to be sampled, and obtain a second sampling result;

[0095] The processing module is further configured to: delete the sampling results corresponding to the data flows whose target parameter values are greater than or equal to the second threshold in the second sampling results to obtain the small flow sampling results; and determine the flow statistics information based on the large flow sampling results and the small flow sampling results.

[0096] In a possible implementation of the fourth aspect, the second sampling module is specifically configured to:

[0097] Performing a hash operation on at least part of the flow identification information of each data packet in the sampled data flow to obtain a hash value;

[0098] A second sampling result is determined based on data packets whose hash values are within the target value range.

[0099] In a possible implementation of the fourth aspect, a hash seed of the hash operation is updated according to a preset time interval.

[0100] In a possible implementation of the fourth aspect, the network device further includes a communication module, configured to receive flow collection control information;

[0101] The flow collection control information includes at least one of the following: a flow collection function switch control command, flow identification information of the data flow, sampling rates corresponding to the first sampling result and the second sampling result, a first threshold value, and a second threshold value.

[0102] In a possible implementation of the fourth aspect, a sampling rate of the small flow is greater than a sampling rate of the large flow.

[0103] In a possible implementation manner of the fourth aspect, the processing module is specifically configured to:

[0104] Determine the statistics of the large flow based on the large flow sampling results and the large flow sampling rate;

[0105] Determine the small flow statistics based on the small flow sampling result and the small flow sampling rate;

[0106] Combine the large flow statistics and small flow statistics to obtain flow statistics.

[0107] In a possible implementation of the fourth aspect, the flow identification information includes five-tuple information or seven-tuple information, and the flow statistics information includes one or more of the following information: the number of data packets, the number of bytes, and flow collection time information of the data flow.

[0108] In a fifth aspect, an embodiment of the present application provides a flow collection method, including:

[0109] Determine a flow category of a data flow to be sent, where the flow category includes a large flow or a small flow; within a target time interval, a target parameter value of the large flow is greater than a target parameter value of the small flow; the target parameter value includes the number of packets and / or the number of bytes;

[0110] A data packet corresponding to a data flow is sent to a network device. The data packet carries flow tag information for indicating the flow category of the data flow. The flow tag information is used by the network device to determine the flow category corresponding to the data packet and sample the data packets of large flows and small flows respectively.

[0111] In a possible implementation of the fifth aspect, determining a flow category of a data flow to be sent includes:

[0112] For the data stream to be sent, within the target time interval, if the target parameter value of the data stream is less than the corresponding flow size threshold, the flow category of the data stream is determined to be a small flow; if the target parameter value of the data stream is greater than or equal to the corresponding flow size threshold, the flow category of the data stream is determined to be a large flow; the target parameter value includes the number of data packets and / or the number of bytes.

[0113] In a possible implementation of the fifth aspect, determining a flow category of a data flow to be sent includes:

[0114] The flow category of the data flow is determined according to the service type to which the data flow to be sent belongs, wherein the target parameter value of the data flow is associated with the service type to which the data flow belongs.

[0115] In a possible implementation manner of the fifth aspect, the method further includes:

[0116] Within the target time interval, if the target parameter value of the data flow is less than the corresponding flow size threshold, the flow category of the data flow is updated to small flow; if the target parameter value of the data flow is greater than or equal to the corresponding flow size threshold, the flow category of the data flow is updated to large flow.

[0117] In a possible implementation of the fifth aspect, the flow size threshold corresponds to the service type; different flow size thresholds correspond to different service types.

[0118] In a possible implementation of the fifth aspect, at least one flow category includes multiple subcategories, and the flow marking information is further used by the network device to determine a sampling rate based on the subcategories, wherein data flows of different subcategories use different sampling rates.

[0119] In a sixth aspect, an embodiment of the present application provides a computing device, including:

[0120] a processing module, configured to determine a flow category of a data flow to be sent, the flow category including a large flow or a small flow; within a target time interval, a target parameter value of the large flow is greater than a target parameter value of the small flow; the target parameter value includes a number of packets and / or a number of bytes;

[0121] The communication module is used to send data packets corresponding to the data flow to the network device. The data packets carry flow marking information for indicating the flow category of the data flow. The flow marking information is used by the network device to determine the flow category corresponding to the data packet and sample the data packets of the large flow and the data packets of the small flow respectively.

[0122] In a possible implementation manner of the sixth aspect, the processing module is specifically configured to:

[0123] For the data stream to be sent, within the target time interval, if the target parameter value of the data stream is less than the corresponding flow size threshold, the flow category of the data stream is determined to be a small flow; if the target parameter value of the data stream is greater than or equal to the corresponding flow size threshold, the flow category of the data stream is determined to be a large flow; the target parameter value includes the number of data packets and / or the number of bytes.

[0124] In a possible implementation manner of the sixth aspect, the processing module is specifically configured to:

[0125] The flow category of the data flow is determined according to the service type to which the data flow to be sent belongs, wherein the target parameter value of the data flow is associated with the service type to which the data flow belongs.

[0126] In a possible implementation manner of the sixth aspect, the processing module is further configured to:

[0127] Within the target time interval, if the target parameter value of the data flow is less than the corresponding flow size threshold, the flow category of the data flow is updated to small flow; if the target parameter value of the data flow is greater than or equal to the corresponding flow size threshold, the flow category of the data flow is updated to large flow.

[0128] In a possible implementation of the sixth aspect, the flow size threshold corresponds to the service type; different flow size thresholds correspond to different service types.

[0129] In a possible implementation of the sixth aspect, at least one flow category includes multiple subcategories, and the flow marking information is further used by the network device to determine a sampling rate based on the subcategories, wherein data flows of different subcategories use different sampling rates.

[0130] In the seventh aspect, an embodiment of the present application provides a communication system, including: a network device and a computing device, the network device is used to execute the method of the first or second aspect above, and the computing device is used to send data packets to the network device or execute the method of the fifth aspect above.

[0131] In a possible implementation of the seventh aspect, the communication system also includes a control device for sending flow acquisition control information to the network device and the computing device; the flow acquisition control information includes at least one of the following: a flow acquisition function switch control command, flow identification information of the data flow, sampling rates corresponding to large flows and small flows, and flow parameter information for distinguishing large flows from small flows.

[0132] In an eighth aspect, an embodiment of the present application provides a communication device, comprising: a memory and a processor, the memory being used to store a computer program; the processor being used to execute the method described in the first aspect, the second aspect, or the fifth aspect above when calling the computer program.

[0133] In a ninth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method described in the first, second or fifth aspect above is implemented.

[0134] In a tenth aspect, an embodiment of the present application provides a computer program product, which, when executed on a communication device, enables the communication device to execute the method described in the first aspect, the second aspect, or the fifth aspect above.

[0135] In an eleventh aspect, an embodiment of the present application provides a chip system, comprising a processor coupled to a memory, the processor executing a computer program stored in the memory to implement the method described in the first, second, or fifth aspects above. The chip system may be a single chip or a chip module composed of multiple chips.

