17 results about "Port mirroring" patented technology

The invention discloses a data processing method of a block chain network and a related product thereof, the block chain network comprises a plurality of block chain nodes, the plurality of block chain nodes comprise block outlet nodes, the plurality of block chain nodes carry out data interaction based on a switch, the switch has a port mirror image module, and the port mirror image module is connected with the block outlet nodes. The method comprises the following steps: receiving a first data packet sent by a switch through a port mirroring module, wherein the first data packet is obtained by mirroring an obtained network data packet related to an out-block node through the port mirroring module by the switch; performing data analysis processing on the first data packet to obtain analysis data; and detecting the out-of-block node based on the analysis data to obtain a detection result which indicates the out-of-block process of the out-of-block node. By adopting the method and the device, the accuracy of detecting and processing the out-of-block node can be improved.

The application provides a DDoS attack detection method, device and system, the method comprising: capturing network card traffic data through Scapy, the network card traffic data being traffic sent to a target machine obtained from a switch through port mirroring technology; based on a pre-trained classifier, determining whether a DDoS attack will occur according to the network card traffic data, if yes, determining a malicious MAC address according to the network card traffic data based on a statistical method of a CRH algorithm, and controlling the switch to perform a filtering operation on the traffic sent to the target machine according to the malicious MAC address. The method not only has high processing efficiency, but also can accurately distinguish malicious traffic in mixed traffic, correctly detect the MAC address of a host initiating a DDoS attack, and has high detection precision.

The invention relates to the technical field of video and audio signal monitoring, in particular to a switch node port mirroring video and audio signal monitoring method, which comprises the following steps of: creating a dynamic mirroring point: creating a mirroring point at each node in a target node group based on a network topology structure, a traffic limit and a fault removal score of a candidate node; multi-dimensional data association collection: collecting mirror image flow data through the created mirror image point, collecting network equipment performance index data at the same time, and adding a synchronization timestamp mark to all the collected data; fault propagation path modeling: constructing a real-time fault propagation path model based on the network topology data and the collected fault data; and fault source automatic positioning: analyzing the fault propagation path model, and determining the initial occurrence position and time of the fault. The device can dynamically construct the mirror image, accurately determine the fault, adaptively control the flow and visualize, and efficiently improve the operation and maintenance of the video and audio network.

The embodiment of the invention provides a micro-service architecture-oriented network security detection method and device. The method comprises the following steps of: respectively acquiring communication flow between virtual machines and a network activity track of a container through a virtual switch port mirror image and a log interface of a container platform; constructing a dynamic baseline model containing a legal communication matrix, a protocol white list and a traffic threshold; comparing the acquired data with the dynamic baseline model by adopting a real-time stream processing technology, and detecting an abnormal behavior of the container or the virtual machine; and executing response measures of different levels according to the seriousness of the abnormal behavior threat. According to the scheme, internal attack behaviors such as container escape and transverse penetration can be effectively identified and coped with.

A computing system is provided, including a server computing device configured to execute a security service that communicates with a security agent on a client computing device via a wide area network and an on-premises network on which the client computing device is provisioned, and receive and store, at the server computing device, administrator login credentials for a router device on the on-premises network. The processor is further configured to send a monitoring command to the security agent to cause the security agent to access the router device using the administrator login credentials and configure the router device to forward network traffic received by the router device to the security agent at the client computing device via port mirroring, and receive an on-premises network traffic monitoring report from the security agent based on the network traffic forwarded to the client computing device.

The invention relates to a virtual machine agent-free IP self-healing method suitable for a hyper-converged architecture. The method comprises the following steps: dividing a self-healing IP pool based on an etcd distributed cluster, and constructing an MAC-VM asset library; aRP flow is monitored through an OpenvSwitch port mirror image, and IP conflicts are accurately recognized in combination with a multiple confirmation mechanism; locating a conflicting virtual machine and a corresponding CephRBD disk path according to the conflicting MAC address; the IP configuration mode of the virtual machine is judged by integrating the multi-source data; determining a repair target according to the priority of the operation state priority, the configuration mode subordinate and the response time bottom; executing a hierarchical repair strategy for the DHCP mode, the static agency-free mode and the static agency mode; and the repair effect is ensured through repair verification and a closed loop mechanism, and rollback operation is executed when the repair effect fails. The method is compatible with an agency-free environment and a DHCP and static IP mixed deployment scene, permanent restoration of IP conflicts is achieved, manual intervention is greatly reduced, the stability and autonomous ability of a hyper-fusion platform are improved, and the method has the advantages of being safe and reliable in data, compatible in production-level operation and the like.

