A method and apparatus for determining a network topology map

Abstract

The application discloses a method and device for determining a network topology graph, wherein the method comprises the following steps: acquiring data flow information collected by N network devices in a target network, wherein the N network devices comprise a first network device, and the data flow information collected by the first network device is used for indicating a corresponding relationship between at least one media access control (MAC) address and at least one Internet protocol (IP) address; determining a topology graph corresponding to the first network device according to the corresponding relationship between the at least one MAC address and the at least one IP address; and determining a network topology graph of the target network according to topology graphs corresponding to the N network devices. The above method can improve the efficiency and accuracy of determining the network topology graph.

Description

A method and apparatus for determining network topology. Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and apparatus for determining a network topology. Background Technology

[0002] A network topology diagram is a graphical representation of the connections between network devices. It can be a star topology, ring topology, tree topology, etc. The network devices can include routers, switches, servers, and various terminal devices.

[0003] With the development of network technology, network topology diagrams are becoming increasingly important in network security. They can help identify and analyze potential security vulnerabilities, such as single points of failure, insecure connections, and unauthorized access paths. As a result, network administrators can better locate and resolve potential risks, take preventative measures, and reduce the risk of network attacks.

[0004] Currently, based on specified fields in the data traffic information collected by network devices, it is possible to determine the devices connected to the upstream and downstream levels of the network device. However, this method is affected by the number of network devices that can provide data traffic information, thus making it impossible to accurately determine the network topology of the target network. Summary of the Invention

[0005] This application provides a method and apparatus for determining a network topology map, used to determine the network topology map of a target network as completely as possible.

[0006] In a first aspect, embodiments of this application provide a method for determining a network topology map. This method can be executed by an apparatus for determining a network topology map. The method includes: acquiring data traffic information collected by N network devices in a target network, wherein the N network devices include a first network device, and the data traffic information collected by the first network device is used to indicate a correspondence between at least one Media Access Control (MAC) address and at least one Internet Protocol (IP) address, wherein the MAC address is the source MAC address of the data traffic flowing through the first network device, and the IP address is the source IP address of the data traffic flowing through the first network device; or the MAC address is the destination MAC address of the data traffic flowing through the first network device, and the IP address is the destination IP address of the data traffic flowing through the first network device; determining a topology map corresponding to the first network device based on the correspondence between the at least one MAC address and the at least one IP address; the topology map corresponding to the first network device includes at least the first network device and devices connected to the first network device; and determining a network topology map of the target network based on the topology maps corresponding to the N network devices; wherein N is a positive integer.

[0007] In one possible implementation, determining the topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address includes: if the at least one MAC address includes a first MAC address, and the first MAC address corresponds to at least two IP addresses, then determining that the device connected to the first network device includes a router.

[0008] In one possible implementation, determining the topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address includes: if the first network device is a router, and the at least one MAC address includes a second MAC address and a third MAC address, the IP address corresponding to the second MAC address is a first IP address, and the IP address corresponding to the third MAC address is a second IP address, then it is determined that the device connected to the first network device includes a switch.

[0009] In one possible implementation, determining the network topology of the target network based on the topology diagrams corresponding to the N network devices includes: the topology diagram corresponding to the first network device includes a first switch connected to the first network device, and the topology diagram corresponding to the second network device includes a second switch connected to the second network device; if the terminal devices connected to the first switch and the second switch are the same, then the first switch and the second switch are merged into one switch in the network topology diagram.

[0010] In one possible implementation, determining the network topology of the target network based on the topology diagrams corresponding to the N network devices includes: the topology diagram corresponding to the first network device includes a third switch connected to the first network device, and the topology diagram corresponding to the second network device includes a first router connected to the second network device; if the terminal device connected to the third switch is the same as that connected to the first router, then it is determined that the third switch is connected to the first router in the network topology diagram.

[0011] In one possible implementation, determining the network topology of the target network based on the topology diagrams corresponding to the N network devices includes: the topology diagram corresponding to the first network device includes a second router connected to the first network device, and the topology diagram corresponding to the second network device includes a third router connected to the second network device; if the terminal devices connected to the second router and the third router are the same, then it is determined that the second router and the third router are connected through a fourth switch in the network topology diagram.

