A network storm source tracing method for power system local area network

Abstract

The present invention discloses a method for tracing the source of a network storm for a local area network of a power system, including: connecting to the mirror port of a core switch; counting the network traffic in a normal operating state and the traffic proportion of a single device in the local area network to determine whether a network storm occurs; using network loop detection and IP address conflict detection to locate the problem area. The method for tracing the source of a network storm for a local area network of a power system provided by the present invention can trace the source at the first time when the storm occurs, obtain the data of the entire switch dynamically through the mirror port, and the calculation result is more accurate and real-time; combining loop detection with IP address conflict detection can handle a variety of network storms, and has stronger applicability. The present invention can play a good auxiliary role in ensuring the safe and stable operation of the network.

Description

Technical Field

[0001] The present invention relates to the technical field of network source tracing, and in particular to a method for tracing the source of a network storm in a local area network of an electric power system. Background Art

[0002] In the local area network of the power system, due to network topology, software design, hardware failure or other reasons, network data packets are copied and propagated in large quantities in the local area network, resulting in network performance degradation or even network paralysis. This problem is called network storm and is a common problem in the network.

[0003] The existing technology mainly starts from preventing and suppressing the occurrence of network storms. The local area network is divided into network areas through virtual local area networks (VLANs). After the area division, the network equipment and topology structure in a single area become simple, thereby reducing the record and impact range of network storms. Once a network storm actually occurs, operation and maintenance personnel can usually only use network tool software to capture network packets and locate the source of the storm by analyzing the data packets. This method makes it difficult to trace the source of the storm in the first place. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by the present invention is: the existing technology mainly starts from preventing and suppressing the occurrence of network storms. When a network storm occurs, it is impossible to trace the source in the first time. The only way is to use network tool software to capture packets and locate the location of the storm source by analyzing the data packets.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for tracing the source of a network storm in a local area network of a power system, comprising:

[0008] Connect to the mirror port of the core switch;

[0009] Count the network traffic in normal operation and the traffic proportion of a single device in the LAN to determine whether a network storm has occurred;

[0010] Use network loop detection and IP address conflict detection to locate problem areas.

[0011] As a preferred solution of the network storm source tracing method for the power system local area network described in the present invention, wherein: the connection to the core switch mirror port includes opening a mirror port in the core switch in the existing local area network, using a network cable to connect the switch mirror port, and obtaining the traffic data of all ports of the entire switch through the mirror port.

[0012] As a preferred scheme of the method for tracing the source of a network storm for a local area network of a power system described in the present invention, wherein: the statistics of network traffic under normal operating conditions and the traffic proportion of a single device in the local area network include regularly sampling the total traffic data belonging to the switch, and performing traffic statistics on the devices connected to each port of the switch respectively, to obtain the network traffic under normal operating conditions and the traffic proportion of a single device in the local area network as a standard for measuring whether a network storm occurs.

[0013] As a preferred solution of the network storm source tracing method for the power system local area network described in the present invention, wherein: the network traffic and the proportion of the traffic of a single device in the local area network include: when the network traffic is greater than 1.5 times the dynamic threshold of the total traffic of the preset switch or the proportion of the traffic of a single device is greater than 30%, it is determined that a network storm has occurred.

[0014] As a preferred solution of the method for tracing the source of a network storm for a local area network of a power system described in the present invention, wherein: the occurrence of a network storm includes, when the network traffic statistics result reaches the judgment standard for the occurrence of a network storm, using network loop detection and IP address conflict detection in sequence to locate the problem area.

[0015] As a preferred solution of the network storm source tracing method for the power system local area network described in the present invention, wherein: the network loop detection includes: when a loop appears in the network, the broadcast information will be continuously forwarded and broadcast through the loop to form a network storm, and the network loop detection is used to check for network storm anomalies.

[0016] As a preferred solution of the method for tracing the source of a network storm for a local area network of a power system described in the present invention, the network loop detection also includes sending a certain number of broadcast packets to the local area network to be tested, capturing data packets, and obtaining the ratio of actual broadcast packets to detected broadcast packets per unit time based on the captured data packets. Once the detected packets are much larger than the actually sent packets, it can be determined that there is a loop in the local area network, and SNMP is used to query the ports with abnormal traffic in the local area network.

[0017] As a preferred solution of the network storm source tracing method for the power system local area network described in the present invention, wherein: the SNMP includes, using the SNMP protocol to read the ifInNUcastPkts object attribute of the device in the MIB-II object group, the attribute represents the number of input broadcast packets of the device, and the broadcast packet receiving rate of the port is obtained according to the change value of two ifInNUcastPkts. If the receiving rate is much higher than the value during normal operation, that is,

[0018]

[0019] This indicates that the device connected to the port contains a network storm source. Combined with the abnormal network traffic, the problematic device is located and provided to the operation and maintenance personnel in the form of an IP address plus a Mac address.

