A network detection method, device, equipment and readable storage medium

Abstract

The application discloses a network detection method, device and equipment and a readable storage medium in the computer technical field. The application divides a data center network to be detected into multiple network areas, and constructs a corresponding area detection packet for each of the multiple network areas. Therefore, the network detection of each network area is independent and self-contained, and does not interfere with each other, that is, each network area uses the corresponding area detection packet to perform network detection on a detection path in the area, thereby obtaining a detection return packet. In this way, redundant return packets are not easily generated, the accuracy of the detection return packet is improved, the number is reduced, the quality of the detection return packet is improved, and therefore, the subsequent analysis work of the detection return packet is facilitated. Correspondingly, the network detection device, equipment and readable storage medium provided by the application also have the above technical effects.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a network detection method, apparatus, device, and readable storage medium. Background Technology

[0002] Currently, existing in-band network telemetry (INT) schemes have many problems. For example, when probing via broadcast, broadcast forwarding is repeated, which not only easily leads to congestion but also generates a large amount of redundant information. Furthermore, when probing based on a depth-first search strategy, the varying lengths of the probe paths complicate the analysis of the probe response packets.

[0003] Therefore, how to reduce information redundancy in in-band network telemetry and improve the analysis efficiency of probe return packets is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a network probing method, apparatus, device, and readable storage medium to reduce information redundancy in in-band network telemetry and improve the analysis efficiency of probing response packets. The specific solution is as follows:

[0005] Firstly, this application provides a network detection method, including:

[0006] Construct region detection packets corresponding to multiple network regions; wherein, the multiple network regions are obtained by dividing the data center network according to a preset network topology size.

[0007] Each region probe packet is sent to the corresponding network region, so that the multiple network regions can use the corresponding region probe packets to perform network probe on the probe path within their respective regions and obtain probe return packets;

[0008] Obtain the probe response packets from the multiple network regions and determine the destination node corresponding to each probe response packet;

[0009] The probe packets from the multiple network regions are sent to the destination node so that the destination node can analyze the probe packets it has received.

[0010] Optionally, constructing region probe packets corresponding to multiple network regions includes:

[0011] For each network region, construct a region probe packet carrying the region identifier of the current network region;

[0012] Accordingly, sending the probe packets for each region to the corresponding network region includes:

[0013] Each area probe packet is sent to the corresponding network area according to the area identifier.

[0014] Optionally, determining the destination node corresponding to each probe return packet includes:

[0015] The source IP address is extracted from each probe packet, and the node identifier of the destination node corresponding to each source IP address is obtained by querying a preset correspondence table, so as to determine the destination node corresponding to each probe packet.

[0016] Optionally, the probe return packets of the plurality of network regions correspond to at least two destination nodes;

[0017] Accordingly, sending the probe response packets of the multiple network regions to the destination node so that the destination node can analyze the probe response packets it has received includes:

[0018] The probe packets from the plurality of network regions are distributed to the at least two destination nodes, so that the at least two destination nodes can analyze the probe packets they receive.

[0019] Optionally, it also includes:

[0020] The at least two destination nodes are nodes in a distributed system, and heartbeat packets are periodically sent to each node in the distributed system;

[0021] If any node in the distributed system is determined to be faulty based on the heartbeat packet, the node identifier of the faulty node is queried in the preset correspondence table. After unbinding the found node identifier from the corresponding source IP address, a correspondence is established between the unbound source IP address and the node identifier of the non-faulty node in the distributed system.

[0022] Optionally, the data center network is divided into multiple network regions, including:

[0023] Obtain the network topology information of the data center network;

[0024] Based on the network topology information and the preset network topology size, the data center network is divided into multiple network regions to make the network devices and detection paths of each network region more consistent.

[0025] Optionally, if the data center network is a fat tree structure, the process of generating the network topology information includes:

[0026] Record the network devices in the core layer of the fat tree structure to obtain set dimension information; each set dimension information record includes the set identifier, the name and port of the network device in the corresponding set, and the names of other devices connected to that port.

[0027] Based on any set dimension information, network devices in the aggregation layer of the fat tree structure are recorded, and network devices in the edge layer are recorded based on the network devices in the aggregation layer to obtain pod dimension information; any pod dimension information records the pod identifier, the name and port of the network device in the corresponding pod, the name of other devices connected to the port, and the network layer identifier to which the network device belongs;

[0028] By merging all set dimension information and all pod dimension information, the network topology information is obtained.

[0029] Optionally, it also includes:

[0030] If any network device in any network area has been modified, then the area probe packet for that network area is changed according to the modified network device.

[0031] Accordingly,

[0032] If a new network area is added to the data center network, a region probe packet is constructed for the new network area, and the destination node corresponding to the probe return packet of the new network area is determined.

[0033] Secondly, this application provides a network detection device, comprising:

[0034] A construction module is used to construct area detection packets corresponding to multiple network regions; wherein, the multiple network regions are obtained by dividing the data center network according to a preset network topology size.

