A cloud network packet capture and analysis method and related equipment

Abstract

The disclosed embodiment provides a packet capture and analysis method and related equipment for a cloud network, by sending first configuration information to the first virtual network device on the traffic path, the first configuration information is used to instruct the first virtual network device to dye the target service message corresponding to the target tenant, generate dyed messages and upload tracking logs, and instruct other virtual network devices on the traffic path to upload tracking logs for the dyed messages when receiving the dyed messages; receive the tracking log uploaded by the virtual network device, and determine the target virtual network device and the corresponding packet capture rules based on the tracking log, and send a packet capture instruction to the target virtual network device, so that the target virtual network device obtains the original message data corresponding to the target service message based on the packet capture rules. The original message data is captured based on the packet capture rules, thus overcoming the problem that the cloud network cannot reuse traditional packet capture methods.

Description

Technical Field

[0001] The disclosed embodiments relate to the technical field of cloud networks, and in particular to a packet capture and analysis method for a cloud network and related equipment. Background Art

[0002] Currently, in cloud networks, when a tenant's business encounters a packet loss problem, it is necessary to first determine the corresponding message forwarding path, and then troubleshoot the problem based on the message forwarding path. However, the message forwarding path that carries traffic is calculated by comprehensively considering the use of some resources such as bandwidth, disaster recovery, cost, and water level, and this process will change dynamically. At the same time, the business traffic of different tenants will also change based on their own needs. Therefore, it is difficult for cloud vendors to infer their specific message forwarding path in real time and accurately.

[0003] In the related art, messages can be tracked by marking them, thereby determining the message forwarding path. However, the solutions in the prior art cannot obtain the original message data while tracking the messages, which leads to low efficiency in troubleshooting abnormal devices in the cloud network. Summary of the invention

[0004] The disclosed embodiments provide a cloud network packet capture and analysis method and related devices to overcome the problem of low efficiency in troubleshooting abnormal devices in the cloud network.

[0005] In a first aspect, an embodiment of the present disclosure provides a packet capture and analysis method for a cloud network, including:

[0006] Sending first configuration information to a first virtual network device on a traffic path, wherein the first configuration information is used to instruct the first virtual network device to dye a target service message corresponding to a target tenant, generate a dyed message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload a tracking log for the dyed message when receiving the dyed message;

[0007] After the first virtual network device forwards the dyed message, receiving a tracking log uploaded by the virtual network device, and determining a target virtual network device and a corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message;

[0008] A packet capture instruction is sent to the target virtual network device, so that the target virtual network device obtains original message data corresponding to the target service message based on the packet capture rule.

[0009] In a second aspect, an embodiment of the present disclosure provides a packet capture and analysis device for a cloud network, including:

[0010] A configuration module, configured to send first configuration information to a first virtual network device on a traffic path, wherein the first configuration information is used to instruct the first virtual network device to dye a target service message corresponding to a target tenant, generate a dyed message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload a tracking log for the dyed message when receiving the dyed message;

[0011] A determination module, configured to receive a tracking log uploaded by a virtual network device after the first virtual network device forwards the dyed message, and determine a target virtual network device and a corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message;

[0012] The processing module is used to send a packet capture instruction to the target virtual network device, so that the target virtual network device obtains the original message data corresponding to the target service message based on the packet capture rule.

[0013] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: a processor and a memory;

[0014] The memory stores computer-executable instructions;

[0015] The processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the packet capture and analysis method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0016] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the packet capture and analysis method of the cloud network as described in the first aspect and various possible designs of the first aspect is implemented.

[0017] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the packet capture and analysis method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0018] The present embodiment provides a cloud network packet capture and analysis method and related equipment, which sends first configuration information to the first virtual network device on the traffic path, wherein the first configuration information is used to instruct the first virtual network device to color the target business packet corresponding to the target tenant, generate a colored packet and upload a tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log for the colored packet when receiving the colored packet; after the first virtual network device forwards the colored packet, the tracking log uploaded by the virtual network device is received, and the target virtual network device and the corresponding packet capture rule are determined according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the colored packet; and a packet capture instruction is sent to the target virtual network device so that the target virtual network device obtains the original packet data corresponding to the target business packet based on the packet capture rule. By obtaining the tracking logs generated by message tracking, the tracking logs are automatically analyzed to determine the packet capture device and packet capture rules, and finally the original message data is captured based on the packet capture rules. This overcomes the problem that the cloud network cannot reuse traditional packet capture methods, and can decouple the computing packet capture device and packet capture rules to reuse the architecture of traditional packet capture capabilities without intruding on the message forwarding logic, making the entire solution easier to implement and deploy. While coloring the business messages and uploading the tracking logs, the corresponding original message data is obtained, avoiding the process of secondary capture of the original message data, improving the capture and analysis efficiency of data messages, and improving the troubleshooting efficiency of abnormal devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1 An application scenario diagram of the cloud network packet capture and analysis method provided by the embodiment of the present disclosure;

[0021] Figure 2 Schematic diagram of the process of the packet capture and analysis method of the cloud network provided by the embodiment of the present disclosure Figure 1 ;

[0022] Figure 3 for Figure 2 A flowchart of a specific implementation method of step S102 in the illustrated embodiment;

[0023] Figure 4 for Figure 3A flowchart of a specific implementation method of step S1022 in the illustrated embodiment;

[0024] Figure 5 A schematic diagram of a process for determining packet capture rules provided by an embodiment of the present disclosure;

[0025] Figure 6 Schematic diagram of the process of the packet capture and analysis method of the cloud network provided by the embodiment of the present disclosure Figure 2 ;

[0026] Figure 7 for Figure 6 A flowchart of a specific implementation method of step S208 in the illustrated embodiment;

[0027] Figure 8 A structural block diagram of a packet capture and analysis device for a cloud network provided in an embodiment of the present disclosure;

[0028] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure;

[0029] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0031] The application scenarios of the embodiments of the present disclosure are explained below:

