Method and related device for locating faults by capturing network packets

Abstract

The present invention discloses a method and related device for locating faults by capturing packets on a network. The method can collect and obtain data information of multiple hosts through an Agent client deployed on a container Docker and / or a virtual machine operating system; collect and obtain data information of corresponding multiple intermediate nodes through a network probe deployed on an intermediate node between each of the hosts; analyze each of the data information to generate a network topology map; when any of the hosts has a network connection failure or a data transmission failure, determine the scope of troubleshooting according to the network topology map, and determine the cause of the fault according to the current data information within the scope of the troubleshooting. The present invention can establish a network topology map, first determine the scope of troubleshooting when a fault occurs, then capture the information within the scope of troubleshooting and determine the cause of the fault, without blindly capturing a large amount of information and data packets, and has high efficiency and high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of data transmission, and in particular to a method for locating faults by capturing packets in a network and a related device. Background Art

[0002] With the rise of technologies such as containers and virtualization, the traditional method of deploying probes at the network egress to capture network packets and locate faults has a large blind spot. For example, there is a wide range of captured data packets, which leads to a large amount of data packets that need to be captured, low efficiency and inaccuracy. Summary of the invention

[0003] In view of the above problems, the present invention provides a method and related device for locating faults by capturing network packets, which overcome the above problems or at least partially solve the above problems.

[0004] In a first aspect, a method for locating a fault by capturing a network packet includes:

[0005] By deploying an Agent client on a container Docker and / or a virtual machine operating system, data information of multiple hosts is collected and obtained, wherein each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, wherein the data packet statistics information represents the data packet reception situation and the data packet transmission situation, and the data flow statistics information represents the flow situation of the corresponding data;

[0006] By deploying network probes on intermediate nodes between each of the hosts, data information of the corresponding plurality of intermediate nodes is collected, wherein at least one of the intermediate nodes is involved in the communication link between each of the hosts;

[0007] Analyze each of the data information to generate a network topology diagram, wherein the network topology diagram includes each of the hosts and each of the intermediate nodes;

[0008] When any of the hosts encounters a network connection failure or a data transmission failure, the fault troubleshooting scope is determined based on the network topology diagram, and the cause of the fault is determined based on the current data information within the fault troubleshooting scope.

[0009] In combination with the first aspect, in certain optional implementations, when any of the hosts has a network connection failure or a data transmission failure, determining a troubleshooting scope according to the network topology diagram, and determining the cause of the fault according to the current data information within the troubleshooting scope, includes:

[0010] When any of the hosts has a network connection failure or a data transmission failure, according to the network topology diagram, a target Agent client deployed on other hosts that are in communication with the host is determined, and a target network probe deployed on an intermediate node between the other hosts and the host is determined;

[0011] Sending corresponding packet capture strategies to each of the target Agent clients, each of the target network probes, and the Agent client of the host, respectively, so that each of the target Agent clients, each of the target network probes, and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them;

[0012] The cause of the fault is determined based on the current data information.

[0013] In combination with the previous embodiment, in some optional embodiments, the corresponding packet capture strategies are respectively issued to each of the target Agent clients, each of the target network probes, and the Agent client of the host, so that each of the target Agent clients, each of the target network probes, and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them, including:

[0014] The corresponding packet capture strategies are respectively issued to each of the target Agent clients, each of the target network probes and the Agent client of the host, so that each of the target Agent clients collects the current data information of each of the other hosts that are connected to the host in communication according to the received packet capture strategies, each of the target network probes collects the current data information of each of the intermediate nodes between each of the other hosts and the host according to the received packet capture strategies, and the Agent client of the host collects the current data information of the host according to the received packet capture strategies;

[0015] Determining the cause of the fault according to the current data information includes:

[0016] The cause of the fault is determined according to the current data information of the host, the current data information of each of the other hosts, and the current data information of each of the intermediate nodes.

