A method, apparatus, device, and medium for detecting network topology.

Abstract

This application provides a method, apparatus, device, and medium for detecting network topology. The method includes: selecting multiple servers under test and multiple receiving servers from multiple servers, selecting one server under test and one receiving server, and controlling the server under test to inject traffic into the receiving server through a switch; acquiring outflow traffic information of the multiple servers under test and inflow traffic information of each port of the switch; and determining the connection relationship between the multiple servers under test and each port of the switch based on the outflow traffic information and the inflow traffic information. This method realizes topology detection based on traffic data analysis, without being limited by factors such as device protocols and security filtering rules. It can effectively make up for the shortcomings of protocol-based topology discovery methods, and is more convenient for analyzing service flow paths. By locating the root cause of traffic anomalies, fault location of service flow paths can be achieved.

Description

Technical Field

[0001] This application relates to the field of networking, specifically to a method, apparatus, device, and medium for detecting network topology. Background Technology

[0002] Fault management is a core function of network management. Accurate fault diagnosis and accurate fault location are of great significance for maintaining the normal operation of the network, and a complete network topology diagram is the basic guarantee for network fault location.

[0003] Automatic network topology discovery refers to the process of collecting topology information of each node in a network using gateway protocols or tools, and obtaining a complete network topology structure through topology generation algorithms. Currently, the main automatic network topology discovery methods include: SNMP-based topology discovery, ICMP-based topology discovery, OSPF-based topology discovery, and LLDP-based topology discovery.

[0004] However, all of the above methods are based on obtaining network and device information through a certain communication protocol for topology discovery, and each has its own advantages and disadvantages. In practice, factors such as device protocol incompatibility and security filtering rule restrictions often lead to insufficient completeness of network topology discovery. Summary of the Invention

[0005] In view of the above problems, embodiments of this application are proposed to provide a method, apparatus, device and medium for detecting network topology to overcome or at least partially solve the above problems.

[0006] To address the aforementioned problems, this application discloses a method for detecting network topology, wherein the network is equipped with switches and multiple servers connected to the switches, and the method includes:

[0007] Select multiple servers to be tested and multiple servers to receive traffic from multiple servers, and select one server to be tested and one server to receive traffic. Control the server to be tested to inject traffic into the server to receive traffic through the switch.

[0008] Obtain outbound traffic information from multiple servers under test and inbound traffic information from each port of the switch;

[0009] Based on the outflow and inflow traffic information, the connection relationships between multiple servers under test and each port of the switch are determined.

[0010] Optionally, outflow traffic information includes the historical average outflow traffic, and inflow traffic information includes the historical average inflow traffic. Based on each outflow and inflow traffic piece of information, the connection relationships between multiple servers under test and each port of the switch are determined, including:

[0011] Calculate the mean deviation between the average historical outflow and the average historical inflow, and determine the connection relationship between multiple servers under test and each port of the switch based on the mean deviation.

[0012] Optionally, the outflow traffic information also includes the total outflow traffic value, and the inflow traffic information also includes the total inflow traffic value. Based on the mean deviation, the connection relationship between multiple servers under test and each port of the switch is determined, including:

[0013] When the mean deviation is less than or equal to the reference threshold, the total deviation between the total outflow and the total inflow is calculated, and the connection relationship between the multiple servers under test and each port of the switch is determined based on the total deviation.

[0014] Optionally, based on the total deviation, the connection relationships between multiple servers under test and each port of the switch can be determined, including:

[0015] The target total value deviation is determined from the various total value deviations, and the test server and switch ports corresponding to the target total value deviation are determined to be directly connected.

[0016] Optionally, the target total deviation is the total deviation with the smallest value among all total deviations.

[0017] Optionally, calculating the total deviation between the total outflow and the total inflow includes:

[0018] Determine the time of the flow change, and calculate the total deviation between the total outflow and the total inflow during the time of the change.

[0019] Optionally, obtaining outbound traffic information from multiple servers under test and inbound traffic information from each port of the switch includes:

[0020] Obtain the mutation nodes corresponding to traffic mutations on multiple servers under test, and determine the outflow traffic value and outflow timestamp corresponding to each mutation node;

[0021] Based on the outflow value and outflow timestamp, determine the total outflow value within the abrupt change period;

[0022] Based on the outflow timestamp, determine the inflow traffic value and inflow timestamp for each mutation node corresponding to each port of the switch;

[0023] Based on the inflow flow value and the inflow timestamp, determine the total inflow flow value within the abrupt change period.

[0024] Optionally, obtain the mutation nodes corresponding to the traffic mutations occurring on each server port, and determine the outflow traffic value and outflow timestamp corresponding to each mutation node, including:

[0025] Obtain the mutation nodes corresponding to the traffic mutations of multiple servers under test, and determine the index list corresponding to each mutation node;

[0026] Based on the index list, determine the outflow value and outflow timestamp corresponding to each mutation node.

