Network IP address tracing method and system

Abstract

The invention discloses a network IP address tracing method and system, and relates to the technical field of network engineering, and the method comprises the steps: collecting the configuration information of equipment, and obtaining a configuration file of the equipment; according to the configuration file, generating a port table through configuration analysis; based on the port table, an equipment topology table is obtained through IP address matching; obtaining an initial IP to be traced and an opposite terminal IP; performing IP address matching from the port table based on the initial IP and the opposite terminal IP, and determining an initial position and a target position; and determining all paths of the initial position and the target position through the equipment topology table based on the initial position and the target position. The method has the advantages that the topological structure is found and constructed in a complex network, and the interconnection topology corresponding to a plurality of physical port ends through Trunk can be identified; the initial position of a certain IP can be traced in the whole network; and a path between any two IP addresses is detected.

Description

Technical Field

[0001] The present invention relates to the technical field of network engineering, and particularly to a method and system for tracing network IP addresses. Background Art

[0002] CMNET is an Internet independently built by an operator. Different from the IP bearer network that only bears internal services, CMNET is interconnected with the international Internet and can access Internet resources through it. CMNET is divided into three overall layers: the CMNET backbone network, the CMNET provincial network, and the CMNET metropolitan area network. The total number of devices is 975, and the networking structure is complex. The user side mainly includes home broadband, 4G, and 5G users, and the content side mainly includes telecommunications and China Unicom resources, in-network resources, IDC resources, and video platforms.

[0003] With the continuous expansion of the scale of the Internet, the number of business system accesses has increased sharply, and the network structure has become more and more complex. The existing network management system can discover device failures through SNMPTRAP. However, for network quality problems reported through complaints, locating and delimiting faults still rely on manual troubleshooting, with low efficiency, mainly manifested in: incomplete asset management functions, inaccurate resource information, topological errors caused by manual entry, and inability to trace; currently, only traffic collection can be achieved, and the function of testing the quality of network devices is not available; there is no unified presentation platform, and only hop-by-hop login inspection and analysis can be performed; the function of judging abnormal values and presenting alarms is not available. The existing system can only reflect problems through device failures, and the provided reference alarm information is extremely large in quantity and poor in relevance, making it difficult to focus on positioning. Since the quality problem mainly comes from device performance, it is urgent to develop a system to solve the problem of the efficiency of quality problem positioning. Summary of the Invention

[0004] To solve the above technical problems, a method and system for tracing network IP addresses are provided. This technical solution solves the problem that the existing system can only reflect problems through device failures, and the provided reference alarm information is extremely large in quantity and poor in relevance, making it difficult to focus on positioning.

[0005] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A method for tracing network IP addresses includes:

[0007] Collecting the configuration information of a device to obtain a configuration file of the device;

[0008] Generating a port table by analyzing the configuration according to the configuration file, where the port table at least includes the mapping relationship between the IP address corresponding to the device port, the subnet mask, and the Trunk binding;

[0009] Obtaining a device topology table based on the port table through IP address matching;

[0010] Obtain the initial IP to be traced and the peer IP;

[0011] Based on the initial IP and the peer IP, perform IP address matching in the port table to determine the starting position and the target position;

[0012] Based on the starting position and the target position, determine all paths between the starting position and the target position through the device topology table.

[0013] Preferably, the generation of the port table by analyzing the configuration specifically includes:

[0014] S101. Read the configuration file line by line;

[0015] S102. Tokenize each line of the configuration by spaces;

[0016] S103. Analyze line by line;

[0017] S104. Judge whether the first word is "interface". If so, record the physical port value in the cache. If the second first word is "interface", empty the cache content and store it in the device port table, and then return to S103. If the second first word is not "interface", directly return to S103;

[0018] S105. If not, if the first word contains "ip" and / or "address", record the IP address in the cache and return to S103;

[0019] S106. If the first word does not contain "ip" and "address" and the first word is "eth-trunk" and / or "ip-trunk", record the Trunk port in the cache and return to S103. If the first word does not contain "ip" and "address" and the first word is not "eth-trunk" and / or "ip-trunk", the algorithm ends.

