A LAN loop fast detection positioning system

Abstract

A LAN loop rapid detection positioning system, comprising a loop detection engine, an alarm module, an application module, a database, a data analysis module and a data acquisition module; the data acquisition module is deployed in the LAN, collects the port flow, mac address and LDT information of the switch in the LAN, the original data is standardized and analyzed by the data analysis module and stored into the database, the database uploads the data to the loop detection engine for further analysis through the switch; the loop detection engine deeply analyzes and detects the collected and analyzed data of the switch, finally judges whether there is a loop in the network, when the loop is detected, the alarm module alarms and notifies, and the network state is displayed through the application module. The application can monitor the network state in real time, accurately identify the loop fault in the LAN, and timely notify the operation and maintenance personnel through the alarm mechanism. Through the system, the operation and maintenance personnel can quickly locate the fault point, greatly shortening the fault troubleshooting time.

Description

Technical Field

[0001] This invention relates to the field of network management and maintenance technology, and specifically to a local area network (LAN) loop rapid detection and location system. Background Technology

[0002] As local area networks (LANs) continue to expand in size and complexity, the number of network devices and connection nodes has increased dramatically, leading to a significant increase in the probability of network loop problems. A network loop refers to the repeated transmission of the same data frame within the LAN, resulting in excessive consumption of network bandwidth, increased device load, and even serious faults such as broadcast storms and network congestion, directly affecting the normal operation of services and network stability.

[0003] Traditional loop detection methods often rely on manual troubleshooting or simple network protocols, resulting in low efficiency and difficulty in accurately locating loops in complex network environments, leading to lengthy troubleshooting times. There is an urgent need for an automated and intelligent loop detection system capable of real-time network status monitoring, accurate identification, and rapid location of loop problems, thereby improving network operation and maintenance efficiency, reducing network downtime, and ensuring efficient network operation. Summary of the Invention

[0004] To address the technical problems of slow and inefficient loop fault location and detection in existing networks, this technical solution provides a rapid loop detection and location system for local area networks (LANs). This system integrates a loop detection engine, an alarm module, an application module, a database, a data analysis module, and a data acquisition module. Through automated data acquisition, intelligent analysis and processing, and the collaborative work of multiple detection algorithms, it can monitor network status in real time, accurately identify loop faults in the LAN, and promptly notify maintenance personnel through an alarm mechanism. This system enables maintenance personnel to quickly locate fault points, significantly shortening troubleshooting time, improving network availability and stability, and ensuring the normal operation of services; effectively solving the aforementioned problems.

[0005] This invention is achieved through the following technical solution:

[0006] A local area network (LAN) loop rapid detection and location system includes a loop detection engine, an alarm module, an application module, a database, a data analysis module, and a data acquisition module. The data acquisition module is deployed within the LAN, collecting switch port traffic, MAC address tables, and Link Discovery Protocol (LDT) information. This data is then transmitted to the data analysis module, which performs standardized analysis on the raw data and stores it in the database. The loop detection engine, as the core component, performs in-depth analysis and detection of the network data stored in the database to determine whether a loop fault exists in the LAN. When a loop fault is detected, the alarm module issues an alarm notification, and the application module displays the network status.

[0007] Furthermore, the data analysis module uses hash mapping to store the hash values ​​of data fields such as switch port traffic, MAC address table, and Link Discovery Protocol (LDT) information collected by the data acquisition module as keys, quickly finding and removing duplicate data. At the same time, the data analysis module sets threshold range detection, defines a reasonable traffic range or packet loss rate, and data exceeding the range is considered abnormal and marked or removed. In addition, the data analysis module performs normalization processing on the collected raw data.

[0008] Furthermore, the specific operation method of the data analysis module in standardizing the collected raw data is as follows: First, redundant, duplicate, and abnormal data are removed through data cleaning, and missing data is corrected or supplemented; then, data from different sources are standardized according to timestamps, units, and field names; at the same time, the data analysis module performs consistency, integrity, and logical checks; the processed data is stored in the database, and after index optimization and partition management, it is convenient for subsequent efficient querying and in-depth analysis.

