Time delay measurement method and device, program product and electronic equipment

Abstract

The invention provides a time delay measurement method and device, a program product and electronic equipment, and relates to the technical field of computers. The method comprises the following steps: acquiring session data of nodes in each cluster; querying a preset address library according to the name of each cluster, replacing an intranet address in the session data of the nodes in each cluster with a public network address of the cluster, initiating deep packet inspection system addressing according to the obtained public network address, and determining a first address and a second address; simultaneously sending a snapshot instruction to deep packet inspection management function systems respectively corresponding to the first address and the second address so as to obtain a plurality of first mirror image traffic packets and second mirror image traffic packets; the snapshot instruction comprises a quintuple of session data of nodes in each cluster and corresponding mirror image capture time; and according to the plurality of first mirror image traffic packets and the second mirror image traffic packets, time delay information of nodes in each cluster is determined.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a delay measurement method, device, program product, and electronic device. Background Art

[0002] Currently, with the explosive growth of cloud computing, financial transactions, and real-time interactive services, network latency accuracy and service traffic security have become core network performance indicators.

[0003] In related technologies, latency measurement is performed by directly embedding a latency marker in the original data packet. Specifically, a network device inserts a latency measurement marker and a transmit timestamp into a service data packet. Downstream devices (such as switches or terminal devices) detect the marker, record the receive timestamp, and report the receive timestamp to a management platform. The management platform then determines the one-way latency based on the transmit and receive timestamps.

[0004] While the aforementioned latency measurement methods can determine latency information, they not only alter the message structure but also pose the risk of data tampering, making them difficult to meet the requirements of high-security scenarios such as finance and government affairs. Therefore, accurately determining latency while ensuring service traffic security has become a pressing issue. Summary of the Invention

[0005] The present disclosure provides a delay measurement method, a delay measurement device, a computer program product, and an electronic device to improve the accuracy of delay determination while ensuring the security of business traffic.

[0006] According to a first aspect of the present disclosure, a delay measurement method is provided, the method comprising:

[0007] Get the session data of each node in the cluster;

[0008] Querying a preset address library according to the name of each cluster, replacing the intranet address in the session data of the nodes in each cluster with the public network address of the cluster, and initiating deep packet inspection system addressing according to the obtained public network address to determine the first address and the second address;

[0009] Sending a snapshot instruction to the deep packet inspection management function system corresponding to the first address and the second address respectively to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of session data of each node in the cluster and the corresponding mirror capture time;

[0010] Determine the delay information of the nodes in each cluster according to the multiple first mirrored traffic packets and the second mirrored traffic packets.

[0011] In one possible implementation, simultaneously sending a snapshot instruction to the deep packet inspection management function systems corresponding to the first address and the second address, respectively, includes:

[0012] A snapshot instruction is simultaneously sent to a first deep packet inspection management function system on the Internet data center side and a second deep packet inspection management function system deployed on the user side of the user network.

[0013] In a possible implementation, the image capture time is determined based on an image capture time rule; the image capture time rule is that the image capture time is determined based on the hourly time and a multiple of 10 minutes.

[0014] In a possible implementation, determining the latency information of each node in the cluster according to the plurality of first mirrored traffic packets and the second mirrored traffic packets includes:

[0015] Constructing an index for the plurality of first mirrored traffic packets and second mirrored traffic packets by rolling hashing, and determining a serial number corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet;

[0016] Locating identical matching mirrored traffic packets in the same session according to the sequence numbers corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet, and extracting the dual-ended timestamp of the matching mirrored traffic packet;

[0017] Delay information of the nodes in each cluster is determined according to the obtained double-ended tagged timestamp.

[0018] In a possible implementation, the first mirrored traffic packet is determined by: a plurality of first mirrored traffic flows marked with timestamps and segmented according to preset milliseconds and collected by the first deep packet inspection management function system according to the mirror capture time of the snapshot instruction;

[0019] The second mirror traffic packet is determined by: the second deep packet inspection management function system according to the mirror capture time of the snapshot instruction, and is collected by a plurality of second mirror traffic segments according to preset milliseconds and marked with timestamps.

[0020] In one possible implementation, the method further includes:

[0021] Based on the delay information, network optimization processing is performed on the service systems corresponding to the nodes in each cluster.

[0022] In one possible implementation, the method further includes:

[0023] Update the correspondence table between the address segments detected in the first deep packet inspection management function system on the Internet data center side and the second deep packet inspection management function system deployed on the user side of the user network and the device name / management address.

[0024] According to a second aspect of the present disclosure, a delay measurement device is provided, the device comprising:

[0025] An acquisition unit, used to acquire session data of nodes in each cluster;

[0026] a processing unit, configured to query a preset address library according to the name of each cluster, replace the intranet address in the session data of the nodes in each cluster with the public network address of the cluster, and initiate addressing of a deep packet inspection system according to the obtained public network address to determine the first address and the second address;

[0027] The processing unit is further configured to simultaneously send a snapshot instruction to the deep packet inspection management function system corresponding to each of the first address and the second address to obtain a plurality of first mirrored traffic packets and a second mirrored traffic packet; the snapshot instruction includes a five-tuple of session data of each node in the cluster and a corresponding mirrored capture time;

[0028] An analyzing unit is configured to determine delay information of each node in the cluster based on the plurality of first mirrored traffic packets and the second mirrored traffic packets.

[0029] In a possible implementation, the processing unit is configured to:

[0030] A snapshot instruction is simultaneously sent to a first deep packet inspection management function system on the Internet data center side and a second deep packet inspection management function system deployed on the user side of the user network.

[0031] In a possible implementation, the image capture time is determined based on an image capture time rule; the image capture time rule is that the image capture time is determined based on the hourly time and a multiple of 10 minutes.

