On-stream detection methods, systems, and network nodes
By adding a follow-up detection metadata header field after the IPv4 packet payload field, the difficulty of follow-up detection in native IPv4 networks is solved, and follow-up detection with an unchanged IPv4 header length is realized, supporting multi-dimensional detection and reducing hardware costs.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NEW H3C TECH CO LTD
- Filing Date
- 2026-03-24
- Publication Date
- 2026-06-02
AI Technical Summary
In native IPv4 networks, it is difficult to implement flow detection because IPv4 packets have a fixed header length and do not have the flexible header extension mechanism of IPv6 packets, making it difficult to carry flow detection information in IPv4 packets.
A new flow detection metadata header field is added after the packet payload field of the IPv4 packet. It carries flow detection information and ensures that the IPv4 header length remains unchanged by reusing unused bits in the IPv4 header as trigger bits. Intermediate nodes can quickly locate the tail data and support hop-by-hop detection and end-to-end detection.
It enables flow-based detection in native IPv4 networks, avoids intermediate nodes parsing the IPv4 Options field, ensures line-speed forwarding performance, and provides sufficient byte space to carry multi-dimensional detection data, reducing hardware implementation costs.
Smart Images
Figure CN122137907A_ABST
Abstract
Description
Technical Field
[0001] This application relates to network communication technology, and in particular to in-situ flow information telemetry (IFIT) methods, systems and network nodes. Background Technology
[0002] Flow-based detection, by carrying performance indicators such as actual packet loss rate and latency in business packets, is used to monitor network quality such as latency, packet loss, and jitter in real time. It has the advantages of convenient deployment and high statistical accuracy.
[0003] In IPv6 networks, flow detection information is typically carried using the optional TLV (Type-Length-Value) field in the Destination Options Header (DOH) of IPv6 packets. However, in native IPv4 networks, the fixed length and limited space of the IPv4 packet header (such as the area before the payload field) and the lack of a flexible header extension mechanism like IPv6 make implementing flow detection a pressing technical challenge. Summary of the Invention
[0004] This application provides a method, system, and network node for flow detection to enable flow detection in native IPv4 networks.
[0005] This embodiment provides a flow detection method, which is applied to network nodes in an IPv4 network. The network node serves as the entry node, and the method includes: When determining to perform flow detection based on the first IPv4 packet, a flow detection metadata header field is added after the packet payload field of the first IPv4 packet to obtain a second IPv4 packet; the flow detection metadata header field carries flow detection information; the packet payload field carries service data. Send the second IPv4 message.
[0006] A flow detection system includes an ingress node, an egress node, and an intermediate node between the ingress node and the egress node of an IPv4 packet in an IPv4 network. When the ingress node determines to perform flow detection based on the first IPv4 packet, it adds a flow detection metadata header field after the packet payload field of the first IPv4 packet to obtain a second IPv4 packet; the flow detection metadata header field carries flow detection information; the packet payload field carries service data; and the second IPv4 packet is sent. After receiving the second IPv4 packet, any intermediate node continues to forward the second IPv4 packet and counts the detection data based on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet. After receiving the second IPv4 packet, the egress node performs statistical analysis on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet, and performs flow detection metadata header field after deleting the packet payload field of the IPv4 packet. The node then adjusts the IPv4 packet to restore the second IPv4 packet to the first IPv4 packet.
[0007] A network node, comprising: a processor and a machine-readable storage medium; The machine-readable storage medium stores computer instructions, which, when executed by the processor, perform the steps in the method described above.
[0008] As can be seen from the above technical solutions, in this embodiment, by adding a follow-up detection metadata header field after the packet payload field of the current IPv4 packet, follow-up detection in the native IPv4 network is realized.
[0009] Furthermore, this embodiment adds a flow detection metadata header field after the packet payload field of the current IPv4 packet. This ensures that the IPv4 header length of the current IPv4 packet remains unchanged (the IPv4 header length is also 5 bytes). This avoids the intermediate network nodes from entering the slow forwarding path (sending to the CPU) based on the IPv4 Options field by inserting the IPv4 Options field into the IPv4 header, such as the IPv4 packet header and the transport layer header (TCP / UDP header) to carry flow detection information.
