[go: up one dir, main page]

WO2024159962A1 - 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质 - Google Patents

虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质 Download PDF

Info

Publication number
WO2024159962A1
WO2024159962A1 PCT/CN2023/140326 CN2023140326W WO2024159962A1 WO 2024159962 A1 WO2024159962 A1 WO 2024159962A1 CN 2023140326 W CN2023140326 W CN 2023140326W WO 2024159962 A1 WO2024159962 A1 WO 2024159962A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
mirrored
mirroring
instance
virtual
Prior art date
Application number
PCT/CN2023/140326
Other languages
English (en)
French (fr)
Inventor
郭云铃
胡西宁
廖上榜
董侠飞
Original Assignee
天翼云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天翼云科技有限公司 filed Critical 天翼云科技有限公司
Publication of WO2024159962A1 publication Critical patent/WO2024159962A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/58—Association of routers
    • H04L45/586—Association of routers of virtual routers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/76—Routing in software-defined topologies, e.g. routing between virtual machines
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Definitions

  • the present application relates to the field of communication technology, and in particular to a traffic mirroring method for a virtual instance, a traffic mirroring device for a virtual instance, a corresponding virtual machine platform, and a corresponding computer-readable storage medium.
  • traffic mirroring In the related technology of traffic mirroring, it can be manifested as determining the monitoring port corresponding to the mirror destination request based on the mirror source IP resolution of the mirror source request, and then sending the traffic request to the corresponding monitoring port to realize traffic mirroring.
  • the traffic mirroring realized by it cannot distinguish the traffic mirroring, which is not conducive to the traffic analysis and audit of the inbound and outbound traffic.
  • embodiments of the present application are proposed to provide a traffic mirroring method for a virtual instance, a traffic mirroring device for a virtual instance, a corresponding virtual machine platform, and a corresponding computer-readable storage medium that overcome the above problems or at least partially solve the above problems.
  • the embodiment of the present application discloses a traffic mirroring method of a virtual instance, which is applied to a virtual machine platform.
  • the virtual machine platform includes a computing node of the virtual instance.
  • the method includes:
  • the mirrored traffic packets are sent to the destination terminal so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic packets.
  • obtaining the constructed traffic flow table for the mirrored traffic further includes:
  • the configured traffic mirroring information is obtained, and a traffic flow table for the mirrored traffic is constructed using the traffic mirroring information; wherein the traffic mirroring information includes at least traffic direction information, traffic mirroring instance information, terminal node information, traffic filtering policy information, and user-defined label information.
  • the mirrored traffic includes inbound mirrored traffic for inbound traffic and outbound mirrored traffic for outbound traffic.
  • the traffic flow table for the mirrored traffic is constructed using the traffic mirroring information, including:
  • the traffic mirroring instance information, traffic direction information, terminal node information, traffic filtering policy information, and user-defined label information are used to construct the inbound flow table for the incoming mirrored traffic and the outbound flow table for the outgoing mirrored traffic. Traffic flow table.
  • the virtual instance is located in a virtual private cloud, and the virtual private cloud has a corresponding traffic mirroring gateway instance created in the mirroring gateway, and the mirroring gateway group for carrying different traffic mirroring gateway instances includes multiple mirroring gateway nodes.
  • generating a mirrored traffic packet according to the mirrored traffic and the traffic flow table includes:
  • the mirrored traffic and traffic flow table are received through the mirrored gateway node of the mirrored gateway group;
  • the routing table is obtained through the mirror gateway node, and the mirror traffic message is processed according to the routing table and the traffic flow table to generate a mirror traffic packet.
  • the mirrored traffic message is processed according to the routing forwarding table and the traffic flow table to generate a mirrored traffic packet, including:
  • the traffic mirroring information of the response traffic flow table is matched successfully with the routing forwarding information respectively, and the routing forwarding information is used to encapsulate the mirrored traffic message to obtain a mirrored traffic packet.
  • the method before generating the mirrored traffic packet according to the mirrored traffic and the traffic flow table, the method further includes:
  • An access request sent by a user destination terminal is received; wherein the access request includes a virtual instance to be accessed, and the virtual instance has a corresponding traffic mirroring gateway instance created in the mirroring gateway.
  • sending the mirrored traffic message to the destination terminal includes:
  • a destination terminal node of the destination terminal is determined based on the destination gateway address, and the mirrored traffic message is sent to the destination terminal node.
  • the mirrored traffic message is sent to the destination terminal node, including:
  • the embodiment of the present application also discloses a traffic mirroring method of a virtual instance, which is applied to a destination terminal, the destination terminal is communicatively connected with a virtual machine platform, and the virtual machine platform includes a computing node of the virtual instance, and the method includes:
  • a mirrored traffic message sent by a computing node of the virtual instance;
  • the mirrored traffic message is generated based on the mirrored traffic and the traffic flow table, wherein the mirrored traffic is obtained by mirroring the inbound and outbound traffic of the virtual instance;
  • the traffic flow table is constructed based on the configured traffic mirroring information, and the traffic mirroring information includes at least traffic direction information and/or traffic mirroring instance information;
  • Distinguish mirrored traffic based on the traffic direction information in the traffic flow table of the mirrored traffic packet including:
  • the inbound mirror traffic and outbound mirror traffic of the virtual instance corresponding to the traffic mirroring instance information are analyzed;
  • the mirrored traffic of the virtual instances corresponding to different traffic mirroring instance information is distinguished, and the mirrored traffic of the different virtual instances is analyzed.
  • the embodiment of the present application also discloses a traffic mirroring device for a virtual instance, which is applied to a virtual machine platform.
  • the virtual machine platform includes a computing node of the virtual instance.
  • the device includes:
  • a module for acquiring traffic to be mirrored used for acquiring traffic to be mirrored of a virtual instance, where the traffic to be mirrored of the virtual instance includes inbound traffic and/or outbound traffic;
  • a traffic mirroring module is used to mirror the inbound and outbound traffic of the virtual instance on the computing node of the virtual instance to obtain mirrored traffic;
  • a mirrored traffic message generation module used to obtain the traffic flow table constructed for the mirrored traffic, and generate a mirrored traffic message according to the mirrored traffic and the traffic flow table;
  • the mirrored traffic message sending module is used to send the mirrored traffic message to the destination terminal so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • the embodiment of the present application also discloses a traffic mirroring device of a virtual instance, which is applied to a destination terminal, the destination terminal is communicatively connected with a virtual machine platform, and the virtual machine platform includes a computing node of the virtual instance, and the device includes:
  • a mirrored traffic message receiving module used for receiving a mirrored traffic message sent by a computing node of a virtual instance; the mirrored traffic message is generated based on the mirrored traffic and a traffic flow table, wherein the mirrored traffic is obtained based on mirroring the inbound and outbound traffic of the virtual instance;
  • the mirrored traffic distinguishing module is used to distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic messages.
  • the embodiment of the present application also discloses a virtual machine platform, including: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, and when the computer program is executed by the processor, a traffic mirroring method of any virtual instance is implemented.
  • the embodiment of the present application also discloses a computer-readable storage medium, on which a computer program is stored.
  • a computer program is stored.
  • the computer program is executed by a processor, a traffic mirroring method of any virtual instance is implemented.
  • the inbound and outbound traffic of the virtual instance is mirrored at the computing node of the virtual instance to obtain the mirrored traffic, and the traffic flow table constructed for the mirrored traffic can be obtained, and the mirrored traffic message is generated according to the mirrored traffic and the traffic flow table, and the mirrored traffic message is sent to the destination terminal, so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • the relevant information of the virtual instance mirrored traffic is designed into the message, and sent from the computing node through the message carrying method, the traffic of the virtual instance is mirrored while occupying the least data center, and the mirrored traffic is sent to the designated terminal node, and the mirrored traffic is distinguished at the terminal node.
  • the routing forwarding table on the mirrored gateway can be designed according to the characteristics of the mirrored traffic message sent by the computing node to achieve high-speed processing of the mirrored message.
  • FIG1 is a flow chart of a flow mirroring method embodiment of a virtual instance of the present application.
  • FIG2 is a schematic diagram of constructing an outbound flow table for a virtual instance provided in an embodiment of the present application
  • FIG3 is a schematic diagram of constructing an inflow flow table of a virtual instance provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of the logical network distribution of a virtual machine instance on a public cloud provided in an embodiment of the present application
  • FIG5 is a flowchart of another embodiment of a traffic mirroring method for a virtual instance of the present application.
  • FIG. 6 is a schematic diagram of an application scenario of traffic mirroring of a virtual instance provided in an embodiment of the present application
  • FIG. 7 is a block diagram of a flow mirroring device embodiment of a virtual instance of the present application.
  • FIG8 is a structural block diagram of another virtual instance of a traffic mirroring device embodiment of the present application.
  • the embodiment of the present application implements traffic mirroring based on the UDP (User Datagram Protocol) protocol in the public cloud, specifically through the traffic flow table Open vSwitch encapsulated by the VXLAN Tunnel.
  • UDP User Datagram Protocol
  • the core idea of the embodiment of the present application is to mirror the inbound and outbound traffic of the virtual instance at the computing node of the virtual instance to obtain the mirrored traffic, and to obtain the traffic flow table constructed for the mirrored traffic, and to generate the mirrored traffic message according to the mirrored traffic and the traffic flow table, and to send the mirrored traffic message to the destination terminal, so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • the user can more accurately and flexibly mirror the traffic of the cloud instance, and the traffic mirroring process is completed at the computing node where the virtual instance is located, which greatly saves the network bandwidth resources of the data center, and does not affect the main process of the user's virtual instance.
  • the user's mirrored traffic can be distributed to any designated terminal node (as long as the three-layer network is reachable) through configuration, and the traffic of the virtual instance is mirrored while occupying the least data center, and the mirrored traffic is sent to the designated terminal node, and the mirrored traffic is distinguished at the terminal node.
  • the traffic mirroring gateway sends the mirrored traffic message to the destination terminal node based on the UDP encapsulated double-layer tunnel message according to the routing forwarding table.
  • the routing forwarding table on the mirroring gateway according to the characteristics of the mirrored traffic message sent by the computing node, high-speed processing of the mirrored message is achieved.
  • the filtering strategy of the traffic filter configured by the user can also be completed on the computing node to filter out the unnecessary traffic at the source end. The filter strategy supports accepting and discarding operations.
  • a flowchart of a method for traffic mirroring of a virtual instance of the present application is shown, which is applied to a virtual machine platform, and the virtual machine platform includes a computing node of a virtual instance, and specifically may include the following steps:
  • Step 101 obtaining the traffic to be mirrored of the virtual instance, where the traffic to be mirrored of the virtual instance includes inbound traffic and/or outbound traffic;
  • Traffic mirroring refers to the process of copying the traffic of a monitored port to a specific monitoring port for the purpose of traffic monitoring. Specifically, it can be manifested as the process of copying the traffic of a virtual instance to a destination terminal.
  • the direction of the virtual instance mirror traffic can be designed into the message by designing and arranging the traffic of the computing node, and by implementing the mirroring of the mirror traffic and the generation of the mirror traffic message at the computing node, and the message is sent from the computing node through the message carrying method, so as to occupy the least space in the data center.
  • the traffic of the virtual instance can be mirrored, the mirrored traffic can be sent to the specified terminal node, and the mirrored traffic can be distinguished at the terminal node.
  • the traffic to be mirrored of the virtual instance may first be acquired, and the acquired traffic to be mirrored of the virtual instance may include the inbound traffic and/or outbound traffic of the virtual instance.
  • the inbound traffic of the virtual instance may refer to access traffic or request traffic, etc.
  • the outbound traffic may refer to response traffic and requested data, information, etc., which is not limited in the embodiments of the present application.
  • Step 102 mirroring the inbound and outbound traffic of the virtual instance at the computing node of the virtual instance to obtain mirrored traffic;
  • the incoming and outgoing traffic of the virtual instance can be mirrored on the computing node of the virtual instance to obtain mirrored traffic for the incoming traffic and mirrored traffic for the outgoing traffic.
  • the traffic mirroring process is completed on the computing node where the virtual instance is located.
  • the computing node can refer to the host node to save network bandwidth resources in the data center.
  • the computing node may also obtain the traffic filter filtering policy configured by the user, and based on the traffic filter filtering policy configured by the user, filter out the unnecessary traffic at the source end so as to mirror the traffic of the filtered virtual instance.
  • the filter policy may support accept and discard operations.
  • Step 103 obtaining the constructed traffic flow table for the mirrored traffic, and generating a mirrored traffic message according to the mirrored traffic and the traffic flow table;
  • the traffic flow table constructed for the mirrored traffic can be obtained to generate mirrored traffic packets based on the mirrored traffic and the traffic flow table, so as to design the routing forwarding table on the mirrored gateway according to the characteristics of the mirrored traffic packets sent by the computing nodes, so as to realize high-speed processing of the mirrored packets.
  • the traffic flow table for the mirrored traffic is obtained mainly by obtaining the configured traffic mirroring information, and then using the traffic mirroring information to construct the traffic flow table for the mirrored traffic, so as to design and arrange the traffic of the computing node Open vSwitch and optimize the flow table on the bridge.