[0027] Optionally, after controlling the server under test to inject traffic into the receiving server through the switch, the method further includes:

[0028] Remove the server under test from the list of servers under test and select a new server under test.

[0029] Optionally, before obtaining the outflow traffic information of multiple servers under test ports and the inflow traffic information of each port of the switch, the method further includes:

[0030] Filter non-physical ports.

[0031] Optionally, before obtaining the outflow traffic information of multiple servers under test ports and the inflow traffic information of each port of the switch, the method further includes:

[0032] Calculate the cumulative inflow traffic to each port of the switch. If the cumulative inflow traffic is less than a preset threshold, it is determined that there is no outflow traffic into the server under test at that switch port.

[0033] Optionally, after determining that there is no outgoing traffic flowing into the server under test through the switch port, the method further includes:

[0034] Exclude that switch port.

[0035] This application also discloses a network topology detection device, in which switches and multiple servers connected to the switches are deployed in the network. The device includes:

[0036] The injection traffic control module is used to select multiple servers under test and multiple receiving servers from multiple servers, and select one server under test and one receiving server, and control the server under test to inject traffic into the receiving server through the switch.

[0037] The traffic information acquisition module is used to acquire outflow traffic information from multiple servers under test and inflow traffic information from each port of the switch.

[0038] The connection relationship determination module is used to determine the connection relationship between multiple servers under test and each port of the switch based on the outflow and inflow traffic information.

[0039] This application also discloses an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the network topology detection method described above.

[0040] This application also discloses a non-volatile readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the network topology detection method described above.

[0041] The embodiments of this application have the following advantages:

[0042] In this embodiment, multiple servers under test and multiple receiving servers are selected from multiple servers. One server under test and one receiving server are selected, and the server under test is controlled to inject traffic into the receiving server through a switch. Then, the outflow traffic information of multiple servers under test and the inflow traffic information of each port of the switch are obtained. Finally, based on the outflow traffic information and the inflow traffic information, the connection relationship between multiple servers under test and each port of the switch is determined. This realizes topology detection based on traffic data analysis. It is not limited by factors such as device protocols and security filtering rules. It can effectively make up for the shortcomings of protocol-based topology discovery methods. Moreover, it is easier to analyze the business flow path. By locating the root cause of traffic anomalies, the fault location of the business flow path can be achieved. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating the steps of an embodiment of a network topology detection method according to this application;

[0044] Figure 2 This is a schematic diagram of the network structure in an embodiment of this application;

[0045] Figure 3 This is a flowchart illustrating the steps of another embodiment of the network topology detection method of this application;

[0046] Figure 4 This is a traffic diagram in another embodiment of the network topology detection method of this application;

[0047] Figure 5 This is a schematic diagram of an embodiment of a network topology detection system according to this application;

[0048] Figure 6 This is a flowchart illustrating an embodiment of a network topology detection system according to this application;

[0049] Figure 7 This is a structural block diagram of an embodiment of a network topology detection device according to this application. Detailed Implementation

[0050] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] Currently, the main methods for automatic network topology discovery include:

[0052] (1) Topology discovery based on SNMP

[0053] SNMP (Simple Network Management Protocol) is an application layer protocol encapsulated in UDP (User Datagram Protocol). SNMP-based network topology discovery is highly efficient, but access to the MIB (Management Information Base) may be restricted, thus this method has certain limitations.

[0054] (2) ICMP-based topology discovery

[0055] ICMP (Internet Control Message Protocol) is a connectionless network layer protocol encapsulated in IP (Internet Protocol) messages. It is mainly used to transmit error control messages between source hosts, destination hosts, and intermediate routers. ICMP has two important applications: one is in Ping tools (Packet Internet Groper, an Internet packet explorer used to test network connectivity), and the other is in Traceroute tools (network monitoring tools used to monitor all routing nodes between a source host and a destination host). ICMP-based topology discovery has no special requirements for intermediate network devices and has a wide range of applications, but its drawback is low detection efficiency.

[0056] (3) Topology discovery based on ARP

[0057] ARP (Address Resolution Protocol) is a TCP / IP protocol (Transmission Control Protocol / Internet Protocol, a protocol suite that enables information transmission between multiple different networks) that obtains the physical address from the IP address. It is a stateless protocol encapsulated in Ethernet data frames, and its main function is to translate network IP addresses into physical MAC addresses (Media Access Control Addresses). Almost all network devices support this protocol and maintain an ARP table locally that records all active devices in the local area network. ARP-based topology discovery is highly efficient, but it can only be applied to local area networks, and due to the delay in ARP table recording, it cannot discover network devices in a timely manner.

[0058] (4) OSPF-based topology discovery

[0059] OSPF (Open Shortest Path First, a link-state routing protocol for Internet Protocol (IP) networks) is a link-state protocol encapsulated in IP packets. OSPF-based topology discovery is a passive topology discovery method that uses information from communication between probe hosts and routers to construct the network topology. This method is efficient, but it can only perform topology discovery within a certain range, and it is only effective for routers that support the OSPF protocol. The algorithm complexity is also relatively high.