[0032] Figure 1An application scenario diagram of the packet capture and analysis method of the cloud network provided by the embodiment of the present disclosure, the packet capture and analysis method of the cloud network provided by the embodiment of the present disclosure can be applied to the packet tracking in the cloud network, and the application scenario of abnormal detection for the virtual network device in the network. The execution subject of this embodiment can be a server or other electronic device used to perform the above tasks in the cloud network, and the above execution subject can be a virtual device or a physical device. Among them, taking the server as an example, in some embodiments, the above server can implement the packet capture and analysis method of the cloud network provided by the embodiment of the present application by running various computer executable instructions or computer programs. For example, the computer executable instructions can be program-level commands, machine instructions or software instructions. The computer program can be a native program or software module in the operating system; it can be a local application, that is, a program that needs to be installed in the operating system to run, or it can be a program running based on the browser environment. In summary, the above computer executable instructions can be instructions in any form, and the above computer program can be an application, module or plug-in in any form, and the specific implementation form can be configured as needed. Furthermore, in some embodiments, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud storage, cloud communications, cloud databases, cloud computing, cloud functions, network services, middleware services, domain name services, security services, content delivery networks (CDNs), as well as big data and artificial intelligence platforms, among which cloud services can be interactive processing services for terminal devices to call.

[0033] refer to Figure 1 As shown in , between the target user's computing node P0 and the Internet Service Provider (ISP), it is necessary to forward through three virtual network devices (i.e., virtual network devices) P1, P2, and P3 in sequence. Exemplarily, the above P1, P2, and P3 are used to implement the functions of the Next Generation Gateway (NGW), the Virtual Private Network Gateway (VPC Gateway, XGW), and the Internet Gateway (Internet Gateway, IGW), respectively. In the prior art, when it is necessary to capture the service messages transmitted from the computing node to the ISP via the virtual network devices P1, P2, and P3, it is usually necessary to additionally deploy a control server in the cloud network to configure the above virtual network devices P1, P2, and P3, respectively, so that each virtual network device can identify the service messages sent from the target user's computing node P0, and then complete the tracking of the service messages.

[0034] However, the solutions in the prior art cannot obtain the corresponding original message data while tracking the business messages in the above process. Instead, they can only locate the position of the abnormal node based on the results of message tracking, but cannot determine the cause of the abnormality of the abnormal node, thereby affecting the subsequent troubleshooting of the abnormal node.

[0035] The disclosed embodiment provides a cloud network packet capture and analysis method to solve the above-mentioned problem.

[0036] refer to Figure 2 , Figure 2 Schematic diagram of the process of the packet capture and analysis method of the cloud network provided by the embodiment of the present disclosure Figure 1 The method of this embodiment can be applied in a control server (hereinafter referred to as the server). The packet capture and analysis method of the cloud network includes:

[0037] Step S101: Send first configuration information to the first virtual network device on the traffic path, where the first configuration information is used to instruct the first virtual network device to dye the target service message corresponding to the target tenant, generate the dyed message and upload the tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log for the dyed message when receiving the dyed message.

[0038] Step S102: After the first virtual network device forwards the dyed message, a tracking log uploaded by the virtual network device is received, and a target virtual network device and a corresponding packet capture rule are determined according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message.

[0039] For example, reference Figure 1 In the schematic diagram of the application scenario shown, the server sends the first configuration information to the first virtual network device located in the forwarding plane. The virtual network device is a virtual device in the cloud network. After receiving the first configuration information, the first virtual network device in the forwarding plane will execute the processing logic of coloring the target business message. Among them, the target business message is the business traffic of the target tenant, in the application scenario of detecting the traffic path formed by the network device rented by the target tenant to determine the abnormal network device therein. The first configuration information contains the identification rules of the target business message corresponding to the target tenant, that is, the coloring rules. By configuring the coloring rules to the first virtual network device in the cloud network, the first virtual network device is controlled to color the target business message corresponding to the target tenant and upload the tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log when receiving the colored message.

[0040] Exemplarily, after the first virtual network device identifies the target service message, it will dye it, that is, add a dyeing mark to the specified header field of the target service message, generate a dyed target service message, that is, a dyed message, and forward it to the next-hop virtual network device. After receiving the dyed message, the virtual network device will continue to forward it to the next-hop virtual network device on the one hand, and on the other hand, it will form a corresponding log file to record the receipt / sending of the dyed message. Exemplarily, the log file is a tracking log. In a possible implementation, the tracking log contains relevant information for the dyed message, which is obtained by parsing the dyed message, for example, the five-tuple information of the dyed message, etc.

[0041] Afterwards, the server receives the tracking log uploaded by the virtual network device, and determines the target virtual network device and the corresponding packet capture rules based on the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed messages. On the traffic path, due to the implementation of load balancing technology, the virtual network device that actually receives and forwards the dyed messages will change, and the target virtual network device is the virtual network device that actually receives and forwards the dyed messages on the traffic path.

[0042] In one possible implementation, Figure 3 As shown, the specific implementation of step S102 includes:

[0043] Step S1021: Generate metadata for the target service message according to the tracking log, where the metadata includes network transmission parameters of the target service message and a network address corresponding to the target virtual network device.

[0044] Step S1022: According to the metadata, the tracking logs of the target virtual network devices belonging to the same network address are merged to obtain a merged log corresponding to the target virtual network device.

[0045] Step S1023: obtaining at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generating a packet capture rule corresponding to the target virtual network device according to the at least one set of network transmission parameters.

