Mirror method, bridge, system, medium and program product

Abstract

The application discloses a mirroring method, a bridge, a system, a medium and a program product; comprising: if a first message received by a first bridge meets a mirroring condition, obtaining a message belonging identifier from the first message; the message belonging identifier comprises a port identifier or a VNI of the first message; determining a second message based on at least the message belonging identifier and the first message; sending the second message to a second bridge to trigger the second bridge to obtain the message belonging identifier from the second message, encapsulate the second message based on the message belonging identifier to obtain a third message, and send the third message to the first bridge; wherein the third message comprises a mirrored message of the first message; and the third message is used for sending to a mirroring destination by the first bridge to trigger the mirroring destination to distinguish the third message based on the message belonging identifier and an address identifier of a mirroring source carried by the third message. The scheme enables the mirroring destination to perform targeted isolation analysis on the third message.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a mirroring method, bridge, system, media, and program product. Background Technology

[0002] In the field of cloud computing technology, Open vSwitch (OVS) filters and replicates its incoming and outgoing traffic data according to preset filtering conditions to obtain traffic mirrors, and then forwards the traffic mirrors to the corresponding mirror destinations on remote hosts for the remote hosts to parse the traffic mirrors. However, in the above process, the data packets carried in the traffic mirrors are insufficient to support the remote hosts in performing targeted analysis of the traffic mirrors. Summary of the Invention

[0003] Based on the above technical issues, embodiments of this application provide a mirroring method, a bridge, a system, a medium, and a program product.

[0004] The technical solution provided in this application is as follows:

[0005] This application first provides a mirroring method, which is applied to a first network bridge; the method includes:

[0006] If the first packet received by the first bridge meets the mirroring conditions, the packet ownership identifier is obtained from the first packet; wherein, the packet ownership identifier includes the port identifier of the first packet or the network identifier (VXLAN NetworkIdentifier, VNI) of the Virtual eXtensible Local Area Network (VXLAN).

[0007] The second message is determined based at least on the message attribution identifier and the first message;

[0008] The second message is sent to the second bridge to trigger the second bridge to obtain the message ownership identifier from the second message, encapsulate the second message based on the message ownership identifier to obtain a third message, and send the third message to the first bridge; wherein, the third message includes a mirror message of the first message; the third message is used for the first bridge to send to the mirror destination to trigger the mirror destination to distinguish the third message based on the message ownership identifier and the address identifier of the mirror source carried by the third message.

[0009] This application embodiment also provides a mirroring method, the method being applied to a second network bridge, the method comprising:

[0010] The first bridge receives a second message sent by the first bridge; wherein the second message is determined by the first bridge after determining that the first message meets the mirroring conditions, based at least on the message owner identifier of the first message and the first message; the message owner identifier includes the port identifier or VNI of the first message;

[0011] Obtain the message ownership identifier from the second message;

[0012] The second message is encapsulated based on the message attribution identifier to obtain a third message, and the third message is sent to the first bridge to trigger the first bridge to send the third message to the mirror destination; wherein, the third message includes a mirror message of the first message; the message attribution identifier and the address identifier of the mirror source carried by the third message are used for the mirror destination to distinguish the third message.

[0013] This application embodiment also provides a first bridge, the first bridge including a first processor and a first memory; wherein, the first memory stores a first computer program; when the first computer program is executed by the first processor, it can implement the mirroring method applied to the first bridge as described above.

[0014] This application embodiment also provides a second bridge, the second bridge including a second processor and a second memory; wherein, the second memory stores a second computer program; when the second computer program is executed by the second processor, it can implement the mirroring method applied to the second bridge as described above.

[0015] This application also provides a mirroring system, which includes the first bridge as described above, the second bridge as described above, a mirroring source, and a mirroring destination.

[0016] This application also provides a computer-readable storage medium storing a computer program; when the computer program is executed by a processor of an electronic device, it can implement the mirroring method as described above.

[0017] This application also provides a computer program product, which includes a computer program; when the computer program is executed by the processor of an electronic device, it can implement the mirroring method as described above.

[0018] The mirroring method applied to a first bridge provided in this application embodiment, if the first packet received by the first bridge meets the mirroring conditions, obtains a packet ownership identifier including the port identifier or VNI of the first packet, thus controlling the operation of obtaining the packet ownership identifier; furthermore, it determines a second packet based at least on the packet ownership identifier and the first packet, so that the second packet not only contains the first packet but also carries the packet ownership identifier of the first packet, thereby improving the comprehensiveness and integrity of the data in the second packet; based on this, the second packet is sent to the second bridge to trigger the second bridge to obtain the packet ownership identifier from the second packet, thus realizing the transmission of the packet ownership identifier across bridges. Since the port ownership identifier includes the port number or VNI of the first packet, through the above operations... This enables cross-bridge transmission of the packet's port number and VNI. On the other hand, the second bridge encapsulates the second packet based on the packet's owner identifier to obtain a third packet and sends it to the first bridge. The first bridge then sends the third packet to the mirror destination, and the third packet includes the mirror packet of the first packet. Thus, based on the second bridge's encapsulation of the second packet, the packet's owner identifier is transparently transmitted between the second bridge, the first bridge, and even the mirror destination. This provides data support for the mirror destination to distinguish the third packet based on the packet's owner identifier and the address identifier of the mirror source carried in the third packet. Consequently, the mirror destination can perform targeted and accurate analysis of the aforementioned mirror packets at the resource group or user group level based on the port identifier or VNI carried in any mirror packet it receives. Attached Figure Description

[0019] Figure 1 A schematic flowchart illustrating the mirroring method applied to a first bridge as provided in an embodiment of this application;

[0020] Figure 2 This is a schematic diagram illustrating the process of sending a mirror message to a mirror destination, as provided in an embodiment of this application.

[0021] Figure 3 A schematic flowchart illustrating the mirroring method applied to a second bridge as provided in an embodiment of this application;

[0022] Figure 4 This application provides a schematic diagram of a structure for performing mirroring through two bridges in an embodiment of the application.

