Mirror data stream distribution method, device and system, electronic equipment and storage medium

Abstract

The invention discloses a mirroring data flow distribution method, device and system, electronic equipment and a storage medium, and the method comprises the steps: receiving mirroring data flows, sent by a plurality of source switches, of network regions to which the source switches belong, integrating the received messages of the plurality of network regions into a target message carrying a target network region identifier, and the target message is flooded to a plurality of security systems in a one-way manner, so that multi-source-to-multi-destination mirror image data flow distribution can be realized, and service requirements are met. The method can be executed after a traditional switch is transformed, so that a special mirror image switch does not need to be deployed on the premise of reducing the deployment cost of a connecting line and a safety system, the purchase and operation and maintenance cost can be reduced, and the total cost is reduced.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and in particular to a mirrored data stream distribution method, apparatus, system, electronic device, and storage medium. Background Technology

[0002] Mirroring data streams refers to copying packets from network devices to a designated interface. The security system connects to this interface to analyze, monitor, and alert on the mirrored data streams, enabling secure network data management. Due to the different functions of security devices—such as Web Application Firewalls (WAFs), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), or full traffic monitoring—and the different brands of security devices, multiple security probes are typically deployed in a security system. Furthermore, to achieve comprehensive network-wide security protection, the security system needs to collect mirrored data streams from area aggregation switches in different network zones. Therefore, the security system receives mirrored data from multiple area aggregation switches, and this mirrored data also needs to be distributed to multiple security systems.

[0003] Currently, there are typically two network architectures for distributing mirrored data streams: a star-shaped full-mesh architecture, where the mirrored data stream from a single area aggregation switch is replicated to multiple destination ports on the local machine. These destination ports connect to different security devices, each corresponding to a security system, thus simultaneously distributing the local mirrored data stream to multiple security systems. The other architecture uses a dedicated mirror switch, where the mirrored data stream from the area aggregation switch is uniformly sent to a dedicated mirror switch, which then distributes it to multiple security systems. However, both of these distribution methods are relatively expensive. Summary of the Invention

[0004] This application provides a mirrored data stream distribution method, apparatus, system, electronic device, and storage medium, which can realize multi-source to multi-destination mirrored data stream distribution to meet business needs and reduce total cost.

[0005] In a first aspect, embodiments of this application provide a mirrored data stream distribution method, applied to a mirrored data stream distribution system. The mirrored data stream distribution system includes an aggregation point switch, multiple source switches, and multiple security systems. The aggregation point switch is interconnected with the multiple source switches, and the aggregation point switch is also interconnected with the multiple security systems. Different source switches are physically isolated from each other.

[0006] The method for distributing mirrored data streams includes:

[0007] The system receives mirror data streams from the multiple source switches, each representing a network area to which it belongs. The mirror data streams from different network areas carry different network area identifiers. The system integrates the received packets from the multiple network areas into a target packet carrying a target network area identifier. The system then unidirectionally floods the target packet to the multiple security systems.

[0008] Optionally, before receiving the mirrored data streams of the network areas to which each source switch belongs sent by the plurality of source switches, the method further includes: performing logical isolation and traffic isolation on the plurality of network areas.

[0009] Optionally, the logical isolation and traffic isolation of the plurality of network areas includes:

[0010] Disable the STP protocol to logically isolate the multiple network areas; enable port isolation function for interconnection with the multiple network areas to isolate traffic between the multiple network areas.

[0011] Optionally, the step of integrating received packets from multiple network regions into a target packet carrying a target network region identifier includes:

[0012] The received packets from the multiple network regions are mirrored, split, and reassembled; the traffic packet header format is standardized, and a VLAN tag is encapsulated; the VLAN ID in the VLAN tag is set as the identifier of the target network region to obtain the target packet.

[0013] Optionally, before unidirectionally flooding the target packet to the multiple security systems, the method further includes: disabling the MAC address learning function of the target packet to enable data flooding.

[0014] Secondly, this application also provides a mirrored data stream distribution device, applied to a mirrored data stream distribution system. The mirrored data stream distribution system includes an aggregation point switch, multiple source switches, and multiple security systems. The aggregation point switch is interconnected with the multiple source switches and is also interconnected with the multiple security systems. Different source switches are physically isolated from each other.