[0012] Secondly, embodiments of this application provide an apparatus for determining a network topology map. The apparatus includes: an acquisition module, configured to acquire data traffic information collected by N network devices in a target network, wherein the N network devices include a first network device, and the data traffic information collected by the first network device is used to indicate the correspondence between at least one Media Access Control (MAC) address and at least one Internet Protocol (IP) address, wherein the MAC address is the source MAC address of the data traffic flowing through the first network device, and the IP address is the source IP address of the data traffic flowing through the first network device, or the MAC address is the destination MAC address of the data traffic flowing through the first network device, and the IP address is the destination IP address of the data traffic flowing through the first network device; a determination module, configured to determine the topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address; wherein the topology map corresponding to the first network device includes at least the first network device and devices connected to the first network device; and configured to determine the network topology map of the target network based on the topology maps corresponding to the N network devices; wherein N is a positive integer.

[0013] In one possible implementation, the determining module is further configured to determine that the device connected to the first network device includes a router if the at least one MAC address includes a first MAC address and the first MAC address corresponds to at least two IP addresses.

[0014] In one possible implementation, the determining module is further configured to determine that the device connected to the first network device includes a switch if the first network device is a router and the at least one MAC address includes a second MAC address and a third MAC address, the IP address corresponding to the second MAC address is a first IP address, and the IP address corresponding to the third MAC address is a second IP address.

[0015] In one possible implementation, the apparatus further includes a merging module, wherein the topology map corresponding to the first network device includes a first switch connected to the first network device, and the topology map corresponding to the second network device includes a second switch connected to the second network device; the merging module is used to merge the first switch and the second switch into a single switch in the network topology map if the terminal devices connected to the first switch and the second switch are the same.

[0016] In one possible implementation, the topology map corresponding to the first network device includes a third switch connected to the first network device, and the topology map corresponding to the second network device includes a first router connected to the second network device; the merging module is further configured to determine that the third switch is connected to the first router in the network topology map if the terminal device connected to the third switch is the same as that connected to the first router.

[0017] In one possible implementation, the topology map corresponding to the first network device includes a second router connected to the first network device, and the topology map corresponding to the second network device includes a third router connected to the second network device; the merging module is further configured to determine, if the terminal devices connected to the second router and the third router are the same, that the second router and the third router are connected through a fourth switch in the network topology map.

[0018] Thirdly, embodiments of this application also provide an apparatus for determining a network topology, including a memory and a processor, wherein the memory is used to store computer programs or instructions; and the processor is used to invoke the computer programs or instructions stored in the memory to execute the method as described in any possible implementation of the first aspect.

[0019] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when read and executed by a computer, cause the computer to perform a method as described in any possible implementation of the first aspect.

[0020] Fifthly, embodiments of this application provide a computer program product storing instructions that, when read and executed by a computer, cause the computer to perform a method as described in any possible implementation of the first aspect. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 is a schematic diagram of obtaining data traffic information according to an embodiment of the present invention;

[0023] Figure 2 is a flowchart illustrating a method for determining a network topology diagram according to an embodiment of the present invention.

[0024] Figure 3 is a schematic diagram of a first network device connecting to a router according to an embodiment of the present invention;

[0025] Figure 4 is a schematic diagram of a first network device connected to a switch according to an embodiment of the present invention;

[0026] Figure 5 is a schematic diagram of a first network device connecting to a terminal device according to an embodiment of the present invention;

[0027] Figure 6 is a schematic diagram of a network device topology diagram based on interface information provided in an embodiment of the present invention.

[0028] Figure 7 is a schematic diagram of a network topology diagram corresponding to a target network determined based on the relationship between switches according to an embodiment of the present invention.

[0029] Figure 8 is a schematic diagram of a network topology diagram for determining a target network based on the relationship between switches and routers, according to an embodiment of the present invention.

[0030] Figure 9 is a schematic diagram of a network topology diagram corresponding to a target network determined based on the relationship between routers according to an embodiment of the present invention.

[0031] Figure 10 is a schematic diagram of an internal module of the device for determining a network topology provided in an embodiment of the present invention;

[0032] Figure 11 is a schematic diagram of a device for determining a network topology provided in an embodiment of the present invention. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0034] With the development of communication technology, network topology diagrams are playing an increasingly important role in network security. Network administrators can use network topology diagrams to better locate and resolve potential problems and take corresponding measures in advance.

