Message detection method and network equipment

Abstract

The invention relates to a message detection method and network equipment. The method comprises the following steps: acquiring reference header information of a to-be-forwarded message, detecting the to-be-forwarded message according to the reference header information and a message forwarding table item, determining a detection result of the to-be-forwarded message, and generating abnormal information of the to-be-forwarded message when the detection result is abnormal; the to-be-forwarded message is obtained by modifying header information of a received initial message by a message repeater in the network equipment; the abnormal information comprises reference header information; according to the method, not only is the detection result that the message to be forwarded is normal or abnormal obtained, but also the abnormal information including the reference header information of the message to be forwarded is generated under the condition that the detection result is abnormal for subsequent abnormal analysis instead of simply and coarsely discarding the message, so that the refined detection of the message is realized, and the detection efficiency is improved. And the comprehensiveness of message detection is improved.

Description

Technical Field

[0001] The present application relates to the technical field of cloud computing, and in particular to a message detection method and a network device. Background Art

[0002] Software Defined Networking (SDN) is a new type of network architecture that separates the control plane from the data plane of the network to flexibly control the transmission of messages in the network.

[0003] In actual applications, the forwarding behaviors of the data plane and the control plane may be inconsistent during the message forwarding process, which may cause network anomalies or failures. In related technologies, network devices (such as gateways and switches) in SDN will detect messages when forwarding messages, obtain detection results, and directly discard messages when the forwarding behaviors of the data plane and the forwarding plane are inconsistent.

[0004] However, the message detection results in the related art are single and less comprehensive. Summary of the invention

[0005] Based on this, it is necessary to provide a message detection method and network device to address the above technical issues.

[0006] In a first aspect, the present application provides a message detection method, which is applied to a data plane manager deployed on a network device, and the method includes:

[0007] Obtaining reference header information of a message to be forwarded; the message to be forwarded is obtained by modifying the header information of an initial message received by a message forwarder in a network device;

[0008] Detecting the message to be forwarded according to the reference header information and the message forwarding table entry, and determining the detection result of the message to be forwarded;

[0009] When the detection result is abnormal, abnormal information of the message to be forwarded is generated; the abnormal information includes reference header information.

[0010] In one of the embodiments, detecting the message to be forwarded according to the reference header information and the message forwarding table entry to determine the detection result of the message to be forwarded includes:

[0011] Determine expected header information of the message to be forwarded according to the message forwarding table entry;

[0012] The detection result of the message to be forwarded is determined according to the reference header information and the expected header information.

[0013] In one of the embodiments, determining the detection result of the message to be forwarded according to the reference header information and the expected header information includes:

[0014] When the reference header information matches the expected header information, determining that the detection result of the message to be forwarded is normal;

[0015] When the reference header information does not match the expected header information, it is determined that the detection result of the message to be forwarded is abnormal.

[0016] In one embodiment, the method further comprises:

[0017] Determine the detection identifier of the message to be forwarded according to the message forwarding table entry;

[0018] The detection identifier and the detection result of the message to be forwarded are sent to the message forwarder; the message forwarder is used to associate the detection identifier of the message to be forwarded with the detection result to obtain a detection completion table.

[0019] In one of the embodiments, before obtaining the reference header information of the message to be forwarded, the method further includes:

[0020] Receive the table entry hit information sent by the message forwarder; the message forwarding table entry includes multiple sub-table entries; the table entry hit information is used to represent the matching status of the initial message and each sub-table entry;

[0021] When the entry hit information indicates that there is a missed sub-entry, determining that the detection result of the message to be forwarded is abnormal;

[0022] When the entry hit information indicates that there is no missed sub-entry, a step of acquiring reference header information of the message to be forwarded is performed.

[0023] In a second aspect, the present application provides a message detection method, which is applied to a message forwarder in a network device, and the method includes:

[0024] Modify the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded;

[0025] A message notification event including the detection identifier is generated according to the received detection identifier of the message to be forwarded; the message notification event is used to instruct the data plane manager deployed in the network device to detect the message to be forwarded according to the reference header information of the message to be forwarded and the message forwarding table entry, determine the detection result of the message to be forwarded, and generate abnormal information of the message to be forwarded when the detection result is abnormal; the abnormal information includes the reference header information.

[0026] In one of the embodiments, the message forwarding table entry includes a plurality of sub-table entries; and modifying the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded includes:

[0027] Determine the entry hit information according to the matching status between the initial message and each sub-entry, and send the entry hit information to the data plane manager;

[0028] When the entry hit information indicates that there is no missed sub-entry, the header information of the initial message is modified according to the entry hit information to obtain a message to be forwarded.

