Network traffic monitoring function test method and device based on message sampling, equipment and storage medium

Abstract

The invention discloses a network flow monitoring function test method, device and equipment based on message sampling and a storage medium, and relates to the technical field of network flow monitoring, and the method comprises the steps: generating flow configuration and mirror image configuration based on preset parameters, sending the flow configuration to a test instrument, and sending the mirror image configuration to a switch; receiving a first sampling message set returned by the test instrument and a second sampling message set returned by the switch; performing format, content and time three-dimensional analysis on the first sampling message set and the second sampling message set in parallel to obtain a comprehensive verification result; and comparing the comprehensive verification result with a preset baseline rule base to obtain a test result, completing flow injection and mirror image copying through one-time synchronous configuration, and realizing full-process automation, full scene coverage and zero manual intervention of message verification of the network flow monitoring function test based on three-dimensional closed-loop verification of a dual-channel sampling message.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network flow monitoring, and particularly relates to a network flow monitoring function test method and device based on packet sampling, equipment and a storage medium. BACKGROUND

[0002] Currently, the test of network flow monitoring technology (sflow) based on packet sampling mostly depends on manual test. Manual test is usually that a tester uses some basic network tools, such as packet capture software and sflow collector equipment, to view and test network devices one by one.

[0003] Manual test needs the tester to invest a lot of time and energy, and manual operation is prone to errors, resulting in inaccurate test results. Moreover, for some complex network scenarios and traffic patterns, it is difficult for manual operation to comprehensively and accurately monitor and analyze. Due to the complexity and workload of the test, it is difficult to comprehensively test all possible network scenarios and traffic conditions, so that some potential problems cannot be discovered in time. In the case of the continuous change of network environment, the existing test method is difficult to test whether the network flow condition is monitored in time, and the source of abnormal flow and attack flow cannot be discovered in time.

[0004] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide a network flow monitoring function test method and device based on packet sampling, equipment and a storage medium, aiming at solving the technical problem of how to improve the automation degree and verification reliability of network flow monitoring test.

[0006] To achieve the above purpose, the present application provides a network flow monitoring function test method based on packet sampling, which comprises the following steps:

[0007] Generating a flow configuration and a mirror configuration based on preset parameters, sending the flow configuration to a test instrument to make the test instrument inject flow to a measured port, and sending the mirror configuration to a switch to make the switch copy the flow of the measured port to a mirror port to start a sampling agent;

[0008] Receiving a first set of sampling packets returned by the test instrument and a second set of sampling packets returned by the switch;

[0009] Performing format, content and time three-dimensional analysis on the first set of sampling packets and the second set of sampling packets in parallel to obtain a comprehensive verification result;

[0010] The comprehensive verification result is compared with a preset baseline rule library to obtain a test result.

[0011] In an embodiment, the step of generating the traffic configuration and the mirror configuration based on the preset parameters comprises:

[0012] A rate field, a protocol field and a duration field in the preset parameters are read, and the rate field, the protocol field and the duration field are encapsulated to obtain the traffic configuration.

[0013] The mirror configuration is generated according to the measured port identifier and the mirror port identifier, and the traffic configuration and the mirror configuration are written into a same configuration frame.

[0014] In an embodiment, the step of sending the traffic configuration to the test instrument to enable the test instrument to inject traffic into the measured port comprises:

[0015] The traffic configuration is serialized into a first instruction frame and sent to the test instrument through a first communication channel;

[0016] A first confirmation frame returned by the test instrument is received and a traffic injection start time is recorded;

[0017] A timer is started based on the traffic injection start time, and a traffic injection state frame is received;

[0018] When the timer reaches a preset duration, the timer is stopped and traffic injection records are counted.

[0019] In an embodiment, the step of sending the mirror configuration to the switch to enable the switch to copy traffic of the measured port to the mirror port to start a sampling agent comprises:

[0020] The mirror configuration is serialized into a second instruction frame and sent to the switch through a management channel;

[0021] A second confirmation frame returned by the switch is received and a configuration effective time is recorded;

[0022] Consistency between a sampling agent start time and the configuration effective time is verified based on the configuration effective time;

[0023] When the consistency is satisfied, a mirror link establishment completion identifier is recorded.

[0024] In an embodiment, the step of receiving the first sampling message set returned by the test instrument and the second sampling message set returned by the switch comprises:

[0025] A first listening port is opened to receive the first sampling message set uploaded by the test instrument;

[0026] opening a second monitoring port to receive a second sample packet set uploaded by the switch;

[0027] appending a first timestamp to each packet in the first sample packet set and appending a second timestamp to each packet in the second sample packet set;

[0028] merging the first sample packet set with the appended first timestamp and the second sample packet set with the appended second timestamp and writing into a cache queue;

[0029] generating a sample sequence number based on the writing order of the cache queue and associating the sample sequence number to each packet.

