A method and storage medium for network packet tracing based on SRv6

Abstract

This application relates to the field of communication technology and discloses a method and storage medium for tracing network packets based on SRv6. The method is applied to SRv6 probes and includes: determining the source address of each packet based on the mirrored data stream, wherein the mirrored data stream is the data stream in the loop where the SRv6 probe is located; determining the destination label of each packet based on the composition type of each packet, wherein the destination label represents the address of the data stream forwarding node to which the packet arrives; associating each source address, each destination label, and each inner packet and transmitting them to the software-defined network (SDN) controller via a situational awareness system, so that the SDN controller can determine the access node of the packet with abnormal traffic based on the inner packet, source address, and destination label, thereby eliminating the additional configuration of APN ID and other additional bandwidth overhead such as DOH optional headers. The solution is simple to deploy and easy to maintain.

Description

Technical Field

[0001] This application relates to the field of communication technology and provides a method and storage medium for tracing network packets based on SRv6. Background Technology

[0002] Typically, in network packet processing, access nodes are responsible for packet encapsulation and decapsulation, while intermediate nodes are responsible for packet forwarding. When processing data packets, intermediate nodes cannot obtain the access node entry information from the forwarded packets. In scenarios requiring attack tracing and handling, traffic sampling techniques are generally used for tracing. However, a sampling ratio that is too low cannot meet the tracing requirements, while a sampling ratio that is too high will affect device performance and require significant investment in sampling resources and equipment.

[0003] Based on the above issues, a common approach is to use a wide area network (WAN) APN6 source tracing and network security linkage solution. This involves configuring an APNID at the access node, which carries the device identifier, interface identifier, and VPN identifier. The APN ID and related identifiers are encoded into the APN Attribute field of the data forwarding plane. The APN Attribute is carried in the IPv6 DOH (Destination Options Header). Then, APN6 probes are deployed at intermediate network forwarding nodes. These probes transmit the collected data flow information along with the APN ID to the situational awareness system, which performs intelligent big data correlation analysis. Additionally, the relationship between the APN ID and the device identifier, interface identifier, and VPN identifier carried by the APN ID needs to be statically imported into the SDN controller to form a source tracing table. If a threat occurs, the situational awareness system issues a blocking policy carrying the APN ID. The SDN controller queries the source tracing table based on the APN ID to obtain the threat location and issues the blocking policy to block abnormal traffic.

[0004] However, the above solution requires unified deployment of APN ID information across the entire network, making implementation difficult. The limited length of each field in the APN ID limits the network scale supported by the solution. Furthermore, the aforementioned traceability table can only be maintained manually, resulting in poor usability, susceptibility to errors, and the need for manual synchronization of the traceability table when network configuration changes, further complicating maintainability. Moreover, the introduction of the optional DOH header increases network packet length, leading to wasted bandwidth due to increased non-payload packet length. Summary of the Invention

[0005] This application provides a method and storage medium for tracing network packets based on SRv6, which simplifies deployment and improves maintainability.

[0006] The specific technical solution provided in this application is as follows:

[0007] In a first aspect, embodiments of this application provide a method for tracing network packets based on SRv6, applied to SRv6 probes, the method comprising:

[0008] The source address of each packet is determined based on the mirrored data stream. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node, and the packets use SRv6 segment routing technology.

[0009] The destination label of each message is determined based on the composition type of each message. The destination label represents the address of the data flow forwarding node to which the message arrives at the last hop.

[0010] After associating each source address, destination label, and inner packet, the situational awareness system transmits the information to the software-defined networking (SDN) controller. This enables the SDN controller to determine the access node of packets with abnormal traffic based on the inner packets, source addresses, and destination labels. The inner packets are obtained by the SRv6 probe unloading the SRv6 header of the packet.

[0011] Optionally, the destination label of each message is determined based on the composition type of each message, including:

[0012] If the composition type of each message does not include an SRv6 SRH header, then the DA field is extracted from the IPv6 header of the message, and the DA field is determined as the destination label of the message; or

[0013] If the composition type of each message indicates that the message includes an SRv6 SRH message header, then the destination label of the message is determined according to the message storage format and the SRv6 SRH message header.

[0014] Optionally, the destination label of the message is determined based on the message storage format and the SRv6 SRH message header, including:

[0015] If the message is stored in an uncompressed format, the first pointer value is determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value; or

[0016] If the message is stored in a compressed format, the first pointer value and the second pointer value are determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value and the second pointer value. The message includes at least two compressed label segments.

[0017] The first pointer value represents the data stream forwarding node to which the message has arrived, and the second pointer value represents the compressed tag segment currently being executed by the message.

