CN114553798B - Traffic mirroring method, device, electronic equipment, medium and product - Google Patents

Abstract

The invention provides a flow mirror image method, a device, electronic equipment, a medium and a product, wherein the flow mirror image method comprises the following steps: obtaining virtual switch information corresponding to all virtual switches in a virtualized operating system; according to the virtual switch information, respectively creating mirror image port groups in a promiscuous mode for each virtual switch in a virtualized operating system; setting a virtual network card for an IDS virtual machine which is deployed in advance in a virtualized operating system according to the virtual switch information, and respectively connecting the set virtual network card with mirror image port groups of all virtual switches in the virtualized operating system; the IDS virtual machine obtains the flow of all service virtual machines in the virtualized operating system through the mirror image port group connected with the virtual network card. The invention can complete the flow mirror configuration in the IDS virtual machine network card setting process without manually configuring each network card, thereby reducing a great deal of complicated manual configuration work.

Description

Traffic mirroring method, device, electronic equipment, medium and product

Technical Field

The present invention relates to the field of data communication monitoring technology, and in particular to a traffic mirroring method, device, electronic equipment, medium and product.

Background technique

Traffic mirroring is to copy part or all of the data involved in one or more ports on a device to another port, and judge and analyze whether the network is secure based on the copied data. If malicious traffic is detected, the corresponding device can be quickly located.

At present, in the vpshere environment, traffic mirroring is mainly divided into port mirroring and port group promiscuous mode mirroring. Among them, port mirroring is to forward the data traffic of one or more source virtual ports in the virtual machine to a destination virtual port through a switch or router, and monitor the source virtual port in real time through the destination virtual port. However, port mirroring only supports distributed switches, and the implementation of its traffic mirroring requires the pre-configuration of the virtual network card of each virtual machine so that the virtual machine and the switch are connected. When there are too many virtual machines, they need to be manually configured one by one, which is too cumbersome and wastes time and energy.

Port group promiscuous mode mirroring supports both distributed switches and standard switches, but there are still too many configuration steps in the interface configuration process, and the overall configuration is also relatively cumbersome.

Therefore, how to simplify the configuration steps in the traffic mirroring process is a technical problem that needs to be solved urgently.

Summary of the invention

The present invention provides a traffic mirroring method, device, electronic equipment, medium and product to solve the above-mentioned defects.

The present invention provides a traffic mirroring method, comprising: obtaining virtual switch information corresponding to all virtual switches in a virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple business virtual machines; according to the virtual switch information, creating a mirror port group in a promiscuous mode for each of the virtual switches in the virtualized operating system, wherein the mirror port group in the promiscuous mode is used to obtain traffic mirroring on the port group on the virtual switch; according to the virtual switch information, setting a virtual network card for an IDS virtual machine pre-deployed in the virtualized operating system, and connecting the set virtual network card to the mirror port group of each virtual switch in the virtualized operating system; the IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

According to a traffic mirroring method provided by the present invention, the virtual switch is one or both of a VSphere distributed switch and a VSphere standard switch.

According to a traffic mirroring method provided by the present invention, the step of obtaining virtual switch information corresponding to each of all virtual switches in a virtualized operating system includes: calling an application programming interface in VMware vSphere for obtaining virtual switch information to obtain virtual switch information corresponding to each of all virtual switches in the virtualized operating system.

According to a traffic mirroring method provided by the present invention, a mirror port group in promiscuous mode is created for each virtual switch in the virtualized operating system, including: calling an application programming interface for creating a mirror port group in VMware vSphere, and creating a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system.

According to a traffic mirroring method provided by the present invention, setting a virtual network card for an IDS virtual machine pre-deployed in the virtualized operating system includes: calling an application programming interface in VMware vSphere for adding a virtual network card, and setting a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system.

According to a traffic mirroring method provided by the present invention, the setting of the virtual network card and the mirror port groups of each virtual switch in the virtualized operating system are connected respectively, including: calling the application programming interface for network card configuration in VMware vSphere, and connecting the set virtual network card and the mirror port groups of each virtual switch in the virtualized operating system respectively.

