A method and device for automatic fault location based on network topology diagram

Abstract

The present invention belongs to the field of network performance technology, and in particular, is an automatic fault location method and device based on a network topology diagram. The present invention generates a data table of the relationship between IP addresses and collection probes after parsing the data packets collected on the network topology device. When locating the fault, the device data flow path through which the IP address passes is automatically sorted out after searching and matching by a specific query IP address, providing a visual way to view the traffic path, and locating the fault of the traffic passing through each device, thereby solving the inefficiency problem of the prior art and quickly determining the fault point.

Description

Technical Field

[0001] The present invention belongs to the technical field of network performance, and in particular to an automatic fault location method and device based on a network topology diagram. Background Art

[0002] The current method for locating network faults is that after receiving a fault location request, network engineers analyze the data packets flowing through each device in each network area one by one until the faulty device is identified.

[0003] The implementation method is that engineers start from the first layer of network devices, download the data packets of this device, parse the downloaded data packets through some data packet parsing tools, and compare the source IP address from the parsed data to see if it matches the query IP, and so on until the traffic fault device point is found. In the real production environment, the network topology is complex, and this method of locating faults by manually comparing one by one is extremely inefficient, and it is very difficult to quickly find the fault point. Summary of the invention

[0004] The purpose of the present invention is to overcome the problem in the prior art of low efficiency in troubleshooting network equipment failures due to complex network topology and data flow paths, and to provide an automatic fault location method and device based on a network topology diagram.

[0005] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:

[0006] A method for automatic fault location based on a network topology diagram, the method comprising:

[0007] S1: Configure the network topology map and configure the collection point probes on the network devices to be located;

[0008] The network device to be located has a NAT conversion function; the collection point probe includes a front probe and a rear probe; the configuration operation includes setting an association relationship table and a connection set table between the network device to be located and the collection point probe;

[0009] S2: Collect data packets through the collection point probe, decode the indicator data and protocol information according to the data packets, obtain the source IP address, original IP address and corresponding collection point probe ID of the data packets, generate a data table and store it in the database;

[0010] S3: specify a client IP, and compare it with the source IP address and the original IP address in the data table;

[0011] Obtain the source IP address and original IP address that are the same as the value of the specified client IP, and generate the corresponding collection point probe ID and its corresponding indicator data as the probe set corresponding to the specified client IP;

[0012] S4: According to the association relationship table, obtain the devices associated with the probe set and generate a device set;

[0013] S5: Matching the traffic path of the designated client IP in the network topology diagram according to the connection set table and the device set;

[0014] S6: Starting from the first device point of the flow path, the indicator data of the front probe and the rear probe of each device point are obtained in turn; the indicator data is compared with the preset fault threshold, and if there is an abnormality, a fault alarm is issued for the device point, and the corresponding fault type is output.

[0015] As a preferred solution of the present invention, the association table in S1 includes device ID, front probe ID, rear probe ID, incoming device connection ID and outgoing device connection ID;

[0016] The connection set table includes the connection ID, source device ID and destination device ID of each connection.

[0017] As a preferred embodiment of the present invention, S2 comprises the following steps:

[0018] Collecting data packets through the collection point probe, decoding each network layer of the data packets, obtaining indicator data and protocol information, and extracting the source IP address of the data packets from the indicator data;

[0019] Generate a data table of the source IP address and its corresponding collection point probe ID and store it in the database;

[0020] The original IP address information of the data packet is parsed according to the protocol information, and the original IP address information is stored in the corresponding collection point probe in the data table.

[0021] As a preferred solution of the present invention, the network layers described in S2 include link layer, network layer, transport layer and application layer; the indicator data includes message length, traffic size, number of connections, source IP, destination IP, source port, destination port, TCP connection establishment, TCP disconnection and / or TCP time consumption.

[0022] As a preferred solution of the present invention, in the parsing operation described in S2, if the protocol information is the HTTP protocol, the XFF field in the parsed data packet header data is marked as the client's original IP; if it is other protocols, the sequence field mapping in the parsed data packet header is marked as the client's original IP.