[0020] Preferably, the obtaining of the device topology table by IP address matching based on the port table specifically includes:

[0021] S201. Set two pointers denoted as x and y respectively;

[0022] S202. The pointer x and the pointer y point to the first row of ports;

[0023] S203. Read the IP address and mask corresponding to the pointer x, and calculate the network address corresponding to the pointer x;

[0024] S204. Read the IP address and mask corresponding to the pointer y;

[0025] S205. Determine whether the port addresses of pointer x and pointer y are the same. If so, point pointer y to the next line of ports and return to S204. If not, proceed to S206;

[0026] S206. Calculate the network address corresponding to pointer y;

[0027] S207. Determine whether the network addresses of pointer x and pointer y are the same. If so, store the two ends of the ports in the topology table and proceed to S208. If not, proceed to S209;

[0028] S208. Determine whether pointer y has traversed all ports. If so, proceed to S209. If not, point pointer y to the next line of ports and return to S204;

[0029] S209. Point pointer y to the first line of ports and pointer x to the next line of ports;

[0030] S210. Determine whether pointer x has traversed all ports. If so, end. If not, return to S203.

[0031] Preferably, the determination of whether the network addresses of pointer x and pointer y are the same specifically includes:

[0032] Read the IP addresses and subnet masks of pointer x and pointer y;

[0033] Convert the IP address to a 4-byte hexadecimal number;

[0034] Convert the subnet mask to binary 0.0.0.X;

[0035] Invert the binary 0.0.0.X to get X.X.X.0;

[0036] Perform an AND calculation on the binary 0.0.0.X and the IP address to obtain the network address;

[0037] Compare the sizes of the network addresses of pointer x and pointer y and output the comparison result.

[0038] Preferably, the determination of all paths between the starting position and the target position based on the starting position and the target position through the device topology table specifically includes:

[0039] S301. Input the starting position;

[0040] S302. Determine the next-hop port through the routing table query function;

[0041] S303. Confirm the next-hop router by querying the topology table;

[0042] S304. Determine whether the next-hop router exists. If so, return to S302. If not, proceed to S305;

[0043] S305. Determine whether there is a remaining next hop. If so, return the previous recursive result to continue the query and return to S302. If not, cache the cached path result.

[0044] Preferably, the routing table query function is specifically:

[0045] S401. Read in the target IP address;

[0046] S402. Read a line of the routing table in sequence;

[0047] S403. Determine whether the target IP is the same as the current one. If not, return to S402. If not, proceed to S404;

[0048] S404. Determine whether the routing range is larger than the previous one. If so, return to S402. If not, proceed to S405;

[0049] S405. Determine whether the routing range is larger than the previous one. If so, proceed to S406. If not, proceed to S407;

[0050] S406. Delete the previous route;

[0051] S407. Add this route to the list;

[0052] S408. Determine whether the entire routing table has been read. If so, end. If not, return to S402.

[0053] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0054] The present invention proposes a network IP address tracing method and system. By discovering and constructing a topological structure in a complex network, it can identify the interconnection topology corresponding to multiple physical ports through Trunk; it can trace the initial position of a certain IP in the entire network; and it can detect the path between any two IP addresses. Description of the Drawings

[0055] Figure 1 It is the structure diagram of the network IP address tracing system proposed by the present invention;

[0056] Figure 2 It is the flowchart of generating a port table in the present invention;

[0057] Figure 3 It is the flowchart of obtaining a device topology table in the present invention;

[0058] Figure 4 It is the flowchart of determining whether the network addresses of pointer x and pointer y are the same in the present invention;

[0059] Figure 5 It is the flowchart of the routing table analysis function in the present invention;

[0060] Figure 6 It is the use case topology diagram in the present invention;

[0061] Figure 7 It is the flowchart of the path discovery algorithm implemented by the path analysis module in the present invention;

[0062] Figure 8 It is the flowchart of the routing table query function in the present invention;

[0063] Figure 9 It is the flowchart of the function for querying the running status information of ports in the present invention;

[0064] Figure 10 It is an example diagram of printing the path discovery process through print in the present invention;

[0065] Figure 11 It is an example diagram of running commands on the Linux system in the present invention to collect the specified device name, IP address, and port. Detailed implementation manners

[0066] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments in the following description are only examples, and those skilled in the art can think of other obvious variations.

