A Stream-Based Tap Realization Method

Abstract

The invention discloses a stream-based TAP (test access point) implementation method and belongs to the data shunting field. The method includes the following steps that: entering direction ACL (access control list) matching is carried out in an entering direction according to a matching field in a message; after the message is matched with an ACL, the matching field is utilized to carry out load balancing operation, so that a corresponding load sharing operator can be obtained; message ports are added to a load sharing group, the load sharing operator is utilized to carry out load sharing; the load sharing group is loaded to a multicast group, or the ports in the load sharing group are added into the multicast group, or the load sharing group and the ports in the load sharing group are altogether added into the multicast group; and a port in an exiting direction performs security filtering on the message through adopting an exiting direction ACL. According to the method of the invention, load sharing is carried out based on stream technology, and the comprehensiveness of a TAP is realized, and the consistency of message sessions between devices of different manufactures can be ensured.

Description

technical field [0001] The invention relates to a data distribution technology, in particular to a flow-based TAP implementation method. Background technique [0002] With the rapid development of the Internet, the security analysis of data flow has become a very important technology, and the shunt device needs to complete the following functions: [0003] Distribution: According to the flow, specify whether the packet should be discarded or forwarded. [0004] Load sharing: Since the processing capabilities of the server and the network device are not equal, the server processing capacity is generally 4-6G, and the network device is 40G-100G, so multiple servers are required to process the traffic delivered by a network device, and the session needs to be further subdivision. [0005] Multicast: For a packet, multiple sets of security analysis may be required at the same time, so it is necessary to support the multicast function. [0006] Filtering: When performing multi...

AI Technical Summary

Problems solved by technology

[0009] 1. The multicast member port conflicts with the Linkagg protection group, and ports need to be wasted to realize the networking solution

[0010] 2. Load sharing is implemented using linkagg, and the functions are not comprehensive

[0011] 3. The security function is poor, and it is necessary to waste ports and use ingress filtering to ensure security

Images