[0136] It can be understood that the beneficial effects of the third to eleventh aspects mentioned above can be found in the relevant descriptions in the first or second aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0137] Figure 1 A schematic diagram of a system architecture provided in an embodiment of the present application;

[0138] Figure 2A flow chart of a flow collection method provided in an embodiment of the present application;

[0139] Figure 3 A schematic diagram of a flow collection principle provided in an embodiment of the present application;

[0140] Figure 4 A schematic diagram of a packet sampling process provided in an embodiment of the present application;

[0141] Figure 5 A schematic diagram of a flow sampling process provided in an embodiment of the present application;

[0142] Figure 6 A schematic diagram of a sampling result processing process provided in an embodiment of the present application;

[0143] Figure 7 A flow chart of another flow collection method provided in an embodiment of the present application;

[0144] Figure 8 Another flow collection principle diagram provided in an embodiment of the present application;

[0145] Figure 9 A schematic diagram of another sampling result processing process provided in an embodiment of the present application;

[0146] Figure 10 A schematic diagram of the structure of a network device provided in an embodiment of the present application;

[0147] Figure 11 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0148] Figure 12 A schematic diagram of the structure of the communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0149] The following describes the embodiments of the present application in conjunction with the accompanying drawings in the embodiments of the present application. The terms used in the implementation methods of the embodiments of the present application are only used to explain the specific embodiments of the present application and are not intended to limit the present application. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0150] In order to facilitate understanding of the technical solutions in the embodiments of the present application, some of the terms involved in the embodiments of the present application are first explained below:

[0151] Data flow: Traffic in a network is typically transmitted in the form of data packets. Data packets with the same flow identification information are identified as belonging to the same flow. This is typically done using a five-tuple (source Internet Protocol (IP) address, destination IP address, source port number, destination port number, and protocol number). Data packets with the same five-tuple information belong to the same flow. Of course, data flows can also be identified using other flow identification information, such as a seven-tuple (adding forwarding port information: input port and output port) to the five-tuple, or a four-tuple (minus the protocol number).

[0152] Large and small flows: Data flows in a network can be categorized as large flows and small flows. Large flows have a higher packet volume and flow rate than small flows. In practice, a data flow whose target parameter value reaches a certain threshold over a period of time is considered a large flow. This target parameter value can include packet count and / or byte count. Conversely, a data flow whose target parameter value falls below a certain threshold over a period of time is considered a small flow.

[0153] Traffic on communication networks is generally a mixture of large and small flows. For example, in data center networks, approximately 80% of traffic is small flows, occupying approximately 20% of network bandwidth resources. The remaining 20% of large flows occupy approximately 80% of network bandwidth resources. Therefore, when monitoring network traffic, both large and small flows should not be ignored.

[0154] Currently, the sampling technology commonly used in network traffic monitoring typically samples data packets at intervals at a certain sampling rate and then determines flow statistics based on the sampling results. This sampling technology is not very user-friendly for small flows. If the sampling rate is set too low, small flows are easily missed, resulting in a loss of sampling accuracy. As the sampling rate decreases, the sampling error for small flows increases rapidly. For example, at a sampling rate of 0.01, the sampling error for small flows is approximately 70% higher than at a sampling rate of 1. Setting the sampling rate too high increases resource overhead.

[0155] Based on this, an embodiment of the present application provides a traffic collection solution to improve the sampling accuracy of small flows while reducing resource overhead.

[0156] The technical solution provided in the embodiments of the present application can be applied to any communication network that requires traffic collection. For the sake of convenience, the following mainly uses the data center network of the CLOS architecture as an example for illustrative explanation.

[0157] Figure 1 A schematic diagram of a system architecture provided in an embodiment of the present application is shown as follows: Figure 1As shown, the system architecture includes a data center network that utilizes a multi-layer Clos architecture. A three-layer Clos architecture is used as an example for illustration. The three-layer Clos architecture includes an access layer, an aggregation layer, and a core layer. Each layer can include multiple switches. For example, the access layer includes four access switches T1 to T4, the aggregation layer includes four aggregation switches A1 to A4, and the core layer includes four core switches C1 to C4. In actual applications, the network devices at each layer can also be other devices capable of data forwarding, such as routers. For ease of description, switches are used as an example for illustration.

[0158] Among them, the access switch can also be called an edge switch; because the access switch is usually located at the top of the rack, it is also called a top-of-rack (TOR) switch. Each access switch can connect to multiple servers (servers). Here, for example, each access switch is connected to two servers S. The server can provide storage, network (web), computing, big data, artificial intelligence (AI) and other services. Each server can be connected to one or more access switches. It is understandable that in other communication networks, the access switch can also connect to other types of computing devices.

[0159] The downlink port of the aggregation switch is connected to the access switch, and the uplink port is connected to the core switch; the core switch can be connected to the external network; the access switch can communicate with other access switches or devices in the external network through the aggregation switch and the core switch. Figure 1 As shown in , each aggregation switch in the aggregation layer can be connected to each access switch respectively, and can be connected to each core switch respectively.

[0160] For ease of management, in some embodiments, the equipment in the data center network can also be planned and managed in the form of a point of deliver (POD); POD can correspond to a business, each business can correspond to one or more PODs, and each POD can provide transmission services for the corresponding business. Each POD may include multiple access switches and multiple aggregation switches. For each POD, each aggregation switch in the POD can be connected to each access switch in the POD respectively, and each aggregation switch in the POD can be connected to a different core switch; each core switch can be connected to the aggregation switches in multiple PODs. For example, Figure 1The network architecture shown in the figure can be divided into two PODs. POD1 includes access switches T1 and T2 and aggregation switches A1 and A2, and POD2 includes access switches T3 and T4 and aggregation switches A3 and A4. In POD1, aggregation switches A1 and A2 are both connected to access switches T1 and T2, where aggregation switch A1 can be connected to core switches C1 and C2 respectively, and aggregation switch A2 can be connected to core switches C3 and C4 respectively. Similarly, in POD2, aggregation switches A3 and A4 are both connected to access switches T3 and T4, where aggregation switch A3 can be connected to core switches C1 and C2 respectively, and aggregation switch A4 can be connected to core switches C3 and C4 respectively.

[0161] The server can transmit data to other servers or devices in the external network through each switch. In some embodiments, traffic collection can be performed on the access switch. When the server sends a data stream to the access switch, the data stream can be broken down into individual data packets for transmission. After receiving the data packets of each data stream sent by the server, the access switch can sample the data packets of the large and small flows respectively, and then determine flow statistics based on the large and small flow sampling results.

[0162] In some embodiments, when sampling, large flows are sampled based on the quantity characteristics of data packets (hereinafter referred to as packet sampling), such as fixed interval sampling or random sampling, to obtain higher large flow sampling accuracy; small flows are sampled based on the flow identification information of data packets (hereinafter referred to as flow sampling) to further improve the small flow sampling accuracy and reduce resource overhead.

[0163] In some embodiments, the system architecture may further include a measurement service center, which may include a monitoring and analysis device. After the access switch determines the flow statistics, it may send the flow statistics to the monitoring and analysis device for the monitoring and analysis device to perform traffic statistics, analysis, and data display. The flow statistics collection function and analysis function of the monitoring and analysis device may be located in different devices or integrated into the same device.

[0164] In some embodiments, the measurement service center may further include a control device that may send flow collection control information, such as flow collection function switch control commands and sampling rate, to the data center network to control the flow collection process of the access switch.

[0165] The following mainly uses the above-mentioned system architecture as an example to illustrate the traffic collection method provided in an embodiment of the present application. This method can be executed by the access switch in the above-mentioned architecture to collect traffic from data streams sent by the server. It is understood that in some embodiments, this method can also be executed by other switches to collect traffic for other types of data streams, such as data streams flowing into the data center network. In other scenarios, this method can also be executed by network devices in the scenario to collect traffic from the port's inbound and / or outbound traffic.

[0166] Figure 2 A flow chart of a flow collection method provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the method may include the following steps:

[0167] S110 , performing packet sampling on each data packet of the data stream to be sampled to obtain a packet sampling result.

[0168] It can be understood that the naming method of some terms in the embodiments of the present application is only an example and should not be understood as a limitation to the embodiments of the present application. In some embodiments, the same terms can also be named by other names. For example, the packet sampling result can be named the first sampling result, and the following stream sampling result can be named the second sampling result.