[0067] Refer to Figure 1 As shown, a network IP address tracing system includes:

[0068] A data center, which stores a device port table, a device topology table, a device routing table, a port performance table, and a port test table;

[0069] A topology discovery subsystem, which is used to generate a port table by analyzing the configuration according to a configuration file. The port table at least includes the mapping relationship between the device port and the corresponding IP address, subnet mask, and Trunk binding, and based on the port table, obtains the device topology table through IP address matching;

[0070] A path discovery subsystem, which is used to determine the starting position and the target position by performing IP address matching on the initial IP and the peer IP from the port table, and based on the starting position and the target position, determine all paths between the starting position and the target position through the device topology table.

[0071] The topology discovery subsystem includes:

[0072] Device port analysis module, which is used to generate a port table according to a configuration file through configuration analysis;

[0073] Interconnection topology analysis module, which is used to obtain a device topology table based on the port table through IP address matching;

[0074] Port performance log retention module, which is used to collect port status and test the port status to obtain a port performance table and a port test table.

[0075] The path discovery subsystem includes:

[0076] Address traceability analysis module, which is used to obtain the initial IP and peer IP to be traced, and determine the starting position and target position based on IP address matching of the initial IP and peer IP from the port table;

[0077] Path analysis module, which is used to determine all paths between the starting position and the target position based on the starting position and the target position through the device topology table;

[0078] Path performance real-time collection module, which is used to evaluate the path performance based on the performance of each port in the path.

[0079] Among them, the implementation process of the topology discovery subsystem is:

[0080] According to the configuration file, generate a port table through configuration analysis. The port table at least includes the mapping relationship between the device port and the corresponding IP address, subnet mask, and Trunk binding;

[0081] Based on the port table, obtain a device topology table through IP address matching;

[0082] The device port analysis module generates a port table according to the configuration file through configuration analysis. This table has two functions: one is to store device static data for periodic port performance scanning, and the other is to discover the interconnection relationship between devices through IP address comparison by analyzing this table with the help of the subnet mask comparison function. Refer to Figure 2 As shown, the implementation method is as follows:

[0083] S101. Read the configuration file line by line;

[0084] S102. Tokenize each line of the configuration by spaces;

[0085] S103. Analyze line by line;

[0086] S104. Determine whether the first word is "interface". If so, record the physical port value cache. If the second first word is "interface", empty the cache content and store it in the device port table, then return to S103. If the second first word is not "interface", directly return to S103;

[0087] S105. If not, and if the first word contains "ip" and / or "address", record the IP address to the cache and return to S103;

[0088] S106. If the first word does not contain "ip" and "address" and the first word is "eth-trunk" and / or "ip-trunk", record the Trunk port to the cache and return to S103. If the first word does not contain "ip" and "address" and the first word is not "eth-trunk" and / or "ip-trunk", the algorithm ends.

[0089] After being processed by the device port analysis module, the output device port table is written into the data center. The sample table is as

[0090] shown in Table 1.

[0091]

[0092] Table 1

[0093] The topology discovery sub-module simplifies the algorithm according to the actual characteristics of the network to improve the budget efficiency. The algorithm optimization is based on the following three points:

[0094] Since there is a clear device list, there is no need to traverse the device ports hop by hop. All device ports can be traversed simultaneously through the multi-threaded concurrent method, without the need to frequently search for the next hop and then traverse the ports.

[0095] There are no identical IP address segments on the Internet. Otherwise, it will cause routing conflicts. Therefore, only the IP address segment matching needs to be considered for the IP address, and there is no need to consider the MAC address for secondary verification.

[0096] The IP addresses of the interconnection ports on the Internet are all 30-bit masks, and the ports are configured one-to-one, without the one-to-many situation, that is, one line of link relationship corresponds to one hop.

