A network asset topology monitoring method, a collection client, a collection server, a storage medium and a product

Abstract

The embodiment of the application discloses a network asset topology monitoring method and a collection client, a collection server, a storage medium and a product, and comprises the following steps: the collection client acquires current monitoring information related to a network device from the network device under the condition that the collection client receives a monitoring instruction sent by the collection server; the collection client is arranged in the network device; and the collection client sends the current monitoring information to the collection server, so that the collection server determines a network asset topology diagram established according to the network device according to the current monitoring information.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network asset topology monitoring method and a data collection client, data collection server, storage medium, and product. Background Technology

[0002] With the rapid development of digital and information technologies, the requirements for network security, data security, and information security are becoming increasingly stringent, posing greater challenges to the security operation and maintenance of enterprise networks. Therefore, in the daily production activities of enterprises, it is necessary to constantly monitor the status of network asset topology, detect changes in topology, the access of new devices and assets, communication failures or outages of existing devices and assets, and be able to pinpoint the location of topology changes and device / asset changes.

[0003] In related technologies, probing is performed by sending Simple Network Management Protocol (SNMP) messages into the internal LAN to discover the locations of SNMP-enabled routers and the path relationships between them. Then, Address Resolution Protocol (ARP) messages are broadcast to each subnet corresponding to each router to discover the path relationships between routers and hosts. Finally, Transmission Control Protocol (TCP) probe messages are sent to the host ports to discover the topology relationship between port services and hosts. Because SNMP operates in a "pull" mode, to address issues such as information aging and failure, SNMP messages need to be continuously sent to obtain information. A large number of SNMP interaction messages will cause additional overhead and pressure on the network, thereby reducing service processing efficiency. Summary of the Invention

[0004] To address the aforementioned technical issues, this application aims to provide a network asset topology monitoring method, as well as a data acquisition client, data acquisition server, storage medium, and product, which can improve business processing efficiency.

[0005] The technical solution of this application is implemented as follows:

[0006] This application provides a network asset topology monitoring method, applied to a data acquisition client, the network asset topology monitoring method comprising:

[0007] Upon receiving a monitoring instruction from the data acquisition server, the system retrieves current monitoring information from the network device that is connected to the network device; the network device is equipped with a data acquisition client.

[0008] The current monitoring information is sent to the data collection server so that the data collection server can determine the network asset topology map established based on the network devices according to the current monitoring information.

[0009] This application embodiment provides another method for monitoring network asset topology, applied to a data acquisition server. The method for monitoring network asset topology includes:

[0010] Send monitoring commands to multiple data acquisition clients respectively;

[0011] Receive multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices that are connected to the multiple network devices;

[0012] Based on the multiple sets of current monitoring information, a network asset topology map is determined based on the multiple network devices.

[0013] This application embodiment provides a data acquisition client, the data acquisition client including:

[0014] The acquisition unit is used to acquire current monitoring information that is connected to the network device from the network device when it receives a monitoring instruction sent by the acquisition server;

[0015] The first sending unit is used to send the current monitoring information to the data collection server so that the data collection server can determine the network asset topology map established based on the network device according to the current monitoring information.

[0016] This application embodiment further provides a data acquisition client, the data acquisition client including:

[0017] The system comprises a first memory, a first processor, and a first communication bus. The first memory communicates with the first processor via the first communication bus. The first memory stores a network asset topology monitoring program executable by the first processor. When the network asset topology monitoring program is executed, the network asset topology monitoring method described above is executed by the first processor.

[0018] This application provides a data acquisition server, which includes:

[0019] The second sending unit is used to send monitoring commands to multiple data acquisition clients respectively;

[0020] The receiving unit is used to receive multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices that are connected to the multiple network devices;

[0021] The determining unit is used to determine the network asset topology map established based on the multiple sets of current monitoring information.

[0022] This application embodiment further provides a data acquisition server, the data acquisition server comprising:

[0023] The system comprises a second memory, a second processor, and a second communication bus. The second memory communicates with the second processor via the second communication bus. The second memory stores a network asset topology monitoring program executable by the second processor. When the network asset topology monitoring program is executed, the network asset topology monitoring method described above is executed by the second processor.

[0024] This application provides a storage medium storing a computer program for use in a data acquisition client and a data acquisition server. The computer program, when executed by a first processor, implements the network asset topology monitoring method described above for use in the data acquisition client; and when executed by a second processor, it implements the same method for use in the data acquisition server.

[0025] This application also provides a computer program product, including a computer program that can be executed by a first processor in a data acquisition client to complete the steps of the aforementioned network asset topology monitoring method applied to a data acquisition server; the computer program can also be executed by a second processor in a data acquisition client to complete the steps of the aforementioned network asset topology monitoring method applied to a data acquisition server.

[0026] This application provides a network asset topology monitoring method, a data acquisition client, a data acquisition server, a storage medium, and a product. The network asset topology monitoring method includes: upon receiving a monitoring instruction from a data acquisition server, the data acquisition client obtains current monitoring information from network devices that are connected to the network devices; the network devices are equipped with the data acquisition client; and the data acquisition server sends the current monitoring information to the data acquisition server so that the data acquisition server can determine the network asset topology map established based on the network devices according to the current monitoring information. The above-described solution involves setting up data acquisition clients in network devices. These clients acquire current monitoring information connected to the network devices and send it to the data acquisition server. In cases where multiple clients correspond to multiple network devices, the server receives multiple sets of current monitoring information from these clients. Based on this information, a network asset topology map is determined. Since the server runs on a server, it can also access the network asset topology map. Specifically, the server directly acquires multiple sets of current monitoring information from the clients and network devices, thus determining the network asset topology map. This method of obtaining the network asset topology map from the network devices does not affect the transmission of business information between the network devices and the server, preventing additional network overhead and pressure, thereby improving business processing efficiency. Attached Figure Description

[0027] Figure 1 A network asset topology monitoring process provided in this application embodiment Figure 1 ;

[0028] Figure 2 This is a schematic diagram illustrating an exemplary process for establishing a long network connection and maintaining a heartbeat between a data acquisition client and a data acquisition server, provided as an embodiment of this application.

[0029] Figure 3 This application provides an exemplary incremental reporting process. Figure 1 ;

[0030] Figure 4 This application provides an exemplary incremental reporting process for a data acquisition client. Figure 2 ;

[0031] Figure 5 This application provides an exemplary full-reporting process illustration. Figure 1 ;

[0032] Figure 6This application provides an exemplary full-data reporting process for a data acquisition client. Figure 2 ;

[0033] Figure 7 A network asset topology monitoring process provided in this application embodiment Figure 2 ;

[0034] Figure 8 This is a schematic diagram illustrating an exemplary data collection server-side full-data reporting process provided in this application embodiment;

[0035] Figure 9 This is a schematic diagram of an exemplary incremental reporting process for a data collection server, provided as an embodiment of this application.

[0036] Figure 10 A schematic diagram of an exemplary enterprise intranet architecture provided for embodiments of this application;

[0037] Figure 11 A schematic diagram of an exemplary network topology provided in this application embodiment;

[0038] Figure 12 A schematic diagram of the composition structure of a data acquisition client provided in this application embodiment. Figure 1 ;

[0039] Figure 13 A schematic diagram of the composition structure of a data acquisition client provided in this application embodiment. Figure 2 ;

[0040] Figure 14 A schematic diagram of the composition structure of a data acquisition server provided in this application embodiment. Figure 1 ;

[0041] Figure 15 A schematic diagram of the composition structure of a data acquisition server provided in this application embodiment. Figure 2 . Detailed Implementation

[0042] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0043] In related technologies, the `traceroute` command can be used to send Internet Control Message Protocol (ICMP) messages. Intermediate nodes, such as routers and switches, then return ICMP timeout response packets, actively probing the nodes through which IP packets pass, thereby analyzing the transmission path to form a topology map. However, this also requires sending a large number of probe messages, increasing network load, and there is a risk of incorrect path identification.