[0030] In an embodiment, the step of performing parallel format, content and time three-dimensional resolution on the first sample packet set and the second sample packet set to obtain a comprehensive verification result comprises:

[0031] extracting the first sample packet set and the second sample packet set from the cache queue;

[0032] resolving a header field of each packet and comparing the header field with a preset format template to obtain format verification information;

[0033] calculating a load entropy value of each packet and performing difference operation on the load entropy value and an original flow entropy value to obtain content verification information;

[0034] calculating a timestamp difference value of adjacent packets and comparing the timestamp difference value with a preset jitter threshold to obtain time verification information;

[0035] encapsulating the format verification information, the content verification information and the time verification information to obtain the comprehensive verification result.

[0036] In an embodiment, the step of comparing the comprehensive verification result with a preset baseline rule library to obtain a test result comprises:

[0037] matching each index in the comprehensive verification result with an abnormal rule in the preset baseline rule library;

[0038] when any index and the abnormal rule match successfully, marking an abnormal entry and accumulating an abnormal count;

[0039] comparing the abnormal count with a preset tolerance threshold to generate an abnormal report;

[0040] merging the abnormal report with a test result field to obtain the test result.

[0041] In addition, to achieve the above object, the application further provides a network traffic monitoring function testing device based on packet sampling, which comprises:

[0042] A configuration module is configured to generate a traffic configuration and a mirror configuration based on preset parameters, send the traffic configuration to a test instrument to make the test instrument inject traffic to a measured port, and send the mirror configuration to a switch to make the switch copy traffic of the measured port to a mirror port to start a sampling agent;

[0043] A packet receiving module is configured to receive a first set of sampling packets returned by the test instrument and a second set of sampling packets returned by the switch;

[0044] An analysis module is configured to perform three-dimensional analysis of format, content and time on the first set of sampling packets and the second set of sampling packets in parallel to obtain a comprehensive checking result;

[0045] A comparison module is configured to compare the comprehensive checking result with a preset baseline rule library to obtain a test result.

[0046] In addition, to achieve the above object, the application further provides a network traffic monitoring function testing device based on packet sampling, which comprises a memory, a processor and a network traffic monitoring function testing program based on packet sampling stored in the memory and executable on the processor, wherein the network traffic monitoring function testing program based on packet sampling is configured to implement the steps of the network traffic monitoring function testing method based on packet sampling as described above.

[0047] In addition, to achieve the above object, the application further provides a storage medium, wherein the storage medium stores a network traffic monitoring function testing program based on packet sampling, and the network traffic monitoring function testing program based on packet sampling implements the steps of the network traffic monitoring function testing method based on packet sampling as described above when executed by a processor.

[0048] In addition, to achieve the above object, the application further provides a computer program product, wherein the computer program product comprises a computer program, and the computer program implements the steps of the network traffic monitoring function testing method based on packet sampling as described above when executed by a processor.

[0049] The one or more technical solutions provided by the application have at least the following technical effects:

[0050] By synchronously generating a traffic configuration and a mirror configuration first, and then collecting and cross- verifying two sets of sampling packets in three dimensions in parallel, the system automatically completes traffic application, mirror copying, packet analysis and abnormality comparison, the test period is shortened, the abnormality detection rate is improved, and the automation and reliability of network traffic monitoring testing are improved. Attached Figure Description

[0051] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a flowchart illustrating an embodiment of the network traffic monitoring function test method based on packet sampling provided in this application.

[0054] Figure 2 This is a structural block diagram provided for Embodiment 2 of the network traffic monitoring function test method based on message sampling in this application;

[0055] Figure 3 This is a flowchart illustrating Embodiment 2 of the network traffic monitoring function test method based on packet sampling in this application;

[0056] Figure 4 This is a schematic diagram of the module structure of the network traffic monitoring function test device based on packet sampling according to an embodiment of this application;

[0057] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the network traffic monitoring function test method based on packet sampling in the embodiments of this application.

[0058] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0059] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0060] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0061] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions, such as a network traffic monitoring function testing device based on packet sampling. The following description uses a network traffic monitoring function testing device based on packet sampling as an example to illustrate this embodiment and the subsequent embodiments.

[0062] Based on this, the embodiment of the application provides a network traffic monitoring function test method based on packet sampling. Referring to Figure 1 , Figure 1 The flowchart of the first embodiment of the network traffic monitoring function test method based on packet sampling of the application is shown in the figure.

[0063] In this embodiment, the network traffic monitoring function test method based on packet sampling comprises steps S10-S40:

[0064] Step S10, generating a traffic configuration and a mirror configuration based on preset parameters, sending the traffic configuration to a test instrument to make the test instrument inject traffic to a measured port, and sending the mirror configuration to a switch to make the switch copy the traffic of the measured port to a mirror port to start a sampling agent;

[0065] It should be understood that the overall technical architecture of the scheme comprises:

[0066] The test instrument integrates a traffic generator (simulating normal / attack traffic) + a high-precision probe (ns-level timestamp packet capture);

[0067] The switch enables sFlow Agent and configures port 1 traffic mirroring to port 2;

[0068] The control center schedules the test process, runs the analysis engine and the alarm rule library.