[0009] Furthermore, the data analysis module needs to define a mapping table to standardize the data, mapping the data units and formats of different devices to a unified standard, and using regular expressions to verify the consistency of MAC addresses and other data formats. Finally, the data analysis module uses a B-tree index to index the timestamp, device ID, and port ID fields, and partitions the database table by time period to improve query efficiency.

[0010] Furthermore, the loop detection engine performs loop detection through the coordinated operation of traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring. First, traffic anomaly analysis identifies abnormally large increases in traffic by monitoring changes in switch ports, initially marking potential loop risks. Then, CPCAR packet loss analysis performs in-depth comparison of packet loss data at the control plane rate limit of the ports to detect whether packet loss exceeds the normal range, and further confirms loop risks when packet loss is too large. Simultaneously, MAC address drift monitoring analyzes frequent changes or drifts in MAC addresses in network devices. Finally, LDT loop monitoring continuously monitors link discovery protocol data to detect new loop information in core devices, further confirming the existence of loops.

[0011] Furthermore, the traffic anomaly analysis involves monitoring the traffic changes of the switch ports, collecting incoming and outgoing traffic data, calculating the increase in traffic using a sliding window, identifying abnormally large increases in traffic, marking potential loop risks, setting a reasonable traffic threshold, and marking potential loop risks when the traffic exceeds this threshold.

[0012] Furthermore, the CPCAR packet loss analysis obtains packet loss data through the `display cpu-defend arp-requeststatistics` command, and performs an in-depth comparison between the CPCAR (Control Plane Rate Limiting) packet loss data (Drop(Packets)) of the port and the preset value to detect whether the packet loss exceeds the normal range. If the packet loss is too large, the loop risk is further confirmed.

[0013] Furthermore, the MAC address drift monitoring is performed by monitoring the switch trap logs for MAC address drift. Once the MAC_FLAPPING_ALARM log type is detected, it indicates that the MAC address in the network device is frequently changing or drifting, which is one of the key signals that loops cause path confusion.

[0014] Furthermore, the application module provides a graphical interface that displays network status and loop detection results. Through this interface, network administrators can view key information about network status and loop detection results, enabling them to have a comprehensive understanding of the network's health status. At the same time, the application module also supports troubleshooting and performance tuning functions, helping network administrators to better manage and maintain the local area network environment.

[0015] Furthermore, when the loop detection engine detects a loop, the alarm module immediately triggers and sends an alarm notification to the network administrator through various means, including system pop-ups. This feature ensures that the network administrator can promptly understand changes in network status and take appropriate measures to resolve the problem.

[0016] Furthermore, the database storage system collects, analyzes, and detects all data generated during the process.

[0017] Furthermore, the operation steps of the detection and positioning system include:

[0018] Step 1: The data acquisition module establishes a connection with the network device via SSH to collect port traffic, CPCAR packet loss data, MAC address drift information, and LDT loop information in real time. After preliminary processing, the collected data is transmitted to the data analysis module for further analysis and stored in the database to ensure the integrity and accuracy of the data.

[0019] Step 2: The loop detection engine reads port traffic data from the database and continuously monitors traffic changes. If it detects an abnormal increase in traffic on a port that exceeds the normal range, it temporarily marks the device as having excessive traffic, indicating a loop risk.

[0020] Step 3: After detecting abnormal traffic, the loop detection engine further compares and analyzes the CPCAR packet loss data of the port; by calculating the difference between the CPCAR packet loss data and the normal packet loss data, the absolute value is taken; if the difference exceeds the preset threshold, it is further confirmed that the device has excessive packet loss, which increases the risk of loop.

[0021] Step 4: The loop detection engine simultaneously searches the device's syslog logs, focusing on monitoring for log information related to MAC address drift. If it finds that the MAC address frequently drifts between different ports, it confirms that the device has a loop problem and marks the device.