According to a traffic mirroring method provided by the present invention, the method also includes: deploying an IDS virtual machine on a virtualized operating system.

The present invention also provides a traffic mirroring device, comprising: an information acquisition module, used to obtain virtual switch information corresponding to all virtual switches in a virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple business virtual machines; a mirror port group creation module, used to create a mirror port group in a promiscuous mode for each of the virtual switches in the virtualized operating system according to the virtual switch information, wherein the mirror port group in the promiscuous mode is used to obtain traffic mirroring on the port group on the virtual switch; a traffic acquisition module, used to set a virtual network card for an IDS virtual machine pre-deployed in the virtualized operating system according to the virtual switch information, and connect the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system respectively; the IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned traffic mirroring methods are implemented.

The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned traffic mirroring methods are implemented.

The present invention also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned traffic mirroring methods when executed by a processor.

The present invention provides a traffic mirroring method, device, electronic device, medium and product, wherein the traffic mirroring method creates a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system, and sets a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system, and then connects the virtual network card to the mirror port group respectively, so that the IDS virtual machine can obtain the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card, without the need to manually configure each network card, thereby reducing a large amount of tedious manual configuration work.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a flow chart of a traffic mirroring method according to an embodiment of the present invention;

FIG2 is a schematic diagram of implementing traffic mirroring according to an embodiment of the present invention;

FIG3 is a schematic diagram of the structure of a traffic mirroring device provided in an embodiment of the present invention;

FIG. 4 is a schematic diagram of a physical structure of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

FIG. 1 is a flow chart of a traffic mirroring method provided by an embodiment of the present invention; as shown in FIG. 1 , the traffic mirroring method may include the following steps:

Step 101: Acquire virtual switch information corresponding to all virtual switches in a virtualized operating system.

In this embodiment, the virtualized operating system is Esxi, which is an operating system of VMWare and has built-in virtualization capabilities.

The virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple service virtual machines.

FIG. 2 is a schematic diagram of implementing traffic mirroring according to an embodiment of the present invention.

As shown in Figure 2, there are m virtual switches on an Esxi, each virtual switch has n port groups, and each port group is connected to a business virtual machines (i.e., virtual machines used to process user services. Each port group can be connected to one business virtual machine or multiple business virtual machines). At this time, an Esxi is connected to m*n*a business virtual machines and processes the services on m*n*a business virtual machines at the same time.

In this step, the virtual switch information corresponding to each virtual switch can be obtained in the configuration interface of the Esxi host. The virtual switch information specifically includes information such as device ID and port ID. It can also be automatically obtained through the relevant API in VMware vSphere, without limitation.

Step 102: Create a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system according to the virtual switch information.

The difference between the mirror port group and the common port group is that the mirror port group can be set to promiscuous mode by calling VMWare vsphereAPI. Promiscuous mode is a feature of the vsphere port group. The mirror port group set to promiscuous mode can receive the traffic mirroring of all business virtual machines connected to the ports of other port groups.

The port group on the virtual switch refers to the organizational unit on the VSphere software switch. A virtual switch can have multiple port groups. A port group has multiple ports. The virtual network card of the business virtual machine is connected to one of the ports.

In this step, you can set up mirror port groups for n port groups on VMware vSphere Distributed Switch based on m virtual switch information. Specifically, first select the port mirroring session type for a ports on the port group, then specify the port mirroring name and session details (such as a description of the mirrored port, etc.), then select the port mirroring source, select the traffic source and traffic direction for the mirrored port, and finally select the port or uplink as the mirroring target of the mirrored port. You can also automatically create a mirror port group for each virtual switch through the relevant API in VMware vSphere.

Step 103, according to the virtual switch information, setting a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system, and connecting the set virtual network card to the mirror port group of each virtual switch in the virtualized operating system respectively;

The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

Among them, the IDS virtual machine deployed on the virtualized operating system Esxi is a virtual machine used to implement the IDS function (intrusion detection).

