Network path blocking point positioning method, device and storage medium

Abstract

The present invention provides a network path blocking point positioning method, device and storage medium, which constructs a test data packet that meets the path release rules configured by the link protection device through a network protocol, configures the source address and source port of the test data packet as the address and port of the source node, and configures the destination address and destination port of the test data packet as the destination address and destination port of the destination node, automatically sends the test data packet to the destination node, captures the return data packet of the test data packet, and determines whether the destination node is a blocking point based on the capture result to obtain a blocking point positioning result. Utilizing the technical solution of the present invention, it is possible to automatically locate the possible blocking points in the network path through the test data packet, solving the problem of low efficiency and accuracy in manually locating the blocking points. Especially when the source node has released the compliant traffic, the technical solution of the present invention can accurately and efficiently locate the possible blocking points in the network path.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and storage medium for locating a network path blocking point. Background Art

[0002] In order to meet the physical and logical isolation of each security domain and subdomain, various link protection devices such as firewalls, security blocking devices, DPI devices, etc. are deployed without exception at each security boundary within the network organizational structure, thus forming a multi-level defense security layout on the network path. Each security boundary blocks all traffic by default, and the types of security blocking devices and blocking technologies vary. However, for compliant traffic, the security team of each security boundary can release it as needed.

[0003] However, in practice, it is found that even if compliant traffic has been released, network paths may still be blocked.

[0004] Therefore, how to locate blocking points in network paths more accurately and efficiently has become a topic of general consideration in the industry. Summary of the invention

[0005] The present invention provides a network path blocking point positioning method, device and storage medium, which are used to solve the defect of low efficiency of the network path blocking point positioning method in the prior art and realize more efficient and accurate positioning of the network path blocking point.

[0006] In a first aspect, the present invention provides a network path blocking point positioning method, which is applied to a network node configured as a source node in the network path, the network path also includes a network node configured as a destination node, and a link protection device is deployed in the network node. The network path blocking point positioning method includes:

[0007] Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0008] Sending the test data packet to the destination node;

[0009] Capturing the return data packet of the test data packet;

[0010] It is determined whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result.

[0011] In one embodiment, constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol includes:

[0012] When a release instruction for the specified flow is detected, a test data packet is constructed using the specified flow;

[0013] The network path blocking point positioning method also includes:

[0014] If the blocking point positioning result shows that the destination node is not a blocking point, the designated traffic is released;

[0015] If the blocking point positioning result shows that the destination node is a blocking point, the designated traffic is prohibited.

[0016] In one embodiment, before constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, the method further includes:

[0017] Receiving a network path inspection task from the server, wherein the network path inspection task includes an address and a port of at least one of the destination nodes;

[0018] Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, including:

[0019] The address and port of the source node are configured as the source address and source port of the test data packet, and the address and port of the destination node are used to configure the destination address and destination port of the test data packet;

[0020] The network path blocking point positioning method also includes:

[0021] The blocking point positioning result is sent to the server.

[0022] In one embodiment, before sending the test data packet to the destination node, the method further includes:

[0023] Creating a network packet capture filter, wherein the network packet capture filter is configured to capture the return data packet of the test data packet;

[0024] Capturing the return data packet of the test data packet, including:

[0025] The network packet capture filter is used to capture the return data packet of the test data packet.

[0026] In one embodiment, the network path blocking point positioning method further includes:

[0027] When constructing the test data packet, configuring a characteristic tag for the test data packet;

[0028] Capturing the return data packet of the test data packet, including:

[0029] The return data packet of the test data packet is identified according to the characteristic tag.

[0030] In one embodiment, judging whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result includes:

[0031] According to the preset correspondence between the network protocol and the blocking judgment rule, obtaining the blocking judgment rule corresponding to the network protocol;

[0032] It is determined whether the capture result satisfies the acquired blocking judgment rule to obtain the blocking point positioning result.

[0033] In one embodiment, judging whether the capture result satisfies the acquired blocking judgment rule to obtain the blocking point positioning result includes:

[0034] If the network protocol is TCP, and the captured return data packet is a REST response, determining the destination node as a blocking point according to the blocking point positioning result;

[0035] If the network protocol is ICMP, and the captured return data packet shows that the port is unreachable, the destination node is determined to be the blocking point according to the blocking point positioning result.

[0036] In a second aspect, the present invention provides a method for locating a blocking point on a network path, wherein the network path includes a network node configured as a source node and a network node configured as a destination node, and a link protection device is deployed in the network node. The method for locating a blocking point on the network path is applied to a server side, and includes:

[0037] Sending a network path inspection task to at least one of the source nodes, so that the source node constructs the source address and source port of the test data packet and the destination address and destination port of the destination node according to the network path inspection task, sends the test data packet to the destination node, captures the return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0038] Receiving the blocking point positioning result from at least one of the source nodes;

[0039] The blocking point information of the network path is determined according to the blocking point positioning result.

[0040] In one embodiment, before sending the network path inspection task to at least one of the source nodes, the method further includes:

[0041] Acquire end-to-end traffic information that satisfies the path release rule;

[0042] Acquire the network path corresponding to the end-to-end traffic information in a database;

[0043] Configuring each network node in the network path to obtain at least one group of the source node and the destination node;

[0044] At least one network path inspection task is generated correspondingly according to at least one group of source nodes and destination nodes.

