CN-122027508-A - Network index data acquisition method, device, equipment, medium and product

CN122027508ACN 122027508 ACN122027508 ACN 122027508ACN-122027508-A

Abstract

The application relates to the technical field of network communication, and provides a network index data acquisition method, device, equipment, medium and product. The method comprises the steps of configuring eBPF instruction sets based on preset six-element information, wherein the six-element information comprises a client IP address, a client port, a server IP address, a server port, a domain name and a thread number, filtering a received first network data packet based on the eBPF instruction set to obtain a second network data packet, and collecting a network index data set corresponding to the second network data packet, wherein the second network data packet accords with the six-element information. Based on the scheme of the application, accurate and efficient network index data acquisition can be realized.

Inventors

MA LEI
WANG JIAN
GUO KAIMING
GUO SONG
LI ZHI
WANG PANPAN
QI XIANGYI

Assignees

中移（杭州）信息技术有限公司
中国移动通信集团有限公司

Dates

Publication Date: 20260512
Application Date: 20260204

Claims (14)

1. The network index data acquisition method is characterized by comprising the following steps of: configuring an extended Berkeley data packet filter eBPF instruction set based on preset six-element information, wherein the six-element information comprises a client Internet Protocol (IP) address, a client port, a server IP address, a server port, a domain name and a thread number; And filtering the received first network data packet based on the eBPF instruction set to obtain a second network data packet, and collecting a network index data set corresponding to the second network data packet, wherein the second network data packet accords with the six-element information.
2. The method of claim 1, wherein configuring eBPF the instruction set based on the preset six-element information comprises: based on preset six-element information, the eBPF instruction set is configured in at least one mode of dynamic tracking, static tracking and user state tracking.
3. The method of claim 2, wherein the configuring eBPF the instruction set based on the preset six-element information by at least one of dynamic tracking, static tracking, and user state tracking includes: Based on preset six-element information, a eBPF instruction set corresponding to a data link layer of an operating system kernel is configured in a dynamic tracking mode; based on the six-element information, configuring eBPF instruction sets corresponding to a network layer of the operating system kernel in a static tracking mode; And configuring a eBPF instruction set corresponding to a transmission layer of the operating system kernel in a dynamic tracking and static tracking mode based on the six-element information, and/or configuring a eBPF instruction set corresponding to an application layer in a user state tracking mode based on the six-element information.
4. The method of claim 1, wherein filtering the second network data packet from the received first network data packet based on the eBPF instruction set and collecting a network metric data set corresponding to the second network data packet includes: Calling a network card to receive a first network data packet, and transmitting the first network data packet to an operating system kernel; acquiring first index data corresponding to the first network data packet based on eBPF instruction sets corresponding to a data link layer of the operating system kernel; Filtering from the first network data packet based on eBPF instruction sets corresponding to a network layer of the operating system kernel to obtain an intermediate network data packet, and collecting second index data corresponding to the intermediate network data packet; Filtering to obtain a second network data packet from the intermediate network data packet based on eBPF instruction sets corresponding to a transmission layer of the operating system kernel and collecting third index data corresponding to the second network data packet, or filtering to obtain the second network data packet from the intermediate network data packet based on eBPF instruction sets corresponding to an application layer and collecting third index data corresponding to the second network data packet; And determining a network index data set corresponding to the second network data packet according to the first index data, the second index data and the third index data corresponding to the second network data packet.
5. The method of claim 4, wherein filtering the intermediate network data packet from the first network data packet based on the eBPF instruction set corresponding to the network layer of the operating system kernel comprises: Analyzing the first network data packet based on eBPF instruction sets corresponding to the network layer of the operating system kernel to obtain corresponding communication quadruple information and thread numbers; Filtering from the first network data packet according to communication quadruple information and thread number corresponding to the first network data packet to obtain an intermediate network data packet; The intermediate network data packet is a first network data packet conforming to the client IP address, the client port, the server IP address, the server port and the thread number in the six-element information.
6. The method of claim 4, wherein filtering the second network packet from the intermediate network packet based on the eBPF instruction set corresponding to the transport layer of the operating system kernel comprises: under the condition that the intermediate network data packet is a non-encrypted hypertext transfer protocol (HTTP) protocol data packet, analyzing the intermediate network data packet based on eBPF instruction sets corresponding to a transmission layer of the operating system kernel to obtain corresponding HTTP request data; Filtering from the intermediate network data packet according to the domain name contained in the HTTP request data corresponding to the intermediate network data packet to obtain a second network data packet; wherein the second network data packet is an intermediate network data packet conforming to the domain name in the six-element information.
7. The method of claim 4, wherein filtering the second network packet from the intermediate network packet based on the eBPF instruction set corresponding to the application layer comprises: Under the condition that the intermediate network data packet is a secure hypertext transfer protocol (HTTPS) protocol data packet encrypted by a Secure Socket Layer (SSL)/transport layer security protocol (TLS), tracking the intermediate network data packet in a user state SSL/TLS protocol analysis flow based on a eBPF instruction set corresponding to an application layer to obtain request data before SSL/TLS encryption or response data after SSL/TLS decryption; Filtering the intermediate network data packet to obtain a second network data packet according to the domain name contained in the request data before SSL/TLS encryption or the response data after SSL/TLS decryption; wherein the second network data packet is an intermediate network data packet conforming to the domain name in the six-element information.
8. The method of claim 4, wherein after determining the network index data set corresponding to the second network data packet according to the first index data, the second index data, and the third index data corresponding to the second network data packet, further comprises: and transmitting the network index data set corresponding to the second network data packet from the operating system kernel to an application layer through a ring buffer queue.
9. The method according to any one of claims 4 to 8, wherein the first index data corresponding to the second network data packet includes a network card transceiving time; The second index data corresponding to the second network data packet comprises at least one of a time-to-live value TTL and a data packet length; And the third index data corresponding to the second network data packet comprises at least one of Round Trip Time (RTT), congestion window size, communication state, retransmission times, weak password number and zero window number.
10. The method of claim 1, wherein after filtering the second network data packet from the received first network data packet based on the eBPF instruction set and collecting the network metric data set corresponding to the second network data packet, further comprising: performing data cleaning and index aggregation on the network index data set corresponding to the second network data packet at an application layer, and aggregating index data; And sending the aggregate index data to an index analysis platform.
11. A network index data acquisition device, comprising: The configuration module is used for configuring eBPF instruction sets based on preset six-element information, wherein the six-element information comprises a client IP address, a client port, a server IP address, a server port, a domain name and a thread number; And the acquisition module is used for filtering the received first network data packet based on the eBPF instruction set to obtain a second network data packet, and acquiring a network index data set corresponding to the second network data packet, wherein the second network data packet accords with the six-element information.
12. A network device comprising a memory, a transceiver, and a processor; the system comprises a memory for storing a computer program, a transceiver for receiving and transmitting data under the control of the processor, and a processor for reading the computer program in the memory and performing the following operations: Configuring eBPF instruction sets based on preset six-element information, wherein the six-element information comprises a client IP address, a client port, a server IP address, a server port, a domain name and a thread number; And filtering the received first network data packet based on the eBPF instruction set to obtain a second network data packet, and collecting a network index data set corresponding to the second network data packet, wherein the second network data packet accords with the six-element information.
13. A non-transitory computer readable storage medium having stored thereon a computer program, characterized in that the computer program when executed by a processor implements the steps of the network indicator data collection method according to any of claims 1 to 10.
14. A computer program product comprising a computer program, characterized in that the computer program when executed by a processor implements the steps of the network indicator data collection method of any one of claims 1 to 10.

