Quick flow grouping method based on two-level cache

Abstract

The invention provides a quick flow grouping method based on two-level cache, which comprises the following steps: in the measuring period, a measurer maintains a flow table respectively in a low-capacity high-speed cache and a high-capacity low-speed cache; for each incoming message, firstly checking whether the high-speed cache has a flow record thereof or not; if the high-speed cache has the flow record, accumulating the message information in the flow record; if the high-speed cache does not have the flow record, randomly sampling the message; and if the message is sampled, establishing the flow record in the high-speed cache, otherwise recording the message in the low-speed cache. In the invention, the characteristic of heavy-tailed distribution of flow length in network flow is utilized, the long-flow information comprising a large quantity of messages in the high-speed cache is recorded, the low-speed flow in the low-speed cache is recorded, flow is grouped by adopting the two-level cache, the flow grouping efficiency of the network flow is greatly improved, and simultaneously each message in equal probability is sampled, so that the long flow is recorded in the high-speed cache in a very high probability, and the probability that the short-flow with a small quantity of messages is recorded in the high-speed cache is very low.

Description

technical field [0001] The invention relates to a network flow measurement technology, in particular to a group flow technology beneficial to high-speed network flow. The measurement method makes full use of different characteristics of two-level buffers to greatly improve the flow group flow efficiency technology. The invention belongs to the field of network traffic measurement. Background technique [0002] Network traffic is composed of packets, and each TCP or UDP packet includes five-tuple information such as source IP address, sink IP address, protocol, source port, and sink port, and will have the same A packet collection of five-tuple information such as source IP address, sink IP address, protocol, source port, and sink port is called a flow record. Group flow is to aggregate all packets with the same quintuple information into one record during the measurement process. Group flow of network traffic is a very important task in the field of network measurement, man...

AI Technical Summary

Problems solved by technology

Due to the large scale of network traffic, especially in the backbone network, the number of quintuple flows is also very large, and it is difficult to maintain all flow records in the meter

[0004] At present, two different types of cache are used in routers and measuring instruments: SRAM and DRAM. SRAM is a static random access memory, a memory with static access function, which can save the data stored in it without refreshing the circuit. The reading speed is fast, but the disadvantage is small capacity and high price and cost. The high-speed read rate of SRAM is suitable for the group flow operation in the high-speed backbone network, but its small capacity and high price make it difficult to realize the group flow operation of all the traffic in the backbone network

Images