CN101257415B - Network flow real time self-adapting measuring method based on fixed storage space - Google Patents
Network flow real time self-adapting measuring method based on fixed storage space Download PDFInfo
- Publication number
- CN101257415B CN101257415B CN2008100192773A CN200810019277A CN101257415B CN 101257415 B CN101257415 B CN 101257415B CN 2008100192773 A CN2008100192773 A CN 2008100192773A CN 200810019277 A CN200810019277 A CN 200810019277A CN 101257415 B CN101257415 B CN 101257415B
- Authority
- CN
- China
- Prior art keywords
- current
- network flow
- sampling
- message
- memory space
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Disclosed is a real time self-adapting measuring method based on the network flow in a permanent storage space, comprising: setting a duration of the interval to be measured, a network flow storage space and a sample measurement parameter; establishing a threshold for defining the storage space size of the network flow as a reference of measurement loop end in the measuring process, thus, if the fluxion of the storage space network flow exceeds the threshold, the present measurement interval is end, subsequently, outputting all the flow record information estimation value; calculating the sample measurement parameter of the next measurement interval according to the period of the present measurement interval, the duration of the interval to be measured and the present sample measurement parameter. The invention can save consumption of the measuring resources in the self-adapting process and maintain the accuracy of the network flow information; intercomparsion and calculation can be achieved directly in different measurement intervals by the measuring results of different sample parameters.
Description
Technical field
The present invention relates to be used for the self-adapting measuring method of network traffics, especially a kind of in the high speed large scale network based on the network flow real time self-adapting measuring method of fixed storage space.
Background technology
Network flow is used very extensive in network, the behavioural analysis of stream Network Based and abnormality detection are the hot research problems, in the IETF tissue, there are two working groups to specialize in the relevant issues of network flow, real-time RTFM of flow measurement working group and network flow information output services group IPFIX, their work is to set up the relevant universal standard that network flow is measured.Because the characteristic of " bigger, faster, the sudden change " of the Internet, making becomes the primary study problem of present network flow measurement based on the approximate measure technology of sampling.
Owing to measure the restriction of resource, measuring system is difficult to write down all flows by measured link, therefore adopts the message of the method measure portion of sampling by link.Measuring system generally is by combining according to the message with identical traffic identifier, owing to do not have corresponding relation between network flow quantity and the message amount, and the burst characteristic of flow, measuring system can't make and fix the memory space that a Measuring Time is interval and Measurement Network flows simultaneously measuring the moment setting sampling parameter that begins.If the setting of sampling parameter very little, then the estimated accuracy of measurement result is lower, and in the interval end of Measuring Time, a large amount of memory spaces do not use, the consumption of waste measurement resource.And if that the sampling parameter is provided with is excessive, Measuring Time is interval do not finish in, the network flow memory space has used up, and can't continue to measure the flow in remaining time.
Because network flow data has important application and researching value, all provide the network flow measurement function in the modern router, as NetFlow is provided in the cisco router function, NetFlow provides the network flow measurement function in router, because all all-networks by it of resource measurement that router is difficult to provide enough flow, Cisco has increased the sampling function on the NetFlow basis, the NetFlow of sampling can carry out network flow by extracting part subnetwork flow and measure, but the measurement sampling probability of NetFlow needs the user to adjust in measuring process, can't adapt to the sudden change situation of network traffics in addition.Estan has proposed to have the NetFlow of adaptive sampling ability, this NetFlow algorithm can adapt to the sudden change situation of network traffics, but finally can not give full play to the measurement resource of router, certainty of measurement is lower, also consume more cpu resource in network flow double sampling process, therefore more effective, the more accurate adaptive sampling algorithm of design is just even more important.