[0097] Based on this algorithm, only all device ports need to be listed, and the device topology table, that is, the device interconnection relationship table, can be obtained through IP address matching, providing the next-hop port device for the subsequent path search. By setting two pointers x and y, where x is the outer loop and y is the inner loop, when the outer loop traverses all ports, the device topology table is integrated. Refer to Figure 3 shown as follows. The actual algorithm is:

[0098] S201. Set two pointers, denoted as x and y respectively;

[0099] S202. The pointers x and y point to the first-row ports;

[0100] S203. Read the IP address and mask corresponding to pointer x, and calculate the network address corresponding to pointer x;

[0101] S204. Read the IP address and mask corresponding to pointer y;

[0102] S205. Determine whether the port addresses of pointers x and y are the same. If so, point pointer y to the next-row port and return to S204. If not, perform S206;

[0103] S206. Calculate the network address corresponding to pointer y;

[0104] S207. Determine whether the network addresses of pointers x and y are the same. If so, store the two ends' ports in the topology table and perform S208. If not, perform S209;

[0105] S208. Determine whether pointer y has traversed all ports. If so, perform S209. If not, point pointer y to the next-row port and return to S204;

[0106] S209. Pointer y points to the first-row port, and pointer x points to the next-row port;

[0107] S210. Determine whether pointer x has traversed all ports. If so, end. If not, return to S203.

[0108] During the topology discovery process, it is necessary to calculate the network addresses to which the subnet masks of two ports belong, for determining whether the ports corresponding to the two addresses are interconnected. Through the displacement method, the dotted decimal is converted into a 4-byte hexadecimal number according to the positions, for judging and comparing sizes. The inverse mask is used to convert the original format like " / 24" into "00001111", and the network address can be obtained by performing an AND operation with the two IP addresses. The implementation method is as Figure 4 shown, specifically:

[0109] Read the IP addresses and subnet masks of pointers x and y;

[0110] Convert the IP address into a 4-byte hexadecimal number;

[0111] Convert the subnet mask into binary 0.0.0.X;

[0112] Invert the binary 0.0.0.X to get X.X.X.0;

[0113] Perform an AND calculation on the binary 0.0.0.X and the IP address to obtain the network address;

[0114] Compare the network addresses of pointer x and pointer y and output the comparison result.

[0115] During the process of address storage, there will be two different formats: the traditional mask (255.255.255.0) and the command echo mask ( / 32). For calculation, it is necessary to unify the mask format. Convert the mask to the binary format of 11111111.11111111.11111111.00000000, calculate the number of 1s, that is, a 24-bit mask, expressed as " / 24". The code is omitted.

[0116] Generate a topology function. According to the port table generated through the configuration file, use two pointers to compare the IP address ownership line by line. Due to the principle of unique networking for public IP addresses, it is only necessary to compare the IP addresses to complete the topology generation, and there is no need to re-verify the MAC address.

[0117] After being processed by this module, the output device topology table is written into the data center. The sample table contains the two-end devices, ports, and IP addresses. The sample table is shown in Table 2;

[0118]

[0119] Table 2

[0120] The implementation process of the path discovery subsystem is as follows:

[0121] Obtain the initial IP to be traced and the peer IP;

[0122] Based on the initial IP and the peer IP, perform IP address matching from the port table to determine the starting position and the target position;

[0123] Based on the starting position and the target position, determine all paths between the starting position and the target position through the device topology table.

[0124] Among them, the purpose of the address traceability analysis module for address traceability analysis is to be able to trace the ownership of an arbitrary IP address without knowing the network mask, and finally return the names of two routers. The address traceability is based on the following principles:

[0125] Within an autonomous system, it is necessary to define from the routing level. Among them, the intra-domain protocols include direct routes, static routes, and OSPF external routes, which are considered intra-domain service routes. EBGP routes can be considered external boundary routes. Both of these two types of routes can be used as the starting points. While ISIS-L2 routes and IBPG routes can only be considered as routing transit points and cannot be used as starting points.

[0126] In principle, the routing protocol preferably selects the route with the smallest subnet range. The aggregated route can only be larger than the smallest route. Therefore, the smallest possible route in the network is preferably selected as the starting point.

[0127] Since there are equal-cost routes in the network, such as static routes being equally advertised, there may be multiple starting points for one IP address, which should be considered during path search.

[0128] The subnet mask in the route is represented in the form of 192.168.1.1 / 24. The / 24 mask needs to be shifted to convert it to binary, and then the network address is calculated.

[0129] All routes need to be entered into the device routing table according to the device. Since the total table has a large amount of data, the network addresses should be sorted, or indexes or filtering conditions should be added before using this table to avoid the process from being unresponsive for a long time due to traversing the entire routing table.