[0010] Furthermore, in this embodiment, a new follow-up detection metadata header field is added after the packet payload field of the current IPv4 packet. Intermediate nodes can quickly locate the tail data without parsing complex option lists, thus ensuring line-speed forwarding performance.
[0011] Furthermore, this embodiment adds a follow-up detection metadata header field after the packet payload field of the current IPv4 packet. This tail encapsulation method does not change the relative positional relationship between the IPv4 header, such as the IPv4 packet header and the transport layer header (TCP / UDP header). Therefore, it avoids the situation where devices such as firewalls, load balancers, NAT devices, intrusion detection systems, or other intermediate boxes, or the final receiving host, expect the IPv4 packet header to be directly followed by the TCP / UDP header, cannot recognize the follow-up detection information because a field such as the IPv4 Options field is inserted between the IPv4 header and the transport layer header (TCP / UDP header). This prevents problems such as the IPv4 packet being discarded or the connection being reset due to the inability to recognize the information, which may be mistaken for a protocol error or malicious payload.
[0012] Furthermore, this embodiment adds a flow detection metadata header field after the packet payload field of the current IPv4 packet. Since the tail can provide sufficient byte space (such as 12 bytes or more), the flow detection metadata header field can carry a variety of metadata such as flow ID, node ID, and timestamp, supporting hop-by-hop detection, end-to-end detection, packet loss and delay multi-dimensional measurement. Moreover, this method is simpler in logic and consumes fewer resources in hardware chip (such as ASIC FPGA) implementation, which is conducive to low-cost hardware implementation. Attached Figure Description
[0013] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.
[0014] Figure 1 A flowchart illustrating the method provided in this application embodiment; Figure 2 This is a network structure diagram provided for an embodiment of this application; Figure 3 A structural diagram of the IPv4 packet header fields provided in the embodiments of this application; Figure 4 This is a structural diagram of the metadata header fields for streaming detection provided in the embodiments of this application; Figure 5 The schematic diagrams provided for the embodiments of this application are as follows; Figure 6 This is a network node structure diagram provided in the embodiments of this application; Figure 7 This is a hardware structure diagram provided for an embodiment of this application. Detailed Implementation
[0015] This embodiment provides a flow detection method applied to Native IPv4 networks, specifically as follows: Figure 1 As shown.
[0016] See Figure 1 , Figure 1 This is a flowchart illustrating a method provided in an embodiment of this application. The method is applied to, for example... Figure 2 The network node shown is part of a Native IPv4 network. For example, this network node is... Figure 2 The entry node is shown. (For example...) Figure 1 As shown, a network node acting as an entry node may include the following steps: Step 101: When determining to perform flow detection based on the current first IPv4 packet, add a flow detection metadata header field after the packet payload field of the current first IPv4 packet to obtain the second IPv4 packet; the flow detection metadata header field carries flow detection information; the packet payload field carries service data.
[0017] As one example, determining to perform flow detection based on the current first IPv4 packet may include: If the service flow to which the current first IPv4 packet belongs is the target flow, then check whether the sum of the packet length of the current first IPv4 packet and the preset follow-up detection metadata length is less than or equal to the preset transmission length threshold. If so, then determine to perform follow-up detection based on the current first IPv4 packet.
[0018] Optionally, the aforementioned preset transmission length threshold may be, for example, the maximum transmission unit (MTU) of the outgoing port of the aforementioned IPv4 packet.
[0019] In this embodiment, the length of the metadata header field for the streaming detection is a set length, such as 12 bytes or 3 bit words (96 bits).
[0020] Of course, in this embodiment, if the sum of the length of the current first IPv4 packet and the preset length of the following detection metadata is greater than the preset transmission length threshold, then following detection will not be performed based on the current first IPv4 packet, and it can be transmitted in the conventional IPv4 packet transmission mode.
[0021] Step 102: Send the second IPv4 packet.
[0022] In this embodiment, step 102 can further be based on the above-mentioned flow detection information to count flow detection data. The following will describe how to count flow detection data based on flow detection information, which will not be repeated here.
[0023] As can be seen, in this embodiment, by adding a follow-up detection metadata header field after the packet payload field of the current IPv4 packet, follow-up detection in the native IPv4 network is realized.