In order to solve the sampling parameter problems of too is set at present, generally take two kinds of methods: (1) sampling parameter is being measured setting at first, adopt identical sampling parameter in the whole measuring process, having expired of measurement space, just with all flow output, as the method that adopts among the Sampled Netflow; (2) adopt self-adapting measuring method, when Measuring Time does not finish, and measurement space has been expired, just adopt adaptive method adjustment sampling parameter, and the recorded information in the adjustment flow buffering, remove the discharge record that does not meet under the new sampling parameter condition, vacating space continues to measure the flow information in the remaining time of the interval, as the adaptive sampling method of Estan.First method be owing to can not adjust measurement parameter in whole measuring process, can't be adapted to the unsteadiness of network traffics and sudden.Though second method can be adjusted the sampling parameter, in adaptive process, need to waste the flow information of measuring in the resource adjustment network flow buffer memory, and the adjustment space is that the flow information of having measured with sacrifice is a cost.
Comprehensive these two kinds of methods, first method essence are fixed network stream memory space and time interval, arrive in case has expired in the network flow space or Measuring Time is interval, the interval end of current time can be carried out the measurement of next time interval then; But in new time interval, this method is not adjusted measurement parameter, makes measurement parameter can not adapt to the collaborative demand of network traffics and measurement resource.Second method is the set time interval, do not finish if Measuring Time is interval, and the network flow memory space has been expired, and then adjusts network flow memory space and measurement parameter, proceeds to measure, and finishes up to Measuring Time.
Summary of the invention
The present invention proposes a kind of network flow real time self-adapting measuring method based on fixed storage space, this method is set duration, network flow memory space and sampling measurement parameter between an expectation measurement zone, the duration is used for the index as the sampling measurement parameter adjustment between the expectation measurement zone, the network flow storage size is as the foundation that finishes between current measurement zone, and the sampling measurement parameter is the relation between control survey resource and the network traffics; In measuring process, set a fixed network stream storage size threshold values as a foundation of measuring loop ends,, finish between then current measurement zone, export all discharge record information estimated values if memory space network flow fluxion surpasses threshold values; According to the sampling measurement parameter between duration between the time interval between current measurement zone, expectation measurement zone and the next measurement zone of current sampling measurement calculation of parameter.Duration between the expectation measurement zone that occurs is used for the control survey resource, if the duration is less than the duration between the expectation measurement zone between current measurement zone, and the network flow memory space is full, need be with the discharge record information output of network flow memory space, illustrate that then measuring system need consume processing and storage that more measurement resources are used for network traffic information, thereby measure the sampling parameter and be provided with excessively, strengthened the burden of measuring system; And if between current measurement zone the duration surpass the duration between the expectation measurement zone, and the network flow memory space is not full, illustrate that measuring the parameter of sampling is provided with too smallly, has wasted the measurement resource, has reduced the precision of Measurement Network flow.
Concrete technical step of the present invention is as follows:
The 1st step: parameter is set
The interval T of expectation Measuring Time is set, and the measurement sampling ratio is 1/m, and the size of network flow memory space K is N, measures concluding time End;
The 2nd step: initial value between current measurement zone is set
It is Current_t1 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set;
The 3rd step: judge and measure the concluding time
If the current measuring system time greater than measuring concluding time End, then with all output of the record of the stream in the network flow memory space, measures and finishes; Otherwise wait for that message arrives measuring appliance, if a message A arrives measuring appliance, the quantity that current packet accouter i is set increases by 1, and promptly i=i+1 entered into for the 4th step;
The 4th step: packet sampling
Use the sampling ratio 1/m current message A that samples, if when promptly the quantity i of message equals the m reciprocal of sampling ratio 1/m in the packet accouter, packet sampling A then, and the value that current packet accouter i is set is 0, enters into for the 5th step; If when the quantity i of message was less than the m reciprocal of sampling ratio 1/m in the packet accouter, then message A was dropped, got back to for the 3rd step;
The 5th step: upgrade the network flow storage space information
In network flow memory space K, search this by the network flow a of packet sampling A,, then the message of this network flow a counted K[a if find this network flow a in the network flow memory space] m reciprocal of the sampling probability 1/m that adds up, i.e. K[a]=K[a]+m, got back to for the 3rd step; If in network flow memory space K, do not find by the network flow a of packet sampling A, then in the network flow memory space, increase a record and be used for storage networking stream a, the m reciprocal that its initial message number is set is sampling probability 1/m, be K[a]=m, the stream record quantity n that is provided with among the network flow memory space K adds up 1, be n=n+1, entered into for the 6th step;
The 6th step: judge between current measurement zone and finish
If it is N that the record quantity n that flows among the current network stream memory space K equals the size of network flow memory space K, finish between then current measurement zone, write down that the concluding time is current_t2 between current measurement zone, N the network flow recorded information that current network flows among the memory space K exported from internal memory, entered for the 7th step; Otherwise do not finish between current measurement zone, got back to for the 3rd step;
The 7th step: the sampling parameter in adjusting between next measurement zone
Between current measurement zone altogether duration t be the difference between the interval time started current_t1 of concluding time current_t2 and current Measuring Time between current measurement zone, be t=current_t2-current_t1, the Measuring Time interval of the initial expectation of measuring system is T, the sampling ratio that uses between current measurement zone is 1/m, during then next measurement in the interval computing formula reciprocal of sampling ratio 1/m be
Expression is greater than (minimum positive integer of 1+ (T-t)/t) m got back to for the 2nd step.