[0020] As a preferred solution of the method for tracing the source of a network storm for a local area network of a power system described in the present invention, the IP address conflict detection also includes using a passive detection method to capture non-free ARP messages of each port. When it is found that the source IP address in the non-free ARP message is the same as the IP address in the existing ARP table entry, and the source MAC address in the message is different from the MAC of the corresponding ARP table entry, it is determined that an IP address conflict exists in the device, and the message is provided to the operation and maintenance personnel in the form of an IP address plus a Mac address.

[0021] Beneficial effects of the present invention: The network storm source tracing method for the power system local area network provided by the present invention can trace the source of the storm as soon as it occurs, obtain the dynamic data of the entire switch through the mirror port, and the calculation result is more accurate and real-time; the loop detection is combined with the IP address conflict detection, and various network storms can be processed, which is more applicable. The present invention can play a good auxiliary role in ensuring the security and stable operation of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0023] Figure 1 An overall flow chart of a method for tracing the source of a network storm in a local area network of a power system provided by an embodiment of the present invention;

[0024] Figure 2A comparison chart of load balancing rates of multiple algorithms under the same task request in a network storm source tracing method for a power system local area network provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0026] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0027] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0028] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0029] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0030] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0031] Example 1

[0032] Reference Figure 1-2 , is an embodiment of the present invention, and provides a method for tracing the source of a network storm in a local area network of a power system, comprising:

[0033] S1: connected to the mirror port of the core switch;

[0034] Furthermore, connecting the mirror port of the core switch includes opening the mirror port in the core switch in the existing local area network, connecting the mirror port of the switch with a network cable, and obtaining the flow data of all ports of the entire switch through the mirror port.

[0035] It should be noted that when a network storm has not occurred, the network traffic data under the conditions of the LAN is obtained by statistically analyzing the total traffic data. At the same time, the traffic data of each device in the network is analyzed to obtain the traffic share of each device in the network. After a certain period of sampling, the network traffic range in the LAN under normal conditions and the traffic share data interval of each device under normal conditions are calculated based on samples of multiple time periods. Based on this data and a certain redundancy value, the traffic threshold standard for judging network storms is formed.

[0036] It should also be noted that in a long-term operating industrial network, the distribution of traffic is often relatively stable. Therefore, regular traffic data collection and slice analysis can more accurately obtain the normal operating status of the network environment, which can be used as a reference for subsequent analysis and judgment of abnormal traffic data.

[0037] S2: Count the network traffic in normal operation and the traffic proportion of a single device in the LAN to determine whether a network storm has occurred;

[0038] Furthermore, the total traffic data of the switch is sampled regularly, and the traffic statistics of the devices connected to each port of the switch are performed separately to obtain the network traffic under normal operating conditions and the traffic proportion of a single device in the LAN, which is used as a standard to measure whether a network storm has occurred.

[0039] It should be noted that a network storm is determined to have occurred when the network traffic is greater than 1.5 times the preset dynamic threshold of the total switch traffic or the traffic proportion of a single device is greater than 30%.

[0040] It should also be noted that when the network traffic is lower than the preset dynamic threshold of the total switch traffic, a network storm may also occur, but the probability is low. When the dynamic threshold is less than the overloaded ports, each port can occupy a larger cache to ensure cache utilization and data transmission speed. Therefore, the network traffic should be greater than the dynamic threshold of the total switch traffic. Experimental verification shows that when the network traffic exceeds 1.5 times the dynamic threshold of the total switch traffic, there is a greater probability of a network storm. Therefore, the network traffic is set to be greater than 1.5 times the dynamic threshold of the total switch traffic.

[0041] S3: Use network loop detection and IP address conflict detection to locate the problem area.

[0042] Furthermore, when the network traffic statistics result reaches the criterion for judging the occurrence of a network storm, network loop detection and IP address conflict detection are used in sequence to locate the problem area.

[0043] It should be noted that network loops and IP address conflicts are the most common and widespread causes of network storms. Network loops cause a rapid increase in duplicate messages in the network and eventually fill the entire channel; IP address conflicts will generate a large number of useless ARP messages due to the constant competition between conflicting devices for communication rights, squeezing out the transmission bandwidth of other key information data.

[0044] Furthermore, if a loop appears in the network, the broadcast information will be continuously forwarded and broadcast through the loop to form a network storm. Use network loop detection to troubleshoot network storm anomalies.

[0045] It should be noted that a certain number of broadcast packets are sent to the LAN to be tested, and data packets are captured. Based on the captured data packets, the ratio of actual broadcast packets to detected broadcast packets per unit time is obtained. Once the detected packets are much larger than the actual sent packets, it can be determined that there is a loop in the LAN, and SNMP is used to query the ports with abnormal traffic in the LAN.