[0024] Furthermore, this embodiment adds a flow detection metadata header field after the packet payload field of the current IPv4 packet. This ensures that the IPv4 header length of the current IPv4 packet remains unchanged (the IPv4 header length is also 5 bytes). This avoids the intermediate network nodes from entering the slow forwarding path (sending to the CPU) based on the IPv4 Options field by inserting the IPv4 Options field into the IPv4 header, such as the IPv4 packet header and the transport layer header (TCP / UDP header) to carry flow detection information.
[0025] Furthermore, in this embodiment, a new follow-up detection metadata header field is added after the packet payload field of the current IPv4 packet. Intermediate nodes can quickly locate the tail data without parsing complex option lists, thus ensuring line-speed forwarding performance.
[0026] Furthermore, this embodiment adds a follow-up detection metadata header field after the packet payload field of the current IPv4 packet. This tail encapsulation method does not change the relative positional relationship between the IPv4 header, such as the IPv4 packet header and the transport layer header (TCP / UDP header). Therefore, it avoids the situation where devices such as firewalls, load balancers, NAT devices, intrusion detection systems, or other intermediate boxes, or the final receiving host, expect the IPv4 packet header to be directly followed by the TCP / UDP header, cannot recognize it because the IPv4 Options field carrying follow-up detection information is inserted between the IPv4 header, such as the IPv4 packet header and the transport layer header (TCP / UDP header). This prevents problems such as the IPv4 packet being discarded or the connection being reset due to the inability to recognize it as a protocol error or malicious payload.
[0027] Furthermore, this embodiment adds a flow detection metadata header field after the packet payload field of the current IPv4 packet. Since the tail can provide sufficient byte space (such as 12 bytes or more), the flow detection metadata header field can carry a variety of metadata such as flow ID, node ID, and timestamp, supporting hop-by-hop detection, end-to-end detection, packet loss and delay multi-dimensional measurement. Moreover, this method is simpler in logic and consumes fewer resources in hardware chip (such as ASIC FPGA) implementation, which is conducive to low-cost hardware implementation.
[0028] In this embodiment, a composite scheme of "header identifier + trailer bearer" can be implemented by using an unused bit in the IPv4 header field of the current first IPv4 packet, such as the IPv4 header field, in conjunction with a newly added flow detection metadata header field after the payload field. For example, an unused bit in the IPv4 header field, such as the IPv4 header field, can be reused as a trigger bit to indicate that a flow detection metadata header field has been added after the payload field of the current IPv4 packet.
[0029] As an example, this embodiment can set a reserved bit, Reserved Flag, in the Flags field of the IPv4 header of the current first IPv4 packet to a set value, such as 1. Here, the set value, such as 1, is used to indicate that the current first IPv4 packet carries the flow detection metadata header field. Figure 3 An example is shown illustrating the structure of an IPv4 header field.
[0030] Optionally, the first bit of Flags, i.e., bit0 or Flag0, is a reserved bit, while the second bit (bit1 or Flag0) and the third bit (bit2 or Flag2) of Flags are already occupied.
[0031] In this embodiment, the above-mentioned flow detection metadata header fields carry the Extended Flow Detection Type Identifier (Ext FM Type), Node Identifier (NodeMonID), Flow Flow Identifier (FlowMonID), and flow detection metrics in ascending order of bit position. These flow detection metrics include at least one of packet loss measurement identifier, latency measurement identifier, and timestamp. Figure 4 An example is shown illustrating the structure of the metadata header field for stream-based detection.
[0032] like Figure 4 As shown, the header fields of the flow detection metadata include three bitwords (96 bits). The first bitword includes the Ext FM Type and reserved fields. For example, the Ext FM Type occupies 0 to 15 bits, and the reserved fields occupy 16 to 31 bits. The second bitword includes NodeMonID, F, P, T, and the reserved field RSV. The third bitword includes FlowMonID, L, D, R, and HTI. Table 1 provides an example description of each field. Table 1 The following is combined with Figure 5 The method provided in the embodiments of this application is described in the network scenario shown: like Figure 5As shown, node 501, acting as the ingress node, identifies the service flow to which the currently received IPv4 packet (denoted as packet 500) belongs based on packet characteristics such as the source IP address and destination IP address. If the service flow is a pre-defined target flow that requires flow-following detection, then the total length (L1) indicated by the total length field in the IPv4 packet header of packet 500 is extracted. It is then determined whether the sum of L1 and the preset length of the flow-following detection metadata header field (denoted as L2) is less than or equal to the maximum transmission unit (MTU) of the outgoing port used by node 501 to forward packet 500.