[0060] (5) Topology discovery based on LLDP

[0061] LLDP (Link Layer Discovery Protocol) is a neighbor discovery protocol that defines a standard method for Ethernet network devices to announce their existence to other nodes in the network and store discovery information for each neighboring device. LLDP information is transmitted periodically and retained for a certain period of time. The information is stored in the LLDP MIB database, which can be retrieved using the SNMP protocol. This method is suitable for physical topology discovery, but LLDP information is time-sensitive and only valid for devices that support the LLDP protocol.

[0062] However, all of the above methods are based on obtaining network and device information through a certain communication protocol for topology discovery, and each has its own advantages and disadvantages. In practice, factors such as device protocol incompatibility and security filtering rule restrictions often lead to insufficient completeness of network topology discovery. Based on this, this application provides a method, apparatus, device and medium for detecting network topology structure to make up for the shortcomings of the above-mentioned methods for topology discovery based on obtaining network and device information through communication protocols.

[0063] The embodiments of this application are further described below:

[0064] Reference Figure 1 This diagram illustrates a flowchart of an embodiment of a network topology detection method according to this application. Figure 2 As shown, the network is equipped with switches and multiple servers connected to the switches. The method may include the following steps:

[0065] Step 101: Select multiple servers to be tested and multiple receiving servers from multiple servers, and select one server to be tested and one receiving server. Control the server to be tested to inject traffic into the receiving server through the switch.

[0066] When it is necessary to determine the network topology, select multiple servers under test and multiple receiving servers from multiple servers, and select one server under test and one receiving server. Control the server under test to inject traffic into the receiving server through the switch until all servers have initiated the operation of injecting traffic.

[0067] In some embodiments of this application, after step 101, the method may further include the following steps:

[0068] Remove the server under test from the list of servers under test and select a new server under test.

[0069] After controlling the server under test to inject traffic into the receiving server through the switch, the server under test that has completed the traffic injection operation can be removed from the multiple servers under test, and a new server under test that has not performed the traffic injection operation can be selected, so as to control the newly selected server under test to inject traffic into the receiving server through the switch.

[0070] Step 102: Obtain outbound traffic information from multiple servers under test and inbound traffic information from each port of the switch.

[0071] After controlling all servers to complete the traffic injection operation, the outflow traffic information of all servers under test and the inflow traffic information of each port of the switch are obtained, so as to perform traffic data analysis and determine the network topology.

[0072] In some embodiments of this application, prior to step 102, the method may further include the following steps:

[0073] Filter non-physical ports.

[0074] Before acquiring outbound traffic information from all servers under test and inbound traffic information from each port of the switch, non-physical ports can be filtered to avoid data interference caused by acquiring data from non-physical ports.

[0075] In some embodiments of this application, prior to step 102, the method may further include the following steps:

[0076] Calculate the cumulative inflow traffic to each port of the switch. If the cumulative inflow traffic is less than a preset threshold, it is determined that there is no outflow traffic into the server under test at that switch port.

[0077] Before acquiring outbound traffic information of all servers under test and inbound traffic information of each port of the switch, the cumulative sum of inbound traffic of each port of the switch can be calculated first. When the cumulative sum of inbound traffic is less than a preset threshold, it is determined that there is no outbound traffic flowing into the server under test on that port of the switch, thereby avoiding data acquisition of invalid ports.

[0078] In some examples of this application, after determining that there is no outflow traffic into the server under test via the switch port, the method may further include the following steps:

[0079] Exclude that switch port.

[0080] Once an invalid port is identified, it can be excluded from the list of objects from which data is to be retrieved, thus preventing data retrieval from that invalid port during the data retrieval process.

[0081] Step 103: Based on the outflow and inflow information, determine the connection relationship between the multiple servers under test and each port of the switch.

[0082] After obtaining the outflow and inflow traffic information, the connection relationship between multiple servers under test and each port of the switch can be determined based on the outflow and inflow traffic information.

[0083] In this embodiment, multiple servers under test and multiple receiving servers are selected from multiple servers. One server under test and one receiving server are selected, and the server under test is controlled to inject traffic into the receiving server through a switch. Then, the outflow traffic information of multiple servers under test and the inflow traffic information of each port of the switch are obtained. Finally, based on the outflow traffic information and the inflow traffic information, the connection relationship between multiple servers under test and each port of the switch is determined. This realizes topology detection based on traffic data analysis. It is not limited by factors such as device protocols and security filtering rules. It can effectively make up for the shortcomings of protocol-based topology discovery methods. Moreover, it is easier to analyze the business flow path. By locating the root cause of traffic anomalies, the fault location of the business flow path can be achieved.

[0084] Reference Figure 3 This diagram illustrates a step flowchart of another embodiment of a network topology detection method according to this application. The network includes switches and multiple servers connected to the switches. The method may include the following steps:

[0085] Step 301: Select multiple servers to be tested and multiple receiving servers from multiple servers, and select one server to be tested and one receiving server. Control the server to be tested to inject traffic into the receiving server through the switch.