[0044] The problems existing in the related technologies can be solved by the methods in the following embodiments.

[0045] This application provides a method for monitoring network asset topology, which is applied to a data acquisition client. Figure 1 A flowchart of a network asset topology monitoring method provided in this application embodiment is shown below. Figure 1 As shown, network asset topology monitoring methods may include:

[0046] S101. Upon receiving a monitoring instruction from the data acquisition server, obtain current monitoring information from the network device that is connected to the network device.

[0047] The network asset topology monitoring method provided in this application embodiment is applicable to scenarios where a network asset topology map established by network devices is monitored using a data acquisition client and a data acquisition server.

[0048] In the embodiments of this application, the data collection client can be implemented in various forms. For example, the data collection client described in this application can be a software program deployed in terminal devices used for network transmission, such as switches, routers, firewalls, and load balancers.

[0049] It should be noted that the network device is equipped with a data acquisition client. The data acquisition client and the data acquisition server are network reachable.

[0050] In this application embodiment, network devices include switches, routers, hosts, and other devices. The specific network devices can be determined according to the actual situation, and this application embodiment does not limit them.

[0051] In this embodiment of the application, the data collection client is located in a network device.

[0052] In this embodiment of the application, the network device can have a one-to-one relationship with the data collection client, that is, one network device corresponds to one data collection client, and a data collection client can be set up on each network device.

[0053] In this embodiment, the current monitoring information refers to network connection-related data of the network device under the current conditions. The network device obtains various port and link-related table entries through multiple methods such as routing protocols, Link Layer Discovery Protocol (LLDP), Address Resolution Protocol (ARP), and port learning. The client reads various table entries and parameter values ​​stored in the network device to collect and monitor the port status and connection information of the network device (i.e., the current monitoring information). The collected current monitoring information includes port up / down status, port Media Access Control (MAC), port Internet Protocol (IP), peer MAC, peer IP, neighbor table, forwarding table (i.e., MAC table), routing table, ARP table, etc.

[0054] It should be noted that the current monitoring information is the full amount of monitoring information collected by the client from the network device.

[0055] In this embodiment, before the acquisition client obtains the current monitoring information that is connected to the network device from the network device after receiving the monitoring instruction sent by the acquisition server, it also obtains the server identifier to be connected to the network; sends a network connection request to the acquisition server corresponding to the server identifier, so as to establish a long network connection with the acquisition server according to the network connection request, and interacts with the acquisition server based on the long network connection.

[0056] In this embodiment, the server identifier can be identification information used to identify the data collection server. For example, the server identifier can be the IP address of the data collection server, or other identification information that can be used to identify the data collection server. The specific identification can be determined according to the actual situation, and this embodiment does not limit it.

[0057] In this embodiment, the server identifier can be identifier information configured in the acquisition client, identifier information transmitted to the acquisition client by other devices, or identifier information obtained by the acquisition client through other means. The specific way the acquisition client obtains the server identifier can be determined according to the actual situation, and this embodiment does not limit it.

[0058] In this embodiment of the application, when the data acquisition client starts successfully, the data acquisition client sends a network connection request to the data acquisition server to establish a TCP session with the data acquisition server, that is, to establish a long network connection with the data acquisition server.

[0059] Understandably, the data acquisition client obtains the server identifier and sends a network connection request to the server corresponding to that identifier, thereby establishing a long-term network connection with the data acquisition server. Based on this long-term network connection, the client reports the monitoring information collected from the network devices to the data acquisition server. This allows the data acquisition server to determine the network asset topology map built based on the network devices according to the current monitoring information. In this way, the server obtains the network asset topology map built based on the network devices without affecting the transmission of business information between the network devices and the server, that is, without causing additional overhead and pressure to the network, thereby improving business processing efficiency.

[0060] In this embodiment, after the acquisition client sends the current monitoring information to the acquisition server, if the long network connection with the acquisition server is broken, it resends a network connection request to the acquisition server to re-establish the long network connection with the acquisition server according to the network connection request; if the long network connection is successfully re-established and the monitoring instruction sent by the acquisition server is the first monitoring instruction, the last baseline information before the long network connection was broken is determined; if the long network connection is successfully re-established and the first monitoring information is obtained from the network device for the first time, the first incremental monitoring information between the first monitoring information and the last baseline information is determined; when the current periodic reporting time point arrives, the first incremental monitoring information is sent to the acquisition server.

[0061] In this embodiment, after a TCP session is successfully established between the data acquisition client and the data acquisition server, the client maintains a heartbeat with the server. If the TCP session between the client and the server is interrupted, the client will automatically initiate a reconnection with the server to re-establish a long-lived connection. Before the session is successfully established, the baseline remains unchanged (i.e., the last baseline information before the network connection is broken is used as the baseline). The client continuously collects and monitors information and compares it with the last baseline information. Incremental information is not reported to the server temporarily, and the baseline is not updated until the session is successfully established and the incremental information is successfully reported for the first time, at which point the baseline is updated.

[0062] In this embodiment of the application, the process for establishing a long network connection and maintaining a heartbeat interaction between the data acquisition client and the data acquisition server is described in [link to application]. Figure 2As shown: The data acquisition client sends a network connection request to the data acquisition server, specifically a SYN (Synchronize) message. Upon receiving the SYN, the server sends an ACK (acknowledgment) followed by another SYN. ​​The client then sends an ACK back to the server, successfully establishing a persistent network connection. After this connection is established, the client periodically sends heartbeat requests to the server. The server responds to these requests with heartbeat responses to maintain the connection between the two clients.

[0063] In this embodiment of the application, when the monitoring instruction sent by the data collection server is the first monitoring instruction and the network long connection is successfully re-established, the data collection client determines the last incremental information when it last reported to the data collection server before the network long connection was disconnected, and determines the last baseline information by combining the last incremental information and the baseline information used to determine the last incremental information.

[0064] It should be noted that this periodic reporting time point is the first periodic reporting time point after the network long connection is successfully re-established.

[0065] Understandably, when the network connection between the data acquisition client and the data acquisition server is lost, the client resends a network connection request to the data acquisition server to re-establish a long-term network connection. If the network connection is successfully re-established and the long-term connection was not broken before the client reported to the data acquisition server using the incremental reporting method corresponding to the first monitoring instruction, the client continues to report to the data acquisition server using the incremental reporting method. This ensures that even with an interruption in the long-term network connection, the client will not interrupt the periodic reporting of incremental monitoring information to the data acquisition server, achieving the effect of continuous periodic reporting after a single subscription, thus improving the intelligence of network asset topology monitoring.

[0066] S102. Send the current monitoring information to the data collection server so that the data collection server can determine the network asset topology map established based on the network devices according to the current monitoring information.

[0067] In this embodiment of the application, after the acquisition client obtains the current monitoring information that is connected to the network device from the network device, it sends the current monitoring information to the acquisition server so that the acquisition server can determine the network asset topology map established based on the network device according to the current monitoring information.

[0068] In this embodiment, the process by which the acquisition client obtains current monitoring information that is connected to the network device from the network device when it receives a monitoring instruction sent by the acquisition server includes: parsing the first key-value pair sent by the acquisition server to obtain a parsing result; and obtaining current monitoring information that is connected to the network device from the network device when the parsing result identifies the first key-value pair as a monitoring instruction. Correspondingly, the process by which the acquisition client sends the current monitoring information to the acquisition server includes: converting the current monitoring information into a second key-value pair; and sending the second key-value pair to the acquisition server.