[0069] The first network port of the test instrument is connected to the first network port of the switch, and the second network port of the test instrument is connected to the second network port of the switch; the switch is configured with sflow agent function, and the first network port is configured to mirror to the second network port

[0070] It should be noted that the preset parameters refer to a set of static or semi-static information stored in the test system before the test starts, which is used to describe the characteristics of the network traffic to be tested and the requirements of the test environment. The content usually covers traffic rate, protocol type, test duration, port mapping relationship, etc., aiming to provide a unique basis for subsequent automated configuration.

[0071] The traffic configuration is a set of instructions generated according to the preset parameters, which can be directly parsed and executed by the test instrument. The configuration exists in the form of structured packets or scripts, which is used to tell the test instrument "which port, which protocol, and at what rate" to send test traffic.

[0072] The mirror configuration is another set of instructions derived from the same set of preset parameters, which is used to guide the switch to copy all data frames appearing on the measured port and forward them to the mirror port, and at the same time activate the built-in packet sampling agent function of the switch, so as to capture and count later.

[0073] Test instrument refers to a special hardware or virtual device with programmable traffic generation and high-precision packet capture capability. It is interconnected with the network device under test through a standard network interface, can continuously output test traffic according to the received traffic configuration, and returns the captured packets to the test control center.

[0074] Port under test refers to a physical or logical port on the switch that actually carries the traffic to be tested. The traffic generated by the test instrument first enters this port.

[0075] Switch refers to a network switching device with functions such as packet forwarding, mirroring, and sampling. Its internal firmware or software can parse the mirror configuration and complete traffic replication and sampling agent startup accordingly.

[0076] Mirror port refers to a port designated in the mirror configuration for receiving replicated traffic from the port under test. This port is connected to the listening port of the test control center or test instrument, ensuring that the replicated traffic can be captured subsequently.

[0077] Sampling agent refers to a functional module inside the switch, responsible for sampling, encapsulating, and actively reporting packets on the port under test or mirror port at a specified period or buffer threshold.

[0078] As shown in Figure 2 , the test instrument constructs a normal scenario, sends a certain rate of Layer 2 / 3 packets to the switch through the first network port, the switch receives the packets, periodically collects interface statistics, encapsulates and sends to sflow collector (first network port), the test instrument outputs the collected values of sflow collector and compares them with the expected results of the scenario, runs the analysis engine to determine whether the time and results are the same, and outputs part of the test results;

[0079] The second network port of the test instrument monitors the packets sent by the first network port, captures packets with ns-level timestamps, analyzes whether the sflow packets are normal, and whether the preconfigured periodic sflow packets are sent, and integrates and outputs the test results as above;

[0080] The test instrument constructs an abnormal scenario, sends non-linear burst rate Layer 2 / 3 packets to the switch through the first network port, the switch receives the packets, accumulates them to the upper limit of the buffer area, and immediately encapsulates and sends to sflow collector (first network port), the test instrument outputs the collected values of sflow collector and compares them with the expected results of the scenario, runs the analysis engine to determine whether the time and results are the same, and outputs part of the test results;

[0081] The second network port of the test instrument monitors the packets sent by the first network port, captures packets with ns-level timestamps, analyzes whether the sflow packets are normal, and whether the preconfigured periodic sflow packets are sent, and integrates and outputs the test results as above;

[0082] The random structure Counter sampling + Sflow sampling scene is verified for a long time, and the stable environment and burst scene and the sending exception message verify whether the sflow result is normal;

[0083] In a possible implementation, the step S10 comprises steps A11-A13:

[0084] A11: reading the rate field, the protocol field and the duration field in the preset parameter, encapsulating the rate field, the protocol field and the duration field to obtain the traffic configuration;

[0085] It should be noted that the rate field, the protocol field and the duration field respectively represent three basic attributes of the sending rate of the traffic, the network protocol type and the test duration. After reading these fields, the system can uniquely determine the traffic form.

[0086] The encapsulation refers to the process of packing the above fields into an internal object or frame format according to a predetermined data structure, so as to obtain a complete traffic configuration.

[0087] A12: generating a mirror configuration according to the measured port identifier and the mirror port identifier, and writing the traffic configuration and the mirror configuration into the same configuration frame.

[0088] It should be noted that the measured port identifier refers to a number or name used to uniquely identify the measured port, so as to ensure that the mirror configuration accurately points to the port.

[0089] The mirror port identifier refers to a number or name used to uniquely identify the mirror port, so as to ensure that the copied traffic is accurately delivered.