[0035] The detection module is used to send detection packets from each region to the corresponding network regions, so that the multiple network regions can use the corresponding region detection packets to perform network detection on the detection path within their respective regions and obtain detection response packets.

[0036] The determination module is used to acquire the probe response packets of the multiple network regions and determine the destination node corresponding to each probe response packet;

[0037] The distribution module is used to send the probe response packets of the multiple network areas to the destination node, so that the destination node can analyze the probe response packets it has received.

[0038] Thirdly, this application provides an electronic device, comprising:

[0039] Memory, used to store computer programs;

[0040] A processor is used to execute the computer program to implement the aforementioned network detection method.

[0041] Fourthly, this application provides a readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned network detection method.

[0042] As can be seen from the above scheme, this application provides a network probing method, including: constructing regional probe packets corresponding to multiple network regions; wherein, the data center network is divided according to a preset network topology to obtain the multiple network regions; each regional probe packet is sent to the corresponding network region, so that the multiple network regions use the corresponding regional probe packets to perform network probing on the probe path within their respective regions and obtain probe response packets; obtaining the probe response packets of the multiple network regions and determining the destination node corresponding to each probe response packet; sending the probe response packets of the multiple network regions to the destination node, so that the destination node analyzes the probe response packets it has received.

[0043] As can be seen, this application divides the data center network to be probed into multiple network regions according to a preset network topology size, and constructs corresponding regional probe packets for each network region. Therefore, the network probes of each network region are independent and autonomous, without interference from each other. That is, each network region uses the corresponding regional probe packet to perform network probes on the probe path within its region, thereby obtaining probe response packets. In this way, different network regions will not interfere with each other, so redundant response packets are less likely to be generated. Thus, the accuracy of the probe response packets will be improved and the number will be reduced, thereby improving the quality of the probe response packets. Therefore, it can facilitate the subsequent analysis of the probe response packets and help improve the efficiency of response packet analysis.

[0044] Correspondingly, the network detection device, equipment, and readable storage medium provided in this application also have the above-mentioned technical effects. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0046] Figure 1 This is a flowchart of a network detection method disclosed in this application;

[0047] Figure 2 This is a schematic diagram of a data center network disclosed in this application;

[0048] Figure 3 This is a schematic diagram of a storage structure disclosed in this application;

[0049] Figure 4This is a schematic diagram of one of the detection paths disclosed in this application;

[0050] Figure 5 This is a schematic diagram of another detection path disclosed in this application;

[0051] Figure 6 This is a schematic diagram of a corresponding relationship disclosed in this application;

[0052] Figure 7 This is a schematic diagram of the software architecture of a network detection system disclosed in this application;

[0053] Figure 8 This is a schematic diagram of a network detection device disclosed in this application;

[0054] Figure 9 This is a schematic diagram of an electronic device disclosed in this application. Detailed Implementation

[0055] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0056] With the increasingly widespread application of technologies such as the Internet of Things (IoT), artificial intelligence (AI), and cloud computing, data center networks, as the foundation and support for these services, provide users with efficient, secure, and reliable computing, transmission, and storage services. They play an increasingly important role in production, daily life, and various critical business deployments within enterprises. To ensure the quality of service in data centers, real-time monitoring of the data center network is essential. Currently, in-band network telemetry can be used to monitor data center networks. In-band network telemetry covers the network links to be probed with specific probe packets, allowing users to collect network link information in an in-band manner using specific data packets. The collected information can be widely applied to scenarios such as load balancing, fault detection, and network event tracing.

[0057] Currently, existing in-band network telemetry schemes have many problems. For example, when using broadcast probing, different network devices may connect to the same device, leading to repeated broadcast forwarding, which not only easily causes congestion but also generates a large amount of redundant information. Furthermore, when using INT-path based on a depth-first search strategy for probing, the varying lengths of the probing paths complicate the analysis of the probing response packets. Therefore, this application provides a network probing scheme that can reduce information redundancy in in-band network telemetry and improve the efficiency of probing response packet analysis.

[0058] See Figure 1As shown in the figure, this application discloses a network detection method, including:

[0059] S101. Construct area probe packets corresponding to multiple network regions respectively.

[0060] This involves dividing the data center network into multiple network regions according to a preset network topology. Assume the data center network is... Figure 2 The example shows a fat-tree structured network. In... Figure 2 In this topology, the core layer consists of four core switches: C1 and C2 form set1, and C3 and C4 form set2. The aggregation layer has eight switches: A1 to A8, and the edge layer has eight switches: E1 to E8. Two switches in the aggregation layer and two switches in the edge layer form a pod. The entire aggregation and edge layers consist of four pods (arrays). The two aggregation layer switches connect to two core layer switches in different sets. The two edge layer switches connect to two servers. It can be seen that in this fat-tree topology, there are multiple physical paths between every two servers. Load balancing can be achieved by utilizing these replaceable, equivalent physical paths, fully utilizing network resources, reducing the possibility of congestion, and increasing network bandwidth and fault tolerance.