Compared with prior art, the present invention has following advantage and beneficial effect:
(1) the present invention uses fixed network stream storage size as the triggering index that finishes between measurement zone to judge, and the foundation of using expectation Measuring Time interval to adjust as the self adaptation of sampling measurement parameter; Realize that the sampling measurement parameter adaptive is adjusted in the different measuring interval, and in the self adaptation adjustment process, avoid recanalization, save consumption of measuring resource in the adaptive process and the precision that keeps network traffic information recorded information in the network flow memory space;
(2) in the measured message data procedures, the estimated value of record network flow message amount replaces measured value in the network flow memory space, make the measurement result of using different sampling parameters in the different measuring interval can directly carry out mutually relatively and calculate, improved the versatility of measurement data;
Description of drawings
Fig. 1 is the schematic diagram of the inventive method;
Fig. 2 is the flow chart of the inventive method.
Embodiment
Referring to Fig. 1, Fig. 2, establish a sequence of message A A B C D A E F B E C E F A H N D, each chronomere arrives a message
1 (the 1st step): parameter is set
Expectation Measuring Time interval 6 is set, and measuring sampling ratio is 1/2, and the size of network flow memory space K is 2, measures the concluding time 15, enters for 2 (the 2nd steps);
2 (the 2nd steps): initial value between current measurement zone is set
It is 0 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set; Entered for 3 (the 3rd steps);
3 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 1, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 4 (the 4th steps);
4 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/2 sampling, when the quantity 1 of message was not equal to the inverse 2 of sampling ratio 1/2 in the packet accouter, then message A was dropped, and got back to for 5 (the 3rd steps);
5 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 2, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 6 (the 4th steps);
6 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/2 sampling, when the quantity i=2 of message equals the inverse 2 of sampling ratio 1/2 in the packet accouter, packet sampling A then, and the value that current packet accouter i is set is 0, enters into for 7 (the 5th steps);
7 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow a of packet sampling A, in network flow memory space K, do not find by the network flow a of packet sampling A, then in the network flow memory space, increase a record and be used for storage networking stream a, the inverse 2 that its initial message number is set is sampling probability 1/2, be K[a]=2, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=1 entered into for 8 (the 6th steps);
8 (the 6th steps): judge between current measurement zone and finish
The record quantity n=1 that flows among the current network stream memory space K does not finish between current measurement zone less than the big or small N=2 of network flow memory space K, gets back to for 9 (the 3rd steps);
9 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 3, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message B arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 10 (the 4th steps);
10 (the 4th steps): packet sampling
Use the current message B of sampling ratio 1/2 sampling, when the quantity 1 of message was not equal to the inverse 2 of sampling ratio 1/2 in the packet accouter, then message B was dropped, and got back to for 11 (the 3rd steps);
11 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 4, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message C arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 12 (the 4th steps);
12 (the 4th steps): packet sampling
Use the current message C of sampling ratio 1/2 sampling, when the quantity i=2 of message equals the inverse 2 of sampling ratio 1/2 in the packet accouter, packet sampling C then, and the value that current packet accouter i is set is 0, enters into for 13 (the 5th steps);
13 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow c of packet sampling C, in network flow memory space K, do not find by the network flow c of packet sampling C, then in the network flow memory space, increase a record and be used for storage networking stream c, the inverse 2 that its initial message number is set is sampling probability 1/2, be K[c]=2, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=2 entered into for 14 (the 6th steps);
14 (the 6th steps): judge between current measurement zone and finish
If the record quantity n=2 that flows among the current network stream memory space K equals the big or small N=2 of network flow memory space K, finish between then current measurement zone, write down that the concluding time is 4 between current measurement zone, 2 network flow recorded informations that current network flows among the memory space K are exported from internal memory, and the result of output is
A?2
C?2
Entered for 15 (the 7th steps);
15 (the 7th steps): the sampling parameter in adjusting between next measurement zone