[0169] Specifically, the data flows to be sampled can be all data flows sent by the server to the access switch (hereinafter referred to as the switch), or they can be data flows sent by the server to the switch that meet specific rules. For example, by configuring access control list (ACL) rules on the switch, data flows that require statistics (i.e., data flows to be sampled) can be selected for traffic collection. For ease of explanation, the following example uses the example of all data flows sent by the server to the switch as the data flows to be sampled.

[0170] like Figure 3 As shown, after the data packet sent by the server reaches the switch, the switch can perform two processes on the data packet at the same time: packet sampling and flow sampling, and then delete the sampling results of small flows in the packet sampling results and the sampling results of large flows in the flow sampling results to obtain large flow sampling results and small flow sampling results respectively.

[0171] Among them, packet sampling and flow sampling do not have a strict timing execution relationship, which can be as follows Figure 3 As shown in , packet sampling and flow sampling are performed on the data packets simultaneously; in other embodiments, packet sampling may be performed on the data packets first and then flow sampling, or flow sampling may be performed on the data packets first and then packet sampling.

[0172] It is understood that after receiving a data packet, the switch can copy the incoming data packet through the network processor (such as the forwarding chip) and send it to the central processing unit for sampling and statistics. After the central processing unit completes sampling, it can discard the copied data packet; the original data packet can continue to be processed according to the original forwarding rules. The forwarding chip can adopt either a run-to-completion (RTC) architecture or a pipeline architecture.

[0173] Specifically, when performing packet sampling, sampling may be performed in a fixed interval sampling manner or a random sampling manner.

[0174] For fixed interval sampling, in some implementations, fixed packet interval sampling may be used, that is, the packet number interval is determined according to the set sampling rate, and sampling is performed periodically according to the packet number interval. For example, Figure 4 As shown in (a), the sampling rate of packet sampling is 1 / 3, so sampling can be performed every 3 data packets. For the 8 data packets of data streams f1, f2, and f3 received successively, 2 data packets of data stream f1 and 1 data packet of data stream f3 are collected through 3 samplings.

[0175] The sampling results of the data flow can be recorded in the flow table, where each flow table entry in the flow table can correspond to a data flow, and the flow table entry can record the flow identification information (such as five-tuple information) and sampling results of the corresponding data flow; the sampling results of the data flow can include the number of data packets and / or bytes collected for the data flow. For the sake of convenience, the following mainly uses the number of data packets as an example for exemplary explanation.

[0176] During the packet sampling process, if a data packet is collected, the flow table can be updated. For the sampled data packet, if the data flow to which the data packet belongs has a corresponding flow table entry in the flow table, the sampling result in the flow table entry can be updated; if the data flow to which the data packet belongs does not have a corresponding flow table entry in the flow table, a new flow table entry can be added to record the sampling result of the data flow. For example, Figure 4 As shown in (a), the flow table can be updated according to the sampling results, and the flow table records that the data flow f1 is sampled to 2 data packets and the data flow f3 is sampled to 1 data packet.

[0177] In other implementations, fixed-interval sampling may also specifically adopt fixed time interval sampling, that is, a time interval is determined according to a set sampling rate, and sampling is performed periodically according to the time interval, for example, sampling is performed every several milliseconds.

[0178] For random sampling, in some implementations, a random number within a certain value range (e.g., 0 to 1) can be generated for each data packet, and then whether the random number falls within the sampling interval corresponding to the sampling rate is determined to determine whether the data packet is sampled. For example, Figure 4 As shown in (b), the random number ranges from 0 to 1, the packet sampling rate is 0.3, and the corresponding sampling interval is 0 to 0.3. For the eight packets received from data streams f1, f2, and f3, the corresponding random numbers generated are 0.1, 0.6, 0.3, 0.2, 0.9, 0.3, 0.7, and 0.7, respectively. The four packets whose random numbers fall within the sampling interval of 0 to 0.3 are sampled. Correspondingly, the flow table is updated based on the sampling results, recording that one packet was sampled from data stream f1, two packets were sampled from data stream f2, and one packet was sampled from data stream f3.

[0179] In other implementations, random sampling may also be performed by sampling with a random number of packets or sampling with a random time interval, for example, randomly sampling one data packet from every ten data packets, or randomly sampling one data packet every 10 milliseconds.

[0180] S120: Perform flow sampling according to the flow identification information of each data packet of the data flow to be sampled, and obtain a flow sampling result.

[0181] Flow sampling is performed based on the flow identification information of the data packet. That is, at each sampling, whether the flow identification information of the data packet meets the flow identification sampling range of this time is determined to determine whether the data packet is sampled.

[0182] Sampling may be performed based on part or all of the flow identification information of the data packet. For example, the flow identification information of the data flow includes quintuple information. When performing flow sampling, sampling may be performed based on part or all of the information in the quintuple information.

[0183] Optionally, sampling may be performed every several data packets or several time periods. During each sampling, a flow identifier sampling range of the sampling may be randomly selected according to the sampling rate, and data packets meeting the flow identifier sampling range are collected.

[0184] In order to improve sampling efficiency, in some embodiments, a hash operation can be performed on at least part of the flow identification information of the data packet to obtain a hash value; and the flow sampling result is determined based on the data packet whose hash value is within the flow collection interval (i.e., the target value range).

[0185] For example, Figure 5As shown, the data packet includes a data packet header and a payload. The five-tuple information can be extracted from the data packet header as a hash factor, and then a hash operation is performed in combination with the hash seed to obtain a hash value; then it is determined whether the hash value is within the flow collection interval. If it is within the flow collection interval, the data packet is determined to be collected; otherwise, it is not collected.

[0186] Similar to packet sampling, the sampling results of flow sampling can be recorded in a flow table. During flow sampling, the flow table can be updated based on the collected data packets. Here, the flow table records that data flow f1 sampled 1 data packet, data flow f2 sampled 1 data packet, and data flow f3 sampled 2 data packets.

[0187] The hash seed can be a random number. Considering that a fixed hash factor and hash seed may cause the hash values of packets in some data flows to consistently fall outside the flow collection interval, to minimize hash polarization, the hash seed can be updated at a preset interval. This preset interval can be variable or fixed, meaning the hash seed can be updated periodically.

[0188] When updating the hash seed, a random value may be generated each time as the hash seed; or the values in the hash seed set may be polled sequentially, and the value polled each time may be used as the hash seed for the update.

[0189] The flow collection interval can be determined based on the sampling rate and the range of the hash value. The length of the flow collection interval is the product of the length of the hash value range and the sampling rate. To facilitate calculation, the hash value can be normalized so that the hash value range is 0-1. Correspondingly, the length of the flow collection interval is equal to the sampling rate. For example, if the sampling rate is 0.3, the flow collection interval can be 0-0.3, or it can be another interval within the range of 0-1 with a length of 0.3.

[0190] The sampling rate of stream sampling and the sampling rate of packet sampling may be the same or different. In order to improve the sampling accuracy of stream sampling, in some embodiments, the sampling rate of stream sampling may be greater than the sampling rate of packet sampling.

[0191] S130: Delete the sampling results of the small flow in the packet sampling results to obtain the large flow sampling results; delete the sampling results of the large flow in the flow sampling results to obtain the small flow sampling results.

[0192] Specifically, the switch may process the packet sampling results and the flow sampling results at regular intervals to determine the large flow sampling results and the small flow sampling results.

[0193] like Figure 6As shown, the packet sampling results and the flow sampling results correspond to a flow table respectively. The flow table contains the flow identification information and sampling results corresponding to the collected data flow. For the flow table corresponding to the packet sampling result (referred to as the packet sampling flow table), the sampling result of the small flow can be deleted to obtain the large flow sampling result; for the flow table corresponding to the flow sampling result (referred to as the flow sampling flow table), the sampling result of the large flow can be deleted to obtain the small flow sampling result.

