Routing-based directional forwarding method, equipment, medium and product

Abstract

The embodiments of the present application relate to the technical field of traffic forwarding, and disclose a routing-based directional forwarding method, device, medium, and product. After the traffic analysis device is started, a broadcast ARP message is sent through the mirror network port. The ARP message contains the IP address and MAC address of the mirror network port. The traffic collection and forwarding device sends an ICMP request to the mirror network port of the traffic analysis device to confirm that the mirror network port has been initialized. The traffic collection and forwarding device encapsulates the mirror traffic and forwards the encapsulated message to the traffic analysis device. The traffic analysis device collects the mirror traffic through the mirror network port and parses the messages in the mirror traffic. This can at least solve the technical problem of cross-network traffic forwarding.

Description

Technical Field

[0001] The present application relates to the technical field of traffic forwarding, and in particular to a routing-based directional forwarding method. Background Art

[0002] In distributed network architectures, cross-regional service deployments, and cloud-based network environments, the core components of traffic collection and analysis systems—traffic collection devices (such as network splitters, port mirroring switches, and dedicated probes) and traffic analysis devices (such as unified DPI systems and security monitoring platforms)—often cannot be deployed on the same LAN segment or physical computer room due to factors such as dispersed physical computer rooms and network security policy isolation (such as VLAN division and firewall access control). In such cases, network forwarding technology is required to transmit mirrored traffic from the collection devices across network segments and computer rooms to the analysis devices, enabling real-time analysis and processing of network traffic.

[0003] Traditional solutions often use DPDK (Data Plane Development Kit) technology to achieve high-performance packet reception. However, this relies on the kernel bypass mechanism of the network card, which causes the ARP protocol stack at the operating system level to malfunction. This in turn renders the packet reception network port of the traffic analysis device (hereinafter referred to as the "mirrored network port") invisible at the IP layer. Specifically, switches, routers, and other devices in the network cannot obtain the MAC address of the mirrored network port through the ARP protocol, resulting in IP-based traffic being unable to be correctly forwarded to the analysis device. Furthermore, traditional solutions lack a response mechanism for probe messages such as ICMP, further exacerbating the difficulty of device status awareness. Summary of the Invention

[0004] One purpose of the present application is to provide a routing-based directional forwarding method, device, medium and product, at least to solve the technical problem of forwarding traffic across networks.

[0005] To achieve the above objectives, some embodiments of the present application provide the following aspects:

[0006] In the first aspect, some embodiments of the present application also provide a routing-based directional forwarding method, including sending a broadcast ARP message through the mirror network port after the traffic analysis device is started, wherein the ARP message contains the IP address and MAC address of the mirror network port; the traffic collection and forwarding device sends an ICMP request to the mirror network port of the traffic analysis device to confirm that the initialization of the mirror network port is complete; the traffic collection and forwarding device encapsulates the mirror traffic and forwards the encapsulated message to the traffic analysis device; the traffic analysis device collects the mirror traffic through the mirror network port and parses the message in the mirror traffic.

[0007] In a second aspect, some embodiments of the present application further provide an electronic device comprising: one or more processors; and a memory storing computer program instructions, wherein the computer program instructions, when executed, cause the processor to perform the steps of the method described above.

[0008] In a third aspect, some embodiments of the present application further provide a computer-readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method described above.

[0009] In a fourth aspect, some embodiments of the present application further provide a computer program product, comprising a computer program / instruction, which implements the steps of the above-described method when executed by a processor.

[0010] Compared with the related art, the solution provided in the embodiment of the present application is based on the cross-segment traffic mirror transmission method of DPDK, which realizes lossless transmission of mirrored traffic and transparency of device status in cross-computer room and cross-VLAN scenarios through high-performance traffic capture and intelligent network reachability guarantee mechanism. Through active ARP broadcast and ICMP response, the packet receiving port of the traffic analysis device is made "visible" at the IP layer, eliminating the problem of "invisibility" of the packet receiving port at the IP layer caused by the lack of ARP due to DPDK network card binding in the traditional solution. Then, the ICMP request packet is captured by DPDK, and after the IP address is resolved, if the destination IP is the mirrored network card address, an ICMP response packet is constructed to simulate the active state of the IP layer. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] One or more embodiments are exemplarily illustrated by pictures in the corresponding drawings. These exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are represented as similar elements. Unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0012] Figure 1 A schematic diagram of a flow chart of a routing-based directional forwarding method according to an embodiment of the present application;

