Sensing and early warning method and device for light splitting link fault and readable storage medium

Abstract

The invention provides a light splitting link fault sensing and early warning method, which comprises the following steps of: accessing flow among upstream user plane network elements to downstream deep packet inspection equipment through intermediate equipment, acquiring the flow among the user plane network elements through the deep packet inspection equipment, and detecting and analyzing a user plane flow data packet; analyzing the single user plane flow data packet to obtain an outer-layer IP pair and an inner-layer quintuple, judging whether an inner-layer protocol in the inner-layer quintuple is TCP protocol data, and if so, recording the flow direction of the outer-layer IP pair of the user plane flow data packet; counting the uplink / downlink traffic of the outer IP pair of the user plane traffic data packet recorded in the detection period, and generating a traffic statistical information table; and judging whether the uplink flow or the downlink flow of the outer-layer IP pair in the flow statistical information table is 0, and if so, carrying out link fault early warning. According to the sensing and early warning method for the light splitting link fault, the light splitting link fault of the upstream equipment can be sensed when the condition of the upstream light splitting link is unknown.

Description

Technical Field

[0001] The present invention belongs to the technical field of mobile core network traffic collection, and in particular relates to a method, device and readable storage medium for perceiving and warning of optical splitting link failure. Background Art

[0002] In the prior art, in order to collect user-side traffic of the mobile core network, devices such as splitters and convergence and diversion are usually used. The splitter is a passive device responsible for copying and distributing optical signals. The convergence and diversion are forwarding devices responsible for copying and forwarding input data packets. The traffic passing through the splitter and convergence and diversion will be output to DPI (Deeply Packet Insect) for processing.

[0003] like Figure 2 As shown, in a machine room of a mobile core network, two user-plane network elements are connected through two optical fibers for uplink and downlink communications.

[0004] like Figure 3 As shown, in order to collect the user plane traffic of the mobile core network, a copy of the uplink and downlink traffic between two network elements can be obtained through an optical splitter and an optical amplifier.

[0005] Similarly, the uplink and downlink traffic between multiple network elements in one machine room, between multiple network elements in multiple machine rooms, and between multiple network elements in multiple machine rooms will be copied and sent to the aggregation and diversion according to the collection plan. The aggregation and diversion will be divided according to the downstream DPI processing capacity and business needs.

[0006] like Figure 4 As shown, it should be noted that:

[0007] An optical fiber is inserted into one (input / output) port.

[0008] The input port of DPI is also plugged with an optical fiber, but it contains multiple traffic components.

[0009] The splitter and the convergence and diversion each have their own functions. When a splitter link between the splitter and the convergence and diversion fails, it will only be discovered during regular inspections. Sometimes, even without inspections, the problem cannot be discovered. The inspection cycle is generally based on days, weeks, months, or years. If the splitter link failure is not discovered and repaired in time, it will cause the downstream DPI device to lose part of the traffic, resulting in one-sidedness of the call record data in the log retention system, such as Figure 5 As shown in FIG. 1 , the uplink traffic between NE 1 and NE 2 is not connected to the aggregation and splitting due to the failure of the splitting link, resulting in partial loss of DPI1 and DPI2 traffic. Summary of the invention

[0010] The purpose of the present invention is to solve the problems in the prior art and propose a method, device and readable storage medium for perceiving and warning of optical splitting link failures. When an upstream optical splitting link fails and is not discovered and repaired in time, the downstream DPI acquisition device can perceive the optical splitting link failure of the upstream device without any knowledge of the upstream optical splitting link.

[0011] In order to achieve the above object, the present invention adopts the following technical scheme.

[0012] The traffic between the upstream user plane network elements is connected to the downstream deep packet inspection device through the splitting or shunting intermediate device, the traffic between the user plane network elements is obtained through the deep packet inspection device, and the user plane traffic data packets are inspected and analyzed;

[0013] Parse a single user plane traffic data packet to obtain an outer IP pair and an inner five-tuple, determine whether the inner protocol in the inner five-tuple is TCP protocol data, and if so, record the traffic direction of the outer IP pair of the user plane traffic data packet;

[0014] Counting the uplink / downlink traffic of the outer IP pair of the user plane traffic data packet recorded within the detection period, and generating a traffic statistics information table;

[0015] Determine whether the uplink traffic or downlink traffic of the outer IP pair in the traffic statistics information table is 0, and if so, issue a link failure warning.