[0018] Optionally, a first pointer value is determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value, including:

[0019] Extract the Segments Left value from the SRv6 SRH header and set the Segments Left value as the first pointer value;

[0020] If the first pointer value indicates that the data flow forwarding node currently arriving at the packet is the last hop data flow forwarding node, then the DA field extracted from the IPv6 packet header will be determined as the packet's destination label; or

[0021] If the first pointer value indicates that the data flow forwarding node to which the packet is currently arriving is not the last hop data flow forwarding node, then the first pointer value is assigned a value until the packet arrives at the last hop data flow forwarding node, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the packet.

[0022] Optionally, a first pointer value and a second pointer value are determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value and the second pointer value, including:

[0023] Extract the Segments Left value and SI value from the SRv6 SRH message header, and determine the Segments Left value as the first pointer value and the SI value as the second pointer value;

[0024] Determine whether the message has reached the last hop data stream forwarding node based on the first pointer value;

[0025] If so, the destination label of the message is determined based on the second pointer value; otherwise, the first pointer value is assigned until the message reaches the last hop data stream forwarding node.

[0026] Optionally, the destination label of the message is determined based on the second pointer value, including:

[0027] If the second pointer value indicates that the currently executing compressed label segment of the packet is the last compressed label segment, then the DA field extracted from the IPv6 packet header is determined as the destination label of the packet; or

[0028] If the second pointer value indicates that the compressed tag segment currently being executed in the message is not the last compressed tag segment, then the second pointer value is assigned a value until the message executes the last compressed tag segment, and the value of the DA field is updated, and the updated DA field is determined as the destination tag of the message.

[0029] Secondly, embodiments of this application provide a method for tracing network packets based on SRv6.

[0030] The method is applied to SDN controllers and includes:

[0031] Each received inner packet is parsed. If any inner packet is found to have abnormal traffic, the destination VPN instance associated with the received source address and destination label is found according to the preset correspondence between source address, destination label and VPN instance. The source address, destination label and inner packet are associated and transmitted to the SDN controller by the situational awareness system. The source address is determined by the SRv6 probe based on each packet in the mirror data stream. The destination label is determined by the SRv6 probe based on the composition type of each packet. The inner packet is obtained by the SRv6 probe after unloading the SRv6 packet header. The mirror data stream is the data stream in the loop where the SRv6 probe is located. The data stream value of the mirror data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The packet uses SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node to which the packet reaches the last hop.

[0032] The access node of the abnormal traffic packets is determined based on the destination VPN instance, and a blocking policy is issued to the access node based on the abnormal traffic N-tuple, where the abnormal traffic N-tuple is determined based on the abnormal traffic packets.

[0033] Thirdly, an SRv6 probe includes:

[0034] Memory, used to store executable instructions;

[0035] A processor for reading and executing executable instructions stored in memory to implement the method as described in any of the first aspects.

[0036] Fourthly, an SDN controller includes:

[0037] Memory, used to store executable instructions;

[0038] A processor is used to read and execute executable instructions stored in memory to implement the method as described in the second aspect.

[0039] Fifthly, a computer-readable storage medium, when instructions in the storage medium are executed by a processor, enables the processor to perform the method described in any of the first and second aspects above.

[0040] The beneficial effects of this application are as follows:

[0041] In summary, this application provides a method and storage medium for SRv6-based network packet tracing. This method, applied to an SRv6 probe, includes: determining the source address of each packet based on a mirrored data stream, where the mirrored data stream is the data stream in the loop where the SRv6 probe resides, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, the packets use SRv6 segment routing technology, determining the destination label of each packet based on its composition type, where the destination label represents the address of the data stream forwarding node at the last hop of the packet, associating each source address, each destination label, and each inner packet, and then transmitting this association to a software-defined network (SDN) controller via a situational awareness system. This allows the SDN controller to determine the access node of packets with abnormal traffic based on the inner packets, source address, and destination label. The inner packets are obtained by the SRv6 probe unloading the SRv6 packet header. This method of using the native SRv6 packet header to confirm the access node of packets with abnormal traffic eliminates the need for an APN. Despite the additional configuration of ID and other parameters, as well as the additional bandwidth overhead of optional DOH headers, the solution is simple to deploy and easy to maintain.

[0042] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0043] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0044] Figure 1 This is a schematic diagram of the system architecture for SRv6-based network packet tracing in an embodiment of this application;

[0045] Figure 2 This is a schematic diagram illustrating the process of an SRv6 probe performing SRv6-based network packet tracing in an embodiment of this application.

