Message capturing method for user mode virtual switch and virtual switch

Abstract

The invention discloses a message capturing method for a user mode virtual switch and the virtual switch. The method comprises the following steps: setting a logic node which allows to mount a callback function on a message processing path of the virtual switch as a packet capturing point; in response to a received packet capture opening instruction, registering a packet capture callback function used for executing a message copying operation at a packet capture point specified by the packet capture opening instruction; when the original message runs to a specified packet capture point in the message processing path, triggering a packet capture callback function to copy the message, storing the copied message into a shared data queue, and simultaneously enabling the original message to continuously execute the original processing flow; and extracting the copied message from the shared data queue for analysis or storage. According to the method, the dynamic packet capture management capability is realized, operation and maintenance personnel are allowed to start or stop the packet capture function at a specific position in real time through a simple instruction when the virtual switch operates, the operation and maintenance efficiency is greatly improved, and the influence on services is reduced.

Description

Technical Field

[0001] This invention relates to the field of virtual switch technology, and in particular to a packet capture method for a user-mode virtual switch and a virtual switch. Background Technology

[0002] With the rapid development and large-scale application of cloud computing technology, virtualization network technology is also constantly iterating and updating. As a core component of virtualized networks, the technical architecture of virtual switches (vSwitch) is gradually shifting from traditional kernel-mode data forwarding to higher-performance user-mode data forwarding.

[0003] In network operation and maintenance and troubleshooting, packet capture is the most direct and essential means for R&D and operations personnel to diagnose network problems and locate faults. In traditional kernel-mode forwarding architectures, such as Figure 1 Technicians can directly use the standard tcpdump tool to capture packets from network devices operating in kernel mode. tcpdump uses socket system calls and kernel hook functions to trigger callbacks when packets are sent and received at the network device layer, copying and analyzing the captured packets.

[0004] However, as virtual switches transition to user-space operation, standard tcpdump cannot directly capture packets from user-space network devices because these devices do not directly pass through the kernel protocol stack. To address this issue, existing technologies typically employ the following solutions: Mirroring port-based solutions (such as ovs-tcpdump): This approach typically requires creating a mirror port operating in kernel mode within a virtual switch. By modifying the flow table configuration, traffic flowing through user-space network devices (source ports) is copied and forwarded to this kernel-mode mirror port. Since the mirror port operates in kernel mode, tcpdump can be used to capture packets from it, thereby indirectly capturing traffic from user-space devices.

[0005] Traffic acquisition scheme based on virtualization instances (such as Chinese patent CN117294533A): This scheme captures traffic by adjusting the switch flow table and mirroring it to an additional virtualization instance through the patch port.

[0006] Although the aforementioned existing technologies have solved the problem of user-space packet capture to some extent, they still have significant shortcomings in practical applications: First, there is a significant performance overhead. Creating mirrored ports, issuing or modifying flow table configurations, and other operations place a heavy additional burden on the virtual switch. Test data shows that using ovs-tcpdump for packet capture can cause the virtual switch's performance to drop by more than 50%, severely impacting normal business traffic forwarding.

[0007] Secondly, the methods are highly dependent on and have limited reliability. Existing packet capture methods rely heavily on the forwarding functions of the virtual switch itself (such as flow table matching and forwarding logic). When the virtual switch itself malfunctions (e.g., flow table lookup fails or forwarding logic is abnormal) and packet capture is needed for localization, the packets captured by relying on its forwarding functions may have been distorted or lost, making the packet capture results unreliable.

[0008] Secondly, packet capture coverage is limited (blind spots exist). Existing solutions typically only capture packets on the network device ports responsible for sending and receiving. In the operation mechanism of virtual switches, there is a slow routing path P2, where packets are sent to the controller for processing when no matching flow table is found. These sent packets do not pass through regular network device ports, therefore existing port mirroring-based methods cannot capture this critical control plane interaction packet, preventing maintenance personnel from analyzing the problem along the entire path.

[0009] Finally, deployment and maintenance are complex. Existing technologies often require creating additional image devices, modifying flow tables, and even deploying additional virtualization instances, which are cumbersome and not conducive to rapid deployment and low-cost maintenance by cloud service providers.

[0010] Therefore, the industry urgently needs to improve the existing protection acquisition methods for user-mode virtual switches. Summary of the Invention

[0011] The purpose of this invention is to provide a packet capture method and virtual switch for user-space virtual switches that can be implemented directly inside the user-space virtual switch, has minimal impact on forwarding performance, and can cover multi-path packet capture.