In this step, according to the information of m virtual switches, m virtual network cards are added to the IDS virtual machine, and the added m virtual network cards are connected to the mirror port groups of each virtual switch respectively. At this time, the IDS virtual machine can obtain the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card, that is, one IDS virtual machine can obtain the traffic on m*n*a business virtual machines.

In addition, the above virtual network cards can be added manually in the virtual network editor in the VMware virtual machine software, or m virtual network cards can be automatically added to the IDS virtual machine through the relevant API in VMware vSphere.

The traffic mirroring method provided in the embodiment of the present invention creates a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system, and sets a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system, and then connects the virtual network card to the mirror port group respectively, so that the IDS virtual machine can obtain the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card. The traffic mirroring configuration can be completed in the IDS virtual machine network card setting process, and there is no need to manually configure each network card, thereby reducing a lot of tedious manual configuration work.

Furthermore, the virtual switch is one or both of a VSphere distributed switch and a VSphere standard switch, that is, the above-mentioned m virtual switches can all be VSphere distributed switches, or all can be VSphere standard switches, or the m virtual switches can be composed of b VSphere distributed switches and c VSphere standard switches.

The VSphere distributed switch is located in the VMkernel and is a virtual switch that spans multiple associated Esxi hosts. It is responsible for managing the traffic between virtual machines and the VMkernel. In addition, since the VSphere distributed switch is built on the basis of vCenter Server, the network of all associated Esxi hosts can be managed and monitored by configuring the distributed switch.

The VSphere standard switch is also located in the VMkernel. It is mainly used to provide network connections between hosts and virtual machines and manage virtual machine traffic. The standard switch can bridge internal traffic between virtual machines in the same VLAN and link to the outside through uplinks (one or more physical network cards). The difference from the above-mentioned VSphere distributed switch is that the VSphere standard switch only runs on a single Esxi host.

The traffic mirroring method provided by the embodiment of the present invention can implement traffic mirroring configuration for both types of virtual switches, namely, VSphere distributed switches and VSphere standard switches, and has a wide range of applications and versatility.

Furthermore, the obtaining of virtual switch information corresponding to all virtual switches in the virtualized operating system includes:

An application programming interface for obtaining virtual switch information in VMware vSphere is called to obtain virtual switch information corresponding to all virtual switches in the virtualized operating system.

Specifically, the virtual switch information of each virtual switch is obtained by calling an API capable of obtaining virtual switch information in VMware vSphere.

The traffic mirroring method provided by the embodiment of the present invention automatically obtains virtual switch information through an API used to obtain virtual switch information in VMware vSphere, further simplifies the configuration process of traffic mirroring, and reduces manual configuration work.

Further, the creating a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system includes:

An application programming interface for creating a mirror port group in VMware vSphere is called to respectively create a mirror port group in a promiscuous mode for each virtual switch in the virtualized operating system.

Specifically, by calling an API in VMware vSphere that can create a mirror port group, a mirror port group in a promiscuous mode is automatically created for each virtual switch.

The traffic mirroring method provided in the embodiment of the present invention automatically creates a mirror port group for each virtual switch through an API for creating a mirror port group in VMware vSphere, thereby further simplifying the configuration process of traffic mirroring and reducing manual configuration work.

Furthermore, the step of setting a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system includes:

The application programming interface for adding a virtual network card in VMware vSphere is called to set a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system.

Specifically, by calling an API in VMware vSphere that can create a mirror port group, a mirror port group in a promiscuous mode is automatically created for each virtual switch.

The traffic mirroring method provided in the embodiment of the present invention automatically creates a mirror port group for each virtual switch through an API for creating a mirror port group in VMware vSphere, thereby further simplifying the configuration process of traffic mirroring and reducing manual configuration work.

Further, the step of respectively connecting the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system includes:

The application programming interface for network card configuration in VMware vSphere is called to respectively connect the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system.

Specifically, by calling an API capable of configuring a network card in VMware vSphere, the virtual network card and the mirror port group set above are automatically configured, so that the set virtual network card is connected to the mirror port group.