[0194] Specifically, the large and small flows can be determined according to the target parameter values in the sampling results of the flow table, and the data flow with the target parameter value less than the flow size threshold is determined as the small flow, and the data flow with the target parameter value greater than or equal to the flow size threshold is determined as the large flow.

[0195] The target parameter value may include the number of packets and / or the number of bytes, and correspondingly, the flow size threshold may include a packet threshold and / or a byte threshold. For example, a data flow with a number of packets less than the packet threshold may be determined as a small flow, or a data flow with a number of bytes less than the byte threshold may be determined as a small flow, or a data flow with a number of packets less than the packet threshold and a number of bytes less than the byte threshold may be determined as a small flow.

[0196] The flow size threshold can be determined based on the processing cycle and sampling rate used to determine the large and small flow sampling results. Its size is positively correlated with the length of the processing cycle and the sampling rate. As previously mentioned, the sampling rate for packet sampling and the sampling rate for flow sampling can be the same or different. Correspondingly, the flow size threshold corresponding to the packet sampling results and the flow size threshold corresponding to the flow sampling results can also be the same or different.

[0197] The flow size threshold corresponding to the packet sampling result is called the first threshold, and the flow size threshold corresponding to the flow sampling result is called the second threshold. The above process of determining the large flow sampling result and the small flow sampling result is: delete the sampling results corresponding to the data flow whose target parameter value is less than the first threshold in the packet sampling result to obtain the large flow sampling result; delete the sampling results corresponding to the data flow whose target parameter value is greater than or equal to the second threshold in the flow sampling result to obtain the small flow sampling result.

[0198] The first threshold and the second threshold may be the same or different; and both the first threshold and the second threshold may include a packet threshold and / or a byte threshold. When both the first threshold and the second threshold include a packet threshold and a byte threshold, the thresholds being the same or different here refer to the corresponding thresholds being the same or different, that is, the packet threshold corresponding to the packet sampling result is the same or different from the packet threshold corresponding to the flow sampling result, and the byte threshold corresponding to the packet sampling result is the same or different from the byte threshold corresponding to the flow sampling result.

[0199] For example, Figure 6As shown, the flow size thresholds corresponding to both packet sampling results and flow sampling results are packet thresholds, which are 3. For the packet sampling flow table, the sampling results with fewer than 3 packets are deleted, that is, the sampling results for data flows f3 and f4 are deleted. The remaining sampling results for data flows f1 and f2 are the large flow sampling results. For the flow sampling flow table, the sampling results with greater than or equal to 3 packets are deleted, that is, the sampling results for data flows f1 and f2 are deleted. The remaining sampling results for data flows f3 and f4 are the small flow sampling results.

[0200] It can be understood that the above flow size threshold is only an example shown for ease of understanding, and its specific size is not particularly limited in this embodiment.

[0201] S140: Determine flow statistics information according to the large flow sampling result and the small flow sampling result.

[0202] After determining the large flow sampling results and the small flow sampling results, the switch can determine the large flow statistics based on the large flow sampling results and the packet sampling rate; determine the small flow statistics based on the small flow sampling results and the flow sampling rate; and then combine the large flow statistics and the small flow statistics to obtain the flow statistics.

[0203] The flow statistics information may include the number of packets and / or bytes of the data flow. In some implementations, the number of bytes may be replaced by the number of bits. In some embodiments, the flow statistics information may also include flow collection time information to facilitate determining the statistical duration corresponding to the flow statistics information. The flow collection time information may include a start timestamp, an end timestamp, and / or a collection duration.

[0204] Continue to see Figure 6 , assuming that the sampling rate of packet sampling and flow sampling is 1 / 3, the flow statistics include the number of data packets; after determining the large flow sampling results and small flow sampling results, the number of data packets in the large flow sampling results and the small flow sampling results can be multiplied by 3 and combined together to obtain the flow statistics information, which can be recorded in the corresponding flow table. Figure 6 As shown, the flow statistics recorded in the flow table include: the number of data packets of data flow f1 is 12, the number of data packets of data flow f2 is 15, the number of data packets of data flow f3 is 6, and the number of data packets of data flow f4 is 6.

[0205] After merging the large flow statistical information and the small flow statistical information, the packet sampling flow table and the flow sampling flow table can be cleared and then continued to be used to record the newly collected sampling results; alternatively, when determining the large and small flow sampling results in step S130, the data in the packet sampling flow table and the flow sampling flow table can be taken out, and subsequent deletion, merging, etc. can be performed to determine the flow statistical information; the packet sampling flow table and the flow sampling flow table continue to be used to record the newly collected sampling results.

[0206] In some embodiments, flow statistics corresponding to the packet sampling (hereinafter referred to as first flow statistics) may be determined based on the packet sampling results and the sampling rate of the packet sampling; and flow statistics corresponding to the flow sampling (hereinafter referred to as second flow statistics) may be determined based on the flow sampling results and the sampling rate of the flow sampling. Then, the statistics of the small flow in the first flow statistics may be deleted to obtain the large flow statistics; the statistics of the large flow in the second flow statistics may be deleted to obtain the small flow statistics; and the large flow statistics and the small flow statistics may be merged to obtain the flow statistics. Alternatively, in the above steps S110 and S120, when recording the sampling results of the data flow in the flow table, the flow statistical information can be recorded according to the sampling rate, that is, the packet sampling results recorded in the packet sampling flow table are the above-mentioned first flow statistical information, and the flow sampling results recorded in the flow sampling flow table are the above-mentioned second flow statistical information; correspondingly, in the above steps S130 and S140, the large flow sampling results are the large flow statistical information, and the small flow sampling results are the small flow statistical information. In step S140, the large flow sampling results and the small flow sampling results are directly merged to obtain the flow statistical information.

[0207] The traditional method of packet sampling for all data streams requires increasing the sampling rate to improve the sampling accuracy of small streams. In the above implementation, the stream sampling process is based on the flow identification information of the data packet. In this way, the sampling probability of the data packet is related to the flow identification information of the data packet. Compared with packet sampling, where the sampling probability is mainly related to the number of data packets in the data stream, this sampling method can effectively improve the sampling probability of small streams. Therefore, in this implementation, the small stream sampling results are determined based on the flow sampling results, which can effectively improve the sampling accuracy of small streams without increasing the sampling rate. Although this implementation increases the process of stream sampling, the resource overhead required by the traditional method of increasing the sampling rate increases by several times or even dozens of times. The resource overhead required for the stream sampling process in this implementation is far less than this. Therefore, this implementation can reduce resource overhead while improving sampling accuracy.

[0208] Figure 7 A flow chart of another flow collection method provided in an embodiment of the present application is shown as follows: Figure 7 As shown, the method may include the following steps:

[0209] S210: The server determines the flow type of the data flow to be sent.

[0210] In some embodiments, when sending a data stream, the server can determine the flow category of the data stream based on the target parameter value of the data stream being sent. A data stream with a target parameter value less than a certain threshold is determined as a small flow, and a data stream with a target parameter value greater than or equal to the threshold is determined as a large flow. Similar to the above, the target parameter value can include the number of packets and / or the number of bytes. For example, a data stream with a packet count of less than 50 can be determined as a small flow, and a data stream with a packet count greater than or equal to 50 can be determined as a large flow.

[0211] In some embodiments, the server may determine the flow category corresponding to the data packet (ie, the flow category of the data flow to which the data packet belongs) according to the service type to which the data packet (or data flow) belongs.