[0022] Step 5: The loop detection engine continuously monitors the LDT link discovery protocol data of the core device and analyzes loop topology changes in real time. If the LDT detects new loop information, the system immediately marks the device as having a loop and further verifies the loop problem. Beneficial effects

[0023] The local area network loop rapid detection and location system proposed in this invention has the following advantages compared with the prior art:

[0024] This invention integrates a loop detection engine, an alarm module, an application module, a database, a data analysis module, and a data acquisition module. Through automated data acquisition, intelligent analysis and processing, and the collaborative work of multiple detection algorithms, it can monitor network status in real time, accurately identify loop faults in the local area network (LAN), and promptly notify maintenance personnel through an alarm mechanism. This system enables maintenance personnel to quickly locate fault points, significantly shortening troubleshooting time, improving network availability and stability, and ensuring the normal operation of services. It aims to quickly locate network loop faults in LAN service scenarios, allowing maintenance personnel to rapidly pinpoint the fault point, reduce troubleshooting time, and improve network availability and stability.

[0025] In this invention, the loop detection engine performs loop detection through the collaborative work of traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring. Through traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring, it can detect loop problems in the local area network in real time and accurately, and quickly locate faulty devices or ports, significantly reducing troubleshooting time.

[0026] In this invention, the data analysis module comprehensively judges multiple indicators such as traffic, packet loss, and MAC address changes, avoiding false alarms or missed alarms caused by a single factor. The multi-dimensional data analysis and detection methods work together to effectively improve the accuracy and sensitivity of detection.

[0027] The alarm module in this invention is configured to send immediate alerts to network administrators via various methods (such as desktop pop-ups, SMS, and email) once a loop problem is detected, ensuring that the problem is addressed promptly and preventing network outages and business losses. The system is highly automated, capable of continuously monitoring network status in real time. It can automatically detect and alert on loop problems without manual intervention, significantly improving network operation and maintenance efficiency and reducing the risk of errors from manual operation.

[0028] The application module settings in this invention allow maintenance personnel to intuitively view network status, fault information, and loop detection results through the graphical interface of the application module, which improves the convenience of network management and user experience, and helps to optimize network performance and quickly troubleshoot faults.

[0029] This invention enables loop problems in local area networks to be quickly identified and resolved at an early stage, preventing loops from causing wider network paralysis, significantly improving the overall availability and stability of the network, and ensuring the normal operation of network services. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the overall architecture of the present invention. Detailed Implementation

[0031] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. The described embodiments are merely some embodiments of the present invention, and not all embodiments. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the design concept of the present invention should fall within the protection scope of the present invention. Example

[0032] like Figure 1 As shown, a local area network (LAN) loop rapid detection and location system includes a loop detection engine, an alarm module, an application module, a database, a data analysis module, and a data acquisition module. The data acquisition module is deployed within the LAN, collecting switch port traffic, MAC address tables, and Link Discovery Protocol (LDT) information. This data is then transmitted to the data analysis module, which performs standardized analysis on the raw data and stores it in the database. The loop detection engine, as the core component, performs in-depth analysis and detection of the network data stored in the database to determine whether a loop fault exists in the LAN. When a loop fault is detected, the alarm module issues an alarm notification, and the application module displays the network status.

[0033] The data acquisition module's main function is to collect port traffic information, MAC address table data, and key network status indicators such as Link Discovery Protocol (LDT) from these network devices in real time and accurately. Deployed within the local area network, it is responsible for collecting port traffic, MAC addresses, and LDT information from network devices in real time. By continuously monitoring and recording this data, the data acquisition module provides a solid data foundation for subsequent system analysis and testing.

[0034] The data acquisition module obtains raw data, including switch port traffic, MAC address table, Link Discovery Protocol (LDT) information, and transmits the data to the data analysis module.

[0035] The data analysis module uses hash mapping to store the hash values ​​of data fields (switch port traffic collected by the data acquisition module, MAC address table, Link Discovery Protocol (LDT) information, quarterly device ID, port ID, and timestamp) as keys, enabling quick identification and removal of duplicate data. Simultaneously, the module sets threshold range detection, defining reasonable traffic intervals or packet loss rates; data exceeding these ranges is considered abnormal and marked or removed. Furthermore, the module normalizes the collected raw data, defining a mapping table to map data units and formats from different devices to a unified standard. Regular expressions are used to verify the consistency of MAC addresses and other data formats. Finally, the module uses a B-tree index to index fields such as timestamps, device IDs, and port IDs, partitioning the database table by time period to improve query efficiency.