[0012] To achieve the above objectives, this invention discloses a packet capture method for a user-space virtual switch, comprising: Configure logical nodes that allow callback functions to be mounted on the packet processing path of the virtual switch as packet capture points; In response to the received packet capture start command, a packet capture callback function for performing packet copying operation is registered at the packet capture point specified by the packet capture start command; When the original packet reaches the specified packet capture point in the packet processing path, the packet capture callback function is triggered to copy the packet and store the copied packet in the shared data queue, while the original packet continues to execute the original processing flow. The copied messages are extracted from the shared data queue for parsing or storage.

[0013] Preferably, the packet capture points on the message processing path include at least one of the following locations: The position after the user-mode network device executes the packet reception function to receive the data packet and before looking up the flow table; The position before the user-mode network device executes the packet sending function to send data packets; If the virtual switch does not find a matching flow table, it will send the data packet to the position before the controller's upload operation is executed.

[0014] Preferably, the method for responding to the received packet capture start command includes: The packet capture start command is received from the outside through a packet capture component residing in the virtual switch; The packet capture initiation command is parsed to identify the target packet capture point and operation type; When the operation type is to enable packet capture, the packet capture component registers the packet capture callback function with the target packet capture point.

[0015] Preferably, the message capture method also includes: In response to the received packet capture stop command, the packet capture component cancels the packet capture callback function registered at the target packet capture point.

[0016] Preferably, in the packet capture callback function, a deep copy of the original packet is performed to generate a duplicate packet; Push the replica message into the shared data queue; After the copy message is pushed into the queue, control is immediately returned so that the main forwarding thread of the virtual switch can continue processing the original message.

[0017] Preferably, the message capture method also includes: The packet capture component asynchronously retrieves packets from the shared data queue. The retrieved messages are filtered according to preset filtering rules; The filtered messages can be written to a specified file path, or the message content can be printed to the terminal interface in real time.

[0018] The present invention also provides a virtual switch for user mode, wherein the virtual switch is provided with a functional module for packet capture, and the functional module operates based on the packet capture method described above.

[0019] The present invention also provides a message capture system, comprising: One or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the message capture method as described above.

[0020] The present invention also provides a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the message capture method described above.

[0021] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the message capture method described above.

[0022] Compared to existing technologies, the packet capture method provided by the above technical solution firstly utilizes a lightweight memory copying mechanism through a packet capture callback function and asynchronous processing via a shared queue. This ensures that packet parsing and storage operations do not block the normal forwarding path of the original packet, guaranteeing that the virtual switch maintains high forwarding performance during packet capture. Secondly, the packet capture action is directly attached to the logical nodes through which the packet passes, rather than relying on the virtual switch's flow table matching or forwarding rules. Therefore, even if the virtual switch's forwarding logic (flow table) malfunctions or is misconfigured, causing packets to fail to forward normally, the callback function will still be triggered and the packet captured as long as it reaches that logical node. This avoids the problems of missed captures or unreliable packet capture results caused by relying on forwarding functions, thus providing a more accurate reflection of the packet's state in the processing path. Furthermore, packet capture does not require changes to the existing virtual network topology, reducing the operational complexity for maintenance personnel and lowering the risk of network outages due to configuration errors. In addition, the packet capture function is dynamically enabled, and this dynamic registration mechanism ensures that the virtual switch operates without any additional resource overhead during non-diagnostic periods, achieving on-demand resource allocation. Attached Figure Description

[0023] Figure 1 This is a flowchart of the tcpdump packet capture process in existing technologies.

[0024] Figure 2 This is a schematic diagram of virtual switch forwarding and uploading in an embodiment of the present invention.

[0025] Figure 3 This is a schematic diagram of the layout of the capture points in an embodiment of the present invention.

[0026] Figure 4 This is a flowchart illustrating the workflow of the virtual switch in an embodiment of the present invention. Detailed Implementation

[0027] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0028] This embodiment discloses a packet capture method for user-space virtual switches. This method aims to solve the problems in existing technologies, such as significant performance loss due to port mirroring-based packet capture, the existence of packet capture blind spots, and unreliability due to reliance on forwarding logic.

[0029] To better understand the packet capture process in this embodiment, the normal processing of data packets in the virtual switch (i.e., the forwarding process when packet capture is not enabled) will be explained first.

[0030] like Figure 2 The process of a normal data packet passing through a virtual switch is as follows: First, the packet receiving function of the network device receives the data packets (for example, the dev2 device in the figure receives data packets).

