CN110719215A - Flow information acquisition method and device of virtual network - Google Patents

Abstract

The embodiments of the present application disclose a method and device for collecting flow information of a virtual network, and relate to the field of cloud computing. A specific implementation of the method includes: acquiring the message information in the virtual network; in response to determining that the message information matches the matching field of the preset forwarding rule, using the forwarding instruction in the action field in the preset forwarding rule, The meta-information of the packet information is forwarded to the aggregation module specified by the forwarding instruction; based on the meta-information of the packet information, flow information of the virtual switch is obtained through statistics by the aggregation module. The present application forwards the meta-information of the matched packet information to the aggregation module for statistics based on the matching field of the forwarding rule, avoiding unnecessary packet information statistics; and only forwards the meta-information of the packet information to the aggregation module , the metadata data amount is small, which reduces the overhead of data forwarding.

Description

Flow information collection method and device for virtual network

technical field

The embodiments of the present application relate to the field of computer technologies, and in particular, to a method and device for collecting flow information of a virtual network.

Background technique

With the rapid growth of cloud services, more and more services are carried on cloud computing platforms. With the complexity of business, the traffic of cloud platform also shows explosive growth. The growth of traffic not only tests the carrying capacity of the cloud network, but also poses greater challenges to the traffic monitoring of the cloud network.

At present, in the virtual network, the traffic statistics component is implemented on ovs-vswitchd. The ovs-vswitchd daemon is the core component of OVS (Open vSwitch, Open Virtual Switching Standard). data exchange. For each data packet that needs to be collected, OVS needs to copy the packet from the data channel to ovs-vswitchd in a certain way, and then ovs-vswitchd performs packet classification and statistics. In the process of counting large traffic, the duplication of data packets and the process of transmitting data packets from the data channel to ovs-vswitchd will cause a lot of overhead, and traffic collection is likely to affect the normal forwarding of data packets.

SUMMARY OF THE INVENTION

The embodiments of the present application provide a method and device for collecting flow information of a virtual network.

In a first aspect, an embodiment of the present application provides a method for collecting flow information of a virtual network, wherein the method includes: acquiring packet information in the virtual network; in response to determining that the packet information matches a matching field of a preset forwarding rule Matching, through the forwarding instruction in the action field in the preset forwarding rule, forwards the meta-information of the packet information to the aggregation module specified by the forwarding instruction. The matching field is used to identify the message information corresponding to the forwarding rule, and the action field is used to represent the The instruction information executed on the matched packet information; based on the meta information of the packet information, the flow information of the virtual switch is obtained through the aggregation module statistics.

In some embodiments, the meta-information of the message information includes: a local area network address and a forwarding port, where the forwarding port is a forwarding port for data transmission between a virtual switch and a virtual machine in the virtual network; the above-mentioned meta-information based on the message information, through the aggregation module The flow information of the virtual switch is obtained by statistics, including: identifying the virtual private network attribute information corresponding to the packet information through the aggregation module according to the local area network address and forwarding port of the packet information; The flow information of the virtual private network corresponding to the text information.

In some embodiments, in response to determining that the packet information matches the matching field of the preset forwarding rule, the meta-information of the packet information is forwarded to the specified forwarding instruction through the forwarding instruction in the action field of the preset forwarding rule. The aggregation module includes: in response to determining that the message information matches the matching domain of the preset forwarding rule, adding an access identifier to the message information, and the access identifier is used to characterize whether the security access rule of the virtual network accepts the terminal corresponding to the message information The access request is forwarded to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule, and the meta-information of the message information with the access identifier is forwarded to the aggregation module specified by the forwarding instruction, and the meta-information includes the access identifier.

In some embodiments, the above-mentioned meta-information based on the packet information, the flow information of the virtual switch is obtained by the aggregation module, including: based on the access identifier of the packet information, the aggregation module is used to collect statistics to distinguish whether the flow is accepted by the security access rule. information.

In some embodiments, in response to determining that the packet information matches the matching field of the preset forwarding rule, the meta-information of the packet information is forwarded to the specified forwarding instruction through the forwarding instruction in the action field of the preset forwarding rule. The aggregation module includes: in response to determining that the message information matches the matching domain of the preset forwarding rule, storing the meta-information of the message information in the cache; in response to reaching the preset export time, through the action in the preset forwarding rule The forwarding instruction in the domain forwards the meta-information of the packet information in the cache to the aggregation module specified by the forwarding instruction.