[0212] The sizes of data flows of various business types usually have certain characteristics, that is, the business type to which the data flow belongs has a certain correlation with its target parameter value (number of packets and / or number of bytes). For example, for storage-type services, such as object storage service (OBS), its data flows are usually dominated by long flows, and a single data flow usually exceeds 700 kilobytes (KB); for network (web)-type services, its data flows are usually dominated by short flows, and a single data flow is usually less than 700KB. Data flows belonging to storage-type services can be marked as large flows, and data flows belonging to network-type services can be marked as small flows. For other types of services, such as computing and AI, similarly, the flow category of their data flows can be determined based on the length characteristics of their data flows.

[0213] In specific implementations, the service type and flow category of a data packet can be determined based on the correspondence between the service type and IP information (such as the IP network segment). For example, if the IP address of a data packet falls within the IP address range corresponding to storage-class services, the data packet can be marked as a large flow.

[0214] Among them, the correspondence between the service type and the IP information can be determined based on the service type provided by the server and the IP information corresponding to the server; for a data center network managed by POD, the correspondence between the service type and the IP information can also be determined based on the service type and IP information corresponding to the POD to which the server belongs.

[0215] In some embodiments, the server may determine the flow category corresponding to the data packet based on the measurement data.

[0216] Specifically, the server can enable the collection function to collect the data flows to be sent, and calculate the target parameter values of the data flows within a certain time interval after the start of collection (herein referred to as the target time interval). Initially, all data flows can be marked as small flows by default; then, during the collection and statistics process, when the target parameter value of a data flow reaches a certain threshold (i.e., the flow size threshold), the data flow can be marked as a large flow. Subsequent data packets of this data flow can be directly marked as large flows without being collected.

[0217] That is, for the data flow to be sent, within the target time interval, if the target parameter value of the data flow is less than the corresponding flow size threshold, the flow category of the data flow is determined to be a small flow, and its data packets are all marked as small flows; if the target parameter value of the data flow is greater than or equal to the corresponding flow size threshold, the flow category of the data flow is determined to be a large flow, and its data packets are all marked as large flows.

[0218] Similar to the above, the target parameter value may include the number of packets and / or bytes. The duration corresponding to the target time interval and the specific size of the flow size threshold may be set as needed and are not particularly limited here.

[0219] This solution will slightly affect the labeling results of large flows in the early stage of collection, but as the collection progresses and large flows are identified, the accuracy of the labeling results will be greatly improved. The above measurement process can be performed once at regular intervals.

[0220] In some embodiments, the server may also determine the flow category corresponding to the data packet according to the service type to which the data packet belongs and the target parameter value of the data flow to which it belongs.

[0221] The main difference between this implementation and the aforementioned flow classification determination based on measurement data is that, initially, the flow classification corresponding to the data packet can be determined based on the service type to which the data packet belongs, as described above. Then, similar to the aforementioned flow classification determination based on measurement data, the flow classification of the data flow is updated based on the measurement statistics collected during the acquisition process. Specifically, within a target time interval, if the target parameter value of the data flow is less than the corresponding flow size threshold, the flow classification of the data flow is updated to a small flow; if the target parameter value of the data flow is greater than or equal to the corresponding flow size threshold, the flow classification of the data flow is updated to a large flow.

[0222] To further improve acquisition accuracy, in some implementations, when updating the flow category of a data flow based on measurement statistical data, a flow size threshold can be determined based on the service type, so that data flows of various service types are divided into large flows and small flows. In this way, both the large flow sampling objects and the small flow sampling objects on the switch side can cover various service types, resulting in more accurate sampling results.

[0223] For example, for storage services, most of their data flows are long flows exceeding 700KB, while for network services, their data flows are almost all less than 700KB. Therefore, a larger flow size threshold, such as 700KB, can be set for storage services, while a smaller flow size threshold, such as 400KB, can be set for network services.

[0224] Correspondingly, when marking large and small flows, initially, data flows for storage services can be marked as large flows, and the corresponding data packets are marked as large flows; data flows for network services can be marked as small flows, and the corresponding data packets are marked as small flows. During the server's statistical collection process, for data flows for storage services, if the number of bytes within the target time interval is less than 700KB, it will be updated to a small flow, and all subsequent data packets of this data flow will be marked as small flows; for data flows for network services, if the number of bytes within the target time interval reaches 400KB, it will be updated to a large flow, and all subsequent data packets of this data flow will be marked as large flows.

[0225] That is, data flows belonging to the same service type include large flows and small flows; for large flows and small flows belonging to the same service type, within the target time interval, the target parameter value of the large flow is greater than or equal to the flow size threshold corresponding to the service type, and the target parameter value of the small flow is less than the flow size threshold corresponding to the service type.

[0226] The flow size thresholds corresponding to different service types may be different, or multiple service types may correspond to the same flow size threshold, and different flow size thresholds may correspond to different service types.

[0227] It is understandable that the method of determining the flow category is not limited to this. For example, in some embodiments, a classification model may also be used to determine the flow category, and this embodiment does not specifically limit this.

[0228] S220: The server sends a data packet corresponding to the data flow (carrying flow tag information indicating the flow category) to the switch.

[0229] After the server determines the flow category of the data packet, it can carry flow tag information in the data packet header before sending it to the switch to facilitate identification by the switch.

[0230] In some implementations, a flow marker bit may be added to the data packet header to indicate flow marker information. The flow marker bit may be one bit. For example, a bit of 0 may indicate that the flow category is a small flow, and a bit of 1 may indicate that the flow category is a large flow. Of course, the flow marker bit may also include multiple bits.

[0231] In some implementations, existing fields in the packet header can be reused. For example, the explicit congestion notification (ECN) field or the option field can be reused, and one bit in the field can be used as a flow marker. The ECN field is generally used when a network device forwards a packet, so it can be reused before the packet reaches the network device. The option field is usually customizable, so some bits in the option field can be customized as flow markers.

[0232] For example, Figure 8 As shown, the 8 data packets sent by the server include 5 data packets with the flow marker bit being 1 and 3 data packets with the flow marker bit being 0, that is, 5 data packets of large flows and 3 data packets of small flows.

[0233] S230: After receiving the data packets of the data flow to be sampled, the switch identifies the data packets of the large flow and the data packets of the small flow in the data flow to be sampled, performs packet sampling on the data packets of the large flow to obtain a large flow sampling result; and performs flow sampling on the data packets of the small flow to obtain a small flow sampling result.

[0234] As in the above embodiment, the data stream to be sampled may be all or part of the data stream sent by the server to the switch. Here, the entire data stream is still used as an example for illustrative description.

[0235] After receiving the data packet sent by the server, the switch can identify the flow category of the data packet based on the flow tag information in the data packet. For example, if the value of the flow tag bit of the data packet is 1, it can be determined that its flow category is a large flow; if the value of the flow tag bit of the data packet is 0, it can be determined that its flow category is a small flow.

[0236] After the switch identifies the flow category of the data packet, it can sample the data packets of each category.

[0237] In some implementations, packet sampling can be used to sample large flows and small flows separately. In this way, compared with the traditional method of sampling the data packets of all data flows together, in this implementation, the data packets of large flows and small flows are sampled separately, which can reduce the impact of the large flow data packets with a larger number of packets on the sampling probability of the small flow data packets, thereby improving the sampling accuracy of the small flow and reducing resource overhead.

[0238] In some implementations, packet sampling can be used for large flows, while stream sampling can be used for small flows. This increases the probability of sampling smaller flows, thereby further improving the sampling accuracy of small flows. The following examples illustrate packet sampling for large flows and stream sampling for small flows.

[0239] Specifically, ACL rules can be pre-configured to indicate the data packet sampling method corresponding to the flow tag information; the switch determines the data packet sampling method according to the ACL rules, and then samples the data packets. Figure 8 According to the ACL rules, the switch can identify that the flow marker value of 5 data packets is 1 and perform packet sampling on these 5 data packets; and can identify that the flow marker value of 3 data packets is 0 and perform flow sampling on these 3 data packets. In this way, for the same data packet, it only performs packet sampling or flow sampling once, which can effectively improve collection efficiency and reduce resource overhead. Of course, it is also possible to identify flow categories without relying on the ACL function of the switch. In some implementations, flow categories can also be identified by adding relevant software function modules to the switch. This embodiment of the present application does not specifically limit this.