[0036] The data analysis module performs the following operations to standardize the collected raw data: First, it cleanses the data to remove redundant, duplicate, and abnormal data, and corrects or completes missing data. Next, it standardizes the data from different sources according to timestamps, units, and field names. At the same time, the data analysis module performs consistency, integrity, and logical checks. The processed data is stored in the database, and after index optimization and partition management, it facilitates efficient subsequent queries and in-depth analysis.

[0037] The data analysis module standardizes the data by defining a mapping table to map the data units and formats of different devices to a unified standard, and uses regular expressions to verify the consistency of MAC addresses and other data formats. Finally, the data analysis module uses a B-tree index to index the timestamp, device ID, and port ID fields, and partitions the database table by time period to improve query efficiency.

[0038] Database: Stores all data generated during the system's acquisition, analysis, and detection processes.

[0039] Loop Detection Engine: As a core component, it is specifically responsible for in-depth analysis of network data stored in the database to determine whether loop faults exist in the local area network. This engine ensures efficient and accurate loop detection through the collaborative work of multiple detection algorithms. Specifically, it performs loop detection through the coordinated operation of traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring; ensuring efficient and accurate loop detection.

[0040] The collaborative operation mode of the traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring is as follows:

[0041] First, traffic anomaly analysis identifies situations with abnormally large increases in traffic by monitoring changes in switch ports, and initially marks potential loop risks. Specifically, it monitors switch port traffic, collects incoming and outgoing traffic data, calculates the increase in traffic using a sliding window, identifies situations with abnormally large increases in traffic, marks potential loop risks, and sets a reasonable traffic threshold (1000). Traffic exceeding this threshold is marked as a potential loop risk.

[0042] Then, CPCAR packet loss analysis performs an in-depth comparison of the port's control plane rate limit packet loss data to detect whether the packet loss exceeds the normal range. If the packet loss is too large, it further confirms the risk of loops. Specifically, it obtains packet loss data through the command `display cpu-defend arp-request statistics`, performs an in-depth comparison of the port's CPCAR (control plane rate limit) packet loss data (Drop(Packets)) with the preset value, detects whether the packet loss exceeds the normal range, and further confirms the risk of loops if the packet loss is too large.

[0043] At the same time, MAC address drift monitoring and analysis is used to detect frequent changes or drifts in MAC addresses in network devices. Specifically, by monitoring MAC address drift in switch trap logs, if the MAC_FLAPPING_ALARM log type is found, it indicates that the MAC addresses in the network devices are frequently changing or drifting. This is one of the key signals that loops cause path confusion.

[0044] Finally, LDT loop monitoring continuously monitors Link Discovery Protocol (LDT) data to detect new loop information in core devices, further confirming the existence of loops and ultimately determining the loop status.

[0045] Alarm Module: When the loop detection engine detects a loop, the alarm module is immediately triggered, sending alarm notifications to the network administrator through various means, including system pop-ups. This feature ensures that network administrators can promptly understand changes in network status and take appropriate measures to resolve the problem.

[0046] Application Module: Provides a graphical interface that displays network status and loop detection results. It acts as a bridge between the system and the user, offering an intuitive and easy-to-use graphical interface. Through this interface, network administrators can view key information about network status and loop detection results, achieving a comprehensive understanding of network health. Simultaneously, the application module also supports troubleshooting and performance tuning functions, helping network administrators better manage and maintain the local area network environment.

[0047] The operation steps of the detection and positioning system include:

[0048] Step 1: The data acquisition module establishes a connection with the network device via SSH to collect port traffic, CPCAR packet loss data, MAC address drift information, and LDT loop information in real time. After preliminary processing, the collected data is transmitted to the data analysis module for further analysis and stored in the database to ensure the integrity and accuracy of the data.