[0061] As can be seen, in a fat-tree structure, from top to bottom, there are core layers, aggregation layers, and edge layers. Aggregation layer switches and edge layer switches are assigned to different arrays (Pods). In one example, the K-ary fat-tree topology construction rules are as follows: the number of core layer switches is K² / 4; every K / 2 core layer switches form a Set; the number of Pods is K; each Pod has K / 2 edge layer switches and K / 2 aggregation layer switches; each edge layer switch connects to K / 2 servers; the remaining K / 2 ports of each edge layer switch connect to K / 2 aggregation layer switches within a Pod; the i-th port of each core layer switch connects to the i-th Pod; the core layer switches of the i-th Set connect to the i-th aggregation layer switch of each Pod; all switches provide K ports. Therefore, it can be calculated that a fat-tree topology can connect a total of K... 3 There are 4 servers, and the number of equivalent paths between servers in different Pods is K. 2 / 4.

[0062] against Figure 2The data center network shown can be divided into two Layer 2 network areas. Then, within each Layer 2 area, four devices are assigned to one network area. For example, all core layer switches and their connected aggregation layer switches within a set can be grouped into one Layer 2 network area, i.e., C1, C2, A1, A3, A5, and A7 can be grouped into network area X. To ensure that the number of devices, probe paths, and probe paths are equal across different network areas, network area X is further divided into two 2×2 partitions, ensuring that each network area contains four devices. This ensures that the number of devices, probe paths, and probe paths are equal across different network areas, and that the construction rules and strategies for the probe packets in different network areas are consistent. The probe return packets from different network areas have the same components, facilitating the construction of regional probe packets and the analysis of probe return packets.

[0063] In one example, when network area X is further divided according to a "2×2" specification, two network areas can be obtained: one network area includes C1, C2, A1, and A3, and the other network area includes C1, C2, A5, and A7. Accordingly, set2 and its connected aggregation layer switches are divided according to the "2×2" specification, which will not be elaborated further here. For the Layer 2 area composed of the aggregation layer and the switching layer, a pod can be divided into one network area, for example: A1, A2, E1, and E2 form one network area. The aforementioned "2×2" specification can be the preset network topology size described in this embodiment. Of course, the preset network topology size can also be other sizes, but the "2×2" specification is the preferred option.

[0064] As can be seen, the number of devices and the number of probe paths are equal in each network region obtained by dividing the data center network. Therefore, the number and length of probe paths in each network region are consistent. This not only reduces redundant probe data and achieves network-wide detection without blind spots, but also allows for the same construction rules and strategies for regional probe packets corresponding to different network regions. The probe response packets from different network regions will have the same components, facilitating the construction of regional probe packets for each network region using the same construction rules and strategies, and also facilitating the analysis of the corresponding probe response packets. The construction rules and strategies for regional probe packets can be set according to actual conditions, and will not be elaborated in this embodiment. In one specific implementation, constructing regional probe packets corresponding to multiple network regions includes: for each network region, constructing a regional probe packet carrying the region identifier of the current network region; correspondingly, sending each regional probe packet to the corresponding network region includes: sending each regional probe packet to the corresponding network region according to the region identifier. It can be seen that each regional probe packet carries a region identifier; of course, path labels can also be set in each regional probe packet to replace the region identifier.

[0065] In one specific implementation, the data center network is divided into multiple network regions, including: acquiring network topology information of the data center network; and dividing the data center network into multiple network regions based on the network topology information and a preset network topology size, so that the network devices and probe paths in each network region tend to be consistent. Ideally, the number of network devices and probe paths in each network region is equal, and the lengths of different probe paths in different network regions or within the same network region are equal.

[0066] In one specific implementation, if the data center network is a fat tree structure, the process of generating network topology information includes: recording network devices in the core layer of the fat tree structure to obtain set dimension information; each set dimension information records a set identifier, the name and port of the network device in the corresponding set, and the names of other devices connected to that port; based on any set dimension information, recording network devices in the aggregation layer of the fat tree structure, and recording network devices in the edge layer based on the network devices in the aggregation layer to obtain pod dimension information; each pod dimension information records a pod identifier, the name and port of the network device in the corresponding pod, the names of other devices connected to that port, and the network layer identifier to which the network device belongs; merging all set dimension information and all pod dimension information to obtain network topology information.

[0067] Combination Figure 2 As shown, the set dimension information and pod dimension information are as follows: Figure 3 As shown. In Figure 3 In this context, a set dimension is represented by C. A C contains information such as a set1-C1 / C2, recorded as key-value pairs. For device C1, port 1 connects to device A1, port 2 connects to device A3, port 3 connects to device A5, and port 4 connects to device A7. A pod dimension is represented by A or E. A indicates that the device serving as a value belongs to the aggregation layer, while E indicates that the device serving as a value belongs to the edge layer. For example... Figure 3 As shown, a pod A includes information such as key-value pairs (pod1-A1 / A2) and the aggregation layer identifier (agg) to which A1 / A2 belongs. For device A1, port 1 connects to device C1, port 2 connects to device C2, port 3 connects to device E1, and port 4 connects to device E2. Figure 3 As shown, an E contains information such as: key-value pairs recording pod1-E1 / E2, and the edge layer identifier to which E1 / E2 belongs. For devices E1 and E2, the devices connected to each of their ports are also recorded accordingly. Figure 3 Not yet drawn.