In a second aspect, an embodiment of the present application provides an apparatus for collecting flow information of a virtual network, wherein the apparatus includes: an obtaining unit configured to obtain packet information in the virtual network; a forwarding unit configured to respond to determining The packet information matches the matching field of the preset forwarding rule, and the meta-information of the packet information is forwarded to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule, and the matching field is used to identify the forwarding The packet information corresponding to the rule, the action field is used to represent the instruction information executed on the matched packet information; the statistics unit is configured to obtain the flow information of the virtual switch through the aggregation module based on the meta information of the packet information.

In some embodiments, the meta-information of the above-mentioned message information includes: a local area network address and a forwarding port, where the forwarding port is a forwarding port for data transmission between a virtual switch and a virtual machine in the virtual network; the statistics unit is further configured according to the message information According to the local area network address and forwarding port, the aggregation module identifies the virtual private network attribute information corresponding to the packet information; based on the virtual private network attribute information, the aggregation module obtains the flow information of the virtual private network corresponding to the packet information through statistics.

In some embodiments, the forwarding unit is further configured to, in response to determining that the packet information matches a matching field of a preset forwarding rule, add an access identifier to the packet information, where the access identifier is used to characterize whether the security access rule of the virtual network is Accept the access request of the terminal corresponding to the message information; forward the meta information of the message information with the access identifier added to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule, and the meta information includes the access identifier .

In some embodiments, the statistics unit is further configured to obtain, through the aggregation module, flow information that distinguishes whether the flow information is accepted by the security access rule or not based on the access identifier of the packet information.

In some embodiments, the forwarding unit is further configured to, in response to determining that the packet information matches the matching field of the preset forwarding rule, store the meta information of the packet information in the cache; in response to reaching the preset export time, pass The forwarding instruction in the action field in the forwarding rule is preset, and the meta-information of the packet information in the cache is forwarded to the aggregation module specified by the forwarding instruction.

In a third aspect, an embodiment of the present application provides a computer-readable medium on which a computer program is stored, wherein the method described in any implementation manner of the first aspect is implemented when the program is executed by a processor.

In a fourth aspect, an embodiment of the present application provides an electronic device, including: one or more processors; a storage device, on which one or more programs are stored, when the one or more programs are processed by the one or more processors Execution causes one or more processors to implement a method as described in any implementation form of the first aspect.

In the method and device for collecting flow information of a virtual network provided by the embodiments of the present application, first, the packet information in the virtual network is acquired; then, in response to determining that the packet information matches the matching field of the preset forwarding rule, the The forwarding instruction in the action field in the preset forwarding rule, forwards the meta-information of the packet information to the aggregation module specified by the forwarding instruction; then, based on the meta-information of the packet information, through the aggregation The module obtains the flow information of the virtual switch through statistics. The present application forwards the meta-information of the matched packet information to the aggregation module for statistics based on the matching field of the forwarding rule, avoiding unnecessary packet information statistics; in addition, because only the meta-information of the packet information is forwarded to The aggregation module has a small amount of metadata data, which reduces the overhead of data forwarding.

Description of drawings

Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG. 1 is an exemplary system architecture diagram to which an embodiment of the present application may be applied;

2 is a flowchart of an embodiment of a method for collecting flow information of a virtual network according to the present application;

3 is a schematic diagram of an application scenario of the method for collecting flow information of a virtual network according to the present embodiment;

FIG. 4 is a flowchart of another embodiment of a method for collecting flow information of a virtual network according to the present application;

5 is a structural diagram of an embodiment of a device for collecting flow information of a virtual network according to the present application;

FIG. 6 is a schematic structural diagram of a computer system suitable for implementing the embodiments of the present application.

Detailed ways

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the related invention, but not to limit the invention. In addition, it should be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

FIG. 1 shows an exemplary architecture 100 to which the method and apparatus for collecting flow information of a virtual network of the present application can be applied.

As shown in FIG. 1 , the system architecture 100 may include terminal devices 101 , 102 , and 103 , a network 104 and a server 105 . The network 104 is a medium used to provide a communication link between the terminal devices 101 , 102 , 103 and the server 105 . The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The terminal devices 101, 102, and 103 may be hardware devices or software that support network connection for data interaction and data processing. When the terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with functions such as information interaction, network connection, etc., including but not limited to smart phones, tablet computers, e-book readers, laptop computers and desktops computer, etc. When the terminal devices 101, 102, and 103 are software, they can be installed in the electronic devices listed above. It can be implemented, for example, as multiple software or software modules for providing distributed services, or as a single software or software module. There is no specific limitation here.