[0049] Step 2: The loop detection engine reads port traffic data from the database and continuously monitors traffic changes. If it detects an abnormal increase in traffic on a port that exceeds the normal range, it temporarily marks the device as having excessive traffic, indicating a loop risk.

[0050] Step 3: After detecting abnormal traffic, the loop detection engine further compares and analyzes the CPCAR packet loss data of the port; by calculating the difference between the CPCAR packet loss data and the normal packet loss data, the absolute value is taken; if the difference exceeds the preset threshold, it is further confirmed that the device has excessive packet loss, which increases the risk of loop.

[0051] Step 4: The loop detection engine simultaneously searches the device's syslog logs, focusing on monitoring for log information related to MAC address drift. If it finds that the MAC address frequently drifts between different ports, it confirms that the device has a loop problem and marks the device.

[0052] Step 5: The loop detection engine continuously monitors the LDT link discovery protocol data of the core device and analyzes loop topology changes in real time. If the LDT detects new loop information, the system immediately marks the device as having a loop and further verifies the loop problem.

[0053] The specific operation methods of the detection and positioning system include:

[0054] Step A: The operations and maintenance personnel deploy data acquisition modules on key network nodes within the local area network to ensure that the modules can cover all core devices and ports, and monitor the network device traffic, MAC address table and link status in real time.

[0055] Step B: The data acquisition module establishes a secure connection with the switch via the SSH protocol, periodically collects indicators such as port traffic, MAC address table, CPCAR packet loss rate, and LDT loop information, and efficiently and accurately transmits this data to the data analysis module to ensure real-time information synchronization.

[0056] Step C: After receiving the collected raw data, the data analysis module performs data cleaning, format standardization, and anomaly filtering according to predefined rules. The processed data is then stored in the database using an optimized storage strategy, providing a clear and structured analytical foundation for subsequent loop detection.

[0057] Step D: The loop detection engine extracts the latest network data from the database and performs deep correlation analysis on the data using multiple algorithms, including traffic anomaly analysis, CPCAR packet loss monitoring, MAC address drift detection, and LDT loop monitoring, to determine whether a loop exists. Once a loop is detected, the alarm module is immediately triggered.

[0058] Step E: After confirming a loop problem, the alarm module promptly sends an alarm notification to the network administrator. The alarm is presented in multiple ways, including desktop pop-ups, SMS, or email notifications, ensuring that the administrator can respond quickly and take appropriate action.

[0059] Step F: The application module displays the loop detection results and network status in an intuitive way through charts, topology diagrams, etc., providing real-time network health monitoring, fault location, and detailed loop analysis reports to help administrators quickly troubleshoot problems and optimize the network.

[0060] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent changes or modifications made in accordance with the spirit and essence of the present invention should be covered by the present invention.

Claims

1. A local area network loop rapid detection and positioning system, characterized in that: It includes a loop detection engine, an alarm module, an application module, a database, a data analysis module, and a data acquisition module. The data acquisition module is deployed in the local area network to collect switch port traffic, MAC address table, and Link Discovery Protocol (LDT) information, and transmits the data to the data analysis module. The data analysis module performs standardized analysis on the raw data and stores it in the database. The loop detection engine is the core component, performing deep analysis and detection of network data stored in the database to determine whether loop faults exist in the local area network. The loop detection engine performs loop detection through the collaborative work of traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring. The operation mode of the collaborative work of traffic anomaly analysis, CPCAR packet loss analysis, MAC address drift monitoring, and LDT loop monitoring is as follows: First, traffic anomaly analysis identifies situations with abnormally large increases in traffic by monitoring changes in switch ports, and initially marks potential loop risks. Specifically, it monitors switch port traffic, collects incoming and outgoing traffic data, calculates the increase in traffic using a sliding window, identifies situations with abnormally large increases in traffic, marks potential loop risks, sets a reasonable traffic threshold, and marks potential loop risks when the traffic exceeds this threshold. Then, CPCAR packet loss analysis performs an in-depth comparison of the port's control plane rate limit packet loss data to detect whether the packet loss exceeds the normal range. If the packet loss is too large, it further confirms the risk of loops. Specifically, it obtains packet loss data through the command `display cpu-defendarp-request statistics`, performs an in-depth comparison of the port's CPCAR control plane rate limit packet loss data (Drop) with the preset value, detects whether the packet loss exceeds the normal range, and further confirms the risk of loops if the packet loss is too large. At the same time, MAC address drift monitoring and analysis is used to detect frequent changes or drifts in MAC addresses in network devices. Specifically, by monitoring MAC address drift in switch trap logs, if the MAC_FLAPPING_ALARM log type is found, it indicates that the MAC addresses in the network devices are frequently changing or drifting. Finally, LDT loop monitoring continuously monitors the LDT data to detect new loop information in core devices, further confirms whether a loop exists, and ultimately determines the loop situation. When a loop fault is detected, the alarm module issues an alarm notification, and the application module displays the network status.