[0130] In address tracing, a routing table analysis function is designed to simplify the complexity of the overall tracing code. This function is used to analyze the routing status, record the routing table of each managed device Agent under normal operation, and based on the routing table, analyze all possible paths when there is an end-to-end exception. Based on the characteristics of routing table analysis: one is what you see is what you get, without considering the cooperation issues between routing protocols; the other is that compared with configuration file analysis, the routing table analysis method can obtain dynamically learned routes, such as routes redistributed by BGP, OSPF, etc. can all be collected, ensuring the continuity of the routing path. As Figure 5 shown, the specific routing table analysis function is as follows:

[0131] A1. Read a line of the routing table in sequence;

[0132] A2. Judge whether the routing flag is D, DB, or RD. If not, return to A1. If so, perform A3;

[0133] A3. Judge whether it is the local IP address prefix. If not, return to A1. If so, perform A4;

[0134] A4. Judge whether it is an equal-cost route. If so, perform A5. If not, perform A6;

[0135] A5. Write the address of the previous route and the next hop of this route into the database;

[0136] A6. Write this route into the database;

[0137] A7. Judge whether the entire routing table has been read. If so, end. If not, return to A1.

[0138] Since each node in the network has one or more next hops, during actual testing, different paths will form a tree-like structure. Because the depth is unpredictable, a recursive method is used to find sub-paths and record the depth. For example Figure 6 As shown, there are a total of 3 paths in the use case topology;

[0139] Path 1: A -> D1 -> G -> I;

[0140] Path 2: A -> D2 -> G -> I;

[0141] Path 3: B -> E -> H -> I;

[0142] The path analysis module implements the path discovery algorithm as follows:

[0143] Based on the address tracing result, the program directly enters the starting position and uses the routing table lookup function to find the next hop. If there are equivalent routes in parallel, two next hop ports are output to the topology query program.

[0144] The topology query program finds all the next hop device names based on the next hop interface. If there are equivalent routes, two device names are returned. At this time, in a recursive manner, the first router name is substituted into the routing table lookup function in sequence to achieve recursion.

[0145] Boundary condition: When the topology query program cannot find the next hop device based on the port, the port is set as the boundary port, that is, the end port, and the query is completed while returning to the upper-level function.

[0146] When all paths have been traversed, that is, when the boundary node has no other paths in the previous hop at the same time, the entire path discovery process ends.

[0147] The overall algorithm flow chart is as Figure 7 shown, specifically:

[0148] S301. Input the starting position;

[0149] S302. Determine the next hop port through the routing table query function;

[0150] S303. Confirm the next hop router by querying the topology table;

[0151] S304. Determine whether the next hop router exists. If so, return to S302. If not, proceed to S305;

[0152] S305. Determine whether there are remaining next hops. If so, return to the previous recursive result to continue the query and return to S302. If not, cache the cached path result.

[0153] When designing the path analysis module, network complexity, multi-hop and multi-exit problems need to be considered. Therefore, multiple functionally independent functions need to be designed to cooperate to complete path detection. Specifically, the following functions are included.

[0154] Next-hop interface query function: Through address tracing, the originating node router to which the address belongs has been found, and the next-hop exit of this router is queried according to the IP address. Since IP routing follows the principle of the smallest subnet, it is necessary to compare and find the matching smallest route in the routing table until there is no smaller route. Then this exit is the next-hop. If a larger mask, that is, a smaller subnet, is found, the next-hop list is updated. If there is no larger next-hop, there may be two equivalent next-hops, then both of these routes need to be recorded. Therefore, the append method is used to add instead of replacing, as Figure 8 shown, the routing table query function is specifically as follows:

[0155] S401. Read in the target IP address;

[0156] S402. Read a line of the routing table in sequence;

[0157] S403. Judge whether the target IP is the same as the current one. If not, return to S402. If so, perform S404;

[0158] S404. Judge whether the routing range is larger than the previous one. If so, return to S402. If not, perform S405;

[0159] S405. Judge whether the routing range is larger than the previous one. If so, perform S406. If not, perform S407;

[0160] S406. Delete the previous route;

[0161] S407. Add this route to the list;

[0162] S408. Judge whether the entire routing table has been read. If so, end. If not, return to S402.