[0046] Exemplarily, first, according to the tracking log, the metadata of the target service message is obtained. In a possible implementation, the tracking log is generated based on the five-tuple information and the vxlan protocol header information. Since the tracking log is generated by the virtual network device when forwarding the target service message, the metadata is a collection of tracking logs uploaded by each virtual network device. By parsing the content of the tracking log, the metadata of the network transmission parameters of the corresponding target service message can be obtained. After that, the metadata of the network transmission parameters of the target service message is used as the message identification rule to determine the target virtual network device and the corresponding packet capture rule, so as to realize the capture of the original message data of the target service message. The tracking log contains a module type identifier, a forwarding device identification code and a network transmission parameter. The module type identifier represents the functional type of the corresponding virtual network device, and the forwarding device identification code represents the network address of the corresponding virtual network device; the network transmission parameters include: inner message source address, inner message source port, inner message destination address, inner message destination port, inner protocol type, network identifier of the virtual extensible local area network, the location of the original message data in each forwarding device, outer source IP, and outer destination IP.

[0047] Furthermore, in a possible implementation, the metadata includes first-class parameters and second-class parameters, the first-class parameters are used to characterize the network address corresponding to the target virtual network device, and the second-class parameters are used to characterize the network transmission parameters of the target service message; exemplarily, the server obtains the first-class parameters and the second-class parameters, i.e., the network address corresponding to the target virtual network device and the network transmission parameters of the target service message, by parsing the metadata, and then the server first merges the tracking logs using the first-class parameters, i.e., the tracking logs with the same parameter values ​​of the first-class parameters in the corresponding metadata are determined to be tracking logs generated by the same network device. For example, in the tracking log Log1, the first-class parameter ncip is included, which characterizes the network address of the target virtual network device, and exemplarily, the corresponding parameter value is, for example, 1.1.1.1; in the tracking log Log2, the same first-class parameter ncip is included, and if the parameter value of the first-class parameter is also 1.1.1.1, then the network device corresponding to the tracking log Log1 and the network device corresponding to the tracking log Log2 are the same network device (target virtual network device). In this case, the tracking log Log1 and the tracking log Log2 can be merged into one group, namely, the tracking log corresponding to the target virtual network device. Afterwards, the tracking log also includes the second type of parameters. For example, the second type of parameters include information such as the inner message source address, the inner message source port, and the inner message destination address. For the above-mentioned merged tracking log, the corresponding network transmission parameters and the parameter values ​​of the network transmission parameters indicated by the second type of parameters are obtained based on the second type of parameters, and the above-mentioned network transmission parameters are used as packet capture rules to perform subsequent packet capture of message data.

[0048] In one possible implementation, the metadata also includes a third type of parameter, which is used to characterize the function type of the target virtual network device. For example, the third type of parameter is BVS (baseline verification system), LB (load balancer), VGW (virtual gateway), etc. Accordingly, in one possible implementation, the specific implementation of step S1022 includes:

[0049] Step S1022A: merging the tracking logs of the target virtual network devices belonging to the same function type and network address to obtain a merged log corresponding to the target virtual network device.

[0050] Exemplarily, in the steps of this embodiment, the tracking logs are merged using both the function type and the network address as key values, that is, the tracking logs with the same network address and function type are regarded as tracking logs generated by the same target virtual network device, and then they are merged to generate corresponding merged logs.

[0051] In another possible implementation, Figure 4As shown, the specific implementation of step S102 includes:

[0052] Step S1024: Generate metadata for the target service message according to the tracking log, where the metadata includes network transmission parameters of the target service message and a function type corresponding to the target virtual network device.

[0053] Step S1025: According to the metadata, the tracking logs of the target virtual network devices belonging to the same function type are merged to obtain a merged log corresponding to the target virtual network device.

[0054] Step S1026: obtaining at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generating a packet capture rule corresponding to the target virtual network device according to the at least one set of network transmission parameters.

[0055] For example, Figure 3 Similar to the illustrated embodiment, in this embodiment, after obtaining the metadata, the tracking logs are merged based on the function type in the metadata as the key value, that is, the tracking logs with the same function type are regarded as tracking logs generated by the same target virtual network device, and then they are merged to generate corresponding merged logs. The specific implementation process can be referred to the introduction in the previous embodiment, and will not be repeated here.

[0056] In a possible implementation, exemplarily, the first type of parameters includes a forwarding device identification code (ncip), which is used to characterize the network address of the virtual network device; the second type of parameters includes: inner message source address (saddr), inner message source port (sport), inner message destination address (daddr), inner message destination port (dport), inner protocol type (proto), virtual extensible LAN network identifier (VNI), the location of the original message data in each forwarding device (loc), outer source IP (out_sip), outer destination IP (out_dip), timestamp (timestamp), etc., that is, network transmission parameters. The third type of parameters includes a module type identifier, which characterizes the functional type of the corresponding virtual network device. The third type of parameters are, for example, BVS (baseline verification system), LB (load balancer), VGW (virtual gateway), etc. The forwarding device identification code, module type identifier and network transmission parameters are recorded in the tracking log. Among them, the location of the original message data in each forwarding device includes the location of the input forwarding device and the location of the output forwarding device.

[0057] Figure 5 A schematic diagram of a process for determining a packet capture rule provided in an embodiment of the present disclosure is shown below. Figure 5The above process is introduced in more detail. For example, after obtaining multiple tracking logs (tracking log sets) uploaded by each virtual network device, the server groups the above tracking logs according to the module category identifier and the forwarding device identification code in the tracking log. For example, as shown in the figure, the module category identifiers of tracking log #1 and tracking log #2 are both BVS (represented as module=BVS in the figure), and the forwarding device identification code (first type parameter) is both 33.1.4.3 (represented as nvip=33.1.4.3 in the figure). Therefore, tracking log #1 and tracking log #2 are merged into the tracking log of the target virtual network device BVS-33.1.4.3. Similarly, the parameter values ​​of the module category identifiers of tracking log #3 and tracking log #4 are both NGW (represented as module=NGW in the figure), and the forwarding device identification code is both 10.3.4.1 (represented as nvip=10.3.4.1 in the figure). Therefore, tracking log #3 and tracking log #4 are merged into the tracking log of the target virtual network device NGW-10.3.4.1. Afterwards, taking tracking log #1 and tracking log #2 as examples, the second type of parameters include one or more of the inner message source address, inner message source port, inner message destination address, inner message destination port, inner protocol type, network identifier of the virtual extensible LAN, location of the original message data in each forwarding device, outer source IP, and outer destination IP. After deduplication and merging, the parameter values ​​corresponding to the above second type of parameters in tracking log #1 and the parameter values ​​corresponding to the above second type of parameters in tracking log #2 are used as network transmission parameters. For example, the second parameter "inner message source address" in tracking log #1 is a (expressed as: saddr=a), and the "inner message source address" in tracking log #2 is also a (expressed as: saddr=a), then the network transmission parameters include [saddr=a]; for another example, the second parameter "the location of the original message data in each forwarding device" in tracking log #1 is addr1 (expressed as loc=addr_1), and the second parameter "the location of the original message data in each forwarding device" in tracking log #2 is addr_2 (expressed as loc=addr_2), then the network transmission parameters include [loc=addr_1, addr_2]. The above parameter values ​​addr_1 and addr_2 represent an OR relationship, that is, when the location of the original message data in each forwarding device is addr_1 or addr_2, the packet capture condition is met.