[0013] Figure 2 A flowchart of another routing-based directional forwarding method provided according to an embodiment of the present application;

[0014] Figure 3 The figure is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0015] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0016] First embodiment

[0017] The first embodiment of the present application relates to a directional forwarding method based on routing. Figure 1 As shown, the method may include the following steps:

[0018] S101, after the traffic analysis device is started, a broadcast ARP message is sent through the mirror network port, wherein the ARP message includes the IP address and MAC address of the mirror network port;

[0019] During initialization, the traffic analysis device actively sends a broadcast ARP packet through the mirrored network port used to receive mirrored traffic. This packet explicitly carries the mirrored network port's IP address (target IP) and MAC address (target MAC). This message is broadcasted network-wide to inform switches, routers, and other devices on the network that the MAC address corresponding to this IP address is the actual MAC address of the mirrored network port.

[0020] Update the ARP cache table of the network device to ensure that all subsequent IP-routed traffic (including encapsulated mirrored traffic) can be located to the traffic analysis device through the correct MAC address, avoiding traffic forwarding failures caused by ARP loss.

[0021] S102, the traffic collection and forwarding device sends an ICMP request to the mirror network port of the traffic analysis device to confirm that the mirror network port is initialized;

[0022] Establish a status confirmation mechanism between devices to ensure that the traffic analysis device is ready to receive mirrored traffic. After obtaining the IP address of the mirrored network port of the traffic analysis device, the traffic collection and forwarding device sends an ICMP message (i.e., a Ping request) to that IP address to detect whether the mirrored network port has been initialized and is active.

[0023] If the traffic analysis device's mirrored network port has completed the ARP announcement and is ready, it will parse the ICMP request message in step S104 and construct an ICMP response message to return to the collection and forwarding device, indicating that the device is available. If no response is received, the collection and forwarding device can repeat the ICMP request or trigger an error handling mechanism (such as delayed forwarding) to ensure the target device is reliable before traffic transmission.

[0024] S103, the traffic collection and forwarding device encapsulates the mirrored traffic and forwards the encapsulated message to the traffic analysis device;

[0025] To enable cross-segment and cross-VLAN mirrored traffic routing and forwarding, and adapt to Layer 3 network environments, mirrored traffic is encapsulated with an IP header, an Ethernet header, and a specified VLAN ID. When the encapsulated packets pass through a network switch, the switch forwards the traffic to the target network segment or computer room where the traffic analysis device is located, based on the destination IP address (Layer 3 routing) and VLAN ID (Layer 2 VLAN policy) in the packets, using static routing or dynamic routing protocols (such as OSPF and BGP).

[0026] S104: The traffic analysis device collects the mirrored traffic through the mirrored network port and parses the messages in the mirrored traffic.

[0027] To achieve high-performance packet reception and multi-protocol message processing, maintain network reachability, and parse service data, VLAN matching and decapsulation are performed. If the VLAN ID in the message matches the pre-configured target VLAN ID, it is identified as mirrored traffic requiring processing. The outer IP header and Ethernet header are stripped, retaining only the payload data of the original mirrored traffic (such as IP packets, TCP / UDP packets, etc.) for subsequent processing by service modules such as DPI deep analysis and traffic statistics.

[0028] Processing of non-target VLAN or no VLAN messages: If an ARP message is parsed and its target IP is the IP address of the mirrored network port, an ARP response message (including the IP and MAC of the mirrored network port) is constructed and sent back to the requester through the mirrored network port to ensure that the ARP table entries of the network device remain valid (solving the ARP aging problem).

[0029] If an ICMP message is parsed and its destination IP address is the IP address of the mirrored network port, an ICMP response message (containing the same identifier and sequence number) is constructed and sent back to the requester through the mirrored network port, simulating the active state of the IP layer (such as a ping response) to ensure that network detection tools (such as monitoring systems) can detect that the device is online.