[0068] As can be seen, using set and pod dimension information, we can record: the names of each device, the connection relationships between different devices, and the network layer to which the device used as the value belongs. The resulting network topology information can comprehensively record the network topology and facilitates information recording and area division. For example: recording... Figure 3 As shown in step C, all core layer switches are traversed along the dimensions of the set, and for each set, switch information is stored in random order. (Record) Figure 3 As shown in A, iterate through C to find the aggregation layer switch connected to each set based on the information of the first switch in C, thus storing the data according to the pod dimension. (Record) Figure 3 As shown in E, based on the information of the first switch in each pod (A), the edge layer switches connected to it are stored in a random order. That is: based on the information of the first switch C1 in set1, A1, A3, A5, and A7 connected to C1 are obtained. Then A1, A3, A5, and A7 are the first switches of the four pods, and so on, thus completing the storage of pod-level aggregation layer switch information. Based on the information of the first switch A1 in pod1, E1 and E2 are obtained respectively, and so on, thus completing the storage of all pod-level edge layer switch information.

[0069] S102. Send the probe packets of each region to the corresponding network region, so that multiple network regions can use the corresponding region probe packets to perform network probe on the probe path in their respective regions and obtain probe response packets.

[0070] It's important to note that a network area doesn't necessarily have only one area probe packet. The exact number depends on the number of paths that need to be probed within that area. In other words, the number of area probe packets corresponds to the number of probe paths within a network area. Therefore, there's a one-to-one correspondence between area probe packets and their respective probe paths, and each area probe packet contains a path label. The number of probe packets for a network area equals the number of probe response packets.

[0071] Please refer to Figure 2 For the network area composed of A1, A2, E1, and E2, the following can be considered: Figure 4 The detection path is shown. (As shown in the image.) Figure 4 As shown, this network region has two probe paths: a sequential path and a reverse path. Each path has four hops, and these two probe paths can form an Eulerian circuit. Please refer to... Figure 2 For the network area composed of C1, C2, A1, and A3, the following can be done: Figure 5 The detection path is shown. (As shown in the image.) Figure 5As shown, this network region also has two probe paths: a sequential path and a reverse path. Each path has four hops, and these two probe paths can form an Eulerian circuit. (Compare...) Figure 4 and Figure 5 It can be seen that when dividing the network according to the "2×2" specification, it is easy to achieve the following: the number of devices in different network areas is equal, the number of detection paths is equal, and the detection paths are consistent. Therefore, the network areas are divided according to the "2×2" specification first.

[0072] S103. Obtain probe packets from multiple network regions and determine the destination node corresponding to each probe packet.

[0073] S104. Send probe packets from multiple network areas to the destination node so that the destination node can analyze the probe packets it has received.

[0074] In this embodiment, there is at least one destination node. However, since a network area may have at least one probe packet, the number of probe packets from multiple network areas is relatively large. Therefore, when using a single target node to analyze these probe packets, the analysis task may be difficult to complete in a timely manner. To address this, this embodiment identifies a destination node for the analysis of each probe packet. This distributes probe packets from multiple network areas to these destination nodes, which can share the analysis task, thereby improving the efficiency of probe packet analysis.

[0075] In one specific implementation, probe packets from multiple network regions correspond to at least two destination nodes; accordingly, sending probe packets from multiple network regions to destination nodes so that destination nodes can analyze the probe packets they have received includes: distributing probe packets from multiple network regions to at least two destination nodes so that at least two destination nodes can analyze the probe packets they have received respectively.

[0076] In one specific implementation, determining the destination node corresponding to each probe packet includes: extracting the source IP address from each probe packet and obtaining the node identifier of the destination node corresponding to each source IP address by querying a preset mapping table, thereby determining the destination node corresponding to each probe packet. Here, the source IP address of the probe packet is the IP address of the device probed by the last hop of a region probe packet. Therefore, the mapping relationship between the IP address of the device probed by the last hop of a region probe packet and the node identifiers of each destination node can be pre-recorded. Subsequently, when a probe packet is obtained, the destination node corresponding to that packet can be queried based on the source IP address of the probe packet. The node identifier of the destination node can be a node IP address, etc. Figure 6 As shown, each entry records a corresponding relationship. An entry includes: the IP address of a destination node (e.g., ...). Figure 6In the DIP_1) and the device IP detected by the last hop in its corresponding multiple areas (such as DIP_1) and the device IP detected by the last hop (such as DIP_1) and the device IP detected by the last hop in its corresponding multiple areas ... Figure 6 (e.g., SRC_1, SRC_2, etc. corresponding to DIP_1). In this way, according to the correspondence of different entry records, probe packets from different network regions can be distributed to the corresponding destination nodes, thereby improving the analysis efficiency of probe packets.