[0086] When it is necessary to determine the network topology, select multiple servers under test and multiple receiving servers from multiple servers, and select one server under test and one receiving server. Control the server under test to inject traffic into the receiving server through the switch until all servers have initiated the operation of injecting traffic.

[0087] Step 302: Obtain outflow traffic information of multiple servers under test and inflow traffic information of each port of the switch; wherein, the outflow traffic information includes the historical average outflow traffic and the inflow traffic information includes the historical average inflow traffic.

[0088] After controlling all servers to complete the traffic injection operation, the average historical outflow traffic of all servers under test and the average historical inflow traffic of each port of the switch are obtained, so as to perform traffic data analysis and determine the network topology.

[0089] Step 303: Calculate the mean deviation between the average historical outflow and the average historical inflow, and determine the connection relationship between the multiple servers under test and each port of the switch based on the mean deviation.

[0090] By calculating the mean deviation between the average historical outflow and the average historical inflow, the directly connected servers and switch ports can be determined based on the mean deviation, thereby determining the connection relationship between multiple servers under test and each port of the switch.

[0091] In some embodiments of this application, the outflow traffic information also includes the total outflow traffic value, and the inflow traffic information also includes the total inflow traffic value. Step 303, determining the connection relationship between multiple servers under test and each port of the switch based on the mean deviation, may include the following sub-steps:

[0092] Sub-step 11: When the mean deviation is less than or equal to the reference threshold, calculate the total deviation between the total outflow and the total inflow, and determine the connection relationship between the multiple servers under test and each port of the switch based on the total deviation.

[0093] When the mean deviation is less than or equal to the reference threshold, it can be determined that the historical outflow mean of the server under test and the historical inflow mean of the port are not significantly different. The server under test and the port may be directly connected. Therefore, it is necessary to further determine the server under test and the switch port that are directly connected based on the total deviation.

[0094] In some examples of this application, determining the connection relationship between multiple servers under test and each port of the switch based on the total deviation may include:

[0095] The target total value deviation is determined from the various total value deviations, and the test server and switch ports corresponding to the target total value deviation are determined to be directly connected.

[0096] By determining the target total value deviation from each total value deviation, and then determining the test server and switch ports corresponding to the target total value deviation, the combination of test server and switch ports most likely to have a direct connection can be determined.

[0097] In a specific embodiment, the target total deviation is the total deviation with the smallest value among all total deviations.

[0098] The smaller the deviation of a certain total value, the more likely there is a direct connection between the server under test and the switch port corresponding to that deviation. Therefore, the total value deviation with the smallest value among all deviations can be determined as the target total value deviation, and the server under test and switch port corresponding to the target total value deviation are determined to be directly connected.

[0099] In some embodiments of this application, calculating the total deviation between the total outflow and the total inflow in step 303 may include the following sub-steps:

[0100] Sub-step 21: Determine the time of the flow change, and calculate the total deviation between the total outflow and the total inflow during the flow change period.

[0101] When the server under test injects traffic into the receiving server through the switch, a traffic mutation will occur. By determining the time of the mutation and calculating the deviation between the total outflow traffic and the total inflow traffic during the mutation time, the directly connected server under test and switch ports can be accurately identified.

[0102] In some examples of this application, step 302 may include the following sub-steps:

[0103] Sub-step 31: Obtain the mutation nodes corresponding to the traffic mutations of multiple servers under test, and determine the outflow traffic value and outflow timestamp corresponding to each mutation node.

[0104] By obtaining the mutation nodes corresponding to traffic mutations on multiple servers under test, the outflow traffic value and outflow timestamp corresponding to each mutation node can be determined, so as to calculate the total outflow traffic value within the mutation time.

[0105] Sub-step 32: Based on the outflow value and outflow timestamp, determine the total outflow value within the abrupt change period.

[0106] After determining the outflow value and outflow timestamp corresponding to each mutation node, the total outflow value within the mutation time can be calculated based on the outflow value and outflow timestamp corresponding to each mutation node.

[0107] Sub-step 33: Based on the outflow timestamp, determine the inflow traffic value and inflow timestamp for each mutation node corresponding to each port of the switch.

[0108] After determining the outflow timestamp corresponding to the mutation node, the inflow traffic value and inflow timestamp of each port of the switch corresponding to each mutation node can be determined based on the outflow timestamp, so as to calculate the total inflow traffic value during the mutation time.

[0109] Sub-step 34: Based on the inflow flow value and the inflow timestamp, determine the total inflow flow value within the abrupt change period.

[0110] After determining the inflow traffic value and inflow timestamp for each mutation node corresponding to each port of the switch, the total inflow traffic value during the mutation period can be calculated based on the inflow traffic value and inflow timestamp for each mutation node.

