CN-121984900-A - Flow-based micro burst detection method, device and equipment

CN121984900ACN 121984900 ACN121984900 ACN 121984900ACN-121984900-A

Abstract

The application provides a flow-based micro burst detection method, a flow-based micro burst detection device and flow-based micro burst detection equipment, which are characterized in that a special statistics counter group is bound with data flows, counting accumulation is completed according to accurate arrival time matching statistics subcycles after a message hits a flow table, subcycle level fine granularity flow statistics of a single data flow is realized, the limitation that only port level integral monitoring can be realized in the traditional technology is broken through, and core data support is provided for positioning single flow micro bursts. After the statistics period is reached, the data of the counter are summarized to form a statistics data set, and the counter is cleared, so that the integrity of the statistics data is guaranteed, the cyclic multiplexing of the counter resources is realized, and continuous statistics is supported. After the standardized encapsulation of the data set is reported, the analyzer can uniformly analyze and calculate the average flow velocity of each subcycle and quantitatively judge the micro burst, thereby greatly improving the accuracy and objectivity of the micro burst detection and solving the core problem that the single data flow micro burst phenomenon cannot be identified in the prior art.

Inventors

WANG CHAOQUN
LUO BIN
YANG YI

Assignees

格创通信(浙江)有限公司

Dates

Publication Date: 20260505
Application Date: 20260331

Claims (10)

1. A method for flow-based micro burst detection, comprising: When a message of a data stream hits a corresponding flow statistic flow table, determining a statistical sub-period to which the message belongs according to the arrival time of the message, and carrying out flow counting accumulation on a statistical counter corresponding to the statistical sub-period, wherein the data stream to which the message belongs is matched with a group of statistical counters; When a statistical period is reached, summarizing flowmeter values of all the statistical counters to form a statistical data set, and resetting count values of all the statistical counters, wherein the statistical period comprises all the statistical sub-periods; packaging the statistical data set into a preset report data structure, and reporting the preset report data structure to an analyzer; The analyzer calculates the average flow velocity of the data flow in each statistical sub-period according to the statistical data set, and confirms whether the data flow generates micro burst or not according to the average flow velocity.
2. The method according to claim 1, wherein when the message in the data flow hits the corresponding flow statistics flow table, determining the statistical sub-period to which the message belongs according to the arrival time of the message, and before the step of accumulating the flow count of the statistical counter corresponding to the statistical sub-period, further comprising: configuring N statistic counters for each data stream in the flow statistic flow table; Dividing the statistical period into N statistical subcycles in an equally dividing way, so that each statistical counter corresponds to one statistical subcycle one by one.
3. The method of claim 2, further comprising, prior to the step of configuring N statistics counters for each data flow in the traffic statistics flow table: When the queue depth of the outlet port monitored in real time exceeds a preset threshold value and the preset threshold value is lower than the packet loss threshold value of the port, starting a flow statistics flow table micro-burst statistics function corresponding to all data flows on the outlet port.
4. The method of claim 1, wherein the step of aggregating flow meter values of all of the statistical counters forms a statistical dataset, comprising: acquiring a starting time identifier of the statistical period, a flow count value of each statistical sub-period, a historical reporting state identifier and a flow statistical granularity identifier; and forming the statistical data set by the starting time identifier, the flow count value of each statistical sub-period, the historical reporting state identifier and the flow statistical granularity identifier.
5. The method according to claim 4, wherein when the bandwidth value of the output port transmitting the data stream is greater than the bandwidth threshold, the step of determining the statistical sub-period to which the packet belongs according to the arrival time of the packet when the packet of the data stream hits the corresponding traffic statistical flow table, and performing traffic count accumulation on the statistical counter corresponding to the statistical sub-period includes: configuring flow statistics granularity, and recording the actual message byte number of the data flow to which the message belongs through an independent register; And when the actual byte number reaches a preset byte unit, counting and updating the statistical counter corresponding to the statistical sub-period.
6. The method of claim 1, wherein said analyzer calculates an average flow rate of the data stream for each of said statistical sub-periods from said set of statistical data, and wherein said step of determining whether or not said data stream is micro-bursty based on said average flow rate comprises: acquiring a normal average rate of the data stream and a bandwidth value of the output port; And if the average flow velocity in any statistical sub-period reaches a preset multiple of the normal average velocity or exceeds the bandwidth value of the outlet port, determining that the data flow has micro burst.
7. A flow-based micro burst detection apparatus, the apparatus comprising: the data statistics module is used for determining the statistical sub-period to which the message belongs according to the arrival time of the message when the message of the data flow hits the corresponding flow statistics flow table, and carrying out flow counting accumulation on the statistical counter corresponding to the statistical sub-period, wherein the data flow to which the message belongs is matched with a group of statistical counters; the data processing module is used for summarizing flowmeter values of all the statistical counters to form a statistical data set when a statistical period is reached, and clearing count values of all the statistical counters; the data reporting module is used for packaging the statistical data set into a preset reporting data structure and reporting the preset reporting data structure to the analyzer; The analyzer is used for calculating the average flow velocity of the data flow in each statistical subcycle according to the statistical data set, and confirming whether the data flow generates micro burst or not according to the average flow velocity.
8. The apparatus of claim 7, wherein said data statistics module is further configured to configure N statistics counters for each data flow in said traffic statistics flow table, and divide said statistics period equally into N said statistics subcycles such that each said statistics counter corresponds one-to-one to one with one said statistics subcycle.
9. The apparatus of claim 8, wherein the data statistics module is further configured to start a traffic statistics flow table micro-burst statistics function for all data flows on the egress port when the real-time monitored queue depth of the egress port exceeds a preset threshold and the preset threshold is lower than a packet loss threshold of the port.
10. An electronic device, comprising: A memory for storing one or more programs; A processor; The method of any one of claims 1 to 6 is implemented when the one or more programs are executed by the processor.