[0069] In this embodiment, the interaction information between the data acquisition client and the data acquisition server is all in key-value pair format. Specifically, upon receiving a first key-value pair from the data acquisition server, the data acquisition client parses the first key-value pair to obtain a parsing result; based on the parsing result, it determines a monitoring instruction and retrieves current monitoring information related to the network device from the network device according to the monitoring instruction. The data acquisition client then converts this current monitoring information into a second key-value pair and sends the second key-value pair to the data acquisition server.

[0070] It should be noted that the method by which the data acquisition server converts the monitoring command into the first key-value pair and the method by which the data acquisition client converts the current monitoring information into the second key-value pair can be determined according to the actual situation, and this application embodiment does not limit this.

[0071] In this embodiment, the transmission of commands and the reporting of collected information between the client and server are both done using JSON format. The JSON format stores data in key-value pairs. To reduce the amount of data sent, all keys and some values ​​are replaced with integer values. Both the client and server use the same dictionary to store the correspondence between keys, values, and integer values; for example, a reported command corresponds to "1". Each key and value corresponds to a globally unique integer value. Upon receiving the JSON data, the client or server parses it by looking up the dictionary. Table 1 shows examples of some key-value pairs in the dictionary.

[0072] Table 1 shows examples of integer values ​​corresponding to keys and values ​​in the dictionary.

[0073] Key / Value Integer value Key / Value Integer value Reporting instructions 1 peer MAC 13 Instruction serial number 2 peer IP 14 Reporting type 3 Neighbor table 15 Full report 4 Forwarded 16 Incremental reporting begins 5 Routing table 17 Incremental reporting has ended. 6 ARP table 18 Reported data set 7 Increase 19 Device ID 8 delete 20 Device IP 9 renew 21 Port status 10 Reporting results 22 Port MAC 11 Incremental reporting interval (ms) 23 Port IP 12 … …

[0074] For example, the data acquisition server sends the instruction data {1:4,2:"20"} to the data acquisition client:

[0075] Command Analysis: The client is submitting all collected information for this 20th time.

[0076] The client reports the collected information to the server:

[0077]

[0078]

[0079] Analysis: The client is reporting all collected information this time. The corresponding reporting command is the 20th one. The reported data is omitted.

[0080] The data collection server will return a success result after successfully receiving, parsing, and updating the reported data; otherwise, it will return a failure result.

[0081]

[0082] Analysis: Omitted.

[0083] For incremental reporting, the data collection server only issues the command once and does not return a reporting result for each subsequent report; it assumes each report is successful. This implements a one-time subscription for continuous reporting. An example of incremental reporting is as follows:

[0084]

[0085] Understandably, the data collection server and the data collection client interact with each other using key-value pairs, which reduces the amount of data transmitted during information exchange and increases the speed of information exchange.

[0086] In this embodiment of the application, the process of the acquisition client sending current monitoring information to the acquisition server includes: when the monitoring instruction is a first monitoring instruction, acquiring current baseline information; determining incremental monitoring information between the current baseline information and the current monitoring information; and sending incremental monitoring information to the acquisition server when the periodic reporting time point arrives.

[0087] It should be noted that the current baseline information is the previous monitoring information updated after receiving the first monitoring instruction and the last report to the data collection server; the first monitoring instruction is used to instruct the incremental reporting of monitored information to the data collection server.

[0088] It should be noted that the periodic reporting time points are those carried in the first monitoring instruction.

[0089] In this embodiment of the application, the difference between the current baseline information and the current monitoring information is determined to obtain incremental monitoring information.

[0090] Understandably, upon receiving the first monitoring instruction, the acquisition client obtains the current baseline information, determines the incremental monitoring information between the current baseline information and the current monitoring information, and reports the incremental monitoring information to the acquisition server when the periodic reporting time arrives. This achieves the effect that the acquisition server can continuously report periodically after subscribing to the acquisition client once, thus improving the intelligence of network asset topology monitoring.

[0091] In this embodiment of the application, before the acquisition client sends incremental monitoring information to the acquisition server when the periodic reporting time point arrives, it will determine the current monitoring information as incremental monitoring information if the monitoring instruction is the first monitoring instruction and the current monitoring information is the monitoring information to be reported to the acquisition server for the first time after receiving the first monitoring instruction.

[0092] In this embodiment of the application, when the client reports monitoring information to the server for the first time, it directly reports the full amount of current monitoring information collected from the network device as incremental monitoring information to the server.

[0093] Understandably, when the acquisition client reports monitoring information to the acquisition server for the first time after receiving the first monitoring instruction, since there is no full set of monitoring information collected during the previous report, i.e., no latest baseline information, it reports the current monitoring information to the acquisition server. This avoids the inability to report the first monitoring information and subsequent monitoring information to the acquisition server due to the lack of the latest baseline information, thus improving the intelligence of network asset topology monitoring.

[0094] In this embodiment of the application, after the acquisition client obtains the current baseline information, if the current monitoring information is the same as the current baseline information, it will prohibit sending a prompt message about no incremental monitoring information to the acquisition server when the periodic reporting time point arrives.

[0095] It should be noted that when the current monitoring information is the same as the current baseline information, the data acquisition client will not report the monitoring information to the data acquisition server when the periodic reporting time arrives.

[0096] Understandably, when the current monitoring information is the same as the current baseline information, no report is sent to the data collection server, which reduces invalid interactions between the data collection client and the data collection server and lowers the network load.

[0097] In this embodiment of the application, when the periodic reporting time point arrives, the data acquisition client sends incremental monitoring information to the data acquisition server and determines the current monitoring information as the next baseline information so that when the next periodic reporting time point arrives, the next incremental monitoring information is reported based on the next baseline information.

[0098] It should be noted that the next periodic reporting time point is the one carried in the first monitoring instruction.

[0099] In this embodiment of the application, after each successful reporting of incremental monitoring information to the data collection server by the data collection client, the current monitoring information obtained from the incremental monitoring information is used as the baseline information for the next report.

[0100] In the embodiments of this application, such as Figure 3 As shown, upon receiving the first monitoring instruction (incremental reporting start instruction) sent by the acquisition server, the acquisition client obtains the current monitoring information connected to the network device from the network device; obtains the current baseline information; determines the incremental monitoring information between the current baseline information and the current monitoring information; determines the current monitoring information as the next baseline information (the acquisition client performs baseline update); when the periodic reporting time point arrives, it sends the incremental monitoring information to the acquisition server (incremental reporting); after successful reporting, the acquisition server also performs baseline update; when the next acquisition time point arrives, the acquisition client obtains the next current monitoring information connected to the network device from the network device; determines the next incremental monitoring information between the current baseline information and the next current monitoring information; uses the next current monitoring information to perform baseline update again; when the next periodic reporting time point arrives, it sends the next incremental monitoring information to the acquisition server; ... until the acquisition client receives the incremental reporting stop instruction sent by the acquisition server.

[0101] In the embodiments of this application, such as Figure 4 As shown: Upon receiving the first monitoring instruction (incremental reporting instruction) sent by the acquisition server, the client obtains the current monitoring information (acquisition information) connected to the network device from the network device; obtains the current baseline information; determines the incremental monitoring information between the current baseline information and the current monitoring information (baseline comparison analysis, with increment); if the current monitoring information is the same as the current baseline information, it determines that there is no incremental monitoring information (no increment); when the periodic reporting time point arrives, it sends incremental monitoring information (incremental reporting) to the acquisition server; waits for the incremental reporting time interval, and determines whether it has received the incremental reporting stop instruction sent by the acquisition server. If not received, the client obtains the next current monitoring information connected to the network device from the network device; determines the next incremental monitoring information between the current baseline information and the next current monitoring information; uses the next current monitoring information to re-update the baseline; when the next periodic reporting time point arrives, it sends the next incremental monitoring information to the acquisition server; ... until the client receives the incremental reporting stop instruction sent by the acquisition server.