[0090] The same configuration frame refers to a single control message formed by merging the traffic configuration and the mirror configuration, so as to reduce the configuration delay and ensure that the two configurations are synchronized to take effect.

[0091] In a possible implementation, the step S10 further comprises steps A13-A110:

[0092] A13: serializing the traffic configuration into a first instruction frame and sending it to the test instrument through a first communication channel;

[0093] It should be noted that the first instruction frame refers to a binary or text frame obtained by serializing the traffic configuration, which can be transmitted on the first communication channel.

[0094] The first communication channel refers to a special management link between the test control center and the test instrument, which is used to issue traffic control instructions and receive state feedback.

[0095] A14: receiving the first confirmation frame returned by the test instrument and recording the traffic injection starting time;

[0096] It should be noted that the first confirmation frame refers to the confirmation message sent back to the test control center by the test instrument after successfully receiving and parsing the first instruction frame, used to prove that the configuration has taken effect.

[0097] The flow injection start time refers to the time when the first confirmation frame arrives at the test control center, used as a reference for subsequent timing and synchronization.

[0098] A15: Start the timer based on the flow injection start time and receive the flow injection status frame;

[0099] It should be noted that the timer refers to a timer maintained by software or hardware, used to continuously monitor the duration of flow injection.

[0100] The flow injection status frame refers to the status message periodically sent by the test instrument to the test control center, used to report that the current flow is still being injected.

[0101] A16: Stop the timer and count the flow injection record when the timer reaches the preset duration;

[0102] It should be noted that the flow injection record refers to the summary information of the injected flow when the timer stops, usually including the actual duration, message count, etc., used for subsequent verification.

[0103] A17: Serialize the mirror configuration into a second instruction frame and send it to the switch through the management channel;

[0104] It should be noted that the second instruction frame refers to the control frame obtained after the mirror configuration is serialized, which can be transmitted on the management channel.

[0105] The management channel refers to the dedicated management link between the test control center and the switch, used to issue mirror, sampling and other control instructions.

[0106] A18: Receive the second confirmation frame returned by the switch and record the configuration effective time;

[0107] It should be noted that the second confirmation frame refers to the confirmation message sent back by the switch after successfully receiving and parsing the second instruction frame, used to prove that the mirror and sampling agent are ready.

[0108] The configuration effective time refers to the time when the second confirmation frame arrives, used as a time reference for subsequent synchronization checks.

[0109] A19: Verify the consistency of the sampling agent start time and the configuration effective time based on the configuration effective time;

[0110] It should be noted that the sampling agent start time refers to the time when the internal sampling agent of the switch actually starts working, which can be verified for synchronization accuracy by comparing it with the configuration effective time.

[0111] A110: record the mirror link establishment completion identifier when the consistency is met.

[0112] It should be noted that the mirror link establishment completion identifier refers to a flag bit or a log entry generated after the synchronization verification is successful, which is used to inform the subsequent steps that the mirror link has been reliably established.

[0113] Step S20, receiving the first sample message set returned by the test instrument and the second sample message set returned by the switch;

[0114] It should be noted that the first sample message set refers to the complete message sequence captured by the test instrument at the mirror port and returned.

[0115] The second sample message set refers to the sampled and encapsulated message sequence actively reported by the sampling agent of the switch.

[0116] In a feasible implementation, step S20 includes steps A21-A25:

[0117] A21: start the first monitoring port to receive the first sample message set uploaded by the test instrument;

[0118] It should be noted that the first monitoring port refers to an interface on the test control center or the test instrument that is specially used to receive the first sample message set.

[0119] A22: start the second monitoring port to receive the second sample message set uploaded by the switch;

[0120] It should be noted that the second monitoring port refers to an interface on the test control center or the test instrument that is specially used to receive the second sample message set.

[0121] A23: attach a first timestamp to each message of the first sample message set, and attach a second timestamp to each message of the second sample message set;

[0122] It should be noted that the first timestamp refers to a capture time mark attached to each message in the first sample message set.

[0123] The second timestamp refers to a reporting time mark attached to each message in the second sample message set.

[0124] A24: merge and write the first sample message set with the attached first timestamp and the second sample message set with the attached second timestamp into a cache queue;

[0125] It should be noted that the cache queue refers to a first-in-first-out storage area used to temporarily store the two groups of sample messages with attached timestamps, ensuring that the subsequent analysis order is not disordered.

[0126] A25: generating a sampling sequence number based on the write order of the cache queue and associating it to each message.

[0127] It should be noted that the sampling sequence number refers to a continuous number generated according to the write order of the cache queue, which is used to uniquely identify the position of each sampling message on the time axis.

[0128] Step S30, the format, content, time three-dimensional analysis is performed on the first sampling message set and the second sampling message set in parallel, and the comprehensive verification result is obtained;

[0129] It should be noted that the format dimension refers to the angle of checking the compliance of the structure attributes such as message header field, length, type, etc.