[0077] Ideally, all probe packets are evenly distributed across all destination nodes, achieving load balancing. To achieve this, network regions can be uniformly mapped to each destination node. For example, assuming a data center network is divided into four network regions, four destination nodes can be set up, allowing each destination node to handle probe packets from one network region. Since the number and length of probe paths across different network regions are as consistent as possible, the quantity, composition, and analysis strategies of probe packets from different network regions are identical. Therefore, when a destination node processes probe packets from one network region, the amount of analysis data and the load on different destination nodes are the same, thus achieving load balancing. Each destination node can be a node in a distributed system.

[0078] In one specific implementation, at least two destination nodes are nodes in a distributed system, and heartbeat packets are periodically sent to each node in the distributed system. If any node in the distributed system is determined to be faulty based on the heartbeat packets, the node identifier of the faulty node is queried in a preset correspondence table. After unbinding the found node identifier with the corresponding source IP address, a correspondence is established between the unbound source IP address and the node identifier of the non-faulty node in the distributed system. This does not affect the continued processing of the analysis task, and the fault tolerance and robustness are good.

[0079] In one specific implementation, if any network device in any network area is modified, the area probe packet for that network area is changed according to the modified network device. Correspondingly, if a new network area is added to the data center network, an area probe packet is constructed for the new network area, and the destination node corresponding to the probe return packet of the new network area is determined. It is evident that when the data center network is modified, only the area probe packets and the destination nodes of the probe return packets involved in the modified part need to be changed accordingly, while other areas continue to use the previous probe packets and destination nodes for detection and analysis. Therefore, the changes are minimal, which is beneficial for the continuous execution of detection and analysis tasks.

[0080] As can be seen, in this embodiment, the data center network to be probed is divided into multiple network regions, and corresponding regional probe packets are constructed for each of the multiple network regions. Therefore, the network probes of each network region are independent and autonomous, and do not interfere with each other. That is, each network region uses the corresponding regional probe packet to perform network probes on the probe path within its own region, thereby obtaining probe return packets. In this way, different network regions will not interfere with each other, so it is not easy to generate redundant return packets. For the probe return packets of all network regions, this application can determine at least two destination nodes. At least two destination nodes can share the analysis task of these probe return packets, thus improving the analysis efficiency of probe return packets.

[0081] According to the method provided in the above embodiments, a network detection system as described in the following embodiments can be implemented. This software system uses the "divide and conquer" approach to divide the entire data center network into multiple similar structures, and collects and processes data from each structure separately. Thus, the entire network detection system consists of two main parts: planning and distribution. The planning part divides the entire data center network into multiple regions and designs specific detection paths for each region. The distribution part distributes the reported detection packets to different analysis servers for processing.

[0082] Specifically, the overall software architecture of the network detection system is as follows: Figure 7 As shown, based on Figure 7 The software architecture shown below illustrates the data acquisition and analysis process of this system:

[0083] Step 1: Each analysis server process starts, informing the interaction module that the service is online; simultaneously, the planning module interacts with the control terminal to obtain the data center network topology. The control terminal is the control terminal for the data center network.

[0084] In this system, the various analysis servers constitute a distributed system. This embodiment employs a distributed data acquisition approach, dividing the entire data center network into multiple acquisition zones with identical structures. Each acquisition zone can reuse the same strategy for path planning and INT data acquisition. Furthermore, for common pod-level network scaling, existing acquisition strategies can be effectively utilized, ensuring the scalability of INT data acquisition.

[0085] Step 2: The interaction module informs the distribution algorithm module of the DIP (Destination IP) information (i.e., the IP address of the analysis server, etc.); at the same time, the planning module informs the distribution algorithm module and the controller of the results of the probe path planning.

[0086] Step 3: The distribution algorithm module, based on the DIP information and path planning results, establishes a mapping relationship by matching the source IP and DIP information of the reported INT messages (i.e., probe response packets). Simultaneously, the controller distributes the planned probe paths to the data center. When recording the mapping relationship, the DIP is used as the primary key, and each DIP is associated with an assigned source IP. This structure facilitates subsequent CRUD operations on DIPs and source IPs. The mapping relationship is recorded as follows: Figure 6 As shown.

[0087] Step 4: Within the data center, based on the issued probe path, apply SR technology to send INT probe packets with path tags to collect network data of the entire data center, and send the obtained INT data to the transceiver module.

[0088] Step 5: The transceiver module retrieves the corresponding DIP information from the corresponding relationship based on the reported source IP.

[0089] Step 6: After finding the DIP information, repackage the data packet and send the new INT data packet to the corresponding DIP for processing.

[0090] Specifically, the steps are as follows:

[0091] Step a: The monitoring module obtains DIP information from the corresponding relationship.

[0092] Step b: The monitoring module sends heartbeat packets periodically based on the DIP information to detect the DIP.

[0093] Step c: When DIP detects anomalies multiple times, it informs the distribution algorithm module to adjust the corresponding relationship.

[0094] Step d: Provide command line for manual configuration and updates of the data center topology or DIP start / stop.