[0102] Understandably, after sending incremental monitoring information to the data collection server, the client uses the current monitoring information as the next baseline information. By updating the baseline information, the amount of data reported each time is reduced, thus lowering the network load.

[0103] In this embodiment of the application, the process of the acquisition client sending the current monitoring information to the acquisition server includes: determining the current monitoring information as the full monitoring information when the monitoring instruction is the second monitoring instruction; and sending the full monitoring information to the acquisition server.

[0104] It should be noted that the second monitoring command is used to instruct the full reporting of the monitored information to the data collection server.

[0105] In this embodiment of the application, the full monitoring information refers to all monitoring information obtained by the client from the network device that has a connection relationship with the network device, i.e., the current monitoring information.

[0106] In this embodiment of the application, after the data acquisition server successfully receives and parses the full monitoring information sent by the data acquisition client, the data acquisition server sends feedback information on the reception and parsing results to the data acquisition client and determines the current monitoring information as the next baseline information. After completing the reporting corresponding to the second monitoring instruction, and upon receiving the first monitoring instruction issued by the data acquisition server, the data acquisition server reports the first incremental monitoring information after receiving the first monitoring instruction based on the next baseline information.

[0107] It should be noted that after the data acquisition server successfully receives and parses the full amount of monitoring information sent by the data acquisition client, it will also determine the current monitoring information as the next baseline information to keep it synchronized with the baseline information of the data acquisition client.

[0108] In this embodiment of the application, after the data acquisition client sends the full monitoring information to the data acquisition server, it will no longer send monitoring information to the data acquisition server until it receives the monitoring instruction sent by the data acquisition server again.

[0109] Understandably, by setting a second monitoring command, when periodic continuous reporting is not required, the data collection client can use the current monitoring information as the full monitoring information according to the second monitoring command issued by the data collection server, and then report the full monitoring information to the data collection server, thus avoiding continuous reporting of monitoring information and reducing the network load between the data collection client and the data collection server.

[0110] In the embodiments of this application, such as Figure 5As shown, when the acquisition client receives the second monitoring instruction (full report instruction) sent by the acquisition server, it obtains the current monitoring information that is connected to the network device from the network device; determines the current monitoring information as full monitoring information; and then sends the full monitoring information (full report) to the acquisition server; after successful reporting, the acquisition server sends feedback information on the reception and parsing results to the acquisition client.

[0111] In the embodiments of this application, such as Figure 6 As shown, upon receiving the second monitoring instruction (full report instruction received) from the data acquisition server, the data acquisition client obtains the current monitoring information (collected information) connected to the network device from the network device; it identifies the current monitoring information as the full monitoring information and sends the full monitoring information to the data acquisition server (full report); after successful reporting, the data acquisition server sends feedback information on the reception and parsing results to the data acquisition client (server feedback received). If the feedback information indicates successful reception and parsing of the current monitoring information, the current monitoring information is identified as the next baseline information, and the current reporting ends; otherwise, the current monitoring information is re-reported to the data acquisition server. It should be noted that after successful reporting, the data acquisition server also identifies the current monitoring information as the next baseline information.

[0112] It is understandable that by setting up data acquisition clients in network devices, these clients can obtain current monitoring information from network devices that are connected to them, and then send this information to the data acquisition server. In cases where multiple data acquisition clients correspond to multiple network devices, the data acquisition server can obtain multiple sets of current monitoring information from these clients. Based on this information, a network asset topology map established by the multiple network devices can be determined. Since the data acquisition server runs on a server, the server can use it to obtain the network asset topology map. Specifically, the data acquisition server can directly obtain multiple sets of current monitoring information from multiple network devices from multiple clients, and then determine the network asset topology map based on this information. This method of obtaining the network asset topology map from the network devices does not affect the transmission of business information between the network devices and the server, meaning it does not impose additional overhead or pressure on the network, thereby improving business processing efficiency.

[0113] This application embodiment further provides a network asset topology monitoring method, which is applied to a data acquisition server. Figure 7 A flowchart of a network asset topology monitoring method provided in this application embodiment is shown below. Figure 7 As shown, network asset topology monitoring methods may include:

[0114] S201. Send monitoring commands to multiple data acquisition clients respectively.

[0115] The network asset topology monitoring method provided in this application embodiment is applicable to scenarios where a network asset topology map established by network devices is monitored using a data acquisition client and a data acquisition server.

[0116] In the embodiments of this application, the data acquisition client can be implemented in various forms. For example, the data acquisition client described in this application may include devices such as servers.

[0117] In this embodiment, there can be multiple data acquisition clients. The data acquisition server can send monitoring commands to each of the multiple clients.

[0118] It should be noted that this monitoring instruction can be either a first monitoring instruction or a second monitoring instruction.

[0119] In this embodiment, the data acquisition server can send monitoring instructions to multiple data acquisition clients upon receiving an instruction; it can also send monitoring instructions to multiple data acquisition clients when a preset time arrives; or it can send monitoring instructions to multiple data acquisition clients after establishing long network connections with multiple data acquisition clients. The specific timing for the data acquisition server to send monitoring instructions to multiple data acquisition clients can be determined according to the actual situation, and this embodiment does not limit this.

[0120] It should be noted that this monitoring command is in key-value pair format.

[0121] In this embodiment, the data acquisition server sends monitoring instructions to multiple data acquisition clients, so that the multiple data acquisition clients can obtain multiple sets of current monitoring information that are connected to the corresponding network devices from the corresponding network devices.

[0122] In this embodiment, the data collection server can be located within the server or located outside the server and communicate with the server via an interface call. That is, the server obtains the network asset topology map from the data collection server through the interface call.

[0123] S202. Receive multiple sets of current monitoring information collected by multiple acquisition clients from multiple network devices, which are connected to the multiple network devices.

[0124] In this embodiment, the data acquisition server sends monitoring instructions to multiple data acquisition clients, and waits to receive multiple sets of current monitoring information collected by the multiple data acquisition clients from multiple network devices that are connected to the multiple network devices.

[0125] In this embodiment, each set of current monitoring information represents network connection-related data of the network device under the current condition. The network device obtains various port and link-related table entries through multiple methods such as routing protocols, Link Layer Discovery Protocol (LLDP), Address Resolution Protocol (ARP), and port learning. The client reads various table entries and parameter values ​​stored in the network device to collect and monitor the port status and connection information (i.e., current monitoring information). The collected current monitoring information includes port up / down status, port Media Access Control (MAC), port Internet Protocol (IP), peer MAC, peer IP, neighbor table, forwarding table (i.e., MAC table), routing table, ARP table, etc.

[0126] In this embodiment of the application, the process of the data acquisition server receiving multiple sets of current monitoring information collected by multiple data acquisition clients from multiple network devices and having a connection relationship with multiple network devices includes: when the monitoring instruction is a second monitoring instruction, receiving multiple sets of full monitoring information collected by multiple data acquisition clients from multiple network devices respectively.

[0127] It should be noted that the second monitoring command is used to instruct multiple data collection clients to report all the monitored information in full; multiple sets of current monitoring information include multiple sets of full monitoring information.

[0128] In this embodiment of the application, after the data acquisition server successfully receives and parses multiple sets of full monitoring information sent by multiple data acquisition clients, the data acquisition server sends feedback information on the reception and parsing results to the multiple data acquisition clients respectively.

[0129] In this embodiment, after the data acquisition server receives multiple sets of full monitoring information collected by multiple data acquisition clients from multiple network devices, the multiple data acquisition clients will no longer send monitoring information to the data acquisition server until they receive a monitoring instruction from the data acquisition server again.