[0130] The content dimension refers to the angle of checking the consistency or abnormality of the data content such as the entropy value and feature field of the message payload.

[0131] The time dimension refers to the angle of checking the jitter or delay of the difference value of adjacent message timestamps.

[0132] The comprehensive verification result refers to the unified conclusion data obtained after fusing the format, content and time three checking results, which is used for final comparison.

[0133] Step S40, comparing the comprehensive verification result with the preset baseline rule library to obtain the test result.

[0134] It should be noted that the preset baseline rule library refers to a series of abnormal judgment criteria set defined and stored in advance, which is used to match with the comprehensive verification result.

[0135] In one possible implementation, step S40 includes steps A31-A34:

[0136] A31: matching each index in the comprehensive verification result with the abnormal rule in the preset baseline rule library;

[0137] It should be noted that the abnormal rule refers to a single judgment criterion in the baseline rule library, which usually describes under what conditions it should be identified as abnormal.

[0138] A32: when any index and abnormal rule match successfully, mark the abnormal item and accumulate the abnormal count;

[0139] It should be noted that the abnormal item refers to the specific index or message record that is marked as abnormal in the matching process.

[0140] The abnormal count refers to the cumulative number of abnormal items marked, which is used to measure the overall abnormality degree.

[0141] A33: comparing the abnormal count with the preset tolerance threshold to generate an abnormal report;

[0142] It should be noted that the exception report refers to a structured document generated according to the comparison between the exception count and the tolerance threshold, for detailed description of the exception distribution.

[0143] A34: merging the exception report with the test result field to obtain the test result.

[0144] It should be noted that the test result field refers to a data field for carrying the final pass / fail conclusion and additional description, which forms a complete test result after merging with the exception report.

[0145] It should be understood that the present scheme automatically closes the loop test framework, which initiates a full-chain automatic verification architecture of "traffic injection-mirror collection-in-depth analysis-exception positioning", eliminating manual intervention nodes.

[0146] The test instrument integrates the steady-state background flow (RFC6349 TCP flow model) + dynamic attack flow (based on Spirent Attack Wizard template) to realize real network environment simulation.

[0147] The present scheme synchronously checks the format compliance (Header length, sample / counter type value domain) of the three core elements of sFlow message, the content accuracy (entropy value comparison of sampled traffic and original traffic), and the time accuracy (message interval jitter detection, accuracy ±1μs).

[0148] The present scheme covers the complete life cycle test scenarios of sFlow from initialization configuration, steady-state operation, burst response to long-term stability and reliability.

[0149] The present scheme has 30+ built-in exception detection rules (such as TCP-SYN flood message proportion >80% triggering alarm), which verify the real-time performance of the monitoring system.

[0150] The control center of the present scheme can manage multiple test instruments at the same time, realizing collaborative testing of sFlow systems across machine frames / clusters.

[0151] The present embodiment provides a network traffic monitoring function test method based on message sampling, which synchronously generates traffic configuration and mirror configuration first, then collects and cross-verifies two groups of sampling messages in three dimensions in parallel, and the system automatically completes traffic application, mirror replication, message analysis and exception comparison, shortens the test period, improves the exception detection rate, and realizes the automation and reliability improvement of network traffic monitoring test.

[0152] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above embodiment one can refer to the above introduction, and the subsequent will not be repeated. On this basis, please refer to Figure 3 , step S30, comprising steps S301-S305:

[0153] Step S301, extracting a first set of sampling packets and a second set of sampling packets from a cache queue;

[0154] It should be noted that the cache queue is a temporary storage area managed according to the first-in first-out rule, used for temporarily storing two groups of timestamped sampling packets; the extraction action is to read the packets in order, so that the packets are separated from the queue and enter the subsequent analysis pipeline, while the queue space is released to avoid repeated reading.

[0155] Step S302, analyzing the header field of each packet and comparing the header field with a preset format template to obtain format verification information;

[0156] It should be noted that analysis refers to reading the packet header byte by byte to identify the fields of each protocol layer; the preset format template is a pre-fixed legal field structure reference; comparison refers to comparing the fields obtained by analysis with the template item by item; the obtained conclusion is the format verification information, which is used to describe whether the packet structure is compliant.

[0157] Step S303, calculating the load entropy value of each packet and performing difference operation on the load entropy value and the original flow entropy value to obtain content verification information;

[0158] It should be noted that the load entropy value is a randomness index obtained by calculating the information entropy of the pure data part of the packet; the original flow entropy value is the baseline randomness measured before flow injection; the difference operation subtracts the two values and takes the absolute value to quantify the degree of influence of the network device on the data content; the result is the content verification information, which is used to judge whether the content is changed.