[0163] Next-hop router name query function: Relying on the interface relationship corresponding to the network topology, on the premise of knowing the local device and port, the IP address of the peer device can be obtained by querying the topology table, so as to locate the specific peer device for the next step of path query.

[0164] Input: Local device name, next-hop port number;

[0165] Output: Next-hop device name.

[0166] The next-hop router name query function relies on the interface relationship corresponding to the network topology. Given the local device and port, it can obtain the IP address of the peer device by querying the topology table, thus locating the specific peer device for the next-step path query. During the query process, the function records the hop depth to observe the number of hops of a certain node in the entire path. When the next hop cannot be found, it goes back to the previous hop to continue searching for the path. In the case of multiple exits for the next hop, each interface is probed one by one, and the next-hop hostname is obtained recursively.

[0167] The duplicate path removal function mainly targets the duplicate next hops in each path. First, all detected path segments are sorted. If there are identical items, the duplicate path segment is popped to ensure that the path is not repeated, reducing the complexity of subsequent port running status queries.

[0168] Query the port running status information. This function mainly deals with the situation of "multiple physical ports bound to a Trunk". Due to the limited bandwidth of physical ports, sometimes 4 or more physical 100G ports need to be bound into a 400G Trunk link, and logically, only a single-port connection between routers is presented, greatly reducing the routing complexity. This method is very common in operator backbone networks. Therefore, this function needs to identify each physical port corresponding to a Trunk port and test the quality of this port. Refer to Figure 9 As shown, the function for querying port running status information is specifically as follows:

[0169] Read in the device name and port number;

[0170] Judge whether it is a Trunk bundling port. If so, list all physical ports under this Trunk and read the port performance data from the database. If not, directly read the port performance data from the database;

[0171] Display the performance data.

[0172] The status query and display function: used to present the port running status result, and identify the location to which the interface belongs, the local port and the peer port name. If this interface is the end point of the path, it is displayed as BORDER, and a panoramic path quality map is generated in a fixed format.

[0173] Specific implementation example:

[0174] Print the path discovery process through print. The numbers represent the depth, that is, the number of hops. The result is as Figure 10 , and the presented result is consistent with the actual path;

[0175] Run commands on the Linux system to collect the specified device name, IP address, and port, obtain the RX and TX optical powers corresponding to the port, and verify that the SNMP port performance acquisition is effective. The collected results displayed at this time are as Figure 11 shown.

[0176] In summary, the advantages of the present invention are as follows: By discovering and constructing a topological structure in a complex network, it is possible to identify the interconnection topology corresponding to multiple physical ports through Trunk; the initial position of a certain IP can be traced throughout the network; and the path between any two IP addresses can be detected.

[0177] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art of this industry should understand that the present invention is not limited by the above embodiments. What is described in the above embodiments and the specification is only the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A network IP address tracing method, characterized in that: include: Collect the configuration information of the device to obtain the configuration file of the device; According to the configuration file, a port table is generated by analyzing the configuration, wherein the port table at least includes a mapping relationship between the device port corresponding to the IP address, the subnet mask and the Trunk binding; Based on the port table, the device topology table is obtained by matching the IP addresses; Get the initial IP and peer IP to be traced; Based on the IP address matching of the initial IP and the peer IP from the port table, the starting location and the target location are determined; Based on the starting location and the target location, all paths to the starting location and the target location are determined through the device topology table.

2. A network IP address tracing method according to claim 1, characterized in that: The generating of the port table by analyzing the configuration specifically includes: S101, reading the configuration file line by line; S102, segment each line of configuration according to spaces; S103, line by line analysis; S104, determine whether the first word is interface, if so, record the physical port value cache, if the second first word is interface, store the cache content in the device port table, clear it, and return to S103, if the second first word is not interface, directly return to S103; S105, if not, if the first word contains ip and / or address, then record the ip address to the cache and return to S103; S106. If the first word does not contain ip and address and the first word is eth-trunk and / or ip-trunk, record the Trunk port to the cache and return to S103. If the first word does not contain ip and address and the first word is not eth-trunk and / or ip-trunk, the algorithm ends.