[0035] Currently, there are several ways to construct network topology maps, such as Address Resolution Protocol (ARP) scanning and NetFlow technology. Specifically, ARP scanning is a technique that obtains the Internet Protocol (IP) address and Media Access Control (MAC) address of devices within a local area network (LAN) by broadcasting ARP requests. It can be used to construct LAN topology maps, but it cannot work across subnets, so it is not suitable for constructing topology maps of large networks. Moreover, ARP scanning is susceptible to ARP spoofing attacks, affecting the accuracy of the constructed LAN topology map.

[0036] NetFlow technology is a network traffic analysis and monitoring technique that can be applied to intelligent network devices such as routers, switches, and firewalls. By collecting network traffic information entering and leaving network devices, NetFlow data for those devices can be obtained. In existing technologies, the next_hop field in NetFlow data can be used to directly construct the upstream and downstream network devices connected to the current network device. However, since the next_hop field only provides information about the upstream and downstream network devices, constructing the network topology based on the next_hop field becomes complex if the target network has a large number of devices. Furthermore, the next_hop field only provides the IP address of the next-hop router and cannot obtain information about switches, terminal devices, or other network devices. Therefore, a complete network topology cannot be constructed solely based on the next_hop field.

[0037] Based on this, embodiments of the present invention provide a method for determining a network topology map. According to the correspondence between MAC addresses and IP addresses in data traffic information, the network topology map of the target network can be determined more completely.

[0038] Figure 1 is a schematic diagram of obtaining data traffic information according to an embodiment of the present invention, including a terminal device and a network device. The terminal device and the network device can be connected communicatively through a network. The terminal device can be a computer or a server, and the network device can be a router, a switch, or a smart firewall. Optionally, the data traffic information can be obtained based on NetFlow data. Staff configure the NetFlow data to the network device through the terminal device, including configuring which fields the NetFlow data should include and which terminal device the NetFlow data should be sent to, so that the terminal device can obtain the data traffic information flowing through that network device. There can be multiple terminal devices and network devices; one terminal device can obtain NetFlow data from multiple network devices. Figure 1 illustrates a connection between only one terminal device and one network device. This application does not specifically limit the number of terminal devices and network devices.

[0039] Figure 2 is a flowchart illustrating a method for determining a network topology map according to an embodiment of the present invention. This flowchart can be executed by a device for determining the network topology map, which can be a terminal device that acquires NetFlow data. As shown in Figure 2, the process includes the following steps:

[0040] Step 201: The device for determining the network topology map obtains data traffic information collected by N network devices in the target network. The N network devices include a first network device. The data traffic information collected by the first network device is used to indicate the correspondence between at least one MAC address and at least one IP address.

[0041] For example, the target network is the network range for which the network topology map needs to be obtained, such as a floor, a building, or a community. The target network includes N network devices, where N is a positive integer. Network devices are devices that can obtain data traffic information, such as routers and switches.

[0042] The target network consists of N network devices, including the first network device. The NetFlow data collected by the first network device may include the following fields: src_addr (source IP address), dst_addr (destination IP address), src_mac (source MAC address), dst_mac (destination MAC address), next_hop (IP address of the next-hop router), input_snmp (Simple Network Management Protocol (SNMP) index of the input interface), and output_snmp (SNMP index of the output interface). A MAC address is a physical address stored in computer hardware and is a unique identifier for a network device's network interface card (NIC). An IP address is a logical address used in computer software to identify devices on the network.

[0043] A MAC address typically corresponds to a network device or an interface of a network device. Based on MAC addresses and IP addresses, a mapping relationship can be established between MAC addresses and IP addresses. One MAC address can correspond to one IP address or multiple IP addresses. If the MAC address is the source MAC address of the data traffic flowing through the first network device, then the IP address corresponding to the MAC address is the source IP address of the data traffic flowing through the first network device. If the MAC address is the MAC address of the data traffic flowing through the first network device, then the IP address corresponding to the MAC address is the destination IP address of the data traffic flowing through the first network device, and the MAC address and its corresponding IP address are addresses within the same data traffic stream.