[0023] Figure 5 This is a schematic diagram of the structure for message cross-bridge transmission provided in an embodiment of this application;

[0024] Figure 6 A module flowchart of the mirroring method provided in the embodiments of this application;

[0025] Figure 7 This is a schematic diagram of the structure of the first bridge provided in an embodiment of this application;

[0026] Figure 8 This is a schematic diagram of the structure of the second bridge provided in an embodiment of this application;

[0027] Figure 9 This is a schematic diagram of the structure of the mirror system provided in the embodiments of this application;

[0028] Figure 10 This is another schematic diagram of the image system provided in an embodiment of this application. Detailed Implementation

[0029] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0030] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0031] Traffic mirroring can replicate real traffic to a mirror service, allowing the mirror service to perform troubleshooting or monitoring and analysis of the transmission of data frames on one or more ports based on the traffic mirror.

[0032] Typically, traffic mirroring includes port mirroring and flow mirroring. Port mirroring can copy all traffic flowing through a network port without discrimination and forward it to the destination receiving port. Its smallest unit of mirroring is the port level. Flow mirroring, on the other hand, can identify and forward the traffic that is matched to the destination port based on filtering rules. Its smallest unit of mirroring is a flow.

[0033] In cloud server scenarios, the traffic mirroring process is related to the mirror source, mirror destination, and mirror session. The mirror source refers to the virtual machine elastic network interface instance that needs to mirror network traffic, while the mirror destination refers to the virtual machine elastic network interface instance or load balancer (LB) instance that receives the mirrored network traffic. The mirror session is the process of copying network traffic from the mirror source to the mirror destination by specifying filtering conditions.

[0034] In the actual traffic mirroring process, it is necessary to rely on filtering conditions to filter the original traffic. The filtering conditions include inbound or outbound rules, which are used to filter the network traffic to be mirrored in the mirroring session. The original traffic refers to the business traffic undertaken by the mirror source (Virtual Private Cloud, VPC). The key packets of the original traffic after being filtered by the rules are then encapsulated by VXLAN and passed to the mirroring destination. These packets are called mirror packets.

[0035] Among the related technologies, a traffic mirroring method based on OVS for the virtualization system InCloud Sphere and a streaming mirroring method for cloud hosts are provided.

[0036] The OVS-based traffic mirroring method is implemented as follows: OVS replicates traffic flowing through it to create a traffic mirror based on the Open Virtual Switching Standard. This traffic mirror is then forwarded to a remote host via a Generic Routing Encapsulation (GRE) channel, allowing the remote host to parse and store the traffic mirror. The traffic flowing through OVS includes traffic from virtual machines, traffic from the OVS uplink, or traffic from OVS port groups. This method enables the acquisition of traffic from virtual machines, OVS uplinks, and port groups, providing data support for remote hosts to monitor network traffic.

[0037] The cloud server streaming mirroring method can reduce traffic on the mirroring destination port, analyze information above the Internet Protocol (IP) layer, and improve the accuracy of problem analysis. This method is implemented through the following steps: 1) Configure the stream entry as the mirroring source in the stream matching table; 2) Configure any port of the device as the mirroring destination port; 3) When a data frame is received on a port other than the destination port of the device, a stream matching operation is first performed. If the stream matching determines that the data frame belongs to a certain configured stream, the data frame is copied and sent to the mirroring destination port for output, while the original data frame continues to perform normal data forwarding; if the stream matching finds that the data frame does not belong to a certain configured stream, the stream mirroring operation ends.

[0038] However, in the above process, the mirrored traffic is achieved by copying and forwarding packets. The mirrored packets do not carry data related to tenant isolation, so they are insufficient to support targeted analysis of traffic mirroring by remote hosts.

[0039] Based on the above technical issues, embodiments of this application provide a mirroring method, a bridge, a system, a medium, and a program product.

[0040] The technical solutions provided in this application are applicable to fields such as big data analysis or cloud computing.

[0041] Figure 1 A schematic flowchart of the mirroring method applied to the first bridge provided in the embodiments of this application is shown below. Figure 1 As shown, the method may include the following steps:

[0042] Step 101: If the first message received by the first bridge meets the mirroring conditions, obtain the message ownership identifier from the first message.

[0043] The message owner identifier includes the port identifier of the first message or the VNI of the VXLAN.

[0044] Accordingly, if the first bridge does not receive the first message, or if the first bridge receives the first message but the first message does not meet the mirroring conditions, then the message ownership identifier can be omitted from the first message.

[0045] In one implementation, the first bridge may be set in OpenFlow's OVS; exemplaryly, the first bridge may include a service bridge for processing business data transmission and / or control data transmission; exemplaryly, the first bridge may include a Bridge Integration (Br-int).

[0046] In one implementation, the first message may include any message in the traffic flowing through the OVS where the first bridge is located; wherein the traffic flowing through the OVS includes at least one of traffic from virtual machines, traffic from the OVS uplink, or traffic from the OVS port group.

[0047] In one implementation, the mirroring conditions may include filtering rules; for example, the filtering rules may be set in the actions of a flow table entry associated with the first bridge, wherein the flow table entry may be determined and distributed by Software-Defined Networking (SDN).

[0048] Specifically, the filtering criteria may include a first rule corresponding to the outgoing direction and a second rule corresponding to the incoming direction; the first rule and the second rule may be the same or different.

[0049] Specifically, filtering criteria can include quintuples, rule priority, port number, and metadata.

[0050] The port number is used to distinguish different VPCs, that is, the port number can represent the VPC identifier and is used to identify the VPC tenant to which the current packet belongs; while the five-tuple includes five major elements: the protocol number of the packet, the source IP address, the destination IP address, the source port, and the destination port.

[0051] Specifically, the quintuple and rule priority are used to accurately filter the packets sent and received by the port represented by the port number, and determine the filtered packets as data packets to be mirrored, that is, packets that meet the mirroring conditions.

[0052] Specifically, when multiple rules are involved, rule priority can specify which rule is currently the target rule, thereby improving the flexibility and controllability of message filtering.

[0053] In one implementation, when the first message is an outgoing message of the first bridge, the port identifier may include the port number of the first message; accordingly, the port number of the first message can be obtained during the process of determining that the first message meets the mirroring conditions.