Between current measurement zone altogether duration t be the difference between the interval time started current_t1=0 of concluding time current_t2=4 and current Measuring Time between current measurement zone, be t=current_t2-current_t1=4-0=4, the Measuring Time interval of the initial expectation of measuring system is T=6, the sampling ratio that uses between current measurement zone is 1/m=1/2, during then next measurement in the interval computing formula reciprocal of sampling ratio 1/m be
Got back to for 16 (the 2nd steps);
16 (the 2nd steps): initial value between current measurement zone is set
It is 4 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set; Entered for 17 (the 3rd steps);
17 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 5, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message D arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 18 (the 4th steps);
18 (the 4th steps): packet sampling
Use the current message D of sampling ratio 1/3 sampling, when the quantity 1 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message D was dropped, and got back to for 19 (the 3rd steps);
19 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 6, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 20 (the 4th steps);
20 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/3 sampling, when the quantity 2 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message A was dropped, and got back to for 21 (the 3rd steps);
21 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 7, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message E arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=3 entered into for 22 (the 4th steps);
22 (the 4th steps): packet sampling
Use the current message E of sampling ratio 1/3 sampling, when the quantity 3 of message equals the inverse 3 of sampling ratio 1/3 in the packet accouter, packet sampling E then, and the value that current packet accouter i is set is 0, enters into for 23 (the 5th steps);
23 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow e of packet sampling E, in network flow memory space K, do not find by the network flow e of packet sampling E, then in the network flow memory space, increase a record and be used for storage networking stream e, the inverse 3 that its initial message number is set is sampling probability 1/3, be K[e]=3, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=1 entered into for 24 (the 6th steps);
24 (the 6th steps): judge between current measurement zone and finish
The record quantity n=1 that flows among the current network stream memory space K does not finish between current measurement zone less than the big or small N=2 of network flow memory space K, gets back to for 25 (the 3rd steps);
25 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 8, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message F arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 26 (the 4th steps);
26 (the 4th steps): packet sampling
Use the current message F of sampling ratio 1/3 sampling, when the quantity 1 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message F was dropped, and got back to for 27 (the 3rd steps);
27 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 9, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message B arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 28 (the 4th steps);
28 (the 4th steps): packet sampling
Use the current message B of sampling ratio 1/3 sampling, when the quantity 2 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message B was dropped, and got back to for 29 (the 3rd steps);
29 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 10, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message E arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=3 entered into for 30 (the 4th steps);
30 (the 4th steps): packet sampling
Use the current message E of sampling ratio 1/3 sampling, when the quantity 3 of message equals the inverse 3 of sampling ratio 1/3 in the packet accouter, packet sampling E then, and the value that current packet accouter i is set is 0, enters into for 31 (the 5th steps);
31 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow e of packet sampling E, in network flow memory space K, find by the network flow e of packet sampling E, the message of this network flow a is counted K[e] inverse 3 of the sampling probability 1/3 that adds up, i.e. K[e]=K[e]+3=6, got back to for 32 (the 3rd steps);
32 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 11, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message C arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 33 (the 4th steps);
33 (the 4th steps): packet sampling
Use the current message C of sampling ratio 1/3 sampling, when the quantity 1 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message C was dropped, and got back to for 34 (the 3rd steps);
34 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 12, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message E arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 35 (the 4th steps);
35 (the 4th steps): packet sampling
Use the current message E of sampling ratio 1/3 sampling, when the quantity 2 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message E was dropped, and got back to for 36 (the 3rd steps);