[0045] In a third aspect, the present invention provides a network path inspection system, wherein the network path includes a network node configured as a source node and a network node configured as a destination node, and a link protection device is deployed in the network node. The network path inspection system includes:

[0046] The server sends a network path inspection task to at least one of the source nodes, receives a blocking point positioning result from at least one of the source nodes, and determines the blocking point information of the network path according to the blocking point positioning result;

[0047] At least one of the source nodes constructs the source address, source port and destination address and destination port of the corresponding destination node of the test data packet according to the network path inspection task, sends the test data packet to the destination node, captures the return data packet of the test data packet, and determines whether the destination node is a blocking point based on the capture result to obtain the blocking point positioning result, and the test data packet satisfies the path release rules configured by the link protection device.

[0048] In one embodiment, it also includes:

[0049] The backend management system sends the network path inspection task to the server end, and receives the blocking point information of the network path from the server end.

[0050] In a fourth aspect, the present invention provides a network path blocking point positioning device, which is applied to a network node configured as a source node in the network path, the network path also includes a network node configured as a destination node, and a link protection device is deployed in the network node, and the network path blocking point positioning device includes:

[0051] A construction module, constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0052] A sending module, sending the test data packet to the destination node;

[0053] A capture module, which captures the return data packet of the test data packet;

[0054] The judgment module judges whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result.

[0055] In a fifth aspect, the present invention provides a network path blocking point positioning device, wherein the network path includes a network node configured as a source node and a network node configured as a destination node, link protection devices are deployed in the network nodes, and the network path blocking point positioning device is applied to a server side, comprising:

[0056] A sending module, sending a network path inspection task to at least one of the source nodes, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0057] A receiving module, receiving the blocking point positioning result from at least one of the source nodes;

[0058] A determination module determines the blocking point information of the network path according to the blocking point positioning result.

[0059] In a sixth aspect, the present invention provides a terminal, applied to a network node configured as a source node in a network path, the network path also includes a network node configured as a destination node, and a link protection device is deployed in the network node;

[0060] The terminal includes a memory, a transceiver, and a processor;

[0061] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0062] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0063] Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0064] Sending the test data packet to the destination node;

[0065] Capturing the return data packet of the test data packet;

[0066] It is determined whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result.

[0067] In a seventh aspect, the present invention provides a network device, including a memory, a transceiver, and a processor;

[0068] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0069] When a network path includes a network node configured as a source node and a network node configured as a destination node, and a link protection device is deployed in the network nodes, a network path inspection task is sent to at least one of the source nodes, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0070] Receiving the blocking point positioning result from at least one of the source nodes;

[0071] The blocking point information of the network path is determined according to the blocking point positioning result.

[0072] In an eighth aspect, the present invention provides an electronic device comprising a memory and a memory storing a computer program, wherein the processor implements the steps of the network path blocking point locating method described in the first aspect or the second aspect when executing the program.

[0073] In a ninth aspect, the present invention provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, wherein the computer program is used to enable the processor to execute the steps of the network path blocking point locating method described in the first aspect or the second aspect.

[0074] The network path blocking point positioning method, device and storage medium provided by the present invention construct a test data packet that meets the path release rules configured by the link protection device through a network protocol, the source address and source port of the test data packet are configured as the address and port of the source node, the destination address and destination port of the test data packet are configured as the destination address and destination port of the destination node, the test data packet is automatically sent to the destination node, the return data packet of the test data packet is captured, and whether the destination node is a blocking point is determined based on the capture result to obtain a blocking point positioning result. Utilizing the technical solution of the present invention, it is possible to automatically locate the possible blocking points in the network path through the test data packet, solving the problem of low efficiency and accuracy in manually locating the blocking points. Especially when the source node has released the compliant traffic, the technical solution of the present invention can accurately and efficiently locate the possible blocking points in the network path. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0076] Figure 1 This is one of the structural schematic diagrams of the network path inspection system provided by the present invention;

[0077] Figure 2 This is one of the flow charts of the method for locating a network path blocking point provided by the present invention;

[0078] Figure 3 This is one of the flow charts of the network path inspection method provided by the present invention;

[0079] Figure 4 This is the second structural diagram of the network path inspection system provided by the present invention;

[0080] Figure 5 This is the second flow chart of the method for locating a network path blocking point provided by the present invention;

[0081] Figure 6 This is a third flow chart of a method for locating a network path blocking point provided by the present invention;

[0082] Figure 7 This is a fourth flow chart of a method for locating a network path blocking point provided by the present invention;

[0083] Figure 8 This is a fifth flow chart of a method for locating a network path blocking point provided by the present invention;

[0084] Fig. 9 This is one of the schematic diagrams of the results of the network path blocking point positioning device provided by the present invention;

[0085] Fig.10 This is the second result schematic diagram of the network path blocking point positioning device provided by the present invention;

[0086] Fig.11 is a schematic diagram of the structure of a terminal according to an embodiment of the present application;

[0087] Fig.12 A schematic diagram of the structure of a network device according to an embodiment of the present application;

[0088] Fig.13 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0089] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0090] The inventor of the present invention analyzed the prior art and found that in order to solve the problem of network blockage and path blockage when the security team has released the compliant traffic, the business team uses manual means to initiate a connectivity test from the source end to the other end when receiving the traffic release from the security team, triggering the traffic of the corresponding network protocol, and determining whether the network is reachable as expected based on the test results. If the network is unreachable, it is necessary to gradually verify with each security team based on the direction of the business traffic on the network path, exclude the security boundaries that have passed normally, and gradually locate from the network path until each team cooperates online and manually finds the blocking point.

