Network state monitoring method and device based on downlink flow, and electronic equipment

Abstract

The embodiment of the invention provides a network state monitoring method based on downlink traffic, which comprises the following steps of configuring a cache occupation instruction with a routing rule for a traffic monitoring network card, establishing a virtual network card in a virtual machine, configuring a traffic engine, receiving downlink traffic data, executing the cache occupation instruction, and caching by utilizing a downlink buffer area. monitoring an occupation state of a downlink buffer area, if the occupation state of the downlink buffer area meets a preset condition, routing a part of uncached traffic data in the downlink traffic data to an uplink buffer area for caching, creating a first task and a second task which are parallel by a traffic engine, and respectively reading the downlink flow data from the uplink buffer area and the downlink buffer area, storing the downlink flow data in the second storage space, and monitoring the network state by using the downlink flow data. Due to the fact that the cache space is expanded, the data throughput is improved, parallel tasks are used for reading and storing data, the speed and timeliness are improved, the risk of data loss is reduced, and then the reliability of monitoring through flow data is improved.

Description

technical field [0001] The present application relates to the field of the Internet, and in particular to a network status monitoring method, device and electronic equipment based on downlink traffic. Background technique [0002] After the networking is completed, the data will be uploaded and then downloaded in the process of using the network. For the convenience of description, the industry uses downlink and uplink to indicate receiving and sending. Based on network security considerations, the industry will continue to analyze the traffic data to analyze the network status. Monitoring to identify anomalies such as risks and threats. [0003] At present, when monitoring in the industry, custom-made network cards are often used to cache uplink and downlink data. This kind of customized network card has an uplink data buffer area and a downlink data buffer area. valley effect. [0004] However, there is a high probability of abnormality in this method. At this time, the ...

AI Technical Summary

Problems solved by technology

[0004] However, there is a high probability of abnormality in this method. At this time, the amount of downlink traffic data is often large, and the amount of traffic data is often fluctuating. If the buffer space is too small, the downlink data is not cached in time, which will lead to data loss. , so that when using cached traffic data for network status monitoring, it will cause low reliability

Images