[0030] For non-ARP / ICMP traffic (such as HTTP and DNS), ordinary service packets are directly passed to upper-layer applications for parsing through DPDK's high-performance interfaces without additional processing. This layered processing mechanism ensures efficient decapsulation and service analysis of the target mirrored traffic. Furthermore, by actively responding to ARP / ICMP messages, it continuously maintains the "visibility" and "activity" of the mirrored network port at the IP layer, forming a closed loop of "network reachability assurance → traffic transmission → status feedback."

[0031] It's easy to see that compared to related technologies, the solution provided in this embodiment of the present application broadcasts ARP packets to announce the mirrored port's IP and MAC addresses, and simulates the mirrored port's IP layer activity by responding to ICMP requests. The traffic collection device encapsulates the original mirrored traffic and sends it to the switch, which forwards it to the traffic analysis device based on routing policies. The traffic analysis device then collects the mirrored port traffic and analyzes and processes the traffic content. This enables cross-room and cross-segment mirrored traffic forwarding and high-performance collection and analysis.

[0032] Second embodiment

[0033] The second embodiment of the present application relates to a routing-based directional forwarding method. The second embodiment is an improvement on the first embodiment, and the specific improvements are:

[0034] Furthermore, the traffic collection and forwarding device encapsulates and processes the mirrored traffic, including: encapsulating the mirrored traffic message into an IP header, configuring the destination IP as the mirrored network port IP of the traffic analysis device; encapsulating the mirrored traffic message into an Ethernet header, configuring the destination MAC as the mirrored network port MAC of the traffic analysis device; specifying a VLAN ID, and forwarding the encapsulated message to the traffic analysis device.

[0035] Furthermore, parsing the message in the mirrored traffic includes: when the VLAN ID in the message is a specified ID, stripping the IP header in the message, performing traffic parsing and business processing; when the VLAN ID in the message is not a specified ID or does not contain VLAN, determining whether it is an ARP message.

[0036] Furthermore, the determination of whether it is an ARP message includes: when the message is an ARP message and the ARP IP is equal to the mirror network port IP, constructing an ARP response message and sending it through the mirror network port; when the message is not an ARP message, determining whether it is an ICMP message.

[0037] Furthermore, the determination of whether it is an ICMP message includes: when the message is an ICMP message and the ICMP IP is equal to the mirror network port IP, constructing an ICMP response message and sending it through the mirror network port; when the message is not an ICMP message, performing traffic analysis and business processing.

[0038] Furthermore, the traffic collection and forwarding equipment and the traffic analysis equipment perform message capture and processing based on DPDK, and the DPDK is used to accelerate the efficiency of network card data transmission and reception and message parsing.

[0039] Furthermore, the sending of a broadcast ARP message through the mirror network port includes: the broadcast ARP message sent by the traffic analysis device is an ARP request message or an ARP response message, which is used to update the ARP table entry of a switch or router in the network, so that the mirror network port is visible at the IP layer.

[0040] like Figure 2 As shown in the figure, the network environment includes: traffic analysis equipment, equipped with a high-performance network card, capable of announcing its own network address information by broadcasting ARP packets, and can parse and process received traffic; traffic collection and forwarding equipment, capable of traffic encapsulation and forwarding, capable of adding specific header information to mirrored traffic according to configuration and sending it to the network; network switches, supporting VLAN division and routing policies, can forward traffic based on the destination address and VLAN ID of the message. The specific steps of the routing-based directional forwarding method are as follows:

[0041] After the traffic analysis device starts up, its mirrored network port immediately sends a broadcast ARP packet. This packet explicitly carries the mirrored network port's own IP address and MAC address, broadcasting its existence to other network devices (such as switches and routers), ensuring that subsequent traffic can be accurately addressed to the device.

[0042] The traffic collection and forwarding device sends an ICMP request message to the mirrored network port of the traffic analysis device to confirm whether the mirrored network port has completed initialization and is in a state where it can receive traffic. If the mirrored network port of the traffic analysis device is ready, it will respond to the ICMP request, indicating that it is capable of receiving traffic.

[0043] After receiving the original mirrored traffic, the traffic collection and forwarding device encapsulates it. It adds an IP header, setting the destination IP address to the preconfigured IP address of the traffic analysis device's mirrored network port to ensure route accessibility within the Layer 3 network. It also adds an Ethernet header, setting the destination MAC address to the MAC address of the traffic analysis device's mirrored network port for proper Layer 2 transmission. Furthermore, it assigns a specific VLAN ID to the encapsulated packet, based on cross-VLAN transmission requirements. After encapsulation, the packet is forwarded to the network switch, which, based on routing policies, directs it to the traffic analysis device.