The server 105 may be a server that provides various services, for example, a server that provides functions such as virtual network connection and data processing to the terminal devices 101 , 102 , and 103 . The server can store or process the various data received, and feed back the processing results to the terminal device.

It should be noted that the method for collecting flow information of the virtual network provided by the embodiments of the present disclosure may be executed by the server 105 ; correspondingly, the apparatus for collecting flow information of the virtual network may be set in the server 105 . There is no specific limitation here.

It should be noted that the server may be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or can be implemented as a single server. When the server is software, it may be implemented as multiple software or software modules for providing distributed services, or may be implemented as a single software or software module. There is no specific limitation here.

It should be understood that the numbers of terminal devices and servers in FIG. 1 are only illustrative. There can be any number of terminal devices and servers according to implementation needs.

Continuing to refer to FIG. 2 , a flow 200 of an embodiment of the method for collecting flow information of a virtual network according to the present application is shown, including the following steps:

Step 201: Obtain packet information in the virtual network.

In this embodiment, the virtual network is a computer network that is at least partly virtual network links. A virtual network link does not contain a physical connection between two computing devices, but is implemented through network virtualization. In a virtual network, VMs (Virtual Machine Server, virtual server) can be connected to a virtual switch. With the help of the virtual switch, a logical virtual Ethernet interface can be provided for the VMs or containers running on the server to realize the distribution of network data and Forward.

In this embodiment, the packet information is a data unit exchanged and transmitted in a virtual network, including a source IP (Internet Protocol, Internet Protocol address) address, source port, destination IP address, destination port, transport layer protocol, time, message Complete data information such as text data. In a virtual network, packet information is distributed and forwarded through virtual switches.

A virtual switch is set in the execution body (for example, the server in FIG. 1 ), and the message information in the virtual network can be obtained.

Step 202, in response to determining that the packet information matches the matching field of the preset forwarding rule, forward the meta information of the packet information to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field of the preset forwarding rule.

In this embodiment, the preset matching rule is composed of at least a matching domain and an action domain. The matching field is used to identify the packet information corresponding to the forwarding rule, and the action field is used to represent the instruction information executed on the matched packet information.

The matching field includes but is not limited to the following fields: virtual local area network ID (Identity document, identification number), virtual local area network priority, source IP address, destination IP address, IP protocol, source port, destination port, and transport layer protocol. The action field includes but is not limited to the following instructions: an instruction for forwarding the meta-information of the message information, discarding is an instruction for discarding the message information when the conditions are met, and specifying a queue ID for the message to implement QOS (Quality of Service, service). quality) instructions.

For example, the format of the preset forwarding rule may be "source IP=11:11:11:11/24, destination IP=10.10.10.0/24, action=statistical flow information, forwarding from port 10". The preset forwarding rule is used to represent that the meta information of the packet information whose source IP is 11:11:11:11/24 and whose destination IP is 10.10.10.0/24 is forwarded from port 10 to the aggregation module for flow information statistics.

In this embodiment, the execution body identifies the packet information that matches the matching domain through the matching domain of the preset matching rule, and forwards the meta-information of the matching packet information to the aggregation module through the forwarding instruction in the action domain of the preset forwarding rule .

In some optional implementation manners, the execution body forwards the meta information of the packet information according to the preset export time, so as to centrally forward the meta information of the packet information and reduce the running overhead time caused by real-time forwarding of the meta information of the packet information. Specifically, in response to determining that the message information matches the matching field of the preset forwarding rule, the execution body stores the meta-information of the message information in the cache; in response to reaching the preset export time, the action field in the preset forwarding rule is used. The forwarding instruction in the cache forwards the meta-information of the packet information in the cache to the aggregation module specified by the forwarding instruction.

In some optional implementation manners, the preset forwarding rule may be implemented through the OpenFlow protocol.

In this embodiment, the meta information of the packet information is obtained by extracting the feature information in the packet information, including source IP address, source port, destination IP address, destination port, and transport layer protocol.

Step 203 , based on the meta information of the packet information, obtain flow information of the virtual switch through statistics by the aggregation module.

In this embodiment, the aggregation module may obtain the corresponding flow information according to the statistics of all or part of the meta information of the packet information. For example, the aggregation module can collect statistics on packet information whose meta information is "source IP address A, source port B, destination IP address A', destination port B', and transport layer protocol C", and obtain the same meta information corresponding flow information. The flow information includes but is not limited to the number of packets, the number of bytes, and the start time and end time of the flow information.