[0032] In a possible implementation, the analysis unit is configured to:

[0033] Constructing an index for the plurality of first mirrored traffic packets and second mirrored traffic packets by rolling hashing, and determining a serial number corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet;

[0034] Locating identical matching mirrored traffic packets in the same session according to the sequence numbers corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet, and extracting the dual-ended timestamp of the matching mirrored traffic packet;

[0035] Delay information of the nodes in each cluster is determined according to the obtained double-ended tagged timestamp.

[0036] In one possible embodiment, the first mirror traffic packet is determined by: a first deep packet inspection management function system according to the mirror capture time of the snapshot instruction, and a plurality of first mirror traffics marked with timestamps and segmented according to preset milliseconds; the second mirror traffic packet is determined by: a second deep packet inspection management function system according to the mirror capture time of the snapshot instruction, and a plurality of second mirror traffics marked with timestamps and segmented according to preset milliseconds.

[0037] In a possible implementation manner, the device further includes an optimization unit configured to:

[0038] Based on the delay information, network optimization processing is performed on the service systems corresponding to the nodes in each cluster.

[0039] In a possible implementation, the apparatus further includes an updating unit configured to:

[0040] Update the correspondence table between the address segments detected in the first deep packet inspection management function system on the Internet data center side and the second deep packet inspection management function system deployed on the user side of the user network and the device name / management address.

[0041] According to a third aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the method of the first aspect and possible implementations thereof are implemented.

[0042] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the method of the above-mentioned first aspect and its possible implementation methods by executing the executable instructions.

[0043] The technical solution disclosed in this disclosure has the following beneficial effects:

[0044] In the embodiment of the present disclosure, the session data of the nodes in each cluster can be obtained; the preset address library can be queried according to the name of each cluster, the intranet address in the session data of the nodes in each cluster is replaced with the public network address of the cluster, and the deep packet inspection system addressing is initiated according to the obtained public network address to determine the first address and the second address; a snapshot instruction is sent to the deep packet inspection management function system corresponding to the first address and the second address at the same time to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of the session data of the nodes in each cluster and the corresponding mirror capture time; based on the multiple first mirror traffic packets and the second mirror traffic packets, the delay information of the nodes in each cluster is determined. It can be seen that the embodiment of the present disclosure adopts a non-intrusive architecture, reuses existing deep packet inspection equipment and business flows, and does not require any changes to the existing business flows. It not only ensures the security of business traffic, but also improves the accuracy of determining delay information to a certain extent because the delay is determined based on real traffic packets.

[0045] Other features and advantages of the present disclosure will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present disclosure. The purposes and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments of the present disclosure. Obviously, the drawings introduced below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A schematic diagram of an application scenario in this exemplary embodiment is shown;

[0048] Figure 2 A schematic diagram showing another application scenario in this exemplary embodiment is shown;

[0049] Figure 3 A schematic flow chart showing a method for measuring time delay in this exemplary embodiment is shown;

[0050] Figure 4 A schematic diagram of a process for issuing a snapshot instruction in this exemplary embodiment is shown;

[0051] Figure 5 A schematic diagram of a process for determining delay information in this exemplary embodiment is shown;

[0052] Figure 6A schematic structural diagram of a delay measurement device in this exemplary embodiment is shown;

[0053] Figure 7 A schematic structural diagram of an electronic device in this exemplary embodiment is shown. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure. In the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0055] The terms "comprises" and "comprising" and any variations thereof in the specification and claims of this disclosure are intended to cover non-exclusive protection. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements, but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0056] In the embodiments of the present disclosure, one or more, "many" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or plural.

[0057] It should be noted that the terms "first", "second", "third", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order, sequence, size and priority. For example, the first address and the second address in the embodiment of the present disclosure are only used to distinguish different addresses. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0058] The following describes exemplary embodiments of the present disclosure in conjunction with the accompanying drawings. The accompanying drawings are schematic diagrams of the present disclosure and are not necessarily drawn to scale. Some of the block diagrams shown in the accompanying drawings may be functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, or in hardware modules or integrated circuits, or in networks, processors or microcontrollers. The embodiments can be implemented in various forms and should not be construed as being limited to the examples set forth herein. The features, structures or characteristics described in the present disclosure can be combined in one or more embodiments in any suitable manner. In the description below, many specific details are provided to provide a full description of the embodiments of the present disclosure. However, those skilled in the art will appreciate that one or more specific details may be omitted when implementing the technical solutions of the present disclosure, or that other methods, components, devices, steps, etc. may be used to replace one or more specific details.

[0059] It should be noted that in the embodiments of this disclosure, certain software, components, models, and other existing industry solutions may be mentioned. These should be considered exemplary and are intended solely to illustrate the feasibility of implementing the technical solutions of this disclosure. This does not mean that the applicant has or will necessarily use such solutions. The collection, dissemination, and use of data in this technical solution comply with relevant national laws and regulations.

[0060] As previously mentioned, while latency measurement methods provided in related technologies can determine latency information, they not only change the message structure but also pose the risk of data tampering, making them difficult to meet the requirements of high-security scenarios such as finance and government affairs. Therefore, accurately determining latency while ensuring the security of business traffic has become a pressing issue.

[0061] In view of one or more of the above problems, an exemplary embodiment of the present disclosure provides a method for measuring latency, by which the session data of nodes in each cluster can be obtained; a preset address library is queried according to the name of each cluster, the intranet address in the session data of the nodes in each cluster is replaced with the public network address of the cluster, and a deep packet inspection system addressing is initiated based on the obtained public network address to determine the first address and the second address; a snapshot instruction is simultaneously sent to the deep packet inspection management function system corresponding to each of the first address and the second address to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of session data of the nodes in each cluster and the corresponding mirror capture time; based on the multiple first mirror traffic packets and the second mirror traffic packets, the latency information of the nodes in each cluster is determined. It can be seen that the embodiment of the present disclosure adopts a non-intrusive architecture, reuses existing deep packet inspection equipment and business flows, and does not require any changes to the existing business flows. It not only ensures the security of business traffic, but also improves the accuracy of determining latency information to a certain extent because the delay is determined based on real traffic packets.