[0058] Step S103: Sending a packet capture instruction to the target virtual network device, so that the target virtual network device obtains original message data corresponding to the target service message based on the packet capture rule.

[0059] Exemplarily, after determining the target virtual network device and the corresponding packet capture rule, the server issues a corresponding packet capture instruction for each target virtual network device. In one possible implementation, the packet capture instruction includes a packet capture rule corresponding to the target virtual network device sent. The target virtual network device that receives the packet capture instruction will capture the original message data based on the packet capture rule in the packet capture instruction. In another possible implementation, after or at the same time as the packet capture instruction, the corresponding packet capture rule is sent to the target virtual network device, so that the target virtual network device obtains the packet capture rule and captures the original message data based on the packet capture rule. The method of transmitting the packet capture rule to the target virtual network device can be set according to specific needs, which will not be repeated here.

[0060] After receiving the packet capture instruction and the corresponding packet capture rules, the target virtual network device will identify all forwarded message data based on the packet capture rules, and after identifying the message that meets the packet capture rules, it will capture it, thereby obtaining the original message data of the above-mentioned target business message. After that, the target virtual network device will send the original message to the data processing end, such as the execution subject of the method provided in this embodiment, that is, the server, or an external device, so as to achieve the purpose of coloring and tracking the target business message while obtaining the corresponding original message data. Finally, based on the analysis and diagnosis of the original message data obtained in the steps of this embodiment, the abnormal device in the network traffic path corresponding to the target tenant can be determined.

[0061] In this embodiment, the first configuration information is sent to the first virtual network device on the traffic path, and the first configuration information is used to instruct the first virtual network device to color the target business message corresponding to the target tenant, generate a colored message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log for the colored message when receiving the colored message; after the first virtual network device forwards the colored message, the tracking log uploaded by the virtual network device is received, and the target virtual network device and the corresponding packet capture rule are determined according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the colored message; and a packet capture instruction is sent to the target virtual network device so that the target virtual network device obtains the original message data corresponding to the target business message based on the packet capture rule. That is, a tracking task is sent to the first virtual network device, which colors the hit data packets and uploads the tracking log. After forwarding the colored packets, other virtual network devices also upload the tracking logs after hitting the colored packets. Then, the target network device and the corresponding packet capture rules are determined based on the tracking logs. Finally, the original packet data is captured based on the packet capture rules. In this way, the forwarding topology and packet information of the cloud group message can be truly tracked. By obtaining the tracking logs generated by the message tracking, the packet capture device and the packet capture rules are determined by automatically analyzing the tracking logs. Finally, the original packet data is captured based on the packet capture rules, thereby overcoming the problem that the cloud network cannot reuse traditional packet capture methods, and can decouple the calculation of the packet capture device and the packet capture rules. In this way, the architecture of reusing traditional packet capture capabilities does not invade the message forwarding logic, making the whole solution easier to implement and deploy. While realizing the coloring of the business message and uploading the tracking log, the corresponding original message data is obtained to avoid the process of secondary capture of the original message data, improve the capture and analysis efficiency of data messages, and improve the troubleshooting efficiency of abnormal devices.

[0062] refer to Figure 6 , Figure 6 Schematic diagram of the process of the packet capture and analysis method of the cloud network provided by the embodiment of the present disclosure Figure 2 In this embodiment Figure 2 On the basis of the illustrated embodiment, step S102 is further refined, and the packet capture and analysis method of the cloud network includes:

[0063] Step S201: Send first configuration information to the first virtual network device on the traffic path, where the first configuration information is used to instruct the first virtual network device to dye the target service message corresponding to the target tenant, generate the dyed message and upload the tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log for the dyed message when receiving the dyed message.

[0064] Step S202: After the first virtual network device forwards the dyed message, a tracking log uploaded by the virtual network device is received.

[0065] Step S203: According to the tracking log, the metadata of the target service message and the traffic topology of the target tenant are obtained.

[0066] For example, reference Figure 2 In the embodiment shown, after the server sends the first configuration information to the first virtual network device on the traffic path, it configures the first virtual network device to identify the received service message, and when identifying the target service message belonging to the target tenant, it dyes it and forwards it downstream. In the forwarding process, the virtual network device that receives the dyed message generates a corresponding tracking log and uploads it to the server. The process is Figure 2 The illustrated embodiment has been described in detail and will not be described again here.

[0067] After that, the server obtains the tracking log and parses it, and uses the information in the tracking log to obtain the metadata of the target business message and the traffic topology of the target tenant. Among them, on the one hand, the metadata of the target business message is used to characterize the network transmission parameters of the target business message, such as five-tuple information, vxlan protocol header information, etc., which will not be repeated here. On the other hand, in the process of the target business message being transmitted from the upstream to the downstream of the traffic path, the tracking log generated by each virtual network device will record the corresponding network transmission parameters, thereby determining the network address of the upstream virtual network device, the network address of the downstream virtual network device and other information. After that, by combining the tracking logs uploaded by each virtual network device, an actual traffic path composed of the network addresses of the virtual network devices can be formed. The actual traffic path can characterize the transmission path of the target tenant's business traffic, that is, the traffic topology.