[0031] After Dev2 receives the data packet, the virtual switch looks up the generated flow table and modifies and forwards the packet according to the actions in the flow table. The specific network device to which the packet is forwarded is determined by the flow table.

[0032] The packet is then sent to the network device that needs to send it, such as dev3. This process is called the fast-forward path P1.

[0033] If no corresponding entry is found in the flow table, for example, if dev3 receives a data packet but does not find the corresponding flow table, the data packet will be sent to the controller for processing.

[0034] After processing, the controller returns the data packet and the corresponding operation instruction to the virtual switch. The virtual switch then modifies the data packet based on the returned operation. This process is called slow path P2.

[0035] Finally, the sending network device dev3 calls the packet sending function to send the data packet to the network device dev1.

[0036] Based on the operating mechanism of the virtual switch described above, the packet capture method proposed in this embodiment is implemented by introducing a non-intrusive bypass capture mechanism into the forwarding path. For example... Figure 3 and Figure 4 Specifically, it includes the following steps: S1: Configure a logical node that allows callback functions to be mounted as a packet capture point Q on the packet processing path of the virtual switch.

[0037] In this embodiment, by modifying the source code or configuration of the virtual switch, a logical judgment node is pre-set in the aforementioned packet processing path. The default state of this logical node (i.e., when no callback function is registered) does not process packets, only performing a simple empty judgment, thus ensuring that the forwarding performance of the virtual switch is unaffected in non-packet capture states.

[0038] S2: In response to the received packet capture start command, register a packet capture callback function for performing packet copying operation at the packet capture point Q specified by the packet capture start command.

[0039] When a user or maintenance personnel needs to capture packets at a specific location, they send a packet capture start command to the virtual switch. Upon receiving this command, the virtual switch registers a specific packet capture callback function on the corresponding logical node pre-configured in step S1, based on the target location specified in the command. The main function of this packet capture callback function is defined as performing a packet copying operation.

[0040] S3: When the original packet reaches the specified packet capture point Q in the packet processing path, the packet capture callback function is triggered to copy the original packet and store the copied packet in the shared data queue, while the original packet continues to execute the original processing flow.

[0041] After registering the packet capture callback function, when the service traffic (raw packets) of the virtual switch flows through the packet capture point Q, the pre-defined logic will detect the existence of the callback function and trigger it. At this time, the packet capture callback function will copy (preferably a deep copy) the current raw packet to generate a copy packet. Subsequently, the copy packet is pushed into a pre-allocated shared data queue (Ring Buffer or similar structure).

[0042] Specifically, after the copying and queuing operations are completed, control immediately returns to the main forwarding thread of the virtual switch. The original packets are not modified or delayed and continue to be transmitted downstream along the original fast forwarding path P1 or slow forwarding path P2. This mechanism ensures that packet capture operations do not interrupt or change the normal service forwarding logic, avoiding data distortion that may occur in traditional mirrored port solutions due to reliance on forwarding logic.

[0043] S4: Extract the copied message from the shared data queue and parse or store it.

[0044] Simultaneously or subsequently, while the forwarding thread in the data plane writes the replica packets to the shared data queue, another thread or process asynchronously retrieves the replica packets from the shared data queue. Furthermore, the retrieved packets can be filtered according to preset filtering rules. The filtered packets can then be written to a specified file path, or their contents can be printed to the terminal interface in real time.

[0045] Using the above method, this embodiment achieves packet capture directly within the user-space virtual switch without creating additional kernel-space mirror ports or modifying flow table configurations. This significantly reduces the performance loss of the virtual switch caused by packet capture operations and ensures the authenticity and integrity of the captured packets.

[0046] On the other hand, such as Figure 3 The packet capture point Q on the message processing path may include at least one of the following locations: 1. The first position W1 after the user-mode network device executes the packet receiving function to receive the data packet and before looking up the flow table.

[0047] When a virtual switch receives a data packet from a physical network interface card (NIC) or a virtual network interface card (such as a virtual machine's vNIC), the packet is at the entry point of the data plane of the virtual switch, which is the first position W1, before it enters the flow table lookup and forwarding logic of the virtual switch.

[0048] The packets captured at position W1 represent the raw inbound traffic received by the virtual switch. This is crucial for analyzing all packets received by the network device, verifying the integrity of inbound traffic, checking for packet loss or errors, and analyzing the raw traffic before any flow table processing occurs. For example, all packets entering the virtual switch can be captured, regardless of whether they match any flow table or whether they are ultimately forwarded, dropped, or sent to the controller.

[0049] 2. The second position W2 before the user-mode network device executes the packet sending function to send the data packet.