The invention discloses a scheduling adaptation method for an industrial PON and an industrial Ethernet, and the method comprises the steps: constructing a protocol-optical resource mapping semantic model, abstracting the communication demands of different industrial Ethernet protocols into a unified data structure containing a time-sensitive service level, a flow feature and a communication period parameter, mapping to generate corresponding scheduling demand parameters required by the industrial PON management platform; target traffic is sensed in real time based on a port mirroring technology, protocol identification is carried out by using a protocol-optical resource mapping semantic model, the bandwidth demand and transmission time sequence characteristics of industrial Ethernet service flow are further analyzed, the analyzed bandwidth demand and transmission time sequence characteristics are mapped into scheduling demand parameters of an industrial PON, and the scheduling demand parameters of the industrial PON are mapped to the target traffic. And the industrial PON management platform generates and issues a deterministic scheduling instruction based on the received scheduling demand parameters, so that deterministic transmission service is realized. According to the invention, low-delay, low-jitter and high-reliability transmission service can be provided for the multi-protocol industrial equipment.

A repeater usable as one of a plurality of repeaters (11-15) forming a communication network (1) together with a monitoring device (30), wherein the plurality of repeaters (11~15) each have a plurality of ports (P0~P7), wherein at least one of the plurality of ports (P0~P7) in each of the plurality of repeaters (11~15) is connected to a port of another repeater, and one of the plurality of repeaters (11~15) performs port mirroring to one of its own plurality of ports (P0~P7), wherein a mirror frame duplicated by the port mirroring is transferred to the monitoring device (30) monitoring the mirror frame, wherein the mirror frame contains a header, a type, and payload, wherein the header contains a sender media access control address, sender MAC address, wherein the repeater comprises: a first transfer unit (10a, S140~S160) configured to to add port information to the mirror frame as transfer route information, the port information being indicative of (i) one port among the plurality of ports (P0~P7) at the repeater acting as a monitoring port at which the port mirroring is performed, and (ii) another port other than the one port among the plurality of ports (P0~P7) at the repeater acting as a first destination port from which the mirror frame is output and transferred to the monitoring device (30), and output the mirror frame to which the transfer route information from the first destination port has been added, when the repeater performs port mirroring and is monitored by the monitoring device (30), and a second transfer unit (10b, S170∼S200) configured to add the port information to the mirror frame as the transfer route information, wherein the port information is indicative of (iii) one port among the plurality of ports (P0~P7) of the repeater at which the mirror frame is received from the other repeater, and (iv) another port, different from the one port, among the plurality of ports (P0~P7) at the repeater acting as a subsequent destination port from which the received mirror frame is output and transferred to the monitoring device (30), and output the received mirror frame to which the transfer route information has been added from the subsequent destination port, if the repeater does not perform port mirroring and is not monitored by the monitoring device (30).

The invention relates to remote switch port mirroring in a network. An example network switch includes: a hardware platform; a first switch port supported by the hardware platform and configured to receive a first network traffic of a network; and switch logic supported by the hardware platform, configured to replicate the first network traffic received by the first switch port to generate mirrored traffic for a second switch port in the network, the switch logic further configured to embed metadata in the mirrored traffic, the metadata includes information external to the first network traffic, and the switch logic is further configured to send the mirrored traffic to a device connected to the second switch port.

The invention belongs to the technical field of network abnormal traffic detection, and particularly provides a local area network exit abnormal traffic detection method and device, which utilizes the port mirroring function of the existing core network switching equipment to losslessly copy exit traffic to an independent mirroring port in a bypass mode, thereby improving the detection efficiency. And real-time deep analysis is carried out on the mirror image traffic by means of general computing equipment provided with traffic analysis software, abnormal traffic is accurately identified based on a threat feature rule base, and an infected terminal in a local area network is rapidly positioned according to source address information of the abnormal traffic. By means of the arrangement, monitoring of the outlet flow of the local area network is achieved, the cost is low, the blind area problem caused by the fact that professional safety equipment cannot be deployed in scenes such as county-level branches due to cost limitation is solved, and the high-standard requirement of industries such as insurance for network safety can be met.

The invention relates to an embedded equipment network fault positioning device based on multistage signal acquisition and analysis, and belongs to the technical field of embedded network fault diagnosis. The device comprises: 1) a physical layer signal acquisition module for acquiring a physical signal state of a network card through a PHY register direct reading circuit; 2) a drive loopback test module which integrates a hardware packet generator and a drive injection interface to realize a protocol stack bypass test; 3) the protocol layer analysis module monitors a device network protocol stack and generates an ARP verification instruction; 4) the switch control module dynamically configures a port mirror image through a hardware-level SNMP engine, and configures a dual-channel evidence collector at the same time; according to the device, the problem that a traditional method needs to be matched with multiple devices is solved, the network card / switch fault can be rapidly positioned through a single device, the diagnosis accuracy of the device is larger than 96%, and the response time does not exceed 2 seconds.