[0044] After collecting traffic through the mirrored network port, the traffic analysis device first analyzes the VLAN ID. If the VLAN ID matches a pre-defined ID, it removes the outer IP header and extracts the payload data. It then performs a series of processing operations on this payload data, including packet parsing and traffic analysis, to achieve in-depth analysis and application of network traffic.

[0045] Classify non-target VLAN traffic. If the parsed VLAN ID does not match the specified ID, or the packet itself does not carry a VLAN ID, further determine the packet type:

[0046] ARP message processing: If it is determined to be an ARP message and the destination IP address in the message is consistent with the IP address of the traffic analysis device's mirrored network port, the traffic analysis device constructs an ARP response message and sends it out through the mirrored network port to maintain the correctness of the ARP table entries in the network.

[0047] ICMP message processing: If it is not an ARP message, it is then determined whether it is an ICMP message. If it is an ICMP message and its destination IP address is equal to the IP address of the mirrored network port, an ICMP response message is constructed and sent through the mirrored network port to ensure that the active status of the mirrored network port at the IP layer is perceived by the network device.

[0048] Other message processing: If it is neither an ARP message nor an ICMP message, the message is directly parsed and other corresponding processing functions are performed, such as extracting protocol information from the message and performing traffic statistics.

[0049] Through the above steps, this embodiment achieves efficient forwarding and high-performance collection and analysis of mirrored traffic in cross-computer room and cross-network segment scenarios, ensuring that the traffic analysis device can accurately and timely process various types of traffic data in a complex network environment while maintaining its own visibility and activity in the network.

[0050] The step division of the above various methods is only for the purpose of clear description. During implementation, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0051] In addition, some embodiments of the present application further provide an electronic device. The electronic device may be various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, etc. The electronic device may also be various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices.

[0052] The electronic device includes: one or more processors; and a memory storing computer program instructions, wherein the computer program instructions, when executed, enable the processor to perform the steps of the method provided in any one or more of the above embodiments. Figure 3An exemplary structural diagram of the electronic device is disclosed. Figure 3 As shown, the electronic device includes: one or more processors 1101, memory 1102, and interfaces for connecting various components, including high-speed and low-speed interfaces. The various components are interconnected using different buses and can be mounted on a common motherboard or in other ways as needed. The processor can process instructions executed within the electronic device, including instructions stored in or on the memory for displaying graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, if desired, multiple processors and / or multiple buses can be used with multiple memories and multiple storage devices. Similarly, multiple electronic devices can be connected, with each device providing some of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0053] The electronic device may further include: an input device 1103 and an output device 1104. The processor 1101, the memory 1102, the input device 1103 and the output device 1104 may be connected via a bus or other means. Figure 3 The bus connection is taken as an example.

[0054] Input device 1103 can receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. Examples include a touch screen, keypad, mouse, trackpad, touchpad, pointing stick, one or more mouse buttons, trackball, joystick, and other input devices. Output device 1104 may include a display device, auxiliary lighting devices (e.g., LEDs), and tactile feedback devices (e.g., vibration motors). The display device may include, but is not limited to, a liquid crystal display (LCD), a light-emitting diode (LED) display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0055] To provide user interaction, the electronic device may be a computer. The computer includes a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user, as well as a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices may also be used to provide user interaction; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback), and input from the user may be received in any form, including acoustic input, voice input, or tactile input.

[0056] In the embodiments of the present application, a computer program / instruction is stored on a computer-readable medium. When executed by a processor, the computer program / instruction implements the steps of the method provided in any one or more of the above embodiments. The computer-readable medium may be included in the electronic device described in the above embodiments, or it may exist independently and not be incorporated into the device. The computer-readable medium carries one or more computer-readable instructions.

[0057] The memory 1102 can be used as a non-transitory computer-readable storage medium to store non-transitory software programs, non-transitory computer executable programs, and modules. The processor 1101 executes the non-transitory software programs, instructions, and modules stored in the memory 1102 to execute various functional applications and data processing of the server, thereby implementing the program instructions / modules corresponding to the method provided in any one or more of the above embodiments of the present application.