36 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 13, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message F arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=3 entered into for 37 (the 4th steps);
37 (the 4th steps); Packet sampling
Use the current message F of sampling ratio 1/3 sampling, when the quantity 3 of message equals the inverse 3 of sampling ratio 1/3 in the packet accouter, packet sampling F then, and the value that current packet accouter i is set is 0, enters into for 38 (the 5th steps);
38 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow f of packet sampling F, in network flow memory space K, do not find by the network flow f of packet sampling F, then in the network flow memory space, increase a record and be used for storage networking stream f, the inverse 3 that its initial message number is set is sampling probability 1/3, be K[f]=3, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=2 entered into for 39 (the 6th steps);
39 (the 6th steps): judge between current measurement zone and finish
If the record quantity n=2 that flows among the current network stream memory space K equals the big or small N=2 of network flow memory space K, finish between then current measurement zone, write down that the concluding time is 13 between current measurement zone, 2 network flow recorded informations that current network flows among the memory space K are exported from internal memory, and the result of output is
E?6
F?3
Entered for 40 (the 7th steps);
40 (the 7th steps): the sampling parameter in adjusting between next measurement zone
Between current measurement zone altogether duration t be the difference between the interval time started current_t1=4 of concluding time current_t2=13 and current Measuring Time between current measurement zone, be t=current_t2-current_t1=13-4=9, the Measuring Time interval of the initial expectation of measuring system is T=6, the sampling ratio that uses between current measurement zone is 1/m=1/3, during then next measurement in the interval computing formula reciprocal of sampling ratio 1/m be
Got back to for 41 (the 2nd steps);
41 (the 2nd steps): initial value between current measurement zone is set
It is 13 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set; Entered for 42 (the 3rd steps);
42 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 14, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 43 (the 4th steps);
43 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/2 sampling, when the quantity 1 of message was not equal to the inverse 2 of sampling ratio 1/2 in the packet accouter, then message A was dropped, and got back to for 44 (the 3rd steps);
44 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 15, equals to measure concluding times 15 wait message and arrives measuring appliance, and a message H arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 44 (the 4th steps);
44 (the 4th steps): packet sampling
Use the current message H of sampling ratio 1/2 sampling, when the quantity 2 of message equals the inverse 2 of sampling ratio 1/2 in the packet accouter, packet sampling H then, and the value that current packet accouter i is set is 0, enters into for 45 (the 5th steps);
45 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow h of packet sampling H, in network flow memory space K, do not find by the network flow h of packet sampling H, then in the network flow memory space, increase a record and be used for storage networking stream h, the inverse 2 that its initial message number is set is sampling probability 1/2, be K[h]=2, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=1 entered into for 46 (the 6th steps);
46 (the 6th steps): judge between current measurement zone and finish
If the record quantity 1 that flows among the current network stream memory space K does not finish between then current measurement zone less than the size 2 of network flow memory space K, got back to for 47 (the 3rd steps);
47 (the 3rd steps): judge and measure the concluding time
The current measuring system time 16 then all exports the record of the stream in the network flow memory space greater than measuring the concluding time 15,
H 2
Measure and finish.
In this example, the result of measuring system output is:
A 2
C 2
E 6
F 3
H 2。
Claims (2)
1. based on the network flow real time self-adapting measuring method of fixed storage space, it is characterized in that setting the duration between an expectation measurement zone, network flow memory space and sampling measurement ratio, the duration is used for the index as the adjustment of sampling measurement ratio between the expectation measurement zone, the network flow storage size is as the foundation that finishes between current measurement zone, the sampling measurement ratio is the relation between control survey resource and the network traffics, detailed process is: set a fixed network stream memory space as a foundation of measuring loop ends in measuring process, if the network flow memory space has been expired, finish between then current measurement zone, export all discharge record information estimated values; Calculate sampling measurement ratio interior between next measurement zone according to duration and current sampling measurement ratio between the time interval between current measurement zone, expectation measurement zone.