[0159] Step S304, calculating the timestamp difference of adjacent packets and comparing the timestamp difference with a preset jitter threshold to obtain time verification information;

[0160] It should be noted that the timestamp difference refers to the interval between the capture times of two adjacent sampling packets; the preset jitter threshold is a pre-set upper limit of tolerable interval; comparison refers to judging whether the difference exceeds the threshold; the obtained conclusion is the time verification information, which is used to describe the timing stability of packet arrival.

[0161] Step S305, encapsulating the format verification information, content verification information and time verification information to obtain a comprehensive verification result.

[0162] It should be noted that encapsulation refers to combining the three discrete verification information into a single structured data unit to form a comprehensive verification result that can be directly read by the subsequent rule library, realizing centralized expression and unified transmission of three-dimensional verification conclusion.

[0163] The embodiment provides a network traffic monitoring function test method based on packet sampling, which compresses four operations of packet capturing, format checking, content comparison and timing verification into a single automatic pipeline: the cache queue ensures that the packets are in order and have no omissions; the format checking information ensures protocol compliance; the content checking information reveals load changes; the time checking information quantifies network jitter; and the three are encapsulated to form a comprehensive checking result, which can be directly used for subsequent abnormal comparison. Therefore, the network traffic monitoring function test realizes zero manual intervention, full coverage verification and efficient abnormal positioning in the analysis link, and the overall verification efficiency and accuracy are significantly improved.

[0164] It should be noted that the above examples are only used for understanding the present application and do not constitute a limitation on the network traffic monitoring function test method based on packet sampling of the present application. More forms of simple changes based on this technical concept are within the protection scope of the present application.

[0165] The present application also provides a network traffic monitoring function test device based on packet sampling, which is described with reference to Figure 4 The network traffic monitoring function test device based on packet sampling comprises:

[0166] The configuration module 10 is configured to generate a traffic configuration and a mirror configuration based on preset parameters, send the traffic configuration to a test instrument to make the test instrument inject traffic to a measured port, and send the mirror configuration to a switch to make the switch copy the traffic of the measured port to a mirror port to start a sampling agent.

[0167] The packet receiving module 20 is configured to receive a first sampling packet set returned by the test instrument and a second sampling packet set returned by the switch.

[0168] The analysis module 30 is configured to perform format, content and time three-dimensional analysis on the first sampling packet set and the second sampling packet set in parallel to obtain a comprehensive checking result.

[0169] The comparison module 40 is configured to compare the comprehensive checking result with a preset baseline rule library to obtain a test result.

[0170] The network traffic monitoring function test device based on packet sampling provided by the present application adopts the network traffic monitoring function test method based on packet sampling in the above embodiment, and can solve the technical problem of how to improve the automation degree and verification reliability of network traffic monitoring test. Compared with the prior art, the network traffic monitoring function test device based on packet sampling provided by the present application has the same beneficial effects as the network traffic monitoring function test method based on packet sampling provided by the above embodiment, and other technical features in the network traffic monitoring function test device based on packet sampling are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0171] In an embodiment, the configuration module 10 is further configured to read a rate field, a protocol field and a duration field in the preset parameter, encapsulate the rate field, the protocol field and the duration field to obtain a traffic configuration;

[0172] generate a mirror configuration according to the measured port identifier and the mirror port identifier, and write the traffic configuration and the mirror configuration into a same configuration frame.

[0173] In an embodiment, the configuration module 10 is further configured to serialize the traffic configuration into a first instruction frame and send the first instruction frame to the test instrument through a first communication channel;

[0174] receive a first confirmation frame returned by the test instrument and record a traffic injection start time;

[0175] start a timer based on the traffic injection start time and receive a traffic injection state frame;

[0176] stop the timer and count the traffic injection record when the timer reaches a preset duration.

[0177] In an embodiment, the configuration module 10 is further configured to serialize the mirror configuration into a second instruction frame and send the second instruction frame to the switch through a management channel;

[0178] receive a second confirmation frame returned by the switch and record a configuration effective time;

[0179] verify consistency between a sampling agent start time and the configuration effective time based on the configuration effective time;

[0180] record a mirror link establishment completion identifier when the consistency is satisfied.

[0181] In an embodiment, the packet receiving module 20 is further configured to start a first monitoring port to receive a first sampling packet set uploaded by the test instrument;

[0182] start a second monitoring port to receive a second sampling packet set uploaded by the switch;

[0183] attach a first timestamp to each packet in the first sampling packet set and attach a second timestamp to each packet in the second sampling packet set;

[0184] merge the first sampling packet set with the attached first timestamp and the second sampling packet set with the attached second timestamp and write the merged packet set into a cache queue;

[0185] generate a sampling serial number based on a writing order of the cache queue and associate the sampling serial number to each packet.