Description

Network index data acquisition method, device, equipment, medium and product Technical Field The present invention relates to the field of network communications technologies, and in particular, to a method, an apparatus, a device, a medium, and a product for collecting network index data. Background In modern network architecture, distributed network systems improve access response speed and overall quality of service by deploying services or content to multiple nodes close to the user. However, in a complex network environment and a scenario of massive service requests, the actual network performance of the system is often affected by a combination of a plurality of underlying factors, so that the service quality fluctuates. Such performance fluctuations not only directly affect the end user experience, but also present challenges for optimization of network performance and fault localization. And network index data are collected, so that decision basis can be provided for in-depth analysis of system performance, positioning of fault sources and implementation of effective optimization strategies. Therefore, how to accurately and efficiently collect network index data has become a technical problem to be solved. Disclosure of Invention The embodiment of the application provides a network index data acquisition method, device, equipment, medium and product, which are used for solving the technical problem of how to accurately and efficiently acquire network index data. In a first aspect, an embodiment of the present application provides a method for collecting network index data, including: configuring eBPF instruction sets based on preset six-element information, wherein the six-element information comprises a client IP address, a client port, a server IP address, a server port, a domain name and a thread number; And filtering the received first network data packet based on eBPF instruction sets to obtain a second network data packet, and collecting a network index data set corresponding to the second network data packet, wherein the second network data packet accords with six-element information. With reference to the first aspect, in some possible implementations, configuring eBPF the instruction set based on preset six-element information includes: based on preset six-element information, the eBPF instruction set is configured in at least one mode of dynamic tracking, static tracking and user state tracking. With reference to the first aspect and the foregoing implementation manner, in some possible implementation manners, configuring eBPF an instruction set by at least one of dynamic tracking, static tracking, and user state tracking based on preset six-element information includes: Based on preset six-element information, a eBPF instruction set corresponding to a data link layer of an operating system kernel is configured in a dynamic tracking mode; Based on the six-element information, configuring eBPF instruction sets corresponding to a network layer of an operating system kernel in a static tracking mode; based on the six-element information, a eBPF instruction set corresponding to a transmission layer of an operating system kernel is configured in a dynamic tracking and static tracking mode, and/or a eBPF instruction set corresponding to an application layer is configured in a user state tracking mode based on the six-element information. With reference to the first aspect and the foregoing implementation manner, in some possible implementation manners, filtering, based on the eBPF instruction set, a second network data packet from the received first network data packet, and collecting a network index data set corresponding to the second network data packet, where the filtering includes: Calling the network card to receive the first network data packet and transmitting the first network data packet to the kernel of the operating system; acquiring first index data corresponding to a first network data packet based on eBPF instruction sets corresponding to a data link layer of an operating system kernel; Filtering to obtain an intermediate network data packet from the first network data packet based on eBPF instruction sets corresponding to network layers of the kernel of the operating system, and collecting second index data corresponding to the intermediate network data packet; Filtering to obtain a second network data packet from the intermediate network data packet based on eBPF instruction sets corresponding to the transmission layer of the kernel of the operating system and collecting third index data corresponding to the second network data packet, or filtering to obtain the second network data packet from the intermediate network data packet based on eBPF instruction sets corresponding to the application layer and collecting third index data corresponding to the second network data packet; and determining a network index data set corresponding to the second network data packet according to