2. according to the described network flow real time self-adapting measuring method of claim 1, it is characterized in that concrete technical step is as follows based on fixed storage space:
The 1st step: parameter is set
Duration T between the expectation measurement zone is set, and the measurement sampling ratio is 1/m, and the size of network flow memory space K is N, measures concluding time End;
The 2nd step: initial value between current measurement zone is set
It is Current_t1 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set;
The 3rd step: judge and measure the concluding time
If the current measuring system time greater than measuring concluding time End, then with all output of the record of the stream in the network flow memory space, measures and finishes; Otherwise wait for that message arrives measuring appliance, if a message A arrives measuring appliance, the quantity that current packet accouter i is set increases by 1, and promptly i=i+1 entered into for the 4th step;
The 4th step: packet sampling
Use the sampling ratio 1/m current message A that samples, if when promptly the quantity i of message equals the m reciprocal of sampling ratio 1/m in the packet accouter, packet sampling A then, and the value that current packet accouter i is set is 0, enters into for the 5th step; If when the quantity i of message was less than the m reciprocal of sampling ratio 1/m in the packet accouter, then message A was dropped, got back to for the 3rd step;
The 5th step: upgrade the network flow storage space information
In network flow memory space K, search this by the network flow a of packet sampling A,, then the message of this network flow a counted K[a if find this network flow a in the network flow memory space] m reciprocal of the sampling probability 1/m that adds up, i.e. K[a]=K[a]+m, got back to for the 3rd step; If in network flow memory space K, do not find by the network flow a of packet sampling A, then in the network flow memory space, increase a record and be used for storage networking stream a, the m reciprocal that its initial message number is set is sampling probability 1/m, be K[a]=m, the stream record quantity n that is provided with among the network flow memory space K adds up 1, be n=n+1, entered into for the 6th step;
The 6th step: judge between current measurement zone and finish
If it is N that the record quantity n that flows among the current network stream memory space K equals the size of network flow memory space K, finish between then current measurement zone, write down that the concluding time is current_t2 between current measurement zone, N the network flow recorded information that current network flows among the memory space K exported from internal memory, entered for the 7th step; Otherwise do not finish between current measurement zone, got back to for the 3rd step;
The 7th step: the sampling parameter in adjusting between next measurement zone
Time interval t between current measurement zone is the difference between the interval time started current_t1 of concluding time current_t2 and current Measuring Time between current measurement zone, be t=current_t2-current_t1, measuring system expects that initially the duration between measurement zone is T, the sampling ratio that uses between current measurement zone is 1/m, and the computing formula reciprocal of interior sampling ratio 1/m is between then next measurement zone
Expression is greater than (minimum positive integer of 1+ (T-t)/t) m got back to for the 2nd step.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100192773A CN101257415B (en) | 2008-01-18 | 2008-01-18 | Network flow real time self-adapting measuring method based on fixed storage space |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100192773A CN101257415B (en) | 2008-01-18 | 2008-01-18 | Network flow real time self-adapting measuring method based on fixed storage space |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101257415A CN101257415A (en) | 2008-09-03 |
| CN101257415B true CN101257415B (en) | 2010-08-11 |
Family
ID=39891905
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2008100192773A Expired - Fee Related CN101257415B (en) | 2008-01-18 | 2008-01-18 | Network flow real time self-adapting measuring method based on fixed storage space |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101257415B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102469000A (en) * | 2010-11-19 | 2012-05-23 | 沈阳理工大学 | Large-scale network oriented topology sampling method |