2. The local area network loop rapid detection and positioning system according to claim 1, characterized in that: The data analysis module uses hash mapping to store the hash values ​​of data fields such as switch port traffic, MAC address table, and Link Discovery Protocol (LDT) information collected by the data acquisition module as keys, quickly finding and removing duplicate data. At the same time, the data analysis module sets threshold range detection, defines a reasonable traffic range or packet loss rate, and data exceeding the range is considered abnormal and marked or removed. In addition, the data analysis module performs normalization processing on the collected raw data.

3. The local area network loop rapid detection and positioning system according to claim 2, characterized in that: The data analysis module performs the following operations to standardize the collected raw data: First, it cleans the data to remove redundant, duplicate, and abnormal data, and corrects or completes missing data; then, it standardizes the data from different sources according to timestamps, units, and field names. Meanwhile, the data analysis module performs consistency, integrity, and logical checks; the processed data is stored in the database, and after index optimization and partition management, it facilitates subsequent efficient queries and in-depth analysis.

4. The local area network loop rapid detection and positioning system according to claim 3, characterized in that: The data analysis module needs to define a mapping table to standardize the data, mapping the data units and formats of different devices to a unified standard, and using regular expressions to verify the consistency of MAC addresses and other data formats. Finally, the data analysis module uses B-tree indexes to index the timestamp, device ID, and port ID fields, and partitions the database table by time period to improve query efficiency.

5. A local area network loop rapid detection and positioning system according to claim 1, characterized in that: The application module provides a graphical interface that displays network status and loop detection results. Through this interface, network administrators can view key information about network status and loop detection results, gaining a comprehensive understanding of the network's health status. Simultaneously, the application module also supports troubleshooting and performance tuning functions, helping network administrators better manage and maintain the local area network environment.

6. A local area network loop rapid detection and positioning system according to any one of claims 1-5, characterized in that: The operation steps of the detection and positioning system include: Step 1: The data acquisition module establishes a connection with the network device via SSH to collect port traffic, CPCAR packet loss data, MAC address drift information, and LDT loop information in real time. After preliminary processing, the collected data is transmitted to the data analysis module for further analysis and stored in the database to ensure the integrity and accuracy of the data. Step 2: The loop detection engine reads port traffic data from the database and continuously monitors traffic changes. If it detects an abnormal increase in traffic on a port that exceeds the normal range, it temporarily marks the device as having excessive traffic, indicating a loop risk. Step 3: After detecting abnormal traffic, the loop detection engine further compares and analyzes the CPCAR packet loss data of the port; by calculating the difference between the CPCAR packet loss data and the normal packet loss data, the absolute value is taken; if the difference exceeds the preset threshold, it is further confirmed that the device has excessive packet loss, which increases the risk of loop. Step 4: The loop detection engine simultaneously searches the device's syslog logs, focusing on monitoring for log information related to MAC address drift. If it finds that the MAC address frequently drifts between different ports, it confirms that the device has a loop problem and marks the device. Step 5: The loop detection engine continuously monitors the LDT link discovery protocol data of the core device and analyzes loop topology changes in real time. If the LDT detects new loop information, the system immediately marks the device as having a loop and further verifies the loop problem.

Images