[0044] For example, the data traffic flowing through the first network device can be obtained from the NetFlow data collected by the first network device. If the first network device collects three NetFlow data entries within a preset time period, each NetFlow data entry includes a source MAC address, a source IP address, a destination MAC address, and a destination IP address. In the first NetFlow data entry, the source MAC address is MAC1, and the source IP address is IP1; in the second NetFlow data entry, the source MAC address is MAC1, and the source IP address is IP2; in the third NetFlow data entry, the source MAC address is MAC1, and the source IP address is IP3. Then, there are a total of three IP addresses corresponding to the MAC address 1, namely IP1, IP2, and IP3, that is, one source MAC address corresponds to three source IP addresses.

[0045] Similarly, if the MAC address is the destination MAC address, then the IP address corresponding to the destination MAC address should be the destination IP address in the same NetFlow data as that destination MAC address. For example, if the first network device collects three NetFlow data within a preset time period, and the destination MAC address in the first NetFlow data is MAC4 and the destination IP address in the first NetFlow data is IP4; the destination MAC address in the second NetFlow data is MAC4 and the destination IP address in the second NetFlow data is IP5; and the destination MAC address in the third NetFlow data is MAC4 and the destination IP address in the third NetFlow data is IP6, then there are a total of three IP addresses corresponding to MAC4: IP4, IP5, and IP6. That is, one destination MAC address corresponds to three destination IP addresses.

[0046] In one possible implementation, if the first network device collects three NetFlow data entries within a preset time period, and the source MAC address in the first NetFlow data entry is MAC1, and the source IP address is IP1; the source MAC address in the second NetFlow data entry is MAC2, and the source IP address is IP2; and the source MAC address in the third NetFlow data entry is MAC3, and the source IP address is IP3, then the IP address corresponding to MAC1 is IP1; the IP address corresponding to MAC2 is IP2; and the IP address corresponding to MAC3 is IP3. That is, one source MAC address corresponds to one source IP address.

[0047] Similarly, determining the one-to-one correspondence between the destination MAC address and the destination IP address is similar to the method described above for determining the correspondence between the source MAC address and the source IP address, and will not be elaborated upon here.

[0048] Step 201: The device for determining the network topology map determines the topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address.

[0049] 1. Determine the network device topology based on the mapping between MAC addresses and IP addresses.

[0050] (1) One MAC address corresponds to at least two IP addresses.

[0051] For example, the multiple NetFlow data collected by the first network device include multiple MAC addresses, among which a first MAC address is included. If the first MAC address corresponds to at least two IP addresses, then it is determined that the device connected to the first network device includes a router. The first MAC address can be either a source MAC address or a destination MAC address.

[0052] Figure 3 is a schematic diagram of a first network device connected to a router according to an embodiment of the present invention. Using MAC1 as the source MAC address and MAC1 corresponding to IP1, IP2, and IP3 as an example, as shown in Figure 3, if the three NetFlow data collected by the first network device all have MAC1 as the source MAC address, then MAC1 corresponds to IP1, IP2, and IP3 respectively in the three NetFlow data streams. Based on the working principle of the router, after receiving a packet sent by the terminal device, the router can change the MAC address of the received packet to the router's own MAC address. Therefore, since the MAC addresses corresponding to the IP addresses of the three data streams are all the same MAC address, it can be inferred that MAC1 is the router's MAC address, IP1 is the IP address of the first terminal device, IP2 is the IP address of the second terminal device, and IP3 is the IP address of the third terminal device. The first network device is connected to the router in relation to the first terminal device, the second terminal device, and the third terminal device.

[0053] Similarly, if the three destination MAC addresses in the three NetFlow data collected by the first network device are all MAC4, and MAC4 corresponds to IP4, IP5 and IP6 respectively in the three NetFlow data, then it can be inferred that MAC4 is the MAC address of the router, and IP4, IP5 and IP6 are the IP addresses of the three terminal devices. The first network device is connected to the router with the terminal devices corresponding to IP4, IP5 and IP6 addresses.

[0054] (2) One MAC address corresponds to one IP address

[0055] For example, assuming the MAC address is the source MAC address, there are two cases where one MAC address corresponds to one IP address. The first case is that the multiple NetFlow data collected by the first network device includes multiple source MAC addresses, and each of the multiple source MAC addresses corresponds to one source IP address. The second case is that the multiple NetFlow data collected by the first network device includes only one source MAC address, and this source MAC address corresponds to one source IP address.

