A monitoring and analyzing method for network no_socket error

Abstract

The present application relates to the technical field of network error monitoring, and is a kind of network NO_SOCKET error monitoring and analysis method, comprising the following steps: user state program initializes two eBPF programs and storage structure;Two eBPF programs are respectively mounted to socket release function and skb release function;First eBPF program reports sock event entry to user state program;User state program stores it to storage structure;User state program carries out aging treatment to sock event entry;When kernel calls skb release function and second eBPF program judges that the reason is NO_SOCKET error, second eBPF program reports skb event entry to user state program;User state program finds sock event entry from storage structure based on skb event entry, and obtains error processing information, to realize the monitoring and analysis of NO_SOCKET error.

Description

Technical Field

[0001] This invention relates to the field of network error monitoring technology, and specifically to a method for monitoring and analyzing network NO_SOCKET errors. Background Technology

[0002] In Linux kernel networking, there are several pre-defined causes of packet loss, one of which is the NO_SOCKET error. This error mainly indicates that the socket corresponding to the data packet may have been closed or is not listening on the port correctly. It is necessary to confirm whether the process has closed the port or is not listening on the port correctly. Due to the increasing complexity of current network service processes, and the fact that NO_SOCKET errors usually occur without any known problem context, it is difficult to trace the specific process and cause of packet loss when NO_SOCKET errors occur, which is not conducive to troubleshooting. Summary of the Invention

[0003] To address the aforementioned problems, the present invention aims to provide a method for monitoring and analyzing network NO_SOCKET errors. This method utilizes eBPF technology to monitor and record the call stack and process information of socket release functions within a time window, and reports this information to the user-space program. When a released socket receives data packets within the time window, the system responds with a NO_SOCKET error. Simultaneously, the system also uses eBPF technology to monitor the functions that trigger the NO_SOCKET error response. When a NO_SOCKET error occurs, the system reports the skb 5-tuple information of the error to the user-space program. The user-space program uses this skb 5-tuple information to retrieve the corresponding information from the stored call stack and process information of the socket release functions, thereby accurately locating the NO_SOCKET error.

[0004] This invention provides a method for monitoring and analyzing network NO_SOCKET errors, comprising the following steps:

[0005] Step S1: The user-space program initializes the first eBPF program, the second eBPF program, the first storage structure, and the second storage structure;

[0006] Step S2: The user-mode program mounts the first eBPF program to the kernel's socket release function; the user-mode program mounts the second eBPF program to the kernel's skb release function.

[0007] Step S3: When the process calls the socket release function through the kernel, the first eBPF program collects the socket release information and packages it into a sock event entry to report to the user-space program;

[0008] Step S4: The user-mode program stores the sock event entry at the end of the first and second storage structures;

[0009] Step S5: The user-space program ages the sock event entries in the first and second storage structures.

[0010] Step S6: When the process calls the skb release function through the kernel, the second eBPF program captures the skb release event and determines that the cause of the skb release event is a NO_SOCKET error. The second eBPF program then collects the skb release information, packages it into an skb event entry, and reports it to the user-space program.

[0011] Step S7: The user-space program searches for the corresponding sock event entry in the first storage structure after aging based on the skb event entry, and obtains the NO_SOCKET error handling information based on the search result.

[0012] A further improvement of the present invention is that the first storage structure is a HASHMAP structure and the second storage structure is a FIFO structure.

[0013] A further improvement of the present invention is that the aging process in step S5 refers to: the user-mode program comparing the sock event entries from the head to the tail of the second storage structure; if the difference between the timestamp of the sock event entry and the current system time exceeds a preset time window value, the sock event entry is deleted from the first storage structure and the second storage structure, and the comparison of the next sock event entry continues; if the difference between the timestamp of the sock event entry and the current system time does not exceed the preset time window value, the aging process is stopped.

[0014] A further improvement of the present invention is that, in step S6, when the process calls the skb release function through the kernel and the second eBPF program determines that the cause of the skb release event is not a NO_SOCKET error, it exits directly.

[0015] A further improvement of this invention is that the socket release information refers to the PID, name, call stack, and timestamp of the process that calls the socket release function through the kernel.

[0016] A further improvement of the present invention is that the skb release information refers to the skb 5-tuple information of the process that calls the skb release function through the kernel.