[0186] In an embodiment, the analysis module 30 is further configured to extract the first sampling packet set and the second sampling packet set from the cache queue;

[0187] parsing the header field of each packet and comparing the header field with a preset format template to obtain format verification information;

[0188] calculating the load entropy value of each packet and performing difference operation on the load entropy value and the original flow entropy value to obtain content verification information;

[0189] calculating the timestamp difference value of adjacent packets and comparing the timestamp difference value with a preset jitter threshold to obtain time verification information;

[0190] encapsulating the format verification information, the content verification information and the time verification information to obtain comprehensive verification results.

[0191] In an embodiment, the comparison module 40 is further configured to match each index in the comprehensive verification results with an abnormal rule in a preset baseline rule library;

[0192] When any index and abnormal rule are matched successfully, an abnormal entry is marked and an abnormal count is accumulated;

[0193] comparing the abnormal count with a preset tolerance threshold to generate an abnormal report;

[0194] merging the abnormal report with a test result field to obtain a test result.

[0195] The present application provides a network flow monitoring function test device based on packet sampling, which comprises at least one processor and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network flow monitoring function test method based on packet sampling in the above-mentioned embodiment one.

[0196] Reference will now be made to the following description Figure 5 which shows a structural schematic diagram of the network flow monitoring function test device based on packet sampling suitable for being used to implement the embodiments of the present application. The network flow monitoring function test device based on packet sampling in the embodiments of the present application can include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals) and the like, and fixed terminals such as digital TVs, desktop computers and the like. Figure 5The illustrated packet sampling based network traffic monitoring function test device is merely an example and should not be taken as limiting the functionality or use of embodiments of the application.

[0197] As shown in Figure 5 packet sampling based network traffic monitoring function test device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a ROM (Read Only Memory) 1002 or programs loaded from a storage device 1003 into a RAM (Random Access Memory) 1004. Various programs and data required for operation of the packet sampling based network traffic monitoring function test device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the packet sampling based network traffic monitoring function test device to communicate wirelessly or by wire with other devices to exchange data. Although the packet sampling based network traffic monitoring function test device having various systems is illustrated in the figure, it should be understood that all of the illustrated systems are not required to be implemented or possessed. More or fewer systems can be alternatively implemented or possessed.

[0198] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-described functions defined in the methods of embodiments of the present disclosure are performed.

[0199] The network traffic monitoring function test device based on packet sampling provided by the application adopts the network traffic monitoring function test method based on packet sampling in the above embodiment, and can solve the technical problem of how to improve the automation degree and verification reliability of network traffic monitoring test. Compared with the prior art, the network traffic monitoring function test device based on packet sampling provided by the application has the same beneficial effects as the network traffic monitoring function test method based on packet sampling provided by the above embodiment, and other technical features in the network traffic monitoring function test device based on packet sampling are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0200] It should be understood that various parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0201] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0202] The present application provides a computer readable storage medium having computer readable program instructions (i.e. computer programs) stored thereon, the computer readable program instructions being used to execute the network traffic monitoring function test method based on packet sampling in the above embodiment.

[0203] The computer readable storage medium provided in the application may be, for example, a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electrical connection with one or more conductive wires, a portable computer disk, a hard disk, a RAM (Random Access Memory), a ROM (Read Only Memory), an EPROM (Erasable Programmable Read Only Memory or flash memory), an optical fiber, a CD-ROM (CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system, or device. The program code contained in the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electrical wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination of the above.

[0204] The computer readable storage medium described above may be contained in the network traffic monitoring function test device based on packet sampling, or may exist separately and not be assembled into the network traffic monitoring function test device based on packet sampling.

[0205] The computer readable storage medium described above carries one or more programs, when the one or more programs are executed by the network traffic monitoring function test device based on packet sampling, the network traffic monitoring function test device based on packet sampling is caused to: generate a traffic configuration and a mirror configuration based on preset parameters, send the traffic configuration to a test instrument to make the test instrument inject traffic to a measured port, and send the mirror configuration to a switch to make the switch copy the traffic of the measured port to a mirror port to start a sampling agent; receive a first set of sampling packets returned by the test instrument and a second set of sampling packets returned by the switch; perform format, content, and time three-dimensional analysis on the first set of sampling packets and the second set of sampling packets in parallel to obtain a comprehensive verification result; compare the comprehensive verification result with a preset baseline rule library to obtain a test result.

[0206] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0207] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0208] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0209] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., a computer program) for executing the network traffic monitoring function test method based on packet sampling, and can solve the technical problem of how to improve the automation degree and verification reliability of network traffic monitoring test. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the network traffic monitoring function test method based on packet sampling provided by the above-mentioned embodiments, and will not be described here.

[0210] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the network traffic monitoring function test method based on packet sampling as described above.

[0211] The computer program product provided by the application can solve the technical problem of how to improve the automation degree and verification reliability of network traffic monitoring test. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the network traffic monitoring function test method based on packet sampling provided by the above-mentioned embodiments, and are not described here.