[0029] In one of the embodiments, before generating a message notification event including a detection identifier according to the received detection identifier of the message to be forwarded, the method further includes:

[0030] Determine the detection result of the message to be forwarded according to the detection identifier of the message to be forwarded and the detection completion table; the detection completion table includes different detection identifiers and corresponding detection results;

[0031] In the case that the detection completion table does not include the detection identifier of the message to be forwarded, a step of generating a message notification event including the detection identifier is performed according to the received detection identifier of the message to be forwarded.

[0032] In one embodiment, the method further comprises:

[0033] Receive a detection identifier and a detection result of the message to be forwarded sent by the data plane manager;

[0034] The detection identifier of the message to be forwarded is associated with the detection result to obtain a detection completion table.

[0035] In a third aspect, the present application provides a network device, which includes a data plane manager and a message forwarder. The data plane manager is used to implement the steps of the message detection method applied to the data plane manager, and the message forwarder is used to implement the steps of the message detection method applied to the message forwarder.

[0036] In the above-mentioned message detection method and network device, by obtaining the reference header information of the message to be forwarded, and detecting the message to be forwarded according to the reference header information and the message forwarding table entry, the detection result of the message to be forwarded is determined, so as to generate abnormal information of the message to be forwarded when the detection result is abnormal; the message to be forwarded is obtained after the message forwarder in the network device modifies the header information of the received initial message; the abnormal information includes the reference header information; in the above-mentioned method, not only the detection result of whether the message to be forwarded is normal or abnormal is obtained, but also when the detection result is abnormal, the abnormal information including the reference header information of the message to be forwarded is generated for subsequent abnormal analysis, instead of simply and roughly discarding the message, so as to realize the refined detection of the message and improve the comprehensiveness of the message detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG1 is a schematic diagram of the structure of a network device in one embodiment;

[0038] FIG2 is a schematic diagram of a flow chart of a message detection method in an embodiment;

[0039] FIG3 is a schematic diagram of a process for determining a test result in one embodiment;

[0040] FIG4 is a schematic diagram of a process for determining a test result in another embodiment;

[0041] FIG5 is a schematic diagram of a flow chart of a message detection method in another embodiment;

[0042] FIG6 is a schematic diagram of a flow chart of a message detection method in another embodiment;

[0043] FIG7 is a schematic diagram of a process for determining a detection result in another embodiment;

[0044] FIG8 is a schematic diagram of a process of obtaining a message to be forwarded in one embodiment;

[0045] FIG9 is a schematic diagram of a process for determining a detection result in another embodiment;

[0046] FIG10 is a schematic diagram of a process for obtaining a detection completion table in one embodiment;

[0047] FIG11 is a block diagram of a message detection device according to an embodiment;

[0048] FIG. 12 is a structural block diagram of a message detection device in another embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] The message detection method provided in the embodiment of the present application can be applied to the network device shown in Figure 1. The network device 100 includes a data plane manager 101 deployed on the network device 100, and a message forwarder 102. The data plane manager 101 sends information to the message forwarder 102 through the management channel, and the message forwarder 102 reports information to the data plane manager 101 through the event notification channel.

[0051] The data plane manager 101 is a software component deployed on the gateway device 100, which can also be called a data plane management agent (agent), and is used to implement the management and control of message forwarding. The message forwarder 102 is a programmable forwarding chip set in the network device 100, which is used to implement message forwarding. The data plane manager 101 can pull tenant configurations from the cloud network controller (such as an SDN controller), generate message forwarding table entries, and send them to the message forwarder 102 through the management channel, so that the message forwarder 102 can forward messages according to the message forwarding table entries.

[0052] In practical applications, the network device 100 may be a gateway / centralized gateway or a switch.

[0053] Those skilled in the art will understand that the structure shown in FIG. 1 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0054] In one embodiment, as shown in FIG. 2 , a message detection method is provided, which is described by taking the method applied to a data plane manager deployed on the network device of FIG. 1 as an example, including the following steps:

[0055] S210, obtaining reference header information of a message to be forwarded; the message to be forwarded is sent after the message forwarder in the network device modifies the header information of the received initial message.

[0056] Optionally, after receiving the initial message, the message forwarder in the network device can modify the header information of the initial message based on the message forwarding table entry to obtain the message to be forwarded, and generate a message notification event to instruct the network device to call the data plane manager to obtain the header information of the message to be forwarded as reference header information of the message to be forwarded.

[0057] S220: Detect the message to be forwarded according to the reference header information and the message forwarding table entry, and determine the detection result of the message to be forwarded.

[0058] The detection result of the message to be forwarded is used to indicate whether the forwarding behavior of the message to be forwarded on the data plane and the control plane is consistent. If the detection result of the message to be forwarded is normal, it indicates that the forwarding behavior of the message to be forwarded on the data plane and the control plane is consistent; otherwise, if the detection result of the message to be forwarded is abnormal, it indicates that the forwarding behavior of the message to be forwarded on the data plane and the control plane is inconsistent.