[0046] Figure 3 This is a schematic diagram of a process for determining the destination label of each message based on the composition type of each message in an embodiment of this application;

[0047] Figure 4 This is a schematic diagram illustrating a process for determining the destination label of a message based on the SRv6 SRH message header in an embodiment of this application.

[0048] Figure 5This is a flowchart illustrating the method for SDN controllers to perform network packet tracing based on SRv6 in an embodiment of this application.

[0049] Figure 6 This is a schematic diagram of the physical architecture of the SRv6 probe in the embodiments of this application;

[0050] Figure 7 This is a schematic diagram of the physical architecture of the SDN controller in the embodiments of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0052] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.

[0053] The preferred embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0054] See Figure 1 As shown in the embodiments of this application, the system includes at least one SRv6 probe, an SDN controller, and a situational awareness system. Figure 1 In this embodiment, router 1, router 2, and router n are used to exemplarily represent data flow access nodes and data flow forwarding nodes. In order to obtain the source address and destination label of the packet, SRv6 probes are usually set at the aggregation node, i.e., the data flow forwarding node with large forwarding traffic, in order to obtain the source address and destination label of the packet, SRv6 probes are usually set at the aggregation node. Typically, two aggregation nodes are selected in the network and SRv6 probes are set at each node. When the data flow of different user terminals enters the network through different access nodes, it will be further uploaded to the cloud after passing through the data flow forwarding node and the aggregation node. During the transmission process of uploading to the cloud, some user terminal data flows may experience abnormal traffic due to threats. In this embodiment, the SRv6 probes collect the source address and destination label of the data flow and transmit the source address and destination label to the SDN controller through the situational awareness system, so that the SDN controller can determine the access node of the packet with abnormal traffic.

[0055] To facilitate a detailed description of the solutions in the embodiments of this application, the following technical terms will be introduced first:

[0056] IPv6 Segment Routing (SRv6) is a segment routing technology based on the IPv6 forwarding plane, designed to achieve flexible path selection and processing by encoding packet headers within a network programming framework.

[0057] IPv6 segment routing technology SRv6 TE Policy (Segment Routing IPv6 Traffic Engineering Policy): A segment routing technology based on the IPv6 forwarding plane, which aims to improve network quality and meet end-to-end service requirements by implementing traffic engineering through source routing mechanisms.

[0058] G-SRv6 (Generalized Segment Routing over IPv6) is an extended version of SRv6 designed to optimize SRv6 performance and facilitate its large-scale deployment. G-SRv6 significantly reduces segment list overhead by introducing Generalized Segment Identifiers (G-SIDs) and Compressed Segment Identifiers (C-SIDs), thereby reducing the overhead of the SRv6 packet header.

[0059] SDN (Software-Defined Networking) is a network architecture designed to enable flexible management and automation of networks by separating the control plane and data plane.

[0060] In this application embodiment, the implementation of the SRv6-based network packet tracing method is mainly divided into two types: SRv6 probe side and SDN controller side. The following first describes the case where the SRv6 probe executes the SRv6-based network packet tracing method. (See reference...) Figure 2 As shown in the embodiments of this application, a specific process for tracing network packets based on SRv6 is as follows:

[0061] Step 201: Determine the source address of each packet based on the mirrored data stream. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The packets use SRv6 segment routing technology.

[0062] In order not to affect the transmission of the forwarded data stream between various data stream forwarding nodes, in this embodiment of the application, the aforementioned forwarded data stream is copied to obtain a mirrored data stream. That is, the data stream is mirrored to the SRv6 probe at the data stream forwarding node based on the port or fixed traffic characteristics. In this way, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream at the data stream forwarding node. The aforementioned mirrored data stream is introduced into the loop where the SRv6 probe is located so that the SRv6 probe can directly operate on the mirrored data stream, avoiding the impact on the forwarded data stream.

[0063] During implementation, an SRv6 probe is usually set up at a data flow forwarding node that plays a major forwarding role in the network. At the same time, in order to ensure network security, the number of the above-mentioned SRv6 probes is at least two. That is, two data flow forwarding nodes that play a major forwarding role are selected in the network, and a loop is established in parallel at both ends of each data flow forwarding node, and one of the above-mentioned SRv6 probes is set up in one loop.

[0064] During network deployment, the SDN controller or other configuration devices distribute VPN and SRv6 configurations to each access node and each data flow forwarding node in the network. In this embodiment, the SRv6 probe reconstructs the key source and destination information of packets based on the mirrored data flow, thus preparing for packet tracing. Specifically, the SRv6 probe first obtains the IPv6 header of each packet based on the mirrored data flow, and further extracts the SA field from the IPv6 header. The SA field is then used as the source address of each packet, i.e., the source IPv6 router-id.