[0091] In practice, it is found that it is very difficult for business teams to identify and understand network security boundaries because it is not their job. However, in an organization with a very large network scale, it is very necessary for each security team to collaborate. In addition, all end-to-end compliant traffic is a business requirement, and whether the traffic has been released as required also needs to be verified by the business team. When the network is "blocked" (not necessarily a network problem), the security team lacks the means to judge when there is no real-time traffic trigger, which means that this means that "roundtable meetings" are needed continuously, requiring each team to be online, analyze section by section, and find the blocking point.

[0092] Therefore, the above solutions in the prior art are not only inefficient in locating network path blocking points, but also the manual connectivity test may face feasibility issues.

[0093] The inventor of the present invention has come up with the idea of ​​deploying a probe host associated with a link protection device at each network node to automatically locate the network path blocking point. The specific technical principle is as follows:

[0094] 1. Configure a probe host at each network node, build a test data packet on the probe host according to the network protocol, set the source address and source port of the test data packet to the address and port of the current network node in the network path to be tested, and set its destination address and destination port to the address and port accessed by the node in the network path to be tested.

[0095] 2. According to the pre-configuration, the probe host sends a test data packet.

[0096] 3. Use the network card to capture the return data packets that may be received after sending the above two data packets.

[0097] 4. Write the above test data packet to the network card to identify the return data packet capture result corresponding to the test data packet, and determine the connectivity status of the network path to be tested according to the capture result.

[0098] Depending on the network protocol, if the test data packet is constructed according to the TCP protocol, then

[0099] If the captured TCP data packet has the SYN / ACK flag, it means that the network is connected and the service is normal.

[0100] If a TCP data packet with the flag bit of REST type is captured, it means that "the network is connected, the service of the destination node is closed or the link protection device is blocked", that is, the destination node is located as a blocking point;

[0101] If the return data packet is not captured within the set time period, it means that the network is not accessible.

[0102] If the test data packet is a UDP data packet, then

[0103] When a returned UDP data packet is received, it is determined that "the network is connected and the service is normally started", otherwise it is determined that "the network is connected, the service of the destination node is closed or the link protection device is blocked", that is, the destination node is located as a blocking point.

[0104] If the test data packet is an ICMP data packet, if the return status is port unreachable, it is determined that "network is connected, the destination node service is closed or the link protection device is blocked", and the destination node is located as a blocking point. If the return status is route unreachable, it is determined that "no route" is used.

[0105] The technical solution of the present invention is applicable to the TCP / IP network protocol stack, in a multi-level security defense network, to intelligently and quickly locate the network path blocking point, and the method may include the following steps:

[0106] S1: Parse end-to-end compliant traffic through a detailed splitting algorithm and translate it into semantics that can be understood by the traffic generator and decoder, including:

[0107] 1) Read the network activation application work order, parse the network activation application work order to obtain end-to-end traffic information, such as: source access system, source node access point, destination mapping type, destination access point, destination access system, etc.;

[0108] 2) The detailed splitting algorithm is used to split multiple combinations of traffic in the end-to-end traffic information into the smallest unit of traffic groups, and at the same time translates them into semantic fields that can be understood by the traffic generator and decoder and stores them in the database.

[0109] S2: Generate a network path for the split traffic group using an analysis and positioning algorithm, and enumerate the network nodes on the network path based on the network path, including:

[0110] Pre-establish basic information such as network access points, business systems, IP resource libraries, and traffic probe nodes in the database. By searching and matching the above end-to-end compliance, determine the complete network path of the end-to-end traffic, and enumerate all network nodes on the network path based on the network path.

[0111] S3: Send detailed end-to-end traffic requirements directly to all enumerated network nodes to generate real traffic, including:

[0112] 1) Send the end-to-end traffic information to the traffic generator host of the corresponding network node, and generate the dial-up test traffic on demand through the traffic generation program on the traffic generator host;

[0113] 2) Add different feature values ​​to the dial-test traffic for auxiliary traffic capture and analysis;

[0114] S4: According to the pre-set network blocking scenario, all expected return value results are set for analysis and echo, and finally the blocking point is intelligently determined.

[0115] To this end, the present invention provides a network path inspection system, referring to Figure 1 As shown, it specifically includes a server 110 and at least one network node, which can be regarded as a client 121, 122...12n corresponding to the server 110, and is not specifically limited here. The server 110 is connected to each client.