[0240] The specific implementation process of packet sampling and flow sampling can refer to the corresponding implementation method in the above embodiment, which will not be repeated here.

[0241] In this implementation, the sampling objects of packet sampling only include data packets of large flows, and the sampling results in the corresponding packet sampling flow table (i.e., packet sampling results) are the large flow sampling results; the sampling objects of flow sampling only include data packets of small flows, and the sampling results in the corresponding flow sampling flow table (i.e., flow sampling results) are the small flow sampling results. For example, Figure 9 As shown, the sampling results of data flows f1 and f2 recorded in the packet sampling flow table are large flow sampling results, and the sampling results of data flows f3 and f4 recorded in the flow sampling flow table are small flow sampling results.

[0242] In some embodiments, the above-mentioned process of determining the flow category of the data flow on the server can also be performed on the switch. Correspondingly, the data packet sent by the server may not carry the flow marking information. After receiving the data packet of the data flow to be sampled, the switch can identify the data packets of the large flow and the data packets of the small flow in the data flow to be sampled according to the business type and / or measurement data to which the data packet belongs.

[0243] S240: The switch determines flow statistics information according to the large flow sampling result and the small flow sampling result.

[0244] Similar to the aforementioned implementation, the switch can process the large flow sampling results and the small flow sampling results at regular intervals, determine large flow statistics based on the large flow sampling results and the packet sampling rate, and determine small flow statistics based on the small flow sampling results and the flow sampling rate. The large flow statistics and the small flow statistics can then be combined to obtain flow statistics. A detailed description of the flow statistics can be found in the aforementioned embodiment and will not be repeated here.

[0245] Continue to see Figure 9 For example, the sampling rate of packet sampling and flow sampling is 1 / 3, and the flow statistics include the number of data packets. After obtaining the large flow sampling result and the small flow sampling result, the data processing module can multiply the number of data packets in the large flow sampling result and the small flow sampling result by 3, and then merge them together to obtain the flow statistics information, which can be recorded in the corresponding flow table. Figure 9 As shown, the flow statistics recorded in the flow table include: the number of data packets of data flow f1 is 12, the number of data packets of data flow f2 is 15, the number of data packets of data flow f3 is 6, and the number of data packets of data flow f4 is 6.

[0246] In some embodiments, large flows and / or small flows may be further subdivided, that is, any flow category may include multiple subcategories, and data flows of different subcategories use different sampling rates.

[0247] The sub-classification method is similar to the method of dividing large and small flows. For example, large flows can be further divided into two sub-classes based on flow size. The sampling rate of the sub-class with larger flow (hereinafter referred to as the first sub-class) can be higher than the sampling rate of the sub-class with smaller flow (hereinafter referred to as the second sub-class). The sub-classification and sampling rate setting of small flows are similar.

[0248] When marking, the server side can indicate the subcategory by adding bits. For example, the flow marking bit uses two bits, 11 indicates that the flow category is large flow and the subcategory is the first subcategory; 10 indicates that the flow category is large flow and the subcategory is the second subcategory; 01 indicates that the flow category is small flow and the subcategory is the first subcategory; 00 indicates that the flow category is small flow and the subcategory is the second subcategory.

[0249] Correspondingly, when performing sampling, the switch samples the data packets corresponding to the subcategories of each flow category at the corresponding sampling rate; when determining flow statistics, the switch determines the flow statistics according to the sampling rate corresponding to the subcategories of the flow category to which the data flow belongs.

[0250] above Figure 2 The flow collection method shown (hereinafter referred to as the first implementation method) and Figure 7 In the traffic collection method shown (hereinafter referred to as the second implementation method), the first implementation method does not require server participation and has higher adaptability; the second implementation method does not require packet sampling and flow sampling for each data packet, thereby reducing resource overhead. In specific implementation, any implementation method can be selected as needed, and this embodiment of the application does not specifically limit this.

[0251] In an embodiment of the present application, the switch may determine flow statistics information at regular intervals. In some embodiments, each time the switch determines the flow statistics information, it may send the flow statistics information to a monitoring and analysis device of a measurement service center for the monitoring and analysis device to perform flow statistics, analysis, and data display.

[0252] In order to improve the flexibility of flow collection, in some embodiments, as described above Figure 1 As shown, the measurement service center may further include a control device, which may send flow collection control information to switches and / or servers in the data center network to control the flow collection process.

[0253] The flow collection control information may include at least one of the following: a flow collection function switch control command, flow identification information of the data flow, sampling rates of packet sampling and flow sampling, and flow parameter information for distinguishing large flows from small flows.

[0254] Specifically, the flow collection function on / off control commands include: a flow collection function enable command and a flow collection function disable command. The control device can issue the flow collection function on / off control command to the access switch (corresponding to the first implementation method described above) or to the access switch and server (corresponding to the second implementation method described above). Upon receiving the flow collection function enable command, the access switch or server can enable functions related to flow collection; upon receiving the flow collection function disable command, it can disable functions related to flow collection.

[0255] The flow identification information of a data flow is used to define the data flow, such as the aforementioned five-tuple information or four-tuple information. The control device can send the flow identification information of the data flow to the access switch (corresponding to the first implementation method above), or to the access switch and server (corresponding to the second implementation method above). After receiving the flow identification information of the data flow sent by the control device, the access switch or server can identify each data flow based on it. For example, if the received flow identification information is four-tuple information, data packets with the same four-tuple information can be identified as the same data flow.

[0256] As previously mentioned, the sampling rates for packet sampling and flow sampling can be the same or different. Packet sampling and / or flow sampling can further include multiple sampling rates corresponding to subcategories. The control device can issue the sampling rates for packet sampling and flow sampling to the access switch, which can then perform packet sampling and flow sampling accordingly.

[0257] The flow parameter information used to distinguish large flows from small flows may include a flow size threshold (e.g., number of packets, number of bytes). For the first implementation, the control device may send the flow size threshold (which may include the first and second thresholds described above) to the access switch. The switch may then determine large flow sampling results and small flow sampling results based on the flow size threshold, packet sampling results, and flow sampling results. For the second implementation, the control device may send the flow size threshold to the server. The server may then determine large flows from small flows based on the flow size threshold and mark the packets.

[0258] The flow parameter information used to distinguish large and small flows can also include a correspondence between flow identification information and flow categories. For example, 1 corresponds to a large flow and 0 corresponds to a small flow. The control device can issue this correspondence to the access switch and server. Upon receiving this correspondence, the server can determine the flow identification information of the data flow based on it, thereby marking the flow category of the data packet. Upon receiving this correspondence, the access switch can determine the flow category corresponding to the flow identification information based on it, thereby distinguishing large and small flows.

[0259] It can be understood that the solution shown in any one of the above embodiments can be an independent solution, or the solution formed by combining any multiple embodiments can also be an independent solution, and this application does not impose any special restrictions here.

[0260] The traffic collection method provided in the embodiment of the present application distinguishes between the data packets of large flows and small flows in the sampled data stream and samples them separately. Compared with the traditional method of sampling the data packets of all data streams together, this method can reduce the impact of the large flow data packets with a large number of packets on the sampling probability of the small flow data packets, thereby improving the sampling accuracy of the small flow and reducing resource overhead. In addition, in this solution, fixed interval sampling or random sampling is used for the large flow in the sampled data stream, which can achieve relatively high sampling accuracy for the large flow; for the small flow in the sampled data stream, sampling is performed based on the flow identification information of the data packet. In this way, the sampling probability of the data packet is related to the flow identification information of the data packet. Compared with packet sampling where the sampling probability is mainly related to the number of data packets in the data stream, this sampling method can effectively improve the sampling probability of the small flow, thereby further improving the sampling accuracy of the small flow without increasing the sampling rate and reducing resource overhead.