  • the traffic mirroring information at least includes traffic mirroring instance information, terminal node information, traffic direction information, traffic filtering policy information, and user-defined label information, etc., so as to mirror the network traffic of the user virtual instance to the designated terminal node based on the traffic mirroring instance information, traffic direction information, terminal node information, traffic filtering policy information, and user-defined label information (such as traffic differentiation label, length of data packet intercepted after mirroring, etc.) configured by the user, so that the traffic of the mirrors of different virtual instances can be distinguished at the same terminal node (if the terminal node information of different virtual instances is configured as the same) according to the user-defined label information, so that the traffic message quintuple of the virtual instance is the same. That is, the relevant information of the aforementioned traffic mirroring can be designed into the message, so that the relevant information can be sent to the computing node in the form of message carrying.
  • the mirrored traffic includes inbound mirrored traffic for inbound traffic and outbound mirrored traffic for outbound traffic
  • traffic mirroring instance information traffic direction information, terminal node information, and traffic
  • the filtering policy information and the user-defined label information are used to construct an inbound flow table for inbound mirrored traffic and an outbound flow table for outbound mirrored traffic.
  • FIG. 2 a schematic diagram of constructing an outbound flow table for a virtual instance provided by an embodiment of the present application is shown, which can be mainly manifested as adding three tables again in the normally arranged flow table Pipeline, where table refers to a table for storing flow table entries. It should be noted that the table id can be determined according to actual conditions, and the embodiment of the present application does not limit this.
  • table7 table8, and table180.
  • table0, table6, table10 and other tables can perform normal flow table processing procedures
  • each outbound flow table may be as follows:
  • reg2 is the flag for whether to mirror (the specific value of reg2 can be set based on the policy that the inbound value is 1 and the outbound value is 2)
  • the port that needs to be mirrored passes the mirrored traffic filter table, and the priority is set higher than the normal traffic. Assume that the priority of the port that needs to be mirrored is set to 100, and the priority of the port that does not need to be mirrored is set to 10.
  • the relevant operations of table:7 are executed, that is, the function processing filter strategy in the process of mirroring traffic, so as to filter out the unnecessary traffic at the source end based on the traffic filtering strategy information.
  • #By default normal traffic does not need to be sent through mirror traffic. That is, at this time, you can perform the relevant operations of table:10 and perform normal flow table processing.
  • #table 7 function processing filter strategy, based on the action set reg1 flag to determine whether mirroring is needed, assuming 0x1 needs mirroring, if the mirroring switch of the port is turned off, the flow table of reg1 is set not to be sent.
  • FIG. 3 a schematic diagram of constructing an inflow flow table of a virtual instance provided in an embodiment of the present application is shown, which is mainly manifested in adding three tables to the normally arranged flow table Pipeline, where table refers to a table for storing flow table entries. It should be noted that the table id can be determined according to actual conditions, and the embodiment of the present application does not limit this.
  • each flow table in the specific inbound direction may be as follows:
  • the port that needs to be mirrored passes through the mirror traffic filter table, and the priority is set higher than the normal traffic. Assume that the priority of the port that needs to be mirrored is set to 100, and the priority of the port that does not need to be mirrored is set to 10.
  • the relevant operations of table:87 are executed, that is, the function processing filter strategy during the mirror traffic process, so that the unnecessary traffic can be filtered out at the source end based on the traffic filtering strategy information.
  • the mirroring of the inbound and outbound traffic of the above virtual instance can be selected based on the user's actual situation at the mirroring point (such as table6 and table86). Generally speaking, the mirroring point of the outbound traffic will be selected after passing the port's Qos speed limit flow table and before passing the security group flow table; the mirroring point of the inbound traffic will be selected after passing the security group and port's Qos speed limit traffic. In addition, the location and value of carrying the direction mark of the mirrored traffic to the message can also be freely selected.
  • the direction can be carried in the physical address mac of the source end of the message memory, the outbound mark value is set to 0x4163e, and the inbound mark value is set to 0x2163e.
  • This embodiment of the present application does not limit this.
  • the virtual instance is located in a virtual private cloud
  • the virtual private cloud has a corresponding traffic mirror gateway instance created in the mirror gateway
  • the mirror gateway group for carrying different traffic mirror gateway instances includes multiple mirror gateway nodes.
  • virtual instance 1 i.e., VM1
  • virtual instance 2 i.e., VM2
  • VPC1 Virtual Private Cloud
  • each VPC can create a traffic mirroring gateway instance on the mirroring gateway (for example, traffic mirroring gateway instance 1mrgw-VPC1, traffic mirroring gateway instance 2mrgw-VPC2, etc.), and a mirroring gateway group can contain multiple mirroring gateway nodes to carry traffic mirroring gateway instances of different VPCs, where different mirroring gateway nodes can be implemented based on multiple physical servers as nodes.
  • the mirrored traffic and the traffic flow table can be received through the mirrored gateway node of the mirrored gateway group, and then the mirrored traffic message is generated by using the mirrored traffic and the traffic flow table.
  • the routing forwarding table can also be obtained through the mirrored gateway node, and the mirrored traffic message is processed according to the routing forwarding table and the traffic flow table to generate a mirrored traffic packet.
  • the specific message processing process can be manifested as obtaining the traffic mirroring information of the traffic flow table and obtaining the routing forwarding information of the routing forwarding table, and then responding to the successful matching of the traffic mirroring information of the traffic flow table with the routing forwarding information, and using the routing forwarding information to encapsulate the mirrored traffic message to obtain a mirrored traffic packet.
  • the routing forwarding table can be obtained based on the routing forwarding information of the matching domain and the routing forwarding information of the action domain.
  • the routing forwarding information of the matching domain is mainly used to match the traffic mirroring information of the traffic flow table
  • the routing forwarding information of the action domain is mainly used to implement the message sending operation when the match is successful.
  • the routing forwarding information of the matching domain may include Vni (Vni can be a user ID similar to VLAN ID for identifying a Virtual Network Instance), traffic direction, port physical address portmac information.
  • Vni can be a user ID similar to VLAN ID for identifying a Virtual Network Instance
  • traffic direction can be matched with the Vni, traffic direction, and portmac information in the routing forwarding table. If the match is unsuccessful, the message will be discarded.
  • the data message hits the routing forwarding table, it can be forwarded according to the routing forwarding information of the routing forwarding table, and the mirrored traffic message can be encapsulated and sent out.
  • the routing table may be as shown in Table 1 below:
  • the routing forwarding information of the matching domain may include the internal destination physical address InnerDstMac, the internal source physical address InnerSrcMac, the internal source logical address innerSrcIp, the internal destination logical address innerDstIp, the internal virtual network instance identifier InnerVni, the external destination logical address OuterDstIp and the external network instance identifier OuterVni.
  • it can be mainly manifested as encapsulating the intermediate layer VXLAN information according to the InnerDstMac, InnerSrcMac, innerSrcIp, innerDstIp, and InnerVni of the action domain.
  • the message is sent from the traffic mirroring gateway to the mirroring terminal node.
  • InnerVni can be defined by the user and is used to distinguish traffic at the mirroring terminal node.
  • Step 104 Send the mirrored traffic message to the destination terminal so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • a mirrored traffic message When sending a mirrored traffic message to a destination terminal, it can be manifested as obtaining a routing forwarding table and a destination gateway address of the routing forwarding table through a mirrored gateway, and then determining the destination terminal node of the destination terminal based on the destination gateway address, and sending the mirrored traffic message to the destination terminal node, that is, the traffic mirroring gateway can send the mirrored traffic message to the destination terminal node based on a UDP encapsulated double-layer tunnel message according to the routing forwarding table.
  • an access request sent by a user's destination terminal will be received, and the destination terminal may be a virtual instance preset in a preset virtual private cloud.
  • the access request includes the virtual instance to be accessed, and the virtual instance has a corresponding traffic mirroring gateway instance created in the mirroring gateway.
  • a mirrored traffic message When sending a mirrored traffic message to a destination terminal node, it can also be manifested as obtaining the virtual instance where the traffic mirroring gateway instance to be accessed is currently located, and forwarding the routing forwarding table of the traffic mirroring gateway instance corresponding to the virtual instance where the traffic mirroring gateway instance to be accessed is currently located, so as to forward the mirrored traffic message to the destination terminal node based on the routing forwarding table of the corresponding traffic mirroring gateway instance.
  • a mirrored traffic message is sent to a destination terminal, and the destination terminal can distinguish the mirrored traffic based on the relevant information carried and sent in the mirrored traffic message.
  • the relevant information is related to the mirrored traffic, and includes at least traffic mirroring instance information, terminal node information, traffic direction information, traffic filtering policy information, and user-defined label information, etc.
  • the mirrored traffic can be distinguished based on the traffic direction information and/or traffic mirroring instance information in the traffic flow table.
  • it can be manifested as distinguishing the incoming mirrored traffic and outgoing mirrored traffic of the mirrored traffic based on the traffic direction information carried by the mirrored traffic packet, and analyzing the incoming traffic and outgoing traffic; and/or distinguishing the incoming mirrored traffic and outgoing mirrored traffic of the virtual instance corresponding to the traffic mirroring instance information based on the traffic mirroring instance information and traffic direction of the mirrored traffic packet, and analyzing the incoming traffic and outgoing traffic of the virtual instance corresponding to the traffic mirroring instance information; and/or distinguishing the mirrored traffic of virtual instances corresponding to different traffic mirroring instance information based on the traffic mirroring instance information of the mirrored traffic packet, and analyzing the mirrored traffic of different virtual instances.
  • the inbound and outbound traffic of the virtual instance is mirrored at the computing node of the virtual instance to obtain the mirrored traffic, and the traffic flow table constructed for the mirrored traffic can be obtained, and the mirrored traffic message is generated according to the mirrored traffic and the traffic flow table, and the mirrored traffic message is sent to the destination terminal, so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • the relevant information of the virtual instance mirrored traffic is designed into the message, and sent from the computing node through the message carrying method, the mirroring of the traffic of the virtual instance is realized while occupying the least data center, the mirrored sending to the designated terminal node, and the differentiation of the mirrored traffic at the terminal node.
  • the routing forwarding table on the mirrored gateway can be designed according to the characteristics of the mirrored traffic message sent by the computing node to realize high-speed processing of the mirrored message.
  • FIG. 1 is applied to a virtual machine platform, where the virtual machine platform includes a computing node of a virtual instance, and specifically may include the following steps:
  • Step 501 receiving a mirrored traffic message sent by a computing node of a virtual instance
  • Traffic mirroring refers to the process of copying the traffic of a monitored port to a specific monitoring port for the purpose of traffic monitoring. Specifically, it can be manifested as the process of copying the traffic of a virtual instance to a destination terminal.
  • relevant information of the virtual instance mirrored traffic can be designed into the message, and sent from the computing nodes through message carrying, thereby implementing mirroring of the traffic of the virtual instance with minimal occupation of the data center, mirroring transmission to the designated terminal node, and differentiation of the mirrored traffic at the terminal node.
  • the destination terminal can receive the mirrored traffic message sent by the computing node of the virtual instance, so as to distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message, for example, distinguish the mirrored traffic based on the traffic direction information contained in the carried traffic flow table.
  • the received mirrored traffic message may be generated based on the mirrored traffic and the traffic flow table, wherein the mirrored traffic is obtained based on mirroring the inbound traffic and the outbound traffic of the virtual instance.
  • Traffic mirroring information at least includes traffic mirroring instance information, terminal node information, traffic direction information, traffic filtering policy information, and user-defined label information, etc., to mirror the network traffic of the user's virtual instance to the specified terminal node based on the user-configured traffic mirroring instance information, traffic direction information, terminal node information, traffic filtering policy information, and user-defined label information (such as traffic differentiation label, length of data packet intercepted after mirroring, etc.), so that the traffic of subsequent mirrors of different virtual instances can be distinguished at the same terminal node (if the terminal node information of different virtual instances is configured as the same) according to the user-defined label information, that is, the traffic message quintuple of the virtual instance is the same. It is also possible to mirror the inbound and outbound traffic of the virtual instance separately and distinguish the traffic direction, so that users can more accurately and flexibly mirror the traffic of cloud instances.
  • Step 502 Differentiate the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • the inbound and outbound mirrored traffic of a port can be distinguished based on the traffic direction information carried by the mirrored traffic message
  • the inbound and outbound mirrored traffic of a port can be distinguished based on the traffic mirroring instance information carried by the mirrored traffic message
  • the inbound and outbound mirrored traffic of a port can be distinguished based on the traffic direction information and traffic mirroring instance information carried by the mirrored traffic message.
  • the relevant information used to distinguish the inbound and outbound mirrored traffic of a port can also be other information carried in the message; and the relevant information used to distinguish the inbound and outbound mirrored traffic of a port can be specifically determined based on the information designed to be carried in the message, and the embodiments of the present application do not limit this.
  • the incoming mirrored traffic and the outgoing mirrored traffic of the mirrored traffic can be distinguished based on the traffic direction information of the mirrored traffic packet, and the incoming traffic and the outgoing traffic can be analyzed; in another case, the incoming mirrored traffic and the outgoing mirrored traffic of the virtual instance corresponding to the traffic mirrored instance information can be distinguished based on the traffic mirrored instance information and the traffic direction of the mirrored traffic packet, and the incoming traffic and the outgoing traffic of the virtual instance corresponding to the traffic mirrored instance information can be analyzed; in yet another case, the mirrored traffic of the virtual instances corresponding to different traffic mirrored instance information can also be distinguished based on the traffic mirrored instance information of the mirrored traffic packet, and the mirrored traffic of different virtual instances can be analyzed.