[0023] As a preferred embodiment of the present invention, S5 comprises the following steps:

[0024] S51: Obtain the first device point in the device set and define it as device S;

[0025] S52: using the device ID of the device S as a query condition for the source device, searching for the connection of the device in the connection set table;

[0026] If the connection mapping of the device S as the source device is not found, the device S is removed from the device set, the next unprocessed device point in the device set is defined as the device S, and the process goes to S52;

[0027] If the connection mapping corresponding to the device S is found, the target device in the connection mapping is defined as the device T, the device S is removed from the device set, and the process proceeds to S53;

[0028] S53: Determine whether the device T already exists in the path data;

[0029] If it exists, put device S into the path data and place it before device T;

[0030] If it does not exist, put the device S and the device T into the path data in order, and define the current device T as the device S, and go to S52;

[0031] S54: After all device points are matched, each device point is connected along the path data in the network topology diagram and output as a traffic path.

[0032] As a preferred solution of the present invention, the preset fault threshold in S6 includes a delay index threshold, a jitter index threshold and a packet loss rate index threshold;

[0033] When the indicator data of the probes before and after the equipment exceeds the preset fault threshold, it is determined that there is an abnormality, a fault alarm is issued for the equipment point, and the corresponding fault type is output.

[0034] An automatic fault location device based on a network topology diagram includes at least one processor and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the methods described above.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention generates a relationship data table between IP addresses and collection probes after parsing the data packets collected on the network topology devices. When locating the fault, the device data flow path through which the IP address passes is automatically sorted out after searching and matching through a specific query IP address, providing a visual way to view the traffic path and locate the fault of the traffic passing through each device, thereby solving the inefficiency problem of the prior art and quickly determining the fault point. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of a flow chart of an automatic fault location method based on a network topology diagram according to Embodiment 1 of the present invention;

[0038] Figure 2 A schematic diagram of a network topology map in an automatic fault location method based on a network topology map according to Embodiment 3 of the present invention;

[0039] Figure 3 A schematic diagram of the process of IP address conversion and marking when NAT conversion exists in an automatic fault location method based on a network topology diagram described in Example 3 of the present invention;

[0040] Figure 4 A schematic diagram of a traffic path in an automatic fault location method based on a network topology diagram according to Embodiment 3 of the present invention;

[0041] Figure 5 This is a schematic structural diagram of an automatic fault location device based on a network topology map described in Example 4 of the present invention, which utilizes the automatic fault location method based on a network topology map described in the above embodiment. DETAILED DESCRIPTION

[0042] The present invention is further described in detail below in conjunction with test examples and specific implementation methods. However, this should not be understood as the scope of the above subject matter of the present invention being limited to the following embodiments, and all technologies realized based on the content of the present invention belong to the scope of the present invention.

[0043] Example 1

[0044] like Figure 1 As shown, a method for automatic fault location based on a network topology diagram includes:

[0045] S1: Configure a network topology map and configure collection point probes on the network devices to be located.

[0046] The network device to be located has a NAT conversion function; the collection point probe includes a front probe and a rear probe; the configuration operation includes setting an association relationship table and a connection set table between the network device to be located and the collection point probe.

[0047] S2: Collect data packets through the collection point probe, decode the indicator data and protocol information according to the data packets, obtain the source IP address, original IP address and corresponding collection point probe ID of the data packets, generate a data table and store it in the database.

[0048] S3: specify a client IP, and compare it with the source IP address and the original IP address in the data table;

[0049] The source IP address and the original IP address having the same value as the specified client IP are obtained, and the corresponding collection point probe ID and the corresponding indicator data thereof are generated as a probe set corresponding to the specified client IP.

[0050] S4: According to the association relationship table, obtain the devices associated with the probe set and generate a device set.

[0051] S5: Match the traffic path of the designated client IP in the network topology diagram according to the connection set table and the device set.

[0052] S6: Starting from the first device point of the flow path, the indicator data of the front probe and the rear probe of each device point are obtained in turn; the indicator data is compared with the preset fault threshold, and if there is an abnormality, a fault alarm is issued for the device point, and the corresponding fault type is output.

[0053] The present invention abstracts the physical network topology into a logical network topology diagram, and associates the probe points with the logical topology nodes in the process of drawing the logical topology diagram, and at the same time establishes the path flow relationship between the nodes through the connection direction between the topology nodes. Drawing the logical topology diagram is part of this solution.

[0054] The main difficulty overcome by the present invention is that in a complex network topology, especially in a network topology with NAT devices, assuming that there are 100 network devices, how to find all the devices that a certain request [from the client to the application server] passes through [assuming that it passes through 10 devices] among these 100 devices. And by counting and comparing the flow data indicators before and after passing through this network device, the failure of data packet loss, response delay, etc. at a certain node can be located.