[0054] For example, in the field of VPC technology, by means of the binding and isolation relationship between the port number of a message and the VPC tenant to which it belongs, the VPC tenant to which the first message belongs can be determined by the port number of the first message.

[0055] In one implementation, when the first message is an inbound message of the first bridge, the message home identifier may include the VNI; accordingly, after the first bridge receives the first message, it can perform a decapsulation operation on the first message to obtain its VXLAN header data, and then obtain the VNI of the VPC network to which the first message belongs from the VXLAN header data.

[0056] For example, in a cloud computing VPC environment, the VNI can be used to characterize and determine the virtual network or VPC tenant to which the first message belongs.

[0057] For example, the message attribution identifier can be the mirror session identifier.

[0058] Step 102: Determine the second message based at least on the message owner identifier and the first message.

[0059] In one implementation, the second message may carry a message ownership identifier, and the second message may also carry the header data and payload of the first message.

[0060] In one implementation, the second message can be determined in any of the following ways:

[0061] The second message is obtained by encoding the message owner identifier and the first message based on the preset encoding grid.

[0062] The message owner identifier is set in a specified field in the first message to obtain the second message; the specified field can be preset or adjusted or set according to the provisions of the first flow table entry.

[0063] Step 103: Send the second message to the second bridge to trigger the second bridge to obtain the message ownership identifier from the second message, encapsulate the second message based on the message ownership identifier to obtain the third message, and send the third message to the first bridge.

[0064] The third message includes a mirror message of the first message; the third message is used by the first bridge to send to the mirror destination to trigger the mirror destination to distinguish the third message based on the message owner identifier and the address identifier of the mirror source carried in the third message.

[0065] In one implementation, the second bridge and the first bridge can be located on the same computing node or on different computing nodes. The first bridge and the second bridge can be located on the same OVS or on different OVSs.

[0066] In one implementation, the second bridge can be specifically used to perform mirroring processing on the packets to be mirrored; wherein, the packets to be mirrored may include a first packet that meets the mirroring conditions, or a second packet carrying a packet ownership identifier; for example, the second bridge may include a Mirror Bridge, which can be simply referred to as br-mirror; for example, the first bridge and the second bridge can perform bidirectional data transmission through patch-port.

[0067] In one implementation, after the second bridge obtains the packet ownership identifier from the second packet, it can first encapsulate the second packet based on a pre-defined encapsulation protocol to obtain an encapsulated packet. Then, it sets the packet ownership identifier in the second field of the encapsulated packet, sets the source IP address in the header of the encapsulated packet to the IP address of the mirror source, and configures the destination IP address in the header to the IP address of the mirror destination, thereby obtaining the third packet. For example, the above encapsulation protocol can be specified by the SDN controller or by the user, and it needs to meet the transmission requirements of the mirror packet represented by the third packet for cross-bridge transmission and cross-compute node transmission. For example, the encapsulation protocol can include the VXLAN protocol, and the corresponding encapsulation operation can include tunnel encapsulation. For example, the second field can include IP header control fields, such as the Time to Live (TTL) subfield and the Type of Service (TOS) field.

[0068] In one implementation, since the third message is obtained by the second bridge encapsulating the second message, the address identifier of the mirror source carried in the third message can be the same as the address identifier of the mirror source carried in the first message and the second message respectively. For example, the address identifier of the mirror source may include the IP address of the mirror source. In this way, after the mirror destination receives the third message, it can parse the third message to obtain the above-mentioned address identifier.

[0069] In one implementation, after receiving the third message, the first bridge can forward the third message to the mirror destination based on the IP address of the mirror destination carried in the third message.

[0070] In one implementation, by obtaining the address identifier, the mirror destination can determine the mirror source to which the third packet belongs, and by obtaining the packet ownership identifier, the mirror destination can determine the source of the third packet and the VPC tenant or virtual network resource group to which it belongs.

[0071] In one implementation, the mirror source, mirror destination, first bridge, and second bridge can be located on the same computing node or on different computing nodes.

[0072] As can be seen from the above, the mirroring method applied to the first bridge provided in this application embodiment, if the first packet received by the first bridge meets the mirroring conditions, obtains the packet ownership identifier including the port identifier or VNI of the first packet, thus realizing control over the operation of obtaining the packet ownership identifier; and, at least based on the packet ownership identifier and the first packet, determines the second packet, so that the second packet can not only contain the first packet, but also carry the packet ownership identifier of the first packet, thereby improving the comprehensiveness and integrity of the data in the second packet; on this basis, the second packet is sent to the second bridge to trigger the second bridge to obtain the packet ownership identifier from the second packet. In this way, the transmission of the packet ownership identifier across bridges is realized. Since the port ownership identifier includes the port number or VNI of the first packet, through the above operations, it is possible to... This allows the port number and VNI of the message to be prevented from being transmitted across bridges. On the other hand, the second bridge encapsulates the second message based on the message's ownership identifier and sends the third message to the first bridge, so that the first bridge can send the third message to the mirror destination. The third message includes the mirror message of the first message. In this way, based on the encapsulation of the second message by the second bridge, the message ownership identifier is transparently transmitted between the second bridge, the first bridge, and even the mirror destination. This provides data support for the mirror destination to distinguish the resource group or user group to which the third message belongs based on the message ownership identifier and the address identifier of the mirror source carried in the third message. This enables the mirror destination to perform targeted and accurate analysis of the above-mentioned mirror message at the resource group or user group level based on the port identifier or VNI carried by any mirror message it receives.

[0073] Having suitable and cost-effective servers is crucial for enterprise operations. As a simple, efficient, and elastically scalable computing resource, cloud server traffic mirroring is a key functionality that enterprises focus on. OVS primarily handles the cloud server's network data forwarding plane, undertaking packet forwarding functions for the virtual machines (i.e., the compute nodes where the cloud servers reside). The Data Plane Development Kit (DPDK) is a high-performance packet processing acceleration software library. OVS accelerated with DPDK can directly bypass the kernel-mode data path, thereby accelerating packet processing speeds for physical network cards and virtual network interfaces. The technical solution provided in this application mirrors cloud server port traffic to the destination node based on OVS-DPDK.