[0111] In a specific embodiment, sub-step 31 may include:

[0112] Obtain the mutation nodes corresponding to the traffic mutations of multiple servers under test, and determine the index list corresponding to each mutation node; based on the index list, determine the outflow traffic value and outflow timestamp corresponding to each mutation node.

[0113] The following is an illustrative description of step 303:

[0114] Select a server i to be tested and calculate the historical average outbound traffic of server i. Next, select a port j on the switch and calculate the historical average inflow traffic to port j. Then through The mean deviation D was calculated. ij If D ij If D > 0.3, it indicates that the historical average outflow traffic of server i and the historical average inflow traffic of port j differ too much, confirming that server i and port j cannot have a direct connection. ij If the value is ≤0.3, it indicates that the historical average outflow traffic of server i and the historical average inflow traffic of port j are not significantly different. Server i and port j may be directly connected, which needs to be further determined.

[0115] Based on the amount of injected traffic, a reference value is set. The traffic values ​​of each server under test are then converted from 0 to 1, with values ​​less than the reference value recorded as 0 and values ​​greater than or equal to the reference value recorded as 1. This process transforms the traffic sequence of each server under test into a 01 string.

[0116] The mutations caused by injected traffic include two string patterns: "010" and "0110", such as... Figure 4 As shown, this application embodiment takes the "010" string pattern as an example, starting from the corresponding 01 string. The system matches the string "010" to obtain a list of indices for the corresponding "010" string. Based on this list, it retrieves the sequence of outflow traffic values ​​for the corresponding node on the server under test. outflow timestamp sequence

[0117] If D ij If the value is ≤0.3, then the timestamp sequence of the server i under test is used. Obtain the timestamp sequence of incoming traffic to port j. and inflow flow value sequence The outgoing timestamp sequence of server port i [t] i (n),t i (n+1),t i Taking (n+2) as an example, the corresponding outflow value sequence is [v i (n),vi (n+1),v i (n+2)], the inflow timestamp sequence corresponding to port j is [t j (m),t j (m+1),t j (m+2)], the corresponding inflow value sequence is [v j (m),v j (m+1),v j [(m+2)], where t j (m) represents the first traffic sequence of port j that is less than or equal to t. i The inflow timestamp of (n), t j (m+2) is the first value less than or equal to t. i (n+2) inflow timestamps.

[0118] Recalculate [t] j (m),t j The outflow S of server i under test within the time interval [m+2] i and the inflow S to port j j S i (n)=v i (n)*t i (n)-t j (m)]+v i (n+1)*[t i (n+1)-t i (n)]+v i (n+2)*[t j (m+2)-t i [(n+1)], S j (n)=v j (m+2)*t j (m+2)-t j (m+1)]+v j (m+1)*t j (m+1)-t j (m)], then through Calculate the deviation of the total value d ij (n).

[0119] Using the above method, the string The total deviation of the matched "010" pattern subsequence traffic is calculated one by one, and the combination of the test server and switch ports with a total deviation of less than a set threshold is obtained, thereby determining the network topology.

[0120] In this embodiment, multiple servers under test and multiple receiving servers are selected from multiple servers. One server under test and one receiving server are selected, and the server under test is controlled to inject traffic into the receiving server through a switch. Then, the outflow traffic information of multiple servers under test and the inflow traffic information of each port of the switch are obtained. The outflow traffic information includes the historical average outflow traffic, and the inflow traffic information includes the historical average inflow traffic. Finally, the mean deviation between each historical average outflow traffic and each historical average inflow traffic is calculated, and the connection relationship between multiple servers under test and each port of the switch is determined based on the mean deviation. This realizes topology detection based on traffic data analysis, without being limited by factors such as device protocols and security filtering rules. It can effectively make up for the shortcomings of protocol-based topology discovery methods, and it is more convenient to analyze the business flow path. By locating the root cause of traffic anomalies, the fault location of the business flow path can be achieved.

[0121] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0122] refer to Figure 5 This diagram illustrates a structural block diagram of an embodiment of a network topology detection system according to this application. The system may include the following modules:

[0123] The traffic management module is responsible for filtering and obtaining the required historical traffic sampling data from the monitoring server.

[0124] The traffic injection module is responsible for deploying traffic injection scripts on physical servers and monitoring the remote execution capabilities of the scripts via the API (Application Program Interface).

[0125] The port filtering module is responsible for performing preliminary filtering of physical ports based on the port type and traffic volume of the switch.

[0126] The port direct connection analysis module is responsible for analyzing the filtered physical ports to determine the similarity between the outflow traffic of each port of the switch and the inflow traffic of each physical server, thereby determining whether there is a direct connection between the switch port and the server.

[0127] The following describes the workflow of the network topology detection system embodiment described above:

[0128] like Figure 2 As shown, a monitoring system (such as Zabbix Server or ZabbixAgent) is deployed on four physical servers. Monitoring items are configured for the inbound and outbound traffic of the four physical servers through automatic network card discovery. The inbound and outbound traffic of each port of the 10 Gigabit switch SW1 is collected through the online Zabbix monitoring system. The traffic collection time interval of the switch port is 5 minutes, and the sampled data is the average value of the traffic change within 5 minutes.