[0033] If node 501 finds that the sum of L1 and L2 is less than or equal to the MTU of the outgoing port forwarding the IPv4 packet, it modifies the total length in the IPv4 header field of packet 500 from L1 to L1+L2 (the sum of L1 and L2 is denoted as L3), recalculates the header checksum based on L3 to obtain the second header checksum, updates the header checksum in the IPv4 header field from the original first header checksum to the second header checksum, sets the reserved flag (i.e., Flag 0) in the Flags field of the IPv4 header field to a valid state (e.g., set to 1), and adds a new IFIT Meta Header field after the Payload field (carrying the original payload) and before the Frame Check Sequence (FCS) field of packet 500. Optionally, node 501 may also calculate a Cyclic Redundancy Check (CRC) value based on the metadata header field of the flow detection, and perform a specified operation, such as an XOR operation, on the CRC value and the original frame check sequence carried in the FCS field to update the FCS field from the original frame check sequence to the calculated result. Through the above adjustments to message 500, the adjusted message 500 can now be denoted as message 501.
[0034] Node 501 forwards message 501 through its outgoing port. It then compiles the detection data based on the flow detection information carried in the flow detection metadata header fields and sends it to the analyzer. Here, Node 501 compiles the detection data based on the flow detection information, for example, measuring flow detection metrics such as packet loss rate and latency indicated by the L field and / or P field according to the measurement period indicated by the P field and the detection type indicated by the T field.
[0035] Node 502, acting as any intermediate node of packet 501, upon receiving packet 501 from Node 501, quickly identifies Flag 0 in the IPv4 header field of packet 501 using hardware logic. If Flag 0 is valid, such as being set to 1, it directly locates the trailing flow detection metadata header field. For example, using hardware logic, it calculates the starting offset address of the trailing flow detection metadata header field by subtracting the IPv4 header field length, the TCP / UDP header length, and the payload field length from the Total Length indicated in the IPv4 header field. It directly accesses the memory area at the starting offset address to obtain the trailing flow detection information without shifting the packet payload data. It extracts the trailing flow detection information carried in the trailing flow detection metadata header field to statistically analyze detection data and send it to the analyzer. Simultaneously, Node 502 forwards packet 501 without modifying it.
[0036] As the egress node of message 501, node 503, upon receiving message 501 sent from node 501, quickly identifies Flag 0 in the IPv4 header of message 501 through hardware logic; if Flag 0 is in a valid state, such as being set to 1, it directly locates the following flow detection metadata header field at the end, obtains the following flow detection information carried by the following flow detection metadata header field, and statistically analyzes the detection data based on the following flow detection information and sends it to the analyzer. Simultaneously, the flow detection metadata header field is removed from message 501, and the Flag 0 in the IPv4 header field is restored from a valid state to an invalid state (e.g., set to 0). The Total Length field in the IPv4 header field is modified to L1 as described above, and the IPv4 header checksum is corrected based on L1 compensation to change the Frame Check Sequence carried in the FCS field of message 501 to the original Frame Check Sequence. Furthermore, the header Checksum in the IPv4 header field of the received message 501 is updated from the current second header checksum to the first header checksum, which is calculated based on the first length. This is equivalent to restoring message 501 to the original message 500 described above. For ease of understanding, after the above adjustments to message 501, the adjusted message 501 can now be referred to as message 500. Node 503 then forwards message 500 to the receiving host.