[0015] The device includes:

[0016] The receiving module is used to receive mirror data streams from the network areas to which each source switch belongs, sent by the multiple source switches. The mirror data streams from different network areas carry different network area identifiers. The message integration module is used to integrate the received messages from multiple network areas into a target message carrying a target network area identifier. The traffic flooding module is used to unidirectionally flood the target message to the multiple security systems.

[0017] Thirdly, embodiments of this application provide an electronic device, including:

[0018] One or more processors;

[0019] Memory, used to store one or more programs.

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the mirror data stream distribution method described in any embodiment of this application.

[0021] Fourthly, this application provides a mirrored data stream distribution system, including multiple source switches, multiple security systems, and a convergence point switch. The convergence point switch is interconnected with the multiple source switches and is also interconnected with the multiple security systems. Different source switches are physically isolated from each other.

[0022] The aggregation point switch is used to execute the mirrored data stream distribution method described in any embodiment of this application.

[0023] Optionally, each source switch is used to aggregate mirrored data streams from its respective network area and mark the VLAN ID in the corresponding packet as the corresponding network area identifier.

[0024] Fifthly, embodiments of this application provide a storage medium storing a computer program thereon, which, when executed by a processor, implements the mirror data stream distribution method described in any embodiment of this application.

[0025] This application proposes a method, apparatus, system, electronic device, and storage medium for mirrored data stream distribution. By receiving mirrored data streams from multiple source switches representing their respective network regions, the received packets from multiple network regions are integrated into a target packet carrying a target network region identifier. This target packet is then unidirectionally flooded to multiple security systems, enabling multi-source to multi-destination mirrored data stream distribution to meet business needs. Since this method can be implemented by modifying traditional switches, it eliminates the need for dedicated mirrored switches while reducing the deployment costs of connection cables and security systems, thus lowering procurement and maintenance costs and ultimately reducing the overall cost. Attached Figure Description

[0026] Figure 1 A schematic diagram of a mirrored data stream distribution architecture provided for existing technologies;

[0027] Figure 2 A schematic diagram of an alternative mirrored data stream distribution architecture provided by existing technology;

[0028] Figure 3This application provides a schematic diagram of the structure of a mirrored data stream distribution system according to an embodiment of the present application.

[0029] Figure 4 A flowchart illustrating a mirrored data stream distribution method provided in an embodiment of this application;

[0030] Figure 5 A schematic diagram illustrating the principle of a mirrored data stream processing procedure provided in this application embodiment;

[0031] Figure 6 A schematic diagram of a mirrored data stream distribution device provided in an embodiment of this application;

[0032] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0033] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the present application are shown in the drawings, not the entire structure.

[0034] Figure 1 A schematic diagram of a mirrored data stream distribution architecture provided for existing technologies, such as... Figure 1 As shown, the mirrored data stream distribution architecture can be a star-shaped full-mesh network architecture, including regional aggregation switches for multiple network areas and multiple security systems; wherein, each regional aggregation switch includes multiple destination ports, and each destination port connects to multiple security systems.

[0035] The mirrored data stream of each regional aggregation switch is replicated to multiple destination ports on the local machine, and each destination port distributes the mirrored data stream to multiple security systems simultaneously.

[0036] However, this network architecture requires the area aggregation switches to replicate local traffic multiple times, increasing their workload. Furthermore, the star-mesh interconnection between the area aggregation switches and the security system increases cabling costs. In addition, each security system requires the deployment of multiple security devices, each with multiple monitoring interfaces to accommodate mirrored data streams from multiple area aggregation switches or the entire network of area aggregation switches, significantly increasing the deployment cost of the security system.

[0037] To reduce the burden on area aggregation switches and lower the deployment costs of cabling and security systems, a network architecture using dedicated mirroring switches is proposed, such as... Figure 2 As shown, Figure 2This diagram illustrates an alternative mirrored data stream distribution architecture for existing technologies. The network architecture of the dedicated mirror switch includes area aggregation switches for multiple network areas, multiple security systems, and a single dedicated mirror switch. The multiple area aggregation switches are interconnected with the dedicated mirror switch, and the multiple security systems are also interconnected with the dedicated mirror switch.