[0017] In combination with the first aspect, in some optional implementations, analyzing each of the data information to generate a network topology diagram includes:

[0018] Analyze each of the data information to determine the data packet flow information of each data packet, wherein the data packet flow information includes: source host information, destination host information, and intermediate node information of the route;

[0019] Determine, according to the data packet flow information of each data packet, the host-to-host connection relationship between each of the hosts, the node-to-node connection relationship between each of the intermediate nodes, and the host-to-node connection relationship between each of the intermediate nodes and each of the hosts;

[0020] The network topology diagram is generated according to the connection relationship between the hosts, the connection relationship between the nodes, and the connection relationship between the host nodes.

[0021] In combination with the first aspect, in some optional implementations, after analyzing each of the data information, the method further includes:

[0022] The data information uploaded by each Agent client and the data information uploaded by each network probe are respectively set with corresponding labels.

[0023] In a second aspect, a device for locating faults by capturing packets on a network includes: an agent information collection unit, a probe information collection unit, an information analysis unit, and a fault cause determination unit;

[0024] The Agent information collection unit is used to collect data information of multiple hosts through an Agent client deployed in a container Docker and / or a virtual machine operating system, wherein each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, wherein the data packet statistics information represents data packet reception status and data packet transmission status, and the data flow statistics information represents the flow status of corresponding data;

[0025] The probe information collection unit is used to collect data information of the corresponding plurality of intermediate nodes through network probes deployed on intermediate nodes between each of the hosts, wherein at least one of the intermediate nodes is involved in the communication link between each of the hosts;

[0026] The information analysis unit is used to analyze each of the data information to generate a network topology map, wherein the network topology map includes each of the hosts and each of the intermediate nodes;

[0027] The fault cause determination unit is used to determine the fault investigation scope according to the network topology diagram when any of the hosts has a network connection failure or a data transmission failure, and to determine the fault cause according to the current data information within the fault investigation scope.

[0028] In conjunction with the second aspect, in some optional implementations, the fault cause determination unit includes: a target determination subunit, a policy delivery subunit, and a cause determination subunit;

[0029] The target determination subunit is used to determine the target Agent client deployed on other hosts that are in communication with the host according to the network topology diagram, and determine the target network probe deployed on the intermediate node between the other hosts and the host when a network connection failure or a data transmission failure occurs in any of the hosts;

[0030] The strategy issuing subunit is used to issue corresponding packet capture strategies to each of the target Agent clients, each of the target network probes and the Agent client of the host, so that each of the target Agent clients, each of the target network probes and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them;

[0031] The cause determination subunit is used to determine the cause of the fault according to the current data information.

[0032] In combination with the previous embodiment, in some optional embodiments, the policy issuing subunit includes: a policy subunit;

[0033] The strategy subunit is used to issue the corresponding packet capture strategy to each target Agent client, each target network probe and the Agent client of the host, so that each target Agent client collects the current data information of each other host connected to the host according to the received packet capture strategy, each target network probe collects the current data information of each intermediate node between each other host and the host according to the received packet capture strategy, and the Agent client of the host collects the current data information of the host according to the received packet capture strategy;

[0034] The cause determination subunit includes: a cause subunit;

[0035] The cause subunit is used to determine the cause of the fault based on the current data information of the host, the current data information of each of the other hosts, and the current data information of each of the intermediate nodes.

[0036] In a third aspect, a computer-readable storage medium stores a program, and when the program is executed by a processor, the method for locating faults by capturing network packets is implemented as described in any one of the above.

[0037] In a fourth aspect, an electronic device comprises at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned methods for network packet capture and fault location.

[0038] By means of the above technical scheme, the method and related device for locating faults by capturing network packets provided by the present invention can collect and obtain data information of multiple hosts through an Agent client deployed on a container Docker and / or a virtual machine operating system, wherein each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, wherein the data packet statistics information represents the data packet reception situation and the data packet transmission situation, and the data flow statistics information represents the flow situation of the corresponding data; through a network probe deployed on an intermediate node between each of the hosts, data information of the corresponding multiple intermediate nodes is collected and obtained, wherein at least one intermediate node is involved in the communication link between each of the hosts; each of the data information is analyzed to generate a network topology map, wherein the network topology map includes each of the hosts and each of the intermediate nodes; when any of the hosts has a network connection failure or a data transmission failure, the fault investigation scope is determined according to the network topology map, and the cause of the fault is determined according to the current data information within the fault investigation scope. From this, it can be seen that the present invention can establish a network topology diagram, first determine the troubleshooting scope when a fault occurs, then capture the information within the troubleshooting scope and determine the cause of the fault, without blindly capturing a large amount of information and data packets, with high efficiency and accuracy.