  • the user can more accurately and flexibly mirror the traffic of the cloud instance, and the traffic mirroring process is completed at the computing node where the virtual instance is located, which greatly saves the network bandwidth resources of the data center and does not affect the main process of the user's virtual instance.
  • the traffic after the user's mirroring can be distributed to any designated terminal node (as long as the three-layer network is reachable) through configuration, and the traffic of the virtual instance is mirrored while occupying the least data center, and the mirroring is sent to the designated terminal node, and the mirroring traffic is distinguished at the terminal node.
  • the traffic mirroring gateway sends the mirrored traffic message to the destination terminal node based on the UDP encapsulated double-layer Tunnel message according to the routing forwarding table, and designs the routing forwarding table on the mirroring gateway according to the characteristics of the mirrored traffic message sent by the computing node, so as to realize high-speed processing of the mirrored message.
  • the filtering strategy of the traffic filter configured by the user can also be completed at the computing node, and the unnecessary traffic is filtered out at the source end, and the filter strategy supports accepting and discarding operations.
  • FIG. 6 a schematic diagram of the application scenario of traffic mirroring of a virtual instance provided in an embodiment of the present application is shown.
  • the embodiment of the present application implements traffic mirroring based on the UDP protocol in a public cloud, specifically through traffic flow table Open vSwitch encapsulated by VXLAN Tunnel.
  • the logical network distribution of the virtual machine instances to be mirrored on the public cloud can be shown in Figure 4.
  • virtual instance 1 i.e. VM1
  • virtual instance 2 i.e. VM2
  • virtual instance 3 i.e. VM3
  • subnet 1 i.e. subnet1 in user VPC2.
  • Each VPC can create a traffic mirroring gateway instance (such as mrgw-VPC1, mrgw-VPC2, etc.) on the mirroring gateway
  • a mirroring gateway group can contain multiple mirroring gateway nodes to carry traffic mirroring gateway instances of different VPCs, where different mirroring gateway nodes can be implemented based on multiple physical servers as nodes.
  • dotted line 1 is the access traffic of VM1 accessing VM3
  • dotted line 2 is the response traffic of VM1 accessing VM3.
  • the access traffic can be the inbound traffic
  • the response traffic can be the outbound traffic.
  • the corresponding orchestration flow table will be sent up and down on the br-int bridge on the Open vSwitch of the host node (compute node 2) where VM3 is located, and the inbound (outbound) traffic will be mirrored and sent to the mirror node of the mirror gateway group through the UDP protocol.
  • the mirror gateway group will send a forwarding routing table to the mirror gateway instance of VPC2 (i.e., mrgw-VPC2), and the mirror gateway instance will forward the traffic to the terminal node (i.e., the virtual instance VM2 in VPC1) according to the sent forwarding routing table, so that the terminal node can distinguish the mirror traffic based on the traffic direction information in the traffic flow table of the mirror traffic message.
  • VPC2 i.e., mrgw-VPC2
  • the mirror gateway instance will forward the traffic to the terminal node (i.e., the virtual instance VM2 in VPC1) according to the sent forwarding routing table, so that the terminal node can distinguish the mirror traffic based on the traffic direction information in the traffic flow table of the mirror traffic message.
  • the user can more accurately and flexibly mirror the traffic of the cloud instance, and the traffic mirroring process is completed on the computing node where the virtual instance is located, which greatly saves the network bandwidth resources of the data center and does not affect the main process of the user's virtual instance.
  • the user's mirrored traffic can be distributed to any specified terminal node (as long as the three-layer network is reachable) through configuration, and the traffic of the virtual instance can be mirrored while occupying the least data center, and the mirrored traffic can be sent to the specified terminal node, and the mirrored traffic can be mirrored at the terminal node. Distinguish.
  • the traffic mirroring gateway sends the mirrored traffic message to the destination terminal node based on the UDP encapsulated double-layer tunnel message according to the routing forwarding table.
  • the routing forwarding table By designing the routing forwarding table on the mirroring gateway according to the characteristics of the mirrored traffic message sent by the computing node, high-speed processing of the mirrored message is achieved.
  • the filtering strategy based on the user-configured traffic filter is also completed on the computing node to filter out unnecessary traffic at the source end. The filter strategy supports accepting and discarding operations.
  • the virtual machine platform includes a computing node of a virtual instance, and specifically may include the following modules:
  • the to-be-mirrored traffic acquisition module 701 is used to acquire the to-be-mirrored traffic of the virtual instance, where the to-be-mirrored traffic of the virtual instance includes inbound traffic and/or outbound traffic;
  • the traffic mirroring module 702 is used to mirror the inbound and outbound traffic of the virtual instance at the computing node of the virtual instance to obtain mirrored traffic;
  • the mirrored traffic message generation module 703 is used to obtain the constructed traffic flow table for the mirrored traffic and generate the mirrored traffic message according to the mirrored traffic and the traffic flow table;
  • the mirrored traffic message sending module 704 is used to send the mirrored traffic message to the destination terminal so that the destination terminal can distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic message.
  • the device provided in the embodiment of the present application may further include the following modules:
  • the traffic flow table construction module is used to obtain the configured traffic mirroring information and use the traffic mirroring information to construct a traffic flow table for the mirrored traffic; wherein the traffic mirroring information at least includes traffic direction information, traffic mirroring instance information, terminal node information, traffic filtering policy information and user-defined label information.
  • the mirrored traffic includes inbound mirrored traffic for inbound traffic and outbound mirrored traffic for outbound traffic;
  • the traffic flow table construction module may include the following submodules:
  • the traffic flow table construction submodule is used to use traffic mirroring instance information, traffic direction information, terminal node information, traffic filtering policy information and user-defined label information to respectively construct an inbound traffic flow table for incoming mirrored traffic and an outbound traffic flow table for outgoing mirrored traffic.
  • the virtual instance is located in a virtual private cloud, and the virtual private cloud has a corresponding traffic mirroring gateway instance created in the mirroring gateway.
  • the mirroring gateway group for carrying different traffic mirroring gateway instances includes multiple mirroring gateway nodes.
  • the mirrored traffic packet generation module 703 may include the following submodules:
  • the mirror traffic receiving submodule is used to receive the mirror traffic and traffic flow table through the mirror gateway node of the mirror gateway group after the computing node of the virtual instance builds the mirror traffic;
  • the mirrored traffic message generation submodule is used to generate a mirrored traffic message using the mirrored traffic and the traffic flow table.
  • the mirrored traffic message generation module 703 may further include the following submodules:
  • the mirror traffic packet generation submodule is used to obtain the routing forwarding table through the mirror gateway node and The forwarding table and traffic flow table process the mirrored traffic packets and generate mirrored traffic packets.
  • the mirrored traffic packet generation submodule may include the following units:
  • a routing forwarding information acquisition unit used to acquire traffic mirroring information of a traffic flow table and acquire routing forwarding information of a routing forwarding table
  • the mirror traffic packet generating unit is used to respond to the traffic mirror information of the traffic flow table being matched successfully with the routing forwarding information, and to encapsulate the mirror traffic message using the routing forwarding information to obtain the mirror traffic packet.
  • the device proposed in the embodiment of the present application may further include the following modules:
  • the access request receiving module is used to receive the access request sent by the user's destination terminal; wherein the access request includes the virtual instance to be accessed, and the virtual instance has a corresponding traffic mirroring gateway instance created in the mirroring gateway.
  • the mirrored traffic message sending module 704 may include the following submodules:
  • the target gateway address acquisition submodule is used to obtain the routing forwarding table through the mirror gateway and obtain the destination gateway address of the routing forwarding table;
  • the mirrored traffic message sending submodule is used to determine the destination terminal node of the destination terminal based on the destination gateway address and send the mirrored traffic message to the destination terminal node.
  • the mirrored traffic message sending submodule may include the following units:
  • the mirrored traffic message sending unit is used to obtain the virtual instance where the traffic mirroring gateway instance to be accessed is currently located, and forward the routing forwarding table to the traffic mirroring gateway instance corresponding to the virtual instance where the traffic mirroring gateway instance to be accessed is currently located, so as to forward the mirrored traffic message to the destination terminal node based on the routing forwarding table based on the corresponding traffic mirroring gateway instance.
  • the flow mirroring device of the virtual instance provided in the embodiment of the present application can mirror the inbound and outbound flows of the virtual instance at the computing node of the virtual instance to obtain the mirrored flow, and can obtain the constructed flow flow table for the mirrored flow, and generate the mirrored flow message according to the mirrored flow and the flow flow table, and send the mirrored flow message to the destination terminal, so that the destination terminal can distinguish the inbound and outbound mirrored flows of the port according to the mirrored flow message.
  • the relevant information of the virtual instance mirrored flow is designed into the message, and sent from the computing node through the message carrying method, the mirroring of the flow of the virtual instance is realized under the condition of occupying the least data center, the mirroring is sent to the designated terminal node, and the distinction of the mirrored flow is realized at the terminal node.
  • the routing forwarding table on the mirrored gateway can be designed according to the characteristics of the mirrored flow message sent by the computing node to realize high-speed processing of the mirrored message.
  • FIG. 8 a structural block diagram of another embodiment of a traffic mirroring device of a virtual instance of the present application is shown, which is applied to a destination terminal, the destination terminal is connected to a virtual machine platform for communication, and the virtual machine platform includes a computing node of a virtual instance, and specifically may include the following modules:
  • the mirrored traffic message receiving module 801 is used to receive the mirrored traffic message sent by the computing node of the virtual instance; the mirrored traffic message is generated based on the mirrored traffic and the traffic flow table, wherein the mirrored traffic is obtained based on mirroring the inbound and outbound traffic of the virtual instance;
  • the mirrored traffic distinguishing module 802 is used to distinguish the inbound and outbound mirrored traffic of the port according to the mirrored traffic messages.
  • the traffic flow table is constructed based on the configured traffic mirroring information, and the traffic mirroring information includes at least traffic direction information and/or traffic mirroring instance information; the mirrored traffic differentiation module 802 may include the following submodules:
  • a first mirrored traffic distinguishing submodule is used to distinguish incoming mirrored traffic and outgoing mirrored traffic of the mirrored traffic based on traffic direction information of the mirrored traffic packet, and analyze the incoming traffic and the outgoing traffic;
  • the second mirrored traffic distinguishing submodule is used to distinguish the incoming mirrored traffic and the outgoing mirrored traffic of the virtual instance corresponding to the traffic mirrored instance information based on the traffic mirrored instance information and the traffic direction of the mirrored traffic packet, and analyze the incoming traffic and the outgoing traffic of the virtual instance corresponding to the traffic mirrored instance information;
  • the third mirrored traffic distinguishing submodule is used to distinguish the mirrored traffic of virtual instances corresponding to different traffic mirroring instance information based on the traffic mirroring instance information of the mirrored traffic packet, and analyze the mirrored traffic of different virtual instances.
  • the traffic mirroring device of the virtual instance provided by the embodiment of the present application realizes the mirroring of the inflow and outflow of the virtual instance respectively, distinguishes the traffic direction, and allows users to more accurately and flexibly mirror the traffic of the cloud instance, and the traffic mirroring process is completed at the computing node where the virtual instance is located, which greatly saves the network bandwidth resources of the data center, and does not affect the main process of the user's virtual instance.
  • the traffic after the user's mirroring can be distributed to any designated terminal node (as long as the three-layer network is reachable) through configuration, and the traffic of the virtual instance is mirrored while occupying the least data center, and the mirroring is sent to the designated terminal node, and the mirroring traffic is distinguished at the terminal node.
  • the traffic mirroring gateway sends the mirrored traffic message to the destination terminal node based on the UDP encapsulated double-layer Tunnel message according to the routing forwarding table, and the routing forwarding table on the mirroring gateway is designed according to the characteristics of the mirrored traffic message sent by the computing node, so as to realize high-speed processing of the mirrored message.
  • the filtering strategy of the traffic filter configured by the user can also be completed at the computing node, and the unnecessary traffic is filtered out at the source end, and the filter strategy supports acceptance and discarding operations.
  • the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
  • the embodiment of the present application also provides a virtual machine platform, including:
  • It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor.
  • the computer program When the computer program is executed by the processor, each process of the traffic mirroring method embodiment of the above virtual instance is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
  • the embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored.
  • a computer program is stored.
  • the computer program is executed by a processor, each process of the traffic mirroring method embodiment of the above-mentioned virtual instance is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
  • the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be realized by computer program instructions.
  • These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device produce a device for realizing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.
  • These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce computer-implemented processing, so that the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质，涉及通信技术领域，所述方法包括：获取虚拟实例的待镜像流量；在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量；获取所构建的针对镜像流量的流量流表，根据镜像流量和流量流表生成镜像流量报文；向目的终端发送镜像流量报文，以便目的终端根据镜像流量报文区分端口的入出镜像流量。通过在计算节点实现对待镜像流量的镜像以及镜像流量报文的生成，将虚拟实例镜像流量的相关信息设计到报文中，以报文携带方式从计算节点发送出去，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像以及镜像发送，实现在终端节点对镜像流量进行的区分。