[0116] Specifically, refer to Figure 2As shown in the timing diagram, the network path inspection system of the present invention is used, the network path includes a network node configured as a source node and a network node configured as a destination node, and link protection devices are deployed in the network nodes. The network path blocking point positioning method provided by the present invention includes the following steps:

[0117] Step 210: The server 110 sends a network path inspection task to a client 12n corresponding to at least one source node;

[0118] Step 220: The client 12n constructs the source address and source port of the test data packet and the destination address and destination port of the destination node according to the network path inspection task, sends the test data packet to the destination node, captures the return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain the blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0119] Step 230: The server 110 receives the blocking point location result from the client 12n corresponding to at least one source node;

[0120] Step 240: The server 110 determines the blocking point information of the network path according to the blocking point positioning results received from each client 12n.

[0121] Specifically, the server 110 deploys a special processing program to execute the above network path inspection task, and the client 12n deploys a special processing program to execute the above network path inspection task.

[0122] refer to Figure 3 As shown, a specific embodiment of the client corresponding to the source node performing the network path inspection task includes the following steps:

[0123] Step 310: Check task parameters: verify inspection input parameters, confirm that all parameters are legal, and perform necessary processing on special parameter values;

[0124] Step 320: construct an ICMP data packet: construct an ICMP request data packet, and forge its source address and destination address to the corresponding values ​​in the network path inspection task;

[0125] Step 330: Construct TCP / UDP data packet: construct a TCP or UDP data packet according to the protocol type in the network path inspection task, and set the source port and destination port to the corresponding values ​​in the network path inspection task;

[0126] Step 340: Create a network packet capture filter, and set the filter to capture the return packet of the above test data packet to be sent;

[0127] Step 350: Turn on packet capture;

[0128] Step 360: Send ICMP and TCP / UDP data packets: write the ICMP data packet and TCP / UDP data packet constructed in step 320 and step 330 to the network card for sending;

[0129] Step 370: Determine whether a return data packet is captured;

[0130] Step 380: If a return data packet is captured, determine whether it is an IP data packet;

[0131] If otherwise, return to step 370;

[0132] If yes, then execute step 390: return the data packet type, return status and other capture results for analysis to determine the network connectivity status of the current network path;

[0133] If the network connectivity status can be determined, then step 3100 is executed: updating the network connectivity status;

[0134] Execute step 3120: disable the return packet capture function;

[0135] If the network connectivity status cannot be determined, the process returns to step 370 .

[0136] If the return data packet is not captured, then step 3130 is executed: determining whether the capture time has timed out;

[0137] If the timeout period is exceeded, it is determined that "the network is unavailable", and step 3100 is executed accordingly;

[0138] If it has not timed out, execute step 3120.

[0139] In the embodiment of the present invention, reference Figure 4 As shown, the network path inspection system includes: a background management system 410, a server 420 and a client 430.

[0140] The backend management system 410 is connected to the server end 420 , sends the network path inspection task to the server end 420 , and receives the blocking point information of the network path from the server end 420 .

[0141] The backend management system 410 and the server 420 can be uniformly deployed on a host with the same operating system (such as Linux), and are responsible for receiving client connections, obtaining / distributing inspection tasks, processing client inspection results, reading and writing databases and caches.

[0142] Specifically, use Figure 4 The network path blocking point positioning method of the network path inspection system shown includes the following steps:

[0143] 1) When a user applies to activate a network policy, he can log in to the backend management system, upload a network policy application form, and batch import the network policy information to be activated;

[0144] 2) After verification, the backend management system 410 writes the network policy information into the database;

[0145] 3) In the background management system 410, the network administrator manually creates or the system automatically creates the network path inspection task according to the specified rules, and the communication processing program of the server end 420 routes the task to the communication processing program of the client end 430 on the relevant probe host;

[0146] 4) After receiving the network path inspection task, the client 430 communication processing program on the probe host sends ICMP data packets and TCP / UDP data packets to the destination IP and destination port by forging the source IP and source port, adds necessary feature data to the data packets, and opens the capture interface of the corresponding return data packets before sending;

[0147] 5) When deploying this system, all business host traffic in the subnet where the probe host is located is mirrored to the port to which the probe host is connected, and the subnet exit network device is set to allow the test host to send test data packets that forge the addresses of other hosts in the subnet;

[0148] 6) According to the type and status of the returned data packets captured in real time, the network status is determined according to the judgment rules in the above inspection process;

[0149] 7) After the test is completed, the client 430 reports the result data to the communication processing program of the server 420 through a secure connection according to the customized communication instructions;

[0150] 8) The communication processing program on the server side 420 verifies the validity of the result and writes the result into the corresponding database and cache of the background management system 410.

[0151] 9) In the background management system 410, users can view inspection items and inspection results through reports, visual interfaces, and real-time test pages. They can immediately execute and view any network path inspection task and can test the connectivity of a specified network online in real time.

[0152] Combine the following Figure 5-Figure 8 The network path blocking point positioning method of the present invention is described.