[0016] Furthermore, the parsing of the user plane traffic data packet to obtain an outer IP pair and an inner IP includes that a single data stream in the user plane traffic data packet includes an inner source IP, an inner source port, a TCP or UDP protocol, an inner destination IP, and an inner destination port.

[0017] Furthermore, the determination of whether the inner IP is TCP protocol data and if so, recording the flow direction of the outer IP pair of the user plane traffic data packet includes filtering the flow of the inner protocol to obtain the inner TCP protocol flow data and determining the flow direction of the outer IP pair of the inner TCP protocol flow data.

[0018] Furthermore, the data information of the outer IP pair includes an upstream network element IP, an upstream traffic size, a downstream network element IP, and a downstream traffic size.

[0019] Further, the uplink / downlink traffic of the outer IP pair of the user plane traffic data packet recorded in the statistical detection period, generating a traffic statistics information table includes:

[0020] When a single TCP data flow ends, the corresponding data information is inserted and merged into the traffic statistics information table. The traffic statistics information table counts the IP pairs within the detection period, uses the upstream / downstream network element IP as the key vector, and the upstream and downstream traffic size as the value vector. The TCP data flow information within the detection period is accumulated in the traffic statistics information table.

[0021] Further, the determining whether the uplink traffic or downlink traffic of the outer IP pair in the traffic statistics information table is 0, and if so, issuing a link failure warning includes:

[0022] Check whether the upstream / downstream traffic of a single outer IP pair in the traffic statistics information table is 0. If the downstream traffic is 0, the downstream optical splitting link between the user plane network elements is faulty; if the upstream traffic is 0, the upstream optical splitting link between the user plane network elements is faulty.

[0023] Furthermore, it also includes taking the user plane network element IP corresponding to the split optical link and the fault direction of the split optical link as warning content, and sending the warning content to the inspection personnel.

[0024] Furthermore, the user plane traffic data packet of the next detection cycle is obtained, the link fault detection step is repeatedly performed, and the link fault status is updated in real time.

[0025] In order to achieve the above-mentioned purpose, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a program running on the processor, and when the processor runs the program, the steps of the method for sensing and warning of optical splitting link failure as described above are executed.

[0026] In order to achieve the above object, the present invention further provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the steps of the method for sensing and warning of optical splitting link failure as described above are executed.

[0027] The present invention proposes a method, device and readable storage medium for sensing and warning of optical splitting link failure, which has the following beneficial effects:

[0028] When a link failure occurs in the upstream and is not discovered and repaired in time, the downstream can sense the optical splitting link failure in the upstream without any knowledge of the upstream link. It generates an early warning and provides maintenance clues to help upstream personnel conduct targeted maintenance. It greatly improves the efficiency of problem discovery and problem solving and minimizes the impact of link failures.

[0029] Other features and advantages of the present invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0031] Figure 1 It is a flow chart of a method for sensing and warning of optical splitting link failure of the present invention;

[0032] Figure 2 A schematic diagram of uplink and downlink communication between two user plane network elements of the background technology;

[0033] Figure 3 A schematic diagram of uplink and downlink communication convergence and splitting between two user plane network elements in the background technology;

[0034] Figure 4 A schematic diagram of uplink and downlink communication convergence and splitting of multiple user plane network elements in the background technology;

[0035] Figure 5 A schematic diagram of a failure of optical splitting links for uplink and downlink communications of multiple user plane network elements in the background technology;

[0036] Figure 6 A schematic diagram of an inner IP and outer IP pair of a user plane traffic data packet of the present invention;

[0037] Figure 7 It is a schematic diagram of the inner layer five-tuple identification of the TCP data stream of the present invention. DETAILED DESCRIPTION

[0038] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0039] Example 1

[0040] Figure 1 The following is a flow chart of the method for sensing and warning the failure of the optical splitting link according to the present invention. Figure 1 , the method for sensing and warning of optical splitting link failure of the present invention is described in detail.