[0039] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0041] Figure 1 A flow chart of a method for locating faults by capturing packets on a network provided by the present invention is shown;

[0042] Figure 2A schematic diagram showing the structure of a device for capturing network packets and locating faults provided by the present invention is shown;

[0043] Figure 3 A structural schematic diagram of an electronic device provided by the present invention is shown. DETAILED DESCRIPTION

[0044] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0045] like Figure 1 The present invention provides a method for locating faults by capturing packets on a network, comprising: S100, S200, S300 and S400;

[0046] S100, collecting and obtaining data information of multiple hosts through an Agent client deployed in a container Docker and / or a virtual machine operating system;

[0047] Each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, the data packet statistics information represents the data packet reception situation and data packet transmission situation, and the data flow statistics information represents the flow situation of the corresponding data;

[0048] Optionally, the container Docker, the virtual machine operating system and the Agent client are well-known concepts in the art, and the present invention will not describe them in detail. For details, please refer to the relevant description in the art.

[0049] Optionally, the present invention can collect and obtain data information of each host by deploying an Agent client in a container Docker and / or a virtual machine operating system.

[0050] Optionally, after analyzing the data information, the Agent client may collect data at time intervals of 1 minute, 5 minutes, 30 minutes, and 1 hour, including but not limited to the number of data packets received per minute, the number of data packets sent per minute, and the flow per minute, as well as the number and flow of data packets counted by the TCP (Transmission Control Protocol) protocol or the UDP (User Datagram Protocol) protocol.

[0051] Optionally, the number of data packets received mentioned in the present invention may include: the number of data packets received for establishing a connection syn, the number of data packets received for closing a connection fin, and the number of data packets received for resetting reset; similarly, the number of data packets sent may include: the number of data packets sent for establishing a connection syn, the number of data packets sent for closing a connection fin, and the number of data packets sent for resetting reset; in addition, the present invention can also count the statistical information of the external IP, including the active link establishment addresses and the passive link establishment addresses, to facilitate the subsequent construction of a network topology diagram.

[0052] Optionally, the present invention can also sample and analyze the network information at a certain ratio after analyzing the data information. The sampling analysis mainly analyzes the single connection protocol situation, such as the return packet data volume, status code and request return packet time of http get. At the same time, the Agent client of the present invention also has a network packet filtering function. When the Agent client performs delayed network packet analysis, the bdf method of the Linux kernel is used to filter the flow packets flowing through the network port to avoid storing a large amount of information. In the implementation of the Agent client, this solution integrates the classic winpcap library to realize the corresponding packet capture statistics and analysis functions. Since the packet is captured on the corresponding virtual machine operating system, the Agent client does not put the network card in the promiscuous mode, but only adds additional processing steps in the Linux kernel, and can set four modes such as statistics only, proportional sampling, full sampling and packet filtering. In terms of data storage, the captured data packets are sent to the execution subject of the present invention through a queue after caching the information for a certain period of time, so that the network traffic can be effectively smoothed. In terms of system configuration, if the network is in a dual-plane network with production data and management control, the Agent client generally uses the management control plane network to send data, so that in the statistics-only mode, there is almost no performance impact on the host being collected.

[0053] Optionally, the above-mentioned http get, linux kernel, bdf method and winpcap library are all well-known concepts in the art, and the present invention will not make any detailed descriptions on them. For details, please refer to the relevant descriptions in the art.

[0054] S200, collecting and obtaining data information of corresponding multiple intermediate nodes through network probes deployed on intermediate nodes between each of the hosts;

[0055] Wherein, the communication link between each of the hosts involves at least one of the intermediate nodes;

[0056] Optionally, two hosts that are connected to each other need to pass through a communication layer and the communication layer may involve multiple intermediate nodes. This is equivalent to the communication between the two hosts being subdivided into multiple segments based on the intermediate nodes. When a host finds that there is a network connection failure or a data transmission failure, it is not necessarily caused by the failure of the host. It may be caused by a failure of the host that sends the data packet, or it may be caused by a failure of an intermediate node in the middle. Therefore, in order to minimize the scope of subsequent troubleshooting and improve the efficiency and accuracy of fault location, the present invention can also collect data information of the intermediate nodes for subsequent generation of a network topology diagram, and the present invention does not limit this.