In some optional implementation manners, the meta information of the packet information further includes: a local area network address and a forwarding port, where the forwarding port is a forwarding port for data transmission between the virtual switch and the virtual machine in the virtual network. The execution subject can obtain the flow information for distinguishing the virtual private network according to the meta information of the packet information. Specifically, the execution body identifies the virtual private network attribute information corresponding to the packet information through the aggregation module according to the local area network address and forwarding port of the packet information; Flow information for private networks.

In this embodiment, the execution subject forwards the meta information of the matched packet information to the aggregation module for statistics based on the matching field of the forwarding rule, so as to avoid unnecessary packet information statistics; and only the meta information of the packet information is The information is forwarded to the aggregation module, and the amount of metadata data is small, which reduces the overhead of data forwarding.

FIG. 3 schematically shows an application scenario of the method for collecting flow information of a virtual network according to this embodiment. The server 301 is provided with a virtual server and a virtual switch. The virtual server forwards and distributes network data information through the virtual switch to provide virtual network services for numerous companies, including the company 302 , the company 303 , and the company 304 . In the process of providing the virtual network service, the server obtains the message information about many companies, and the server obtains the message information of the company 302 and the company 303 by matching the matching fields of the preset matching rules. The forwarding instruction forwards the meta-information of the packet information to the aggregation module specified by the forwarding instruction, and obtains the flow information of the company 302 and the company 303 through the aggregation module statistics.

Continuing to refer to FIG. 4 , a schematic flow 400 of another embodiment of the method for collecting flow information of a virtual network according to the present application is shown, including the following steps:

Step 401: Obtain packet information in the virtual network.

In this embodiment, step 401 is performed in a manner similar to step 201, and details are not described herein again.

Step 402, in response to determining that the packet information matches the matching field of the preset forwarding rule, add an access identifier to the packet information.

In this embodiment, the access identifier is used to represent whether the security access rule of the virtual network accepts the access request of the terminal corresponding to the message information.

During the process of distributing the packet information, the virtual switch in the execution body will identify whether the packet information is admitted by the security access rule, and add corresponding feature information to the packet information based on the identification result of the security access rule; The feature information that identifies whether the message information is accepted by the security access rules of the virtual network, and the execution subject adds an access identifier to the message information.

Step 403: Forward the meta information of the message information to which the access identifier is added to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule.

In this embodiment, the forwarding action of the execution subject with respect to the meta information of the message information is performed in a manner similar to the forwarding action in step 202, the difference is that the meta information of the message information in this embodiment includes an access identifier .

Step 404 , based on the meta information of the packet information, obtain flow information of the virtual switch through statistics by the aggregation module.

In this embodiment, the execution subject may obtain the corresponding flow information through the aggregation module according to the meta-information statistics of the packet information. In some optional implementation manners, the meta-information of the packet information includes an access identifier, and the execution subject can obtain statistical flow information that distinguishes whether it is accepted by the security access rule according to the access identifier of the packet information.

In some optional implementation manners, the execution body may obtain flow information according to the meta-information statistics of part of the packet information, and on the basis of the flow information, perform statistics again based on other meta-information. For example, the execution body obtains the flow information X according to the source IP address, source port, destination IP address, destination port, and transport layer protocol of the meta information of the packet information. Statistics, to distinguish whether the flow information in the flow information X is accepted by the security access rule.

As can be seen from FIG. 4 , compared with the embodiment corresponding to FIG. 2 , the process 400 of the method for collecting flow information of a virtual network in this embodiment specifically illustrates that the meta-information of the packet information may further include an access identifier, and the access identifier Can be used to distinguish whether flow information is accepted by security access rules.

Continuing to refer to FIG. 5 , as an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of an apparatus for collecting flow information of a virtual network, and the apparatus embodiment corresponds to the method embodiment shown in FIG. 2 , Specifically, the device can be applied to various electronic devices.

As shown in FIG. 5 , the flow information collection apparatus includes: an acquisition unit 501 , a forwarding unit 502 and a statistics unit 503 .

The obtaining unit 501 is configured to obtain the message information in the virtual network; the forwarding unit 502 is configured to, in response to determining that the message information matches the matching field of the preset forwarding rule, pass the information in the action field in the preset forwarding rule. The forwarding instruction forwards the meta-information of the message information to the aggregation module specified by the forwarding instruction, the matching field is used to identify the message information corresponding to the forwarding rule, and the action field is used to represent the instruction information executed on the matched message information; The statistics unit 503 is configured to obtain the flow information of the virtual switch by collecting statistics through the aggregation module based on the meta information of the packet information.