[0068] Step S204: Determine the target virtual network device and the corresponding packet capture rule according to the metadata of the target service message.

[0069] Step S205: Sending a packet capture instruction to the target virtual network device, so that the target virtual network device obtains original message data corresponding to the target service message based on the packet capture rule.

[0070] Step S206: receiving original message data sent by the target virtual network device.

[0071] For example, reference Figure 2As described in the illustrated embodiment, the server can obtain metadata of the target business message recorded in the tracking log by parsing the tracking log. After that, the metadata can be divided into the first type of parameters and the second type of parameters, and the target virtual network device is determined based on the first type of parameters, and the packet capture rules are determined based on the second type of parameters. After that, based on the target virtual network device determined in the previous step and the corresponding packet capture rules, a corresponding packet capture instruction is sent to it. The target virtual network device responds to the packet capture instruction, and after identifying the received business message based on the packet capture rules, the process of capturing the original message data can be completed. After that, the original message data is sent to the server.

[0072] Step S207: Based on the traffic topology, a topology identifier is added to the original message data to generate topology message data, wherein the topology identifier is used to indicate the position of each target virtual network device in the traffic path corresponding to the target tenant.

[0073] Step S208: Determine the abnormal virtual network device in the cloud network according to the original message data or the topology message data, or send the topology message data to the data processing server.

[0074] Furthermore, in this embodiment, after the server obtains the original message data, the above discrete original message data cannot show the relationship between the corresponding collection ends, that is, it cannot show the path position relationship (upstream and downstream relationship) between the corresponding target virtual network devices. Therefore, if the diagnosis and troubleshooting of abnormal devices are performed directly through the original message data, there is a problem of lack of link location information of the target virtual network device corresponding to the collected original message data. The lack of link location information for the target virtual network device will lead to the subsequent inability to diagnose and troubleshoot the abnormal device from the global perspective of the traffic path, affecting the troubleshooting efficiency and accuracy of the abnormal device. In this embodiment, after obtaining the original message data, the server adds a topology identifier to the original message data based on the traffic topology generated according to the tracking log in the previous step to generate topology message data, wherein the topology identifier is used to indicate the position of each target virtual network device in the traffic path corresponding to the target tenant. Afterwards, the abnormal virtual network device in the cloud network is determined based on the original message data or the topology message data, or the topology message data is sent to the data processing server for subsequent diagnosis and troubleshooting of the abnormal device. Since the link location information for the target virtual network device is supplemented, the troubleshooting efficiency and accuracy of the abnormal device can be improved.

[0075] Specifically, in one possible implementation, the traffic topology includes a device identifier corresponding to each target virtual network device and a corresponding topology identifier. After receiving the original message data, the server queries the traffic topology based on the device identifier of the source of the original message data (i.e., the target virtual network device that sends the original message data), and obtains the topology identifier corresponding to the target virtual network device. In one possible implementation, the device identifier is, for example, the network address of the network device, and the topology identifier is, for example, the sorting number of the network device in the traffic path.

[0076] Furthermore, in a possible implementation, Figure 7 As shown, the specific implementation of step S208 includes:

[0077] Step S2081: Generate a topology identifier corresponding to the original message data according to the traffic topology.

[0078] Step S2082: Add the topology identifier to the data identifier of the original message data to generate topology message data.

[0079] Exemplarily, the server can obtain the topology identifier corresponding to the original message data according to the traffic topology obtained in the previous step and the network address of the target virtual network device corresponding to each original message data, wherein, in a possible implementation, the topology identifier can include the position number of the target virtual network device in the traffic path corresponding to the target tenant, such as #1 (indicating the first position) and #4 (indicating the fourth position), and then add the topology identifier to the data identifier of the original message data to generate the topology message data, wherein the data identifier of the original message data can be the file name of the original message data, or a specified data field of the original message data. That is, the topology identifier is added to the specified field or file name of the original message data, thereby generating the topology message data containing the topology identifier representing the position of the target virtual network device in the traffic path. Through the scheme in the steps of this embodiment, it can be realized that the end-to-end topology information is added to the captured packet data (original message data), thereby generating the topology message data that can simultaneously represent the specific content of the message and the link position of the target virtual network device in the traffic path. At the same time, by writing the topology identifier into the data identifier of the original message data, the difficulty of extracting topology information from the topology message data by the server or external data processing server in subsequent steps can be reduced, thereby improving the efficiency of abnormal device diagnosis and troubleshooting.

[0080] In this embodiment, the implementation method of step S201-step S202 is the same as that of the present disclosure. Figure 2 The implementation methods of step S101 and step S102 in the illustrated embodiment are the same and will not be described in detail here.

[0081] Corresponding to the cloud network packet capture and analysis method of the above embodiment, Figure 8 A structural block diagram of a packet capture and analysis device for a cloud network provided in an embodiment of the present disclosure. The method described in the above embodiment can be executed by the packet capture and analysis device for the cloud network, which can be implemented by software and / or hardware, and can be integrated in an electronic device with certain data processing functions. The electronic device may include but is not limited to a mobile terminal with big data processing capabilities, as well as a fixed terminal with big data processing capabilities such as a desktop computer and a supercomputer.

[0082] For the sake of convenience, only the parts related to the embodiments of the present disclosure are shown. Figure 8 , the packet capture and analysis device 3 of the cloud network includes:

[0083] The configuration module 31 is used to send first configuration information to the first virtual network device on the traffic path, the first configuration information is used to instruct the first virtual network device to dye the target service message corresponding to the target tenant, generate the dyed message and upload the tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log for the dyed message when receiving the dyed message;

[0084] The determination module 32 is used to receive the tracking log uploaded by the virtual network device after the first virtual network device forwards the dyed message, and determine the target virtual network device and the corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message;

[0085] The processing module 33 is used to send a packet capture instruction to the target virtual network device, so that the target virtual network device obtains the original message data corresponding to the target service message based on the packet capture rule.