[0130] For example, such as Figure 8As shown: The data acquisition server sends a second monitoring command (send full report command) to multiple data acquisition clients; receives multiple sets of current monitoring information collected by multiple data acquisition clients from multiple network devices that are connected to multiple network devices (receive full report information); if the multiple sets of current monitoring information are successfully parsed (successful parsing of full report information), a network asset topology map (correlation analysis, topology drawing) is determined based on the multiple sets of current monitoring information and the current monitoring information is determined as the next baseline information; feedback information indicating successful reception and parsing is sent to multiple data acquisition clients (feedback results). If any set of current monitoring information is not successfully parsed, the data acquisition server sends feedback information indicating unsuccessful reception and parsing to any data acquisition client corresponding to that set of current monitoring information.

[0131] Understandably, by setting a second monitoring command, the data collection server can send a second monitoring command to the data collection client when periodic continuous reporting is not required. This allows the server to obtain multiple sets of full monitoring information from multiple data collection clients based on the second monitoring command, thus avoiding continuous reporting of monitoring information and reducing the network load between the data collection client and the data collection server.

[0132] S203. Determine the network asset topology map based on multiple sets of current monitoring information and multiple network devices.

[0133] In this embodiment, after receiving multiple sets of current monitoring information collected by multiple clients from multiple network devices and having connections with multiple network devices, the data acquisition server determines the network asset topology map established based on the multiple sets of current monitoring information.

[0134] In this embodiment, the process by which the data acquisition server receives multiple sets of current monitoring information collected by multiple acquisition clients from multiple network devices and which are connected to the multiple network devices includes: receiving multiple sets of incremental monitoring information collected by multiple acquisition clients from multiple network devices respectively when the monitoring instruction is a first monitoring instruction; correspondingly, the process by which the data acquisition server determines a network asset topology map based on the multiple sets of current monitoring information includes: obtaining multiple sets of current baseline information corresponding to the multiple network devices; determining multiple sets of full monitoring information based on the multiple sets of current baseline information and the multiple sets of incremental monitoring information; and determining a network asset topology map based on the multiple sets of full monitoring information.

[0135] It should be noted that the first monitoring instruction is used to instruct multiple data collection clients to incrementally report the monitored information; multiple sets of current monitoring information include multiple sets of incremental monitoring information.

[0136] It should be noted that the multiple sets of current baseline information are multiple sets of previous monitoring information updated after the first monitoring command was sent to multiple acquisition clients and after the last report by multiple acquisition clients.

[0137] In this embodiment of the application, the process of determining multiple sets of full monitoring information based on multiple sets of current baseline information and multiple sets of incremental monitoring information can be described as determining the sum of multiple sets of current baseline information and multiple sets of incremental monitoring information to obtain multiple sets of full monitoring information.

[0138] Understandably, when the monitoring command is the first monitoring command, the data acquisition server receives multiple sets of incremental monitoring information collected from multiple network devices by multiple acquisition clients. Based on multiple sets of current baseline information and multiple sets of current baseline information corresponding to multiple network devices, the server determines the network asset topology map based on multiple sets of full monitoring information. The data acquisition server runs on the server, and the server also obtains the network asset topology map. This method of obtaining the network asset topology map based on the network devices does not affect the transmission of business information between the network devices and the server, that is, it does not cause additional overhead and pressure to the network, thereby improving business processing efficiency.

[0139] In this embodiment, after the data collection server determines multiple sets of full monitoring information based on multiple sets of current baseline information and multiple sets of incremental monitoring information, it determines the multiple sets of full monitoring information as multiple sets of next baseline information corresponding to multiple network devices, so as to determine multiple sets of next full monitoring information based on multiple sets of next incremental monitoring information and multiple sets of next baseline information reported by multiple data collection clients at the next periodic reporting time point.

[0140] It should be noted that the next periodic reporting time point is the one carried in the first monitoring instruction.

[0141] For example, such as Figure 9As shown: The data acquisition server sends a first monitoring command (incremental reporting start command) to multiple data acquisition clients; it receives multiple sets of incremental monitoring information collected by multiple data acquisition clients from multiple network devices (incremental reporting information); if multiple sets of current monitoring information are successfully parsed (incremental reporting information parsing successful), it obtains multiple sets of current baseline information corresponding to multiple network devices; based on the multiple sets of current baseline information and multiple sets of incremental monitoring information, it determines multiple sets of full monitoring information; based on the multiple sets of full monitoring information, it determines the network asset topology map, and determines the multiple sets of full monitoring information as multiple sets of next baseline information corresponding to multiple network devices (correlation analysis, topology drawing, and baseline update). If the data acquisition server fails to parse any set of current monitoring information, it determines whether to stop. If so, it sends an incremental reporting stop command to the data acquisition clients; if not, it continues to receive the next incremental monitoring information reported by the data acquisition clients until the stop time, at which point it sends an incremental reporting stop command to the data acquisition clients.

[0142] Understandably, the data acquisition server identifies multiple sets of full monitoring information as multiple sets of next baseline information corresponding to multiple network devices. By updating the baseline information, the amount of data reported by multiple acquisition clients each time is reduced, thereby reducing network load.

[0143] In this embodiment, the process by which the data acquisition server determines the network asset topology map based on multiple network devices according to multiple sets of current monitoring information includes: obtaining multiple sets of port operating status, multiple sets of port LAN addresses, multiple sets of port Internet Protocol addresses, multiple sets of peer LAN addresses, multiple sets of peer Internet Protocol addresses, multiple sets of neighbor tables, multiple sets of LAN address tables, multiple sets of routing tables, and multiple sets of address resolution protocol tables from the multiple sets of monitoring information; determining the physical topology map of multiple network devices based on the multiple sets of port operating status, multiple sets of port LAN addresses, multiple sets of peer LAN addresses, multiple sets of neighbor tables, multiple sets of LAN address tables, and multiple sets of address resolution protocol tables; determining the logical topology map of multiple network devices based on the multiple sets of port operating status, multiple sets of port Internet Protocol addresses, multiple sets of peer Internet Protocol addresses, multiple sets of neighbor tables, multiple sets of routing tables, and multiple sets of address resolution protocol tables; and determining the physical topology map and the logical topology map as the network asset topology map.

[0144] For example, after receiving the collected information from all the clients, the data collection server performs correlation analysis to identify network devices and hosts, as well as the connections between them, forming a network topology map, which is then stored as the current baseline. Figure 10 The network topology drawing process is illustrated using an example: The data collection server obtains the neighbor relationships between network devices, as well as the connected port numbers, MAC addresses, and IP addresses, by integrating all neighbor tables, ARP tables, and port information. Figure 10The following pairwise neighbor relationships can be found: Router / Core Switch 1 <-> Switch 2, Router / Core Switch 1 <-> Switch 3, Router / Core Switch 1 <-> Switch / AC4, Switch / AC4 <-> Wireless Router / AP5. The data collection server analyzes all forwarding tables, routing tables, and ARP tables to obtain devices not listed in the network device neighbor table, along with their connected network device port numbers, MAC addresses, and IP addresses. If a network device's port has connection information for a device that is not a neighboring network device, and that port has no connected neighbors, then that device can be considered a host terminal directly connected to that port of the network device. If, after analysis, multiple host terminals are found directly connected to that port of the network device, then there may be an unmanageable dumb device between the network device and the host terminals, such as a hub, or one of the host terminals may be a physical host machine, while the others are virtual machines bridged to the host machine's network card. Figure 10 The following network device and host connection relationships can be found (the connection port information of switches and host terminals is omitted here): Switch 2 <-> Server 1, Server 2, Server 3, Switch 3 <-> Computer 1, Computer 2, Switch / AC4 <-> Computer 3, Wireless Router / AP5 <-> Laptop 1, Laptop 2. From the above correlation analysis results, a network topology diagram can be obtained, such as... Figure 11 As shown in the figure, N represents network devices and H represents host terminal devices. The data acquisition server then stores this network topology as the current baseline.