In some embodiments, the meta-information of the above-mentioned message information includes: a local area network address and a forwarding port, where the forwarding port is a forwarding port for data transmission between a virtual switch and a virtual machine in the virtual network; the statistics unit 503 is further configured to The local area network address and forwarding port of the information, and the virtual private network attribute information corresponding to the packet information is identified through the aggregation module; based on the virtual private network attribute information, the aggregation module obtains the flow information of the virtual private network corresponding to the packet information through statistics.

In some embodiments, the forwarding unit 502 is further configured to, in response to determining that the packet information matches a matching field of a preset forwarding rule, add an access identifier to the packet information, where the access identifier is used to characterize the security access rule of the virtual network Whether to accept the access request of the terminal corresponding to the message information; forward the meta information of the message information with the access identifier added to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule, and the meta information includes the access logo.

In some embodiments, the statistics unit 503 is further configured to obtain, through the aggregation module, statistics based on the access identifier of the packet information to distinguish whether the flow information is accepted by the security access rule.

In some embodiments, the forwarding unit 501 is further configured to, in response to determining that the packet information matches the matching field of the preset forwarding rule, store the meta information of the packet information in the cache; in response to reaching the preset export time, Through the forwarding instruction in the action field in the preset forwarding rule, the meta-information of the packet information in the cache is forwarded to the aggregation module specified by the forwarding instruction.

Referring next to FIG. 6 , it shows a schematic structural diagram of a computer system 600 suitable for implementing the devices of the embodiments of the present application (eg, devices 101 , 102 , 103 , and 105 shown in FIG. 1 ). The device shown in FIG. 6 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

As shown in FIG. 6, a computer system 600 includes a processor (eg, CPU, central processing unit) 601 that can be loaded into a random access memory (RAM) according to a program stored in a read only memory (ROM) 602 or from a storage section 608 The program in 603 executes various appropriate actions and processes. In the RAM 603, various programs and data necessary for the operation of the system 600 are also stored. The processor 601 , the ROM 602 and the RAM 603 are connected to each other through a bus 604 . An input/output (I/O) interface 605 is also connected to bus 604 .

The following components are connected to the I/O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc. ; and a communication section 609 including a network interface card such as a LAN card, a modem, and the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I/O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 609 and/or installed from the removable medium 611 . When the computer program is executed by the processor 601, the above-mentioned functions defined in the method of the present application are performed.

It should be noted that the computer-readable medium of the present application may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for performing the operations of the present application may be written in one or more programming languages, including object-oriented programming languages—such as Java, Smalltalk, C++, and also conventional procedures, or a combination thereof programming language - such as "C" or a similar programming language. The program code may execute entirely on the client computer, partly on the client computer, as a stand-alone software package, partly on the client computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the client computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (eg, using an Internet service provider through Internet connection).

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logical functions for implementing the specified functions executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or operations , or can be implemented in a combination of dedicated hardware and computer instructions.

The units involved in the embodiments of the present application may be implemented in a software manner, and may also be implemented in a hardware manner. The described unit can also be set in the processor, for example, it can be described as: a processor, including an acquisition unit, a forwarding unit and a statistics unit. Wherein, the names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the acquisition unit may also be described as a unit for "acquiring packet information in a virtual network".

As another aspect, the present application also provides a computer-readable medium. The computer-readable medium may be included in the device described in the above embodiments, or may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the apparatus, the computer equipment: acquires message information in the virtual network; in response to determining the message information and preset forwarding The matching fields of the rules match, and the meta-information of the packet information is forwarded to the aggregation module specified by the forwarding instructions through the forwarding instructions in the action fields in the preset forwarding rules. The matching fields are used to identify the packet information corresponding to the forwarding rules. The action field is used to represent the instruction information executed on the matched packet information; based on the meta-information of the packet information, the flow information of the virtual switch is obtained through statistics by the aggregation module.

The above description is only a preferred embodiment of the present application and an illustration of the applied technical principles. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solution formed by the specific combination of the above technical features, and should also cover the above technical features or Other technical solutions formed by any combination of its equivalent features. For example, a technical solution is formed by replacing the above-mentioned features with the technical features disclosed in this application (but not limited to) with similar functions.