[0065] Step 202: Determine the destination label of each message based on the composition type of each message, where the destination label represents the address of the data flow forwarding node to which the message arrives at the last hop.

[0066] Considering that the source address and destination label are associated one-to-one with the access node of the packet, after determining the source address of the packet, it is necessary to further determine the destination label of the packet. It should be noted that the packet will pass through multiple different data flow forwarding nodes on its way from the access node to the cloud. The packet will be forwarded between any two nodes according to the path information. The aforementioned destination label represents the address of the data flow forwarding node where the packet arrives at the last hop. In other words, the destination label includes all the path information of the packet from the access node through multiple data flow forwarding nodes to the last hop data flow forwarding node.

[0067] In this embodiment of the application, the destination tag of each message is determined based on the composition type of each message, specifically including:

[0068] The first scenario: If the composition type of each message does not include an SRv6 SRH header, then extract the DA field from the IPv6 header of the message and determine the DA field as the destination label of the message; or

[0069] Considering the different composition types of each packet, during implementation, the SRv6 probe will first detect whether there is an SRv6 SRH packet header in the mirrored data stream. If the packet does not contain an SRv6 SRH packet header, then the IPv6 packet header will be obtained from the packet, and the DA field will be extracted from the IPv6 packet header. The obtained DA field will be determined as the destination label of the packet.

[0070] The second scenario: If the composition type of each message indicates that the message includes an SRv6 SRH message header, then the destination label of the message is determined according to the message storage format and the SRv6 SRH message header.

[0071] During implementation, when the SRv6 probe detects the mirrored data stream and determines that the packet contains an SRv6 SRH header, it further determines the destination label of the packet based on the packet's storage format and the SRv6 SRH header. It should be noted that the above-mentioned packet storage format includes two types: uncompressed and compressed. The uncompressed storage format usually refers to the fields of the data stream forwarding nodes corresponding to different hops being arranged sequentially in the packet, while the compressed storage format usually refers to the fields of the data stream forwarding nodes corresponding to different hops being arranged in the packet in the format of compressed label segments.

[0072] The above determination of the message destination label based on the message storage format and SRv6 SRH message header includes:

[0073] Scenario 1: If the message is stored in an uncompressed format, the first pointer value is determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value. Alternatively...

[0074] First, it should be noted that the first pointer value represents the data flow forwarding node to which the packet has arrived. That is, the first pointer value corresponds one-to-one with the data flow forwarding node where the packet is located during the forwarding process. As the packet is forwarded between various data flow forwarding nodes in the network, the value of the first pointer value is constantly changing.

[0075] The above method determines the first pointer value based on the SRv6 SRH message header and then determines the destination label of the message based on the first pointer value. (See also...) Figure 3 As shown, it includes:

[0076] Step 2021: Extract the Segments Left value from the SRv6 SRH header and set the Segments Left value as the first pointer value.

[0077] The Segments Left value is stored as a field in the SRv6 SRH header. During implementation, after determining that the message is stored in an uncompressed format, the SRv6 probe extracts the Segments Left value from the SRv6 SRH header included in the message and uses the extracted Segments Left value as the first pointer value.

[0078] Step 2022: If the first pointer value indicates that the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node, then the DA field extracted from the IPv6 packet header is determined as the destination label of the packet. Alternatively...

[0079] During implementation, after extracting the first pointer value, the first pointer value is further parsed to determine whether the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node. For example, the first pointer value can be checked to see if it includes the address of the last hop data flow forwarding node. If it does, it means that the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node; if it does not, it means that the data flow forwarding node to which the packet is currently arriving is not the last hop data flow forwarding node.

[0080] After determining that the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node through the first pointer value, the DA field is directly extracted from the IPv6 packet header and the above DA field is determined as the destination label of the packet.

[0081] Step 2023: If the first pointer value indicates that the data flow forwarding node currently arriving at the packet is not the last hop data flow forwarding node, then the first pointer value is assigned a value until the packet arrives at the last hop data flow forwarding node, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the packet.

[0082] After determining that the data flow forwarding node currently arriving at the packet is not the last hop data flow forwarding node through the first pointer value, the first pointer value is assigned a value, for example, by decrementing the first pointer value by one, so that the data flow forwarding node pointed to by the first pointer value changes. The assignment operation continues until the packet corresponding to the first pointer value reaches the last hop data flow forwarding node, and then the assignment operation stops.

