Network traffic control method and related system

1 . A method comprising:

receiving, by a firewall controller of a control system, network traffic;

buffering, by the firewall controller, a plurality of packets in the network traffic, wherein the plurality of packets comprises a first packet and a second packet that are associated with each other;

receiving, by a firewall of the control system, bypass traffic based on a copy operation on the network traffic;

detecting a packet in the bypass traffic in order to obtain a detected packet;

generating a packet control message based on the detected packet, wherein the packet control message comprises:

a first packet control message comprising both first packet identification information and first packet control information of the first packet; and

a second packet control message comprising the first packet identification information, the first packet control information, second packet identification information, and second packet control information of the second packet;

receiving, by the firewall controller, the packet control message from the firewall; and

performing, based on the packet control message, a target operation on a target packet in the plurality of packets,

wherein the target operation comprises forwarding, discarding, or buffering,

wherein when the second packet control information indicates to discard the second packet, performing the target operation on the target packet in the plurality of packets comprises discarding, by the firewall controller, the first packet and the second packet,

wherein the first packet control information indicates to buffer the first packet, wherein the first packet control information and the second packet control information indicate to discard the first packet and the second packet, and wherein receiving the packet control message from the firewall, and performing the target operation on the target packet comprises:

receiving, by the firewall controller, the first packet control message;

prolonging a buffer time of the first packet;

receiving, by the firewall controller, the second packet control message; and

discarding the first packet and the second packet.

2 . The method of claim 1 , wherein performing the target operation on the target packet comprises:

selecting the target packet from the plurality of packets based on the first packet identification information or the second packet identification information; and

performing the target operation on the target packet based on the first packet control information or the second packet identification information.

3 . The method of claim 1 , further comprising controlling, by the firewall controller when no packet control message from the firewall is received within a preset time period, the plurality of packets based on a preset control policy.

4 . The method of claim 3 , wherein the preset control policy comprises a plurality of control policies, and wherein controlling the plurality of packets based on the preset control policy comprises:

obtaining, by the firewall controller, a service identifier from the network traffic, wherein the service identifier identifies a service;

determining, by the firewall controller based on a correspondence between the service and a control policy, a target control policy corresponding to the service from the plurality of control policies; and

controlling, by the firewall controller, the plurality of packets based on the target control policy.

5 . The method of claim 1 , further comprising obtaining the bypass traffic through optical splitting by an optical splitter.

6 . The method of claim 1 , further comprising obtaining the bypass traffic through switch mirroring.

7 . A control system, comprising:

a firewall controller configured to:

receive network traffic; and

buffer a plurality of packets in the network traffic, wherein the plurality of packets comprises a first packet and a second packet that are associated with each other; and

a firewall configured to:

receive bypass traffic based on a copy operation on the network traffic;

detect a packet in the bypass traffic in order to obtain a detected packet;

generate a packet control message based on the detected packet, wherein the packet control message comprises:

a first packet control message comprising both first packet identification information and first packet control information of the first packet; and

a second packet control message comprising the first packet identification information, the first packet control information, second packet identification information, and second packet control information of the second packet;

receive the packet control message from the firewall; and

perform, based on the packet control message, a target operation on a target packet in the plurality of packets, wherein the target operation comprises forwarding, discarding, or buffering,

wherein the first packet control information indicates to buffer the first packet, wherein the first packet control information and the second packet control information indicate to discard the first packet and the second packet, and wherein the firewall controller is further configured to:

receive the first packet control message and prolong buffer time of the first packet; and

receive the second packet control message and discard the first packet and the second packet.

8 . The control system of claim 7 , wherein the firewall controller is further configured to:

select the target packet from the plurality of packets based on the first packet identification information or the second packet identification information; and

perform the target operation on the target packet based on the first packet control information or the second packet identification information.

9 . The control system of claim 7 , wherein the firewall controller is further configured to control, when no packet control message from the firewall is received within a preset time period, the plurality of packets based on a preset control policy.

10 . The control system of claim 9 , wherein the preset control policy comprises a plurality of control policies, and wherein the firewall controller is further configured to:

obtain a service identifier from the network traffic, wherein the service identifier identifies a service;

determine, based on a correspondence between the service and a control policy, a target control policy corresponding to the service from the plurality of control policies; and

control the plurality of packets based on the target control policy.

11 . The control system of claim 7 , further comprising an optical splitter configured to obtain the bypass traffic through optical splitting.

12 . The control system of claim 7 , further comprising a switch mirror configured to obtain the bypass traffic through switch mirroring.

13 . A computer program product comprising instructions that are stored on a non-transitory computer-readable medium and that, when executed by one or more processors, cause a control system to:

receive network traffic;

buffer a plurality of packets in the network traffic, wherein the plurality of packets comprises a first packet and a second packet that are associated with each other;

perform a copy operation on the network traffic to obtain bypass traffic;

detect a packet in the bypass traffic in order to obtain a detected packet;

generate a packet control message based on the detected packet, wherein the packet control message comprises:

a first packet control message comprising both first packet identification information and first packet control information of the first packet; and

a second packet control message comprising the first packet identification information, the first packet control information, second packet identification information, and second packet control information of the second packet; and

perform, based on the packet control message, a target operation on a target packet in the plurality of packets, wherein the target operation comprises forwarding, discarding, or buffering,

wherein when the second packet control information indicates to discard the second packet, performing the target operation on the target packet in the plurality of packets comprises discarding the first packet and the second packet,

wherein the first packet control information indicates to buffer the first packet, wherein the first packet control information and the second packet control information indicate to discard the first packet and the second packet, and wherein the instructions, when executed by the one or more processors, further cause the control system to perform the target operation on the target packet by:

receiving the first packet control message and prolonging buffer time of the first packet; and

receiving the second packet control message and discarding the first packet and the second packet.

14 . The computer program product of claim 13 , wherein performing the target operation on the target packet comprises:

selecting the target packet from the plurality of packets based on the first packet identification information or the second packet identification information; and

performing the target operation on the target packet based on the first packet control information or the second packet identification information.

15 . The computer program product of claim 13 , wherein the instructions, when executed by the one or more processors, further cause the control system to control, when no packet control message is received within a preset time period, the plurality of packets based on a preset control policy.

16 . The computer program product of claim 15 , wherein the preset control policy comprises a plurality of control policies, and wherein the instructions, when executed by the one or more processors, further cause the control system to control the plurality of packets based on the preset control policy by:

obtaining a service identifier from the network traffic, wherein the service identifier identifies a service;

determining, based on a correspondence between the service and a control policy, a target control policy corresponding to the service from the plurality of control policies; and

controlling the plurality of packets based on the target control policy.

17 . The computer program product of claim 13 , wherein the instructions, when executed by the one or more processors, further cause the control system to obtain the bypass traffic through optical splitting by an optical splitter.

18 . The computer program product of claim 13 , wherein the instructions, when executed by the one or more processors, further cause the control system to obtain the bypass traffic through switch mirroring.