[0074] Based on the foregoing embodiments, the mirroring method applied to the first bridge provided in this application, which determines the second packet based at least on the packet owner identifier and the first packet, can be implemented in the following ways:

[0075] Add the message ownership identifier to the first field of the first message to obtain the second message.

[0076] The first field includes the link identifier field.

[0077] In one implementation, the first field may include at least one field from the link identifier field; exemplarily, the number and specific fields of the first field may be adjusted according to user settings or DNS controller configuration; exemplarily, the first field may include a Media Access Control (MAC) field.

[0078] As can be seen from the above, in the mirroring method applied to the first bridge provided in this application embodiment, the packet ownership identifier is added to the link identifier field of the first packet to obtain the second packet. When the first field is a MAC field, the above operation can fully utilize the advantage that the data carried by the MAC field does not participate in forwarding when crossing bridges, thereby improving the stability of packet ownership identifier transmission between the first bridge and the second bridge.

[0079] Based on the above technical problems, the mirroring method applied to the first bridge provided in the embodiments of this application can also perform the following operations:

[0080] If a third message is received from the second bridge, a mirror message identifier is set for the third message.

[0081] The mirror message identifier is used to control the first bridge to directly forward the third message to the mirror destination.

[0082] In one implementation, a mirror message identifier can indicate that a third message is a mirror message.

[0083] In one implementation, if the third packet carries a mirror packet identifier, the first bridge no longer judges the third packet based on the mirror condition, and no longer performs security checks and application quality of service (QoS) policies through the first bridge. Instead, it directly sends the third packet to the mirror destination. For example, security checks can be performed through a firewall or through the access control list (ACL) of the underlay.

[0084] In one implementation, the mirror message identifier can be set by the first bridge in the metadata field of the third message.

[0085] Figure 2 This is a schematic diagram illustrating the process of sending a mirror message to a mirror destination, as provided in an embodiment of this application. Figure 2 As shown, the process may include the following steps:

[0086] Step 201: Raw flow tunnel encapsulation.

[0087] For example, the original traffic may include a set of first packets that meet the mirroring conditions; for example, the third packet may be obtained by tunneling the packets in the original traffic by the second bridge.

[0088] Step 202: Re-inject the encapsulated image message into the br-int bridge and mark it with metadata.

[0089] For example, the encapsulated image message may include a third message, and marking the metadata in the action may include setting the image message identifier in the metadata.

[0090] Step 203: Identify metadata tags.

[0091] For example, metadata tags can be identified through security groups, firewalls, and underlay ACLs in the first bridge.

[0092] Step 204: Determine if it is a mirror message.

[0093] For example, if a mirror packet identifier is set in the metadata, it means that the current packet is a mirror packet, and step 205 can be executed. If a mirror packet identifier is not set in the metadata, the current packet is not a mirror packet, and step 206 can be executed.

[0094] Step 205: Skip the security group module.

[0095] For example, the current message can be directly forwarded to the mirror destination.

[0096] Step 206: Normal business testing.

[0097] For example, security service checks can be performed on the current message through the security module.

[0098] The above process enables efficient forwarding of mirrored packets and reduces the waste of data processing and bandwidth resources caused by security checks on mirrored packets.

[0099] As can be seen from the above, the mirroring method applied to the first bridge provided in this application, if a third message is received from the second bridge, sets a mirror message identifier for the third message to control the first bridge to directly forward the third message to the mirror destination. This not only reduces the consumption of data processing resources on the first bridge but also improves the transmission efficiency of the third message.

[0100] Figure 3 This is a flowchart illustrating the mirroring method applied to the second bridge provided in an embodiment of this application, as shown below. Figure 3 As shown, the method may include the following steps:

[0101] Step 301: Receive the second message sent by the first bridge.

[0102] The second message is determined by the first message after it is determined that the first message meets the mirroring conditions, based at least on the message ownership identifier of the first message and the first message itself; the message ownership identifier includes the port identifier or VNI of the first message.

[0103] Step 302: Obtain the message ownership identifier from the second message.

[0104] Step 303: Encapsulate the second message based on the message owner identifier to obtain the third message, and send the third message to the first bridge to trigger the first bridge to send the third message to the mirror destination.

[0105] The third message includes a mirror message of the first message; a message owner identifier and an address identifier of the mirror source carried in the third message, which are used to distinguish the third message for the mirror destination.

[0106] As can be seen from the above, the mirroring method applied to the second bridge provided in this application embodiment involves the second bridge receiving a second message sent by the first bridge and obtaining a message ownership identifier (VNI) from the second message to represent the port identifier or VNI of the first message. This allows the second bridge to obtain the port identifier or VNI of the first message corresponding to the second message, thus achieving stable transparent transmission of the message ownership identifier between the first and second bridges. Furthermore, the second message is encapsulated based on the message ownership identifier to obtain and send a third message to the first bridge, triggering the first bridge to send the third message to the mirroring destination. This achieves stable transparent transmission of the message ownership identifier and the third message between the second bridge and the mirroring destination via the first bridge. Based on this, the mirroring destination can distinguish the resource group or user group to which the third message belongs based on the message ownership identifier and the address identifier of the mirror source, thus providing data support for the mirroring destination to perform targeted isolation analysis of the received mirrored messages based on resource groups or user groups.

[0107] Based on the foregoing embodiments, the mirroring method applied to the second bridge provided in this application, which obtains the packet ownership identifier from the second packet, can be implemented in the following ways:

[0108] Obtain the message ownership identifier from the first field of the second message.

[0109] The first field includes the link identifier field.

[0110] For example, the first field may include a MAC field.

[0111] As can be seen from the above, the mirroring method applied to the second bridge provided in this application embodiment obtains the packet ownership identifier from the first field of the second packet, and the second field includes a link identifier field. In this way, the first field can be stably transmitted along with the second packet, thereby solving the technical problem in related technologies where data related to virtual network isolation, such as port numbers, cannot be transparently transmitted to the bridge.

[0112] Based on the foregoing embodiments, the mirroring method applied to the second bridge provided in this application, which encapsulates the second packet based on the packet ownership identifier to obtain the third packet, can be implemented in the following way:

[0113] The second message is encapsulated based on a pre-defined encapsulation protocol to obtain the encapsulated message; the message ownership identifier is set in the second field of the encapsulated message to obtain the third message.