[0083] Furthermore, after the packet reaches the last hop data flow forwarding node via the first pointer value after the assignment operation, the value of the DA field is updated using the G-SID Container [SL], and the updated DA field is determined as the destination label of the packet. SL stands for Segment Left, and G-SID Container [SL] refers to the G-SID Container pointed to by SL. In the G-SRv6 scheme, the Generalized SID (G-SID) is used to directly refer to the compressed SID, and the space carrying multiple compressed SIDs is called the G-SID Container.

[0084] Scenario 2: If the message is stored in a compressed format, the first pointer value and the second pointer value are determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value and the second pointer value. The message includes at least two compressed label segments.

[0085] It should be noted that the second pointer value represents the compressed label segment currently being executed by the packet. Typically, a packet includes at least two compressed label segments, each containing a complete set of fields specific to the data stream forwarding node. Since the packet is stored in a compressed format, the second pointer value can indicate the fields corresponding to the data stream forwarding node the packet has reached, but a decompression step is required to obtain them. In practice, the first pointer value is used to determine the data stream forwarding node the packet has reached, and the second pointer value is used to determine the compressed label segment currently being executed by the packet, but a decompression step is required to obtain the packet's destination label.

[0086] The above method determines the first and second pointer values ​​based on the SRv6 SRH message header, and then determines the message's destination label based on the first and second pointer values. (See also...) Figure 4 As shown, it specifically includes:

[0087] Step 2021': Extract Segment from SRv6 SRH Packet Header S The Left value and SI (SID Index, SI) value are used, and the Left value of Segments is determined as the first pointer value, and the SI value is determined as the second pointer value.

[0088] First, it's important to clarify that the SRv6 packet encapsulation format involves adding a new IPv6 basic header and an SRv6 Segment Routing Header (SRH) before the original Layer 3 datagram. SRH is a routing extension header with a routing type value of 4. In the IPv6 basic header, the Next Header value is 43, indicating that the next header is a routing extension header. The routing type field in the routing extension header has a value of 4, indicating that the routing extension header is an SRH. The SRH mainly consists of the following parts: Next Header: 8 bits, used to identify the type of the next header. Hdr Ext Len: 8 bits, representing the length of the SRH header in 8-byte units, excluding the first 8 bytes. Routing Type: 8 bits, the routing type field, with a value of 4, indicating that it carries an SRH. Segments Left: 8 bits, identifying the number of the next SID to be checked, initially set to n-1 (where n represents the number of SIDs in the routing extension header), decreasing by 1 for each node traversed. Last Entry: 8 bits, the number of the first SID in the actual forwarding path of the packet in the SRH header. Flags: 8 bits, flag information. Tag: 16 bits, used to mark a group of packets with the same characteristics. Segment List: SID list. Arranged in order from farthest to nearest node on the packet forwarding path, that is, Segment List[0] represents the last SID of the path, Segment List[1] represents the second to last SID of the path, and so on.

[0089] Furthermore, based on the composition of G-SID, the method for calculating the destination address using G-SID is to concatenate the G-SID in the Segment List with the Common Prefix to form a new destination address. Where: Common Prefix: The common prefix, manually configured by the administrator. G-SID: A 32-bit compressed SID obtained from the SRH. SI value: Used to locate the G-SID within a group of G-SIDs. SI is the lowest two bits of the destination address, ranging from 0 to 3. The SI value is decremented by 1 for each node that compresses the SID. If the SI value is 0, the SI value is decremented by 1. In a group of G-SIDs in the Segment List, G-SIDs are arranged from left to right in ascending order of SI, meaning the leftmost G-SID has an SI of 0, and the rightmost G-SID has an SI of 3. 0: If the sum of the bits in Common Prefix, G-SID, and SI is less than 128 bits, the middle bits are padded with 0.

[0090] Since the Segments Left value is stored as a field in the SRv6 SRH header, during implementation, after confirming that the packet is compressed, the packet is first decompressed. Then, the SRv6 probe extracts the Segments Left value from the SRv6 SRH header included in the packet and uses this extracted value as the first pointer value. Additionally, the SRv6 probe extracts the SI value from the SRv6SRH header included in the packet and uses this extracted value as the second pointer value.

[0091] Step 2022': Determine whether the packet has reached the last hop data flow forwarding node based on the first pointer value. If yes, proceed to step 2023'; otherwise, proceed to step 2024'.

[0092] During implementation, after extracting the first pointer value, the first pointer value is used to determine whether the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node. Similarly, the first pointer value can be used to check whether it includes the address of the last hop data flow forwarding node. If it does, it means that the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node; if it does not, it means that the data flow forwarding node to which the packet is currently arriving is not the last hop data flow forwarding node.