[0057] Optionally, the network probe generally stores the data packets of the path points locally through the optical splitter. However, due to the large amount of data collected and the deployment at the network boundary, the information is large. Therefore, before receiving the control command, the network probe is used to collect and upload statistical data, including the number of data packets and flow information per minute at the border.

[0058] Optionally, the executor of the present invention can start the point-to-point packet capture and analysis function of the network probe by calling the API interface of the network probe when needed, and send the packet capture information (data information) to the data collection platform through the interface.

[0059] S300, analyzing each of the data information to generate a network topology map;

[0060] Wherein, the network topology diagram includes each of the hosts and each of the intermediate nodes;

[0061] Optionally, the network topology diagram can record the connection relationship between each host, the connection relationship between each host and the intermediate node, and the connection relationship between each intermediate node. When it is found that a host has timed out when receiving data or the network connection between the host and other hosts fails, the execution subject of the present invention can directly query the topology diagram to determine the other hosts that were originally connected to the host for communication, and which intermediate nodes have passed through, thereby determining the scope of troubleshooting, and the present invention does not limit this.

[0062] Optionally, the present invention does not limit the process of analyzing the data information to generate the network topology diagram, and any feasible solution belongs to the protection scope of the present invention. Figure 1 In the embodiment shown, in some optional embodiments, the S300 includes: step 1.1, step 1.2 and step 1.3;

[0063] Step 1.1, analyzing each of the data information to determine the data packet flow information of each data packet, wherein the data packet flow information includes: source host information, destination host information, and intermediate node information of the route;

[0064] Optionally, as mentioned above, the present invention records the connection relationship between each host and the intermediate nodes between the hosts through a network topology diagram. Therefore, the present invention analyzes the data information, and can analyze which host each data packet comes from (host source information), which host it flows to (flow to host information), and which intermediate nodes it passes through between two nodes (intermediate node information). The information obtained by the above analysis can further determine the connection relationship between each host, the connection relationship between each host and the intermediate node, and the connection relationship between each intermediate node, and the present invention does not limit this.

[0065] Optionally, during the analysis process, the IP address of the Agent client or the address of the network probe involved in each piece of data information may be analyzed, and the present invention does not limit this.

[0066] Optionally, in order to facilitate analysis and display, the present invention can identify which network probe or Agent client collected and uploaded each piece of data information. Figure 1 In the embodiment shown, in some optional embodiments, after analyzing each of the data information in S300, the method further includes:

[0067] The data information uploaded by each Agent client and the data information uploaded by each network probe are respectively set with corresponding labels.

[0068] Optionally, the set label may be a unique identifier of a corresponding Agent client or a unique identifier of a corresponding network probe, which is not limited in the present invention.

[0069] Step 1.2, determining the host-to-host connection relationship between the hosts, the node-to-node connection relationship between the intermediate nodes, and the host-to-node connection relationship between the intermediate nodes and the hosts according to the data packet flow information of each data packet;

[0070] Step 1.3: Generate the network topology diagram according to the connection relationship between each host, the connection relationship between each node, and the connection relationship between each host node.

[0071] S400: When a network connection failure or a data transmission failure occurs in any of the hosts, a troubleshooting scope is determined according to the network topology diagram, and the cause of the failure is determined according to the current data information within the troubleshooting scope.

[0072] Optionally, as mentioned above, the execution subject of the present invention can directly query the topology map to determine which hosts the host with the fault was originally connected to, and which intermediate nodes it passed through, and use these communication-connected hosts and the intermediate nodes passed through as the fault troubleshooting scope. Subsequently, the current data information of each host and intermediate node within the fault troubleshooting scope can be obtained to determine the cause of the fault and locate the fault point, and the present invention does not limit this.