This application relates to an online testing method for DCS network load and dual-network switching performance. The method includes: responding to a unit shutdown and a signal where field I / O signals are securely isolated, generating and activating a batch of temporary test points in at least one pair of controllers in the DCS for network-wide broadcasting to simulate peak network load; when the peak network load exceeds a preset load threshold, forcibly triggering a primary / backup switching operation between the DCS's A and B networks; collecting traffic data from the A and B networks via switch port mirroring; recording application layer service data within the DCS; and analyzing network switching performance indicators based on the traffic and service data. This application solves the problem of inaccurately measuring the operating status of thermal power generating units, and the network-wide broadcasting of batch temporary test points can reproduce the communication characteristics of the DCS under full load or even overload conditions.

The present application relates to a virtual machine agentless IP self-recovery method suitable for super-converged architecture, divides self-recovery IP pool and constructs MAC-VM asset library based on etcd distributed cluster; through OpenvSwitch port mirror listening ARP flow, combines multiple confirmation mechanism to accurately identify IP conflict; according to conflict MAC address, locates conflict virtual machine and corresponding CephRBD disk path; comprehensively judges virtual machine IP configuration mode according to multiple source data; according to running state priority, configuration mode second, response time bottom-up priority, determines repair target; according to DHCP mode, static agentless mode, static agent mode, executes hierarchical repair strategy; through repair verification and closed loop mechanism, ensures repair effect, and executes rollback operation when failing.The present application is compatible with agentless environment and DHCP and static IP mixed deployment scene, realizes permanent repair of IP conflict, greatly reduces manual intervention, improves stability and autonomy of super-converged platform, and has advantages of data safety and reliability, production level operation compatibility and the like.

The invention discloses an IMS (IP Multimedia Subsystem) scheduling system for encrypting SIP (Session Initiation Protocol) signaling call mirror image recording, and belongs to the technical field of communication. According to the system, a recording service is signed for a terminal through a network management unit, and an encrypted call signaling is routed to a scheduling server by a core network session control module according to a triggering rule. The scheduling server serves as a control and media proxy core and executes the key steps that the media forwarding gateway is controlled to establish a set of parallel and complete plaintext SIP signaling sessions; meanwhile, the encrypted media stream from the scheduling terminal is decrypted and re-packaged into a plaintext RTP stream, and then the plaintext RTP stream is sent to the media forwarding gateway. And the network switch mirroring all the plaintext communication data on the media forwarding gateway to a recording server to complete recording. According to the invention, a set of parallel plaintext mirror image channel is innovatively constructed in the encrypted call environment, the technical problem that the encrypted SIP signaling call cannot be recorded in the existing port mirror image mode is solved, and the compatibility and practicability of the system are remarkably improved.

The technical scheme of the invention discloses a method for realizing and testing a simulation model of a configurable multi-port two-layer Ethernet switch. The invention discloses an implementation method for constructing a high-fidelity virtual Ethernet switch model on a universal host and a method for testing the implemented model. The virtual switch model realized by the invention can simulate the working characteristics of a real two-layer Ethernet switch in a universal host environment, and covers functional modules of interface management, virtual local area network (VLAN), two-layer forwarding, multicast, spanning tree, link aggregation, port mirroring and the like.

The invention discloses an IPSEC (Internet Protocol Security) message mirroring method and IPSEC message mirroring equipment. The method comprises the following steps: step 1, configuring a new command; 2, the IPSEC encryption module judges whether the command in the step 1 is configured or not before encryption, and if the command is not configured, original process encryption is carried out and is kept unchanged; step 3, if the command in the step 1 is configured; after IPSEC encryption, copying an original message to a cache, and continuing to encrypt the original message; if the encryption process fails or is abnormally discarded, the message is discarded; the cache is emptied, and the copied message is also discarded; step 4, if the encryption is normal, performing port mirroring processing on the cached message before encryption at the last step of sending the IPSEC encrypted message at the interface, and sending the message to a target mirroring port; and after mirroring, the cache is emptied for cyclic caching of the next IPSEC original message. According to the invention, an accurate positioning method can be provided when the SDWAN service has a fault, and the fault can be positioned in time.

An example network switch includes: a hardware platform; a first switch port, supported by the hardware platform, configured to receive first network traffic for a network; and switch logic, supported by the hardware platform, configured to copy the first network traffic received by the first switch port to generate mirrored traffic for a second switch port in the network, the switch logic further configured to embed metadata into the mirrored traffic, the metadata including information extrinsic to the first network traffic, the switch logic further configured to send the mirrored traffic to a device connected to the second switch port.