[0056] First scenario:

[0057] The first network device collects multiple NetFlow data entries, which include multiple MAC addresses. These multiple MAC addresses include at least a second MAC address and a third MAC address. Figure 4 is a schematic diagram illustrating a first network device connected to a switch according to an embodiment of the present invention. As shown in Figure 4, if in the first NetFlow data entry, the source MAC address is the second MAC address and the source IP address is the first IP address; and in the second NetFlow data entry, the source MAC address is the third MAC address and the source IP address is the second IP address, since the switch does not change the MAC address of the packet after receiving it from the terminal device, it can be inferred that the second MAC address and the first IP address are the MAC address and IP address of the first terminal device, and the third MAC address and the second IP address are the MAC address and IP address of the second terminal device, based on the fact that each IP address corresponds to one MAC address. Therefore, it is determined that the device connected to the first network device includes a switch; that is, in the topology diagram corresponding to the first network device, the first network device, the first terminal device, and the second terminal device are connected to the same switch.

[0058] Similarly, if in the two NetFlow data entries collected by the first network device, the destination MAC address in the first NetFlow data entry is the second MAC address and the destination IP address is the first IP address; and in the second NetFlow data entry, the destination MAC address is the third MAC address and the destination IP address is the second IP address, then it can be inferred that the second MAC address and the first IP address are the MAC address and IP address of the first terminal device; and the third MAC address and the second IP address are the MAC address and IP address of the second terminal device. In the topology diagram corresponding to the first network device, the first network device is connected to the same switch as the first terminal device and the second terminal device. In summary, the multiple MAC addresses included in multiple NetFlow data entries can all be source MAC addresses or all be destination MAC addresses.

[0059] It is important to note that in this scenario, the first network device cannot be a switch. This is because if the first network device is a switch, it becomes impossible to determine whether the first and second terminal devices are directly connected to the first network device or connected via a switch. Therefore, in this case, the topology of the first network device needs to be determined based on interface information. Specifically, the method for determining the topology of the first network device based on interface information is detailed below.

[0060] The second scenario:

[0061] Figure 5 is a schematic diagram of a first network device connecting to a terminal device according to an embodiment of the present invention. As shown in Figure 5, among the multiple NetFlow data collected by the first network device, there is only one source MAC address. This source MAC address corresponds to only one source IP address. Therefore, it can be inferred that the network device corresponding to the source MAC address and the network device corresponding to the source IP address are the same terminal device, and this terminal device is directly connected to the first network device.

[0062] Similarly, among the multiple NetFlow data collected by the first network device, there is only one destination MAC address. This destination MAC address corresponds to only one destination IP address. Therefore, it can be inferred that the network device corresponding to the destination MAC address and the network device corresponding to the destination IP address are the same terminal device, and this terminal device is directly connected to the first network device.

[0063] 2. Determine the network device topology based on interface information.

[0064] In one possible implementation, the MAC address of the network device connected to each input interface can be obtained from the input_snmp field and src_mac in the NetFlow data collected by the first network device. If it is determined from multiple NetFlow data collected by the first network device that the same input interface, such as input interface 1, corresponds to multiple source MAC addresses, it can be inferred that input interface 1 of the first network device is connected to a switch with the network devices corresponding to the multiple source MAC addresses. If input interface 2 of the first network device corresponds to only one source MAC address, and that source MAC address corresponds to only one source IP address, it can be inferred that the network device corresponding to that source MAC address and the network device corresponding to that source IP address are the same terminal device, and that terminal device is directly connected to input interface 2 of the first network device. If input interface 3 of the first network device corresponds to only one source MAC address, but that source MAC address corresponds to at least two source IP addresses, it can be inferred that input interface 3 of the first network device is connected to a router with the network devices corresponding to at least two source IP addresses, and the MAC address of the router is the source MAC address. Similarly, the topology of the first network device is determined based on the correspondence between the output interface and the destination MAC address and destination IP address. The principle is the same as that used to determine the topology of the first network device, so it will not be elaborated on here.

[0065] It is important to note that in the method of determining the network device topology based on interface information, the first network device can be either a router or a switch. This is because regardless of whether the first network device is a router or a switch, the interface information represents the interfaces through which data flows in and out.