[0095] The planning module is specifically used for area division. Figure 2 Taking the network shown as an example, the regions are divided for aggregation layer switches and edge layer switches, and aggregation layer switches and core layer switches. For details, please refer to [reference needed]. Figure 4 , Figure 5That is, for the core layer and aggregation layer, all core layer switches and their connected aggregation layer switches within a set are grouped into one region. For the aggregation layer and edge layer, a pod is grouped into one region. After dividing the Layer 2 connected regions, the number of switches in these regions may still be relatively large. Therefore, these Layer 2 connected regions are further subdivided. Otherwise, the total length of the probe packets will be too large, which will seriously affect the timeliness of the probe results. Moreover, considering the packet length, this is not feasible. Therefore, in order to reduce the number of port information that needs to be collected for each probe packet and control the length of the probe packets, each region needs to be further divided. Therefore, planning a minimum division specification can reduce the length of the probe path. The minimum division specification is the "2×2" specification described in the above embodiment. Thus, the entire network can be divided into multiple "2×2" regions. When the planning module performs path planning, it can follow the... Figure 4 as well as Figure 5 conduct.

[0096] As can be seen, by leveraging the characteristics of Clos network topologies such as fat trees, the three-layer network structure is divided into multiple two-layer network regions, and within each set or pod's two-layer region, a further "2×2" minimum probe unit is defined. Based on the characteristics of Eulerian circuits and the topological storage structure, path planning for each region can be quickly completed through permutation and combination algorithms, ultimately achieving distributed data acquisition across the entire data center network and improving data acquisition efficiency.

[0097] To facilitate area division, the control terminal in this embodiment is configured as follows: Figure 3 The structure shown records network topology information. Specifically, it stores switch interconnection data according to the dimensions of sets and pods. Specifically, it iterates through all core layer switches according to the set dimension, storing switch information in random order for each set, resulting in set C. Then, iterates through C to find the aggregation layer switches connected to each set based on the information of the first switch in C, storing these connections according to the pod dimension, resulting in set A. Based on the information of the first switch in A within each pod, it randomly stores the edge layer switches connected to each pod, resulting in set E. Figure 3 The data structure shown can facilitate updates for INT packet distribution, source IP changes caused by network topology changes, and the scalability of the analysis server.

[0098] Initially, the source IPs are evenly distributed to each analysis server according to the number of DIPs, and then... Figure 6The data structure shown stores the mapping between DIPs and source IPs. Therefore, content reported by the same source IP is always sent to its unique corresponding DIP. When the source IP or DIP changes, the previous mapping is adjusted to achieve load balancing. It is particularly important to note that when a DIP fails, the source IP corresponding to that DIP is moved to another DIP without affecting the processing of other probe packets.

[0099] The interaction module provides external interaction interfaces (such as controller, manual command line configuration, new DIP online interaction, etc.) to realize the creation, deletion and query operations of DIPs. After creating or deleting a DIP, the distribution algorithm is called to update the corresponding relationship.

[0100] The transceiver module receives INT data packets, retrieves the corresponding DIP from the mapping relationship based on the source IP address in the packet, re-encapsulates the INT data packets, and sends them to the corresponding DIP.

[0101] The monitoring module sends heartbeat packets to each analysis server at regular intervals. If an analysis server does not respond to the heartbeat packet normally, it indicates that there may be a problem with the analysis server. After multiple retries still fail, the current analysis server is considered unavailable, and its DIP is sent to the distribution algorithm to update the correspondence.

[0102] As can be seen, based on the principle of "INT packets reported from the same source IP are sent to the same analysis server," distributed processing of data across the entire data center network can be achieved, providing architectural support for subsequent in-depth data analysis (such as integration with AI). Simultaneously, when an analysis server experiences a problem, the principle of "minimizing impact" is adopted, only transferring INT packets that should have been reported to that server to other analysis servers for processing. Other INT packets reported to functioning analysis servers remain unaffected, improving system robustness.

[0103] Furthermore, in this embodiment, any expansion of the network topology or addition / removal of analysis servers can be dynamically handled without stopping the running network probing system, demonstrating excellent scalability. This embodiment is applicable to regular topologies similar to fat tree structures. When the network topology changes, the storage topology only needs incremental updates, ensuring the efficiency of system operation and algorithm execution.

[0104] As can be seen, this embodiment, based on in-band network telemetry technology and the regional characteristics of data center networks, achieves detection coverage of all ports of all switches in the entire network, and plans detection paths by region before detection. In each round of detection, it ensures that the detection area covers all ports of all switches in the entire network, and ensures that each switch port is detected only once; the planned detection path length is as consistent as possible, and the path is not too long to ensure the timeliness of detection and processing, ultimately achieving full network coverage and zero-redundancy detection in the data center. The detection system provided in this embodiment only needs to interact with the controller of the data center network and various analysis servers to realize functions such as data center topology data acquisition, detection path planning, and dynamic loading of analysis servers. The entire process does not require additional configuration of third-party plugins or middleware, and can achieve lightweight deployment. Therefore, this embodiment, based on the concepts of in-band network telemetry technology, distributed data acquisition, and distributed data analysis, separates detection path planning and network data analysis from the controller end, providing a complete data center network monitoring system for Clos network topology.