[0055] Example 2

[0056] This embodiment is a specific implementation of the method for automatic fault location based on a network topology diagram described in Embodiment 1, and includes the following steps:

[0057] S1: Configure a network topology map and configure collection point probes on the network devices to be located.

[0058] The network topology diagram is configured in the network topology monitoring view according to the actual network topology structure. The network device to be located has a NAT conversion function; the collection point probe includes a front probe and a rear probe; the configuration operation includes setting an association relationship table and a connection set table between the network device to be located and the collection point probe.

[0059] The association relationship table includes device ID, front probe ID, rear probe ID, incoming device connection ID and outgoing device connection ID;

[0060] The connection set table includes the connection ID, source device ID and destination device ID of each connection.

[0061] S2: Collect data packets through the collection point probe, decode the indicator data and protocol information according to the data packets, obtain the source IP address, original IP address and corresponding collection point probe ID of the data packets, generate a data table and store it in the database. The specific steps are as follows:

[0062] S21: Collect data packets through the collection point probe, decode each network layer of the data packets, obtain indicator data and protocol information, and extract the source IP address of the data packets from the indicator data.

[0063] The network layers include link layer, network layer, transport layer and application layer; the indicator data includes message length, traffic size, number of connections, source IP, destination IP, source port, destination port, TCP connection establishment, TCP disconnection and / or TCP time consumption.

[0064] S22: Generate a data table with the source IP address and its corresponding collection point probe ID and store it in the database.

[0065] S23: parsing the original IP address information of the data packet according to the protocol information, and storing the original IP address information in the corresponding collection point probe in the data table.

[0066] In the parsing operation, if the protocol information is HTTP protocol, the XFF field in the parsed data packet header data is marked as the client's original IP; if it is other protocols, the sequence field in the parsed data packet header is mapped and marked as the client's original IP.

[0067] S3: specify a client IP, and compare it with the source IP address and the original IP address in the data table;

[0068] The source IP address and the original IP address having the same value as the specified client IP are obtained, and the corresponding collection point probe ID and the corresponding indicator data thereof are generated as a probe set corresponding to the specified client IP.

[0069] S4: According to the association relationship table, obtain the devices associated with the probe set and generate a device set.

[0070] S5: Match the traffic path of the designated client IP in the network topology diagram according to the connection set table and the device set.

[0071] S51: Obtain the first device point definition in the device set as device S.

[0072] S52: Using the device ID of the device S as a query condition for the source device, searching for the connection of the device in the connection set table.

[0073] If the connection mapping of device S as the source device is not found, device S is removed from the device set, the next unprocessed device point in the device set is defined as device S, and the process goes to S52.

[0074] If the connection mapping corresponding to the device S is found, the target device in the connection mapping is defined as the device T, the device S is removed from the device set, and the process proceeds to S53.

[0075] S53: Determine whether the device T already exists in the path data.

[0076] If it exists, put device S into the path data and place it before device T.

[0077] If not, put device S and device T into the path data in order, and define the current device T as device S, and enter S52.

[0078] S54: After all device points are matched, connect each device point along the path data in the network topology diagram and output it as a traffic path. The output traffic path is a path formed by all network device nodes passed through during the process from a user initiating a request from a client to an application server or other device receiving the request.

[0079] S6: Starting from the first device point of the flow path, the indicator data of the front probe and the rear probe of each device point are obtained in turn; the indicator data is compared with the preset fault threshold, and if there is an abnormality, a fault alarm is issued for the device point, and the corresponding fault type is output.

[0080] The preset fault thresholds include a delay index threshold, a jitter index threshold, and a packet loss rate index threshold;

[0081] When the indicator data of the probes before and after the equipment exceeds the preset fault threshold, it is determined that there is an abnormality, a fault alarm is issued for the equipment point, and the corresponding fault type is output.

[0082] In summary, the scheme of the present invention is divided into two steps. The first step is to request path search. Through the node of the NAT device, the client / server address or port will be converted. The node after this node can no longer be matched by the queried IP address, and needs to be matched by the NAT tag until the last device is found. If there is no NAT device, the NAT conversion matching scheme will be used in this step, and the traffic data of all devices will be collected.

[0083] The second step is to find the path found in the first step, and compare the indicator values ​​in the data packets from each device from the beginning to the end through the data flow from the client to the server to determine whether a fault occurs. The present invention is for fault location of the entire path in the network topology, and the path without NAT device can also be analyzed.