[0059] Optionally, after the network device calls the data plane manager to obtain the header information of the message to be forwarded, it can detect the message to be forwarded through the message forwarding table entry generated based on the tenant configuration and the reference header information of the message to be forwarded to determine the detection result of the message to be forwarded.

[0060] Exemplarily, the network device may call the data plane manager to infer the message forwarding item based on the reference header information of the message to be forwarded, and match the inferred message forwarding item with the message forwarding table item generated based on the tenant configuration, so as to determine the detection result of the message to be forwarded according to the matching result. For example, if the matching result is a successful match, the detection result of the message to be forwarded is determined to be normal; otherwise, if the matching result is a failed match, the detection result of the message to be forwarded is determined to be abnormal.

[0061] It should be noted that after completing the message detection, the network device can call the data plane manager to synchronize the detection result to the message forwarder, so as to instruct the message forwarder to forward or discard the message to be forwarded according to the detection result. In which, if the detection result is normal, the message forwarder can forward the message to be forwarded to the next node; if the detection result is abnormal, the message forwarder discards the message to be forwarded.

[0062] S230. When the detection result is abnormal, generate abnormal information of the message to be forwarded; the abnormal information includes reference header information.

[0063] Optionally, when the detection result of the message to be forwarded is abnormal, the network device may call the data plane manager to generate abnormal information including reference header information of the message to be forwarded, and report the abnormal information to the operation and maintenance control center for subsequent abnormal analysis.

[0064] In an embodiment of the present application, by obtaining reference header information of a message to be forwarded, and detecting the message to be forwarded according to the reference header information and a message forwarding table entry, the detection result of the message to be forwarded is determined, so that when the detection result is abnormal, abnormal information of the message to be forwarded is generated; the message to be forwarded is obtained by modifying the header information of the received initial message by a message forwarder in a network device; the abnormal information includes the reference header information; in the above method, not only the detection result of whether the message to be forwarded is normal or abnormal is obtained, but also when the detection result is abnormal, abnormal information including the reference header information of the message to be forwarded is generated for subsequent abnormal analysis, instead of simply and roughly discarding the message, thereby realizing refined detection of the message and improving the comprehensiveness of the message detection.

[0065] To improve the accuracy of the detection result, in one embodiment, as shown in FIG. 3 , the above S220, detecting the message to be forwarded according to the reference header information and the message forwarding table entry, and determining the detection result of the message to be forwarded, includes:

[0066] S310: Determine expected header information of the message to be forwarded according to the message forwarding table entry.

[0067] Optionally, after invoking the data plane manager to generate a message forwarding table entry based on the tenant configuration sent by the SDN controller, the network device may generate expected header information of the message to be forwarded based on the message forwarding table entry.

[0068] S320: Determine a detection result of the message to be forwarded according to the reference header information and the expected header information.

[0069] Optionally, after obtaining the expected header information of the message to be forwarded, the network device may call the data plane manager to match the expected header information with the reference header information of the message to be forwarded to determine the detection result of the message to be forwarded.

[0070] In an optional embodiment, as shown in FIG. 4 , the above S320, determining the detection result of the message to be forwarded according to the reference header information and the expected header information, includes:

[0071] S410: When the reference header information matches the expected header information, determine that the detection result of the message to be forwarded is normal.

[0072] The reference header information matches the expected header information, indicating that the actual forwarding of the message forwarder matches the forwarding configuration of the data plane manager, that is, the forwarding behaviors of the data plane and the control plane are consistent.

[0073] Optionally, the network device may call the data plane manager to match the expected header information with the reference header information of the message to be forwarded, so as to determine that the detection result of the message to be forwarded is normal when the reference header information matches the expected header information.

[0074] S420: When the reference header information does not match the expected header information, determine that the detection result of the message to be forwarded is abnormal.

[0075] The reference header information does not match the expected header information, indicating that the actual forwarding of the packet forwarder does not match the forwarding configuration of the data plane manager, that is, the forwarding behaviors of the data plane and the control plane are inconsistent.

[0076] Optionally, the network device may call the data plane manager to match the expected header information with the reference header information of the message to be forwarded, so as to determine that the detection result of the message to be forwarded is abnormal when the reference header information does not match the expected header information.