[0105] The following describes a network detection device provided in an embodiment of this application. The network detection device described below and the network detection method described above can be referred to each other.

[0106] See Figure 8 As shown in the figure, this application discloses a network detection device, including:

[0107] The construction module 801 is used to construct area probe packets corresponding to multiple network regions; wherein, the data center network is divided into multiple network regions according to a preset network topology size.

[0108] The detection module 802 is used to send the detection packets of each region to the corresponding network region, so that multiple network regions can use the corresponding region detection packets to perform network detection on the detection path in their own region and obtain detection response packets;

[0109] The determination module 803 is used to acquire probe packets from multiple network regions and determine the destination node corresponding to each probe packet;

[0110] The distribution module 804 is used to send probe packets from multiple network areas to the destination node so that the destination node can analyze the probe packets it has received.

[0111] In one specific implementation, the construction module is specifically used for:

[0112] For each network region, construct a region probe packet carrying the region identifier of the current network region;

[0113] Accordingly, the detection module is specifically used for:

[0114] Each area probe packet is sent to the corresponding network area according to the area identifier.

[0115] In one specific implementation, the determining module is specifically used for:

[0116] The source IP address is extracted from each probe packet, and the node identifier of the destination node corresponding to each source IP address is obtained by querying a preset correspondence table, so as to determine the destination node corresponding to each probe packet.

[0117] In one specific implementation, the distribution module is specifically used for:

[0118] When probe packets from multiple network regions correspond to at least two destination nodes, the probe packets from the multiple network regions are distributed to at least two destination nodes so that at least two destination nodes can analyze the probe packets they receive.

[0119] In one specific implementation, it further includes:

[0120] The destination node monitoring module is used to periodically send heartbeat packets to each node in the distributed system when each destination node is a node in the distributed system. If any node in the distributed system is determined to be faulty based on the heartbeat packets, the module queries the node identifier of the faulty node in the preset correspondence table, unbinds the found node identifier from the corresponding source IP address, and establishes a correspondence between the unbound source IP address and the node identifier of the non-faulty node in the distributed system.

[0121] In one specific implementation, a partitioning module is also included, used to partition the data center network to obtain multiple network regions;

[0122] The module division is specifically used for:

[0123] Obtain network topology information for the data center network;

[0124] The data center network is divided into multiple network regions based on network topology information and preset network topology size, so that the network devices and detection paths in each network region tend to be consistent.

[0125] In one specific implementation, it includes a generation module for generating network topology information;

[0126] The generation module is specifically used for: if the data center network is a fat tree structure, recording the network devices in the core layer of the fat tree structure to obtain set dimension information; each set dimension information records the set identifier, the name and port of the network device in the corresponding set, and the names of other devices connected to that port; based on any set dimension information, recording the network devices in the aggregation layer of the fat tree structure, and based on the network devices in the aggregation layer, recording the network devices in the edge layer to obtain pod dimension information; each pod dimension information records the pod identifier, the name and port of the network device in the corresponding pod, the names of other devices connected to that port, and the network layer identifier to which the network device belongs; merging all set dimension information and all pod dimension information to obtain network topology information.

[0127] In one specific implementation, it further includes:

[0128] The modification module is used to modify the area probe packet of any network area according to the modified network device if there is a modification to the network device in any network area.

[0129] Correspondingly, it also includes:

[0130] A new module is added to construct a region probe packet for a newly added network region in the data center network and determine the destination node corresponding to the probe return packet of the newly added network region.

[0131] For more detailed information on the working process of each module and unit in this embodiment, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0132] As can be seen, this embodiment provides a network detection device that can reduce information redundancy in in-band network telemetry and improve the analysis efficiency of detection return packets.

[0133] The following describes an electronic device provided in an embodiment of this application. The electronic device described below can be referred to in conjunction with the network detection method and apparatus described above.

[0134] See Figure 9 As shown in the figure, an embodiment of this application discloses an electronic device, including:

[0135] Memory 901 is used to store computer programs;

[0136] Processor 902 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.

[0137] The following describes a readable storage medium provided in an embodiment of this application. The readable storage medium described below can be referred to in conjunction with the network detection method, apparatus and device described above.

[0138] A readable storage medium is provided for storing a computer program, wherein the computer program, when executed by a processor, implements the network detection method disclosed in the foregoing embodiments. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0139] The terms “first,” “second,” “third,” “fourth,” etc., used in this application (if applicable) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, or apparatus that includes a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, or apparatus.

[0140] It should be noted that the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.

[0141] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0142] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of readable storage medium known in the art.