Description

虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质
相关申请的交叉引用
本申请要求于2023年02月01日提交中国专利局，申请号为202310050246.9，申请名称为“虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别是涉及一种虚拟实例的流量镜像方法、一种虚拟实例的流量镜像装置、相应的一种虚拟机平台以及相应的一种计算机可读存储介质。
背景技术
在公有云虚拟网络中，用户通常会有对云上虚拟实例(虚拟机或Docker容器)的入出流量进行镜像的需求，镜像流量后导入到用户指定的终端节点进行流量分析及审计。
在流量镜像的相关技术中，可以表现为基于对镜像源请求的镜像源IP解析确定镜像目的请求对应的监控端口，然后将流量发送请求到对应的监控端口实现流量镜像，然而其所实现的流量镜像无法对流量镜像进行区分，不利于对入出流量的流量分析及审计。
概述
鉴于上述问题，提出了本申请实施例以便提供一种克服上述问题或者至少部分地解决上述问题的一种虚拟实例的流量镜像方法、一种虚拟实例的流量镜像装置、相应的一种虚拟机平台以及相应的一种计算机可读存储介质。
本申请实施例公开了一种虚拟实例的流量镜像方法，应用于虚拟机平台，虚拟机平台包含虚拟实例的计算节点，方法包括：
获取虚拟实例的待镜像流量，虚拟实例的待镜像流量包括入流量和/或出流量；
在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量；
获取所构建的针对镜像流量的流量流表，根据镜像流量和流量流表生成镜像流量报文；
向目的终端发送镜像流量报文，以便目的终端根据镜像流量报文区分端口的入出镜像流量。
可选地，获取所构建的针对镜像流量的流量流表，还包括：
获取所配置的流量镜像信息，采用流量镜像信息构建针对镜像流量的流量流表；其中，流量镜像信息至少包括流量方向信息、流量镜像实例信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息。
可选地，镜像流量包括针对入流量的入镜像流量和针对出流量的出镜像流量；采用流量镜像信息构建针对镜像流量的流量流表，包括：
采用流量镜像实例信息、流量方向信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息，分别构建入镜像流量的入流量流表，以及出镜像流量的出 流量流表。
可选地，虚拟实例位于虚拟私有云，虚拟私有云在镜像网关具有所创建的相应的流量镜像网关实例，用于承载不同流量镜像网关实例的镜像网关组包括多个镜像网关节点。
可选地，根据镜像流量和流量流表生成镜像流量报文，包括：
在虚拟实例的计算节点构建得到镜像流量后，通过镜像网关组的镜像网关节点接收镜像流量和流量流表；
采用镜像流量和流量流表生成镜像流量报文；
还包括：
通过镜像网关节点获取路由转发表，并根据路由转发表和流量流表对镜像流量报文进行报文处理，生成镜像流量包。
可选地，根据路由转发表和流量流表对镜像流量报文进行报文处理，生成镜像流量包，包括：
获取流量流表的流量镜像信息，以及获取路由转发表的路由转发信息；
响应流量流表的流量镜像信息分别与路由转发信息匹配成功，采用路由转发信息对镜像流量报文进行封装，得到镜像流量包。
可选地，在根据镜像流量和流量流表生成镜像流量报文之前，还包括：
接收用户目的终端发送的访问请求；其中，访问请求包括所要访问的虚拟实例，虚拟实例在镜像网关具有所创建的相应的流量镜像网关实例。
可选地，向目的终端发送镜像流量报文，包括：
通过镜像网关获取路由转发表并获取路由转发表的目的网关地址；
基于目的网关地址确定将目的终端的目的终端节点，并向目的终端节点发送镜像流量报文。
可选地，向目的终端节点发送镜像流量报文，包括：
获取所要访问的流量镜像网关实例当前所在的虚拟实例，向所要访问的流量镜像网关实例当前所在的虚拟实例，所对应的流量镜像网关实例转发路由转发表，以便基于所对应的流量镜像网关实例基于路由转发表将镜像流量报文转发至目的终端节点。
本申请实施例还公开了一种虚拟实例的流量镜像方法，应用于目的终端，目的终端与虚拟机平台通信连接，虚拟机平台包含虚拟实例的计算节点，方法包括：
接收虚拟实例的计算节点发送的镜像流量报文；镜像流量报文基于镜像流量和流量流表生成，其中，镜像流量基于对虚拟实例的入流量和出流量进行镜像得到；
根据镜像流量报文区分端口的入出镜像流量。
可选地，流量流表基于所配置的流量镜像信息构建，流量镜像信息至少包括流量方向信息和/或流量镜像实例信息；
基于镜像流量报文的流量流表中流量方向信息区分镜像流量，包括：
基于镜像流量包的流量方向信息区分镜像流量的入镜像流量和出镜像流量，对入流量和出流量进行分析；
和/或，基于镜像流量包的流量镜像实例信息和流量方向区分与流量镜像实例信 息相应虚拟实例的入镜像流量和出镜像流量，对与流量镜像实例信息相应虚拟实例的入流量和出流量进行分析；
和/或，基于镜像流量包的流量镜像实例信息区分与不同流量镜像实例信息相应虚拟实例的镜像流量，对不同虚拟实例的镜像流量进行分析。
本申请实施例还公开了一种虚拟实例的流量镜像装置，应用于虚拟机平台，虚拟机平台包含虚拟实例的计算节点，装置包括：
待镜像流量获取模块，用于获取虚拟实例的待镜像流量，虚拟实例的待镜像流量包括入流量和/或出流量；
流量镜像模块，用于在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量；
镜像流量报文生成模块，用于获取所构建的针对镜像流量的流量流表，根据镜像流量和流量流表生成镜像流量报文；
镜像流量报文发送模块，用于向目的终端发送镜像流量报文，以便目的终端根据镜像流量报文区分端口的入出镜像流量。
本申请实施例还公开了一种虚拟实例的流量镜像装置，应用于目的终端，目的终端与虚拟机平台通信连接，虚拟机平台包含虚拟实例的计算节点，装置包括：
镜像流量报文接收模块，用于接收虚拟实例的计算节点发送的镜像流量报文；镜像流量报文基于镜像流量和流量流表生成，其中，镜像流量基于对虚拟实例的入流量和出流量进行镜像得到；
镜像流量区分模块，用于根据镜像流量报文区分端口的入出镜像流量。
本申请实施例还公开了一种虚拟机平台，包括：处理器、存储器及存储在存储器上并能够在处理器上运行的计算机程序，计算机程序被处理器执行时实现任一项虚拟实例的流量镜像方法。
本申请实施例还公开了一种计算机可读存储介质，计算机可读存储介质上存储计算机程序，计算机程序被处理器执行时实现任一项虚拟实例的流量镜像方法。
本申请实施例包括以下优点：
在本申请实施例中，在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量，以及可以获取所构建的针对镜像流量的流量流表，并根据镜像流量和流量流表生成镜像流量报文，向目的终端发送镜像流量报文，以便目的终端能够根据镜像流量报文区分端口的入出镜像流量。通过对计算节点的流量的设计编排，以及通过在计算节点实现对待镜像流量的镜像以及镜像流量报文的生成，将虚拟实例镜像流量的相关信息设计到报文中，通过报文携带方式从计算节点发送出去，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及实现在终端节点对镜像流量进行的区分。进一步地，还可以通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。
附图说明
图1是本申请的一种虚拟实例的流量镜像方法实施例的步骤流程图；
图2是本申请实施例提供的对虚拟实例的出流量流表的构建示意图；
图3是本申请实施例提供的虚拟实例的入流量流表的构建示意图；
图4是本申请实施例提供的公有云上虚拟机实例的逻辑网络分布示意图；
图5是本申请的另一种虚拟实例的流量镜像方法实施例的步骤流程图；
图6是本申请实施例提供的虚拟实例的流量镜像的应用场景示意图；
图7是本申请的一种虚拟实例的流量镜像装置实施例的结构框图；
图8是本申请的另一种虚拟实例的流量镜像装置实施例的结构框图。
详细描述
为使本申请的上述目的、特征和优点能够更加明显易懂，下面结合附图和具体实施方式对本申请作进一步详细的说明。
在公有云虚拟网络中，用户通常会有对云上虚拟实例(虚拟机或Docker容器)的入出流量进行镜像的需求，镜像流量后导入到用户指定的终端节点进行流量分析及审计。
为了满足上述需求，本申请实施例在公有云中实现了基于UDP(User Datagram Protocol，用户数据报协议)协议，具体通过VXLAN Tunnel封装的流量流表Open vSwitch所编排的流量镜像。
本申请实施例的核心思想在于在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量，以及可以获取所构建的针对镜像流量的流量流表，并根据镜像流量和流量流表生成镜像流量报文，向目的终端发送镜像流量报文，以便目的终端能够根据镜像流量报文区分端口的入出镜像流量。通过实现虚拟实例的入流量和出流量分别进行镜像，基于设计到报文中的相关信息区分流量方向，让用户可以更精确灵活的对云上实例进行流量镜像，且流量镜像过程在虚拟实例所在的计算节点完成，极大节省数据中心的网络带宽资源，以及不影响用户虚拟实例的主流程，用户镜像后的流量可以通过配置分发到任意一个指定的终端节点(只要三层网络可达)，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及在终端节点对镜像流量进行的区分。进一步地，流量镜像网关根据路由转发表将镜像流量报文基于UDP封装双层Tunnel报文发送到目的终端节点，通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。此外，还可以基于用户配置的流量过滤器过滤策略也在计算节点完成，在源端将不需要的流量过滤出来，过滤器策略支持接受及丢弃操作。
参照图1，示出了本申请的一种虚拟实例的流量镜像方法实施例的步骤流程图，应用于虚拟机平台，虚拟机平台包含虚拟实例的计算节点，具体可以包括如下步骤：
步骤101，获取虚拟实例的待镜像流量，虚拟实例的待镜像流量包括入流量和/或出流量；
流量镜像，可以指的是为了流量监控等目的，将待监控端口的流量复制至特定的监控端口的过程，具体可以表现为将虚拟实例的流量复制到目的终端的过程。
在本申请实施例中，可以通过对计算节点的流量的设计编排，以及通过在计算节点实现对待镜像流量的镜像以及镜像流量报文的生成，将虚拟实例镜像流量的方向设计到报文中，通过报文携带方式从计算节点发送出去，在占用数据中心最少的 情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及在终端节点所进行的对镜像流量的区分。
在本申请的一种实施例中，为了实现对虚拟实例的流量镜像，首先可以对虚拟实例的待镜像流量进行获取，所获取的虚拟实例的待镜像流量可以包括该虚拟实例的入流量和/或出流量。示例性地，虚拟实例的入流量可以指的是访问流量或者请求流量等，出流量可以指的是响应流量以及所请求的数据、信息等，本申请实施例对此不加以限制。
步骤102，在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量；
此时可以在虚拟实例的计算节点，分别对虚拟实例的入流量和出流量进行镜像，得到针对入流量的镜像流量和针对出流量的镜像流量，流量镜像过程在虚拟实例所在的计算节点完成，计算节点可以指的是宿主节点，以节省数据中心的网络带宽资源。