[0038] The mirrored data streams from the regional aggregation switch are uniformly sent to a dedicated mirror switch, which then sends them to multiple security systems. While this approach reduces the burden on the regional aggregation switch and consequently reduces the deployment costs of connection cables and security systems, it requires the deployment of dedicated mirror switches, increasing procurement and maintenance costs.

[0039] Therefore, both star-shaped full-mesh mirrored data flow distribution architecture and dedicated mirrored switch mirrored data flow distribution architecture have the problem of high total cost.

[0040] In view of this, this application provides a mirrored data stream distribution system, including an aggregation point switch, multiple source switches, and multiple security systems. The aggregation point switch is interconnected with the multiple source switches and also interconnected with the multiple security systems, and the different source switches are physically isolated from each other. The different source switches belong to different network areas, and each source switch can aggregate mirrored data streams from its own network area and mark the VLAN ID in the corresponding packets as the corresponding network area identifier.

[0041] For example, Figure 3 This is a schematic diagram of the structure of a mirror data stream distribution system provided in an embodiment of this application, as shown below. Figure 3 As shown, the mirrored data stream distribution system includes an aggregation point switch, three source switches, and three security systems. The three source switches are source switch 1, source switch 2, and source switch 3. All three source switches are interconnected with the aggregation point switch. Source switch 1 is physically isolated from source switches 2 and 3, and source switch 2 is physically isolated from source switch 3.

[0042] If source switch 1 belongs to network area 1, then source switch 1 can aggregate mirrored data streams from network area 1 and mark the VLAN ID in the packets from network area 1 as the first network area identifier, for example, the first network area identifier is 100. If source switch 2 belongs to network area 2, source switch 2 can aggregate mirrored data streams from network area 2 and mark the VLAN ID in the packets from network area 2 as the second network area identifier, for example, the second network area identifier is 200. If source switch 3 belongs to network area 3, source switch 3 can aggregate mirrored data streams from network area 3 and mark the VLAN ID in the packets from network area 3 as the third network area identifier, for example, the third network area identifier is 300.

[0043] The three security systems are Security System 1, Security System 2, and Security System 3. All three security systems are interconnected with the aggregation point switch. Security System 1, Security System 2, and Security System 3 can receive target packets sent by the aggregation point switch.

[0044] It should be noted that, Figure 3 This example only illustrates that the mirrored data stream distribution system includes three source switches and three security systems. In practical applications, the number of source switches and security systems can be two, four, or more. This application does not impose any specific limitations on this.

[0045] In the mirrored data stream distribution system provided in this application embodiment, multiple source switches can send mirrored data streams of the network areas to which each source switch belongs, and the aggregation point switch can receive the mirrored data streams of the network areas to which each source switch belongs, integrate the received packets from multiple network areas into a target packet carrying the target network area identifier, and unidirectionally flood the target packet to multiple security systems. This enables multi-source to multi-destination mirrored data stream distribution to meet business needs. The above-mentioned functions of the aggregation point switch can be achieved by modifying traditional switches. Therefore, while reducing the deployment costs of connection cables and security systems, there is no need to deploy dedicated mirrored switches, which can reduce procurement and maintenance costs, thereby reducing the total cost.

[0046] This application also provides a mirrored data stream distribution method, which is applied to a mirrored data stream distribution system. It can be executed by a mirrored data stream distribution device or an electronic device, which can be implemented by software and / or hardware, and can be integrated into an aggregation point switch.

[0047] Figure 4 This is a flowchart illustrating a mirrored data stream distribution method provided in an embodiment of this application, as shown below. Figure 4 As shown, the specific steps of the mirrored data stream distribution method include:

[0048] S101 receives mirrored data streams from multiple source switches, representing the network areas to which each source switch belongs.

[0049] For example, each network region is an independent Layer 2 domain, physically isolated from other network regions, such as... Figure 3 As shown, network area 1, network area 2 and network area 3 are independent layer 2 domains. Network area 1 is physically isolated from network area 2 and network area 3 respectively. Network area 2 and network area 3 are physically isolated, and each layer 2 domain can only have one root.