[0017] A further improvement of the present invention is that step S7 includes the following steps:

[0018] Step S71: The user-space program obtains the skb 5-tuple information from the skb event entry;

[0019] Step S72: The user-space program searches for the corresponding sock event entry in the first storage structure based on the skb 5-tuple information;

[0020] Step S73: If a sock event entry corresponding to the skb 5-tuple information is found in the first storage structure, the handling information for the NO_SOCKET error is "premature release";

[0021] If no sock event entry corresponding to the skb 5-tuple information is found in the first storage structure, the NO_SOCKET error handling information is "port not bound".

[0022] A further improvement of the present invention is that step S7 further includes step S74: the user-mode program prints the processing information of the NO_SOCKET error.

[0023] A further improvement of this invention is that the socket release function is the sock_release() function; and the skb release function is the kfree_skb_reason() function.

[0024] A further improvement of this invention is that the kernel is the Linux kernel.

[0025] The beneficial effects of this invention are:

[0026] 1. This invention uses eBPF technology to hook into the socket release function and the skb release function, respectively capturing the socket release information (call stack and process PID, etc.) and the skb release information (skb 5-tuple information) when the release reason is NO_SOCKET. By matching the skb release information with the socket release information, the release call stack and process information of the abnormal socket can be obtained, and the problem can be accurately located.

[0027] 2. This invention uses FIFO and HASHMAP structures to manage the socket event entries reported by the socket release function. The FIFO structure is responsible for aging up event entries, which can delete timeout event entries in a very efficient way and avoid excessive memory consumption. The HASHMAP structure provides a fast query function, which can achieve a query efficiency of O(1) and quickly check whether the corresponding event entry exists. Attached Figure Description

[0028] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0029] Figure 1 This is the basic process of interaction between the user-mode program and the kernel in this invention. Detailed Implementation

[0030] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Many specific details are set forth in the following description to provide a thorough understanding of the present invention; however, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0031] This invention provides a method for monitoring and analyzing network NO_SOCKET errors. The user-space program uses eBPF technology to monitor the socket release functions and skb release functions. When a socket release function is called, the call stack and corresponding process information are collected, and this information is simultaneously stored in a delayed-deletion FIFO structure and a HASHMAP structure. The FIFO structure is used for timeout deletion of information to avoid excessive memory consumption, while the HASHMAP structure is used to quickly find the information collected when the corresponding socket is released. When the skb release function gives a NO_SOCKET error as the cause, an skb event entry is reported. The user-space program then retrieves the corresponding socket information in the HASHMAP structure, thus obtaining the process that performed the socket release and the corresponding call stack. If the result is not found, it indicates that the NO_SOCKET error is caused by the socket port not being correctly bound. Specific Implementation Example 1:

[0033] This invention discloses a method for monitoring and analyzing network NO_SOCKET errors. The user-space program implements efficient kernel monitoring through an eBPF program. The specific steps are as follows:

[0034] Step S1: The user-mode program initializes the first eBPF program, the second eBPF program, the first storage structure, and the second storage structure.

[0035] Specifically, the first eBPF program is used to capture sock event entries and collect socket release information (call stack information, time information, process name and process PID information) of the socket release function, and package it into a sock (sock_release) event entry and report it to the user-space program.

[0036] The second eBPF program is used to capture skb release events and parse the reasons for skb release events (corresponding to...). Figure 1In the "obtain free reason"), if the reason is a NO_SOCKET error, obtain the skb five-tuple information, package it into a skb (skb_free) event entry, and report it to the user-space program.

[0037] Initialization of the first storage structure and the second storage structure:

[0038] HASHMAP structure (the first storage structure): Create a HASHMAP to store key-value pairs of <skb five-tuple information, call stack ID of the socket release function, process name, and process PID>.

[0039] FIFO structure (the second storage structure): A delayed deletion queue (used for aging processing of event entries to avoid excessive memory consumption due to too many stored entries), which stores the same information as the HASHMAP structure and attaches timestamps.

[0040] Step S2: Hook (mount) the probes of the first eBPF program to the entry of the kernel's socket release function; hook (mount) the probes of the second eBPF program to the entry of the kernel's skb release function. The socket release function is the sock_release() function, and the skb release function is the kfree_skb_reason() function.