其中，通过实现虚拟实例的入流量和出流量分别进行镜像，区分流量方向，让用户可以更精确灵活地对云上实例进行流量镜像。
在本申请的一些实施例中，在计算节点还可以获取用户所配置的流量过滤器过滤策略，基于用户配置的流量过滤器过滤策略，在源端将不需要的流量过滤出来，以便对过滤后的虚拟实例的流量进行镜像。其中，过滤器策略可以支持接受及丢弃操作。
步骤103，获取所构建的针对镜像流量的流量流表，根据镜像流量和流量流表生成镜像流量报文；
在分别对虚拟实例的入流量和出流量进行流量镜像得到镜像流量后，此时可以获取所构建的针对镜像流量的流量流表，以基于镜像流量和流量流表生成镜像流量报文，便于通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。
具体地，所获取的针对镜像流量的流量流表，主要是通过获取所配置的流量镜像信息，然后采用流量镜像信息构建针对镜像流量的流量流表实现，以对计算节点Open vSwitch的流量进行设计编排，优化网桥上的流表。
其中，流量镜像信息至少包括流量镜像实例信息、终端节点信息、流量方向信息、流量过滤策略信息以及用户自定义标签信息等，以基于用户配置的流量镜像实例信息、流量方向信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息(例如流量区分标签，镜像后截取的数据包长等)来将用户虚拟实例的网络流量镜像到指定的终端节点，便于后续不同虚拟实例的镜像的流量能够在同一终端节点(如果不同虚拟实例的终端节点信息配置为同一个)根据用户自定义标签信息进行区分，使得虚拟实例的流量报文五元组相同。即可以将前述流量镜像的相关信息设计到报文中，以便后续可以在计算节点按照报文携带的方式实现对这些相关信息的发送。
在实际应用中，由于镜像流量包括针对入流量的入镜像流量和针对出流量的出镜像流量，此时可以采用流量镜像实例信息、流量方向信息、终端节点信息、流量 过滤策略信息以及用户自定义标签信息，分别构建针对入镜像流量的入流量流表，以及针对出镜像流量的出流量流表。
具体地，参照图2，示出了本申请实施例提供的对虚拟实例的出流量流表的构建示意图，主要可以表现为在正常编排的流表Pipeline中再次添加三个table，table指的用于存储流表项的表。需要说明的是，table id可以根据实际情况进行确定，本申请实施例对此不加以限制。
正常编排的流表Pipeline中，原先可以包含假设为table0、table6、table
10等的table表，此时可以添加假设为table7，table8，table180的table表。其中，table0、table6、table10等的table表可以进行正常的流表处理流程，table＝6功能可以为添加处理镜像的端口，对于新添加的三个table，table＝7功能可以为处理镜像过滤策略，table＝8功能可以为处理流量镜像方向，table＝180功能可以为将镜像后的流量基于UDP协议封装VXLAN发送出去，以封装VXLAN出计算节点，送达镜像网关节点。
示例性地，具体的出方向各流表的详细设计可以如下所示：
#reg1为方向，reg2为是否镜像flag(对于reg2具体值的设定，可以基于入方向值为1，出方向值为2的策略进行设定)
#虚拟实例出镜像
table＝6,priority＝100,in_port＝{in_port}actions＝goto_table:7
#需要镜像的port过镜像流量filter table，priority优先级设置比正常的流量高，假设对于需要镜像的端口的priority优先级设置为100，不需要过镜像的端口的priority优先级设置为10，此时执行table:7的相关操作，即过镜像流量过程中的功能处理过滤器策略，以便基于流量过滤策略信息在源端将不需要的流量过滤出来，过滤器策略支持接受及丢弃操作
table＝6,priority＝10,actions＝goto_table:10
#默认不需要过镜像流量走正常流量，即此时可以执行table:10的相关操作，进行正常的流表处理流程
#table＝7功能处理过滤器策略，基于action设置的reg1标识以确定是否需要镜像，假设0x1为需要镜像，如果关闭该端口的镜像开关，则设置reg1的流表不下发。在过滤过程中，可以基于过滤策略协议的不同进行流量过滤，具体表现如下：
table＝7,priority＝150,tcp,in_port＝{in_port},nw_dst＝192.168.50.6,tp_dst＝80
actions＝set_field:0x1->reg1,goto_table:8
#假设镜像流量的过滤策略协议为tcp，目的192.168.50.6，端口为80
table＝7,priority＝140,arp,in_port＝{in_port},arp_tpa＝192.168.50.6actions＝set_field:
0x1->reg1,goto_table:8
#假设镜像流量的过滤策略协议为arp，目的192.168.50.6
table＝7,priority＝130,icmp,in_port＝{in_port},nw_dst＝192.168.50.6
actions＝goto_table:8
#假设镜像流量的过滤策略协议为icmp，目的192.168.50.6
table＝7,priority＝100,actions＝goto_table:8
#默认走正常的table
#table＝8功能处理镜像的方向，将match到需要镜像的流量(表现为match reg1＝0x1)；然后在action中复用寄存器reg1进行设置流量镜像的方向，然后将流量进行镜像，镜像后的流量流转到table＝180处理，正常流量继续走table＝10
table＝8,priority＝100,reg1＝0x1
actions＝set_field:0x2->reg1,resubmit(,10),resubmit(,180)
#假设reg1＝0x2为出方向。如关闭port的开关，本流量不下发
table＝8,priority＝10actions＝goto_table:10
#默认走正常Pipeline流程
#table＝180，通过匹配镜像port的镜像方向，所属虚拟私有云及源物理地址，将port的出方向的镜像流量发送到镜像网关，封装VXLAN隧道发送出去，并将方向信息携带在数据包中(内层源mac的高24比特位)
table＝180,priority＝200,reg1＝0x2,reg5＝{vni},dl_src＝{port_src_mac}
actions＝set_field:0x4163e->reg2,move:NXM_NX_REG2[0..23]->NXM_OF_ETH_SRC[24..47],set_field:{vni}->tun_id,group:101##出方向
table＝180,priority＝100,actions＝drop
参照图3，示出了本申请实施例提供的虚拟实例的入流量流表的构建示意图，主要表现为在正常编排的流表Pipeline中添加三个table，table指的用于存储流表项的表。需要说明的是，table id可以根据实际情况进行确定，本申请实施例对此不加以限制。
正常编排的流表Pipeline中，原先可以包含假设为table86、table90等的table表，此时可以添加假设为table87，table88，table180的table表。其中，table86、table90等的table表可以进行正常的流表处理流程，table＝86功能可以为添加入镜像的端口，table＝90功能可以为流表将流量送到虚拟实例的端口port中，table＝87功能可以为处理镜像过滤策略，table＝88功能可以为处理流量镜像方向，table＝180功能可以为将镜像后的流量基于UDP协议封装VXLAN发送出去，封装VXLAN出计算节点，送达镜像网关节点。
示例性地，具体入方向的各个流表的详细设计可以如下所示：
#镜像流量入方向
table＝86,priority＝100,reg7＝{in_port}actions＝goto_table:87
#需要镜像的port过入镜像流量filter table，priority优先级设置比正常的流量高，假设对于需要镜像的端口的priority优先级设置为100，不需要经过镜像的端口的priority优先级设置为10，此时执行table:87的相关操作，即过镜像流量过程中的功能处理过滤器策略，以便基于流量过滤策略信息在源端将不需要的流量过滤出来，过滤器策略支持接受及丢弃操作
table＝86,priority＝10,actions＝goto_table:90
#不需要镜像的直接走正常流程，即此时可以执行table:90的相关操作，进行正常的流表处理流程
table＝87,priority＝150,tcp,reg7＝{in_port},nw_dst＝192.168.50.6,tp_dst＝80
actions＝set_field:0x1->reg1,goto_table:88
#根据过滤器策略过滤出需要镜像的流量
table＝87,priority＝140,arp,reg7＝{in_port},arp_tpa＝192.168.50.6
actions＝set_field:0x1->reg1,goto_table:88
#根据过滤器策略过滤出需要镜像的流量
table＝87,priority＝130,icmp,reg7＝{in_port},nw_dst＝192.168.50.6
actions＝goto_table:88
#根据过滤器策略过滤出不需要镜像的流量，不设置reg1
table＝87,priority＝100,actions＝goto_table:88
#不符合过滤策略的流量默认跳到table88
table＝88,priority＝100,reg1＝0x1
actions＝set_field:0x1->reg1,resubmit(,90),resubmit(,180)
#将符合过滤策略的流量进行镜像，设置流量镜像方向。ox1代表入方向
table＝88,priority＝10actions＝goto_table:90
##默认走正常流程
#table＝180通过匹配镜像port的镜像方向，所属虚拟私有云及目的物理地址，将port的入方向的镜像流量发送到镜像网关，封装VXLAN隧道发送出去，并将方向信息携带在数据包中
table＝180,priority＝200,reg1＝0x1,reg5＝{vni},dl_dst＝{port_dst_mac}actions＝set_field:0x2163e->reg2,move:NXM_NX_REG2[0..23]->NXM_OF_ETH_SRC[24..47],set_field:{vni}->tun_id,group:101#入方向
table＝180,priority＝100,actions＝drop
需要说明的是，上述虚拟实例的出入流量的镜像在镜像点(例如table6和table86)可以基于用户根据实际情况进行选择，一般而言，出流量的镜像点会选择在过完port的Qos限速流表后，过安全组流表之前；入流量的镜像点会选择在过完安全组和port的Qos限速流量之后。以及，对于将镜像流量的方向标记携带到报文的位置及值也可以自由选择，例如在上述示例中可以将方向携带在报文内存的源端的物理地址mac中，出标记值设置为0x4163e，入标记值设置为0x2163e，本申请实施例对此不加以限制。