[0093] Step 2023': Determine the destination label of the message based on the second pointer value.

[0094] If the packet has reached the last hop data flow forwarding node based on the first pointer value, the destination label of the packet is further determined based on the second pointer value. Determining the destination label of the packet based on the second pointer value includes:

[0095] (1) If the second pointer value indicates that the compressed label segment currently being executed in the packet is the last compressed label segment, then the DA field extracted from the IPv6 packet header is determined as the destination label of the packet; or

[0096] During implementation, the value of the second pointer, i.e. the value of the SI value mentioned above, is used to determine whether the compressed label segment currently being executed in the packet is the last compressed label segment. For example, when the SI value is zero, it indicates that the second pointer value has pointed to the last compressed label segment. In this case, the compressed label segment is decompressed, the IPv6 packet header is obtained from it, and the DA field is further extracted from the IPv6 packet header. The extracted DA field is determined as the destination label of the packet.

[0097] (2) If the second pointer value indicates that the compressed tag segment currently being executed in the message is not the last compressed tag segment, then the second pointer value is assigned until the message is executed to the last compressed tag segment, and the value of the DA field is updated, and the updated DA field is determined as the destination tag of the message.

[0098] During implementation, the value of the second pointer, i.e. the value of the SI value mentioned above, is used to determine whether the compressed tag segment currently being executed by the message is the last compressed tag segment. For example, when the SI value is not equal to zero, it means that the second pointer value has not yet pointed to the last compressed tag segment. In this case, an assignment operation is performed on the second pointer value, that is, the SI value is decremented by one until the SI value is equal to zero. In this way, the assignment operation can make the second pointer value point to the last compressed tag segment, that is, force the message to execute to the last compressed tag segment.

[0099] To ensure the accuracy of the destination label, the DA field in the IPv6 header needs to be updated in this case. For example, the value of the DA field can be updated using Common Prefix G-SID Container[0].(G-SID[SI])SI Padding, where the Common Prefix len bits are the value of the Common Prefix len bits before the update, and the G-SID len bits are the value of Container[0].G-SID[SI] minus one. In this way, the updated DA field is determined as the destination label of the packet.

[0100] It's important to clarify that in the G-SRv6 scheme, the Generalized SID (G-SID) directly refers to the compressed SID, and the space carrying multiple compressed SIDs is called a G-SID Container. Under this naming system, a G-SID can be a compressed SID, a standard SRv6 SID, or another type of SID; hence the name "Generalized SID." A G-SID Container can carry one standard SRv6 SID, or one to four 32-bit compressed G-SIDs.

[0101] Step 2024': Assign a value to the first pointer until the message reaches the last hop data stream forwarding node.

[0102] During implementation, when it is determined from the first pointer value that the data flow forwarding node currently arriving at the packet is not the last hop data flow forwarding node, the first pointer value is assigned a value, for example, by decrementing the first pointer value by one, so that the data flow forwarding node pointed to by the first pointer value changes. The assignment operation continues until the packet corresponding to the first pointer value reaches the last hop data flow forwarding node, and then the assignment operation stops.

[0103] It should be noted that after the first pointer value, after the assignment operation, causes the packet to reach the last hop data flow forwarding node, the destination label of the packet is determined by combining it with the second pointer value.

[0104] Step 203: After associating each source address, each destination label, and each inner packet, the information is transmitted to the Software Defined Network (SDN) controller via the situational awareness system. This enables the SDN controller to determine the access node of the packet with abnormal traffic based on the inner packet, source address, and destination label. The inner packet is obtained by the SRv6 probe unloading the SRv6 packet header.

[0105] It should be noted that, in addition to obtaining the source address and destination label of each packet, the SRv6 probe also unloads the SRv6 header of the packet to obtain the inner packet. Since the SDN controller sends the source address, destination label, and inner packet to the same access node simultaneously when issuing VPN configuration and SRv6 configuration, the SRv6 probe will associate the source address, destination label, and inner packet of the same access node and send them to the situation awareness system. The situation awareness system will then send the associated source address, destination label, and inner packet to the SDN controller.

[0106] It should be noted that the aforementioned situational awareness system does not have the ability to trace the access node of packets with abnormal traffic. However, the situational awareness system is the connection node between the SRv6 probe and the SDN controller. After the SDN controller determines the access node of the packets with abnormal traffic, the situational awareness system can report the access node to the maintenance center.