[0129] Referring to Table 1, the actual direct connection relationship between the ports of the four physical servers and switch SW1 is shown.

[0130]

[0131] Table 1

[0132] Referring to Table 2, the correspondence between the outflow monitoring items of the server port and the inflow monitoring items of the switch SW1 port is shown.

[0133]

[0134]

[0135] Table 2

[0136] Referring to Table 3, the correspondence between the inflow monitoring items of the server port and the outflow monitoring items of the switch SW1 port is shown.

[0137]

[0138]

[0139] Table 3

[0140] To obtain the relationship between all directly connected ports of the four physical servers and switch SW1, it is necessary to generate traffic packets between the four servers to obtain traffic monitoring data with significant changes.

[0141] The main operation process for traffic injection in this embodiment is as follows:

[0142] Execute the command "python runzxscript.py -c" in the jump server terminal.<agent_name> -s<server_ip> -n<network_traffic> In this context, "agent_name" represents the hostname of the server being monitored, i.e., the server that outputs traffic, "server_ip" represents the server that receives traffic, and "network_traffic" is used to adjust the size of the traffic packets.

[0143] The script runzxscript.py accesses the Zabbix Server to check if the script entry "makeflow_udp_client" exists. If it exists, it updates the corresponding "command" value; if it does not exist, it creates the script entry "makeflow_udp_client".

[0144] The makeflow.py script is executed on the server specified by "agent_name" to send traffic packets to the server specified by "server_ip", with a default duration of 20 seconds.

[0145] After the makeflow.py script finishes running, it returns the execution result to the jump server terminal.

[0146] Referring to Table 4, some traffic monitoring data for port 10GE1 / 0 / 30 of switch SW1 is given. It can be seen that the traffic increased significantly in the time interval of 1571743765s to 1571744360s.

[0147]

[0148]

[0149] Table 4

[0150] Referring to Table 5, partial outflow traffic data is given for port p4p2 of server SVR208, which is directly connected to port 10GE1 / 0 / 30 of switch SW1.

[0151] 28658 1571741258 536 28658 1571741558 536 28658 1571741858 536 28658 1571742158 536 28658 1571742458 536 28658 1571742758 536 28658 1571743058 536 28658 1571743358 536 28658 1571743658 536 28658 1571743958 536 28658 1571744258 1642176 28658 1571744558 536 28658 1571744858 536 28658 1571745158 536

[0152] Table 5

[0153] like Figure 6 As shown, the main steps of the workflow of the above-described network topology detection system embodiment include:

[0154] Step 1: Select any physical server in the target environment that is directly connected to the switch, and inject traffic of a preset duration and amount into another selected physical server.

[0155] Step 2: Use a monitoring system deployed in the target environment to obtain the inbound and outbound traffic of each port on the switch and server.

[0156] Step 3: After a period of time, exclude the physical machines that have been selected to initiate injection traffic, and then select any new physical machine to repeat steps 1 and 2.

[0157] Step 4: Repeat step 3 until all physical machines in the target environment are covered.

[0158] Step 5: Based on the traffic sampling data, calculate and obtain the physical connection relationship between each port of the switch and the server.

[0159] Step 5 includes:

[0160] 1) Taking the calculation of outflow traffic from the SVR208 port of the server and inflow traffic from the SW1 port of the switch as an example, historical traffic data of a certain duration T is obtained from the database to complete the port filtering.

[0161] 2) Select port i of server SVR208 and calculate the historical average outflow traffic of port i.

[0162] 3) Based on the magnitude of the injected traffic, set a reference value and perform a 0-1 conversion on the traffic value of port i. Values ​​less than the reference value are recorded as 0, and values ​​greater than or equal to the reference value are recorded as 1, thus converting the traffic sequence of port i into a 01 string.

[0163] 4) The mutations caused by injected traffic include two string patterns: "010" and "0110". This embodiment takes the "010" string pattern as an example, starting from the corresponding 01 string... The function matches the string "010" to obtain a list of indices for the corresponding string "010".

[0164] Then, based on the index list, obtain the sequence of outflow traffic values ​​for the corresponding node of the server under test. outflow timestamp sequence

[0165] 5) Then, based on the index list, obtain the outflow traffic value sequence corresponding to port i. outflow timestamp sequence

[0166] 6) Select port j of switch SW1 and calculate the historical average inflow traffic to port j. and through Calculate the deviation from the mean D ij If D ij If the value is greater than 0.3, it means that the traffic of the two ports is not similar overall. Select the next server port and recalculate its historical outflow average and corresponding mean deviation.