在本申请的一些实施例中，虚拟实例位于虚拟私有云，虚拟私有云在镜像网关具有所创建的相应的流量镜像网关实例，用于承载不同流量镜像网关实例的镜像网关组包括多个镜像网关节点。示例性地，如图4所示，虚拟实例1(即VM1)和虚拟实例2(即VM2)位于用户VPC1(Virtual Private Cloud，虚拟私有云)中子网2 (即subnet2)中，虚拟实例3(即VM3)位于用户VPC2中的子网1(即subnet1)中，每个VPC均可以在镜像网关上创建一个流量镜像网关实例(例如流量镜像网关实例1mrgw-VPC1、流量镜像网关实例2mrgw-VPC2等)，而一个镜像网关组中可以包含多个镜像网关节点来承载不同VPC的流量镜像网关实例，其中不同的镜像网关节点可以通过基于多台物理服务器作为节点实现。
在生成镜像流量报文时，可以在虚拟实例的计算节点构建得到镜像流量后，通过镜像网关组的镜像网关节点接收镜像流量和流量流表，然后通过采用镜像流量和流量流表生成镜像流量报文实现。在具体实现中，还可以通过镜像网关节点获取路由转发表，并根据路由转发表和流量流表对镜像流量报文进行报文处理，生成镜像流量包。
在实际应用中，当虚拟实例的镜像流量从计算节点发出后，可以发送到镜像网关组中的镜像网关节点，例如host，目的IP地址可以是镜像网关组的anycast IP地址，当流量到达镜像网关的镜像网关节点host后，镜像网关节点host上的转发程序将会根据路由转发表对报文处理。
具体的报文处理过程可以表现为获取流量流表的流量镜像信息，以及获取路由转发表的路由转发信息，然后响应流量流表的流量镜像信息分别与路由转发信息匹配成功，采用路由转发信息对镜像流量报文进行封装，得到镜像流量包。
路由转发表可以基于匹配域的路由转发信息，以及基于动作域的路由转发信息得到。其中，匹配域的路由转发信息主要用于与流量流表的流量镜像信息进行匹配，动作域的路由转发信息主要用于在匹配成功的情况下，实现的报文发送操作。
匹配域的路由转发信息可以包括Vni(Vni可以是一种类似于VLAN ID的用于标识Virtual Network Instance虚拟网络实例的用户标识)、流量方向、端口物理地址portmac信息，此时可以根据报文的Vni、流量方向、portmac信息与路由转发表中的Vni、流量方向、portmac信息进行匹配，如果匹配不成功进行丢弃处理，此时若数据报文命中路由转发表后，则可以根据路由转发表的路由转发信息进行转发处理，并对镜像流量报文进行封装发送出去。
示例性地，路由转发表可以如下表1所示：
表1
匹配域的路由转发信息可以包括内部目的物理地址InnerDstMac、内部源物理地址InnerSrcMac、内部源逻辑地址innerSrcIp、内部目的逻辑地址innerDstIp、内部虚拟网络实例标识InnerVni、外部目的逻辑地址OuterDstIp以及外部网络实例标识OuterVni，在基于路由转发表进行报文转发时，主要可以表现为根据动作域的InnerDstMac、InnerSrcMac、innerSrcIp、innerDstIp、InnerVni封装中间层VXLAN信 息，然后根据OuterDstIp和OuterVni在封装最外层的VXLAN信息将报文从流量镜像网关发送到镜像终端节点。其中InnerVni可通过用户自行定义，用于在镜像终端节点进行流量区分。
步骤104，向目的终端发送镜像流量报文，以便目的终端根据镜像流量报文区分端口的入出镜像流量。
在向目的终端发送镜像流量报文时，可以表现为通过镜像网关获取路由转发表并获取路由转发表的目的网关地址，然后基于目的网关地址确定将目的终端的目的终端节点，并向目的终端节点发送镜像流量报文，即流量镜像网关能够根据路由转发表将镜像流量报文基于UDP封装双层Tunnel报文发送到目的终端节点。
在本申请的一些实施例中，在生成镜像流量报文之前，将会接收用户目的终端发送的访问请求，目的终端可以是在预设虚拟私有云中预设虚拟实例。其中，访问请求包括所要访问的虚拟实例，虚拟实例在镜像网关具有所创建的相应的流量镜像网关实例。
在向目的终端节点发送镜像流量报文时，还可以表现为获取所要访问的流量镜像网关实例当前所在的虚拟实例，向所要访问的流量镜像网关实例当前所在的虚拟实例，所对应的流量镜像网关实例转发路由转发表，以便基于所对应的流量镜像网关实例基于路由转发表将镜像流量报文转发至目的终端节点。
在实际应用中，向目的终端发送镜像流量报文，目的终端能够基于镜像流量报文中所携带发送的相关信息对镜像流量进行区分，此相关信息为与镜像流量的相关信息，至少包括流量镜像实例信息、终端节点信息、流量方向信息、流量过滤策略信息以及用户自定义标签信息等，此时可以基于流量流表中的流量方向信息和/或流量镜像实例信息对镜像流量进行区分。具体可以表现为基于镜像流量包所携带的流量方向信息，区分镜像流量的入镜像流量和出镜像流量，对入流量和出流量进行分析；和/或基于镜像流量包的流量镜像实例信息和流量方向区分与流量镜像实例信息相应虚拟实例的入镜像流量和出镜像流量，对与流量镜像实例信息相应虚拟实例的入流量和出流量进行分析；和/或基于镜像流量包的流量镜像实例信息区分与不同流量镜像实例信息相应虚拟实例的镜像流量，对不同虚拟实例的镜像流量进行分析。
在本申请实施例中，在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量，以及可以获取所构建的针对镜像流量的流量流表，并根据镜像流量和流量流表生成镜像流量报文，向目的终端发送镜像流量报文，以便目的终端能够根据镜像流量报文区分端口的入出镜像流量。通过对计算节点的流量的设计编排，以及通过在计算节点实现对待镜像流量的镜像以及镜像流量报文的生成，将虚拟实例镜像流量的相关信息设计到报文中，通过报文携带方式从计算节点发送出去，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及在终端节点对镜像流量进行的区分。进一步地，还可以通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。
参照图5，示出了本申请的另一种虚拟实例的流量镜像方法实施例的步骤流程 图，应用于虚拟机平台，虚拟机平台包含虚拟实例的计算节点，具体可以包括如下步骤：
步骤501，接收虚拟实例的计算节点发送的镜像流量报文；
流量镜像，可以指的是为了流量监控等目的，将待监控端口的流量复制至特定的监控端口的过程，具体可以表现为将虚拟实例的流量复制到目的终端的过程。
在本申请实施例中，可以通过对计算节点的流量的设计编排，以及通过在计算节点实现对待镜像流量的镜像以及镜像流量报文的生成，将虚拟实例镜像流量的相关信息设计到报文中，通过报文携带方式从计算节点发送出去，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及实现在终端节点对镜像流量进行的区分。
在本申请的一种实施例中，目的终端可以接收虚拟实例的计算节点发送的镜像流量报文，以便根据镜像流量报文区分端口的入出镜像流量，例如基于所携带的流量流表中包含的流量方向信息区分镜像流量。
具体地，所接收的镜像流量报文可以基于镜像流量和流量流表生成，其中，镜像流量基于对虚拟实例的入流量和出流量进行镜像得到。
流量镜像信息至少包括流量镜像实例信息、终端节点信息、流量方向信息、流量过滤策略信息以及用户自定义标签信息等，以基于用户配置的流量镜像实例信息、流量方向信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息(例如流量区分标签，镜像后截取的数据包长等)来将用户虚拟实例的网络流量镜像到指定的终端节点，便于后续不同虚拟实例的镜像的流量能够在同一终端节点(如果不同虚拟实例的终端节点信息配置为同一个)根据用户自定义标签信息进行区分，即使得虚拟实例的流量报文五元组相同。以及还可以通过实现虚拟实例的入流量和出流量分别进行镜像，区分流量方向，让用户可以更精确灵活地对云上实例进行流量镜像。
步骤502，根据镜像流量报文区分端口的入出镜像流量。
在实际应用中，具体可以基于镜像流量报文所携带的流量方向信息区分端口的入出镜像流量，还可以基于镜像流量报文所携带的流量镜像实例信息区分端口的入出镜像流量，以及还可以基于镜像流量报文所携带的流量方向信息和流量镜像实例信息区分端口的入出镜像流量。需要说明的是，所借助的用于区分端口入出镜像流量的相关信息，除了前述信息以外，还可以是报文中其他携带的信息；以及，所借助的用于区分端口入出镜像流量的相关信息，具体可以基于报文中所设计携带的信息确定，本申请实施例对此不加以限制。
在进行镜像流量区分时，在一种情况下，可以基于镜像流量包的流量方向信息区分镜像流量的入镜像流量和出镜像流量，对入流量和出流量进行分析；在另一种情况下，可以基于镜像流量包的流量镜像实例信息和流量方向区分与流量镜像实例信息相应虚拟实例的入镜像流量和出镜像流量，对与流量镜像实例信息相应虚拟实例的入流量和出流量进行分析；在又一种情况下，还可以基于镜像流量包的流量镜像实例信息区分与不同流量镜像实例信息相应虚拟实例的镜像流量，对不同虚拟实例的镜像流量进行分析。
在本申请实施例中，通过实现虚拟实例的入流量和出流量分别进行镜像，区分流量方向，让用户可以更精确灵活地对云上实例进行流量镜像，且流量镜像过程在虚拟实例所在的计算节点完成，极大节省数据中心的网络带宽资源，以及不影响用户虚拟实例的主流程，用户镜像后的流量可以通过配置分发到任意一个指定的终端节点(只要三层网络可达)，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及实现在终端节点对镜像流量进行的区分。进一步地，流量镜像网关根据路由转发表将镜像流量报文基于UDP封装双层Tunnel报文发送到目的终端节点，通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。此外，还可以基于用户配置的流量过滤器过滤策略也在计算节点完成，在源端将不需要的流量过滤出来，过滤器策略支持接受及丢弃操作。
参照图6，示出了本申请实施例提供的虚拟实例的流量镜像的应用场景示意图，本申请实施例在公有云中实现了基于UDP协议，具体通过VXLAN Tunnel封装的流量流表Open vSwitch所编排的流量镜像。
公有云上待镜像虚拟机实例的逻辑网络分布可以如图4所示，假设虚拟实例1(即VM1)和虚拟实例2(即VM2)位于用户VPC1中子网2(即subnet2)中，虚拟实例3(即VM3)位于用户VPC2中的子网1(即subnet1)中，每个VPC均可以在镜像网关上创建一个流量镜像网关实例(例如mrgw-VPC1、mrgw-VPC2等)，而一个镜像网关组中可以包含多个镜像网关节点来承载不同VPC的流量镜像网关实例，其中不同的镜像网关节点可以通过基于多台物理服务器作为节点实现。
假设用户对VPC2中subnet1的虚拟实例3(VM3)的入或出流量进行镜像，并配置流量过滤策略，将入或出镜像的流量发送到指定的终端节点VPC1中subnet2中的虚拟实例2(VM2)中，当用户在VPC1中subnet2的虚拟实例1对镜像虚拟实例3(VM3)进行访问时，可以实现数据流量的转发。