[0114] The second field includes the IP header control field.

[0115] For example, taking the above encapsulation operation as tunnel encapsulation, the MAC address of the outer tunnel header link layer cannot be specified during the tunnel encapsulation process. However, the tunnel header link layer can be transmitted across bridges. Therefore, the packet attribution field can be set in the second field.

[0116] As can be seen from the above, in the mirroring method applied to the second bridge provided in this application embodiment, the second message is encapsulated based on a pre-set encapsulation protocol to obtain the encapsulated message. In this way, the encapsulated message can achieve the transmission range corresponding to the pre-set encapsulation protocol. Furthermore, the message ownership identifier is set in the second field of the encapsulated message to obtain the third message. The second field includes the IP header control field. In this way, the stability of the message ownership identifier being transparently transmitted across the second bridge and the first bridge can be improved, thereby improving the stability of obtaining the message ownership identifier for the mirroring purpose.

[0117] Based on the foregoing embodiments, the mirroring method for the second bridge provided in this application, which encapsulates the second packet based on the packet ownership identifier to obtain the third packet, can be implemented in the following way:

[0118] Obtain the payload data volume of the first payload in the second message; process the first payload based on the payload data volume to obtain the second payload; encapsulate the second message carrying the second payload based on the message home identifier to obtain the third message.

[0119] The first payload includes the payload data carried by the second message.

[0120] In one implementation, the first payload may include the payload of the second message; for example, the first payload may include the payload carried in the second message.

[0121] In one implementation, the amount of load data may include the size of the data amount of the first load.

[0122] In one implementation, the amount of data in the second payload may be different from the amount of data in the payload.

[0123] In one implementation, the second load can be achieved in the following way:

[0124] The encoding method is determined based on the amount of payload data, and then the first payload is encoded based on the encoding method to obtain the second payload. For example, the encoding method may include compression encoding or extended encoding, which can be used to adjust the amount of payload data.

[0125] In one implementation, the third message can be achieved in the following way:

[0126] The first payload in the second message is replaced by the second payload to obtain the second field after the payload is updated. Then, the second message after the payload is updated is encapsulated according to the pre-set encapsulation protocol. Finally, the message ownership identifier is set in the encapsulated second message after the payload is updated to obtain the third message.

[0127] In actual mirrored streaming scenarios, the focus is usually on whether the message was sent successfully, rather than on the payload carried by the message.

[0128] The mirroring method for the second bridge provided in this application obtains the payload data of the first payload in the second message, processes the first payload based on the payload data to obtain the second payload, and realizes targeted processing of the payload carried by the message to be mirrored; and, based on the message ownership identifier, at least the second message carrying the second payload is encapsulated to obtain the third message. In this way, the message ownership identifier can be carried and transparently transmitted while processing the payload data of the mirrored message.

[0129] Based on the foregoing embodiments, the mirroring method applied to the second bridge provided in this application, which processes the first load based on the load data volume to obtain the second load, can be implemented in the following way:

[0130] If the amount of load data is greater than or equal to the first threshold, the first load is truncated based on the first threshold to obtain the second load; if the amount of load data is less than the second threshold, the first load is padded based on the amount of load data and the second threshold to obtain the second load.

[0131] In one implementation, the first threshold may be greater than the second threshold. For example, the first threshold may be determined based on the network's Maximum Transmission Unit (MTU). For example, taking tunnel encapsulation as an example, the length of the encapsulated tunnel is 50 bytes. In order to reduce the probability of packet loss during mirror packet transmission, the sum of the length of the packet before encapsulation (i.e., the second packet) and the tunnel length may be configured to be less than the link's MTU. Therefore, according to this principle, the maximum mirror packet length, i.e., the first threshold, may be determined by the difference between the minimum value of the link's MTU and 50 bytes.

[0132] In one implementation, the second threshold can be 14.

[0133] In one implementation, if the amount of load data is greater than a first threshold, the loads in the first load that are greater than the first threshold can be removed to obtain the second load.

[0134] In one implementation, if the payload data volume is less than the second threshold, the first payload can be padded based on a preset value so that the data volume of the second payload can be the second threshold. For example, the preset value can be configured by SDN or by the user, such as 0.

[0135] In one implementation, if the payload data volume is greater than or equal to the second threshold and less than the first threshold, the first payload can be kept unchanged. In this case, the second message can be encapsulated using the method provided in the aforementioned embodiments.

[0136] For example, the process of processing the first load to obtain the second load described above can be implemented using the following code:

[0137] pkg_len = User-configured image packet length

[0138] link_mtu = minimum link MTU

[0139] if (pkg_len<14) {

[0140] pkg_len=14

[0141] } else if (pkg_len>link_len - 50) {

[0142] pkg_len=link_len-50

[0143] }

[0144] For example, after processing the first payload to obtain the second payload, encapsulating the second message, and setting the message ownership identifier, a TRUNC operation on the third message can be triggered, with the following code configuration:

[0145] actions=xxxx,output(port=VXLAN-mirror,max_len=${user-defined maximum packet length})

[0146] In real-world data mirroring scenarios, some scenarios impose length limitations on mirrored packets. For example, in certain scenarios, the analysis software configured in the mirror destination can only analyze mirrored packets with a length less than a certain value.

[0147] The technical solution provided in this application embodiment allows for the following: if the payload data volume is greater than or equal to a first threshold, the first payload is truncated based on the first threshold to obtain a second payload; or if the payload data volume is less than the second threshold, the first payload is padded based on the payload data volume and the second threshold to obtain a second payload. This achieves flexible and precise configuration of the first payload data volume, thereby not only reducing the bandwidth consumption and requirements of the third message, but also flexibly meeting the processing needs of mirrored messages of different lengths, and satisfying the message mirroring processing needs in scenarios with high bandwidth costs or where message payload is a primary concern.

[0148] Figure 4 This application provides a schematic diagram of a structure for performing mirroring processing through two bridges, as shown in the embodiment. Figure 4 As shown, this structure can be implemented using br-int 401 and br-mirror 402; where br-int 401 can be the first bridge and br-mirror 402 can be the second bridge.