[0037] The above description implements flow detection in Native IPv4 networks. The method provided by the embodiments of this application has been described above; the system provided by the embodiments of this application is described below: In this embodiment, the system includes an ingress node, an egress node, and an intermediate node between the ingress node and the egress node for an IPv4 packet in an IPv4 network. When the ingress node determines to perform flow detection based on the first IPv4 packet, it adds a flow detection metadata header field after the packet payload field of the first IPv4 packet to obtain a second IPv4 packet; the flow detection metadata header field carries flow detection information; the packet payload field carries service data; and the second IPv4 packet is sent. After receiving the second IPv4 packet, any intermediate node continues to forward the second IPv4 packet and counts the detection data based on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet. After receiving the second IPv4 packet, the egress node performs statistical analysis on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet, and performs flow detection metadata header field after deleting the packet payload field of the IPv4 packet. The node then adjusts the IPv4 packet to restore the second IPv4 packet to the first IPv4 packet. Here's how to restore the IPv4 packet to its initial state: The Reserved Flag bit in the Flags field of the received IPv4 packet's IPv4 header is set from its current value to its initial value; if the Total Length in the IPv4 packet's header field is the second length, it is modified from the current second length to the first length; the first length is the difference between the second length and the preset flow detection metadata length; the header Checksum in the IPv4 packet's header field is updated from the current second header checksum to the first header checksum, calculated based on the first length; and the FCS field of the received IPv4 packet is updated from its current value to the original frame check sequence.
[0038] This system corresponds to Figure 5 The process shown is not repeated here.
[0039] The apparatus provided in the embodiments of this application is described below: See Figure 6 , Figure 6 This is a structural diagram of a device provided in an embodiment of this application. The device is applied to any network node and may include: The processing unit is configured to, when determining to perform flow detection based on the current first IPv4 packet, add a flow detection metadata header field after the packet payload field of the first IPv4 packet to obtain a second IPv4 packet; the flow detection metadata header field carries flow detection information; the packet payload field carries service data. The sending unit is used to send the second IPv4 packet.
[0040] Optionally, the determination of flow detection based on the current first IPv4 packet includes: If the service flow to which the first IPv4 packet belongs is the target flow, then check whether the sum of the packet length of the first IPv4 packet and the preset length of the metadata header field of the follow-up detection is less than or equal to the preset transmission length threshold; if so, then determine to perform follow-up detection based on the first IPv4 packet.
[0041] Optionally, the processing unit further includes: setting the Reserved Flag bit in the Flags field of the IPv4 header of the second IPv4 packet to a set value; the set value is used to instruct the second IPv4 packet to carry the following detection metadata header field.
[0042] Optionally, the processing unit further includes: modifying the message length TotalLength in the IPv4 header field of the second IPv4 message from a first length to a second length; the second length is the sum of the first length and a preset flow detection metadata length.
[0043] Optionally, the IPv4 header field also includes a header checksum. Here, the processing unit further includes: recalculating the header checksum based on the second length mentioned above to obtain the first header checksum; and updating the header checksum from the current second header checksum to the second header checksum.
[0044] Optionally, the second IPv4 message also carries a Frame Check Sequence (FCS) field; the FCS field is located after the message payload field.
[0045] Here, the following detection metadata header field is set between the message payload field and the FCS field.
[0046] Optionally, the processing unit further includes: calculating a Cyclic Redundancy Check (CRC) value based on the metadata header field of the flow detection, performing a specified operation, such as an XOR operation, on the CRC value and the original frame check sequence in the FCS field carried by the second IPV4 packet, and updating the FCS field from the carried original frame check sequence to the calculated result.
[0047] Optionally, the following metadata header fields carry the extended flow detection type identifier Ext FM Type, node identifier NodeMonID, service flow identifier FlowMonID, and flow detection metrics in ascending order of bit position.
[0048] Optionally, if the processing unit uses the aforementioned network node as an exit node, it performs the following steps: Upon receiving the second IPv4 packet, statistical detection data is collected based on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet. The flow detection metadata header field after the packet payload field of the second IPv4 packet is deleted, and the second IPv4 packet is restored to the first IPv4 packet.
[0049] Optionally, the processing unit restores the second IPv4 packet to the first IPv4 packet, including: Set the ReservedFlag bit in the Flags field of the IPv4 header of the second IPv4 packet from its current setting to its initial value; Modify the Total Length field in the IPv4 header of the second IPv4 packet from the current second length to the first length; the first length is the difference between the second length and the preset length of the flow detection metadata. The header checksum in the IPv4 header field of the second IPv4 packet is updated from the current second header checksum to the first header checksum, which is calculated based on the first length.
[0050] Based on the same application concept as the method described above, this application embodiment also provides the hardware structure of the aforementioned network node, specifically as follows: Figure 7 As shown. Figure 7 As shown, the network node includes: a processor and a machine-readable storage medium; The machine-readable storage medium stores computer instructions that, when executed by the processor, perform the steps in the method described above.