[0062] To better understand the technical solutions provided by the embodiments of the present disclosure, the following briefly introduces the application scenarios to which the technical solutions provided by the embodiments of the present disclosure are applicable. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present disclosure and are not limiting. In specific implementations, the technical solutions provided by the embodiments of the present disclosure can be flexibly applied according to actual needs.

[0063] To better understand the technical solutions provided by the embodiments of the present disclosure, some technical names involved in the present disclosure are explained below:

[0064] 1. Prometheus: An open-source container monitoring system developed in the Go language, it focuses on "time series." Each piece of data contains a metric name, label (key-value pair), and timestamp, supporting identification and analysis of monitored objects from multiple dimensions (such as service, instance, and environment). It also has a built-in alerting mechanism, using the Alertmanager component to process alert rules. It supports alert aggregation, grouping, and routing (such as emailing by level) to ensure efficient alert delivery. It also supports rich visualization, such as displaying monitoring data through custom dashboards, supporting various visualization formats such as charts, heat maps, and dashboards.

[0065] 2. remote_write: The remote write protocol of the Prometheus monitoring system, used to push collected time series data (such as sessions) to external storage or analysis services in real time, supporting cross-cluster data aggregation.

[0066] 3. Quintuple: A unique identifier for a network session, including source IP, source port, destination IP, destination port, and transport layer protocol. Transport layer protocols include TCP (Transmission Control Protocol), UDP (User Datagram Protocol), QUIC (Quick UDP Internet Connections), and encrypted traffic.

[0067] 4. Snapshot command: A control command issued to the Deep Packet Inspection (DPI) management system, containing the traffic characteristics to be mirrored (five-tuple) and the precise execution time window (such as the hour + 10-minute multiples), triggering the traffic capture action.

[0068] 5. DPI management function system: A cluster of deep packet inspection devices deployed on the user side and the Internet Data Center (IDC) side, which performs traffic mirroring, fragment packaging and timestamp marking after receiving snapshot instructions.

[0069] 6. Seq sequence number precise matching algorithm: This hash index-based packet matching technology locates TCP packets with the same sequence number in the mirrored traffic at both ends within microseconds for latency calculation.

[0070] In the embodiments of the present disclosure, the latency measurement technology can be used in scenarios such as cloud service provider service level agreement (SLA) visualization and billing optimization, global traffic scheduling of Internet applications, and operator network optimization, which are not limited in the embodiments of the present disclosure.

[0071] See also Figure 1 As shown, Figure 1 This is an application scenario to which the technical solutions of the embodiments of the present disclosure can be applied. In this scenario diagram, it includes a user-side device 110, a service-side device 120, and an electronic device 130. Specifically, the user-side device 110, the service-side device 120, and the electronic device 130 can be directly or indirectly connected to each other through one or more networks 140. Optionally, the application scenario may also include other electronic devices, which can, for example, perform linkage processing based on the time delay output by the electronic device 130, which is not limited in the embodiments of the present disclosure.

[0072] In the disclosed embodiments, service interaction can occur between the user-side device 110 and the service-side device 120, thereby determining session data. Session data may include TCP sessions, UDP sessions, QUIC sessions, encrypted traffic, and the like. The following description uses a TCP session as an example of session data. A TCP session refers to the entire process of data exchange between two devices (such as a computer or server) after a connection is established via TCP. It is the core mechanism for the TCP protocol to achieve reliable communication. TCP session data refers to the data involved in the entire process of data exchange between two devices (such as a computer or server) after a connection is established via TCP.

[0073] In the embodiment of the present disclosure, different services correspond to different clusters. Each cluster includes multiple service-side devices 120 , and each service-side device 120 can be understood as a node in the cluster.

[0074] In an embodiment of the present disclosure, the electronic device 130 can obtain the Transmission Control Protocol TCP session data of the nodes in each cluster; query the preset address library according to the name of each cluster, replace the intranet address in the TCP session data of the nodes in each cluster with the public network address of the cluster, and initiate deep packet inspection system addressing based on the obtained public network address to determine the first address and the second address; simultaneously send snapshot instructions to the deep packet inspection management function systems corresponding to the first address and the second address to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instructions include a five-tuple of the TCP session data of the nodes in each cluster and the corresponding mirror capture time; based on the multiple first mirror traffic packets and the second mirror traffic packets, determine the delay information of the nodes in each cluster.

[0075] In an embodiment of the present disclosure, a delay measurement system is deployed on the electronic device 130, and the delay measurement system includes a remote write / read module, a snapshot instruction issuing module and a snapshot analysis module. Among them, the remote write / read module is used to connect to the Prometheus monitoring system, obtain the session data (including source / destination IP and port) of each cluster node in real time through the remote_write protocol, complete the data standardization processing of the session data (such as adding cluster identification and unified format), and forward the processed data to the snapshot instruction module. In addition, the remote write / read module can also receive the delay calculation results, encapsulate them into a Prometheus compatible format and write back to the storage layer to achieve two-way protocol conversion and traffic control. The snapshot instruction issuing module is used to achieve intelligent address conversion and precise scheduling, that is, query the IP library according to the cluster name, replace the intranet IP in the TCP session with the public network address, and match the user side / IDC side DPI management system address according to the IP segment of the public network address. Dynamically generate a snapshot instruction containing a five-tuple and a precise time window (hourly + 10-minute multiples). This snapshot instruction is issued in parallel to the distributed DPI system, including the first deep packet inspection management function system on the internet data center side and the second deep packet inspection management function system deployed on the user side of the user network. This ensures cross-domain packet capture time synchronization and provides standardized input for latency analysis. The snapshot analysis module is used to synchronously receive mirrored traffic packets (each containing 500-1000 0.1ms fragments) uploaded by the DPI management function systems on both ends (i.e., the first deep packet inspection management function system on the internet data center side and the second deep packet inspection management function system deployed on the user side of the user network). It uses the Seq sequence number hash matching algorithm to locate multiple identical matching mirrored traffic packets in the same TCP session at the microsecond level, thereby determining the matching mirrored traffic packets, and then extracting the corresponding timestamp T1 on the user side and the corresponding timestamp T2 on the IDC side. The end-to-end latency is calculated using the formula T0 = T2 - T1 - clock drift compensation.