[0145] It should be noted that when the data acquisition client continuously and incrementally reports data to the data acquisition server, if changes occur in device connectivity, new devices join the network, or device connections are interrupted (e.g., a network cable becomes disconnected), the data acquisition server can monitor these network topology changes in real time and update the baseline. The data acquisition client only reports incrementally when there is a baseline update; otherwise, it does not report incremental data. Therefore, while ensuring real-time detection of network topology changes, the amount of data reported can be reduced, alleviating network load.

[0146] Understandably, by setting up a data acquisition client in a network device, the data acquisition server receives current monitoring information from the network device that is connected to it. In cases where multiple data acquisition clients correspond to multiple network devices, the data acquisition server can obtain multiple sets of current monitoring information from these clients. Based on this information, it can determine the network asset topology map established by the multiple network devices. Since the data acquisition server runs on a server, the server can utilize it to obtain the network asset topology map. Specifically, the data acquisition server can directly obtain multiple sets of current monitoring information from multiple network devices via multiple clients, thus determining the network asset topology map. This method of obtaining the network asset topology map from the network devices does not affect the transmission of business information between the network devices and the server, meaning it does not impose additional overhead or pressure on the network, thereby improving business processing efficiency.

[0147] Based on the same inventive concept as the above-mentioned network asset topology monitoring method, this application provides a data collection client 1, corresponding to a network asset topology monitoring method applied in the data collection client; Figure 12 A schematic diagram of the composition structure of a data acquisition client provided in this application embodiment. Figure 1 The data collection client 1 may include:

[0148] The first acquisition unit 11 is used to acquire current monitoring information that is connected to the network device from the network device when it receives a monitoring instruction sent by the acquisition server;

[0149] The first sending unit 12 is used to send the current monitoring information to the data collection server so that the data collection server can determine the network asset topology map established based on the network device according to the current monitoring information.

[0150] In some embodiments of this application, the acquisition client further includes a second determining unit;

[0151] The first acquisition unit 11 is used to acquire current baseline information when the monitoring instruction is a first monitoring instruction; the current baseline information is the previous monitoring information updated after receiving the first monitoring instruction and the last report to the acquisition server; the first monitoring instruction is used to instruct the incremental reporting of monitored information to the acquisition server;

[0152] The second determining unit is used to determine the incremental monitoring information between the current baseline information and the current monitoring information;

[0153] The first sending unit 12 is used to send the incremental monitoring information to the collection server when the periodic reporting time point arrives; the periodic reporting time point is carried in the first monitoring instruction.

[0154] In some embodiments of this application, the second determining unit is used to determine the current monitoring information as incremental monitoring information when the monitoring instruction is a first monitoring instruction and the current monitoring information is the monitoring information to be reported to the collection server for the first time after receiving the first monitoring instruction.

[0155] In some embodiments of this application, the data acquisition client further includes a blocking unit;

[0156] The prohibition unit is used to prohibit sending a prompt message indicating no incremental monitoring information to the data collection server when the periodic reporting time point arrives, provided that the current monitoring information is the same as the current baseline information.

[0157] In some embodiments of this application, the second determining unit is used to determine the current monitoring information as the next baseline information, so as to report the next incremental monitoring information based on the next baseline information when the next periodic reporting time point arrives.

[0158] In some embodiments of this application, the second determining unit is used to determine the current monitoring information as full monitoring information when the monitoring instruction is a second monitoring instruction; the second monitoring instruction is used to instruct the full reporting of the monitored information to the data collection server;

[0159] The first sending unit 12 is used to send the full monitoring information to the data collection server.

[0160] In some embodiments of this application, the first acquisition unit 11 is used to acquire the server identifier to be connected to the network.

[0161] The first sending unit 12 is used to send a network connection request to the data collection server corresponding to the server identifier, so as to establish a long network connection with the data collection server according to the network connection request, and to perform information interaction with the data collection server based on the long network connection.

[0162] In some embodiments of this application, the first sending unit 12 is configured to resend a network connection request to the data collection server when the long network connection with the data collection server is broken, so as to re-establish a long network connection with the data collection server according to the network connection request; and to send first incremental monitoring information to the data collection server when the current periodic reporting time point arrives.

[0163] The second determining unit is configured to, when the network long connection is successfully re-established and the monitoring instruction sent by the acquisition server is the first monitoring instruction, determine the last baseline information before the network long connection is disconnected; and when the network long connection is successfully re-established and the first monitoring information is obtained from the network device for the first time, determine the first incremental monitoring information between the first monitoring information and the last baseline information.

[0164] In some embodiments of this application, the acquisition client further includes a parsing unit;

[0165] The parsing unit is used to parse the first key-value pair when it receives the first key-value pair sent by the acquisition server, and obtain the parsing result;

[0166] The first acquisition unit 11 is used to acquire current monitoring information that has a connection relationship with the network device from the network device when the parsing result identifies the first key-value pair as the monitoring instruction;

[0167] Correspondingly, the data acquisition client also includes a conversion unit;

[0168] The conversion unit is used to convert the current monitoring information into a second key-value pair;

[0169] The first sending unit 12 is used to send the second key-value pair to the acquisition server.

[0170] It should be noted that, in practical applications, the first acquisition unit 11 and the first transmission unit 12 can be implemented by the first processor 13 on the acquisition client 1, specifically by a CPU (Central Processing Unit), MPU (Microprocessor Unit), DSP (Digital Signal Processor), or FPGA (Field Programmable Gate Array), etc.; the data storage can be implemented by the first memory 14 on the acquisition client 1.

[0171] This application embodiment also provides a data acquisition client 1, such as... Figure 13As shown, the acquisition client 1 includes: a first processor 13, a first memory 14 and a first communication bus 15. The first memory 14 communicates with the first processor 13 through the first communication bus 15. The first memory 14 stores programs that can be executed by the first processor 13. When the program is executed, the network asset topology monitoring method described above is executed through the first processor 13.

[0172] In practical applications, the first memory 14 can be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the first processor 13.

[0173] This application provides a computer-readable storage medium having a computer program thereon, which, when executed by a first processor 13, implements the network asset topology monitoring method as described above.

[0174] For example, this application also provides a computer program product, including a computer program that can be executed by a first processor 13 in a data acquisition client to complete the steps described in the aforementioned network asset topology monitoring method applied to the data acquisition client.

[0175] It is understandable that by setting up data acquisition clients in network devices, these clients can obtain current monitoring information from network devices that are connected to them, and then send this information to the data acquisition server. In cases where multiple data acquisition clients correspond to multiple network devices, the data acquisition server can obtain multiple sets of current monitoring information from these clients. Based on this information, a network asset topology map established by the multiple network devices can be determined. Since the data acquisition server runs on a server, the server can use it to obtain the network asset topology map. Specifically, the data acquisition server can directly obtain multiple sets of current monitoring information from multiple network devices from multiple clients, and then determine the network asset topology map based on this information. This method of obtaining the network asset topology map from the network devices does not affect the transmission of business information between the network devices and the server, meaning it does not impose additional overhead or pressure on the network, thereby improving business processing efficiency.