[0149] For example, a br-mirror 402 can be created using the following code:

[0150] # Create br-mirror

[0151] ovs-vsctl --no-wait --may-exist add-br br-mirror \

[0152] -- set bridge br-mirror datapath_type=netdev \

[0153] -- set bridge br-mirror fail-mode=secure \

[0154] -- set bridge br-mirror other_config:hwaddr=fa:ff:ff:ff:ff:ff \

[0155] -- set bridge br-mirror protocols='OpenFlow10,OpenFlow11,OpenFlow12,

[0156] OpenFlow13,OpenFlow14,OpenFlow15'

[0157] # Configure IP

[0158] ifconfig br-mirror ${MIRROR_LOCAL_IP} / 24 up

[0159] # Add route

[0160] ovs-appctl ovs / route / add ${MIRROR_LOCAL_IP} br-mirror

[0161] # Create VXLAN interface

[0162] ovs-vsctl add-port br-mirror VXLAN-mirror \

[0163] -- set interface VXLAN-mirror type=VXLAN options:csum=false \

[0164] options:local_ip=flow options:remote_ip=flow options:ttl=flowoptions:tos=flow \

[0165] options:in_key=flow options:out_key=flow options:dst_port=4789

[0166] # Create patch

[0167] ovs-vsctl add-port br-mirror patch-mirror \

[0168] -- set interface patch-mirror type=patch options:peer=patch-int \

[0169] -- add-port br-int patch-int \

[0170] -- set interface patch-int type=patch options:peer=patch-mirror

[0171] For example, in the outbound direction of the message, if vhu-port receives the first message and the first message meets the mirroring conditions, it can obtain the port number of the first message, set the port number in the MAC field of the first message to obtain the second message, and then send the second message to br-mirror through patch-port via Engress Table-Mirror.

[0172] For example, after receiving the second message, br-mirror can obtain the message ownership identifier from the first field of the second message, encapsulate the second message based on the received flow table entry, obtain the encapsulated message, set the message ownership identifier in the second field of the encapsulated message, obtain the third message, and send it to br-int via local-port and patch-port in sequence. br-int sets the mirror message identifier for the third message and sends the third message directly to the mirror destination.

[0173] For the inbound packet, if the first packet meets the mirroring conditions, the VNI can be obtained by descrambling the VXLAN header and set in the first field of the first packet to obtain the second packet. The second packet is then sent to the br-mirror via Ingress Table-Mirror.

[0174] For example, in order not to affect the normal forwarding of the business message, i.e. the first message, the flow mirroring function usually chooses to copy the first message and forward it, while the business message continues to execute the original forwarding logic. To solve the above problem, the timing of the mirroring operation can be selected based on the OVS implementation logic of OpenFlow, thus bypassing the above message copying behavior.

[0175] Specifically, for the inbound packet direction, the encapsulation of the tunnel header may trigger packet copying. Whether packet copying is performed depends on whether the action of encapsulating the tunnel header is the last action. If the action of encapsulating the tunnel header is the last action, that is, after encapsulating the tunnel header, the packet is directly forwarded through the OVS routing at Layer 3 of the underlay network without any other actions to be executed, then packet copying is not required. If the action of encapsulating the tunnel header is not the last action, then the packet needs to be copied first, then the tunnel encapsulation is performed, and then the packet is forwarded, while the original packet continues to execute the remaining actions. Based on the above principles, the embodiment of this application can place the inbound packet mirroring operation after the output operation. In this way, it is possible to achieve that if the action of encapsulating the tunnel header for the mirrored packet is the last action, then packet copying is not required.

[0176] Figure 5 This is a schematic diagram of the structure for message cross-bridge transmission provided in an embodiment of this application.

[0177] For example, for br-int 401, in the outgoing direction of a packet, the VPC to which the first packet belongs can be distinguished by the ingress port number. In the ingress direction, the VNI of the VPC network to which the first packet belongs can be obtained by decapsulating the VXLAN header. However, packet ownership information such as the port number and VNI cannot be transmitted across bridges with the packet. Figure 5 As shown, the transmission process from the first message to the third message may include a first bridge crossing and a second bridge crossing; the first bridge crossing may include transmission from br-int 401 to br-mirror 402, and the second bridge crossing may include transmission from br-mirror to br-int 401.

[0178] In this embodiment of the application, the packet ownership identifier needs to be carried in both of the above two bridge crossing processes. Therefore, in order to ensure the stability of the packet ownership identifier transmission in the above two bridge crossing processes, the field used to carry the packet ownership identifier needs to meet the following conditions: it should not affect the normal forwarding of the mirrored packet, and it should also be able to be directly matched and configured through the OpenFlow flow table.

[0179] Furthermore, during the two bridge crossings mentioned above, the second message was in its original service message form during the first bridge crossing, while the third message was in its tunnel message form after encapsulating the tunnel header during the second bridge crossing. This necessitates configuring different fields for the two message forms to carry the message ownership identifier; specifically, for the second message, the message ownership identifier can be set in the first field, and for the third message, it can be set in the second field.

[0180] The following is a code example for encapsulating the tunnel header. In this code, `set_field:${MIRROR_LOCAL_IP}->tun_dst` sets the IP address of the br-mirror bridge to the destination address of the tunnel header IP layer in the third packet. This allows the third packet to be re-injected into the br-int bridge via routing. The TTL and TOS fields allow the mirroring session identifier to be stored in the third packet. The following are code examples for setting up mirrored traffic in both outbound and inbound directions:

[0181] # Outbound mirrored traffic

[0182] table=0,in_port=patch-mirror,dl_dst=${id_mac},actions=set_field:${sip}->tun_src,set_field:${MIRROR_LOCAL_IP}->tun_ds t,set_field:${VNI}->tun_id,set_field:${ttl}->tun_ttl,set_field:${tos}->tun_tos,output(port=VXLAN-mirror,max_len=1014)

[0183] # Inbound Mirrored Traffic

[0184] table=0,in_port=patch-mirror,dl_src=${id_mac},ip,nw_dst=${sip},actions=set_field:${sip}->tun_src,set_field:${MIRROR_LOCAL_IP} ->tun_dst,set_field:${VNI}->tun_id,set_field:${ttl}->tun_ttl,set_field:${tos}->tun_tos,output(port=VXLAN-mirror,max_len=1014)

[0185] For example, after completing the above operations, the destination IP of the third packet can be corrected to the mirror destination IP, and then re-injected into br-int via patch-mirror to complete the forwarding; specifically, the above operations can be implemented using the following code:

[0186] # br-mirror flow table

[0187] table=1,in_port=LOCAL,,nw_tos=xx,nw_ttl=xx,actions=mod_nw_dst:xxx,output:patch-mirror

[0188] For example, for br-int, the configuration of the third message can be completed through the following code, thereby improving the efficiency of sending the third message to the mirror destination.