[0076] For example, see Figure 2 As shown, Figure 2 This is another application scenario to which the technical solution of the embodiment of the present disclosure can be applied. In the embodiment of the present disclosure, the Prometheus service of the cloud cluster can be configured to obtain the TCP session data of the cluster nodes. Prometheus configures remote_write to push the original data to the remote service. The remote write / read module reads the TCP session data to be measured. Each TCP session data contains the source address, source port, destination address, and destination port. The remote write / read module sends the TCP session data and cluster name read from each cluster to the snapshot instruction issuing module.

[0077] It can be seen that the remote write / read module, as the remote_write receiving endpoint of Prometheus, continuously obtains the original TCP session data (including source / destination address and port) of each cluster node, binds the data with the cluster name, and forwards it to the snapshot instruction issuing module. In addition, the remote write / read module can also receive the session delay results (including five-tuples) calculated by the snapshot analysis module, encapsulate them into a Prometheus compatible format, and transmit them back to the Prometheus storage layer through remote_write. In other words, the remote write / read module needs to complete data standardization processing (such as unifying heterogeneous formats and adding cluster identifiers) and traffic control (such as traffic control based on buffer queues and priority scheduling), support two-way adaptation between the Prometheus protocol and the business system, that is, undertake two-way data flow and protocol conversion functions.

[0078] In the embodiment of the present disclosure, the snapshot instruction issuing module queries the preset address library, wherein the preset address library is, for example, Figure 2 The IP address / DPI device library in the . Query the preset address library according to the name of each cluster, replace the intranet address in the TCP session data of the nodes in each cluster with the public network address of the cluster, and initiate deep packet inspection system addressing based on the obtained public network address to determine the first address and the second address. That is to say, the snapshot instruction issuing module can query the IDC-side DPI management function system address corresponding to the cluster public network address segment, and query the user-side DPI management function system address corresponding to the client address segment. In addition, the snapshot instruction issuing module issues a snapshot instruction to the DPI management function systems at both ends. The snapshot instruction is, for example, an instruction for mirroring a specified stream at the hour, that is, indicating that the mirroring at the hour can be executed at the hour + minutes in multiples of 10, such as 8:50, 9:20, etc. Optionally, the snapshot instruction includes the source address, source port, destination address and destination port of the TCP session to be mirrored, the mirror capture time, etc.

[0079] In this way, the first deep packet inspection management function system on the Internet data center side and the DPI collection and identification module in the second deep packet inspection management function system deployed on the user side of the user network can fragment and mirror the passing traffic according to the received snapshot instructions. Figure 2 The server side of the Internet data center (Server) and Figure 2The service traffic corresponding to the client on the user side of the network. Generally, a duration of 50ms-100ms can be collected for mirroring. This mirroring duration basically covers the network delay within the domestic range. The collection period is further divided into 500-1000 0.1ms fragmented traffic for packaged storage, and a timestamp is marked on each packaged and stored mirrored traffic. In addition, the first deep packet inspection management function system on the Internet data center side and the DPI collection and identification module in the second deep packet inspection management function system deployed on the user side of the user network report the mirrored traffic packet to the corresponding management function system. In this way, the first deep packet inspection management function system on the Internet data center side and the second deep packet inspection management function system deployed on the user side of the user network respectively upload the received mirrored traffic packet to the snapshot analysis module.

[0080] In the disclosed embodiment, the snapshot analysis module uses a hash index acceleration packet matching Seq sequence number precise matching algorithm to match two identical packets in the same session between the IDC-side mirrored traffic packet and the user-side mirrored traffic packet. Then, based on the timestamps of the matching packet files on both ends, it calculates the time difference (i.e., latency) from the source to the destination. For example, if the user-side mirrored traffic packet has a timestamp of T1 and the IDC-side mirrored traffic packet has a timestamp of T2, the time difference T0 can be determined to be T2-T1.

[0081] Optionally, the snapshot analysis module sends the analyzed session delay and the original session five-tuple to the remote write / read module, so that the remote write / read module writes the aggregated analysis results to the Promethues service through the Promethues Remote Write receiver. In this way, users / application apps can obtain their own network delay data in different areas through the Promethues service.

[0082] In the embodiment of the present disclosure, the electronic device 130 can be a server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server or cloud server cluster that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, but is not limited to these.

[0083] Of course, the method provided in the embodiment of the present disclosure is not limited to Figure 1 The application scenarios shown can also be used in other possible application scenarios, and the embodiments of the present disclosure are not limited thereto.

[0084] To further illustrate the technical solutions provided by the embodiments of the present disclosure, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of the present disclosure provide the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiments of the present disclosure. In the actual processing process or when the device is executed, the method may be executed in the order of the methods shown in the embodiments or drawings or in parallel.

[0085] See Figure 3 , Figure 3 A method for measuring time delay is provided in an embodiment of the present invention. The method comprises an electronic device, for example, Figure 1 The electronic device 130 with a delay measurement system is deployed in the system, and the delay measurement system is, for example, Figure 2 The system shown in the system module is not limited in the embodiments of the present invention.

[0086] Step 301: Acquire session data of each node in the cluster.