[0086] According to one or more embodiments of the present disclosure, when the determination module 32 determines the target virtual network device and the corresponding packet capture rules based on the tracking log, it is specifically used to: generate metadata for the target business message based on the tracking log, the metadata including the network transmission parameters of the target business message and the network address corresponding to the target virtual network device; merge the tracking logs of the target virtual network devices belonging to the same network address based on the metadata to obtain a merged log corresponding to the target virtual network device; obtain at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generate packet capture rules corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0087] According to one or more embodiments of the present disclosure, when the determination module 32 determines the target virtual network device and the corresponding packet capture rules based on the tracking log, it is specifically used to: generate metadata for the target business message based on the tracking log, the metadata including the network transmission parameters of the target business message and the function type corresponding to the target virtual network device; merge the tracking logs of the target virtual network devices belonging to the same function type according to the metadata to obtain the merged log corresponding to the target virtual network device; obtain at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generate the packet capture rules corresponding to the target virtual network device according to the at least one set of network transmission parameters.

[0088] According to one or more embodiments of the present disclosure, when the determination module 32 determines the target virtual network device and the corresponding packet capture rules based on the tracking log, it is specifically used to: generate metadata for the target business message based on the tracking log, the metadata including the network transmission parameters of the target business message, the network address corresponding to the target virtual network device, and the function type corresponding to the target virtual network device; merge the tracking logs of the target virtual network devices belonging to the same function type and network address based on the metadata to obtain the merged log corresponding to the target virtual network device; obtain at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generate the packet capture rules corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0089] According to one or more embodiments of the present disclosure, the tracking log contains a module type identifier, a forwarding device identification code and network transmission parameters, the module type identifier represents the functional type of the corresponding virtual network device, and the forwarding device identification code represents the network address of the corresponding virtual network device; the network transmission parameters include: inner layer message source address, inner layer message source port, inner layer message destination address, inner layer message destination port, inner layer protocol type, network identifier of the virtual extensible local area network, the location of the original message data in each forwarding device, outer layer source IP, and outer layer destination IP.

[0090] According to one or more embodiments of the present disclosure, a trace log is generated based on quintuple information and vxlan protocol header information.

[0091] According to one or more embodiments of the present disclosure, the processing module 33 is also used to: receive original message data sent by the target virtual network device; add a topology identifier to the original message data to generate topology message data, wherein the topology identifier is used to indicate the position of each target virtual network device in the traffic path corresponding to the target tenant; and determine abnormal virtual network devices in the cloud network based on the original message data or the topology message data.

[0092] According to one or more embodiments of the present disclosure, the processing module 33 is also used to: obtain the traffic topology of the target tenant based on the tracking log, and the traffic topology characterizes the traffic path of the target business corresponding to the target tenant; when the processing module 33 adds a topology identifier to the original message data to generate topology message data, it is specifically used to: generate a topology identifier corresponding to the original message data based on the traffic topology; add the topology identifier to the data identifier of the original message data to generate topology message data.

[0093] The configuration module 31, the determination module 32 and the processing module 33 are connected in sequence. The cloud network packet capture and analysis device 3 provided in this embodiment can implement the technical solution of the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated in this embodiment.

[0094] In order to implement the above embodiments, an embodiment of the present disclosure provides an electronic device.

[0095] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure is shown in FIG. Fig. 9 As shown, the electronic device 4 includes:

[0096] A processor 41, and a memory 42 communicatively connected to the processor 41;

[0097] The memory 42 stores computer executable instructions;

[0098] The processor 41 executes the computer execution instructions stored in the memory 42 to implement the following Figure 2-Figure 7 The packet capture and analysis method of the cloud network in the illustrated embodiment.

[0099] Optionally, the processor 41 and the memory 42 are connected via a bus 43 .

[0100] For related instructions, please refer to Figure 2-Figure 7 The relevant descriptions and effects corresponding to the steps in the corresponding embodiments can be understood, and no further elaboration is made here.

[0101] The present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, which are used to implement the present invention when executed by a processor. Figure 2-Figure 7 A packet capture and analysis method for a cloud network provided by any one of the corresponding embodiments.

[0102] The present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, the present invention is realized. Figure 2-Figure 7 A packet capture and analysis method for a cloud network provided by any one of the corresponding embodiments.

[0103] In order to implement the above embodiment, the embodiment of the present disclosure also provides an electronic device.

[0104] refer to Fig.10 , which shows a schematic diagram of the structure of an electronic device 900 suitable for implementing the embodiment of the present disclosure, and the electronic device 900 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers, portable multimedia players (PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.10 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0105] like Fig.10 As shown, the electronic device 900 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage device 908 to a random access memory (RAM) 903. Various programs and data required for the operation of the electronic device 900 are also stored in the RAM 903. The processing device 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0106] Typically, the following devices may be connected to the I / O interface 905: input devices 906 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 907 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 908 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 909. The communication device 909 may allow the electronic device 900 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 The electronic device 900 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0107] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 909, or installed from a storage device 908, or installed from a ROM 902. When the computer program is executed by the processing device 901, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0108] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0109] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0110] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0111] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0112] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0113] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit or module does not, in some cases, constitute a limitation on the unit itself.

[0114] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0115] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] In a first aspect, according to one or more embodiments of the present disclosure, a method for packet capture and analysis of a cloud network is provided, comprising:

[0117] Sending first configuration information to the first virtual network device on the traffic path, the first configuration information is used to instruct the first virtual network device to dye the target business message corresponding to the target tenant, generate a dyed message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload the tracking log for the dyed message when receiving the dyed message; after the first virtual network device forwards the dyed message, receiving the tracking log uploaded by the virtual network device, and determining the target virtual network device and the corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message; sending a packet capture instruction to the target virtual network device, so that the target virtual network device obtains the original message data corresponding to the target business message based on the packet capture rule.