[0050] When the virtual switch processes the data packet according to the flow table rules and determines that the data packet needs to be sent out of a certain physical network card or virtual network card, the second position W2 is located at the exit point where the data packet is about to leave the virtual switch's data plane before the data packet is actually sent out.

[0051] The packets captured at this second location, W2, represent outbound traffic that the virtual switch is about to send after processing. This is very useful for verifying the virtual switch's modifications to packets (such as NAT and VLAN tagging), confirming the correctness of forwarding decisions, checking whether outbound traffic conforms to the expected policy, and analyzing the final state of packets before they leave the virtual switch. For example, all packets sent from the virtual switch can be captured, including packets that have been forwarded through flow tables and modified.

[0052] 3. When the virtual switch does not find a matching flow table, it sends the data packet to the third position W3 before the controller's upload operation is executed.

[0053] When a virtual switch performs a flow table lookup and finds that the current packet does not match any existing flow table entry, the virtual switch needs to report the packet to the controller (such as the OpenFlow controller) via this third location W3 for processing to obtain new flow table rules. This packet capture point Q is located before performing the actual upload operation (such as sending the packet to the controller via Netlink or OpenFlow protocol).

[0054] The packets captured at position W3 represent traffic on the slow path P2 that cannot be directly processed in the fast path P1 of the virtual switch and requires controller intervention. This is valuable for debugging new network policies, monitoring unknown traffic, analyzing controller decision-making behavior, and troubleshooting flow table configuration issues (such as missing or incorrect flow table entries). For example, it can capture all abnormal packets that require controller processing, thus revealing which traffic triggered the slow path and how the controller responded to this traffic.

[0055] By setting a packet capture point Q at one or more of the above key locations and registering and triggering the packet capture callback function, a copy of the packet at the corresponding stage can be copied to the shared data queue.

[0056] On the other hand, a packet capture component resides within the virtual switch. This component is responsible for receiving control commands from external sources (such as command-line interface CLI, REST API, or configurations issued by the controller) and managing the state of the underlying packet capture point Q.

[0057] like Figure 4 The specific processing procedure is as follows: 1. Packet capture initiation process, that is, when a user needs to start packet capture, the following steps are executed: Receiving Instructions: The packet capture component first receives the packet capture start instruction from external input. This instruction typically includes necessary parameters, such as the specified packet capture position (e.g., "after receiving packets", "before sending packets", or "before uploading"), the target port identifier, and the operation type ("start" in this step).

[0058] Command parsing: The packet capture component parses the received commands. The parsing process includes identifying the target capture point Q and the operation type in the command. For example, it may identify that the user wants to perform the "start packet capture" operation at "the position after receiving packets on port A".

[0059] Registering callback functions: When the operation type is determined to be "Start packet capture", the packet capture component will locate the corresponding logical node (i.e., the target packet capture point Q) in the virtual switch code. Subsequently, the packet capture component will perform a registration operation, attaching the predefined packet capture callback function used for packet copying to that logical node.

[0060] In practice, this is usually manifested by pointing the function pointer on the logical node to the address of the packet capture callback function.

[0061] Once registration is complete, when data flows through this node, the program pointer jumps to the packet capture callback function to execute the packet copying logic.

[0062] 2. Packet capture stop procedure: When the user completes debugging or monitoring tasks and needs to stop packet capture to restore optimal system performance, the following steps are executed: Receiving and parsing commands: The packet capture component receives and parses externally input commands to stop packet capture. In this case, the parsed operation type is "stop packet capture," and the command also specifies the target location where packet capture should be stopped.

[0063] Cancel callback function: In response to this instruction, the packet capture component will perform a cancel (cancel) operation on the specified target packet capture point Q.

[0064] Specifically, the packet capture component removes the packet capture callback functions that have been registered on the logical node.

[0065] At the underlying implementation level, this typically involves resetting the corresponding function pointer to NULL or pointing it to an empty stub function.

[0066] After the cancellation operation is completed, when subsequent packets flow through this node, the logical judgment will no longer trigger packet replication operations, and the virtual switch will return to a pure forwarding state, without generating additional CPU overhead or memory usage.

[0067] Through the mechanism described in the above embodiments, the present invention achieves a dynamic, hot-swappable packet capture management capability. Unlike traditional solutions that require restarting services or recompiling code to enable debugging functions, this embodiment allows maintenance personnel to enable or stop packet capture functions at specific locations in real time using simple commands while the virtual switch is running, greatly improving maintenance efficiency and reducing the impact on business operations.