[0050] When an aggregation switch interconnects with multiple source switches, multiple network areas become interconnected, meaning multiple Layer 2 domains are interconnected. At this point, the network will reconverge and select a new, unique root, which can lead to network fluctuations and loops. Therefore, disabling the STP protocol can logically isolate multiple Layer 2 domains, i.e., logically isolate multiple network areas.

[0051] Additionally, when mirrored data from multiple network areas reaches the aggregation switch, there is a risk of backflow. For example, ... Figure 3 As shown, the mirrored data stream from network area 1 is transmitted to network area 2 after passing through the aggregation point switch. Therefore, by enabling port isolation functionality that connects to multiple network areas, traffic isolation can be achieved across multiple network areas to block traffic backflow.

[0052] In this way, multiple isolation domains can be set up in the aggregation point switch. Then, based on one isolation domain, a mirror data stream sent by a source switch can be received unidirectionally. Based on multiple different isolation domains, mirror data streams sent by multiple source switches can be received unidirectionally, and the packets sent by different source switches carry different network area identifiers.

[0053] For example, Figure 5 This application provides a schematic diagram of the principle of a mirrored data stream processing procedure, as shown in the embodiments. Figure 5 As shown, source switch 1 sends the mirrored data stream VLAN 100 of network area 1 unidirectionally to the isolation domain 1 of the aggregation point switch; source switch 2 sends the mirrored data stream VLAN 200 of network area 2 unidirectionally to the isolation domain 2 of the aggregation point switch; and source switch 3 sends the mirrored data stream VLAN 300 of network area 3 unidirectionally to the isolation domain of the aggregation point switch.

[0054] S102, integrates the received packets from multiple network areas into a target packet carrying the target network area identifier.

[0055] For example, such as Figure 5As shown, the packet integration module in the aggregation point switch mirrors, splits, and reassembles received packets from multiple network areas, standardizes the traffic packet header format, and encapsulates VLAN tags. The VLAN ID in the VLAN tag is set to the target network area identifier, for example, 500, to achieve packet integration from multiple network areas. In this way, packets from multiple network areas can be integrated to obtain the target packet, i.e., all mirrored data streams, enabling unified scheduling.

[0056] S103 unidirectionally floods the target message to multiple security systems.

[0057] For example, the traffic flooding module in the aggregation point switch connects multiple security systems, such as... Figure 5 As shown, the traffic flooding module connects security system 1, security system 2, and security system 3. By disabling the MAC address learning function of the target packet, it enables data flooding within the VLAN. Subsequently, the target packet, i.e., the integrated traffic, is sent to all security systems, so that all security devices can receive mirrored data streams from all network areas.

[0058] In this embodiment, by receiving mirrored data streams from multiple source switches representing their respective network regions, the received packets from multiple network regions are integrated into a target packet carrying the target network region identifier. This target packet is then unidirectionally flooded to multiple security systems, enabling multi-source to multi-destination mirrored data stream distribution to meet business needs. Since this method can be implemented by modifying traditional switches, it eliminates the need for dedicated mirrored switches while reducing the deployment costs of connection cables and security systems, thus lowering procurement and maintenance costs and ultimately reducing the overall cost.

[0059] This application also provides a mirrored data stream distribution device. Figure 6 This is a schematic diagram of a mirrored data stream distribution device provided in an embodiment of this application. Figure 6 As shown, the mirrored data stream distribution device includes:

[0060] The receiving module 110 is used to receive mirrored data streams from multiple source switches, each representing a network area to which it belongs. The mirrored data streams from different network areas carry different network area identifiers.

[0061] The message integration module 120 is used to integrate messages from multiple network areas into a target message carrying the target network area identifier.

[0062] The traffic flooding module 130 is used to unidirectionally flood target packets to multiple security systems.

[0063] Optionally, the mirrored data stream distribution device also includes:

[0064] The isolation module is used to logically isolate and isolate traffic between multiple network areas.

[0065] Optionally, the isolation module is further configured to disable the STP protocol to logically isolate the multiple network areas; and to enable port isolation functionality for interconnection with the multiple network areas to isolate traffic between the multiple network areas.

[0066] Optionally, the message integration module 120 is further used to mirror, split, and reassemble the received messages from multiple network areas; standardize the traffic message header format and encapsulate VLAN tags; set the VLAN ID in the VLAN tag to the target network area identifier to obtain the target message.