The traffic mirroring method provided in the embodiment of the present invention automatically connects the set virtual network card with the mirroring port group through the API for network card configuration in VMware vSphere, thereby further simplifying the configuration process of traffic mirroring and reducing manual configuration work.

Furthermore, the method also includes: deploying an IDS virtual machine on the virtualized operating system.

Specifically, before obtaining the virtual switch information, the IDS virtual machine is first deployed on the virtualized operating system Esxi. The deployment of the IDS virtual machine can be completed through VMware vCenter, which is not limited in the present invention.

In addition, after the IDS virtual machine obtains the traffic of all the business virtual machines, it performs security detection on the traffic of all the business virtual machines, thereby timely discovering security holes, quickly locating the corresponding business virtual machines, and processing them in time.

The traffic mirroring device provided by the present invention is described below. The traffic mirroring device described below and the traffic mirroring method described above can be referred to each other.

FIG3 is a schematic diagram of the structure of a traffic mirroring device provided by an embodiment of the present invention. As shown in FIG3 , a traffic mirroring device includes:

The information acquisition module 301 is used to acquire virtual switch information corresponding to all virtual switches in the virtualized operating system.

Among them, the virtualization operating system is Esxi, which is an operating system of VMWare and has built-in virtualization capabilities.

The virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple business virtual machines. Specifically, there are m virtual switches on an Esxi, each of which has n port groups, and each port group is connected to a business virtual machine (i.e., a virtual machine used to process user business). At this time, an Esxi is connected to m*n*a business virtual machines and processes the business on m*n*a business virtual machines at the same time.

In this module, you can obtain the virtual switch information corresponding to each virtual switch in the configuration interface of the Esxi host. The virtual switch information specifically includes device ID, port ID and other information; it can also be automatically obtained through the relevant API in VMware vSphere, without limitation.

The mirror port group creation module 302 is used to create a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system according to the virtual switch information.

The difference between the mirror port group and the common port group is that the mirror port group can be set to promiscuous mode by calling VMWare vsphereAPI. Promiscuous mode is a feature of the vsphere port group. The mirror port group set to promiscuous mode can receive the traffic mirroring of all business virtual machines connected to the ports of other port groups.

The port group on the virtual switch refers to the organizational unit on the VSphere software switch. A virtual switch can have multiple port groups. A port group has multiple ports. The virtual network card of the business virtual machine is connected to one of the ports.

In this module, you can set up mirror port groups for n port groups on VMware vSphere Distributed Switch based on m virtual switch information. Specifically, first select the port mirroring session type for a ports on the port group, then specify the port mirroring name and session details (such as a description of the mirrored port, etc.), then select the port mirroring source, select the traffic source and traffic direction for the mirrored port, and finally select the port or uplink as the mirroring target of the mirrored port. You can also automatically create a mirror port group for each virtual switch through the relevant API in VMware vSphere.

The traffic acquisition module 303 is used to set a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system according to the virtual switch information, and respectively connect the set virtual network card to the mirror port group of each virtual switch in the virtualized operating system;

The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

Among them, the IDS virtual machine deployed on the virtualized operating system Esxi is a virtual machine used to implement the IDS function (intrusion detection).

In this module, according to the information of m virtual switches, m virtual network cards are added to the IDS virtual machine, and the added m virtual network cards are connected to the mirror port groups of each virtual switch respectively. At this time, the IDS virtual machine can obtain the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card, that is, one IDS virtual machine can obtain the traffic on m*n*a business virtual machines.

In addition, the above virtual network cards can be added manually in the virtual network editor in the VMware virtual machine software, or m virtual network cards can be automatically added to the IDS virtual machine through the relevant API in VMware vSphere.

The traffic mirroring device provided in the embodiment of the present invention creates a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system, and sets a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system, and then connects the virtual network card to the mirror port group respectively, so that the IDS virtual machine can obtain the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card. The traffic mirroring configuration can be completed in the IDS virtual machine network card setting process, and there is no need to manually configure each network card, thereby reducing a lot of tedious manual configuration work.