[0051] For example, the aforementioned machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, messages, etc. For instance, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.
[0052] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A method for detecting flow-in-flow, characterized in that, This method is applied to network nodes in an IPv4 network, where the network node serves as the entry node. The method includes: When determining to perform flow detection based on the current first IPv4 packet, a flow detection metadata header field is added after the packet payload field of the first IPv4 packet to obtain a second IPv4 packet; the flow detection metadata header field carries flow detection information; the packet payload field carries service data. Send the second IPv4 message.
2. The method according to claim 1, characterized in that, The determination of flow-following detection based on the current first IPv4 packet specifically includes: If the service flow to which the first IPv4 packet belongs is the target flow, then check whether the sum of the packet length of the first IPv4 packet and the preset length of the following flow detection metadata header field is less than or equal to the preset transmission length threshold. If so, then flow detection is determined based on the first IPv4 packet.
3. The method according to claim 1, characterized in that, Before sending the second IPv4 packet, the method further includes: Set the Reserved Flag bit in the Flags field of the IPv4 header of the second IPv4 packet to a set value; the set value is used to indicate that the second IPv4 packet carries the following detection metadata header field.
4. The method according to claim 1, characterized in that, Before sending the second IPv4 packet, the method further includes: Modify the Total Length field in the IPv4 header of the second IPv4 packet from the first length to the second length; the second length is the sum of the first length and the preset length of the flow detection metadata.
5. The method according to claim 4, characterized in that, The IPv4 packet header fields also include header checksum; Before sending the second IPv4 packet, the method further includes: The header checksum is recalculated based on the second length to obtain the first header checksum; Update the header checksum to the first header checksum.
6. The method according to claim 1, characterized in that, The second IPv4 packet also carries a Frame Check Sequence (FCS) field; the FCS field is located after the packet payload field. The following detection metadata header field is set between the message payload field and the FCS field.
7. The method according to claim 1, characterized in that, The header fields of the following flow detection metadata carry, in ascending order of bit position, the extended flow detection type identifier Ext FM Type, the node identifier NodeMonID, the service flow identifier FlowMonID, and the following flow detection metrics.
8. The method according to claim 3, 4, or 5, characterized in that, If the network node acts as the exit node, then the following steps are further performed: Upon receiving the second IPv4 packet, the system performs statistical analysis based on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet, deletes the flow detection metadata header field after the packet payload field of the second IPv4 packet, and restores the second IPv4 packet to the first IPv4 packet.
9. The method according to claim 8, characterized in that, The step of restoring the second IPv4 packet to the first IPv4 packet specifically includes: Set the Reserved Flag bit in the Flags field of the IPv4 header of the second IPv4 packet from its current value to its initial value; Modify the Total Length field in the IPv4 header of the second IPv4 packet from the second length to the first length; the first length is the difference between the second length and the preset length of the flow detection metadata. The header checksum in the IPv4 header field of the second IPv4 packet is updated from the current second header checksum to the first header checksum, which is calculated based on the first length.
10. A flow-following detection system, characterized in that, The system includes an ingress node, an egress node, and intermediate nodes between the ingress and egress nodes of an IPv4 packet in an IPv4 network. When the ingress node determines to perform flow detection based on the first IPv4 packet, it adds a flow detection metadata header field after the packet payload field of the first IPv4 packet to obtain the second IPv4 packet. The header field of the streaming detection metadata carries streaming detection information; The message payload field carries business data; Send the second IPv4 message; After receiving the second IPv4 packet, any intermediate node continues to forward the second IPv4 packet and counts the detection data based on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet. After receiving the second IPv4 packet, the egress node performs statistical analysis on the flow detection information in the flow detection metadata header field carried by the second IPv4 packet, and performs flow detection metadata header field after deleting the packet payload field of the IPv4 packet. The node then adjusts the IPv4 packet to restore the second IPv4 packet to the first IPv4 packet.
11. A network node, characterized in that, Network nodes include: processors and machine-readable storage media; The machine-readable storage medium stores computer instructions that, when executed by the processor, perform the steps of the method as claimed in any one of claims 1 to 9.