| CN105791144A (en) * | 2014-12-19 | 2016-07-20 | 中兴通讯股份有限公司 | Method and apparatus for sharing link traffic |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101051952A (en) * | 2007-04-18 | 2007-10-10 | 东南大学 | Self adaption sampling stream measuring method under high speed multilink logic channel environment |
| CN101051999A (en) * | 2007-05-09 | 2007-10-10 | 东南大学 | Network flow monitor method of controllable resource |
-
2008
- 2008-01-18 CN CN2008100192773A patent/CN101257415B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101051952A (en) * | 2007-04-18 | 2007-10-10 | 东南大学 | Self adaption sampling stream measuring method under high speed multilink logic channel environment |
| CN101051999A (en) * | 2007-05-09 | 2007-10-10 | 东南大学 | Network flow monitor method of controllable resource |
Non-Patent Citations (2)
| Title |
|---|
| 刘卫江等.流测量算法综述.计算机工程与应用 2005年29期.2005,(2005年29期),1-3,7. |
| 刘卫江等.流测量算法综述.计算机工程与应用 2005年29期.2005,(2005年29期),1-3,7. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101257415A (en) | 2008-09-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100442730C (en) | Detecting method for network link band width based on hop-by-hop time stamp label | |
| Duffield et al. | Estimating flow distributions from sampled flow statistics | |
| Choi et al. | Adaptive packet sampling for accurate and scalable flow measurement | |
| Khriji et al. | Measuring energy consumption of a wireless sensor node during transmission: Panstamp | |
| Claeys et al. | Analysis of threshold-based batch-service queueing systems with batch arrivals and general service times | |
| CN100525253C (en) | Network flow monitor method of controllable resource | |
| CN103825775A (en) | Multi-hop wireless network available bandwidth real-time detection method for adaptively detecting packet length | |
| CN101668006A (en) | Self adaptive network traffic sampling method for anomaly detection | |
| CN110351166B (en) | Network-level fine-grained flow measurement method based on flow statistical characteristics | |
| CN101257415B (en) | Network flow real time self-adapting measuring method based on fixed storage space | |
| CN101997776B (en) | Router queue control system based on congestion identification and control method thereof | |
| CN100566265C (en) | Network route band width measuring method based on steady sampling sequence | |
| Gomez et al. | Multimodal retransmission timer for lpwan | |
| CN104253712B (en) | A kind of method that P2P Network Recognitions are carried out using deep packet inspection technical | |
| Horvat et al. | Analysis of QoS parameters for multimedia streaming in Wireless Sensor Networks | |
| JP5155284B2 (en) | P2P traffic amount estimation method, apparatus and program | |
| Joo et al. | Analysis and modeling of traffic from residential high speed Internet subscribers | |
| He et al. | An adaptive traffic sampling method for anomaly detection | |
| Xu et al. | Packet-level adaptive sampling on multi-fluctuation scale traffic | |
| Ricciato et al. | One-way loss measurements from IPFIX records | |
| KR100990041B1 (en) | Apparatus and Method for estimating Channel Capacity of End-to-End terminal | |
| Zhang et al. | Flow byte sizes estimation from simple random packet sampling | |
| Zhenhua | Demand-oriented traffic measuring method for network security situation assessment | |
| Shao et al. | Time-Driven vs packet-driven: a deep study on traffic sampling | |
| CN104539486A (en) | End-to-end available bandwidth estimating method based on TCP acknowledgement packet pair |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| ASS | Succession or assignment of patent right |
Owner name: HAIAN CHANGDA TECHNOLOGY TRANSFER CENTER CO., LTD. Free format text: FORMER OWNER: SOWTHEAST UNIV. Effective date: 20131018 Owner name: SOWTHEAST UNIV. Effective date: 20131018 |
|
| C41 | Transfer of patent application or patent right or utility model | ||
| COR | Change of bibliographic data |
Free format text: CORRECT: ADDRESS; FROM: 210096 NANJING, JIANGSU PROVINCE TO: 226600 NANTONG, JIANGSU PROVINCE |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20131018 Address after: 226600 No. 8 Yingbin Road, software park, Haian County, Jiangsu Province Patentee after: Haian Changzhou University Technology Transfer Center Co., Ltd. Patentee after: Southeast University Address before: 210096 Jiangsu city Nanjing Province four pailou No. 2 Patentee before: Southeast University |
|
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20100811 Termination date: 20170118 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |