A network monitoring and diagnosis method and device based on eBPF

Abstract

The present invention discloses a network monitoring and diagnosis method and device based on eBPF, which relates to the technical field of network environment diagnosis. The method includes: capturing network interaction data between a client and a service server based on an operating system kernel of eBPF; when a predetermined trigger condition is met, the captured network interaction data is forwarded in real time through a log forwarding service, and the log data is analyzed and detected in real time, and the analyzed and detected log data is stored in a log database; potential network problems are checked and located according to the stored log data; and the network is scheduled and optimized according to the checking results. The present invention can capture and analyze abnormal network behavior in real time, and significantly improve the problem diagnosis efficiency and monitoring scalability in complex distributed systems.

Description

Technical Field

[0001] The present invention relates to the technical field of network environment diagnosis, and in particular to a network monitoring and diagnosis method and device based on eBPF. Background Art

[0002] Traditional network monitoring tools can only provide superficial network performance data, lack sufficient accuracy and real-time performance, and are difficult to meet the sophisticated network quality requirements of complex distributed systems. Especially in large-scale distributed environments, traditional methods are difficult to deeply analyze the specific interactive behavior of each TCP connection, resulting in low efficiency and insufficient accuracy in network problem troubleshooting. In addition, XDP in the eBPF (Extended Berkeley Packet Filter) technology only supports the interception of inbound traffic and cannot achieve two-way traffic monitoring. Summary of the invention

[0003] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a network monitoring and diagnosis method and device based on eBPF, which can capture and analyze network abnormal behaviors in real time, and significantly improve the problem diagnosis efficiency and monitoring scalability in complex distributed systems.

[0004] One aspect of the present invention provides a network monitoring and diagnosis method based on eBPF for accessing a server, comprising: capturing network interaction data between a client and a service server based on an operating system kernel of eBPF, wherein the network interaction data includes TCP layer data and service signaling of an application layer; when a predetermined trigger condition is met, forwarding the captured network interaction data in real time through a log forwarding service, performing real-time analysis and anomaly detection on the log data to identify potential network problems and generate alarm information, and storing the analyzed and detected log data in a log database; troubleshooting and locating the potential network problems according to the stored log data; and scheduling and optimizing the network according to the troubleshooting results.

[0005] Furthermore, the step of capturing the TCP layer data and the service signaling of the application layer includes: capturing the key data packets of the TCP connection between the client and the service server through the eBPF-based operating system kernel, extracting TCP / IP information from the key data packets to construct a unique key for identifying the status of the TCP connection; recording the current timestamp when the SYN or PSH flag of the key data packet is detected, and recording the current timestamp again when the corresponding ACK packet is received, and calculating the round-trip delay RTT of the TCP connection by comparing the difference between the two timestamps; when the key data packet is received, checking the sequence number and the response sequence number of the key data packet, and the retransmission counter is incremented when a repeated sequence number is detected to count the number of retransmissions of the current TCP connection; capturing and analyzing the abnormal signaling flag of each key data packet in real time, and when the RST flag is detected, recording and updating the count value of the abnormal connection; parsing the signaling header of the payload of the key data packet, extracting the service signaling related to the type and mode of service interaction, and the service signaling includes CONNECT signaling, PUBLISH signaling and QUERY signaling.

[0006] Furthermore, the real-time analysis and anomaly detection of log data includes: determining the specific operation type based on the service signaling, and classifying and analyzing the operation service according to the operation type; combining the TCP network quality indicators obtained from the TCP layer data and the analysis results of the operation service obtained from the service signaling for correlation analysis; locating the cause of the fault and generating alarm information based on the correlation analysis results.

[0007] Furthermore, when a predetermined trigger condition is met, the captured network interaction data is log forwarded; wherein the predetermined trigger condition includes that the round-trip time RTT is too high and the number of retransmissions exceeds a threshold.

[0008] Furthermore, the abnormal signaling flag includes a SYN flag, a FIN flag and a RST flag.

[0009] Furthermore, the TCP network quality indicators obtained from the TCP layer data and the analysis results of the operating services obtained from the service signaling are combined together for correlation analysis, including: if the sending frequency of the CONNECT signaling exceeds a predetermined threshold and the TCP connection establishment time is delayed, the fault is identified as a connection establishment delay caused by a network bottleneck, and suggestions for optimizing the link are given; when the PUBLISH signaling sends a message, if the TCP layer shows high latency or frequent retransmissions, the fault is identified as a network bottleneck, and suggestions for optimizing the data packet body size and optimizing the link are given; if the QUERY signaling response is delayed and the TCP layer retransmission rate is high, the fault is identified as a prolonged query response time caused by a network bottleneck, and suggestions for adjusting the data packet body size, message sending rate and link are given.

[0010] Furthermore, it also includes: obtaining the client's network address, the operating system type, application version and network type data of the client platform based on TCP layer data, and obtaining the information of the client's region and operator according to the client's network address; evaluating and analyzing the network quality of the region, operator, network type and client platform, and building a data dashboard based on the analysis results.

[0011] On the other hand, the present invention also provides a network monitoring and diagnosis device based on eBPF for accessing a server, including: a capture module, configured to capture network interaction data between a client and a service server based on an eBPF operating system kernel, wherein the network interaction data includes TCP layer data and service signaling of an application layer; a data analysis module, configured to forward the captured network interaction data in real time through a log forwarding service when a predetermined trigger condition is met, perform real-time analysis and anomaly detection on the log data to identify potential network problems and generate alarm information, and store the analyzed and detected log data in a log database; troubleshoot and locate the potential network problems according to the stored log data; and a network scheduling module, configured to schedule and optimize the network according to the troubleshooting results.

[0012] Furthermore, the capture module is configured to: capture key data packets of the TCP connection between the client and the business server through an eBPF-based operating system kernel, extract TCP / IP information from the key data packets to construct a unique key for identifying the status of the TCP connection; record the current timestamp when the SYN or PSH flag of the key data packet is detected, and record the current timestamp again when the corresponding ACK packet is received, and calculate the round-trip delay RTT of the TCP connection by comparing the difference between the two timestamps; when the key data packet is received, check the sequence number and the response sequence number of the key data packet, and the retransmission counter is incremented when a repeated sequence number is detected to count the number of retransmissions of the current TCP connection; capture and analyze the abnormal signaling flag of each key data packet in real time, and when the RST flag is detected, record and update the count value of the abnormal connection; parse the signaling header of the payload of the key data packet, and extract the business signaling related to the type and mode of business interaction, and the business signaling includes CONNECT signaling, PUBLISH signaling and QUERY signaling.

[0013] Furthermore, the data analysis module is configured to: determine the specific operation type based on the service signaling, and classify and analyze the operation service according to the operation type; combine the TCP network quality indicators obtained from the TCP layer data and the analysis results of the operation service obtained from the service signaling to perform correlation analysis; locate the cause of the fault and generate alarm information based on the correlation analysis results.

[0014] Furthermore, the data analysis module is configured to: forward the captured network interaction data in log form when a predetermined trigger condition is met; wherein the predetermined trigger condition includes a round-trip time (RTT) that is too high and a number of retransmissions that exceeds a threshold.

[0015] Furthermore, the abnormal signaling flag includes a SYN flag, a FIN flag and a RST flag.

[0016] Furthermore, the data analysis module is configured to: combine the TCP network quality indicators obtained from the TCP layer data and the analysis results of the operating services obtained from the service signaling for correlation analysis, including: if the sending frequency of the CONNECT signaling exceeds a predetermined threshold and the TCP connection establishment time is delayed, the fault is identified as a connection establishment delay caused by a network bottleneck, and suggestions for optimizing the link are given; when the PUBLISH signaling sends a message, if the TCP layer shows high latency or frequent retransmissions, the fault is identified as a network bottleneck, and suggestions for optimizing the data packet body size and optimizing the link are given; if the QUERY signaling response is delayed and the TCP layer retransmission rate is high, the fault is identified as a prolonged query response time caused by a network bottleneck, and suggestions for adjusting the data packet body size, message sending rate and link are given.

[0017] Furthermore, it also includes a data disk construction module, which is configured to: obtain the client's network address, the operating system type, application version and network type data of the client platform based on TCP layer data, and obtain the information of the client's region and operator according to the client's network address; evaluate and analyze the network quality of the region, operator, network type and client platform, and build a data disk based on the analysis results.

[0018] The eBPF-based network monitoring and diagnosis method and device provided by the present invention have the following beneficial effects:

[0019] (1) Compared with traditional user space monitoring tools, the present invention performs kernel-level network monitoring based on eBPF technology, which can directly access TCP layer data and avoid the delay and accuracy problems of user space data collection;

[0020] (2) The present invention uses eBPF technology to achieve all-round monitoring from the TCP connection layer to the application layer, providing detailed life cycle data for each TCP connection. Combining multi-dimensional data from the network layer and the application layer, the root cause of network problems can be accurately located, rather than just limited to surface problems.

[0021] (3) The data collected by eBPF can be used to conduct detailed analysis of network quality from multiple dimensions such as region, operator, network type and access platform for global network access, helping users optimize network architecture and improve overall performance. This flexible analysis method is superior to the single-perspective analysis of traditional monitoring tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0023] Figure 1 This is a system logic diagram of an eBPF-based network monitoring and diagnosis method provided by an embodiment of the present application;

[0024] Figure 2 It is a flowchart of a network monitoring and diagnosis method based on eBPF provided by an embodiment of the present application;

[0025] Figure 3 It is a schematic diagram of capturing key data packets in the eBPF-based network monitoring and diagnosis method provided by an embodiment of the present application;

[0026] Figure 4 This is a schematic diagram of application layer service signaling in an eBPF-based network monitoring and diagnosis method provided by an embodiment of the present application;

[0027] Figure 5 It is a structural diagram of an eBPF-based network monitoring and diagnosis device provided by an embodiment of the present application;

[0028] Figure 6 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings.

[0031] It should be understood that although the terms first, second, third, etc. may be used to describe the acquisition modules in the embodiments of the present invention, the acquisition modules should not be limited to these terms. These terms are only used to distinguish the acquisition modules from each other.

[0032] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0033] It should be noted that the directional words such as "upper", "lower", "left", and "right" described in the embodiments of the present invention are described at the angles shown in the drawings and should not be understood as limiting the embodiments of the present invention. In addition, in the context, it should also be understood that when it is mentioned that an element is formed "on" or "under" another element, it can not only be formed directly "on" or "under" another element, but also be formed "on" or "under" another element indirectly through an intermediate element.

[0034] See also Figure 1 An embodiment of the present invention provides a network monitoring and diagnosis system 100 based on eBPF, which, through the collaborative work of multiple modules, constitutes an efficient, real-time, and accurate network quality monitoring and optimization system, which comprehensively improves the diagnosis efficiency of network problems and the stability of system performance.

[0035] See also Figure 1, the client 101 initiates a network request to the business service 102, preparing to interact with the business service 102; the access service 103, as the middle layer between the client and the business service, is responsible for forwarding the data interaction between the client and the business service 103; the eBPF program is attached to the access server 102, and is used to capture various types of interaction data at the network layer in real time, such as connection delay, number of retransmissions, etc.; the data captured by eBPF is forwarded in real time through the log forwarding service 104 to ensure the timeliness and integrity of network monitoring data. The data forwarded to the log forwarding service 104 will be passed to the log analysis service 105 for real-time analysis and anomaly detection. The log analysis service 105 conducts in-depth research on network quality, identifies potential network problems, and generates alarms. The analyzed data is stored in the log storage service 106, which supports large-scale and efficient data storage and management, ensures data persistence and query efficiency. The log storage service 106 is connected to the problem troubleshooting system 107, the data display dashboard 108, and the network scheduling system 109. The problem troubleshooting system 107 provides powerful troubleshooting tools, supports querying network data interactions by user dimensions, and assists in quickly locating the root cause of the problem through intelligent analysis. The stored data will be The data display dashboard 108 is visualized, and users can view network quality indicators of different dimensions (regions, services, users, etc.) in real time through the dashboard, helping operation and maintenance personnel to make quick analysis and decisions; based on the analysis results, the network scheduling system 109 can perform network scheduling and optimization, automatically adjust network traffic or configuration, improve overall network performance and stability, and select appropriate network links to be sent according to network delay and network retransmission ratio. If the network delay is less than 50ms and the network retransmission rate is high, considering that the global network environment is relatively complex and there may be protocol identification code interception, the encrypted link is given priority; if the network delay is high and the retransmission rate is low, sending the encrypted link will increase network interaction, and at this time, the original link is given priority.

[0036] See also Figure 2 Another embodiment of the present invention further provides a network monitoring and diagnosis method based on eBPF, comprising the following steps:

[0037] Step S101: The operating system kernel based on eBPF captures network interaction data between a client and a service server, wherein the network interaction data includes TCP layer data and service signaling of an application layer.

[0038] Specifically, eBPF technology is used to implement detailed monitoring and data analysis of TCP connections at the kernel layer, including but not limited to: real-time RTT calculation, retransmission detection, and abnormal signaling counting.

[0039] First, the data packets of the TCP connection are captured. However, in this embodiment, the data packet capture only focuses on capturing key data packets such as the start data packet, abnormal data packet, and end data packet. Figure 3 The start data packets are the first four data packets of each end of TCP data exchange; the abnormal data packets are the abnormal data whose TCP interactive network delay and retry times are greater than the threshold; the end data packets are the FIN and RST data packets in TCP. The strategic advantages of capturing key data packets in this step are:

[0040] (1) Reduce data redundancy. By capturing only key data packets, such as connection initialization, abnormality, and disconnection, meaningless data capture is avoided, thereby significantly reducing the burden of data storage and transmission;

[0041] (2) Improve efficiency. Focusing on important network events can reduce computing and storage pressure without sacrificing analysis accuracy, thereby improving the efficiency of the overall monitoring system.

[0042] (3) Quickly locate problems. Start, exception, and end packets usually carry important status information of the network connection. By centrally capturing these packets, network problems can be located more quickly and accurately, especially when the network quality is unstable or a network anomaly occurs.

[0043] (4) Optimize resource consumption. Only critical data packets are captured, avoiding the continuous capture and processing of all data packets, reducing the consumption of system resources, and making the network monitoring system more scalable when deployed on a large scale.

[0044] Through the above data capture strategy of the present invention, efficient and scalable network quality monitoring can be provided, and the accuracy and practicality of data analysis can be ensured, while maintaining the sustainability of system performance.

[0045] Next, after capturing the key data packet, the TCP connection monitoring is initialized. Specifically, when the TCP key data packet is captured, the eBPF program will extract the necessary TCP / IP information from the key data packet, such as: source and destination IP, port, sequence number, confirmation sequence number, etc. A unique key is constructed with this information to identify the status of each TCP connection. Among them, the unique key consists of: source address, source port, destination address, destination port, sequence number, etc. When the key data packet is sent, the unique key is obtained by the sequence number and the data packet size and the current time is recorded. When the other end responds, the recording time is obtained according to the unique key. The difference between the recorded time and the current time is calculated to calculate the round-trip time RTT of the network. When the key data packet is retransmitted, the number of retransmissions can be recorded according to the count of the recorded unique key. Therefore, the status of each TCP connection can be identified by constructing a unique key.

[0046] Next, calculate the round-trip time RTT. When the SYN or PSH flag of the TCP key data packet is detected, the program will record the current timestamp. When the corresponding ACK packet is received (in the TCP / IP protocol, the receiver will send an ACK packet as a response after successfully receiving the data to confirm the correct reception of the data), the program will record the current time again. By comparing the timestamp difference between the ACK packet and the previous packet, the round-trip time RTT of the TCP connection can be calculated. After the round-trip time RTT is calculated, it is converted into milliseconds and stored in a special data structure to support real-time evaluation of network delays.

[0047] Next, retransmission detection is performed. When the program receives a TCP key data packet, it checks the sequence number and confirmation sequence number of the data packet. If the sequence number is repeated, it means that the data packet may have been retransmitted. The retransmission counter increments when a repeated sequence number is detected to count the number of retransmissions for the current connection. The number of retransmissions reflects network quality issues. The retransmission counter is updated in real time throughout the life cycle of the TCP connection to provide support for analyzing network packet loss.

[0048] Next, abnormal signaling monitoring and counting are performed. The eBPF program captures and analyzes the abnormal signaling flags such as SYN, FIN, and RST of each TCP key data packet in real time. Among them, SYN indicates the start of the connection, FIN indicates the end of the connection, and RST indicates an abnormal reset of the connection. When the RST flag is detected, the program will record and update the count of abnormal connections to help identify abnormal disconnections. By tracking flags such as SYN, FIN, and RST, the present invention can identify abnormal connection behaviors, such as sudden interruptions or reconnection phenomena, and provide data support for subsequent troubleshooting.

[0049] Next, the signaling header of the payload of the key data packet is parsed to extract the service signaling related to the type and mode of service interaction. Figure 4 The business signaling includes CONNECT signaling, PUBLISH signaling and QUERY signaling. Among them, CONNECT signaling indicates that the client initiates a connection request, marking the first communication; PUBLISH signaling indicates that the client sends a message or data, which is often used for publishing or notification; QUERY signaling indicates that the client requests data, which is usually used for information pulling or query operations. By parsing the above signaling, it helps to determine the type and mode of business interaction and provide context information for subsequent analysis.

[0050] Step S102, forwarding the captured network interaction data in real time through the log forwarding service, performing real-time analysis and anomaly detection on the log data to identify potential network problems and generate alarm information, and storing the analyzed and detected log data in the log database; troubleshooting and locating the potential network problems based on the stored log data.

[0051] When the predetermined trigger conditions are met, the captured TCP layer data and application layer business signaling are forwarded in real time through the log forwarding service, wherein the predetermined trigger conditions include round-trip time RTT being too high and the number of retransmissions exceeding a threshold.

[0052] Next, the forwarded log data is analyzed in real time and anomaly detected, including: determining the specific operation type based on the service signaling, and classifying and analyzing the operation services based on the operation type; combining the TCP network quality indicators obtained from the TCP layer data and the analysis results of the operation services obtained from the service signaling for correlation analysis.

[0053] For example: If PUBLISH signaling is frequent and the network layer has high latency or retransmission, it means that the network bottleneck affects message transmission. If the QUERY response time is long but the network latency is normal, it means that the application layer processing capacity is insufficient. The cause of the fault can be located and alarm information can be generated based on the correlation analysis results.

[0054] Another example: if the sending frequency of CONNECT signaling exceeds the predetermined threshold and the TCP connection establishment time is delayed, the fault is identified as a connection establishment delay caused by a network bottleneck, and suggestions for optimizing the link are given; when sending messages with PUBLISH signaling, if the TCP layer shows high latency or frequent retransmissions, the fault is identified as a network bottleneck, and suggestions for optimizing the data packet body size and optimizing the link are given; if the QUERY signaling response is delayed and the TCP layer retransmission rate is high, the fault is identified as a prolonged query response time caused by a network bottleneck, and suggestions for adjusting the data packet body size, message delivery rate, and link are given.

[0055] Next, the analyzed data will be stored in the database of the log storage service, which supports large-scale and efficient data storage and management, ensuring data persistence and query efficiency. Finally, the stored data will be visualized through the data display dashboard, which can view network quality indicators of different dimensions (such as region, service, user, etc.) in real time, helping operation and maintenance personnel to troubleshoot, locate and make quick decisions.

[0056] More preferably, this embodiment also supports the analysis of network quality by region, operator, network type, access platform, etc. Specifically, the network address of the client, the operating system type, application version and network type data of the client platform are obtained based on the TCP layer data, and the information of the region and operator where the client is located is obtained according to the network address of the client; the network quality of the region, operator, network type and client platform is evaluated and analyzed, and a data disk is constructed according to the analysis results, so as to provide high-precision data support for network performance optimization and strategic decision-making.

[0057] Step S103: schedule and optimize the network according to the checking result.

[0058] Specifically, network scheduling and optimization are performed based on the results of the investigation. For example, network traffic or configuration is automatically adjusted to improve overall network performance and stability. The appropriate network link can be selected based on network latency and network retransmission ratio. If the network latency is less than 50ms and the network retransmission rate is high, considering that the global network environment is relatively complex and there may be protocol identification code interception, the encrypted link is given priority. If the network latency is high and the retransmission rate is low, the encrypted link will increase network interaction, so the original link is given priority.

[0059] The eBPF-based network monitoring and diagnosis method provided in this embodiment constitutes an efficient, real-time, and accurate network quality monitoring and optimization system, which comprehensively improves the diagnosis efficiency of network problems and the stability of system performance.

[0060] See also Figure 5 Another embodiment of the present invention further provides a network monitoring and diagnosis device 200 based on eBPF, including a capture module 201, a data analysis module 202 and a network scheduling module 203. The device 200 can execute the network monitoring and diagnosis method based on eBPF in the method embodiment.

[0061] Specifically, the eBPF-based network monitoring and diagnosis device 200 includes:

[0062] The capture module 201 is configured to capture network interaction data between the client and the service server based on the operating system kernel of eBPF, wherein the network interaction data includes TCP layer data and application layer service signaling;

[0063] The data analysis module 202 is configured to forward the captured network interaction data in real time through the log forwarding service when a predetermined trigger condition is met, perform real-time analysis and anomaly detection on the log data to identify potential network problems and generate alarm information, store the analyzed and detected log data in the log database; and troubleshoot and locate the potential network problems according to the stored log data;

[0064] The network scheduling module 203 is configured to schedule and optimize the network according to the checking result.

[0065] Furthermore, the capture module 201 is configured to: capture key data packets of the TCP connection between the client and the business server through an eBPF-based operating system kernel, extract TCP / IP information from the key data packets to construct a unique key for identifying the status of the TCP connection; record the current timestamp when the SYN or PSH flag of the key data packet is detected, and record the current timestamp again when the corresponding ACK packet is received, and calculate the round-trip delay RTT of the TCP connection by comparing the difference between the two timestamps; when the key data packet is received, check the sequence number and the response sequence number of the key data packet, and the retransmission counter is incremented when a repeated sequence number is detected to count the number of retransmissions of the current TCP connection; capture and analyze the abnormal signaling flag of each key data packet in real time, and when the RST flag is detected, record and update the count value of the abnormal connection; parse the signaling header of the payload of the key data packet, and extract the business signaling related to the type and mode of business interaction, and the business signaling includes CONNECT signaling, PUBLISH signaling and QUERY signaling.

[0066] Furthermore, the data analysis module 202 is configured to: determine the specific operation type based on the service signaling, and classify and analyze the operation service according to the operation type; combine the TCP network quality indicators obtained from the TCP layer data and the analysis results of the operation service obtained from the service signaling to perform correlation analysis; locate the cause of the fault and generate alarm information based on the correlation analysis results.

[0067] Furthermore, the data analysis module 202 is also configured to: if the sending frequency of CONNECT signaling exceeds a predetermined threshold and the TCP connection establishment time is delayed, the fault is identified as a connection establishment delay caused by a network bottleneck, and suggestions for optimizing the link are given; when the PUBLISH signaling sends a message, if the TCP layer shows high latency or frequent retransmissions, the fault is identified as a network bottleneck, and suggestions for optimizing the data packet body size and optimizing the link are given; if the QUERY signaling response is delayed and the TCP layer retransmission rate is high, the fault is identified as a prolonged query response time caused by a network bottleneck, and suggestions for adjusting the data packet body size, the message sending rate, and the link are given.

[0068] Furthermore, it also includes a data disk construction module, which is configured to: obtain the client's network address, the operating system type, application version and network type of the client platform based on TCP layer data, and obtain the information of the client's region and operator according to the client's network address; evaluate and analyze the network quality of the region, operator, network type and client platform, and build a data disk based on the analysis results.

[0069] It should be noted that the eBPF-based network monitoring and diagnosis device 200 provided in this embodiment corresponds to a technical solution that can be used to execute each method embodiment. Its implementation principle and technical effect are similar to the method and will not be repeated here.

[0070] See also Figure 6 Another embodiment of the present invention provides a schematic diagram of the structure of an electronic device 300, which is used to implement the eBPF-based network monitoring and diagnosis method in the method embodiment. The electronic device 300 in the embodiment of the present invention may include but is not limited to a smart phone, a tablet computer, a PC, and a server. Figure 6 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0071] like Figure 6 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303 to implement the method of the embodiment of the present invention. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0072] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 6 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0073] The above description is only a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A network monitoring and diagnosis method based on eBPF, used for access server, characterized in that include: Capturing network interaction data of a TCP connection between a client and a service server through an operating system kernel based on eBPF, the network interaction data including key data packets, extracting TCP / IP information from the key data packets to construct a unique key for identifying the state of the TCP connection; When the SYN or PSH flag of the key data packet is detected, the current timestamp is recorded, and when the corresponding ACK packet is received, the current timestamp is recorded again, and the round-trip delay RTT of the TCP connection is calculated by comparing the difference between the two timestamps; when the key data packet is received, the sequence number and the response sequence number of the key data packet are checked, and the retransmission counter is incremented when a repeated sequence number is detected to count the number of retransmissions of the current TCP connection; Capture and analyze the abnormal signaling flag of each key data packet in real time, and when the RST flag is detected, record and update the count value of the abnormal connection; parse the signaling header of the payload of the key data packet, and extract the service signaling related to the type and mode of service interaction, the service signaling includes CONNECT signaling, PUBLISH signaling and QUERY signaling; When the predetermined trigger conditions are met, the captured network interaction data is forwarded in real time through the log forwarding service, the specific operation type is determined according to the business signaling, and the operation business is classified and analyzed according to the operation type; if the sending frequency of the CONNECT signaling exceeds the predetermined threshold and the TCP connection establishment time is delayed, the fault is identified as a connection establishment delay caused by a network bottleneck, and suggestions for optimizing the link are given; when the PUBLISH signaling sends a message, if the TCP layer shows high latency or frequent retransmissions, the fault is identified as a network bottleneck, and suggestions for optimizing the packet size of the data packet and optimizing the link are given; if the QUERY signaling response is delayed and the TCP layer retransmission rate is high, the fault is identified as a query response time extension caused by a network bottleneck, and suggestions for adjusting the packet size of the data packet, the message sending rate, and the link are given; the cause of the fault is located and an alarm message is generated based on the analysis results to identify potential network problems and generate alarm information, and the analyzed and detected log data is stored in the log database; the potential network problems are investigated and located based on the stored log data; Schedule and optimize the network based on the troubleshooting results.

2. A network monitoring and diagnosis method based on eBPF according to claim 1, characterized in that: Also includes: Based on the TCP layer data, the network address of the client, the operating system type of the client platform, the application version and the network type data are obtained, and according to the network address of the client, the information of the region and operator where the client is located is obtained; Evaluate and analyze the network quality of regions, operators, network types, and client platforms, and build a data dashboard based on the analysis results.

3. A network monitoring and diagnostic device based on eBPF, used for accessing a server, characterized in that include: A capture module is configured to capture network interaction data of a TCP connection between a client and a service server through an operating system kernel based on eBPF, wherein the network interaction data includes key data packets, and TCP / IP information is extracted from the key data packets to construct a unique key for identifying a state of the TCP connection; When the SYN or PSH flag of the key data packet is detected, the current timestamp is recorded, and when the corresponding ACK packet is received, the current timestamp is recorded again, and the round-trip delay RTT of the TCP connection is calculated by comparing the difference between the two timestamps; when the key data packet is received, the sequence number and the response sequence number of the key data packet are checked, and the retransmission counter is incremented when a repeated sequence number is detected to count the number of retransmissions of the current TCP connection; Capture and analyze the abnormal signaling flag of each key data packet in real time, and when the RST flag is detected, record and update the count value of the abnormal connection; parse the signaling header of the payload of the key data packet, and extract the service signaling related to the type and mode of service interaction, the service signaling includes CONNECT signaling, PUBLISH signaling and QUERY signaling; The data analysis module is configured to forward the captured network interaction data in real time through the log forwarding service when the predetermined trigger condition is met, determine the specific operation type according to the business signaling, and classify and analyze the operation business according to the operation type; if the sending frequency of the CONNECT signaling exceeds the predetermined threshold and the TCP connection establishment time is delayed, the fault is identified as a connection establishment delay caused by a network bottleneck, and suggestions for optimizing the link are given; when the PUBLISH signaling sends a message, if the TCP layer shows high latency or frequent retransmissions, the fault is identified as a network bottleneck, and suggestions for optimizing the packet size of the data packet and optimizing the link are given; if the QUERY signaling response is delayed and the TCP layer retransmission rate is high, the fault is identified as a query response time extension caused by a network bottleneck, and suggestions for adjusting the packet size of the data packet, the message sending rate, and the link are given; locate the cause of the fault and generate alarm information according to the analysis results, so as to identify potential network problems and generate alarm information, and store the analyzed and detected log data in the log database; investigate and locate the potential network problems according to the stored log data; The network scheduling module is configured to schedule and optimize the network according to the troubleshooting results.

4. The eBPF-based network monitoring and diagnostic device according to claim 3, characterized in that: It also includes a data disk building module, which is configured as follows: Based on the TCP layer data, the network address of the client, the operating system type of the client platform, the application version and the network type data are obtained, and according to the network address of the client, the information of the region and operator where the client is located is obtained; Evaluate and analyze the network quality of regions, operators, network types, and client platforms, and build a data dashboard based on the analysis results.

Images