[0087] In the embodiment of the present disclosure, the remote write / read module in the latency measurement system can serve as the remote_write receiving endpoint of Prometheus to continuously obtain the original session data of each cluster node, so that the session data to be measured can be determined from the continuously obtained original session data of each cluster node, as the final acquired session data of each node in the cluster.

[0088] Step 302: query the preset address library according to the name of each cluster, replace the intranet address in the session data of the node in each cluster with the public network address of the cluster, and initiate deep packet inspection system addressing based on the obtained public network address to determine the first address and the second address.

[0089] Step 303: Sending a snapshot instruction to the deep packet inspection management function system corresponding to the first address and the second address respectively, to obtain a plurality of first mirrored traffic packets and second mirrored traffic packets; the snapshot instruction includes a quintuple of session data of each node in the cluster and the corresponding mirrored capture time;

[0090] In the disclosed embodiments, the snapshot instruction issuing module in the latency measurement system can implement intelligent address conversion and routing decisions. Specifically, it can query a pre-set address library based on the name of each cluster and replace the intranet address in the session data of each node within the cluster with the cluster's public network address. The pre-set address library can be, for example, an IP address / DPI device library. The DPI system then initiates addressing based on the obtained public network address to determine the first and second addresses.

[0091] In the embodiment of the present disclosure, the first deep packet inspection management function system on the Internet data center side and the second deep packet inspection management function system deployed on the user side of the user network are both provided with a correspondence table between the detected address segments and the device name / management address, so that the first address and the second address can be determined based on the correspondence table and the address segment of the public network address.

[0092] Optionally, the mapping table between detected address segments and device names / management addresses within the first deep packet inspection management function system at the internet data center and the second deep packet inspection management function system deployed on the user side of the user network can be updated. The update rules and timing can be set based on actual implementation and are not limited in the present disclosure.

[0093] In addition, the correspondence table between cluster names and allocated public network addresses can be stored and updated, so that query requests from query clients can be received and query results can be returned.

[0094] In the disclosed embodiment, a snapshot instruction can be simultaneously sent to a first deep packet inspection management function system at the internet data center and a second deep packet inspection management function system deployed on the user side of the user network. The image capture time is determined based on an image capture time rule; the image capture time rule determines the image capture time based on the hourly time and a multiple of 10 minutes. For example, the image capture time is 8:50, 9:20, etc., which is the hourly time plus 10 times the minute.

[0095] For example, see Figure 4 As shown, the snapshot instruction issuing module in the latency measurement system can query the IP library according to the cluster name and perform address translation on the TCP session, that is, replace the intranet IP in the TCP session with the public network address, thereby obtaining the public network IP and cluster information, and match the user-side / IDC-side DPI management system address according to the public network address IP segment, that is, the aforementioned first address and second address, and then dynamically generate a snapshot instruction containing a five-tuple and a precise time window (for example, the hour + 10-minute multiples), and issue it to the first address and second address in the distributed DPI system, that is, to the DPI management systems on the IDC side and the user side in parallel, thereby ensuring cross-domain packet capture time synchronization and providing standardized input for latency analysis.

[0096] It can be seen that in the embodiments of the present disclosure, through dynamic address translation, precise timing control and distributed instruction collaboration, the original TCP session data is converted into executable monitoring tasks, providing standardized input and cross-domain scheduling capabilities for end-to-end delay analysis.

[0097] In the disclosed embodiment, the first deep packet inspection management function system on the Internet data center side and the DPI collection and identification module in the second deep packet inspection management function system deployed on the user side of the user network can perform segmented mirroring of the passing traffic according to the received snapshot instruction. Generally, a 50ms-100ms duration can be collected for mirroring, which basically covers the network latency within the domestic range. The collection period is further divided into 500-1000 0.1ms fragmented traffic for packaged storage, and a timestamp is added to each packaged and stored mirrored traffic to obtain the first mirrored traffic packet and the second mirrored traffic packet.

[0098] In other words, the first mirrored traffic packet is determined by the first deep packet inspection management function system based on the snapshot instruction's mirror capture time, multiple timestamped first mirrored traffic flows segmented by preset milliseconds. The second mirrored traffic packet is determined by the second deep packet inspection management function system based on the snapshot instruction's mirror capture time, multiple timestamped second mirrored traffic flows segmented by preset milliseconds. The preset millisecond class is 0.1ms, which is not limited in the disclosed embodiments.

[0099] Step 304: Determine the latency information of each node in the cluster based on the plurality of first mirrored traffic packets and the second mirrored traffic packets.

[0100] In an embodiment of the present disclosure, a snapshot analysis module in a latency measurement system constructs an index for multiple first and second mirrored traffic packets using a rolling hash to determine the sequence number corresponding to each first and second mirrored traffic packet. Based on the sequence number corresponding to each first and second mirrored traffic packet, the system locates multiple identical matching mirrored traffic packets in the same TCP session at the microsecond level and extracts the dual-ended timestamp of each matching mirrored traffic packet. Based on the obtained dual-ended timestamp, the system determines the latency information of each node in the cluster.

[0101] For example, see Figure 5 As shown, the snapshot analysis module in the delay measurement system synchronously receives the mirror traffic packets uploaded by the DPI at both ends (i.e. Figure 5 The system uses the user-side mirrored traffic packets and the IDC-side mirrored traffic packets in the mirrored traffic packets. Each mirrored traffic packet contains 500-1000 0.1ms fragments. Then, a Seq sequence number hash matching algorithm (such as H(seq) = seq% table_size) is used to locate multiple identical matching mirrored traffic packets in the same TCP session at the microsecond level, thereby determining the matching mirrored traffic packets. Based on the matching mirrored traffic packets, the corresponding timestamp T1 on the user side and the corresponding timestamp T2 on the IDC side are extracted. The end-to-end delay is calculated using the formula T0 = T2-T1-clock drift compensation, with a delay accuracy of ±0.05ms.