[0189] # When mirror packets are re-injected into br-int from the br-mirror bridge via the patch port

[0190] table=0,in_port=patch, action: write_metadata:0x1 / 0x1

[0191] # Add mirrored packets to the entry points of security groups and firewalls.

[0192] table=xxx, metadata=0x80000000 / 0x80000000, action: jump to subsequent business flow table items

[0193] # If you encounter the default drop of mirrored traffic, prevent recursive mirroring.

[0194] table=xxx,priority=65000,metadata=0x80000000 / 0x80000000 actions=drop

[0195] table=xxx,priority=65000,metadata=0x80000000 / 0x80000000 actions=drop

[0196] The above methods can achieve tenant isolation of mirrored packets; and by binding mirrored packets to the packet ownership identifier, the filtering conditions only need to be matched once during the data packet mirroring process, thereby reducing the resource consumption of traffic mirroring including massive amounts of data packets.

[0197] In this embodiment of the application, the mirroring destination can distinguish mirroring traffic from different VPCs based on the mirroring session identifier and the mirroring source IP. For both types of mirroring packets, the mirroring source IP is always present in the packet, so there is no need to carry it separately.

[0198] Figure 6 The module flowchart of the mirroring method provided in the embodiments of this application is as follows:

[0199] For example, the key packet filtering module can filter packets based on the five-tuple of the original traffic and the rule priority, that is, to filter whether the first packet meets the mirroring conditions; the tunnel packet encapsulation module can encapsulate the original packet, that is, the second packet. The VNI can be set according to the requirements. Specifically, the port number or VNI can be set according to the packet inbound and outbound directions.

[0200] For example, the packet length control module can discard part of the payload as needed to control the packet length; for example, the mirror traffic marking module can mark metadata to share QoS rate limiting and bypass ACL; for example, the mirror forwarding module can forward mirror packets to mirror destinations, wherein the mirror packets can be the third packets in the aforementioned embodiments.

[0201] Specifically, the critical message filtering module, mirror traffic marking module, and mirror forwarding module can be set in the first bridge, while the tunnel message encapsulation module and message length control module can be set in the second bridge.

[0202] By classifying functions in a modular way, the coupling between the operations performed by the first and second bridges can be reduced, and the flexibility of various function combinations can be improved, thereby enhancing the stability and robustness of the mirroring method implementation process.

[0203] Based on the foregoing embodiments, this application also provides a first network bridge. Figure 7 This is a schematic diagram of the structure of the first bridge provided in an embodiment of this application, as shown below. Figure 7 As shown, the first bridge 7 may include a first processor 701 and a first memory 702; wherein, the first memory 702 stores a first computer program, and when the first computer program is executed by the first processor 701, it can implement the mirroring method applied to the first bridge as described above.

[0204] The first bridge provided in this embodiment may further include the following modules:

[0205] The first processing module is configured to, if the first packet received by the first bridge satisfies the mirroring condition, obtain the packet ownership identifier from the first packet; wherein the packet ownership identifier includes the port identifier or VNI of the first packet; and determine the second packet based at least on the packet ownership identifier and the first packet.

[0206] The first transceiver module is used to send a second message to the second bridge to trigger the second bridge to obtain the message ownership identifier from the second message, encapsulate the second message based on the message ownership identifier to obtain a third message, and send the third message to the first bridge; wherein, the third message includes a mirror message of the first message; the third message is used for the first bridge to send to the mirror destination to trigger the mirror destination to distinguish the third message based on the message ownership identifier and the address identifier of the mirror source carried by the third message.

[0207] The first processing module is used to add the packet ownership identifier to the first field of the first packet to obtain the second packet; wherein the first field includes the link identifier field.

[0208] The first processing module is also used to set a mirror message identifier for the third message if it receives a third message sent by the second bridge; wherein the mirror message identifier is used to control the first bridge to directly forward the third message to the mirror destination.

[0209] Based on the foregoing embodiments, this application also provides a second bridge. Figure 8 This is a schematic diagram of the structure of the second bridge provided in the embodiments of this application, as shown below. Figure 8 As shown, the second bridge 8 may include a second processor 801 and a second memory 802; wherein, the second memory 802 stores a second computer program, and when the second computer program is executed by the second processor 801, it can implement the mirroring method applied to the second bridge as described above.

[0210] The second bridge provided in this application embodiment may further include the following modules:

[0211] The second transceiver module is used to receive a second message sent by the first bridge; wherein the second message is determined by the first bridge after determining that the first message meets the mirroring conditions, based at least on the message owner identifier of the first message and the first message; the message owner identifier includes the port identifier or VNI of the first message;

[0212] The second processing module is used to obtain the message ownership identifier from the second message; encapsulate the second message based on the message ownership identifier to obtain the third message, and send the third message to the first bridge to trigger the first bridge to send the third message to the mirror destination; wherein, the third message includes the mirror message of the first message; the message ownership identifier and the address identifier of the mirror source carried by the third message are used for the mirror destination to distinguish the third message.

[0213] In some embodiments, the second processing module is configured to obtain the packet home identifier from the first field of the second packet; wherein the first field includes a link identifier field.

[0214] In some embodiments, the second processing module is configured to encapsulate a second message based on a pre-defined encapsulation protocol to obtain an encapsulated message; and to set a message ownership identifier in a second field of the encapsulated message to obtain a third message; wherein the second field includes an IP header control field.