[0067] Optionally, the mirrored data stream distribution device also includes:

[0068] The shutdown module is used to disable the MAC address learning function of the target packet in order to enable data flooding.

[0069] The aforementioned mirror data stream distribution device can execute the methods provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing the methods. Technical details not described in detail in this embodiment can be found in the mirror data stream distribution methods provided in any embodiment of this application.

[0070] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present application is shown. Figure 7 The electronic device 12 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0071] like Figure 7 As shown, the electronic device 12 is represented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0072] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0073] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0074] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 7 Not shown; usually referred to as a "hard drive"). Although Figure 7 As not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this application.

[0075] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of this application.

[0076] Electronic device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable a user to interact with electronic device 12, and / or with any device that enables electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, electronic device 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of electronic device 12 via bus 18. It should be understood that, although... Figure 7As not shown, other hardware and / or software modules may be used in conjunction with electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0077] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the mirror data stream distribution method provided in the embodiments of this application.

[0078] This application also provides a computer storage medium.

[0079] The computer-readable storage medium of this application embodiment can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be—but is not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0080] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0081] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0082] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0083] This application also provides a computer program product.

[0084] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer program products, which may include one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be an application-specific or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0085] Note that the above are merely preferred embodiments and the technical principles employed in this application. Those skilled in the art will understand that this application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of this application, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for distributing mirrored data streams, characterized in that, The method is applied to a mirrored data stream distribution system, which includes an aggregation point switch, multiple source switches, and multiple security systems. The aggregation point switch is interconnected with the multiple source switches and also interconnected with the multiple security systems. Different source switches are physically isolated from each other. Receive mirrored data streams from the multiple source switches, each representing a network area to which it belongs. The mirrored data streams from different network areas carry different network area identifiers. The received messages from multiple network areas are integrated into a target message carrying the target network area identifier; The target message is unidirectionally flooded to the multiple security systems.

2. The method according to claim 1, characterized in that, Before receiving the mirrored data streams of the network areas to which each of the multiple source switches belongs, the method further includes: Logical isolation and traffic isolation are performed on the multiple network regions.

3. The method according to claim 2, characterized in that, The logical isolation and traffic isolation of the multiple network regions includes: Disable the STP protocol to logically isolate the multiple network areas; Enable port isolation for interconnection with the multiple network areas to isolate traffic between the multiple network areas.

4. The method according to claim 1, characterized in that, The step of integrating received messages from multiple network regions into a target message carrying a target network region identifier includes: The received packets from the multiple network regions are mirrored, split, and reassembled. Standardize the traffic packet header format and encapsulate VLAN tags; The target packet is obtained by setting the VLAN ID in the VLAN tag to the target network area identifier.

5. The method according to claim 1, characterized in that, Before unidirectionally flooding the target message to the multiple security systems, the method further includes: Disable the MAC address learning function of the target packet to enable data flooding.

6. A mirrored data stream distribution device, characterized in that, The device is applied to a mirrored data stream distribution system, which includes an aggregation point switch, multiple source switches, and multiple security systems. The aggregation point switch is interconnected with the multiple source switches and also interconnected with the multiple security systems. Different source switches are physically isolated. The receiving module is used to receive mirror data streams from the network areas to which each source switch belongs, sent by the multiple source switches. The mirror data streams from different network areas carry different network area identifiers. The message integration module is used to integrate received messages from multiple network areas into a target message carrying the target network area identifier; The traffic flooding module is used to unidirectionally flood the target message to the multiple security systems.

7. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 5.

8. A mirrored data stream distribution system, characterized in that, It includes multiple source switches, multiple security systems, and an aggregation point switch. The aggregation point switch is interconnected with the multiple source switches and is also interconnected with the multiple security systems. Different source switches are physically isolated from each other. The aggregation point switch is used to perform the method according to any one of claims 1 to 5.

9. The mirrored data stream distribution system according to claim 8, characterized in that, Each source switch is used to aggregate mirrored data streams from its respective network area and mark the VLAN ID in the corresponding packet as the corresponding network area identifier.

10. A storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images