[0261] Figure 10 This is a schematic diagram of the structure of a network device provided in an embodiment of the present application. The network device may be a switch, a router, etc. Figure 10 As shown, the network device provided by this embodiment may include: a first sampling module 110 , a second sampling module 120 , a processing module 130 and a communication module 140 .

[0262] In a possible implementation, the first sampling module 110 is used to support the network device in executing step S110 in the above embodiment and / or other processes for the technology described herein.

[0263] The second sampling module 120 is used to support the network device to execute step S120 in the above embodiment and / or other processes used in the technology described herein.

[0264] The processing module 130 is used to support the network device in executing step S130 and step S140 in the above embodiment and / or other processes used for the technology described herein.

[0265] The communication module 140 is used to support the network device in performing operations related to the communication process between other devices (such as other network devices or servers) in the above embodiments and / or other processes used for the technology described herein.

[0266] In another possible implementation, the communication module 140 is used to support the network device in performing the operation of receiving the data packet in step S230 in the above embodiment and / or other processes for the technology described herein.

[0267] The first sampling module 110 is used to support the network device to execute the packet sampling process in step S230 of the above embodiment and / or other processes used in the technology described herein.

[0268] The second sampling module 120 is used to support the network device to execute the flow sampling process in step S230 in the above embodiment and / or other processes used in the technology described herein.

[0269] The processing module 130 is used to support the network device in executing step S240 in the above embodiment and / or other processes used in the technology described herein.

[0270] The network device provided in this embodiment can execute the process executed by the network device in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0271] Figure 11 This is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. The computing device may be the above-mentioned server or a network card in the server, such as Figure 11 As shown, the computing device provided in this embodiment may include: a processing module 210 and a communication module 220 .

[0272] The processing module 210 is used to support the computing device in executing step S210 in the above embodiment and / or other processes used in the technology described herein.

[0273] The communication module 220 is used to support the computing device in executing step S220 in the above embodiment and / or other processes for the technology described herein.

[0274] The device provided in this embodiment can execute the process executed by the computing device in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0275] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0276] An embodiment of the present application also provides a communication device. Figure 12 This is a schematic diagram of the structure of the communication device provided in the embodiment of the present application. It is optional and for the convenience of explanation, Figure 12 Only the main components of the communication device are shown. Figure 12 As shown, the communication device provided by this embodiment includes: a processor 310, a memory 320 and a communication interface 330. The processor 310, the memory 320 and the communication interface 330 communicate with each other through an internal connection path.

[0277] In a possible implementation, a communication device is used to execute the processes and steps corresponding to the network device (eg, a switch) in the above method.

[0278] In another possible implementation, the communication device is used to execute the various processes and steps corresponding to the computing device (eg, server) or the network card of the computing device in the above method.

[0279] In yet another possible implementation, the communication device is used to execute the various processes and steps corresponding to the control device and / or the monitoring and analysis device in the above method.

[0280] Specifically, the processor 310 can be used to execute instructions stored in the memory 320, and when the processor 310 executes the instructions stored in the memory 320, the processor 310 is used to execute the various steps and / or processes of the above-mentioned method embodiments corresponding to the network device, computing device, control device or monitoring and analysis device.

[0281] The memory 320 may be used to store instructions, software programs, and data, such as the sampling results, flow statistics, and other data described in the above method embodiments.

[0282] Those skilled in the art will understand that for ease of explanation, Figure 12 Only one processor 310 and memory 320 are shown. In an actual positioning device, there may be multiple processors 310 and memories 320. The memory 320 may also be called a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.

[0283] For example, the processor 310 may be a general-purpose central processing unit (CPU), a microprocessor, a network processor (NP), or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present solution. The aforementioned processor 310 may be a single-core processor or a multi-core processor. The processor 310 may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). In addition, the processor 310 may be a separate semiconductor chip or may be integrated into a semiconductor chip together with other circuits.

[0284] The memory 320 in the embodiment of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an EPROM, an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0285] The communication interface 330 is used to communicate with other devices, so that the communication device can receive instructions or data from other devices, and send instructions or data to other devices.

[0286] The communication device provided in this embodiment can execute the various steps and / or processes corresponding to the network device, computing device, monitoring and analysis device or control device in the above method embodiment. Its implementation principles and technical effects are similar and will not be repeated here.

[0287] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method described in the above method embodiment is implemented.

[0288] The embodiment of the present application further provides a computer program product, which, when executed on a communication device, enables the communication device to implement the method described in the above method embodiment.

[0289] The present application also provides a chip system, including a processor coupled to a memory, wherein the processor executes a computer program stored in the memory to implement the method described in the above method embodiment. The chip system can be a single chip or a chip module composed of multiple chips.

[0290] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted via the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, hard disk or tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)).

[0291] Those skilled in the art will appreciate that all or part of the process steps in the above-described method embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program can include the process steps in the above-described method embodiments. The aforementioned storage medium can include various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

[0292] The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0293] In the embodiments provided in this application, it should be understood that the disclosed devices / equipment and methods can be implemented in other ways. For example, the device / equipment embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0294] It should be understood that in the description of this application and the appended claims, the terms "comprises," "includes," "has," and any variations thereof are intended to cover non-exclusive inclusions and mean "including but not limited to," unless otherwise specifically emphasized. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not necessarily limited to those steps or modules explicitly listed, but may include other steps or modules not explicitly listed or inherent to the process, method, product, or apparatus.

[0295] In the description of this application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in this application is used to describe the association relationship of associated objects, indicating that three relationships can exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0296] Furthermore, in the description of this application, unless otherwise specified, "plurality" refers to two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of a, b, or c" can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0297] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0298] In addition, in the description of this application specification and the appended claims, the terms "first," "second," etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or precedence, nor should they be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein; and features specified as "first" or "second" may explicitly or implicitly include at least one of such features.

[0299] In the embodiments of this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0300] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized.

[0301] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A flow collection method, characterized in that: The method is applied to a network device, and the method includes: receiving data packets of a data stream to be sampled; Identifying data packets of a large flow and data packets of a small flow in the data flow to be sampled; a target parameter value of the large flow in a target time interval is greater than a target parameter value of the small flow in the target time interval; the target parameter value includes the number of data packets and / or the number of bytes; Sampling data packets of the large flow to obtain a large flow sampling result; Sampling the data packets of the small flow to obtain a small flow sampling result; Flow statistics information is determined according to the large flow sampling result and the small flow sampling result.

2. The method according to claim 1, characterized in that The data packet carries flow marking information, where the flow marking information is used to indicate the flow category of the data flow to be sampled, where the flow category is a large flow or a small flow; The identifying of the data packets of the large flow and the data packets of the small flow in the data flow to be sampled includes: The data packets of the large flow and / or the data packets of the small flow in the data flow to be sampled are identified according to the flow label information.

3. The method according to claim 1 or 2, characterized in that The sampling of the data packets of the large flow to obtain a large flow sampling result includes: Sampling the data packets of the large flow by using a fixed interval sampling method or a random sampling method to obtain a large flow sampling result; The sampling of the data packets of the small flow to obtain the small flow sampling result includes: Sampling is performed according to the flow identification information of the data packets of the small flow to obtain a small flow sampling result.

4. The method according to claim 3, characterized in that The sampling according to the flow identification information of the data packet of the small flow to obtain the small flow sampling result includes: Performing a hash operation on at least part of the flow identification information of each data packet of the small flow to obtain a hash value; The small flow sampling result is determined based on the data packets whose hash values are within the target value range.