[0073] Optionally, the present invention can be provided with a corresponding data display platform for displaying the progress of the results obtained by the collection and analysis. In the usual statistical stage, the data display platform can search the corresponding network topology diagram and the corresponding network probe information based on the IP, and briefly display the link building time of the relevant links, and the request packet response time of some basic protocols (http, common database query). In the case of packet capture analysis or sampling analysis, the data packet statistics of two IP pairs and the data packet statistics of a single reply are displayed according to a certain rule, and a further detailed analysis interface is provided. For the same session, the data collected by the network probe and the Agent client can be combined for comparison, and the time difference of the same data packet on the network probe and the Agent client of both hosts is compared. For the current virtual machine operating system or container environment, because the network connection between the host and the host has not only passed many traditional network devices, but also passed through a pair of virtual gateway devices, etc. In network analysis, the packet capture comparison task can be completed quickly on the two host ends and the network probe point as soon as possible, which is greatly improved in time for determining the cause of the fault and locating the fault point.

[0074] Optionally, the present invention does not limit the process of determining the troubleshooting scope according to the network topology diagram and determining the cause of the fault according to the current data information within the troubleshooting scope. Figure 1 In the embodiment shown, in some optional embodiments, the S400 includes: step 2.1, step 2.2 and step 2.3;

[0075] Step 2.1, when any of the hosts has a network connection failure or a data transmission failure, determine the target Agent client deployed on other hosts that are connected to the host for communication, and determine the target network probe deployed on the intermediate node between the other hosts and the host according to the network topology diagram;

[0076] Step 2.2, issuing corresponding packet capture strategies to each of the target Agent clients, each of the target network probes, and the Agent client of the host, so that each of the target Agent clients, each of the target network probes, and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them;

[0077] Optionally, the present invention can send different packet capture strategies to the network probe and the Agent client according to actual needs, and the specific strategy can be set according to actual needs. For example, it can be set how long to capture data packets, which indicators to count, whether to filter some data packets, etc., and the present invention does not limit this.

[0078] Step 2.3: Determine the cause of the fault based on the current data information.

[0079] In combination with the previous embodiment, in some optional embodiments, the step 2.2 includes:

[0080] The corresponding packet capture strategies are respectively issued to each of the target Agent clients, each of the target network probes and the Agent client of the host, so that each of the target Agent clients collects the current data information of each of the other hosts that are connected to the host in communication according to the received packet capture strategies, each of the target network probes collects the current data information of each of the intermediate nodes between each of the other hosts and the host according to the received packet capture strategies, and the Agent client of the host collects the current data information of the host according to the received packet capture strategies;

[0081] The step 2.3 includes: determining the cause of the fault based on the current data information of the host, the current data information of each of the other hosts, and the current data information of each of the intermediate nodes.

[0082] like Figure 2 As shown, the present invention provides a device for locating faults by capturing packets on a network, comprising: an agent information collection unit 100, a probe information collection unit 200, an information analysis unit 300 and a fault cause determination unit 400;

[0083] The Agent information collection unit 100 is used to collect data information of multiple hosts through an Agent client deployed in a container Docker and / or a virtual machine operating system, wherein each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, wherein the data packet statistics information represents data packet reception status and data packet transmission status, and the data flow statistics information represents the flow status of corresponding data;

[0084] The probe information collection unit 200 is used to collect data information of the corresponding plurality of intermediate nodes through network probes deployed on intermediate nodes between each of the hosts, wherein at least one of the intermediate nodes is involved in the communication link between each of the hosts;

[0085] The information analysis unit 300 is used to analyze each of the data information to generate a network topology map, wherein the network topology map includes each of the hosts and each of the intermediate nodes;

[0086] The fault cause determination unit 400 is used to determine the fault troubleshooting scope according to the network topology diagram when any of the hosts has a network connection failure or a data transmission failure, and to determine the fault cause according to the current data information within the fault troubleshooting scope.

[0087] Combination Figure 2 In the illustrated implementation, in some optional implementations, the fault cause determination unit 400 includes: a target determination subunit, a policy delivery subunit, and a cause determination subunit;

[0088] The target determination subunit is used to determine the target Agent client deployed on other hosts that are in communication with the host according to the network topology diagram, and determine the target network probe deployed on the intermediate node between the other hosts and the host when a network connection failure or a data transmission failure occurs in any of the hosts;

[0089] The strategy issuing subunit is used to issue corresponding packet capture strategies to each of the target Agent clients, each of the target network probes and the Agent client of the host, so that each of the target Agent clients, each of the target network probes and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them;

[0090] The cause determination subunit is used to determine the cause of the fault according to the current data information.