[0066] For example, Figure 6 is a schematic diagram of determining the network device topology based on interface information according to an embodiment of the present invention. As shown in Figure 6, if it is determined from multiple NetFlow data collected by the first network device that interface 1 corresponds only to IP1 and MAC1, then interface 1 is connected to the first terminal device, the IP address of the first terminal device is IP1, and the MAC address of the first terminal device is MAC1. If interface 2 corresponds to two MAC addresses, such as MAC2 and MAC3, and MAC2 corresponds to IP2 and MAC3 corresponds to IP3, then MAC2 and IP2 correspond to the second terminal device, and MAC3 and IP3 correspond to the third terminal device. Interface 2 is connected to a switch, and interface 2 of the first network device is connected to the second and third terminal devices through this switch. If interface 3 corresponds only to one MAC4 address, but the IP address corresponding to this MAC4 address is at least two, then interface 3 is connected to a router, the MAC address of this router is MAC4, and interface 3 is connected to the terminal device corresponding to the IP address corresponding to MAC4 through this router.

[0067] 3. Determine the network device topology based on the next_hop field.

[0068] In addition to determining the network device topology based on the mapping between MAC addresses and IP addresses and based on interface information, the next-hop field can also be used as a supplementary method to improve the network device topology.

[0069] For example, based on the next_hop field in the NetFlow data of the first network device, the ingress interface IP address of the next-hop router of the first network device can be determined. If the next_hop of multiple NetFlow data entries of the first network device is IP1, it can be inferred that the router device corresponding to IP1 is connected to the first network device. It is worth noting that since terminal devices may also be connected to the first network device via routing, if only one or fewer NetFlow data entries of the first network device have a next_hop of IP1, it cannot be determined whether the network device corresponding to IP1 is a router or a terminal device. Therefore, a threshold A can be set, meaning that if more than A next_hop entries in the NetFlow data are all IP1, it can be inferred that the network device corresponding to IP1 is a router. The threshold A can be set to 3, and this application does not specifically limit this setting.

[0070] Step 203: The device for determining the network topology map determines the network topology map of the target network based on the topology maps corresponding to the N network devices.

[0071] Based on steps 201 and 202, the topology of each network device providing NetFlow data in the target network can be determined. Based on the topology of the N network devices, the network topology of the target network is determined.

[0072] (1) Based on switches and switches

[0073] For example, Figure 7 is a schematic diagram of a network topology diagram corresponding to a target network based on the relationship between switches according to an embodiment of the present invention. As shown in Figure 7, the topology diagram corresponding to the first network device includes the first switch connected to the first network device, and the topology diagram corresponding to the second network device includes the second switch connected to the second network device; the terminal devices connected to the first switch and the second switch are the same, both being first terminal devices. Since a terminal device's MAC address usually only connects to one upper-layer switching device, when the first terminal device is connected to a switch in both topology diagrams, it can be inferred that the first switch and the second switch are the same switch, and the first switch and the second switch can be merged into one switch in the network topology diagram, namely switch A.

[0074] (2) Based on switches and routers

[0075] For example, Figure 8 is a schematic diagram of determining the network topology of a target network based on the relationship between switches and routers according to an embodiment of the present invention. As shown in Figure 8, the topology corresponding to the first network device includes a third switch connected to the first network device, and the topology corresponding to the second network device includes a first router connected to the second network device; the terminal devices connected to the third switch and the first router are the same. Since the terminal device accesses the second network device by connecting to the router, for the second network device, the src_mac of the NetFlow data is the MAC address of the router's outgoing interface. For the first network device, the devices corresponding to src_mac and src_ip are both terminal devices. Therefore, it can be determined that the third switch and the first router are connected in the network topology diagram.

[0076] (3) Based on routers and routers

[0077] For example, Figure 9 is a schematic diagram of a network topology diagram corresponding to a target network based on the relationship between routers according to an embodiment of the present invention. As shown in Figure 9, the topology diagram corresponding to the first network device includes a second router connected to the first network device, and the topology diagram corresponding to the second network device includes a third router connected to the second network device. The terminal devices connected to the second router and the third router are the same. Since the src_mac in the NetFlow data of the first network device is the outgoing interface MAC address of the second router, and the src_mac in the NetFlow data of the second network device is the outgoing interface MAC address of the third router, and the devices corresponding to src_ip in the NetFlow data of the first network device and the second network device are both terminal devices, it can be determined that the second router and the third router are connected through a fourth switch in the network topology diagram.