[0041] When the kernel calls the sock_release() function and the kfree_skb_reason() function, the first eBPF program and the second eBPF program mounted at the entrances of the two functions will be run first. In this application, the kernel always refers to the Linux kernel.

[0042] Step S3: When a process calls the socket release function through the kernel, the first eBPF program mounted on this function will be run first. The first eBPF program collects the socket release information and packages it into a sock event entry and reports it to the user-space program. The socket release information refers to the PID, name, call stack, and timestamp of the process that calls the socket release function through the kernel.

[0043] Step S4: The user-space program stores the sock event entries into the tails of the first storage structure and the second storage structure respectively.

[0044] Step S5: After the storage in Step S4 is completed, the user-space program performs aging processing on the sock event entries in the first storage structure and the second storage structure;

[0045] Aging process refers to the user-space program comparing each sock event entry sequentially from the beginning to the end of the first storage structure. If the difference between the timestamp of a sock event entry and the current system time exceeds a preset time window (default 30 seconds), the sock event entry has expired. It is then deleted from both the first and second storage structures, and the comparison of the next sock event entry continues. If the difference between the timestamp of a sock event entry and the current system time does not exceed the preset time window, the aging process stops. System time refers to the time of the system corresponding to the Linux kernel.

[0046] Step S6: When the process calls the skb release function through the kernel, the second eBPF program captures the skb release event and determines whether the cause of the skb release event is a NO_SOCKET error. If the cause of the skb release event is a NO_SOCKET error, the second eBPF program collects the skb release information, packages it into an skb event entry, and reports it to the user-space program. If the cause of the skb release event is not a NO_SOCKET error, no further processing steps are performed.

[0047] Step S7: The user-space program searches for the corresponding sock event entry in the first storage structure after aging based on the skb event entry, and obtains the NO_SOCKET error handling information based on the search result.

[0048] Specifically, the user-space program retrieves the skb 5-tuple information from the reported skb (skb_free) event entries, and uses this as the key to search for the corresponding sock (sock_release) event entry in the first storage structure. Based on the search results, the following scenarios apply:

[0049] If a corresponding entry exists in the first storage structure, the NO_SOCKET error handling information is "premature release". Then, the user-space program prints this handling information and the queried entry information: socket pointer, process name of the socket release process, PID of the socket release process, and the call stack symbolization information of sock_release (resolved through the user-space symbol table).

[0050] If the corresponding entry does not exist in the first storage structure, the processing information for the NO_SOCKET error is "port not bound", and the user-space program prints this processing information.

[0051] like Figure 1The diagram shows the interaction flow between the user-mode program and the kernel of the present invention. Steps S1 and S2 are performed in the user-mode program, step S3 is performed by the first eBPF program in the kernel, step S5 is performed by the second eBPF program in the kernel, and steps S4, S5, and S7 are collectively referred to as event handling, which are performed in the user-mode program. Specific Implementation Example 2:

[0053] In this embodiment, the collection of socket release information by the first eBPF program in step S3 is described in detail. Specifically, the first eBPF program performs the following operations:

[0054] 1. Obtain the process name using bpf_get_current_comm();

[0055] 2. Obtain the process ID (PID) using bpf_get_current_pid_tgid();

[0056] 3. Use bpf_get_stackid() to collect the kernel call stack;

[0057] 4. Record nanosecond-level timestamps (using bpf_ktime_get_ns());

[0058] Finally, the information obtained above is packaged into a sock (sock_release) event entry and reported to the user-space program. Specific Implementation Example 3:

[0060] In this embodiment, in step S6, when the process calls the skb release function (kfree_skb_reason() function) through the kernel, the second eBPF program mounted on that function will be run first. The second eBPF program will perform the following operations:

[0061] 1. Obtain the reason parameter and determine if it is a NO_SOCKET error; if it is not a NO_SOCKET error, exit directly; if it is, proceed with subsequent processing.

[0062] 2. Obtain skb release information (skb 5-tuple information)

[0063] 3. Package the obtained skb 5-tuple information into skb (skb_free) event entries and report them to the user-space program.