[0143] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A network detection method, characterized in that, include: Construct region detection packets corresponding to multiple network regions; wherein, the multiple network regions are obtained by dividing the data center network according to a preset network topology size. Each region probe packet is sent to its corresponding network region, so that each of the multiple network regions can use the corresponding region probe packet to perform network probe on the probe path within its own region and obtain probe return packets; wherein, the number of network devices and the number of probe paths are equal in each network region, and the lengths of different probe paths in different network regions or different probe paths in the same network region are equal. The probe packets from the multiple network regions are acquired, and the destination node corresponding to each probe packet is determined. All probe packets are evenly distributed to the destination nodes. The construction rules and strategies for the regional probe packets corresponding to different network regions are consistent. The number, components, and analysis strategies of the probe packets from different network regions are the same. The probe response packets of the multiple network regions are sent to the destination node so that the destination node can analyze the probe response packets it has received. When a problem occurs at a destination node, the principle of minimizing the impact is adopted, and the probe packets that should have been reported to that destination node are transferred to other destination nodes for processing. The step of dividing the data center network into multiple network regions according to a preset network topology includes: Obtain the network topology information of the data center network; Based on the network topology information and the preset network topology size, the data center network is divided into multiple network regions so that the network devices and detection paths in each network region tend to be consistent. The probe packets from the plurality of network regions correspond to at least two destination nodes; Accordingly, sending the probe response packets of the multiple network regions to the destination node so that the destination node can analyze the probe response packets it has received includes: The probe packets from the plurality of network regions are distributed to the at least two destination nodes, so that the at least two destination nodes can analyze the probe packets they receive.

2. The method according to claim 1, characterized in that, The construction of region probe packets corresponding to multiple network regions includes: For each network region, construct a region probe packet carrying the region identifier of the current network region; Accordingly, sending the probe packets for each region to the corresponding network region includes: Each area probe packet is sent to the corresponding network area according to the area identifier.

3. The method according to claim 1, characterized in that, The determination of the destination node corresponding to each probe return packet includes: The source IP address is extracted from each probe packet, and the node identifier of the destination node corresponding to each source IP address is obtained by querying a preset correspondence table, so as to determine the destination node corresponding to each probe packet.

4. The method according to claim 3, characterized in that, Also includes: The at least two destination nodes are nodes in a distributed system, and heartbeat packets are periodically sent to each node in the distributed system; If any node in the distributed system is determined to be faulty based on the heartbeat packet, the node identifier of the faulty node is queried in the preset correspondence table. After unbinding the found node identifier from the corresponding source IP address, a correspondence is established between the unbound source IP address and the node identifier of the non-faulty node in the distributed system.

5. The method according to claim 1, characterized in that, If the data center network is a fat tree structure, then the process of generating the network topology information includes: Record the network devices in the core layer of the fat tree structure to obtain set dimension information; each set dimension information record includes the set identifier, the name and port of the network device in the corresponding set, and the names of other devices connected to that port. Based on any set dimension information, network devices in the aggregation layer of the fat tree structure are recorded, and network devices in the edge layer are recorded based on the network devices in the aggregation layer to obtain pod dimension information; any pod dimension information records the pod identifier, the name and port of the network device in the corresponding pod, the name of other devices connected to the port, and the network layer identifier to which the network device belongs; By merging all set dimension information and all pod dimension information, the network topology information is obtained.

6. The method according to any one of claims 1 to 5, characterized in that, Also includes: If any network device in any network area has been modified, then the area probe packet for that network area is changed according to the modified network device. Accordingly, If a new network area is added to the data center network, a region probe packet is constructed for the new network area, and the destination node corresponding to the probe return packet of the new network area is determined.

7. A network detection device, characterized in that, include: A construction module is used to construct area detection packets corresponding to multiple network regions; wherein, the multiple network regions are obtained by dividing the data center network according to a preset network topology size. The detection module is used to send detection packets from each region to the corresponding network regions, so that the multiple network regions can use the corresponding region detection packets to perform network detection on the detection paths within their respective regions and obtain detection response packets; wherein, the number of network devices and the number of detection paths in each network region are equal, and the lengths of different detection paths in different network regions or different detection paths in the same network region are equal. The determination module is used to acquire the probe response packets of the multiple network regions and determine the destination node corresponding to each probe response packet; wherein, all probe response packets are evenly distributed to each destination node; the construction rules and strategies of the regional probe packets corresponding to different network regions are consistent; the number, components and analysis strategies of the probe response packets of different network regions are the same; The distribution module is used to send the probe response packets of the multiple network areas to the destination node, so that the destination node can analyze the probe response packets it has received; When a problem occurs at a destination node, the principle of minimizing the impact is adopted, and the probe packets that should have been reported to that destination node are transferred to other destination nodes for processing. A segmentation module is used to acquire network topology information of the data center network; based on the network topology information and a preset network topology size, the data center network is divided into multiple network regions so that the network devices and detection paths of each network region tend to be consistent; Specifically, the distribution module is used to: assign probe response packets from the multiple network regions to at least two destination nodes; and distribute the probe response packets from the multiple network regions to the at least two destination nodes so that the at least two destination nodes can analyze the probe response packets they have received.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the method as claimed in any one of claims 1 to 6.

9. A readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the method as described in any one of claims 1 to 6.

Images