[0041] In step 101, the traffic between upstream user plane network elements is connected to a downstream deep packet inspection device through splitting, diversion and other devices. The deep packet inspection device receives the traffic between the user plane network elements and analyzes the user plane traffic data packets.

[0042] Optionally, user plane traffic is traffic between user plane network elements, which is traffic for mobile terminals, IoT terminals, or Internet of Vehicles terminals to access the Internet and is carried on the mobile core network.

[0043] As an example, the deep packet traffic components include traffic from different regions.

[0044] In step 102, a single user plane traffic data packet is parsed to obtain an outer IP pair and an inner five-tuple, and it is determined whether the inner protocol in the inner five-tuple is TCP protocol data. If so, the traffic direction of the outer IP pair of the user plane traffic data packet is recorded.

[0045] Alternatively, if Figure 6 As shown in the figure, the user plane traffic of the mobile core network has two layers of IP. The outer IP pair is the network element IP, and the inner IP is the IP of the mobile terminal and the IP of the Internet server.

[0046] As an example, DPI performs traffic monitoring to obtain user plane traffic packets, parses the user plane traffic packets to determine whether the inner IP is TCP, and if it is TCP, learns and records the user plane network element traffic direction of the outer IP pair, and generates a traffic information table.

[0047] Alternatively, if Figure 7 As shown in the figure, a flow has an inner five-tuple unique identifier, including the inner source IP, inner source port, TCP or UDP protocol, inner destination IP, and inner destination port.

[0048] Optionally, the traffic filtering only processes the inner TCP protocol traffic, including determining whether it is the TCP protocol according to the inner IP, and after determining the TCP protocol, determining the traffic direction according to the outer IP pair.

[0049] Optionally, the outer IP pair of the traffic is used as the key, and the corresponding value information includes: upstream network element IP, upstream traffic size, downstream network element IP, downstream traffic size.

[0050] As an example, from the perspective of the transport layer in the ISO seven-layer model, mobile terminals can access the Internet through TCP or UDP. UDP is connectionless, and one party can send application layer data while the other party never responds to the application layer data. The TCP protocol is connection-based and has a response confirmation mechanism. When one party sends application layer data, even if the other party does not respond to the application layer data, the TCP transport layer will send a TCP protocol response to inform the other party's TCP transport layer that the application layer data has been successfully received by the local TCP transport layer. Therefore, when a mobile terminal accesses the Internet through TCP, both uplink and downlink data packets must exist in the mobile core network.

[0051] In step 103, the uplink / downlink traffic directions of the outer IP pairs of the user plane traffic data packets recorded within the detection period are counted to generate a traffic statistics information table.

[0052] Optionally, at the end of each TCP flow, the corresponding value information is inserted and merged into a table. The table entry counts the IP pairs within the time period, with the upstream and downstream network element IP as the key and the upstream and downstream traffic size as the value. As the traffic is continuously processed, steps 101 to 103 are repeatedly executed, and multiple entries will be accumulated and learned in this table.

[0053] In step 104, it is determined whether both the uplink traffic and the downlink traffic of the outer IP pair in the traffic statistics information table exist. If so, the link is normal; otherwise, a link failure warning is issued.

[0054] Optionally, determine whether the uplink or downlink is missing based on the IP address direction, count by IP address direction, and record the data packets in each IP direction. Check each table entry to see if its uplink and downlink traffic are both not 0? If only the uplink is not 0, it is determined that the downlink optical splitting link of the two network element IPs is faulty. Similarly, if only the downlink is not 0, it is determined that the uplink optical splitting link of the two network element IPs is faulty.

[0055] Optionally, the two network element IPs corresponding to the link and the direction of the split optical link failure are sent to the inspection personnel via SMS or email to achieve the purpose of early warning.

[0056] In step 105, a user plane traffic data packet of the next detection cycle is obtained, and steps 101 to 104 are repeated to update the link failure status in real time.

[0057] Optionally, when a fault warning is issued for multiple consecutive detection cycles, the warning level is increased and sent to the inspection personnel.