[0215] In some embodiments, the second processing module is configured to obtain the payload data volume of the first payload in the second message; process the first payload based on the payload data volume to obtain the second payload; and encapsulate the second message carrying the second payload based on the message home identifier to obtain the third message; wherein the first payload includes the payload data carried by the second message.

[0216] In some embodiments, the second processing module is configured to, if the load data volume is greater than or equal to a first threshold, perform truncation processing on the first load based on the first threshold to obtain a second load; and if the load data volume is less than a second threshold, perform completion processing on the first load based on the load data volume and the second threshold to obtain a second load.

[0217] This application also provides a mirroring system. Figure 9 This is a schematic diagram of the structure of the mirror system provided in the embodiments of this application, such as... Figure 9 As shown, the mirror system 9 may include a first bridge 7, a second bridge 8, a mirror source 901, and a mirror destination 902.

[0218] Figure 10 Another schematic diagram of the mirror system provided in the embodiments of this application is shown below. Figure 10 As shown, the mirror system 9 may include br-int, br-mirror, mirror source, and mirror destination; among which, the mirror source may be set inside br-int, and the normal forwarding process may include the process of br-int forwarding service packets.

[0219] This application also provides a computer-readable storage medium storing a computer program; when the computer program is executed by a processor of an electronic device, it can implement the mirroring method as described above.

[0220] This application also provides a computer program product, which includes a computer program; when the computer program is executed by the processor of an electronic device, it can implement the mirroring method as described above.

[0221] The description of the various embodiments above tends to emphasize the differences between the various embodiments. The similarities or similarities between them can be referred to, and for the sake of brevity, they will not be repeated here.

[0222] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined to obtain new method embodiments without conflict.

[0223] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0224] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0225] It should be noted that the aforementioned computer-readable storage media can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM), etc.; or it can be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0226] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0227] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0228] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware nodes. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0229] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0230] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0231] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0232] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A mirroring method, characterized in that, The method is applied to a first network bridge; the method includes: If the first packet received by the first bridge meets the mirroring conditions, the packet ownership identifier is obtained from the first packet; wherein, the packet ownership identifier includes the port identifier of the first packet or the network identifier (VNI) of the Virtual Extended Local Area Network (VXLAN); the mirroring conditions include filtering conditions, which include a 5-tuple, rule priority, port number, and metadata. The second message is determined based at least on the message attribution identifier and the first message; The second message is sent to the second bridge to trigger the second bridge to obtain the message ownership identifier from the second message, encapsulate the second message based on the message ownership identifier to obtain a third message, and send the third message to the first bridge; wherein, the third message includes a mirror message of the first message; the third message is used for the first bridge to send to the mirror destination to trigger the mirror destination to distinguish the third message based on the message ownership identifier and the address identifier of the mirror source carried by the third message.

2. The method according to claim 1, characterized in that, The step of determining the second message based at least on the message attribution identifier and the first message includes: The message attribution identifier is added to the first field of the first message to obtain the second message; wherein, the first field includes a link identifier field.

3. The method according to claim 1 or 2, characterized in that, The method further includes: If the third message sent by the second bridge is received, a mirror message identifier is set for the third message; wherein, the mirror message identifier is used to control the first bridge to directly forward the third message to the mirror destination.

4. A mirroring method, characterized in that, The method is applied to a second network bridge, and the method includes: The first bridge receives a second message sent by the first bridge; wherein the second message is determined by the first bridge after determining that the first message meets the mirroring conditions, based at least on the message owner identifier of the first message and the first message; the message owner identifier includes the port identifier of the first message or the VNI of the VXLAN; the mirroring conditions include filtering conditions, which include a five-tuple, rule priority, port number and metadata. Obtain the message ownership identifier from the second message; The second message is encapsulated based on the message attribution identifier to obtain a third message, and the third message is sent to the first bridge to trigger the first bridge to send the third message to the mirror destination; wherein, the third message includes a mirror message of the first message; the message attribution identifier and the address identifier of the mirror source carried by the third message are used for the mirror destination to distinguish the third message.

5. The method according to claim 4, characterized in that, Obtaining the message attribution identifier from the second message includes: The message home identifier is obtained from the first field of the second message; wherein, the first field includes a link identifier field.

6. The method according to claim 4, characterized in that, The process of encapsulating a second message based on the message attribution identifier to obtain a third message includes: The second message is encapsulated based on a pre-defined encapsulation protocol to obtain the encapsulated message; The message attribution identifier is set in the second field of the encapsulated message to obtain the third message; wherein the second field includes the Internet Protocol header control field.

7. The method according to any one of claims 4 to 6, characterized in that, The process of encapsulating the second message based on the message attribution identifier to obtain the third message includes: Obtain the payload data volume of the first payload; wherein the first payload includes the payload data carried by the second message; The first load is processed based on the load data volume to obtain the second load; The third message is obtained by encapsulating a second message carrying the second payload based on the message home identifier.

8. The method according to claim 7, characterized in that, The process of processing the first load based on the load data volume to obtain the second load includes: If the amount of load data is greater than or equal to a first threshold, the first load is truncated based on the first threshold to obtain the second load. If the amount of load data is less than the second threshold, the first load is padded based on the amount of load data and the second threshold to obtain the second load.

9. A first network bridge, characterized in that, The first bridge includes a first processor and a first memory; wherein the first memory stores a first computer program; when the first computer program is executed by the first processor, it can implement the mirroring method as described in any one of claims 1 to 3.

10. A second network bridge, characterized in that, The second bridge includes a second processor and a second memory; wherein the second memory stores a second computer program; when the second computer program is executed by the second processor, it can implement the mirroring method as described in any one of claims 4 to 8.

11. A mirroring system, characterized in that, The mirroring system includes the first bridge as described in claim 9, the second bridge as described in claim 10, a mirroring source, and a mirroring destination.

12. A computer-readable storage medium, characterized in that, The storage medium stores a computer program; when the computer program is executed by the processor of the electronic device, it is able to implement the mirroring method as described in any one of claims 1 to 3 or 4 to 8.

13. A computer program product, characterized in that, The program product includes a computer program; when the computer program is executed by the processor of an electronic device, it is capable of implementing the mirroring method as described in any one of claims 1 to 3 or 4 to 8.

Images