Method and device for capturing abnormal message causing network equipment failure

Abstract

The invention provides a method and a device for capturing an abnormal message causing a network equipment failure. The method and the device are used for solving the problem of the prior art that resources are seriously occupied when the abnormal message is captured. The method comprises the following steps: setting a package capturing mark bit in an abnormal table corresponding to an abnormal number of a to-be-captured abnormal message as an enabling mark indicating to perform package capturing treatment; searching for the corresponding abnormal table according to the abnormal number of the abnormal message; if the package capturing mark bit of the searched abnormal table is the enabling mark, setting the package capturing mark bit of the abnormal message as the enabling mark; and capturing the abnormal message with the package capturing mark bit which is the enabling mark and marking the package capturing mark bit on the to-be-captured abnormal message through the abnormal table, thereby capturing the set message without excess resources.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a method and device for capturing abnormal messages that cause network equipment failures. Background technique [0002] Today's network is developing at an astonishing speed. Network devices (including routers, switches, etc.) carry a variety of services. It is particularly important to analyze packets. In a complex network environment, multiple services are interspersed on network devices, and it is difficult to accurately capture specific discarded packets. [0003] Existing methods for packet capture and troubleshooting generally use flow mirroring or port mirroring to mirror a certain port or a packet that meets a certain rule to a specific physical port or CPU. The granularity of port mirroring is relatively coarse, and it is troublesome to filter out the packets of interest from a large number of packets; the granularity of flow mirroring is relatively fine,...

AI Technical Summary

Problems solved by technology

The granularity of port mirroring is relatively coarse, and it is troublesome to filter out the packets of interest from a large number of packets; the granularity of flow mirroring is finer, but it consumes precious ACL (Access Control List, access control list) resources

The premise of mirroring to a physical port is that there must be an idle physical port. Mirroring to the CPU will increase the load on the CPU. If the traffic is heavy, protocol packets will be discarded, which will cause the entire network device to work abnormally.

[0004] It can be seen that there is a serious resource occupation problem in the prior art when capturing abnormal packets

Images