[0058] As an example, if there are only packets of the TCP protocol in one direction between two user-side network elements from a certain point in time, we can determine that a fault has occurred in the other direction of the link between the two network elements and issue an early warning. The present invention proposes a method for perceiving and warning of optical splitting link failures, which runs on the DPI. As a downstream device, it learns and counts the unidirectional characteristics of the TCP traffic on the downstream DPI device. When a link failure occurs upstream and is not discovered and repaired in time, the downstream can perceive the optical splitting link failure occurring in the upstream device without any knowledge of the upstream. Issue an early warning and provide maintenance clues to help upstream related personnel perform targeted maintenance. Improve the efficiency of discovering and solving problems and minimize the impact of link failures. Ensure the integrity of DPI traffic access. If a link failure is discovered downstream, it means that the upstream has not discovered it or has not discovered it in time. The present invention can sense the upstream link failure downstream without any knowledge of the upstream link.

[0059] Those skilled in the art can understand that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions recorded in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for sensing and warning of optical splitting link failure, characterized in that: include: The traffic between the upstream user plane network elements is connected to the downstream deep packet inspection device through the splitting or shunting intermediate device, the traffic between the user plane network elements is obtained through the deep packet inspection device, and the user plane traffic data packets are inspected and analyzed; Parse a single user plane traffic data packet to obtain an outer IP pair and an inner five-tuple, determine whether the inner protocol in the inner five-tuple is TCP protocol data, and if so, record the traffic direction of the outer IP pair of the user plane traffic data packet; Counting the uplink / downlink traffic of the outer IP pair of the user plane traffic data packet recorded within the detection period, and generating a traffic statistics information table; Determine whether the uplink traffic or downlink traffic of the outer IP pair in the traffic statistics information table is 0, and if so, issue a link failure warning.

2. The method for sensing and warning of optical splitting link failure according to claim 1, characterized in that: The parsing of the user plane traffic data packet to obtain an outer IP pair and an inner IP includes that a single data stream in the user plane traffic data packet includes an inner source IP, an inner source port, a TCP or UDP protocol, an inner destination IP, and an inner destination port.

3. A method for sensing and warning of optical splitting link failure according to claim 1 or 2, characterized in that: The determining whether the inner IP is TCP protocol data and if so, recording the flow direction of the outer IP pair of the user plane traffic data packet includes filtering the flow of the inner protocol to obtain the inner TCP protocol flow data and determining the flow direction of the outer IP pair of the inner TCP protocol flow data.

4. The method for sensing and warning of optical splitting link failure according to claim 3, characterized in that: It also includes that the data information of the outer IP pair includes an upstream network element IP, an upstream traffic size, a downstream network element IP, and a downstream traffic size.

5. The method for sensing and warning of optical splitting link failure according to claim 1, characterized in that: The uplink / downlink traffic of the outer layer IP pair of the user plane traffic data packet recorded in the statistical detection period, generating a traffic statistics information table includes: When a single TCP data flow ends, the corresponding data information is inserted and merged into the traffic statistics information table. The traffic statistics information table counts the IP pairs within the detection period, uses the upstream / downstream network element IP as the key vector, and the upstream and downstream traffic size as the value vector. The TCP data flow information within the detection period is accumulated in the traffic statistics information table.

6. The method for sensing and warning of optical splitting link failure according to claim 1, characterized in that: The determining whether the uplink flow or downlink flow of the outer IP pair in the flow statistics information table is 0, and if so, issuing a link failure warning includes: Check whether the upstream / downstream traffic of a single outer IP pair in the traffic statistics information table is 0. If the downstream traffic is 0, the downstream optical splitting link between the user plane network elements is faulty; if the upstream traffic is 0, the upstream optical splitting link between the user plane network elements is faulty.

7. The method for sensing and warning of optical splitting link failure according to claim 6, characterized in that: The method further includes taking the user plane network element IP corresponding to the split optical link and the fault direction of the split optical link as warning content, and sending the warning content to the inspection personnel.

8. The method for sensing and warning of optical splitting link failure according to claim 1, characterized in that: Obtain the user plane traffic data packet of the next detection cycle, repeat the link fault detection steps, and update the link fault status in real time.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a program running on the processor, and the processor executes a method for sensing and warning of a splitting link failure as described in any one of claims 1 to 8 when running the program.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, a method for sensing and warning of optical splitting link failure described in any one of claims 1 to 8 is executed.

Images