[0153] Reference Figure 5The method for locating a blocking point in a network path is shown. The method is applied to a network node configured as a source node in the network path. The network path also includes a network node configured as a destination node, and a link protection device is deployed in the network node. The execution subject of the method is the source node, which can specifically correspond to a client processing program deployed at the node. The method specifically includes the following steps:

[0154] Step 510: constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0155] Step 520: Send the test data packet to the destination node;

[0156] Step 530: Capture the return data packet of the test data packet;

[0157] Step 540: Determine whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result.

[0158] In the embodiment of the present invention, the network protocol includes at least one of the Internet Control Message Protocol (ICMP), the Transmission Control Protocol (TCP), and the User Datagram Protocol (UDP), which are not specifically limited herein.

[0159] The specific rules used to determine whether the destination node is a blocking point are different when executing step 540 depending on the network protocol. Specifically, the blocking judgment rule corresponding to the network protocol is obtained according to the preset corresponding relationship between the network protocol and the blocking judgment rule;

[0160] It is determined whether the capture result satisfies the acquired blocking judgment rule to obtain a blocking point positioning rule.

[0161] Specifically, if the network protocol is TCP, determining whether the capture result satisfies the acquired blocking judgment rule to obtain a blocking point positioning result includes:

[0162] If the captured return data packet is a SYN / ACK response, it is judged that "the network is connected and the service is normally started", and the destination node is determined not to be a blocking point according to the blocking point positioning result;

[0163] If the captured return data packet is a REST response, it is judged that "the network is connected, the service is closed or the link protection device is blocked", and the destination node is determined to be a blocking point according to the blocking point positioning result;

[0164] In other cases, it is determined that "the network is unavailable" and the blocking point cannot be located at this time.

[0165] Specifically, if the network protocol is UDP, determining whether the capture result satisfies the acquired blocking point to obtain the blocking point positioning result includes:

[0166] When the captured return data packet is a UDP data packet, it is determined that "the network is connected and the service is normally started", and the destination node is determined not to be a blocking point based on the blocking point positioning result.

[0167] Specifically, if the network protocol is ICMP, determining whether the capture result satisfies the acquired blocking point to obtain the blocking point positioning result includes:

[0168] If the captured return data packet shows that the return status is port unreachable, it is determined that "network is connected, service is closed or link protection device is blocked", and the destination node is determined to be a blocking point according to the blocking point positioning result;

[0169] If the captured return data packet shows that the return status is unreachable, it is judged as "no route" and the blocking point cannot be located.

[0170] In this way, when locating the blocking point, not only the possible blocking point can be located, but also the connectivity status of the network path can be obtained.

[0171] During a test, a test data packet may be constructed based on any of the above network protocols, or respectively based on the above three network protocols, and blocking points may be located respectively based on the three constructed test data packets.

[0172] For any network protocol, if the return data packet of the test data packet is not captured within a specified time period, the blocking point cannot be located.

[0173] In addition, the test data packet meets the path release rule configured by the link protection device, indicating that the test data packet is compliant traffic, which can eliminate the impact of the test data packet's own defects on the test results.

[0174] refer to Figure 6 As shown, the embodiment of the present invention also provides a method for locating a network path blocking point, which specifically includes the following steps:

[0175] Step 610: after detecting a release instruction for the designated traffic, construct a test data packet using the designated traffic;

[0176] For steps 620 , 630 , and 640 , please refer to the above 520 , 530 , and 540 respectively, and no further details will be given.

[0177] Step 650: If the blocking point location result shows that the destination node is a blocking point, prohibiting the designated traffic from traveling;

[0178] Step 660: If the blocking point location result shows that the destination node is not a blocking point, the designated traffic is released.

[0179] By using the embodiments of the present invention, the network status of the network path can be automatically detected in real time, and the blocking point can be located with high efficiency.

[0180] Prohibition instructions can be displayed to the user, allowing the user to eliminate blocking points.

[0181] The release instruction of the specified flow indicates that the specified flow meets the path release rule. Constructing a test data packet using the specified flow may include the following steps:

[0182] Determine the source node and destination node based on the specified traffic

[0183] The source address and source port of the test data packet are configured using the address and port of the source node, and the destination address and destination port of the test data packet are configured using the address and port of the destination node.

[0184] In another embodiment of the present invention, before constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, a network path inspection task can be received from the server, the network path inspection task includes at least one address and port of a destination node, the address and port of the source node are configured as the source address and source port of the test data packet, and the address and port of the destination node are used to configure the destination address and destination port of the test data packet. Afterwards, the blocking point positioning result is sent to the server.

[0185] If the network path inspection task includes the addresses and ports of at least two destination nodes, at least two test data packets are constructed according to the address and port of the source node and the corresponding addresses and ports of at least two destination nodes, the source address and source port of each test data packet are the same, but the destination address and destination port are different, and each test data packet is used to test a sub-path of the entire network path. In this way, the source node can use each test data packet to locate the blocking points of these sub-paths respectively.

[0186] In the embodiment of the present invention, when constructing a test data packet, a characteristic tag can be configured for the constructed test data packet, and the characteristic tag is used to mark the test data packet. In this way, when capturing a return data packet of the test data packet, the return data packet of the test data packet can be identified according to the characteristic tag. If the captured return data packet includes the same characteristic tag, it means that the return data packet is the return data packet of the corresponding test data packet.

