SDN-based packet mirroring method, and network traffic monitoring and management system

Abstract

The present disclosure relates to a SDN-based method for mirroring packets, wherein a SDN controller is coupled to an upper layer application and at least one data switching exchange respectively, and the method including: a) the upper layer application sends a mirroring instruction to the SDN controller through a first northbound interface of the SDN controller; b) the SDN controller generates a second flow table based on the mirroring instruction and a first flow table sent by a first data switching exchange; wherein the first data switching exchange initiates transmission of the packets, the first flow table encapsulates the packets, and the second flow table includes at least an action command corresponding to the mirroring instruction; and c) a second data switching exchange extracts the packets from the second flow table, and mirrors the packets to the designated node based on the action command.

Claims

1. A SDN-based method for mirroring packets and a SDN controller is coupled to an upper layer application and at least one data switching exchange respectively, the method comprising: a) sending, by the upper layer application, a mirroring instruction to the SDN controller through a first northbound interface of the SDN controller; b) generating, by the SDN controller based on the mirroring instruction and a first flow table sent by a first data switching exchange, a second flow table; wherein the first data switching exchange is configured to initiate transmission of the packets, the first flow table encapsulates the packets, and the second flow table includes at least an action command corresponding to the mirroring instruction; c) extracting, by a second data switching exchange, the packets from the second flow table, and mirroring the packets to a designated node based on the action command; wherein the first and second flow tables adopt an OpenFlow protocol; and wherein each of the first and second flow tables includes at least a match field item and an action set item, wherein the match field item is used to match the packets, and the action set item includes at least one action command for controlling the actions of the data switching exchanges.

2. The method of claim 1, wherein the first northbound interface is programmed by the user.

3. The method of claim 1, further comprising: monitoring and managing, by a monitoring system according to the packets received by the designated node, network traffic.

4. A system for monitoring and managing network traffic, coupled to at least a first data switching exchange and a second data switching exchange respectively, the system comprising: an upper layer application control unit, configured to send a mirroring instruction to a SDN controller through a first northbound interface of the SDN controller; the SDN controller, configured to generate a second flow table based on the mirroring instruction and a first flow table sent by the first data switching exchange; wherein the first data switching exchange is configured to initiate transmission of the packets, the first flow table encapsulates the packets, the second flow table includes at least an action command corresponding to the mirroring instruction, and wherein the second data switching exchange is configured to extract the packets from the second flow table and mirror the packets to a designated node based on the action command; wherein the first and second flow tables adopt an OpenFlow protocol; wherein each of the first and second flow tables includes at least a match field item and an action set item, wherein the match field item is used to match the packets, and the action set item includes at least one action command for controlling the actions of the data switching exchanges and a monitoring and management unit, configured to monitor and manage the network traffic according to the packets received by the designated node.

5. The system according to claim 4, wherein the system is deployed as a distributed system.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) FIG. 1 is a flowchart of a SDN-based method for mirroring packets according to a first embodiment of the present disclosure.

(2) FIG. 2 is a block diagram showing the structure of a system for monitoring and managing network traffic according to a second embodiment of the present disclosure.

(3) FIG. 3 is a table illustrating the packet structure of an OpenFlow protocol.

DETAILED DESCRIPTION OF THE EMBODIMENTS

(4) For convenience of explanation, in various embodiments of the present disclosure, a SDN controller and a first and second data switching exchanges are exemplarily illustrated. The SDN controller is communicatively coupled to the first and second data switching exchanges, respectively. However, it can be understood that, according to particular application scenarios, the present disclosure can be implemented in a case where a plurality of SDN controllers and more data switching exchanges are included, as long as the plurality of SDN controllers and the more data switching exchanges are coupled to each other, and are communicated in accordance with an agreed protocol.

(5) A SDN northbound interface is an interface that the SDN controller opens to the upper layer service application, with a purpose of enabling the service application to conveniently call the underlying network resources and capabilities. Through the northbound interface, developers of network services can call various network resources by means of software programming.

(6) A SDN southbound interface is an interface that the SDN controller opens to the underlying switching device. On the one hand, the information reported by the underlying switching device is monitored and collected by an uplink channel. On the other hand, the SDN controller also utilizes the downlink channel of the southbound interface to control downstream network devices.

(7) As shown in FIG. 1, a first embodiment of the present disclosure provides a SDN-based method for mirroring packets, which includes the following steps.