具体表现为，如图6所示的虚线1为VM1访问VM3的访问流量，虚线2为VM1访问VM3的响应流量，对VM3而言，此时访问流量可以为入流量，响应流量可以为出流量，用户对VM3配置了入(出)流量的镜像功能，那么将在VM3所在的宿主节点(计算节点2)的Open vSwitch上的br-int网桥上下发相应的编排流表，将入(出)流量镜像出来通过UDP协议发送到镜像网关组的镜像节点上。同时还会在镜像网关组给VPC2的镜像网关实例(即mrgw-VPC2)下发转发路由表，而镜像网关实例根据下发的转发路由表将流量转发到终端节点(即VPC1中虚拟实例VM2)上，以便终端节点能够基于镜像流量报文的流量流表中流量方向信息区分镜像流量。
在本申请实施例中，通过实现虚拟实例的入流量和出流量分别进行镜像，区分流量方向，让用户可以更精确灵活地对云上实例进行流量镜像，且流量镜像过程在虚拟实例所在的计算节点完成，极大节省数据中心的网络带宽资源，以及不影响用户虚拟实例的主流程，用户镜像后的流量可以通过配置分发到任意一个指定的终端节点(只要三层网络可达)，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及实现在终端节点对镜像流量进行的 区分。进一步地，流量镜像网关根据路由转发表将镜像流量报文基于UDP封装双层Tunnel报文发送到目的终端节点，通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。此外，还可以基于用户配置的流量过滤器过滤策略也在计算节点完成，在源端将不需要的流量过滤出来，过滤器策略支持接受及丢弃操作。
需要说明的是，对于方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请实施例并不受所描述的动作顺序的限制，因为依据本申请实施例，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请实施例所必须的。
参照图7，示出了本申请的一种虚拟实例的流量镜像装置实施例的结构框图，应用于虚拟机平台，虚拟机平台包含虚拟实例的计算节点，具体可以包括如下模块：
待镜像流量获取模块701，用于获取虚拟实例的待镜像流量，虚拟实例的待镜像流量包括入流量和/或出流量；
流量镜像模块702，用于在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量；
镜像流量报文生成模块703，用于获取所构建的针对镜像流量的流量流表，根据镜像流量和流量流表生成镜像流量报文；
镜像流量报文发送模块704，用于向目的终端发送镜像流量报文，以便目的终端根据镜像流量报文区分端口的入出镜像流量。
在本申请的一种实施例中，本申请实施例提出的装置还可以包括如下模块：
流量流表构建模块，用于获取所配置的流量镜像信息，采用流量镜像信息构建针对镜像流量的流量流表；其中，流量镜像信息至少包括流量方向信息、流量镜像实例信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息。
在本申请的一种实施例中，镜像流量包括针对入流量的入镜像流量和针对出流量的出镜像流量；流量流表构建模块可以包括如下子模块：
流量流表构建子模块，用于采用流量镜像实例信息、流量方向信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息，分别构建入镜像流量的入流量流表，以及出镜像流量的出流量流表。
在本申请的一种实施例中，虚拟实例位于虚拟私有云，虚拟私有云在镜像网关具有所创建的相应的流量镜像网关实例，用于承载不同流量镜像网关实例的镜像网关组包括多个镜像网关节点。
在本申请的一种实施例中，镜像流量报文生成模块703可以包括如下子模块：
镜像流量接收子模块，用于在虚拟实例的计算节点构建得到镜像流量后，通过镜像网关组的镜像网关节点接收镜像流量和流量流表；
镜像流量报文生成子模块，用于采用镜像流量和流量流表生成镜像流量报文。
在本申请的一种实施例中，镜像流量报文生成模块703还可以包括如下子模块：
镜像流量包生成子模块，用于通过镜像网关节点获取路由转发表，并根据路由 转发表和流量流表对镜像流量报文进行报文处理，生成镜像流量包。
在本申请的一种实施例中，镜像流量包生成子模块可以包括如下单元：
路由转发信息获取单元，用于获取流量流表的流量镜像信息，以及获取路由转发表的路由转发信息；
镜像流量包生成单元，用于响应流量流表的流量镜像信息分别与路由转发信息匹配成功，采用路由转发信息对镜像流量报文进行封装，得到镜像流量包。
在本申请的一种实施例中，在根据镜像流量和流量流表生成镜像流量报文之前，本申请实施例提出的装置还可以包括如下模块：
访问请求接收模块，用于接收用户目的终端发送的访问请求；其中，访问请求包括所要访问的虚拟实例，虚拟实例在镜像网关具有所创建的相应的流量镜像网关实例。
在本申请的一种实施例中，镜像流量报文发送模块704可以包括如下子模块：
目标网关地址获取子模块，用于通过镜像网关获取路由转发表并获取路由转发表的目的网关地址；
镜像流量报文发送子模块，用于基于目的网关地址确定将目的终端的目的终端节点，并向目的终端节点发送镜像流量报文。
在本申请的一种实施例中，镜像流量报文发送子模块可以包括如下单元：
镜像流量报文发送单元，用于获取所要访问的流量镜像网关实例当前所在的虚拟实例，向所要访问的流量镜像网关实例当前所在的虚拟实例，所对应的流量镜像网关实例转发路由转发表，以便基于所对应的流量镜像网关实例基于路由转发表将镜像流量报文转发至目的终端节点。
在本申请实施例中，本申请实施例提供的虚拟实例的流量镜像装置可以在虚拟实例的计算节点对虚拟实例的入流量和出流量进行镜像，得到镜像流量，以及可以获取所构建的针对镜像流量的流量流表，并根据镜像流量和流量流表生成镜像流量报文，向目的终端发送镜像流量报文，以便目的终端能够根据镜像流量报文区分端口的入出镜像流量。通过对计算节点的流量的设计编排，以及通过在计算节点实现对待镜像流量的镜像以及镜像流量报文的生成，将虚拟实例镜像流量的相关信息设计到报文中，通过报文携带方式从计算节点发送出去，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及实现在终端节点对镜像流量进行的区分。进一步地，还可以通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。
参照图8，示出了本申请的另一种虚拟实例的流量镜像装置实施例的结构框图，应用于目的终端，目的终端与虚拟机平台通信连接，虚拟机平台包含虚拟实例的计算节点，具体可以包括如下模块：
镜像流量报文接收模块801，用于接收虚拟实例的计算节点发送的镜像流量报文；镜像流量报文基于镜像流量和流量流表生成，其中，镜像流量基于对虚拟实例的入流量和出流量进行镜像得到；
镜像流量区分模块802，用于根据镜像流量报文区分端口的入出镜像流量。
在本申请的一种实施例中，流量流表基于所配置的流量镜像信息构建，流量镜像信息至少包括流量方向信息和/或流量镜像实例信息；镜像流量区分模块802可以包括如下子模块：
第一镜像流量区分子模块，用于基于镜像流量包的流量方向信息区分镜像流量的入镜像流量和出镜像流量，对入流量和出流量进行分析；
第二镜像流量区分子模块，用于基于镜像流量包的流量镜像实例信息和流量方向区分与流量镜像实例信息相应虚拟实例的入镜像流量和出镜像流量，对与流量镜像实例信息相应虚拟实例的入流量和出流量进行分析；
第三镜像流量区分子模块，用于基于镜像流量包的流量镜像实例信息区分与不同流量镜像实例信息相应虚拟实例的镜像流量，对不同虚拟实例的镜像流量进行分析。
在本申请实施例中，本申请实施例提供的虚拟实例的流量镜像装置通过实现虚拟实例的入流量和出流量分别进行镜像，区分流量方向，让用户可以更精确灵活地对云上实例进行流量镜像，且流量镜像过程在虚拟实例所在的计算节点完成，极大节省数据中心的网络带宽资源，以及不影响用户虚拟实例的主流程，用户镜像后的流量可以通过配置分发到任意一个指定的终端节点(只要三层网络可达)，在占用数据中心最少的情况下实现对虚拟实例的流量的镜像，向指定终端节点进行的镜像发送，以及实现在终端节点对镜像流量进行的区分。进一步地，流量镜像网关根据路由转发表将镜像流量报文基于UDP封装双层Tunnel报文发送到目的终端节点，通过根据计算节点发送出的镜像流量报文特性，设计镜像网关上的路由转发表，实现对镜像报文的高速处理。此外，还可以基于用户配置的流量过滤器过滤策略也在计算节点完成，在源端将不需要的流量过滤出来，过滤器策略支持接受及丢弃操作。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本申请实施例还提供了一种虚拟机平台，包括：
包括处理器、存储器及存储在存储器上并能够在处理器上运行的计算机程序，该计算机程序被处理器执行时实现上述虚拟实例的流量镜像方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质上存储计算机程序，计算机程序被处理器执行时实现上述虚拟实例的流量镜像方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
本说明书中的各个实施例均采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似的部分互相参见即可。
本领域内的技术人员应明白，本申请实施例的实施例可提供为方法、装置、或计算机程序产品。因此，本申请实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请实施例是参照根据本申请实施例的方法、终端设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理终端设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理终端设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理终端设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理终端设备上，使得在计算机或其他可编程终端设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程终端设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请实施例的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请实施例范围的所有变更和修改。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者终端设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者终端设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括要素的过程、方法、物品或者终端设备中还存在另外的相同要素。
以上对本申请所提供的一种虚拟实例的流量镜像方法、一种虚拟实例的流量镜像装置、相应的一种虚拟机平台以及相应的一种计算机可读存储介质，进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上，本说明书内容不应理解为对本申请的限制。