[0187] refer to Figure 7 The network path blocking point positioning method provided by the present invention, the network path includes a network node configured as a source node and a network node configured as a destination node, link protection devices are deployed in the network nodes, the execution subject of the method is a server end, and the method specifically includes:

[0188] Step 710: Send a network path inspection task to at least one of the source nodes, so that the source node constructs the source address and source port of the test data packet and the destination address and destination port of the destination node according to the network path inspection task, sends the test data packet to the destination node, captures the return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0189] Step 720: receiving the blocking point positioning result from at least one of the source nodes;

[0190] Step 730: Determine the blocking point information of the network path according to the blocking point positioning result.

[0191] In an optional embodiment of the present invention, referring to Figure 8 As shown, before sending the network path inspection task to at least one source node, the following steps are also included:

[0192] Step 810: Acquire end-to-end traffic information that satisfies the path release rule;

[0193] Step 820: Obtain the network path corresponding to the end-to-end traffic information in the database;

[0194] Step 830: configuring each network node in the network path to obtain at least one set of the source node and the destination node;

[0195] Step 840: Generate at least one network path inspection task corresponding to at least one group of source nodes and destination nodes.

[0196] In this case, when the end-to-end flow information is transmitted from one end of the network path to the other end, it may pass through at least one network node in the middle. By obtaining the addresses and ports of all network nodes in the network path, all network nodes on the network path can be enumerated. By combining each network node to obtain at least one group of source nodes and destination nodes, segmented inspection of the network path can be achieved, and blocking point positioning can be achieved for each network node. The server side determines the blocking point information of the entire network path based on the blocking positioning results of each segment in the network path, which can ensure the comprehensiveness, accuracy and efficiency of the network path blocking point positioning results of the present invention.

[0197] The network path blocking point positioning device provided by the present invention is described below. The network path blocking point positioning device described below and the network path blocking point positioning method described above can be referenced to each other.

[0198] Reference Fig. 9 As shown, the network path blocking point positioning device is applied to a network node configured as a source node in the network path, and the network path also includes a network node configured as a destination node, and a link protection device is deployed in the network node. The device includes:

[0199] A construction module 910 constructs a test data packet that satisfies the path release rule configured by the link protection device based on a network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0200] A sending module 920 sends the test data packet to the destination node;

[0201] A capture module 930, which captures the return data packet of the test data packet;

[0202] The judgment module 940 judges whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result.

[0203] For the specific functions performed by the above modules, please refer to the corresponding methods, which will not be repeated here.

[0204] Reference Fig.10 As shown, the network path includes a network node configured as a source node and a network node configured as a destination node, and link protection devices are deployed in the network nodes. The network path blocking point positioning device may include:

[0205] The sending module 1001 sends a network path inspection task to at least one of the source nodes, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0206] A receiving module 1002 receives the blocking point positioning result from at least one source node;

[0207] The determination module 1003 determines the blocking point information of the network path according to the blocking point positioning result.

[0208] For the specific functions performed by the above modules, please refer to the corresponding methods, which will not be repeated here.

[0209] The terminal device involved in the embodiments of the present application may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem, etc. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE).

[0210] The network device involved in the embodiments of the present application may be a base station, which may include multiple cells providing services for terminals. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in an access network that communicates with a wireless terminal device through one or more sectors on an air interface, or other names.

[0211] Fig.11 is a schematic diagram of the structure of a terminal according to an embodiment of the present application, referring to Fig.11 , the embodiment of the present application also provides a terminal, which is applied to a network node configured as a source node in a network path, the network path also includes a network node configured as a destination node, and a link protection device is deployed in the network node. The terminal may include: a memory 1110, a transceiver 1120 and a processor 1130;

[0212] The memory 1110 is used to store computer programs; the transceiver 1120 is used to send and receive data under the control of the processor 1130; the processor 1130 is used to read the computer program in the memory 1110 and perform the following operations:

[0213] A test data packet that satisfies the path release rule configured on the link protection device is constructed based on the network protocol, the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0214] Send a test data packet to the destination node;

[0215] Capture the return data packets of the test data packets;

[0216] According to the capture result, it is determined whether the destination node is a blocking point to obtain the blocking point positioning result.

[0217] Among them, Fig.11 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1130 and various circuits of memory represented by memory 1110 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1120 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. For different user devices, the user interface 1140 may also be an interface capable of externally connecting to the required internal devices.

[0218] The processor 1130 is responsible for managing the bus architecture and general processing, and the memory 1110 can store data used by the processor 1130 when performing operations.

[0219] The processor 1130 is used to execute any method provided in the embodiments of the present application according to the obtained executable instructions by calling the computer program stored in the memory 1110. The processor and the memory can also be arranged physically separately.