[0118] According to one or more embodiments of the present disclosure, determining the target virtual network device and the corresponding packet capture rules based on the tracking log includes: generating metadata for the target business message based on the tracking log, the metadata including the network transmission parameters of the target business message and the network address corresponding to the target virtual network device; merging the tracking logs of the target virtual network devices belonging to the same network address based on the metadata to obtain a merged log corresponding to the target virtual network device; obtaining at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generating packet capture rules corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0119] According to one or more embodiments of the present disclosure, determining the target virtual network device and the corresponding packet capture rules based on the tracking log includes: generating metadata for the target business message based on the tracking log, the metadata including network transmission parameters of the target business message and the function type corresponding to the target virtual network device; merging the tracking logs of target virtual network devices belonging to the same function type based on the metadata to obtain a merged log corresponding to the target virtual network device; obtaining at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generating packet capture rules corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0120] According to one or more embodiments of the present disclosure, determining the target virtual network device and the corresponding packet capture rules based on the tracking log includes: generating metadata for the target business message based on the tracking log, the metadata including network transmission parameters of the target business message, the network address corresponding to the target virtual network device, and the function type corresponding to the target virtual network device; merging the tracking logs of target virtual network devices belonging to the same function type and network address based on the metadata to obtain a merged log corresponding to the target virtual network device; obtaining at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generating packet capture rules corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0121] According to one or more embodiments of the present disclosure, the tracking log contains a module type identifier, a forwarding device identification code and network transmission parameters, the module type identifier represents the functional type of the corresponding virtual network device, and the forwarding device identification code represents the network address of the corresponding virtual network device; the network transmission parameters include: inner layer message source address, inner layer message source port, inner layer message destination address, inner layer message destination port, inner layer protocol type, network identifier of the virtual extensible local area network, location of the original message data in each forwarding device, outer layer source IP, and outer layer destination IP.

[0122] According to one or more embodiments of the present disclosure, the tracking log is generated based on quintuple information and vxlan protocol header information.

[0123] According to one or more embodiments of the present disclosure, it also includes: receiving original message data sent by the target virtual network device; adding a topology identifier to the original message data to generate topology message data, wherein the topology identifier is used to indicate the position of the target virtual network device in the traffic path corresponding to the target tenant; and determining abnormal virtual network devices in the cloud network based on the original message data or the topology message data.

[0124] According to one or more embodiments of the present disclosure, it also includes: obtaining the traffic topology of the target tenant according to the tracking log, the traffic topology characterizing the traffic path of the target business corresponding to the target tenant; adding a topology identifier to the original message data to generate topology message data, including: generating a topology identifier corresponding to the original message data according to the traffic topology; adding the topology identifier to the data identifier of the original message data to generate topology message data.

[0125] In a second aspect, according to one or more embodiments of the present disclosure, a packet capture and analysis device for a cloud network is provided, comprising:

[0126] A configuration module, configured to send first configuration information to a first virtual network device on a traffic path, wherein the first configuration information is used to instruct the first virtual network device to dye a target service message corresponding to a target tenant, generate a dyed message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload a tracking log for the dyed message when receiving the dyed message;

[0127] A determination module, configured to receive a tracking log uploaded by a virtual network device after the first virtual network device forwards the dyed message, and determine a target virtual network device and a corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message;

[0128] The processing module is used to send a packet capture instruction to the target virtual network device, so that the target virtual network device obtains the original message data corresponding to the target service message based on the packet capture rule.

[0129] According to one or more embodiments of the present disclosure, when the determination module determines the target virtual network device and the corresponding packet capture rules based on the tracking log, it is specifically used to: generate metadata for the target business message based on the tracking log, the metadata including the network transmission parameters of the target business message and the network address corresponding to the target virtual network device; merge the tracking logs of the target virtual network devices belonging to the same network address according to the metadata to obtain the merged log corresponding to the target virtual network device; obtain at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generate the packet capture rules corresponding to the target virtual network device according to the at least one set of network transmission parameters.

[0130] According to one or more embodiments of the present disclosure, when a determination module determines a target virtual network device and a corresponding packet capture rule based on a tracking log, the determination module is specifically used to: generate metadata for the target business message based on the tracking log, the metadata including network transmission parameters of the target business message and a function type corresponding to the target virtual network device; merge the tracking logs of target virtual network devices belonging to the same function type based on the metadata to obtain a merged log corresponding to the target virtual network device; obtain at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generate a packet capture rule corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0131] According to one or more embodiments of the present disclosure, when a determination module determines a target virtual network device and a corresponding packet capture rule based on a tracking log, the determination module is specifically used to: generate metadata for the target business message based on the tracking log, the metadata including network transmission parameters of the target business message, a network address corresponding to the target virtual network device, and a function type corresponding to the target virtual network device; merge the tracking logs of target virtual network devices belonging to the same function type and network address based on the metadata to obtain a merged log corresponding to the target virtual network device; obtain at least one set of network transmission parameters from the merged log corresponding to the target virtual network device, and generate a packet capture rule corresponding to the target virtual network device based on the at least one set of network transmission parameters.

[0132] According to one or more embodiments of the present disclosure, the first type of parameters includes: a forwarding device identification code; the second type of parameters includes: an inner message source address, an inner message source port, an inner message destination address, an inner message destination port, an inner protocol type, a network identifier of a virtual extensible local area network, the location of the original message data in each forwarding device, an outer source IP, and an outer destination IP.

[0133] According to one or more embodiments of the present disclosure, a trace log is generated based on quintuple information and vxlan protocol header information.

[0134] According to one or more embodiments of the present disclosure, the processing module is also used to: receive original message data sent by the target virtual network device; add a topology identifier to the original message data to generate topology message data, wherein the topology identifier is used to indicate the position of each target virtual network device in the traffic path corresponding to the target tenant; and determine abnormal virtual network devices in the cloud network based on the original message data or the topology message data.