Description

Flow-based micro burst detection method, device and equipment Technical Field The present application relates to the field of network traffic monitoring technologies, and in particular, to a method, an apparatus, and a device for detecting micro bursts based on flows. Background The traditional network management software calculates the real-time bandwidth of the network by taking seconds to minutes as a period, the monitored time granularity is thicker, the integral flow change trend of the network can only be reflected, the micro burst phenomenon in millisecond level can only be represented by a stable flow curve, the identification capability of the micro burst flow is not provided, the effective monitoring of the micro burst is difficult to realize, the monitoring mode of the network telemetry (TELEMETRY) improves the time granularity of the flow monitoring to microsecond level, the identification of the port micro burst phenomenon can be realized by monitoring the queue depth or the port rate of an outlet port of the network equipment, whether the micro burst occurs in a specific port can be judged, the monitoring dimension of the mode is only aiming at the integral flow of the port, and a plurality of different data flows are usually mixed in the port, the independent flow statistics and the monitoring can not be carried out on the single data flow in the port, the integral flow characteristic of the port can only be represented, and the micro burst identification and the positioning of the specific data flow can not be realized. With the development of network communication technology, the application of the large-bandwidth port in network equipment is more and more extensive, the flow bearing capacity in unit time is greatly improved, and the precision requirement of network fine management on flow monitoring is also improved. The monitoring capability of the conventional micro burst detection scheme is only remained on the whole port level, a network manager can only know whether the micro burst occurs in the port or not, and cannot clearly determine which data flow is used for inducing the micro burst, meanwhile, the conventional scheme does not have adaptive design aiming at the flow characteristics of the large-bandwidth port, lacks reasonable allocation thought of flow monitoring resources, is difficult to match with the actual requirements of network fine management on the efficient utilization of the specific data flow micro burst detection and monitoring resources, and cannot provide accurate technical support on the data flow level for targeted optimization of network flow and network quality improvement. Disclosure of Invention The embodiment of the application provides a method, a device and equipment for detecting micro burst based on flow, which are used for improving the accuracy and objectivity of micro burst detection. In a first aspect, an embodiment of the present application provides a method for detecting a micro burst based on a stream, including: When a message of a data stream hits a corresponding flow statistic flow table, determining a statistical sub-period to which the message belongs according to the arrival time of the message, and carrying out flow counting accumulation on a statistical counter corresponding to the statistical sub-period, wherein the data stream to which the message belongs is matched with a group of statistical counters; When a statistical period is reached, summarizing flowmeter values of all the statistical counters to form a statistical data set, and resetting count values of all the statistical counters, wherein the statistical period comprises all the statistical sub-periods; packaging the statistical data set into a preset report data structure, and reporting the preset report data structure to an analyzer; The analyzer calculates the average flow velocity of the data flow in each statistical sub-period according to the statistical data set, and confirms whether the data flow generates micro burst or not according to the average flow velocity. In a second aspect, embodiments of the present application provide a stream-based micro burst detection apparatus, the apparatus comprising: the data statistics module is used for determining the statistical sub-period to which the message belongs according to the arrival time of the message when the message of the data flow hits the corresponding flow statistics flow table, and carrying out flow counting accumulation on the statistical counter corresponding to the statistical sub-period, wherein the data flow to which the message belongs is matched with a group of statistical counters; the data processing module is used for summarizing flowmeter values of all the statistical counters to form a statistical data set when a statistical period is reached, and clearing count values of all the statistical counters; the data reporting module is used for packaging the statistical data set into a preset reporting d