[0176] Based on the same inventive concept as the above-mentioned network asset topology monitoring method, this application provides a data collection server 2, corresponding to a network asset topology monitoring method applied in the data collection server; Figure 14 A schematic diagram of the composition structure of a data acquisition server provided in this application embodiment. Figure 1 The data collection server 2 may include:

[0177] The second sending unit 21 is used to send monitoring instructions to multiple data acquisition clients respectively;

[0178] The receiving unit 22 is used to receive multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices that are connected to the multiple network devices;

[0179] The first determining unit 23 is used to determine the network asset topology map established based on the multiple sets of current monitoring information based on the multiple network devices.

[0180] In some embodiments of this application, the receiving unit 22 is configured to receive multiple sets of incremental monitoring information collected by the multiple acquisition clients from the multiple network devices when the monitoring instruction is a first monitoring instruction; the first monitoring instruction is configured to instruct the multiple acquisition clients to incrementally report the monitored information; the multiple sets of current monitoring information include the multiple sets of incremental monitoring information;

[0181] Correspondingly, the data acquisition server also includes a second acquisition unit;

[0182] The second acquisition unit is used to acquire multiple sets of current baseline information corresponding to the multiple network devices; the multiple sets of current baseline information are multiple sets of previous monitoring information updated after the multiple acquisition clients have last reported after sending the first monitoring instruction to the multiple acquisition clients respectively;

[0183] The first determining unit 23 is used to determine multiple sets of full monitoring information based on the multiple sets of current baseline information and the multiple sets of incremental monitoring information; and to determine the network asset topology map based on the multiple sets of full monitoring information.

[0184] In some embodiments of this application, the first determining unit 23 is used to determine the multiple sets of full monitoring information as multiple sets of next baseline information corresponding to multiple network devices, so as to determine multiple sets of next full monitoring information based on the multiple sets of next incremental monitoring information and the multiple sets of next baseline information reported by the multiple acquisition clients at the next periodic reporting time point.

[0185] In some embodiments of this application, the receiving unit 22 is configured to receive multiple sets of full monitoring information collected by the multiple acquisition clients from the multiple network devices when the monitoring instruction is a second monitoring instruction; the second monitoring instruction is configured to instruct the multiple acquisition clients to report the monitored information in full; the multiple sets of current monitoring information include the multiple sets of full monitoring information.

[0186] In some embodiments of this application, the second acquisition unit is used to acquire from the multiple sets of monitoring information multiple sets of port operating status, multiple sets of port LAN addresses, multiple sets of port Internet Protocol addresses, multiple sets of peer LAN addresses, multiple sets of peer Internet Protocol addresses, multiple sets of neighbor tables, multiple sets of LAN address tables, multiple sets of routing tables, and multiple sets of address resolution protocol tables.

[0187] The first determining unit 23 is configured to determine the physical topology of the multiple network devices based on the multiple sets of port operating status, the multiple sets of port LAN addresses, the multiple sets of peer LAN addresses, the multiple sets of neighbor tables, the multiple sets of LAN address tables, and the multiple sets of address resolution protocol tables; determine the logical topology of the multiple network devices based on the multiple sets of port operating status, the multiple sets of port Internet Protocol addresses, the multiple sets of peer Internet Protocol addresses, the multiple sets of neighbor tables, the multiple sets of routing tables, and the multiple sets of address resolution protocol tables; and determine the physical topology and logical topology as the network asset topology.

[0188] It should be noted that, in practical applications, the aforementioned second transmitting unit 21, receiving unit 22, and first determining unit 23 can be implemented by the second processor 24 on the acquisition server 2, specifically by a CPU (Central Processing Unit), MPU (Microprocessor Unit), DSP (Digital Signal Processor), or FPGA (Field Programmable Gate Array), etc.; the aforementioned data storage can be implemented by the second memory 25 on the acquisition server 2.

[0189] This application embodiment also provides a data collection server 2, such as... Figure 15 As shown, the data acquisition server 2 includes: a second processor 24, a second memory 25, and a second communication bus 26. The second memory 25 communicates with the second processor 24 through the second communication bus 26. The second memory 25 stores programs executable by the second processor 24. When the program is executed, the network asset topology monitoring method described above is executed through the second processor 24.

[0190] In practical applications, the second memory 25 can be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the second processor 24.

[0191] This application provides a computer-readable storage medium having a computer program thereon, which, when executed by a second processor 24, implements the network asset topology monitoring method as described above.

[0192] For example, this application also provides a computer program product, including a computer program that can be executed by a second processor 24 in a data acquisition server to complete the steps described in the aforementioned network asset topology monitoring method applied to the data acquisition server.

[0193] Understandably, by setting up a data acquisition client in a network device, the data acquisition server receives current monitoring information from the network device that is connected to it. In cases where multiple data acquisition clients correspond to multiple network devices, the data acquisition server can obtain multiple sets of current monitoring information from these clients. Based on this information, it can determine the network asset topology map established by the multiple network devices. Since the data acquisition server runs on a server, the server can utilize it to obtain the network asset topology map. Specifically, the data acquisition server can directly obtain multiple sets of current monitoring information from multiple network devices via multiple clients, thus determining the network asset topology map. This method of obtaining the network asset topology map from the network devices does not affect the transmission of business information between the network devices and the server, meaning it does not impose additional overhead or pressure on the network, thereby improving business processing efficiency.

[0194] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0195] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0196] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0197] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0198] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A method for monitoring network asset topology, characterized in that, Applied to a data acquisition client, the method includes: Upon receiving a monitoring instruction from the data acquisition server, the system retrieves current monitoring information from the network device that is connected to the network device; the network device is equipped with a data acquisition client. The current monitoring information is sent to the data collection server so that the data collection server can determine the network asset topology map established based on the network devices according to the current monitoring information; Sending the current monitoring information to the data collection server includes: When the monitoring instruction is the first monitoring instruction, the current baseline information is obtained; the current baseline information is the previous monitoring information updated after receiving the first monitoring instruction and the last report to the data collection server; the first monitoring instruction is used to instruct the incremental reporting of the monitored information to the data collection server; Determine the incremental monitoring information between the current baseline information and the current monitoring information; When the periodic reporting time point arrives, the incremental monitoring information is sent to the data collection server; the periodic reporting time point is carried in the first monitoring instruction.

2. The method according to claim 1, characterized in that, Before sending the incremental monitoring information to the data collection server when the periodic reporting time point arrives, the method further includes: If the monitoring instruction is a first monitoring instruction and the current monitoring information is the monitoring information to be reported to the collection server for the first time after receiving the first monitoring instruction, the current monitoring information is determined as incremental monitoring information.

3. The method according to claim 1, characterized in that, After obtaining the current baseline information, the method further includes: If the current monitoring information is the same as the current baseline information, when the periodic reporting time point arrives, it is prohibited to send a prompt message indicating that there is no incremental monitoring information to the data collection server.

4. The method according to any one of claims 1 or 2, characterized in that, After sending the incremental monitoring information to the data collection server when the periodic reporting time point arrives, the method further includes: The current monitoring information is determined as the next baseline information, so that when the next periodic reporting time point arrives, the next incremental monitoring information is reported based on the next baseline information.

5. The method according to claim 1, characterized in that, Sending the current monitoring information to the data collection server includes: When the monitoring instruction is the second monitoring instruction, the current monitoring information is determined as the full monitoring information; the second monitoring instruction is used to instruct the full reporting of the monitored information to the data collection server; Send the full monitoring information to the data collection server.

6. The method according to claim 1, characterized in that, Before obtaining current monitoring information that is connected to the network device from the network device upon receiving a monitoring instruction from the data acquisition server, the method further includes: Obtain the identifier of the server to be connected to in the network; A network connection request is sent to the data collection server corresponding to the server identifier, so as to establish a long network connection with the data collection server according to the network connection request, and to exchange information with the data collection server based on the long network connection.