[0135] According to one or more embodiments of the present disclosure, the processing module is also used to: obtain the traffic topology of the target tenant based on the tracking log, and the traffic topology characterizes the traffic path of the target business corresponding to the target tenant; when the processing module adds a topology identifier to the original message data to generate topology message data, it is specifically used to: generate a topology identifier corresponding to the original message data based on the traffic topology; add the topology identifier to the data identifier of the original message data to generate topology message data.

[0136] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0137] The memory stores computer-executable instructions;

[0138] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the packet capture and analysis method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0139] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the packet capture and analysis method of the cloud network as described in the first aspect and various possible designs of the first aspect is implemented.

[0140] In a fifth aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, including a computer program, which, when executed by a processor, implements the packet capture and analysis method for the cloud network as described in the first aspect and various possible designs of the first aspect.

[0141] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0142] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0143] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A packet capture and analysis method for a cloud network, characterized in that: include: Sending first configuration information to a first virtual network device on a traffic path, wherein the first configuration information is used to instruct the first virtual network device to dye a target service message corresponding to a target tenant, generate a dyed message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload a tracking log for the dyed message when receiving the dyed message; After the first virtual network device forwards the dyed message, receiving a tracking log uploaded by the virtual network device, and determining a target virtual network device and a corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message; A packet capture instruction is sent to the target virtual network device, so that the target virtual network device obtains original message data corresponding to the target service message based on the packet capture rule.

2. The cloud network packet capture and analysis method according to claim 1, characterized in that: Determining the target virtual network device and the corresponding packet capture rule according to the tracking log includes: Generate metadata for the target service message according to the tracking log, the metadata including network transmission parameters of the target service message and a network address corresponding to the target virtual network device; According to the metadata, merging the tracking logs of the target virtual network devices belonging to the same network address to obtain a merged log corresponding to the target virtual network device; At least one set of network transmission parameters is obtained from the merged log corresponding to the target virtual network device, and a packet capture rule corresponding to the target virtual network device is generated according to the at least one set of network transmission parameters.

3. The cloud network packet capture and analysis method according to claim 1, characterized in that: Determining the target virtual network device and the corresponding packet capture rule according to the tracking log includes: Generate metadata for the target service message according to the tracking log, the metadata including network transmission parameters of the target service message and a function type corresponding to the target virtual network device; According to the metadata, merging the tracking logs of the target virtual network devices belonging to the same function type to obtain a merged log corresponding to the target virtual network device; At least one set of network transmission parameters is obtained from the merged log corresponding to the target virtual network device, and a packet capture rule corresponding to the target virtual network device is generated according to the at least one set of network transmission parameters.

4. The cloud network packet capture and analysis method according to claim 1, characterized in that: Determining the target virtual network device and the corresponding packet capture rule according to the tracking log includes: Generate metadata for the target service message according to the tracking log, the metadata including network transmission parameters of the target service message, a network address corresponding to the target virtual network device, and a function type corresponding to the target virtual network device; According to the metadata, merging the tracking logs of the target virtual network devices belonging to the same function type and network address to obtain a merged log corresponding to the target virtual network device; At least one set of network transmission parameters is obtained from the merged log corresponding to the target virtual network device, and a packet capture rule corresponding to the target virtual network device is generated according to the at least one set of network transmission parameters.

5. The cloud network packet capture and analysis method according to claim 1, characterized in that: The tracking log includes a module type identifier, a forwarding device identification code and a network transmission parameter, wherein the module type identifier represents a function type of a corresponding virtual network device, and the forwarding device identification code represents a network address of a corresponding virtual network device; The network transmission parameters include: inner message source address, inner message source port, inner message destination address, inner message destination port, inner protocol type, network identifier of virtual extensible LAN, location of original message data in each forwarding device, outer source IP, and outer destination IP.

6. The cloud network packet capture and analysis method according to claim 1, characterized in that: The tracking log is generated based on the quintuple information and the vxlan protocol header information.

7. The cloud network packet capture and analysis method according to claim 1, characterized in that: Also includes: Receiving original message data sent by the target virtual network device; Adding a topology identifier to the original message data to generate topology message data, wherein the topology identifier is used to indicate the position of the target virtual network device in the traffic path corresponding to the target tenant; An abnormal virtual network device in the cloud network is determined according to the original message data or the topology message data.

8. The cloud network packet capture and analysis method according to claim 7, characterized in that: Also includes: Obtaining a traffic topology of the target tenant according to the tracking log, where the traffic topology represents a traffic path of a target service corresponding to the target tenant; The adding a topology identifier to the original message data to generate topology message data includes: Generate a topology identifier corresponding to the original message data according to the traffic topology; The topology identifier is added to the data identifier of the original message data to generate topology message data.

9. A packet capture and analysis device for a cloud network, characterized in that: include: A configuration module, configured to send first configuration information to a first virtual network device on a traffic path, wherein the first configuration information is used to instruct the first virtual network device to dye a target service message corresponding to a target tenant, generate a dyed message and upload a tracking log, and instruct other virtual network devices on the traffic path to upload a tracking log for the dyed message when receiving the dyed message; A determination module, configured to receive a tracking log uploaded by a virtual network device after the first virtual network device forwards the dyed message, and determine a target virtual network device and a corresponding packet capture rule according to the tracking log, wherein the target virtual network device is the virtual network device that forwards the dyed message; The processing module is used to send a packet capture instruction to the target virtual network device, so that the target virtual network device obtains the original message data corresponding to the target service message based on the packet capture rule.

10. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the packet capture and analysis method for the cloud network as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the processor executes the computer-executable instructions, the cloud network packet capture and analysis method as described in any one of claims 1 to 8 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the packet capture and analysis method for a cloud network as described in any one of claims 1 to 8 is implemented.

Images