[0107] The SDN controller then determines the access node of the abnormal traffic packet based on the inner packet, source address, and destination label. The following section describes the method used by the SDN controller to perform network packet source tracing based on SRv6. (See also...) Figure 5 As shown in the embodiments of this application, a specific process for tracing network packets based on SRv6 is as follows:

[0108] Step 301: Parse each received inner packet. If any inner packet is found to have abnormal traffic, find the destination VPN instance associated with the received source address and destination label according to the preset correspondence between source address, destination label and VPN instance. The source address, destination label and inner packet are associated and transmitted to the SDN controller by the situational awareness system. The source address is determined by the SRv6 probe based on each packet in the mirror data stream. The destination label is determined by the SRv6 probe based on the composition type of each packet. The inner packet is obtained by the SRv6 probe after unloading the SRv6 packet header. The mirror data stream is the data stream in the loop where the SRv6 probe is located. The data stream value of the mirror data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The packet uses SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node to which the packet reaches the last hop.

[0109] During implementation, after the SDN controller receives the association pair of source address, destination label, and inner packet, the SDN controller first parses each received inner packet to determine which inner packet has abnormal traffic. It should be noted that the above-mentioned abnormal traffic may be caused by network attacks, viruses, etc.

[0110] Since there is a one-to-one correspondence between the source address, destination label, and VPN instance for an access node, after identifying an inner packet with abnormal traffic, the SDN controller will search for the VPN instance associated with the received source address and destination label in the preset correspondence between the source address, destination label, and VPN instance established when the configuration is issued, and determine the associated VPN instance as the destination VPN instance. In this embodiment, the destination VPN instance and the access node with abnormal traffic are in one-to-one correspondence.

[0111] Additionally, it should be noted that the source address, destination label, and inner packet are associated and transmitted to the SDN controller via the situational awareness system. The source address is determined by the SRv6 probe based on each packet in the mirrored data stream. The destination label is determined by the SRv6 probe based on the composition type of each packet. The inner packet is obtained by the SRv6 probe after unloading the SRv6 packet header. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The packet uses SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node to which the packet reaches the last hop. These details will not be elaborated further here.

[0112] Step 302: Determine the access node of the abnormal traffic packets based on the destination VPN instance, and issue a blocking policy to the access node based on the abnormal traffic N-tuple, wherein the abnormal traffic N-tuple is determined based on the abnormal traffic packets.

[0113] Since there is a one-to-one correspondence between VPN instances and access nodes, after identifying the destination VPN instance, the SDN controller further determines the corresponding access node based on that instance, thus identifying the access node of the abnormal traffic packet. To prevent the abnormal traffic packet from continuing to threaten the network, during implementation, the SDN controller also parses the abnormal traffic N-tuple from the abnormal traffic packet and issues a blocking policy to the access node based on this N-tuple, thereby preventing the abnormal traffic packet from continuing to transmit traffic into the network.

[0114] Based on the same inventive concept, see [reference] Figure 6 As shown, this application embodiment provides an SRv6 probe, including: a memory 601 for storing executable instructions; and a processor 602 for reading and executing the executable instructions stored in the memory, and executing any of the methods described in the first aspect above.

[0115] Based on the same inventive concept, see [reference] Figure 7 As shown, this application embodiment provides an SDN controller, including: a memory 701 for storing executable instructions; and a processor 702 for reading and executing the executable instructions stored in the memory, and executing the method described in the second aspect above.

[0116] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium that, when the instructions in the storage medium are executed by a processor, enables the processor to perform the methods described in any of the first and second aspects above.

[0117] In summary, this application provides a method and storage medium for SRv6-based network packet tracing. This method, applied to an SRv6 probe, includes: determining the source address of each packet based on a mirrored data stream, where the mirrored data stream is the data stream in the loop where the SRv6 probe resides, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, the packets use SRv6 segment routing technology, determining the destination label of each packet based on its composition type, where the destination label represents the address of the data stream forwarding node at the last hop of the packet, associating each source address, each destination label, and each inner packet, and then transmitting this association to a software-defined network (SDN) controller via a situational awareness system. This allows the SDN controller to determine the access node of packets with abnormal traffic based on the inner packets, source address, and destination label. The inner packets are obtained by the SRv6 probe unloading the SRv6 packet header. This method of using the native SRv6 packet header to confirm the access node of packets with abnormal traffic eliminates the need for an APN. Despite the additional configuration of ID and other parameters, as well as the additional bandwidth overhead of optional DOH headers, the solution is simple to deploy and easy to maintain.