[0167] 7) If D ij If the value is ≤0.3, then the timestamp sequence of the server i under test is used. Obtain the timestamp sequence of incoming traffic to port j. and inflow flow value sequence The outgoing timestamp sequence of server port i [t] i (n),t i (n+1),t i Taking (n+2) as an example, the corresponding outflow value sequence is [v i (n),v i (n+1),v i (n+2)], the inflow timestamp sequence corresponding to port j is [t j (m),t j (m+1),t j (m+2)], the corresponding inflow value sequence is [v j (m),v j (m+1),v j [(m+2)], where t j (m) represents the first traffic sequence of port j that is less than or equal to t. i The inflow timestamp of (n), t j (m+2) is the first value less than or equal to t. i (n+2) inflow timestamps.

[0168] 8) Calculate [t] j (m),t j The outflow S of server i under test within the time interval [m+2] i and the inflow S to port j j S i (n)=v i (n)*t i (n)-t j (m)]+v i (n+1)*[t i (n+1)-t i (n)]+v i (n+2)*[t j (m+2)-t i [(n+1)], S j (n)=v j (m+2)*[t j (m+2)-t j (m+1)]+v j (m+1)*t j (m+1)-t j (m)], then through Calculate the deviation of the total value d ij (n).

[0169] 9) Using the above method, process the string. The total deviation of the matched "010" pattern subsequence flow is calculated one by one.

[0170] 10) Obtain the combination of test server and switch ports with a total deviation of less than a set threshold, thereby determining the network topology.

[0171] Reference Figure 7 This diagram illustrates a structural block diagram of an embodiment of a network topology detection device according to this application. The network includes switches and multiple servers connected to the switches. The device may include the following modules:

[0172] The injection traffic control module 701 is used to select multiple servers under test and multiple receiving servers from multiple servers, and select one server under test and one receiving server to control the server under test to inject traffic into the receiving server through the switch.

[0173] The traffic information acquisition module 702 is used to acquire outflow traffic information from multiple servers under test and inflow traffic information from each port of the switch.

[0174] The connection relationship determination module 703 is used to determine the connection relationship between multiple servers under test and each port of the switch based on the outflow traffic information and the inflow traffic information.

[0175] In some embodiments of this application, the device may further include the following modules:

[0176] The removal and reselection module is used to remove the server under test from multiple servers under test and select a new server under test.

[0177] The non-physical port filtering module is used to filter non-physical ports.

[0178] The switch port screening module is used to calculate the cumulative sum of inflow traffic to each port of the switch. When the cumulative sum of inflow traffic is less than a preset threshold, it is determined that there is no outflow traffic into the server under test through that switch port.

[0179] The invalid port exclusion module is used to exclude the port of this switch.

[0180] In some embodiments of this application, the outflow information includes the historical average outflow, the inflow information includes the historical average inflow, and the connection relationship determination module 703 may include the following sub-modules:

[0181] The mean deviation calculation submodule is used to calculate the mean deviation between the mean of each historical outflow and the mean of each historical inflow, and to determine the connection relationship between multiple servers under test and each port of the switch based on the mean deviation.

[0182] In some examples of this application, the outflow information also includes the total outflow value, and the inflow information also includes the total inflow value. The mean deviation calculation submodule may include the following units:

[0183] The total deviation calculation unit is used to calculate the total deviation between the total outflow and the total inflow when the mean deviation is less than or equal to the reference threshold, and to determine the connection relationship between multiple servers under test and each port of the switch based on the total deviation.

[0184] In a specific embodiment, the total deviation calculation unit may include the following sub-units:

[0185] The target total value deviation subunit is used to determine the target total value deviation from the various total value deviations, and to determine that the test server and switch port corresponding to the target total value deviation are directly connected.

[0186] The flow change time determination subunit is used to determine the change time corresponding to the flow change and to calculate the total deviation between the total outflow and the total inflow during the change time.

[0187] In some embodiments of this application, the traffic information acquisition module 702 may include the following sub-modules:

[0188] The outflow traffic information submodule is used to obtain the mutation nodes corresponding to traffic mutations on multiple servers under test, and to determine the outflow traffic value and outflow timestamp corresponding to each mutation node.

[0189] The Total Outflow Value submodule is used to determine the total outflow value within a sudden change period based on the outflow value and the outflow timestamp.

[0190] The inflow traffic information submodule is used to determine the inflow traffic value and inflow timestamp for each port of the switch corresponding to each mutation node based on the outflow timestamp.

[0191] The Total Inflow Value submodule is used to determine the total inflow value within a sudden change period based on the inflow value and the inflow timestamp.

[0192] In some examples of this application, the outflow traffic information submodule may include the following units:

[0193] The index list determination unit is used to obtain the mutation nodes corresponding to traffic mutations on multiple servers under test, and to determine the index list corresponding to each mutation node.

[0194] The outflow information unit is used to determine the outflow value and outflow timestamp corresponding to each mutation node based on the index list.

[0195] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0196] This application also provides an electronic device that may include a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the network topology detection method described above.

[0197] This application also provides a non-volatile readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the network topology detection method described above.