[0102] In the embodiment of the present disclosure, the electronic device may further perform network optimization processing on the service systems corresponding to the nodes in each cluster according to the delay information.

[0103] In one possible implementation, after the electronic device determines the latency information of the nodes in each cluster, in the cloud service provider's SLA visualization and billing optimization scenario, the financial tenant provides a cross-availability zone (AZ) latency SLA certificate, and Prometheus receives the latency information, such as {region:"us-east-1→eu-west-1", delay:72.3ms}, aggregates the latency information with the virtual machine's central processing unit (CPU) / memory monitoring data, and generates a tenant-level SLA dashboard. In addition, the cloud service provider can set SLA indicators, such as: if delay<80ms then 100% else 80% / / financial-level SLA threshold, when the cross-domain latency is continuously >80ms, bill compensation is automatically triggered: if avg_delay>SLA_threshold:, apply_credit(tenant_id,20%) / / 20% refund for SLA violation. In addition, tenant self-service optimization can also be achieved: tenants can optimize based on latency thermal Figure 1 The "Low Latency Routing" function is enabled by clicking the button to automatically deploy Equal-Cost Multi-Path (ECMP). Of course, other optimization processes based on latency information can also be performed in cloud service provider SLA visualization and billing optimization scenarios, which is not limited in the embodiments of the present disclosure.

[0104] In one possible implementation, after electronic devices determine the latency information of nodes within each cluster, video conferencing service providers can use this latency information to optimize user access quality in global traffic scheduling scenarios for internet applications. Optionally, global session data can be analyzed to generate a regional latency matrix. Second, anycast routing policies can be dynamically adjusted. When a user's latency to a server exceeds a threshold, the service is switched to a server provider with available capacity and latency that meets the user's needs. Finally, computing capacity elasticity planning can be performed based on network latency, automatically expanding edge nodes and adding new Point of Presence (POP) servers.

[0105] In one possible implementation, after electronic devices determine the latency information of nodes within each cluster, in an operator network optimization scenario, they can accumulate historical data on network latency between nodes across the entire network to identify nodes and links with long-term performance issues in the network, thereby guiding network optimization and planning and construction.

[0106] It can be seen that the three major problems of the Internet Control Message Protocol (ICMP) delay measurement solution, namely, being blocked by firewalls, being separated from real business, and being unable to be diagnosed in segments, are solved in the embodiments of the present disclosure through "business flow multiplexing + mirror isolation analysis". In addition, the present disclosure adopts a non-invasive architecture, reuses existing DPI equipment, supports full protocols (TCP / UDP / QUIC / encrypted traffic), has zero bandwidth overhead (mirror traffic does not occupy business bandwidth), supports encrypted traffic analysis, significantly reduces the difficulty and cost of deploying the delay measurement solution, and increases the scope of application of the delay measurement solution. In addition, the present disclosure issues snapshot instructions to the distributed DPI system based on the preset time window strategy at the hour + 10-minute multiple, realizes on-demand packet capture of established sessions without relying on new connections, supports real-time measurement of any active TCP / UDP session (such as video stream / database long connection), and improves the accuracy of delay measurement. In addition, since the coverage rate reaches 100% of business traffic, the resource utilization efficiency of the solution provided by the present invention is significantly improved compared with the full-traffic packet capture solution: that is, through the 50ms mirroring time combined with 0.1ms sharding processing, the storage overhead can be greatly reduced; at the same time, with the help of the dynamic instruction scheduling mechanism, the computing load is effectively reduced.

[0107] The exemplary embodiment of the present disclosure also provides a delay measurement device. Figure 6 As shown, the delay measurement device 600 includes the following program modules:

[0108] An acquisition unit 601 is configured to acquire session data of each node in the cluster;

[0109] Processing unit 602 is configured to query a preset address library according to the name of each cluster, replace the intranet address in the session data of the nodes in each cluster with the public network address of the cluster, and initiate deep packet inspection system addressing based on the obtained public network address to determine the first address and the second address;

[0110] The processing unit 602 is further configured to simultaneously send a snapshot instruction to the deep packet inspection management function system corresponding to the first address and the second address, respectively, to obtain a plurality of first mirrored traffic packets and second mirrored traffic packets; the snapshot instruction includes a five-tuple of session data of each node in the cluster and a corresponding mirrored capture time;

[0111] The analyzing unit 603 is configured to determine the latency information of each node in the cluster according to the plurality of first mirrored traffic packets and the second mirrored traffic packets.

[0112] In a possible implementation, the processing unit 602 is configured to:

[0113] A snapshot instruction is simultaneously sent to a first deep packet inspection management function system on the Internet data center side and a second deep packet inspection management function system deployed on the user side of the user network.

[0114] In a possible implementation, the image capture time is determined based on an image capture time rule; the image capture time rule is that the image capture time is determined based on the hourly time and a multiple of 10 minutes.

[0115] In a possible implementation, the analysis unit 603 is configured to:

[0116] Constructing an index for the plurality of first mirrored traffic packets and second mirrored traffic packets by rolling hashing, and determining a serial number corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet;

[0117] Locating identical matching mirrored traffic packets in the same session according to the sequence numbers corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet, and extracting the dual-ended timestamp of the matching mirrored traffic packet;

[0118] Delay information of the nodes in each cluster is determined according to the obtained double-ended tagged timestamp.

[0119] In one possible embodiment, the first mirror traffic packet is determined by: a first deep packet inspection management function system according to the mirror capture time of the snapshot instruction, and a plurality of first mirror traffics marked with timestamps and segmented according to preset milliseconds; the second mirror traffic packet is determined by: a second deep packet inspection management function system according to the mirror capture time of the snapshot instruction, and a plurality of second mirror traffics marked with timestamps and segmented according to preset milliseconds.

[0120] In a possible implementation manner, the device further includes an optimization unit configured to:

[0121] Based on the delay information, network optimization processing is performed on the service systems corresponding to the nodes in each cluster.