Furthermore, the virtual switch is one or both of a VSphere distributed switch and a VSphere standard switch, that is, the above-mentioned m virtual switches can all be VSphere distributed switches, or all can be VSphere standard switches, or the m virtual switches can be composed of b VSphere distributed switches and c VSphere standard switches.

The traffic mirroring device provided by the embodiment of the present invention can implement traffic mirroring configuration for both types of virtual switches, namely, a VSphere distributed switch and a VSphere standard switch, and has a wide range of applications and versatility.

Furthermore, the obtaining of virtual switch information corresponding to all virtual switches in the virtualized operating system includes:

An application programming interface for obtaining virtual switch information in VMware vSphere is called to obtain virtual switch information corresponding to all virtual switches in the virtualized operating system.

Specifically, the virtual switch information of each virtual switch is obtained by calling an API capable of obtaining virtual switch information in VMware vSphere.

The traffic mirroring device provided in the embodiment of the present invention automatically obtains virtual switch information through an API used to obtain virtual switch information in VMware vSphere, further simplifies the configuration process of traffic mirroring, and reduces manual configuration work.

Further, the creating a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system includes:

An application programming interface for creating a mirror port group in VMware vSphere is called to respectively create a mirror port group in a promiscuous mode for each virtual switch in the virtualized operating system.

Specifically, by calling an API in VMware vSphere that can create a mirror port group, a mirror port group in a promiscuous mode is automatically created for each virtual switch.

The traffic mirroring device provided in the embodiment of the present invention automatically creates a mirror port group for each virtual switch through an API for creating a mirror port group in VMware vSphere, thereby further simplifying the configuration process of traffic mirroring and reducing manual configuration work.

Furthermore, the step of setting a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system includes:

The application programming interface for adding a virtual network card in VMware vSphere is called to set a virtual network card for the IDS virtual machine pre-deployed in the virtualized operating system.

Specifically, by calling an API in VMware vSphere that can create a mirror port group, a mirror port group in a promiscuous mode is automatically created for each virtual switch.

The traffic mirroring device provided in the embodiment of the present invention automatically creates a mirror port group for each virtual switch through an API for creating a mirror port group in VMware vSphere, thereby further simplifying the configuration process of traffic mirroring and reducing manual configuration work.

Further, the step of respectively connecting the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system includes:

The application programming interface for network card configuration in VMware vSphere is called to respectively connect the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system.

Specifically, by calling an API capable of configuring a network card in VMware vSphere, the virtual network card and the mirror port group set above are automatically configured, so that the set virtual network card is connected to the mirror port group.

The traffic mirroring device provided in the embodiment of the present invention automatically connects the set virtual network card with the mirroring port group through the API for network card configuration in VMware vSphere, thereby further simplifying the configuration process of traffic mirroring and reducing manual configuration work.

FIG4 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. As shown in FIG4 , the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the traffic mirroring method, including: obtaining virtual switch information corresponding to each of all virtual switches in the virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple service virtual machines;

According to the virtual switch information, a mirror port group in a promiscuous mode is created for each virtual switch in the virtualized operating system, wherein the mirror port group in the promiscuous mode is used to obtain traffic mirroring on the port group on the virtual switch;

According to the virtual switch information, a virtual network card is set for the IDS virtual machine pre-deployed in the virtualized operating system, and the set virtual network card is respectively connected to the mirror port group of each virtual switch in the virtualized operating system;

The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

On the other hand, the present invention further provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the traffic mirroring method provided by the above methods, including: obtaining virtual switch information corresponding to each of all virtual switches in a virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple service virtual machines;

According to the virtual switch information, a mirror port group in a promiscuous mode is created for each virtual switch in the virtualized operating system, wherein the mirror port group in the promiscuous mode is used to obtain traffic mirroring on the port group on the virtual switch;

According to the virtual switch information, a virtual network card is set for the IDS virtual machine pre-deployed in the virtualized operating system, and the set virtual network card is respectively connected to the mirror port group of each virtual switch in the virtualized operating system;