[0118] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program product systems. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product system implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program product systems according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0122] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for tracing network packets based on SRv6, characterized in that, Applied to an SRv6 probe, the method includes: The source address of each packet is determined based on the mirrored data stream, wherein the mirrored data stream is the data stream in the loop where the SRv6 probe is located, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, and the packet adopts SRv6 segment routing technology. The destination label of each message is determined based on the composition type of each message, wherein the destination label represents the address of the data flow forwarding node to which the message arrives at the last hop; After associating the source addresses, destination labels, and inner packets, the data is transmitted to the Software Defined Network (SDN) controller via the situational awareness system. This enables the SDN controller to determine the access node of the packet with abnormal traffic based on the inner packet, the source address, and the destination label. The inner packet is obtained by the SRv6 probe unloading the SRv6 header of the packet.

2. The method as described in claim 1, characterized in that, The process of determining the destination label of each message based on its composition type includes: If the composition type of each message indicates that the message does not include an SRv6 SRH header, then the DA field is extracted from the IPv6 header of the message, and the DA field is determined as the destination label of the message; or If the composition type of each message indicates that the message includes an SRv6 SRH message header, then the destination label of the message is determined according to the storage format of the message and the SRv6 SRH message header.

3. The method as described in claim 2, characterized in that, The step of determining the destination label of the message based on the message storage format and the SRv6SRH message header includes: If the message is stored in an uncompressed format, then a first pointer value is determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value; or If the message is stored in a compressed format, a first pointer value and a second pointer value are determined based on the SRv6 SRH message header, and the destination tag of the message is determined based on the first pointer value and the second pointer value, wherein the message includes at least two compressed tag segments; Wherein, the first pointer value represents the data stream forwarding node to which the packet has currently arrived, and the second pointer value represents the compressed tag segment currently being executed by the packet.

4. The method as described in claim 3, characterized in that, The step of determining a first pointer value based on the SRv6 SRH packet header and determining the destination label of the packet based on the first pointer value includes: Extract the Segments Left value from the SRv6 SRH packet header, and determine the Segments Left value as the first pointer value; If the first pointer value indicates that the data flow forwarding node to which the packet is currently arriving is the last hop data flow forwarding node, then the DA field extracted from the IPv6 packet header is determined as the destination label of the packet; or If the first pointer value indicates that the data flow forwarding node to which the packet is currently arriving is not the last hop data flow forwarding node, then the first pointer value is assigned a value until the packet arrives at the last hop data flow forwarding node, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the packet.

5. The method as described in claim 3, characterized in that, The step of determining a first pointer value and a second pointer value based on the SRv6 SRH packet header, and determining the destination label of the packet based on the first pointer value and the second pointer value, includes: Extract the Segments Left value and SI value from the SRv6 SRH packet header, and determine the Segments Left value as the first pointer value and the SI value as the second pointer value; Determine whether the message has reached the last hop data stream forwarding node based on the first pointer value; If so, the destination label of the message is determined according to the second pointer value; otherwise, the first pointer value is assigned a value until the message reaches the last hop data stream forwarding node.

6. The method as described in claim 5, characterized in that, Determining the destination label of the message based on the second pointer value includes: If the second pointer value indicates that the compressed label segment currently being executed in the packet is the last compressed label segment, then the DA field extracted from the IPv6 packet header is determined as the destination label of the packet; or If the second pointer value indicates that the compressed tag segment currently being executed by the message is not the last compressed tag segment, then the second pointer value is assigned a value until the message executes the last compressed tag segment, and the value of the DA field is updated, and the updated DA field is determined as the destination tag of the message.

7. A method for tracing network packets based on SRv6, characterized in that, The method is applied to an SDN controller and includes: Each received inner packet is parsed. If any inner packet is found to have abnormal traffic, the destination VPN instance associated with the received source address and destination label is found according to the preset correspondence between source address, destination label, and VPN instance. The source address, destination label, and inner packet are associated and transmitted to the SDN controller by the situational awareness system. The source address is determined by the SRv6 probe based on each packet in the mirrored data stream. The destination label is determined by the SRv6 probe based on the composition type of each packet. The inner packet is obtained by the SRv6 probe after unloading the SRv6 packet header. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The packet uses SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node to which the packet reaches the last hop. The access node of the abnormal traffic packet is determined based on the destination VPN instance, and a blocking policy is issued to the access node based on the abnormal traffic N-tuple, wherein the abnormal traffic N-tuple is determined based on the abnormal traffic packet.

8. An SRv6 probe, characterized in that, include: Memory, used to store executable instructions; A processor for reading and executing executable instructions stored in the memory to implement the method as claimed in any one of claims 1-6.

9. An SDN controller, characterized in that, include: Memory, used to store executable instructions; A processor for reading and executing executable instructions stored in the memory to implement the method as described in claim 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor, the processor is able to perform the method as described in any one of claims 1-7.

Images