[0122] In a possible implementation, the apparatus further includes an updating unit configured to:

[0123] Update the correspondence table between the address segments detected in the first deep packet inspection management function system on the Internet data center side and the second deep packet inspection management function system deployed on the user side of the user network and the device name / management address.

[0124] It should be noted that Figure 6 The acquisition unit in can be understood as Figure 2 Remote write / read module in Figure 6 The processing unit in can be understood as Figure 2 The snapshot instruction issuing module in Figure 6 The analysis unit in can be understood as Figure 6 The snapshot analysis module in .

[0125] The specific details of each part of the above-mentioned device have been described in detail in the implementation method part. The undisclosed details can be found in the implementation method part, so they will not be repeated here.

[0126] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the exemplary embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0127] The exemplary embodiments of the present disclosure further provide a computer program product, which includes a computer program, and when the computer program is executed by a processor, implements the above-mentioned delay measurement method.

[0128] In one embodiment, a computer program product may be a tangible product containing a computer program, such as a computer-readable storage medium storing the computer program. The computer-readable storage medium may be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory (Flash), mechanical hard disk drive (HDD), solid-state drive (SSD), and the like. Exemplarily, the computer program product may be implemented as a non-volatile storage medium storing the computer program, such as a read-only memory, NAND flash memory, and the like.

[0129] In one embodiment, the computer program product may be an intangible product containing a computer program. For example, the computer program product may be implemented as a virtual digital product, such as a digital file such as an executable file or installation package storing the computer program.

[0130] The code of the computer program can be written in one or more programming languages. Programming languages ​​include C, Java, C++, etc. The program code can be executed entirely on the user computing device, partially on the user computing device, or as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device via any type of network, such as a local area network (LAN), a wide area network (WAN), etc., or can be connected to an external computing device (e.g., via an Internet connection provided by a carrier).

[0131] Computer programs can be carried or transmitted through electrical, magnetic, optical, electromagnetic, infrared, and other signals. Electronic devices can convert signals carrying computer programs into digital signals, thereby running the computer programs. When a computer program is run on an electronic device, its code is used to enable the electronic device to execute (more specifically, the processor of the electronic device can execute) the method steps of various exemplary embodiments of the present disclosure, such as the above-mentioned delay measurement method, which includes the following steps: Step 301: Obtaining session data of nodes in each cluster; Step 302: Querying a preset address library according to the name of each cluster, replacing the intranet address in the session data of each node in the cluster with the public network address of the cluster, and initiating deep packet inspection system addressing based on the obtained public network address to determine the first address and the second address; Step 303: Sending a snapshot instruction to the deep packet inspection management function system corresponding to each of the first address and the second address at the same time to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of session data of each node in the cluster and the corresponding mirror capture time; Step 304: Determining the delay information of each node in the cluster based on the multiple first mirror traffic packets and the second mirror traffic packets.

[0132] By implementing the above method steps through a computer program, the session data of the nodes in each cluster can be obtained; according to the name of each cluster, the preset address library is queried, the intranet address in the session data of the nodes in each cluster is replaced with the public network address of the cluster, and the deep packet inspection system addressing is initiated based on the obtained public network address to determine the first address and the second address; a snapshot instruction is simultaneously sent to the deep packet inspection management function system corresponding to the first address and the second address to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of the session data of the nodes in each cluster and the corresponding mirror capture time; based on the multiple first mirror traffic packets and the second mirror traffic packets, the delay information of the nodes in each cluster is determined. It can be seen that the embodiment of the present disclosure adopts a non-intrusive architecture, reuses the existing deep packet inspection equipment and business flows, and does not require any changes to the existing business flows. It not only ensures the security of the business traffic, but also improves the accuracy of the delay information to a certain extent because the delay is determined based on the real traffic packets.

[0133] The exemplary embodiments of the present disclosure further provide an electronic device, which may include a processor and a memory. The memory stores executable instructions for the processor, such as a computer program. The processor executes the executable instructions to perform the method steps of various exemplary embodiments of the present disclosure.

[0134] Reference below Figure 7 , the electronic device is exemplarily described in the form of a general-purpose computing device. It should be understood that Figure 7 The electronic device 130 shown is merely an example and should not limit the functionality and scope of use of the embodiments of the present disclosure.

[0135] like Figure 7 As shown, the electronic device 130 may include: a processor 710 , a memory 720 , a bus 730 , an I / O (input / output) interface 740 , and a network adapter 750 .

[0136] The memory 720 may include volatile memory, such as RAM 721 and cache unit 722, and may also include non-volatile memory, such as ROM 723. The memory 720 may also include one or more program modules 724. Such program modules 724 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. For example, the program modules 724 may include the modules in the aforementioned devices.

[0137] The processor 710 may include one or more processing units, for example: the processor 710 may include an AP (Application Processor), a modem processor, a GPU (Graphics Processing Unit), an ISP (Image Signal Processor), a controller, an encoder, a decoder, a DSP (Digital Signal Processor), a baseband processor and / or an NPU (Neural-Network Processing Unit), etc.

[0138] The processor 710 can be used to execute executable instructions stored in the memory 720, such as the above-mentioned delay measurement method, which includes the following steps: Step 301: Obtain session data of nodes in each cluster; Step 302: Query the preset address library according to the name of each cluster, replace the intranet address in the session data of the nodes in each cluster with the public network address of the cluster, and initiate deep packet inspection system addressing based on the obtained public network address to determine the first address and the second address; Step 303: Simultaneously send a snapshot instruction to the deep packet inspection management function system corresponding to the first address and the second address to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of session data of the nodes in each cluster and the corresponding mirror capture time; Step 304: Determine the delay information of the nodes in each cluster based on the multiple first mirror traffic packets and the second mirror traffic packets.