7. The method according to claim 6, characterized in that, After sending the current monitoring information to the data collection server, the method further includes: If the long-term network connection with the data acquisition server is broken, a new network connection request is sent to the data acquisition server to re-establish a long-term network connection with the data acquisition server based on the network connection request. If the network long connection is successfully re-established and the monitoring instruction sent by the data collection server is the first monitoring instruction, determine the last baseline information before the network long connection was disconnected; After the network long connection is successfully re-established and the first monitoring information is obtained from the network device for the first time, the first incremental monitoring information between the first monitoring information and the last baseline information is determined; When the current periodic reporting time arrives, the first incremental monitoring information is sent to the data collection server.

8. The method according to claim 1, characterized in that, Upon receiving a monitoring instruction from the data acquisition server, the step of retrieving current monitoring information from the network device that is connected to the network device includes: Upon receiving the first key-value pair sent by the data collection server, the first key-value pair is parsed to obtain the parsing result; If the parsing result identifies the first key-value pair as the monitoring instruction, the current monitoring information that is connected to the network device is obtained from the network device; Accordingly, sending the current monitoring information to the data collection server includes: Convert the current monitoring information into a second key-value pair; Send the second key-value pair to the data collection server.

9. A method for monitoring network asset topology, characterized in that, Applied to the data collection server, the method includes: Send monitoring commands to multiple data acquisition clients respectively; Receive multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices that are connected to the multiple network devices; Based on the multiple sets of current monitoring information, a network asset topology map is determined based on the multiple network devices; The step of receiving multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices and having connection relationships with the multiple network devices includes: When the monitoring instruction is a first monitoring instruction, multiple sets of incremental monitoring information collected by the multiple acquisition clients from the multiple network devices are received; the first monitoring instruction is used to instruct the multiple acquisition clients to incrementally report the monitored information; the multiple sets of current monitoring information include the multiple sets of incremental monitoring information; Accordingly, determining the network asset topology map established based on the multiple sets of current monitoring information, according to the multiple network devices, includes: Acquire multiple sets of current baseline information corresponding to the multiple network devices; the multiple sets of current baseline information are multiple sets of previous monitoring information updated after the multiple acquisition clients have last reported after sending the first monitoring instruction to the multiple acquisition clients respectively; Based on the multiple sets of current baseline information and the multiple sets of incremental monitoring information, multiple sets of full monitoring information are determined; The network asset topology is determined based on the multiple sets of full monitoring information.

10. The method according to claim 9, characterized in that, After determining multiple sets of full-quantity monitoring information based on the multiple sets of current baseline information and the multiple sets of incremental monitoring information, the method further includes: The multiple sets of full monitoring information are respectively determined as multiple sets of next baseline information corresponding to multiple network devices, so as to determine multiple sets of next full monitoring information based on the multiple sets of next incremental monitoring information and the multiple sets of next baseline information reported by the multiple acquisition clients at the next periodic reporting time point.

11. The method according to claim 9, characterized in that, The receiving of multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices and having connection relationships with the multiple network devices includes: When the monitoring instruction is the second monitoring instruction, multiple sets of full monitoring information collected by the multiple acquisition clients from the multiple network devices are received; the second monitoring instruction is used to instruct the multiple acquisition clients to report the monitored information in full; the multiple sets of current monitoring information include the multiple sets of full monitoring information.

12. The method according to claim 9, characterized in that, The step of determining the network asset topology map based on the multiple sets of current monitoring information, established according to the multiple network devices, includes: From the multiple sets of monitoring information, obtain multiple sets of port operating status, multiple sets of port LAN addresses, multiple sets of port Internet Protocol addresses, multiple sets of peer LAN addresses, multiple sets of peer Internet Protocol addresses, multiple sets of neighbor tables, multiple sets of LAN address tables, multiple sets of routing tables, and multiple sets of address resolution protocol tables; The physical topology of the multiple network devices is determined based on the operating status of the multiple sets of ports, the local area network addresses of the multiple sets of ports, the local area network addresses of the multiple sets of peer local area networks, the multiple sets of neighbor tables, the multiple sets of local area network address tables, and the multiple sets of address resolution protocol tables. The logical topology of the multiple network devices is determined based on the multiple sets of port operating status, the multiple sets of port Internet Protocol addresses, the multiple sets of peer Internet Protocol addresses, the multiple sets of neighbor tables, the multiple sets of routing tables, and the multiple sets of address resolution protocol tables. The physical topology diagram and the logical topology diagram are determined as the network asset topology diagram.

13. A data acquisition client, characterized in that, The data acquisition client includes: The first acquisition unit is used to acquire current monitoring information that is connected to the network device from the network device when it receives a monitoring instruction sent by the acquisition server; The first sending unit is used to send the current monitoring information to the data collection server so that the data collection server can determine the network asset topology map established based on the network device according to the current monitoring information; Sending the current monitoring information to the data collection server includes: When the monitoring instruction is the first monitoring instruction, the current baseline information is obtained; the current baseline information is the previous monitoring information updated after receiving the first monitoring instruction and the last report to the data collection server; the first monitoring instruction is used to instruct the incremental reporting of the monitored information to the data collection server; Determine the incremental monitoring information between the current baseline information and the current monitoring information; When the periodic reporting time point arrives, the incremental monitoring information is sent to the data collection server; the periodic reporting time point is carried in the first monitoring instruction.

14. A data acquisition server, characterized in that, The data collection server includes: The second sending unit is used to send monitoring commands to multiple data acquisition clients respectively; The receiving unit is used to receive multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices that are connected to the multiple network devices; The first determining unit is used to determine a network asset topology map established based on the multiple sets of current monitoring information based on the multiple network devices. The step of receiving multiple sets of current monitoring information collected by the multiple acquisition clients from multiple network devices and having connection relationships with the multiple network devices includes: When the monitoring instruction is a first monitoring instruction, multiple sets of incremental monitoring information collected by the multiple acquisition clients from the multiple network devices are received; the first monitoring instruction is used to instruct the multiple acquisition clients to incrementally report the monitored information; the multiple sets of current monitoring information include the multiple sets of incremental monitoring information; Accordingly, determining the network asset topology map established based on the multiple sets of current monitoring information, according to the multiple network devices, includes: Acquire multiple sets of current baseline information corresponding to the multiple network devices; the multiple sets of current baseline information are multiple sets of previous monitoring information updated after the multiple acquisition clients have last reported after sending the first monitoring instruction to the multiple acquisition clients respectively; Based on the multiple sets of current baseline information and the multiple sets of incremental monitoring information, multiple sets of full monitoring information are determined; The network asset topology is determined based on the multiple sets of full monitoring information.

15. A data acquisition client, characterized in that, The data acquisition client includes: A first memory, a first processor, and a first communication bus, wherein the first memory communicates with the first processor via the first communication bus, and the first memory stores a network asset topology monitoring program executable by the first processor. When the network asset topology monitoring program is executed, the method described in any one of claims 1 to 8 is executed via the first processor.

16. A data acquisition server, characterized in that, The data collection server includes: A second memory, a second processor, and a second communication bus, wherein the second memory communicates with the second processor via the second communication bus, and the second memory stores a network asset topology monitoring program executable by the second processor. When the network asset topology monitoring program is executed, the method described in any one of claims 9 to 12 is executed by the second processor.

17. A storage medium storing a computer program thereon, used for data acquisition client and data acquisition server, characterized in that, When the computer program is executed by the first processor, it implements the method according to any one of claims 1 to 8; when the computer program is executed by the second processor, it implements the method according to any one of claims 9 to 12.

18. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the first processor, it implements the method according to any one of claims 1 to 8; when the computer program is executed by the second processor, it implements the method according to any one of claims 9 to 12.

Images