[0220] Fig.12 is a schematic diagram of the structure of a network device according to an embodiment of the present application, referring to Fig.12 , the embodiment of the present application further provides a network device, which may include: a memory 1210, a transceiver 1220 and a processor 1230;

[0221] The memory 1210 is used to store computer programs; the transceiver 1220 is used to send and receive data under the control of the processor 1230; the processor 1230 is used to read the computer program in the memory 1210 and perform the following operations:

[0222] When a network path includes a network node configured as a source node and a network node configured as a destination node, and a link protection device is deployed in the network node, a network path inspection task is sent to at least one source node, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends a test data packet to the destination node, captures a return data packet of the test data packet, determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0223] receiving a blocking point location result from at least one source node;

[0224] The blocking point information of the network path is determined according to the blocking point positioning results.

[0225] Among them, Fig.12 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1230 and various circuits of memory represented by memory 1210 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1220 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1230 is responsible for managing the bus architecture and general processing, and the memory 1210 may store data used by the processor 1230 when performing operations.

[0226] It should be noted here that the terminal and network device provided in the embodiment of the present invention can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0227] Fig.13 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.13 As shown, the electronic device may include: a processor 1310, a communication interface 1320, a memory 1330 and a communication bus 1340, wherein the processor 1310, the communication interface 1320, and the memory 1330 communicate with each other through the communication bus 1340. The processor 810 may call a computer program in the memory 1330 to execute the steps of the network path blocking point positioning method, for example including:

[0228] A test data packet that satisfies the path release rule configured on the link protection device is constructed based on the network protocol, the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0229] Send a test data packet to the destination node;

[0230] Capture the return data packets of the test data packets;

[0231] According to the capture result, it is determined whether the destination node is a blocking point to obtain the blocking point positioning result.

[0232] Or, also include:

[0233] Sending a network path inspection task to at least one source node, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0234] receiving a blocking point location result from at least one source node;

[0235] The blocking point information of the network path is determined according to the blocking point positioning results.

[0236] In addition, the logic instructions in the above-mentioned memory 1330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0237] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a computer, the computer can execute the network path blocking point locating method provided by the above methods, the method comprising:

[0238] A test data packet that satisfies the path release rule configured on the link protection device is constructed based on the network protocol, the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0239] Send a test data packet to the destination node;

[0240] Capture the return data packets of the test data packets;

[0241] According to the capture result, it is determined whether the destination node is a blocking point to obtain the blocking point positioning result.

[0242] Or, also include:

[0243] Sending a network path inspection task to at least one source node, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0244] receiving a blocking point location result from at least one source node;

[0245] The blocking point information of the network path is determined according to the blocking point positioning results.

[0246] On the other hand, an embodiment of the present application further provides a processor-readable storage medium, the processor-readable storage medium storing a computer program, the computer program is used to enable the processor to execute the methods provided in the above embodiments, for example, including:

[0247] A test data packet that satisfies the path release rule configured on the link protection device is constructed based on the network protocol, the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node;

[0248] Send a test data packet to the destination node;

[0249] Capture the return data packets of the test data packets;

[0250] According to the capture result, it is determined whether the destination node is a blocking point to obtain the blocking point positioning result.

[0251] Or, also include:

[0252] Sending a network path inspection task to at least one source node, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, and the test data packet satisfies the path release rule configured by the link protection device;

[0253] receiving a blocking point location result from at least one source node;

[0254] The blocking point information of the network path is determined according to the blocking point positioning results.

[0255] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO)), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drives (SSDs)), etc.

[0256] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0257] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0258] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for locating a network path blocking point, characterized in that: Applied to a network node configured as a source node in the network path, the network path also includes a network node configured as a destination node, a link protection device is deployed in the network node, and the network path blocking point positioning method includes: Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node; Sending the test data packet to the destination node; Capturing the return data packet of the test data packet; Determine whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result; Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, including: After a release instruction for the designated traffic is detected, a test data packet is constructed using the designated traffic.

2. The method for locating a network path blocking point according to claim 1, characterized in that: The network path blocking point positioning method also includes: If the blocking point positioning result shows that the destination node is not a blocking point, the designated traffic is released; If the blocking point positioning result shows that the destination node is a blocking point, the designated traffic is prohibited.

3. The method for locating a network path blocking point according to claim 1, characterized in that: Before constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, the method further includes: Receiving a network path inspection task from the server, wherein the network path inspection task includes an address and a port of at least one of the destination nodes; Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, including: The address and port of the source node are configured as the source address and source port of the test data packet, and the address and port of the destination node are used to configure the destination address and destination port of the test data packet; The network path blocking point positioning method also includes: The blocking point positioning result is sent to the server.

4. The method for locating a network path blocking point according to claim 1, characterized in that: Before sending the test data packet to the destination node, the method further includes: Creating a network packet capture filter, wherein the network packet capture filter is configured to capture the return data packet of the test data packet; Capturing the return data packet of the test data packet, including: The network packet capture filter is used to capture the return data packet of the test data packet.

5. The method for locating a network path blocking point according to claim 1, characterized in that: The network path blocking point positioning method also includes: When constructing the test data packet, configuring a characteristic tag for the test data packet; Capturing the return data packet of the test data packet, including: The return data packet of the test data packet is identified according to the characteristic tag.

6. The method for locating a network path blocking point according to claim 1, characterized in that: Determining whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result includes: According to the preset correspondence between the network protocol and the blocking judgment rule, obtaining the blocking judgment rule corresponding to the network protocol; It is determined whether the capture result satisfies the acquired blocking judgment rule to obtain the blocking point positioning result.