[0212] The above only describes some embodiments of the application, and does not limit the patent scope of the application. Any equivalent structural transformation, direct / indirect application in other related technical fields, or direct / indirect application in other related technical fields based on the technical concept of the application and the content of the specification and drawings are included in the patent protection scope of the application.

Claims

1. A network traffic monitoring function testing method based on packet sampling, characterized in that, The method includes: Based on preset parameters, a traffic configuration and a mirror configuration are generated. The traffic configuration is sent to the test instrument so that the test instrument injects traffic into the port under test. The mirror configuration is sent to the switch so that the switch copies the traffic of the port under test to the mirror port to start the sampling agent. Receive the first set of sampled messages returned by the test instrument and the second set of sampled messages returned by the switch; The first and second sampled message sets are analyzed in parallel using three dimensions: format, content, and time, to obtain a comprehensive verification result. The comprehensive verification result is compared with the preset baseline rule base to obtain the test result.

2. The method as described in claim 1, characterized in that, The steps for generating traffic configuration and mirroring configuration based on preset parameters include: Read the rate field, protocol field, and duration field from the preset parameters, and encapsulate the rate field, protocol field, and duration field to obtain the traffic configuration; A mirror configuration is generated based on the port identifier under test and the mirror port identifier, and the traffic configuration and the mirror configuration are written into the same configuration frame.

3. The method as described in claim 1, characterized in that, The step of sending the traffic configuration to the test instrument to enable the test instrument to inject traffic into the port under test includes: The traffic configuration is serialized into a first instruction frame and sent to the test instrument through the first communication channel; Receive the first confirmation frame returned by the test instrument and record the start time of the flow injection; A timer is started based on the start time of the traffic injection and a traffic injection status frame is received. When the timer reaches the preset duration, the timing stops and the flow injection record is recorded.

4. The method as described in claim 1, characterized in that, The step of sending the mirroring configuration to the switch so that the switch copies the traffic of the port under test to the mirror port to start the sampling agent includes: The image configuration is serialized into a second instruction frame and sent to the switch through the management channel; Receive the second confirmation frame returned by the switch and record the time when the configuration takes effect; Verify the consistency between the sampling agent startup time and the configuration effective time based on the configuration effective time; Record the image link establishment completion flag when consistency is satisfied.

5. The method as described in claim 1, characterized in that, The step of receiving the first set of sampled messages returned by the test instrument and the second set of sampled messages returned by the switch includes: Open the first listening port to receive the first set of sampling messages uploaded by the test instrument; Open the second listening port to receive the second set of sampled packets uploaded by the switch; A first timestamp is appended to each message in the first sampled message set, and a second timestamp is appended to each message in the second sampled message set; The first sampled message set with the first timestamp appended and the second sampled message set with the second timestamp appended are merged and written into the cache queue; A sampling sequence number is generated based on the writing order of the cache queue and associated with each message.

6. The method as described in claim 1, characterized in that, The step of performing parallel analysis of the format, content, and time dimensions of the first sampled message set and the second sampled message set to obtain a comprehensive verification result includes: Retrieve the first sampled message set and the second sampled message set from the cache queue; The header fields of each message are parsed and compared with a preset format template to obtain format verification information; Calculate the load entropy value of each message and perform a difference operation between the load entropy value and the original traffic entropy value to obtain content verification information; Calculate the timestamp difference between adjacent messages and compare the timestamp difference with a preset jitter threshold to obtain time verification information; The format verification information, the content verification information, and the time verification information are encapsulated to obtain a comprehensive verification result.

7. The method as described in claim 1, characterized in that, The step of comparing the comprehensive verification result with a preset baseline rule base to obtain the test result includes: The indicators in the comprehensive verification results are matched with the abnormal rules in the preset baseline rule base. When any indicator matches the aforementioned anomaly rule, the anomaly entry is marked and the anomaly count is incremented. The anomaly count is compared with a preset tolerance threshold to generate an anomaly report; The anomaly report and the test result field are merged to obtain the test result.

8. A network traffic monitoring function testing device based on packet sampling, characterized in that, The device includes: The configuration module is used to generate traffic configuration and mirror configuration based on preset parameters, send the traffic configuration to the test instrument to enable the test instrument to inject traffic into the port under test, and send the mirror configuration to the switch to enable the switch to copy the traffic of the port under test to the mirror port to start the sampling agent. The message receiving module is used to receive the first set of sampled messages returned by the test instrument and the second set of sampled messages returned by the switch; The parsing module is used to perform parallel parsing of the first sampled message set and the second sampled message set in three dimensions: format, content, and time, to obtain a comprehensive verification result; The comparison module is used to compare the comprehensive verification result with the preset baseline rule base to obtain the test result.

9. A network traffic monitoring function testing device based on packet sampling, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network traffic monitoring function test method based on packet sampling as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the network traffic monitoring function test method based on packet sampling as described in any one of claims 1 to 7.

Images