[0084] Example 3

[0085] This embodiment is a specific experimental example of the automatic fault location method based on the network topology diagram described in Embodiment 2, including the following steps:

[0086] 1. Network topology management: Based on the actual network deployment on site, define a logical topology diagram in network topology management (such as Figure 2 As shown in Figure 1), the front and rear probes of the device are used to collect the data packets in the inbound and outbound directions of the node respectively. The lines with arrows are used to define the path direction between network nodes. The association relationship between each device node and the probe and the mapping set between the line and the source / destination device are generated into data tables and stored in the database of the data center platform.

[0087] 2. Collect and parse data packets, decode the traffic packets collected by each probe point, and use decoding tools to decode the binary stream to obtain data indicators, protocol information, and other data at the transport layer and application layer. After decoding the data packets of devices with NAT conversion, parse the original IP address information according to different protocols.

[0088] The HTTP protocol marks the client's original IP address through the XFF field in the packet header, and other protocols mark the client's original IP address through the sequence mapping in the packet header.

[0089] After parsing the original IP of the client.

[0090] The analysis system counts the decoded data packets based on the collection point probe ID and source IP address [IP address decoded from the data packet], and generates a piece of device collection data together with the data indicators obtained from the data packet, such as bit rate, total number of bytes, number of sent data packets, number of received data packets, etc., and stores it in the database table. Figure 3As shown, the data of the NAT-converted device in the database table will have an additional field for the client's original IP address.

[0091] 3. IP address matching, retrieve the specified client IP, use the client IP to compare with the client original IP field of each data in the data table generated in step 2. If the values ​​are the same, then the data is processed, otherwise it is not processed; then use the client IP to compare with the source IP field of each data in the data table generated in step 2. If the values ​​are the same, then the data is processed, otherwise it is not processed; after completing the above steps, obtain all probe sets that the specified client IP has passed through and the data indicators on each probe.

[0092] 4. Map the device. Through the relationship between the device and the probe established in step 1, use the probe set obtained in step 3 to filter out the device set in the device probe relationship table.

[0093] 5. Path generation, through the device connection mapping set table in step 1. Use the device set obtained in step 4 to match an actual path of the device set in the topology map.

[0094] Matching process: Start from the first device in the collection;

[0095] (1) Use the device ID [defined as device S] as the query condition for the source device and search for the device's connection in the device connection mapping set table.

[0096] (1.1) If the connection mapping of the device as the source device is not found, remove the device from the processing set in step 4, and continue to search for the next unprocessed device in the set [repeat step (1)].

[0097] (1.2) If the corresponding connection mapping is found, remove the device from the processing set in step 4, and determine whether the target device [located as device T] in the obtained connection mapping relationship already exists in the path data.

[0098] (1.2.1) If it exists, put the device S into the path data structure and place it before device T.

[0099] (1.2.2) If it does not exist, place device S and device T in the path data structure in order, and use device T as the source device query condition to continue querying downwards [repeat step (1)].

[0100] The above process is performed until each device in the device set in step 4 is processed and the complete path is obtained.

[0101] 6. Path drawing: After obtaining the device and connection set on the path from steps 4 and 5. Figure 4As shown, based on the network topology diagram drawn in step 1, these devices and connections are highlighted to draw the traffic path.

[0102] 7. Fault location. After obtaining the traffic path in step 6, starting from the first device point on the path, compare the traffic indicators of the front and rear probes of the device [obtained in step 3]. If the performance indicator value calculated by the front and rear probe traffic indicators is greater than the built-in threshold, it means that the device has a fault of this indicator type.

[0103] For example, the packet loss rate is calculated by the number of packets in the flow indicators of the front and rear probes. If the packet loss rate is greater than the built-in threshold of 1%, it means that the device has a packet loss failure. These fault information are pushed to the path generated in step 6, and the user is informed of the prompt information when the path is selected. For example, Figure 4 As shown, the packet loss rate is 5%>1%.

[0104] The fault mechanism has built-in common network performance fault analysis indicators. The basic indicators in the data packets before and after the device are obtained through common calculation rules, such as delay indicators, jitter and packet loss rate. Fault judgment is based on common network performance fault analysis standards.

[0105] In this embodiment, the delay index threshold is: when the delay index value is between 50 milliseconds and 200 milliseconds, it is a medium fault and a medium fault prompt will be given; when it is greater than 200 milliseconds, it is a high fault and a high fault prompt will be given.