[0078] The method for determining the network topology of a target network proposed in this application can determine the topology of network devices in the target network that can provide NetFlow data, based at least on the src_addr, dst_addr, src_mac, dst_mac, next_hop, input_snmp, and output_snmp fields in the NetFlow data. Furthermore, based on the relationships between switches, routers, and terminal devices in the topology of each network device, the network topology of the target network is determined. In this way, the network topology of the target network can be determined more accurately and completely, improving the efficiency and accuracy of network topology determination.

[0079] Figure 10 is a schematic diagram of an internal module of a device 10000 for determining a network topology map according to an embodiment of the present invention. As shown in Figure 10, the device may include: an acquisition module 1001, a determination module 1002, and a merging module 1003. Optionally, it may also include a storage module for storing computer instructions or programs. The determination module 1002 may call the computer instructions or programs stored in the storage module.

[0080] The acquisition module 1001 is used to acquire data traffic information collected by N network devices in the target network. The N network devices include a first network device. The data traffic information collected by the first network device is used to indicate the correspondence between at least one Media Access Control (MAC) address and at least one Internet Protocol (IP) address. The MAC address is the source MAC address of the data traffic flowing through the first network device, and the IP address is the source IP address of the data traffic flowing through the first network device. Alternatively, the MAC address is the destination MAC address of the data traffic flowing through the first network device, and the IP address is the destination IP address of the data traffic flowing through the first network device. The determination module 1002 is used to determine the topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address. The topology map corresponding to the first network device includes at least the first network device and the devices connected to the first network device. The determination module 1002 is used to determine the network topology map of the target network based on the topology maps corresponding to the N network devices. Here, N is a positive integer.

[0081] In one possible implementation, the determining module 1002 is further configured to determine that the device connected to the first network device includes a router if the at least one MAC address includes a first MAC address and the first MAC address corresponds to at least two IP addresses.

[0082] In one possible implementation, the determining module 1002 is further configured to determine that the device connected to the first network device includes a switch if the first network device is a router and the at least one MAC address includes a second MAC address and a third MAC address, the IP address corresponding to the second MAC address is a first IP address, and the IP address corresponding to the third MAC address is a second IP address.

[0083] In one possible implementation, the device further includes a merging module 1003, wherein the topology map corresponding to the first network device includes a first switch connected to the first network device, and the topology map corresponding to the second network device includes a second switch connected to the second network device; the merging module 1003 is used to merge the first switch and the second switch into a single switch in the network topology map if the terminal devices connected to the first switch and the second switch are the same.

[0084] In one possible implementation, the topology map corresponding to the first network device includes a third switch connected to the first network device, and the topology map corresponding to the second network device includes a first router connected to the second network device; the merging module 1003 is further configured to determine that the third switch is connected to the first router in the network topology map if the terminal device connected to the third switch is the same as that connected to the first router.

[0085] In one possible implementation, the topology map corresponding to the first network device includes a second router connected to the first network device, and the topology map corresponding to the second network device includes a third router connected to the second network device; the merging module 1003 is further configured to determine, if the terminal devices connected to the second router and the third router are the same, that the second router and the third router are connected through a fourth switch in the network topology map.

[0086] Figure 11 is a schematic diagram of a network topology determination device 11000 provided in an embodiment of the present invention. As shown in Figure 11, it includes at least one processor 1101 and a memory 1102 connected to at least one processor 1101. In this embodiment, the specific connection medium between the processor 1101 and the memory 1102 is not limited. Figure 11 shows an example where the processor 1101 and the memory 1102 are connected via a bus. The bus can be divided into address bus, data bus, control bus, etc.

[0087] In this embodiment of the invention, the memory 1102 stores instructions that can be executed by at least one processor 1101. By executing the instructions stored in the memory 1102, the at least one processor 1101 can implement the steps of the method for determining the network topology as described above.