[0058] The memory 1102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device, etc. In addition, the memory 1102 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1102 may optionally include a memory remotely located relative to the processor 1101, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0059] It should be noted that the computer-readable medium described in this application may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media may include, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component.

[0060] Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc-read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0061] Computer program code for performing the operations of the present application can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0062] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. For example, implementation may be achieved using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In some embodiments, the software program of the present application may be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) may be stored in a computer-readable recording medium, such as a RAM memory, a magnetic or optical drive, a floppy disk, or the like. In addition, some steps or functions of the present application may be implemented using hardware, for example, as a circuit that cooperates with a processor to perform the various steps or functions.

[0063] The computer program product provided in the embodiments of the present application includes one or more computer programs / instructions, which, when executed by a processor, generate, in whole or in part, the processes or functions described in the embodiments of the present application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0064] The flowcharts or block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the devices, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of code, and the module, program segment or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-specific system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0065] The scope of this application is defined by the appended claims rather than the foregoing description and is therefore intended to encompass within this application all changes that come within the meaning and range of equivalents of the claims. Any reference signs in the claims should not be construed as limiting the claims to which they relate. In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in a device claim may also be implemented by one unit or device through software or hardware. Words such as "first" and "second" are only used to distinguish the description and do not indicate any particular order, nor should they be understood as indicating or implying relative importance.

[0066] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art may easily propose variations or substitutions within the technical scope disclosed in the present application, and such variations or substitutions shall be encompassed within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the scope of protection of the claims, and the above embodiments shall be regarded as exemplary and non-limiting.

Claims

1. A routing-based directional forwarding method, characterized in that: The method comprises: After the traffic analysis device is started, a broadcast ARP message is sent through the mirror network port, and the ARP message includes the IP address and MAC address of the mirror network port; The traffic collection and forwarding device sends an ICMP request to the mirror network port of the traffic analysis device to confirm that the initialization of the mirror network port is complete; The traffic collection and forwarding device encapsulates the mirrored traffic and forwards the encapsulated message to the traffic analysis device, wherein the traffic collection and forwarding device encapsulates the mirrored traffic and includes: Encapsulate the mirrored traffic message into an IP header, and configure the destination IP address to be the mirrored network port IP address of the traffic analysis device; Specifying a VLAN ID and forwarding the encapsulated message to the traffic analysis device; The traffic analysis device collects the mirrored traffic through the mirrored network port and parses the messages in the mirrored traffic, wherein the parsing of the messages in the mirrored traffic includes: When the VLAN ID in the message is not a specified ID or does not contain a VLAN, determining whether it is an ARP message, wherein determining whether it is an ARP message includes: When the message is an ARP message and the ARP IP is equal to the mirror network port IP, an ARP response message is constructed and sent out through the mirror network port; When the message is not an ARP message, determining whether it is an ICMP message, wherein determining whether it is an ICMP message includes: When the message is an ICMP message and the ICMP IP is equal to the mirror network port IP, an ICMP response message is constructed and sent out through the mirror network port; When the message is not an ICMP message, traffic analysis and service processing are performed.

2. The method according to claim 1, characterized in that The traffic collection and forwarding device encapsulates the mirrored traffic and further includes: The mirrored traffic message is encapsulated with an Ethernet header, and the destination MAC is configured as the mirrored network port MAC of the traffic analysis device.

3. The method according to claim 2, characterized in that The parsing of the message in the mirrored traffic further includes: When the VLAN ID in the message is the specified ID, the IP header in the message is stripped off, and traffic analysis and service processing are performed.

4. The method according to any one of claims 1 to 3, characterized in that The traffic collection and forwarding equipment and the traffic analysis equipment capture and process messages based on DPDK, which is used to accelerate the efficiency of network card data transmission and reception and message parsing.

5. The method according to claim 4, characterized in that The sending of a broadcast ARP message through the mirrored network port includes: The broadcast ARP message sent by the traffic analysis device is an ARP request message or an ARP response message, which is used to update the ARP table entry of the switch or router in the network, so that the mirror network port is visible at the IP layer.

6. An electronic device, characterized in that: The electronic device comprises: one or more processors; and A memory storing computer program instructions, which, when executed, cause the processor to perform the steps of the method according to any one of claims 1 to 5.

7. A computer-readable medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images