[0106] Jitter index threshold: When the jitter index value is greater than 100ms, a high-level fault prompt will be given.

[0107] Packet loss rate indicator threshold: When the packet loss rate indicator value is greater than 1%, a high-level fault prompt will be given.

[0108] Example 4

[0109] like Figure 5 As shown, an automatic fault location device based on a network topology diagram includes at least one processor, a memory connected to the at least one processor, and at least one input / output interface connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the automatic fault location method based on a network topology diagram described in the above embodiment. The input / output interface may include a display, a keyboard, a mouse, and a USB interface for inputting and outputting data.

[0110] Those skilled in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), disks or optical disks, etc. Various media that can store program codes.

[0111] When the above-mentioned integrated unit of the present invention is implemented in the form of a software functional unit and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0112] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for automatic fault location based on a network topology diagram, characterized in that the method include: S1: Configure the network topology map and configure the collection point probes on the network devices to be located; The network device to be located has a NAT conversion function; the collection point probe includes a front probe and a rear probe; the configuration operation includes setting an association relationship table and a connection set table between the network device to be located and the collection point probe; The association relationship table includes device ID, front probe ID, rear probe ID, incoming device connection ID and outgoing device connection ID; The connection set table includes the connection ID, source device ID and destination device ID of each connection; S2: Collect data packets through the collection point probe, decode the indicator data and protocol information according to the data packets, obtain the source IP address, original IP address and corresponding collection point probe ID of the data packets, generate a data table and store it in the database; S3: specify a client IP, and compare it with the source IP address and the original IP address in the data table; Obtain the source IP address and original IP address that are the same as the value of the specified client IP, and generate the corresponding collection point probe ID and its corresponding indicator data as the probe set corresponding to the specified client IP; S4: According to the association relationship table, obtain the devices associated with the probe set and generate a device set; S5: Matching the traffic path of the designated client IP in the network topology diagram according to the connection set table and the device set; S6: Starting from the first device point of the flow path, the indicator data of the front probe and the rear probe of each device point are obtained in turn; the indicator data are compared with the preset fault threshold value, and if there is an abnormality, a fault alarm is issued for the device point, and the corresponding fault type is output; Wherein, the S2 comprises the following steps: Collecting data packets through the collection point probe, decoding each network layer of the data packets, obtaining indicator data and protocol information, and extracting the source IP address of the data packets from the indicator data; Generate a data table of the source IP address and its corresponding collection point probe ID and store it in the database; Parsing the original IP address information of the data packet according to the protocol information, and storing the original IP address information in the corresponding collection point probe in the data table; S5 includes the following steps: S51: Obtain the first device point in the device set and define it as device S; S52: using the device ID of the device S as a query condition for the source device, searching for the connection of the device in the connection set table; If the connection mapping of the device S as the source device is not found, the device S is removed from the device set, the next unprocessed device point in the device set is defined as the device S, and the process goes to S52; If the connection mapping corresponding to the device S is found, the target device in the connection mapping is defined as the device T, the device S is removed from the device set, and the process proceeds to S53; S53: Determine whether the device T already exists in the path data; If it exists, put device S into the path data and place it before device T; If it does not exist, put the device S and the device T into the path data in order, and define the current device T as the device S, and go to S52; S54: After all device points are matched, each device point is connected along the path data in the network topology diagram and output as a traffic path.

2. The method for automatic fault location based on network topology diagram according to claim 1, characterized in that: The network layers described in S2 include link layer, network layer, transport layer and application layer; the indicator data includes message length, traffic size, number of connections, source IP, destination IP, source port, destination port, TCP connection establishment, TCP disconnection and / or TCP time consumption.

3. The method for automatic fault location based on network topology diagram according to claim 1, characterized in that: In the parsing operation in S2, if the protocol information is HTTP protocol, the XFF field in the parsed data packet header data is marked as the client's original IP; if it is other protocols, the sequence field in the parsed data packet header is mapped and marked as the client's original IP.

4. The method for automatic fault location based on network topology diagram according to claim 1, characterized in that: The preset fault thresholds in S6 include a delay index threshold, a jitter index threshold, and a packet loss rate index threshold; When the indicator data of the probes before and after the equipment exceeds the preset fault threshold, it is determined that there is an abnormality, a fault alarm is issued for the equipment point, and the corresponding fault type is output.

5. An automatic fault location device based on a network topology diagram, characterized in that: It includes at least one processor and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in any one of claims 1 to 4.

Images