[0198] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0199] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0201] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0202] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0203] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0204] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0205] The above provides a detailed description of a network topology detection method, apparatus, device, and medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting network topology, characterized in that, The network includes switches and multiple servers connected to the switches. The method includes: Multiple servers to be tested and multiple receiving servers are selected from the multiple servers. One server to be tested and one receiving server are selected, and the server to be tested is controlled to inject traffic into the receiving server through the switch. After the server to be tested injects traffic into the receiving server through the switch, a server to be tested that has not yet undergone traffic injection is selected, and the newly selected server to be tested is controlled to inject traffic into the receiving server through the switch, until all servers have initiated traffic injection operations. Obtain the outflow traffic information of the multiple servers under test and the inflow traffic information of each port of the switch. The outflow traffic information includes the historical average outflow traffic and the total outflow traffic. The inflow traffic information includes the historical average inflow traffic and the total inflow traffic. Calculate the mean deviation between the average historical outflow and the average historical inflow. When the mean deviation is less than or equal to a reference threshold, calculate the total deviation between the total outflow and the total inflow. Based on the total deviation, determine the connection relationship between the multiple servers under test and each port of the switch.

2. The method according to claim 1, characterized in that, The step of determining the connection relationship between the multiple servers under test and each port of the switch based on the total deviation includes: The target total value deviation is determined from each of the total value deviations, and the test server and switch port corresponding to the target total value deviation are determined to be directly connected.

3. The method according to claim 2, characterized in that, The target total value deviation is the total value deviation with the smallest value among all the total value deviations.

4. The method according to claim 1, characterized in that, The calculation of the total deviation between the total outflow value and the total inflow value includes: Determine the time of the flow mutation, and calculate the total deviation between the total outflow and the total inflow during the time of the mutation.

5. The method according to claim 4, characterized in that, The process of obtaining the outflow traffic information of the multiple servers under test and the inflow traffic information of each port of the switch includes: Obtain the mutation nodes corresponding to the traffic mutations of the multiple servers under test, and determine the outflow traffic value and outflow timestamp corresponding to each mutation node; Based on the outflow value and the outflow timestamp, determine the total outflow value within the abrupt change time period; Based on the outflow timestamp, determine the inflow traffic value and inflow timestamp for each port of the switch corresponding to each mutation node; Based on the inflow flow value and the inflow timestamp, the total inflow flow value within the abrupt change time period is determined.

6. The method according to claim 5, characterized in that, The step of obtaining the mutation nodes corresponding to the traffic mutations occurring on each server port, and determining the outflow traffic value and outflow timestamp corresponding to each mutation node, includes: Obtain the mutation nodes corresponding to the traffic mutations of the multiple servers under test, and determine the index list corresponding to each mutation node; Based on the index list, determine the outflow flow value and outflow timestamp corresponding to each mutation node.

7. The method according to any one of claims 1 to 6, characterized in that, After controlling the server under test to inject traffic into the receiving server through the switch, the method further includes: Remove the server under test from the list of servers under test and select a new server under test.

8. The method according to any one of claims 1 to 6, characterized in that, Before acquiring the outflow traffic information of the ports of the multiple servers under test and the inflow traffic information of each port of the switch, the method further includes: Filter non-physical ports.

9. The method according to any one of claims 1 to 6, characterized in that, Before acquiring the outflow traffic information of the ports of the multiple servers under test and the inflow traffic information of each port of the switch, the method further includes: Calculate the cumulative sum of inflow traffic to each port of the switch. If the cumulative sum of inflow traffic is less than a preset threshold, it is determined that there is no outflow traffic into the server under test at the switch port.

10. The method according to claim 9, characterized in that, After determining that there is no outflow traffic into the server under test at the switch port, the method further includes: Exclude the switch port.

11. A network topology detection device, characterized in that, The network includes switches and multiple servers connected to the switches. The device includes: The injection traffic control module is used to select multiple servers under test and multiple receiving servers from the multiple servers, and select one server under test and one receiving server, and control the server under test to inject traffic into the receiving server through the switch; wherein, after controlling the server under test to inject traffic into the receiving server through the switch, a server under test that has not yet performed a traffic injection operation is reselected, so as to control the reselected server under test to inject traffic into the receiving server through the switch, until all servers have initiated a traffic injection operation; The traffic information acquisition module is used to acquire the outflow traffic information of the multiple servers under test and the inflow traffic information of each port of the switch. The outflow traffic information includes the historical average outflow traffic and the total outflow traffic, and the inflow traffic information includes the historical average inflow traffic and the total inflow traffic. The connection relationship determination module is used to calculate the mean deviation between the average historical outflow traffic and the average historical inflow traffic, and when the mean deviation is less than or equal to a reference threshold, calculate the total deviation between the total outflow traffic and the total inflow traffic, and determine the connection relationship between the multiple servers under test and each port of the switch based on the total deviation.

12. An electronic device, characterized in that, It includes a processor, a storage device, and a computer program stored on the storage device and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 10.

13. A non-volatile readable storage medium, characterized in that, A computer program is stored on the non-volatile readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 10.

Images