The invention discloses a method and device for identifying an
IP address of an IDC service running illegally in a
metropolitan area network, and the method comprises the steps: S01, defining a description rule of a downlink IDC circuit port of the
metropolitan area network, and automatically discovering the downlink IDC port information of the
metropolitan area network based on the description rule; s02, the
system forms a
metropolitan area network downlink IDC port set according to the discovered IDC port information; s03, on the basis of the
Netflow data of the formed
metropolitan area network downlink IDC port set, acquiring an
IP address library for operating the IDC service in the
metropolitan area network; and S04, starting a
timer by the
system, and automatically and synchronously updating the
IP address base of the lower IDC of the metropolitan
area network every day to a flow analysis
system for analysis. According to the method and the device for identifying the IP address of the IDC service running illegally in the metropolitan
area network, the IP address of the IDC service running in the metropolitan
area network can be accurately identified through automatic analysis and manual confirmation, the method and the device have an IDC IP address learning function, manual intervention is reduced, and
rapid identification, confirmation and dynamic updating of an IDC IP address field can be realized.