The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for executing traffic mirroring provided by the above methods is implemented, including: obtaining virtual switch information corresponding to each of all virtual switches in a virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple service virtual machines;

According to the virtual switch information, a mirror port group in a promiscuous mode is created for each virtual switch in the virtualized operating system, wherein the mirror port group in the promiscuous mode is used to obtain traffic mirroring on the port group on the virtual switch;

According to the virtual switch information, a virtual network card is set for the IDS virtual machine pre-deployed in the virtualized operating system, and the set virtual network card is respectively connected to the mirror port group of each virtual switch in the virtualized operating system;

The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. A traffic mirroring method, comprising: Acquire virtual switch information corresponding to each of all virtual switches in the virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple business virtual machines; According to the virtual switch information, a mirror port group in a promiscuous mode is created for each virtual switch in the virtualized operating system, wherein the mirror port group in the promiscuous mode is used to obtain traffic mirroring of service virtual machines connected to all port groups on the virtual switch; According to the virtual switch information, multiple virtual network cards are set for the IDS virtual machine pre-deployed in the virtualized operating system, and the multiple virtual network cards are respectively connected to the mirror port groups of each virtual switch in the virtualized operating system; The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card; The step of setting a plurality of virtual network cards for the IDS virtual machine pre-deployed in the virtualized operating system includes: The application programming interface for adding virtual network cards in VMware vSphere is called to set multiple virtual network cards for the IDS virtual machine pre-deployed in the virtualized operating system. 2. The traffic mirroring method according to claim 1 is characterized in that the virtual switch is one or both of a VSphere distributed switch and a VSphere standard switch. 3. The traffic mirroring method according to claim 1, wherein the step of obtaining virtual switch information corresponding to each of all virtual switches in the virtualized operating system comprises: An application programming interface for obtaining virtual switch information in VMware vSphere is called to obtain virtual switch information corresponding to all virtual switches in the virtualized operating system. 4. The traffic mirroring method according to claim 1, wherein the step of creating a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system comprises: An application programming interface for creating a mirror port group in VMware vSphere is called to respectively create a mirror port group in a promiscuous mode for each virtual switch in the virtualized operating system. 5. The traffic mirroring method according to claim 1, characterized in that the step of connecting the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system comprises: The application programming interface for network card configuration in VMware vSphere is called to respectively connect the set virtual network card to the mirror port groups of each virtual switch in the virtualized operating system. 6. The traffic mirroring method according to any one of claims 1 to 5, characterized in that the method further comprises: Deploy the IDS virtual machine on the virtualized operating system. 7. A traffic mirroring device, comprising: An information acquisition module, used to acquire virtual switch information corresponding to each of all virtual switches in a virtualized operating system; wherein the virtualized operating system is installed with multiple virtual switches, and the port groups on the multiple virtual switches are connected to multiple service virtual machines; A mirror port group creation module, used to create a mirror port group in promiscuous mode for each virtual switch in the virtualized operating system according to the virtual switch information, wherein the mirror port group in promiscuous mode is used to obtain traffic mirroring of the service virtual machines connected to all the port groups on the virtual switch; A traffic acquisition module, configured to set a plurality of virtual network cards for the IDS virtual machine pre-deployed in the virtualized operating system according to the virtual switch information, and connect the plurality of virtual network cards respectively to the mirror port groups of each virtual switch in the virtualized operating system; The IDS virtual machine obtains the traffic of all the business virtual machines in the virtualized operating system through the mirror port group connected to the virtual network card; The step of setting a plurality of virtual network cards for the IDS virtual machine pre-deployed in the virtualized operating system includes: The application programming interface for adding virtual network cards in VMware vSphere is called to set multiple virtual network cards for the IDS virtual machine pre-deployed in the virtualized operating system. 8. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the traffic mirroring method according to any one of claims 1 to 6 are implemented. 9. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the traffic mirroring method according to any one of claims 1 to 6 are implemented. 10. A computer program product, comprising a computer program, characterized in that when the computer program is executed by a processor, the steps of the traffic mirroring method according to any one of claims 1 to 6 are implemented.