[0046] It should also be noted that the ifInNUcastPkts object attribute of the device in the MIB-II object group is read using the SNMP protocol. This attribute represents the number of broadcast packets input to this device. The broadcast packet receiving rate of the port is calculated based on the change value of ifInNUcastPkts twice. If the receiving rate is much higher than the value during normal operation,

[0047]

[0048] This indicates that the device connected to this port contains a network storm source. Combined with the abnormal network traffic, the problematic device is located and provided to the operation and maintenance personnel in the form of IP address and Mac address.

[0049] Furthermore, when there is an IP address conflict in the local area network, the IP conflicting devices continue to compete and cause network oscillation. The local area network is filled with a large number of useless ARP packets, which triggers a network storm. IP address conflict detection is used to troubleshoot network storm anomalies.

[0050] It should be noted that the passive detection method is used to capture the non-free ARP packets of each port. When it is found that the source IP address in the non-free ARP packet is the same as the IP address in the existing ARP table entry, and the source MAC address in the packet is different from the MAC of the corresponding ARP table entry, it is determined that there is an IP address conflict in this device, and it is provided to the operation and maintenance personnel in the form of IP address plus Mac address.

[0051] Example 2

[0052] An embodiment of the present invention provides a method for tracing the source of a network storm in a local area network of a power system. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0053] MATLAB and CloudSim were used to evaluate the algorithm. The simulation was run in an environment with an Intel processor and 16GB RAM. The operating system used was 64-bit Windows 11. The MATLAB programming language system was used for simulation, connection, recording, and data distribution.

[0054] As shown in the table, there is a performance comparison between our invention and traditional technical solutions. Among them, the traditional technical solution takes preventive measures against network storms. The frequency of network storms in traditional technical solutions within 24 hours is low, but the traditional technical solution requires operation and maintenance personnel to capture packets after discovery. Analyzing the content of the data packet takes a lot of time and consumes manpower. Our invention uses network loop detection and IP address conflict detection to locate the problem area, and can accurately locate the two problems that easily cause network storms. It is more targeted and efficient. Traditional technology requires analysis of data packets, and the speed is slower than our invention.

[0055]

[0056] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for tracing the source of a network storm in a local area network of a power system, characterized in that: include: Connect to the mirror port of the core switch; Count the network traffic in normal operation and the traffic proportion of a single device in the LAN to determine whether a network storm has occurred; Use network loop detection and IP address conflict detection to locate problem areas; The connecting to the mirror port of the core switch includes opening a mirror port in the core switch in the existing local area network, connecting the mirror port of the switch with a network cable, and obtaining the flow data of all ports of the entire switch through the mirror port; The counting of network traffic in normal operation and traffic proportion of a single device in the local area network includes regularly sampling total traffic data belonging to the switch and performing traffic statistics on devices connected to each port of the switch, to obtain network traffic in normal operation and traffic proportion of a single device in the local area network as a criterion for measuring whether a network storm occurs; The network traffic and the proportion of traffic of a single device in the local area network include: when the network traffic is greater than 1.5 times the dynamic threshold of the total traffic of the preset switch or the proportion of traffic of a single device is greater than 30%, it is determined that a network storm has occurred; The occurrence of a network storm includes, when the network traffic statistics result reaches the judgment standard of the occurrence of a network storm, using network loop detection and IP address conflict detection to locate the problem area in sequence; The network loop detection includes: when a loop occurs in the network, broadcast information will be continuously forwarded and broadcasted through the loop to form a network storm, and the network loop detection is used to troubleshoot network storm anomalies; The network loop detection also includes sending a certain number of broadcast packets to the LAN to be tested, capturing data packets, and obtaining a ratio of actual broadcast packets to detected broadcast packets per unit time based on the captured data packets. Once the detected packets are much larger than the actually sent packets, it can be determined that there is a loop in the LAN, and SNMP is used to query the port with abnormal traffic in the LAN. The SNMP includes using the SNMP protocol to read the ifInNUcastPkts object attribute of the device in the MIB-II object group, the attribute represents the number of input broadcast packets of the device, and the broadcast packet receiving rate of the port is calculated according to the change value of two ifInNUcastPkts. If the receiving rate is much higher than the value during normal operation, This indicates that the device connected to the port contains a network storm source. The faulty device is located by combining the abnormal network traffic and provided to the operation and maintenance personnel in the form of IP address and Mac address. The IP address conflict detection includes: when there is an IP address conflict in the local area network, the IP conflicting devices continue to compete to cause network oscillation, and the local area network is filled with a large number of useless ARP messages, which triggers a network storm, using IP address conflict detection to troubleshoot network storm anomalies; The IP address conflict detection also includes using a passive detection method to capture non-free ARP messages from each port. When it is found that the source IP address in the non-free ARP message is the same as the IP address in the existing ARP table entry, and the source MAC address in the message is different from the MAC of the corresponding ARP table entry, it is determined that there is an IP address conflict in the device, and the message is provided to the operation and maintenance personnel in the form of IP address plus Mac address.

Images