[0064] Definitions of abbreviations and key terms:

[0065] eBPF (Extended Berkeley Packet Filter) is a kernel technology that originated from the Berkeley Packet Filter (BPF). eBPF allows users to safely run custom programs in kernel space. These programs can be loaded into the Linux kernel and executed when specific kernel event entries (such as system calls, network packet transmission and reception, process scheduling, etc.) are triggered.

[0066] HOOK: A hook is a predefined location in the kernel or user-space program that allows eBPF programs to mount and execute at these locations, thereby intercepting, processing, or extending system behavior. eBPF programs use the hook mechanism to achieve dynamic code injection, and are widely used in networking, security, monitoring, and other fields.

[0067] NO_SOCKET error: When a data packet arrives, the corresponding socket may have been closed or the port may not be listening correctly (e.g., the bind / listen function has not been called), causing the kernel to be unable to match a valid socket structure, thus triggering a NO_SOCKET error and resulting in packet loss.

[0068] FIFO structure: First-In-First-Out (FIFO) is a linear data structure where data elements are stored and accessed in the order they arrive. The core operations of a queue include enqueue and dequeue, similar to queuing scenarios in real life (such as supermarket checkout or printer job scheduling).

[0069] HASHMAP structure: A key-value storage data structure based on a hash function, capable of performing data insertion, deletion and search operations in an average time complexity of O(1).

[0070] skb: A core data structure in the Linux kernel used to manage network packets, its full name is struct sk_buff (Socket Buffer). It is the carrier for the network protocol stack to process data packets, and it runs through the entire network transmission and reception process (from the network card driver to the user-space socket).

[0071] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for monitoring and analyzing network NO_SOCKET errors, characterized in that, Includes the following steps: Step S1: The user-mode program initializes the first eBPF program, the second eBPF program, the first storage structure, and the second storage structure; the first storage structure is a HASHMAP structure, and the second storage structure is a FIFO structure; Step S2: The user-mode program mounts the first eBPF program to the kernel's socket release function; the user-mode program mounts the second eBPF program to the kernel's skb release function. Step S3: When the process calls the socket release function through the kernel, the first eBPF program collects the socket release information and packages it into a sock event entry to report to the user-space program; Step S4: The user-mode program stores the sock event entry at the end of the first and second storage structures; Step S5: The user-space program ages the sock event entries in the first and second storage structures. Step S6: When the process calls the skb release function through the kernel, the second eBPF program captures the skb release event and determines that the cause of the skb release event is a NO_SOCKET error. The second eBPF program then collects the skb release information, packages it into an skb event entry, and reports it to the user-space program. Step S7: The user-space program searches for the corresponding sock event entry in the first storage structure after aging based on the skb event entry, and obtains the NO_SOCKET error handling information based on the search result; Step S7 includes the following steps: Step S71: The user-space program obtains the skb 5-tuple information from the skb event entry; Step S72: The user-space program searches for the corresponding sock event entry in the first storage structure based on the skb 5-tuple information; Step S73: If a sock event entry corresponding to the skb 5-tuple information is found in the first storage structure, the handling information for the NO_SOCKET error is "premature release"; If no sock event entry corresponding to the skb 5-tuple information is found in the first storage structure, the NO_SOCKET error handling information is "port not bound".

2. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, The aging process in step S5 refers to the following: the user-mode program compares the sock event entries from the beginning to the end of the second storage structure; if the difference between the timestamp of the sock event entry and the current system time exceeds the preset time window value, the sock event entry is deleted from the first and second storage structures, and the comparison of the next sock event entry continues; if the difference between the timestamp of the sock event entry and the current system time does not exceed the preset time window value, the aging process stops.

3. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, In step S6, if the process calls the skb release function through the kernel and the second eBPF program determines that the reason for the skb release event is not a NO_SOCKET error, it will exit directly.

4. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, Socket release information refers to the PID, name, call stack, and timestamp of the process that called the socket release function through the kernel.

5. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, skb release information refers to the skb 5-tuple information of a process that calls the skb release function through the kernel.

6. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, Step S7 also includes step S74: The user-mode program prints the handling information for the NO_SOCKET error.

7. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, The socket release function is sock_release(); the skb release function is kfree_skb_reason().

8. The method for monitoring and analyzing network NO_SOCKET errors according to claim 1, characterized in that, The kernel is the Linux kernel.

Images