(8) Step S10: The upper layer application sends a mirroring instruction to the SDN controller through the first northbound interface of the SDN controller.

(9) Specifically, the SDN controller provides encapsulated northbound interfaces for the upper layer application. By calling these northbound interfaces, the upper layer application can implement functions such as calling, allocating, and releasing network resources. The call of the northbound interface affects the SDN controller to deliver the corresponding control policy to the data switching exchange through the southbound interface protocol.

(10) According to the step S10, the first northbound interface is programmed by the user.

(11) Step S20: The SDN controller generates a second flow table based on the mirroring instruction and a first flow table sent by the first data switching exchange.

(12) Herein, the first data switching exchange initiates transmission of the packets, the first flow table encapsulates the packets, and the second flow table includes at least an action command corresponding to the mirroring instruction. The action command instructs the switching exchange that receives the second flow table how to perform packet mirroring, as described below.

(13) According to a preferred embodiment, the first and second flow tables adopt an OpenFlow protocol. Specifically, the packet structure of the OpenFlow protocol (hereinafter referred to as a flow table) is shown in FIG. 3.

(14) As shown in FIG. 3, the OpenFlow protocol includes: Match Fields: match the data packets, and execute the actions in the flow table after the matching is completed; Counter: not discussed in the description; Actions: Action sets, including at least one action command for controlling the actions of the data switching exchanges, such as encapsulation/decompression, multipath forwarding, outputting toward one or more ports, and so on.

(15) Regarding the generation of the second flow table, as an example, in the action set of the flow table, a command to output data to the designated port “output” may be added after the normal forwarding action. For example, if the data is forwarded to port 1 (the port connected to the application) and port 5 (the port connected to the control system), the action command “output 1 5” can be added; in other words, the second flow table will include the action command corresponding to the mirroring instruction.

(16) Step S30: The second data switching exchange extracts the packets from the second flow table, and mirrors the packets to the designated node based on the action command

(17) Continuing with the above example, after parsing the second flow table, the data switching exchange that receives the second flow table obtains the action command “output 1 5”. Per the action command, the second data switching exchange will mirror the packets to port 5.

(18) Further, the monitoring system monitors and manages network traffic according to each packet received by the designated node. Such monitoring and management are performed on the basis of a packet unit. Herein the packet can correspond to a specific port, a virtual machine, or even a specific application. The packet which does not need to be monitored can be excluded. The present disclosure can thus implement traffic monitoring with a finer granularity.

(19) As shown in FIG. 2, a second embodiment of the present disclosure provides a system for monitoring and managing network traffic. The system includes at least an upper layer application control unit 101, a SDN controller 102, and a monitoring and management unit 103. The system for monitoring and managing network traffic is communicatively coupled to a first and second data switching exchanges 201, 202 via the SDN controller 102, respectively. The first data switching exchange 201 initiates transmission of the packets, the second data switching exchange 202 expects to obtain the packets, and the monitoring and management unit 103 expects to obtain the packet mirroring so as to monitor the network traffic.

(20) Specifically, the upper layer application control unit 101 transmits a mirroring instruction to the SDN controller 102 through the first northbound interface of the SDN controller 102.

(21) The SDN controller 102 generates a second flow table based on the mirroring instruction and a first flow table sent by the first data switching exchange 201; the first flow table encapsulates the packets to be transmitted, and the second flow table includes at least an action command corresponding to the mirroring instruction.

(22) Upon receipt of the second flow table, the second data switching exchange 202 extracts the packets from the second flow table, and mirrors the packets to the designated node based on the action command.

(23) Finally, the monitoring and management unit 103 monitors and manages the network traffic according to the packets received by the designated node.

(24) As an improved embodiment, the SDN controller 102 can issue control policies to the first and second data switching exchanges 201, 202 to instruct the data switching exchanges 201, 202 to perform other actions in addition to the mirroring action.

(25) According to a preferred embodiment, the system for monitoring and managing network traffic can be deployed as a distributed system, for example, the upper layer application control unit and the SDN controller are disposed at a local end, and the monitoring and management unit is disposed at a remote end. The first and second data switching exchanges 201, 202 can also be disposed at another remote end.

(26) Further, the network traffic monitoring and management system can also be deployed in a cloud computing manner.

(27) The above depictions are only for the preferred embodiments of the present disclosure and are not intended to limit the scope of protection of the present disclosure. Various modifications may be made by those skilled in the art without departing from the spirit of the disclosure and the appended claims.