5. The method according to claim 4, characterized in that The hash seed of the hash operation is updated according to a preset time interval.

6. The method according to any one of claims 1 to 5, characterized in that The flow category corresponding to the data packet is determined according to the service type to which the data packet belongs and / or the target parameter value of the data flow to which it belongs, wherein the target parameter value of the data flow is associated with the service type to which the data flow belongs.

7. The method according to claim 6, characterized in that Data flows belonging to the same service type include large flows and small flows; For a large flow and a small flow belonging to the same service type, within a target time interval, a target parameter value of the large flow is greater than or equal to a flow size threshold corresponding to the service type, and a target parameter value of the small flow is less than the flow size threshold corresponding to the service type; Different flow size thresholds correspond to different service types.

8. The method according to any one of claims 1 to 7, characterized in that At least one flow category includes multiple subcategories, and data flows of different subcategories use different sampling rates. The flow category includes the large flow and the small flow.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Receive flow collection control information; The stream collection control information includes at least one of the following: a stream collection function switch control command, stream identification information of the data stream, sampling rates corresponding to the large stream and the small stream, and stream parameter information for distinguishing the large stream from the small stream.

10. The method according to any one of claims 1 to 9, characterized in that The sampling rate of the small flow is greater than the sampling rate of the large flow.

11. The method according to any one of claims 1 to 10, characterized in that The determining of flow statistics information according to the large flow sampling result and the small flow sampling result includes: Determining large flow statistical information according to the large flow sampling result and the sampling rate of the large flow; Determining small flow statistical information according to the small flow sampling result and the sampling rate of the small flow; The large flow statistical information and the small flow statistical information are combined to obtain flow statistical information.

12. The method according to any one of claims 1 to 11, characterized in that The flow identification information of the data flow to be sampled includes quintuple information or septuple information, and the flow statistics information includes one or more of the following information: the number of data packets, the number of bytes, and flow collection time information of the data flow.

13. A flow collection method, characterized in that: The method is applied to a network device, and the method includes: Sampling each data packet of the data stream to be sampled by adopting a fixed-interval sampling method or a random sampling method to obtain a first sampling result; Deleting sampling results corresponding to data flows whose target parameter values are less than a first threshold value in the first sampling results to obtain large flow sampling results, where the target parameter values include the number of packets and / or the number of bytes; Sampling according to the flow identification information of each data packet of the data flow to be sampled to obtain a second sampling result; Deleting the sampling results corresponding to the data flow whose target parameter value is greater than or equal to the second threshold in the second sampling results to obtain a low-volume sampling result; Flow statistics information is determined according to the large flow sampling result and the small flow sampling result.

14. The method according to claim 13, wherein: The sampling according to the flow identification information of each data packet of the data flow to be sampled to obtain a second sampling result includes: Performing a hash operation on at least part of the flow identification information of each data packet in the data flow to be sampled to obtain a hash value; A second sampling result is determined based on data packets whose hash values are within the target value range.

15. The method according to claim 13 or 14, characterized in that The method further comprises: Receive flow collection control information; The stream collection control information includes at least one of the following: a stream collection function switch control command, stream identification information of the data stream, sampling rates corresponding to the first sampling result and the second sampling result, the first threshold and the second threshold.

16. A network device, characterized in that: include: a communication module, a processing module, a first sampling module and a second sampling module; The communication module is used to: receive data packets of the data stream to be sampled; The processing module is used to: identify data packets of a large flow and data packets of a small flow in the data flow to be sampled; the target parameter value of the large flow in a target time interval is greater than the target parameter value of the small flow in the target time interval; the target parameter value includes the number of data packets and / or the number of bytes; The first sampling module is used to: sample the data packets of the large flow to obtain a large flow sampling result; The second sampling module is used to: sample the data packets of the small flow to obtain a small flow sampling result; The processing module is further configured to determine flow statistics information according to the large flow sampling result and the small flow sampling result.

17. The network device according to claim 16, wherein: The data packet carries flow marking information, where the flow marking information is used to indicate the flow category of the data flow to be sampled, where the flow category is a large flow or a small flow; The processing module is specifically configured to: identify data packets of a large flow and / or data packets of a small flow in the data flow to be sampled according to the flow label information.

18. The network device according to claim 16 or 17, characterized in that: The first sampling module is specifically configured to: sample the data packets of the large flow by adopting a fixed interval sampling method or a random sampling method to obtain a large flow sampling result; The second sampling module is specifically configured to perform sampling according to the flow identification information of the data packets of the small flow to obtain a small flow sampling result.

19. The network device according to claim 18, wherein: The second sampling module is specifically configured to: Performing a hash operation on at least part of the flow identification information of each data packet of the small flow to obtain a hash value; The small flow sampling result is determined based on the data packets whose hash values are within the target value range.

20. The network device according to claim 19, wherein: The hash seed of the hash operation is updated according to a preset time interval.

21. The network device according to any one of claims 16 to 20, characterized in that: The flow category corresponding to the data packet is determined according to the service type to which the data packet belongs and / or the target parameter value of the data flow to which it belongs, wherein the target parameter value of the data flow is associated with the service type to which the data flow belongs.

22. The network device according to claim 21, wherein: Data flows belonging to the same service type include large flows and small flows; For a large flow and a small flow belonging to the same service type, within a target time interval, a target parameter value of the large flow is greater than or equal to a flow size threshold corresponding to the service type, and a target parameter value of the small flow is less than the flow size threshold corresponding to the service type; Different flow size thresholds correspond to different service types.

23. The network device according to any one of claims 16 to 22, characterized in that: At least one flow category includes multiple subcategories, and data flows of different subcategories use different sampling rates. The flow category includes the large flow and the small flow.

24. The network device according to any one of claims 16 to 23, characterized in that: The communication module is also used for: Receive flow collection control information; The stream collection control information includes at least one of the following: a stream collection function switch control command, stream identification information of the data stream, sampling rates corresponding to the large stream and the small stream, and stream parameter information for distinguishing the large stream from the small stream.

25. The network device according to any one of claims 16 to 24, characterized in that: The sampling rate of the small flow is greater than the sampling rate of the large flow.

26. A network device, characterized in that: include: A first sampling module, a second sampling module and a processing module; wherein: The first sampling module is used to: sample each data packet of the sampled data stream using a fixed interval sampling method or a random sampling method to obtain a first sampling result; The processing module is configured to: delete sampling results corresponding to data flows whose target parameter values are less than a first threshold value in the first sampling results, and obtain a large flow sampling result, wherein the target parameter values include the number of packets and / or the number of bytes; The second sampling module is used to: perform sampling according to the flow identification information of each data packet of the data flow to be sampled to obtain a second sampling result; The processing module is further configured to: delete the sampling results corresponding to the data flow whose target parameter value is greater than or equal to the second threshold in the second sampling results, to obtain the low-volume sampling results; Flow statistics information is determined according to the large flow sampling result and the small flow sampling result.

27. A communication system, characterized in that: include: A network device, a computing device, and a control device, wherein the network device is configured to execute the method according to any one of claims 1 to 15, the computing device is configured to send data packets of a data stream to be sampled to the network device, and the control device is configured to send stream collection control information to the network device and / or the computing device; The stream collection control information includes at least one of the following: a stream collection function switch control command, stream identification information of the data stream, sampling rates corresponding to large streams and small streams, and stream parameter information for distinguishing the large streams from the small streams.

28. A network device, characterized in that: include: A memory and a processor, the memory being used to store a computer program; the processor being used to execute the method according to any one of claims 1 to 15 when calling the computer program.

29. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 15 is implemented.

30. A computer program product, characterized in that When the computer program product is run on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 15.

Images