[0091] In combination with the previous embodiment, in some optional embodiments, the policy issuing subunit includes: a policy subunit;

[0092] The strategy subunit is used to issue the corresponding packet capture strategy to each target Agent client, each target network probe and the Agent client of the host, so that each target Agent client collects the current data information of each other host connected to the host according to the received packet capture strategy, each target network probe collects the current data information of each intermediate node between each other host and the host according to the received packet capture strategy, and the Agent client of the host collects the current data information of the host according to the received packet capture strategy;

[0093] The cause determination subunit includes: a cause subunit;

[0094] The cause subunit is used to determine the cause of the fault based on the current data information of the host, the current data information of each of the other hosts, and the current data information of each of the intermediate nodes.

[0095] Combination Figure 2 In the illustrated embodiment, in some optional embodiments, the information analysis unit 300 includes: an information analysis subunit, a connection relationship subunit and a topology map subunit;

[0096] An information analysis subunit is used to analyze each of the data information to determine the data packet flow information of each data packet, wherein the data packet flow information includes: source host information, destination host information, and intermediate node information of the route;

[0097] a connection relationship subunit, configured to determine, based on the data packet flow information of each data packet, the inter-host connection relationship between each of the hosts, the inter-node connection relationship between each of the intermediate nodes, and the inter-host node connection relationship between each of the intermediate nodes and each of the hosts;

[0098] The topology subunit is used to generate the network topology according to the connection relationship between the hosts, the connection relationship between the nodes and the connection relationship between the host nodes.

[0099] Combination Figure 2 In the illustrated embodiment, in certain optional embodiments, the device further comprises: a label setting unit;

[0100] The label setting unit is used to set corresponding labels for the data information uploaded by each Agent client and the data information uploaded by each network probe after analyzing each data information.

[0101] The present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, any of the above-mentioned methods for locating faults by capturing network packets is implemented.

[0102] like Figure 3 As shown, the present invention provides an electronic device 70, which includes at least one processor 701, and at least one memory 702 and a bus 703 connected to the processor 701; wherein the processor 701 and the memory 702 communicate with each other through the bus 703; the processor 701 is used to call the program instructions in the memory 702 to execute any of the above-mentioned methods for network packet capture and fault location.

[0103] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0104] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0105] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A method for locating faults by capturing packets on a network, characterized in that: include: By deploying an Agent client on a container Docker and / or a virtual machine operating system, data information of multiple hosts is collected and obtained, wherein each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, wherein the data packet statistics information represents the data packet reception situation and the data packet transmission situation, and the data flow statistics information represents the flow situation of the corresponding data; By deploying network probes on intermediate nodes between each of the hosts, data information of the corresponding plurality of intermediate nodes is collected, wherein at least one of the intermediate nodes is involved in the communication link between each of the hosts; Analyze each of the data information to generate a network topology diagram, wherein the network topology diagram includes each of the hosts and each of the intermediate nodes; When any of the hosts has a network connection failure or a data transmission failure, the fault troubleshooting scope is determined according to the network topology diagram, and the cause of the fault is determined according to the current data information within the fault troubleshooting scope; Wherein, when any of the hosts has a network connection failure or a data transmission failure, determining the fault troubleshooting scope according to the network topology diagram, and determining the fault cause according to the current data information within the fault troubleshooting scope, includes: When any of the hosts has a network connection failure or a data transmission failure, according to the network topology diagram, a target Agent client deployed on other hosts that are in communication with the host is determined, and a target network probe deployed on an intermediate node between the other hosts and the host is determined; Sending corresponding packet capture strategies to each of the target Agent clients, each of the target network probes, and the Agent client of the host, respectively, so that each of the target Agent clients, each of the target network probes, and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them; The cause of the fault is determined based on the current data information.