[0068] In summary, this invention discloses a packet capture method for user-space virtual switches. First, a lightweight memory copy is performed using a packet capture callback function, and asynchronous processing is achieved using a shared queue. This ensures that packet parsing and storage operations do not block the normal forwarding path of the original packets. Compared to the high-performance overhead caused by creating mirror ports or modifying flow tables in existing technologies, this invention guarantees that the virtual switch maintains high forwarding performance during packet capture.

[0069] Secondly, packet capture is directly mounted on the logical nodes through which the packet passes, rather than relying on the flow table matching or forwarding rules of the virtual switch (such as the mirrored traffic scheme in existing technologies). Even if the forwarding logic (flow table) of the virtual switch malfunctions or is misconfigured, causing the packet to fail to forward normally, the packet capture callback function will still be triggered and the packet will be captured as long as the packet reaches the logical node. This avoids the problems of missed captures or unreliable packet capture results caused by relying on forwarding functions, thus more realistically reflecting the state of the packet in the processing path.

[0070] Furthermore, this invention is implemented directly at the user-space software level, eliminating the need to create additional kernel-space mirror ports as required by existing technologies, and also eliminating the need to distribute complex flow table configurations to guide traffic. Therefore, when performing packet capture, there is no need to change the existing virtual network topology, reducing the operational complexity for maintenance personnel and lowering the risk of network outages due to configuration errors.

[0071] Furthermore, the packet capture function is dynamically enabled. A callback function is only registered for processing when a command is received; when packet capture is not needed (i.e., no callback function is registered), the logical node will not perform a replication operation. This dynamic registration mechanism ensures that the virtual switch operates without any additional resource overhead during non-diagnostic periods, achieving on-demand resource allocation.

[0072] In another preferred embodiment of the present invention, a virtual switch for user mode is also disclosed, wherein the virtual switch is provided with a functional module for packet capture, which operates based on the packet capture method in the above embodiment.

[0073] This invention also discloses a packet capture system, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the packet capture method as described above. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, used to execute the relevant programs to implement the functions required by the modules in the packet capture system of this application embodiment, or to execute the packet capture method of this application method embodiment.

[0074] This invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform the message capture method described above. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state drives (SSDs).

[0075] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned message capture method.

[0076] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A packet capture method for a user-space virtual switch, characterized in that, include: Configure logical nodes that allow callback functions to be mounted on the packet processing path of the virtual switch as packet capture points; In response to the received packet capture start command, a packet capture callback function for performing packet copying operation is registered at the packet capture point specified by the packet capture start command; When the original packet reaches the specified packet capture point in the packet processing path, the packet capture callback function is triggered to copy the packet and store the copied packet in the shared data queue, while the original packet continues to execute the original processing flow. The copied messages are extracted from the shared data queue for parsing or storage.

2. The message capture method according to claim 1, characterized in that, The packet capture points on the message processing path include at least one of the following locations: The position after the user-mode network device executes the packet reception function to receive the data packet and before looking up the flow table; The position before the user-mode network device executes the packet sending function to send data packets; If the virtual switch does not find a matching flow table, it will send the data packet to the position before the controller's upload operation is executed.

3. The message capture method according to claim 1, characterized in that, The method for responding to the received packet capture start command includes: The packet capture start command is received from the outside through a packet capture component residing in the virtual switch; The packet capture initiation command is parsed to identify the target packet capture point and operation type; When the operation type is to enable packet capture, the packet capture component registers the packet capture callback function with the target packet capture point.

4. The message capture method according to claim 3, characterized in that, Also includes: In response to the received packet capture stop command, the packet capture component cancels the packet capture callback function registered at the target packet capture point.

5. The message capture method according to claim 1, characterized in that, In the packet capture callback function, a deep copy of the original packet is performed to generate a duplicate packet; Push the replica message into the shared data queue; After the copy message is pushed into the queue, control is immediately returned so that the main forwarding thread of the virtual switch can continue processing the original message.

6. The message capture method according to claim 3, characterized in that, Also includes: The packet capture component asynchronously retrieves packets from the shared data queue. The retrieved messages are filtered according to preset filtering rules; The filtered messages can be written to a specified file path, or the message content can be printed to the terminal interface in real time.

7. A virtual switch for user mode, characterized in that, The virtual switch is equipped with a functional module for packet capture, which operates based on the packet capture method described in any one of claims 1 to 6.

8. A message capture system, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the message capture method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the message capture method as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the message capture method according to any one of claims 1 to 6.

Images