[0088] The processor 1101 is the control center of the computer device, capable of connecting various parts of the computer device via various interfaces and lines. It performs resource configuration by running or executing instructions stored in the memory 1102 and accessing data stored in the memory 1102. Optionally, the processor 1101 may include one or more processing units. The processor 1101 may integrate an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1101. In some embodiments, the processor 1101 and the memory 1102 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0089] Processor 1101 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0090] Memory 1102, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 1102 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 1102 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 1102 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0091] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0092] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0093] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0094] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0095] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for determining a network topology, characterized in that, The method includes: acquiring data traffic information collected by N network devices in a target network, wherein the N network devices include a first network device, and the data traffic information collected by the first network device is used to indicate the correspondence between at least one Media Access Control (MAC) address and at least one Internet Protocol (IP) address, wherein the MAC address is the source MAC address of the data traffic flowing through the first network device, and the IP address is the source IP address of the data traffic flowing through the first network device, or the MAC address is the destination MAC address of the data traffic flowing through the first network device, and the IP address is the destination IP address of the data traffic flowing through the first network device; determining a topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address; the topology map corresponding to the first network device is at least The network topology includes the first network device and the devices connected to the first network device; a network topology diagram of the target network is determined based on the topology diagrams corresponding to the N network devices; where N is a positive integer; the topology diagram corresponding to the first network device is determined based on the correspondence between at least one MAC address and at least one IP address, including: if the at least one MAC address includes a first MAC address, and the first MAC address corresponds to at least two IP addresses, then the devices connected to the first network device are determined to include routers; if the first network device is a router, and the at least one MAC address includes a second MAC address and a third MAC address, the IP address corresponding to the second MAC address is a first IP address, and the IP address corresponding to the third MAC address is a second IP address, then the devices connected to the first network device are determined to include switches.

2. The method according to claim 1, characterized in that, Based on the topology diagrams corresponding to the N network devices, the network topology diagram of the target network is determined, including: the topology diagram corresponding to the first network device includes the first switch connected to the first network device, and the topology diagram corresponding to the second network device includes the second switch connected to the second network device; if the terminal devices connected to the first switch and the second switch are the same, then the first switch and the second switch are merged into one switch in the network topology diagram.

3. The method according to claim 1, characterized in that, Based on the topology diagrams corresponding to the N network devices, the network topology diagram of the target network is determined, including: the topology diagram corresponding to the first network device includes a third switch connected to the first network device, and the topology diagram corresponding to the second network device includes a first router connected to the second network device; if the terminal device connected to the third switch is the same as that connected to the first router, then it is determined that the third switch is connected to the first router in the network topology diagram.

4. The method according to claim 1, characterized in that, Based on the topology diagrams corresponding to the N network devices, the network topology diagram of the target network is determined, including: the topology diagram corresponding to the first network device includes a second router connected to the first network device, and the topology diagram corresponding to the second network device includes a third router connected to the second network device; if the terminal devices connected to the second router and the third router are the same, then it is determined that the second router and the third router are connected through a fourth switch in the network topology diagram.

5. An apparatus for determining a network topology, characterized in that, include: The acquisition module is used to acquire data traffic information collected by N network devices in the target network. The N network devices include a first network device. The data traffic information collected by the first network device is used to indicate the correspondence between at least one MAC address and at least one IP address. The MAC address is the source MAC address of the data traffic flowing through the first network device, and the IP address is the source IP address of the data traffic flowing through the first network device. Alternatively, the MAC address is the destination MAC address of the data traffic flowing through the first network device, and the IP address is the destination IP address of the data traffic flowing through the first network device. The determining module is configured to determine the topology map corresponding to the first network device based on the correspondence between at least one MAC address and at least one IP address; the topology map corresponding to the first network device includes at least the first network device and the devices connected to the first network device; and to determine the network topology map of the target network based on the topology maps corresponding to the N network devices; wherein N is a positive integer; specifically, the determining module is configured to: if the at least one MAC address includes a first MAC address, and the first MAC address corresponds to at least two IP addresses, then determine that the devices connected to the first network device include routers; if the first network device is a router, and the at least one MAC address includes a second MAC address and a third MAC address, the IP address corresponding to the second MAC address is the first IP address, and the IP address corresponding to the third MAC address is the second IP address, then determine that the devices connected to the first network device include switches.

6. An apparatus for determining a network topology, characterized in that, include: Memory is used to store computer programs or instructions; A processor is configured to invoke a computer program or instructions stored in the memory to execute the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when read and executed by a computer, cause the computer to perform the method as described in any one of claims 1 to 4.

8. A computer program product, characterized in that, The computer program product stores instructions that, when read and executed, cause the computer program product to perform the method as described in any one of claims 1 to 4.

Images