3. A method for tracing the source of a network IP address according to claim 2, characterized in that: The method of obtaining the device topology table based on the port table by matching the IP addresses specifically includes: S201, set two pointers to be x and y respectively; S202, pointer x, pointer y point to the first row port; S203, read the IP address and mask corresponding to pointer x, and calculate the network address corresponding to pointer x; S204, read the IP address and mask corresponding to pointer y; S205, determine whether the port addresses of pointer x and pointer y are the same, if so, point pointer y to the next row port and return to S204, if not, proceed to S206; S206, calculating the network address corresponding to the pointer y; S207, determine whether the network addresses of pointer x and pointer y are the same, if so, store the two end ports as a topology table and proceed to S208, if not, proceed to S209; S208, determine whether the pointer y has traversed all ports, if so, proceed to S209, if not, point the pointer y to the next row of ports and return to S204; S209, pointer y points to the first row of ports, and pointer x points to the next row of ports; S210, determine whether the pointer x has traversed all ports, if so, end, if not, return to S203.

4. A network IP address tracing method according to claim 3, characterized in that: The determining whether the network addresses of pointer x and pointer y are the same specifically includes: Read the IP address and subnet mask of pointer x and pointer y; Convert the IP address to a 4-byte hexadecimal number. Convert the subnet mask to binary 0.0.0.X; Invert the binary 0.0.0.X to get XXX0; Calculate the binary 0.0.0.X and the IP address to get the network address; Compare the network address sizes of pointer x and pointer y, and output the comparison results.

5. A method for tracing the source of a network IP address according to claim 4, characterized in that: The method of determining all paths of the starting position and the target position based on the starting position and the target position through the device topology table specifically includes: S301, input the starting position; S302, determining the next hop port through a routing table query function; S303, confirm the next router by querying the topology table; S304, determine whether the next hop router exists, if yes, return to S302, if no, proceed to S305; S305, determine whether there is a remaining next hop, if so, return to the last recursive result to continue the query, and return to S302, if not, cache the cached path result.

6. A method for tracing the source of a network IP address according to claim 5, characterized in that: The routing table query function is specifically: S401, read in the target IP address; S402, read a row of the routing table in order; S403, determine whether the target IP is consistent with the current one, if not, return to S402, if not, proceed to S404; S404, determine whether the route range is larger than the previous one, if so, return to S402, if not, proceed to S405; S405, determine whether the route range is larger than the previous one, if so, proceed to S406, if not, proceed to S407; S406, deleting the previous route; S407, adding this route to the list; S408, determine whether the routing table has been read completely, if so, end, if not, return to S402.

7. A network IP address tracing system, characterized in that: The method for tracing the source of a network IP address according to any one of claims 1 to 6 comprises: A data center, wherein the data center stores a device port table, a device topology table, a device routing table, a port performance table, and a port test table; A topology discovery subsystem, wherein the topology discovery subsystem is used to generate a port table by analyzing the configuration according to the configuration file, wherein the port table at least includes a mapping relationship between the device port and the corresponding IP address, subnet mask, and Trunk binding, and obtain a device topology table by matching the IP address based on the port table; The path discovery subsystem is used to determine the starting location and the target location based on IP address matching of the initial IP and the peer IP from the port table, and based on the starting location and the target location, determine all paths to the starting location and the target location through the device topology table.

8. A network IP address tracing system according to claim 7, characterized in that: The topology discovery subsystem includes: A device port analysis module, the device port analysis module is used to generate a port table by analyzing the configuration according to the configuration file; An interconnection topology analysis module, the interconnection topology analysis module is used to obtain a device topology table based on a port table and through IP address matching; The port performance log retention module is used to collect and test the port status to obtain a port performance table and a port test table.

9. A network IP address tracing system according to claim 8, characterized in that: The path discovery subsystem includes: An address tracing analysis module is used to obtain the initial IP and the peer IP to be traced, and determine the starting location and the target location based on the IP address matching of the initial IP and the peer IP from the port table; A path analysis module, wherein the path analysis module is used to determine all paths between the starting location and the target location through a device topology table based on the starting location and the target location; A path performance real-time collection module is used to evaluate the path performance based on the performance of each port in the path.

Images