2. The method according to claim 1, characterized in that The step of issuing corresponding packet capture strategies to each of the target Agent clients, each of the target network probes, and the Agent client of the host, so that each of the target Agent clients, each of the target network probes, and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them, including: The corresponding packet capture strategies are respectively issued to each of the target Agent clients, each of the target network probes and the Agent client of the host, so that each of the target Agent clients collects the current data information of each of the other hosts that are connected to the host in communication according to the received packet capture strategies, each of the target network probes collects the current data information of each of the intermediate nodes between each of the other hosts and the host according to the received packet capture strategies, and the Agent client of the host collects the current data information of the host according to the received packet capture strategies; Determining the cause of the fault according to the current data information includes: The cause of the fault is determined according to the current data information of the host, the current data information of each of the other hosts, and the current data information of each of the intermediate nodes.

3. The method according to claim 1, characterized in that The step of analyzing each of the data information to generate a network topology diagram includes: Analyze each of the data information to determine the data packet flow information of each data packet, wherein the data packet flow information includes: source host information, destination host information, and intermediate node information of the route; Determine, according to the data packet flow information of each data packet, the host-to-host connection relationship between each of the hosts, the node-to-node connection relationship between each of the intermediate nodes, and the host-to-node connection relationship between each of the intermediate nodes and each of the hosts; The network topology diagram is generated according to the connection relationship between the hosts, the connection relationship between the nodes, and the connection relationship between the host nodes.

4. The method according to claim 1, characterized in that After analyzing each of the data information, the method further includes: The data information uploaded by each Agent client and the data information uploaded by each network probe are respectively set with corresponding labels.

5. A device for locating faults by capturing packets on a network, characterized in that: include: Agent information collection unit, probe information collection unit, information analysis unit and fault cause determination unit; The Agent information collection unit is used to collect data information of multiple hosts through an Agent client deployed in a container Docker and / or a virtual machine operating system, wherein each of the hosts is configured with the container Docker and / or the virtual machine operating system, and the data information includes data packet statistics information and data flow statistics information, wherein the data packet statistics information represents data packet reception status and data packet transmission status, and the data flow statistics information represents the flow status of corresponding data; The probe information collection unit is used to collect data information of the corresponding plurality of intermediate nodes through network probes deployed on intermediate nodes between each of the hosts, wherein at least one of the intermediate nodes is involved in the communication link between each of the hosts; The information analysis unit is used to analyze each of the data information to generate a network topology map, wherein the network topology map includes each of the hosts and each of the intermediate nodes; The fault cause determination unit is used to determine the fault troubleshooting scope according to the network topology diagram when any of the hosts has a network connection fault or a data transmission fault, and determine the fault cause according to the current data information within the fault troubleshooting scope; Wherein, the fault cause determination unit includes: a target determination subunit, a strategy delivery subunit and a cause determination subunit; The target determination subunit is used to determine the target Agent client deployed on other hosts that are in communication with the host according to the network topology diagram, and determine the target network probe deployed on the intermediate node between the other hosts and the host when a network connection failure or a data transmission failure occurs in any of the hosts; The strategy issuing subunit is used to issue corresponding packet capture strategies to each of the target Agent clients, each of the target network probes and the Agent client of the host, so that each of the target Agent clients, each of the target network probes and the Agent client of the host collects the current data information according to the packet capture strategies received by each of them; The cause determination subunit is used to determine the cause of the fault according to the current data information.

6. The device according to claim 5, characterized in that The policy issuing subunit includes: a policy subunit; The strategy subunit is used to issue the corresponding packet capture strategy to each target Agent client, each target network probe and the Agent client of the host, so that each target Agent client collects the current data information of each other host connected to the host according to the received packet capture strategy, each target network probe collects the current data information of each intermediate node between each other host and the host according to the received packet capture strategy, and the Agent client of the host collects the current data information of the host according to the received packet capture strategy; The cause determination subunit includes: a cause subunit; The cause subunit is used to determine the cause of the fault based on the current data information of the host, the current data information of each of the other hosts, and the current data information of each of the intermediate nodes.

7. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the method for locating faults by capturing network packets according to any one of claims 1 to 4 is implemented.

8. An electronic device, characterized in that: The electronic device includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the network packet capture fault location method as described in any one of claims 1 to 4.

Images