[0139] By executing the above method steps through the processor 710, the session data of the nodes in each cluster can be obtained; according to the name of each cluster, the preset address library is queried, the intranet address in the session data of the nodes in each cluster is replaced with the public network address of the cluster, and the deep packet inspection system addressing is initiated based on the obtained public network address to determine the first address and the second address; a snapshot instruction is simultaneously sent to the deep packet inspection management function system corresponding to the first address and the second address to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of the session data of the nodes in each cluster and the corresponding mirror capture time; based on the multiple first mirror traffic packets and the second mirror traffic packets, the delay information of the nodes in each cluster is determined. It can be seen that the embodiment of the present disclosure adopts a non-intrusive architecture, reuses existing deep packet inspection equipment and business flows, and does not require any changes to the existing business flows. It not only ensures the security of business traffic, but also improves the accuracy of determining delay information to a certain extent because the delay is determined based on real traffic packets.

[0140] The bus 730 is used to realize the connection between different components of the electronic device 130 and may include a data bus, an address bus, and a control bus.

[0141] The electronic device 130 can communicate with one or more external devices 800 (eg, a keyboard, a mouse, an external controller, etc.) through the I / O interface 740 .

[0142] The electronic device 130 can communicate with one or more networks via the network adapter 750. For example, the network adapter 750 can provide mobile communication solutions such as 3G / 4G / 5G, or wireless communication solutions such as wireless LAN, Bluetooth, and near-field communication. The network adapter 750 can communicate with other modules of the electronic device 130 via the bus 730.

[0143] although Figure 7 Not shown, other hardware and / or software modules may also be provided in the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0144] As can be seen from the above, the technical solutions of the present disclosure can be implemented as methods, devices, systems, computer program products, storage media, electronic devices, etc. Those skilled in the art will understand that various aspects of the present disclosure can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, such as "circuit", "module" or "system".

[0145] It should be understood that the present disclosure is not limited to the specific method steps or structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. Those skilled in the art will easily think of other embodiments based on the specific embodiments provided by the present disclosure. Therefore, the specific embodiments provided by the present disclosure are merely exemplary, and the scope and spirit of the present disclosure are indicated by the claims, which should cover any variations, uses or adaptive changes of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the field of the present technology that are not disclosed in the present disclosure.

Claims

1. A method for measuring time delay, characterized in that: The method comprises: Get the session data of each node in the cluster; Querying a preset address library according to the name of each cluster, replacing the intranet address in the session data of the nodes in each cluster with the public network address of the cluster, and initiating deep packet inspection system addressing according to the obtained public network address to determine the first address and the second address; Sending a snapshot instruction to the deep packet inspection management function system corresponding to the first address and the second address respectively to obtain multiple first mirror traffic packets and second mirror traffic packets; the snapshot instruction includes a five-tuple of session data of each node in the cluster and the corresponding mirror capture time; Determine the delay information of the nodes in each cluster according to the multiple first mirrored traffic packets and the second mirrored traffic packets.

2. The method according to claim 1, characterized in that Sending a snapshot instruction simultaneously to the deep packet inspection management function system corresponding to the first address and the second address respectively includes: A snapshot instruction is simultaneously sent to a first deep packet inspection management function system on the Internet data center side and a second deep packet inspection management function system deployed on the user side of the user network.

3. The method according to claim 1, characterized in that The image capture time is determined based on an image capture time rule; the image capture time rule is that the image capture time is determined based on the hourly time and a multiple of 10 minutes.

4. The method according to any one of claims 1 to 3, characterized in that: Determining the latency information of each node in the cluster according to the plurality of first mirrored traffic packets and the second mirrored traffic packets includes: Constructing an index for the plurality of first mirrored traffic packets and second mirrored traffic packets by rolling hashing, and determining a serial number corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet; Locating identical matching mirrored traffic packets in the same session at the microsecond level based on the sequence numbers corresponding to each of the first mirrored traffic packet and the second mirrored traffic packet, and extracting the dual-ended timestamp of the matching mirrored traffic packet; Determine the delay information of the nodes in each cluster according to the obtained double-ended tagged timestamp.

5. The method according to claim 4, characterized in that The first mirrored traffic packet is determined by: a plurality of first mirrored traffic packets marked with timestamps and collected by the first deep packet inspection management function system according to the mirror capture time of the snapshot instruction and segmented according to preset milliseconds; The second mirror traffic packet is determined by: the second deep packet inspection management function system according to the mirror capture time of the snapshot instruction, and is collected by a plurality of second mirror traffic segments according to preset milliseconds and marked with timestamps.

6. The method according to claim 1, characterized in that The method further comprises: Based on the delay information, network optimization processing is performed on the service systems corresponding to the nodes in each cluster.

7. The method according to claim 1, characterized in that The method further comprises: Update the correspondence table between the address segments detected in the first deep packet inspection management function system on the Internet data center side and the second deep packet inspection management function system deployed on the user side of the user network and the device name / management address.

8. A time delay measurement device, characterized in that: The device comprises: An acquisition unit, used to acquire session data of nodes in each cluster; a processing unit, configured to query a preset address library according to the name of each cluster, replace the intranet address in the session data of the nodes in each cluster with the public network address of the cluster, and initiate addressing of a deep packet inspection system according to the obtained public network address to determine the first address and the second address; The processing unit is further configured to simultaneously send a snapshot instruction to the deep packet inspection management function system corresponding to each of the first address and the second address to obtain a plurality of first mirrored traffic packets and a second mirrored traffic packet; the snapshot instruction includes a five-tuple of session data of each node in the cluster and a corresponding mirrored capture time; An analyzing unit is configured to determine delay information of each node in the cluster based on the plurality of first mirrored traffic packets and the second mirrored traffic packets.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; a memory for storing executable instructions of the processor; The processor is configured to perform the method according to any one of claims 1 to 7 by executing the executable instructions.

Images