Claims (12)

1. A method for collecting flow information of a virtual network, wherein the method comprises: Obtain the packet information in the virtual network; In response to determining that the packet information matches the matching field of the preset forwarding rule, forwarding the meta-information of the packet information to the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule The specified aggregation module, the matching field is used to identify the message information corresponding to the forwarding rule, and the action field is used to represent the instruction information executed on the matched message information; Based on the meta information of the packet information, the aggregation module obtains statistics on the flow information of the virtual switch. 2. The method according to claim 1, wherein the meta-information of the message information comprises: a local area network address and a forwarding port, and the forwarding port is a forwarding port for data transmission between a virtual switch and a virtual machine in a virtual network; The flow information of the virtual switch is obtained through statistics by the aggregation module based on the meta information of the packet information, including: According to the local area network address and forwarding port of the packet information, identify the virtual private network attribute information corresponding to the packet information by the aggregation module; Based on the attribute information of the virtual private network, the aggregation module obtains the flow information of the virtual private network corresponding to the packet information through statistics. 3. The method according to claim 1, wherein, in response to determining that the packet information matches a matching domain of a preset forwarding rule, through a forwarding instruction in an action domain in the preset forwarding rule, Forwarding the meta information of the packet information to the aggregation module specified by the forwarding instruction, including: In response to determining that the packet information matches the matching field of the preset forwarding rule, an access identifier is added to the packet information, and the access identifier is used to represent whether the security access rule of the virtual network accepts the correspondence of the packet information. the access request of the terminal; Through the forwarding instruction in the action field in the preset forwarding rule, the meta information of the packet information added with the access identifier is forwarded to the aggregation module specified by the forwarding instruction, where the meta information includes the access identifier. 4. The method according to claim 3, wherein the flow information of the virtual switch is obtained by statistics of the aggregation module based on the meta information of the packet information, comprising: Based on the access identifier of the packet information, the aggregation module collects statistics to determine whether the flow information is accepted by the security access rule. 5. The method according to claim 1, wherein, in response to determining that the packet information matches a matching field of a preset forwarding rule, through a forwarding instruction in an action field in the preset forwarding rule, Forwarding the meta information of the packet information to the aggregation module specified by the forwarding instruction, including: In response to determining that the message information matches the matching field of the preset forwarding rule, storing the meta-information of the message information in the cache; In response to reaching the preset export time, the meta-information of the packet information in the cache is forwarded to the aggregation module specified by the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule. 6. A device for collecting flow information of a virtual network, wherein the device comprises: an acquisition unit, configured to acquire message information in the virtual network; The forwarding unit is configured to, in response to determining that the packet information matches the matching field of the preset forwarding rule, convert the meta information of the packet information to the forwarding instruction in the action field of the preset forwarding rule Forwarding to the aggregation module specified by the forwarding instruction, the matching field is used to identify the message information corresponding to the forwarding rule, and the action field is used to represent the instruction information executed on the matched message information; The statistics unit is configured to obtain the flow information of the virtual switch through statistics by the aggregation module based on the meta information of the packet information. 7. The device according to claim 6, wherein the meta-information of the message information comprises: a local area network address and a forwarding port, and the forwarding port is a forwarding port for data transmission between a virtual switch and a virtual machine in the virtual network; The statistics unit is further configured to identify the virtual private network attribute information corresponding to the packet information through the aggregation module according to the local area network address and forwarding port of the packet information; based on the virtual private network attribute information, The flow information of the virtual private network corresponding to the packet information is obtained through statistics by the aggregation module. 8. The apparatus of claim 6, wherein, The forwarding unit is further configured to, in response to determining that the packet information matches a matching field of a preset forwarding rule, add an access identifier to the packet information, where the access identifier is used to represent secure access of the virtual network Whether the rule accepts the access request of the terminal corresponding to the message information; forwards the meta information of the message information with the access identifier added to the forwarding instruction through the forwarding instruction in the action field in the preset forwarding rule The specified aggregation module, the meta information includes the access identifier. 9. The apparatus of claim 8, wherein, The statistics unit is further configured to obtain, through the aggregation module, statistics based on the access identifier of the packet information to distinguish whether the flow information is accepted by the security access rule. 10. The apparatus of claim 6, wherein, The forwarding unit is further configured to, in response to determining that the packet information matches the matching domain of the preset forwarding rule, store the meta information of the packet information in the cache; in response to reaching the preset export time, pass The forwarding instruction in the action field in the preset forwarding rule forwards the meta-information of the packet information in the cache to the aggregation module specified by the forwarding instruction. 11. A computer-readable medium having stored thereon a computer program, wherein the program, when executed by a processor, implements the method of any one of claims 1-5. 12. An electronic device comprising: one or more processors; a storage device on which one or more programs are stored, The one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-5.

Images