7. The method for locating a network path blocking point according to claim 6, wherein: Determining whether the capture result satisfies the acquired blocking judgment rule to obtain the blocking point positioning result includes: If the network protocol is TCP, and the captured return data packet is a REST response, determining the destination node as a blocking point according to the blocking point positioning result; If the network protocol is ICMP, and the captured return data packet shows that the port is unreachable, the destination node is determined to be the blocking point according to the blocking point positioning result.

8. A method for locating a network path blocking point, characterized in that: The network path includes a network node configured as a source node and a network node configured as a destination node, link protection devices are deployed in the network nodes, and the network path blocking point positioning method is applied to a server side, including: Sending a network path inspection task to at least one of the source nodes, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of the destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, the test data packet satisfies the path release rule configured by the link protection device, and the test data packet is constructed using the specified traffic after a release instruction for the specified traffic is detected; Receiving the blocking point positioning result from at least one of the source nodes; The blocking point information of the network path is determined according to the blocking point positioning result.

9. The method for locating a network path blocking point according to claim 8, characterized in that: Before sending the network path inspection task to at least one of the source nodes, the method further includes: Acquire end-to-end traffic information that satisfies the path release rule; Acquire the network path corresponding to the end-to-end traffic information in a database; Configuring each network node in the network path to obtain at least one group of the source node and the destination node; At least one network path inspection task is generated correspondingly according to at least one group of source nodes and destination nodes.

10. A network path inspection system, characterized in that: The network path includes a network node configured as a source node and a network node configured as a destination node, link protection devices are deployed in the network nodes, and the network path inspection system includes: The server sends a network path inspection task to at least one of the source nodes, receives a blocking point positioning result from at least one of the source nodes, and determines the blocking point information of the network path according to the blocking point positioning result; At least one of the source nodes constructs the source address, source port and destination address and destination port of the corresponding destination node of the test data packet according to the network path inspection task, sends the test data packet to the destination node, captures the return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain the blocking point positioning result, the test data packet satisfies the path release rule configured by the link protection device, and the test data packet is constructed using the specified traffic after a release instruction for the specified traffic is detected.

11. The network path inspection system according to claim 10, characterized in that: Also includes: The backend management system sends the network path inspection task to the server end, and receives the blocking point information of the network path from the server end.

12. A network path blocking point positioning device, characterized in that: Applied to a network node configured as a source node in the network path, the network path also includes a network node configured as a destination node, a link protection device is deployed in the network node, and the network path blocking point positioning device includes: A construction module, constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node; A sending module, sending the test data packet to the destination node; A capture module, which captures the return data packet of the test data packet; A judgment module, judging whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result; Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, including: After a release instruction for the designated traffic is detected, a test data packet is constructed using the designated traffic.

13. A network path blocking point positioning device, characterized in that: The network path includes a network node configured as a source node and a network node configured as a destination node, link protection devices are deployed in the network nodes, and the network path blocking point positioning device is applied to a server side, including: a sending module, sending a network path inspection task to at least one of the source nodes, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, the test data packet satisfies the path release rule configured by the link protection device, and the test data packet is constructed using the specified traffic after a release instruction for the specified traffic is detected; A receiving module, receiving the blocking point positioning result from at least one of the source nodes; A determination module determines the blocking point information of the network path according to the blocking point positioning result.

14. A terminal, characterized in that: Applied to a network node configured as a source node in a network path, the network path also including a network node configured as a destination node, and a link protection device is deployed in the network node; The terminal includes a memory, a transceiver, and a processor; Memory for storing computer programs; a transceiver, for transmitting and receiving data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, wherein the source address and source port of the test data packet are configured as the address and port of the source node, and the destination address and destination port of the test data packet are configured as the address and port of the destination node; Sending the test data packet to the destination node; Capturing the return data packet of the test data packet; Determine whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result; Constructing a test data packet that satisfies the path release rule configured by the link protection device based on the network protocol, including: After a release instruction for the designated traffic is detected, a test data packet is constructed using the designated traffic.

15. A network device, characterized in that: Including memory, transceiver, processor; A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: When a network path includes a network node configured as a source node and a network node configured as a destination node, and a link protection device is deployed in the network nodes, a network path inspection task is sent to at least one of the source nodes, so that the source node constructs a source address and a source port of a test data packet and a destination address and a destination port of a corresponding destination node according to the network path inspection task, sends the test data packet to the destination node, captures a return data packet of the test data packet, and determines whether the destination node is a blocking point according to the capture result to obtain a blocking point positioning result, the test data packet satisfies the path release rule configured by the link protection device, and the test data packet is constructed using the specified traffic after a release instruction for the specified traffic is detected; Receiving the blocking point positioning result from at least one of the source nodes; The blocking point information of the network path is determined according to the blocking point positioning result.

16. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the steps of the network path blocking point locating method according to any one of claims 1 to 9 are implemented.

17. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the steps of the network path blocking point locating method according to any one of claims 1 to 9.

Images