Claims (15)

  1. 一种虚拟实例的流量镜像方法，其特征在于，应用于虚拟机平台，所述虚拟机平台包含所述虚拟实例的计算节点，所述方法包括：
    获取所述虚拟实例的待镜像流量，所述虚拟实例的待镜像流量包括入流量和/或出流量；
    在所述虚拟实例的计算节点对所述虚拟实例的入流量和出流量进行镜像，得到镜像流量；
    获取所构建的针对所述镜像流量的流量流表，根据所述镜像流量和所述流量流表生成镜像流量报文；
    向目的终端发送所述镜像流量报文，以便所述目的终端根据所述镜像流量报文区分端口的入出镜像流量。
  2. 根据权利要求1所述的方法，其特征在于，所述获取所构建的针对所述镜像流量的流量流表，还包括：
    获取所配置的流量镜像信息，采用所述流量镜像信息构建针对所述镜像流量的流量流表；其中，所述流量镜像信息至少包括流量方向信息、流量镜像实例信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息。
  3. 根据权利要求2所述的方法，其特征在于，所述镜像流量包括针对入流量的入镜像流量和针对出流量的出镜像流量；所述采用所述流量镜像信息构建针对所述镜像流量的流量流表，包括：
    采用所述流量镜像实例信息、流量方向信息、终端节点信息、流量过滤策略信息以及用户自定义标签信息，分别构建入镜像流量的入流量流表，以及出镜像流量的出流量流表。
  4. 根据权利要求1所述的方法，其特征在于，所述虚拟实例位于虚拟私有云，所述虚拟私有云在镜像网关具有所创建的相应的流量镜像网关实例，用于承载不同流量镜像网关实例的镜像网关组包括多个镜像网关节点。
  5. 根据权利要求4所述的方法，其特征在于，所述根据所述镜像流量和所述流量流表生成镜像流量报文，包括：
    在所述虚拟实例的计算节点构建得到镜像流量后，通过所述镜像网关组的镜像网关节点接收所述镜像流量和所述流量流表；
    采用所述镜像流量和所述流量流表生成镜像流量报文；
    还包括：
    通过所述镜像网关节点获取路由转发表，并根据所述路由转发表和所述流量流表对所述镜像流量报文进行报文处理，生成镜像流量包。
  6. 根据权利要求5所述的方法，其特征在于，所述根据所述路由转发表和所述流量流表对所述镜像流量报文进行报文处理，生成镜像流量包，包括：
    获取所述流量流表的流量镜像信息，以及获取所述路由转发表的路由转发信息；
    响应所述流量流表的流量镜像信息分别与所述路由转发信息匹配成功，采用所 述路由转发信息对所述镜像流量报文进行封装，得到镜像流量包。
  7. 根据权利要求1或4所述的方法，其特征在于，在所述根据所述镜像流量和所述流量流表生成镜像流量报文之前，还包括：
    接收用户所述目的终端发送的访问请求；其中，所述访问请求包括所要访问的虚拟实例，所述虚拟实例在镜像网关具有所创建的相应的流量镜像网关实例。
  8. 根据权利要求7所述的方法，其特征在于，所述向目的终端发送所述镜像流量报文，包括：
    通过镜像网关获取路由转发表并获取所述路由转发表的目的网关地址；
    基于所述目的网关地址确定将所述目的终端的目的终端节点，并向所述目的终端节点发送所述镜像流量报文。
  9. 根据权利要求8所述的方法，其特征在于，所述向所述目的终端节点发送所述镜像流量报文，包括：
    获取所要访问的流量镜像网关实例当前所在的虚拟实例，向所述所要访问的流量镜像网关实例当前所在的虚拟实例，所对应的流量镜像网关实例转发所述路由转发表，以便基于所对应的流量镜像网关实例基于所述路由转发表将所述镜像流量报文转发至目的终端节点。
  10. 一种虚拟实例的流量镜像方法，其特征在于，应用于目的终端，所述目的终端与虚拟机平台通信连接，所述虚拟机平台包含所述虚拟实例的计算节点，所述方法包括：
    接收所述虚拟实例的计算节点发送的镜像流量报文；所述镜像流量报文基于镜像流量和流量流表生成，其中，所述镜像流量基于对虚拟实例的入流量和出流量进行镜像得到；
    根据所述镜像流量报文区分端口的入出镜像流量。
  11. 根据权利要求10所述的方法，其特征在于，所述流量流表基于所配置的流量镜像信息构建，所述流量镜像信息至少包括流量方向信息和/或流量镜像实例信息；
    所述根据所述镜像流量报文区分端口的入出镜像流量，包括：
    基于所述镜像流量包的流量方向信息区分所述镜像流量的入镜像流量和出镜像流量，对所述入流量和出流量进行分析；
    和/或，基于所述镜像流量包的流量镜像实例信息和所述流量方向区分与所述流量镜像实例信息相应虚拟实例的入镜像流量和出镜像流量，对与所述流量镜像实例信息相应虚拟实例的入流量和出流量进行分析；
    和/或，基于所述镜像流量包的流量镜像实例信息区分与不同流量镜像实例信息相应虚拟实例的镜像流量，对不同虚拟实例的镜像流量进行分析。
  12. 一种虚拟实例的流量镜像装置，其特征在于，应用于虚拟机平台，所述虚拟机平台包含所述虚拟实例的计算节点，所述装置包括：
    待镜像流量获取模块，用于获取所述虚拟实例的待镜像流量，所述虚拟实例的待镜像流量包括入流量和/或出流量；
    流量镜像模块，用于在所述虚拟实例的计算节点对所述虚拟实例的入流量和出流量进行镜像，得到镜像流量；
    镜像流量报文生成模块，用于获取所构建的针对所述镜像流量的流量流表，根据所述镜像流量和所述流量流表生成镜像流量报文；
    镜像流量报文发送模块，用于向目的终端发送所述镜像流量报文，以便所述目的终端根据所述镜像流量报文区分端口的入出镜像流量。
  13. 一种虚拟实例的流量镜像装置，其特征在于，应用于目的终端，所述目的终端与虚拟机平台通信连接，所述虚拟机平台包含所述虚拟实例的计算节点，所述装置包括：
    镜像流量报文接收模块，用于接收所述虚拟实例的计算节点发送的镜像流量报文；所述镜像流量报文基于镜像流量和流量流表生成，其中，所述镜像流量基于对虚拟实例的入流量和出流量进行镜像得到；
    镜像流量区分模块，用于根据所述镜像流量报文区分端口的入出镜像流量。
  14. 一种虚拟机平台，其特征在于，包括：处理器、存储器及存储在所述存储器上并能够在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如权利要求1至9或权利要求10至11中任一项所述虚拟实例的流量镜像方法。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现如权利要求1至9或权利要求10至11中任一项所述虚拟实例的流量镜像方法。
PCT/CN2023/140326 2023-02-01 2023-12-20 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质 WO2024159962A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310050246.9A CN115865802B (zh) 2023-02-01 2023-02-01 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质
CN202310050246.9 2023-02-01

Publications (1)

Publication Number Publication Date
WO2024159962A1 true WO2024159962A1 (zh) 2024-08-08

Family

ID=85657442

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/140326 WO2024159962A1 (zh) 2023-02-01 2023-12-20 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质

Country Status (2)

Country Link
CN (1) CN115865802B (zh)
WO (1) WO2024159962A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115865802B (zh) * 2023-02-01 2023-06-23 天翼云科技有限公司 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102546390A (zh) * 2011-11-17 2012-07-04 杭州华三通信技术有限公司 一种远程镜像方法及装置
CN108092845A (zh) * 2017-11-06 2018-05-29 中国银联股份有限公司 镜像流量的区分和定位
CN114172854A (zh) * 2021-11-30 2022-03-11 新华三大数据技术有限公司 报文镜像、镜像配置方法、虚拟交换机及镜像配置装置
CN114615174A (zh) * 2022-03-10 2022-06-10 奇安信科技集团股份有限公司 流量监控方法及装置
CN115865802A (zh) * 2023-02-01 2023-03-28 天翼云科技有限公司 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11516050B2 (en) * 2019-06-21 2022-11-29 Amazon Technologies, Inc. Monitoring network traffic using traffic mirroring
CN114531380B (zh) * 2020-10-30 2024-11-08 中国移动通信有限公司研究院 一种镜像质量核查方法、装置及电子设备
CN113709017B (zh) * 2021-08-17 2022-10-04 中盈优创资讯科技有限公司 虚拟化流量的采集方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102546390A (zh) * 2011-11-17 2012-07-04 杭州华三通信技术有限公司 一种远程镜像方法及装置
CN108092845A (zh) * 2017-11-06 2018-05-29 中国银联股份有限公司 镜像流量的区分和定位
CN114172854A (zh) * 2021-11-30 2022-03-11 新华三大数据技术有限公司 报文镜像、镜像配置方法、虚拟交换机及镜像配置装置
CN114615174A (zh) * 2022-03-10 2022-06-10 奇安信科技集团股份有限公司 流量监控方法及装置
CN115865802A (zh) * 2023-02-01 2023-03-28 天翼云科技有限公司 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质

Also Published As

Publication number Publication date
CN115865802A (zh) 2023-03-28
CN115865802B (zh) 2023-06-23

Similar Documents

Publication Publication Date Title
US8630294B1 (en) Dynamic bypass mechanism to alleviate bloom filter bank contention
KR102586898B1 (ko) 패킷 처리 방법 및 장치, 및 관련 디바이스들
EP2926513B1 (en) Packet prioritization in a software-defined network implementing openflow
Rosen Linux kernel networking: Implementation and theory
EP3958521A1 (en) Method and apparatus for providing service for service flow
US8799507B2 (en) Longest prefix match searches with variable numbers of prefixes
CN110943924B (zh) 网络中分段源路由的方法及存储介质
US10693790B1 (en) Load balancing for multipath group routed flows by re-routing the congested route
EP3481015A1 (en) Variable-based forwarding path construction for packet processing within a network device
CN101009683A (zh) 处理网络流量的计算机系统及方法
US20080002663A1 (en) Virtual network interface card loopback fastpath
US10097467B1 (en) Load balancing for multipath groups routed flows by re-associating routes to multipath groups
CN112751769B (zh) 发送报文的方法、装置及系统
WO2016206511A1 (zh) 一种实现nat的方法和装置
WO2017107814A1 (zh) 一种传播QoS策略的方法、装置及系统
US10819640B1 (en) Congestion avoidance in multipath routed flows using virtual output queue statistics
CN105812261A (zh) 信息中心网络中的报文转发方法和系统
US11012418B2 (en) Multi-access interface for internet protocol security
WO2016150296A1 (zh) 发送、接收流规范规则的方法和装置
CN114301868B (zh) 快速生成虚拟容器浮动ip的方法及网络直通的方法和装置
CN106973053A (zh) 宽带接入服务器的加速方法和系统
WO2024159962A1 (zh) 虚拟实例的流量镜像方法、装置、虚拟机平台及存储介质
CN113395212A (zh) 网络装置及其操作方法和非暂时性计算机可读介质
CN115834291B (zh) 分布式内网服务数据获取方法、装置、设备及存储介质
CN102158406A (zh) 面向计算机网络链路的智能选路方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23919524

Country of ref document: EP

Kind code of ref document: A1