[0077] In an embodiment of the present application, expected header information of a message to be forwarded is determined according to a message forwarding table entry, and a detection result of the message to be forwarded is determined according to reference header information and expected header information. Specifically, when the reference header information matches the expected header information, the detection result of the message to be forwarded is determined to be normal; when the reference header information does not match the expected header information, the detection result of the message to be forwarded is determined to be abnormal. In the above method, the expected header information determined based on the message forwarding table entry can accurately represent the expected forwarding result of the control plane, and the reference header information of the message to be forwarded can accurately represent the actual forwarding result of the data plane. By comparing the expected forwarding result (i.e., the expected header information) with the actual forwarding result (i.e., the reference header information), it can be accurately evaluated whether the forwarding behavior of the message to be forwarded on the data plane and the control plane is consistent, thereby improving the accuracy of the obtained detection result.

[0078] In order to obtain the detection completion table, in one embodiment, as shown in FIG5 , the method further includes:

[0079] S510: Determine a detection identifier of the message to be forwarded according to the message forwarding table entry.

[0080] A group of message forwarding table entries corresponds to a unique detection identifier (Identity document, ID). The data flow corresponding to the same message forwarding table entry includes multiple messages to be forwarded, and these messages to be forwarded correspond to the same detection ID.

[0081] Optionally, the network device may call the data plane manager to generate a detection ID of the message to be forwarded according to the message forwarding table entry, so as to synchronize it to the message forwarder, so that the message forwarder can associate the message to be forwarded with the detection ID.

[0082] S520, sending the detection identifier and the detection result of the message to be forwarded to the message forwarder; the message forwarder is used to associate the detection identifier of the message to be forwarded with the detection result to obtain a detection completion table.

[0083] Among them, the detection completion table is used to record the detection ID of the completed detection and its corresponding detection result.

[0084] Optionally, after obtaining the detection result of the message to be forwarded, the network device can call the data plane manager to send the detection ID and the detection result of the message to be forwarded to the message forwarder. The message forwarder can not only forward or discard the message to be forwarded based on the detection result, but also associate the detection ID of the message to be forwarded with the detection result to obtain a detection completion table.

[0085] It should be noted that, when the detection result of the message to be forwarded is abnormal, the abnormal information may also include the detection identifier and expected header information of the message to be forwarded. Among them, the expected header information can reflect the tenant configuration, and the generated abnormal information includes the detection identifier, reference header information and expected header information of the message to be forwarded, which can be used to quickly locate the corresponding tenant configuration during subsequent abnormal analysis.

[0086] In an embodiment of the present application, the detection identifier of the message to be forwarded is determined according to the message forwarding table entry, and the detection identifier and the detection result of the message to be forwarded are sent to the message forwarder; the message forwarder is used to associate the detection identifier of the message to be forwarded with the detection result to obtain a detection completion table; in the above method, the detection completion table is obtained by feeding back the detection identifier and the detection result of the message to be forwarded, thereby realizing the message detection record and improving the convenience and efficiency of subsequent detection result query.

[0087] Whether the detection result of the message to be forwarded is abnormal can be directly determined based on the table entry hit information reported by the message forwarder. Based on this, in one embodiment, as shown in FIG6 , before obtaining the reference header information of the message to be forwarded in S210, the method further includes:

[0088] S610, receiving table entry hit information sent by a message forwarder; the message forwarding table entry includes multiple sub-table entries; the table entry hit information is used to represent the matching status between the initial message and each sub-table entry.

[0089] Among them, different sub-tables correspond to different routing information. Exemplarily, the message forwarding table includes a sub-table corresponding to a MAC address, a sub-table corresponding to an IP address, and the like. In the case where the network device is a centralized gateway, the message forwarding table includes a sub-table corresponding to the next hop information, and the next hop information may include the destination MAC, the source IP (Source IP, SIP) of the encapsulated virtual eXtensible Local Area Network (VXLAN) tunnel, the destination IP (Destination IP, DIP), and the VXLAN Network Identifier (VNI), and the like.

[0090] Exemplarily, the entry hit information can be represented by an error code. The error code is a digital string of a preset number of digits, the preset number of digits is the number of sub-entries in the message forwarding table entry, each digit in the digital string is 1 or 0, and corresponds to a sub-entry. Among them, 1 indicates that the corresponding sub-entry is hit, and 0 indicates that the corresponding sub-entry is not hit.

[0091] Optionally, after receiving the initial message, the message forwarder may generate an error code based on the matching status between the initial message and each sub-entry in the message forwarding entry, and report the error code as entry hit information to the data plane manager. The data plane manager receives the entry hit information sent by the message forwarder in response.

[0092] S620: When the entry hit information indicates that there is a missed sub-entry, determine that the detection result of the message to be forwarded is abnormal.

[0093] The entry hit information indicates that there is a missed sub-entry, that is, the error code includes 0.

[0094] Optionally, the network device calls the data plane manager to analyze the error code, and when the error code includes 0, determines that the detection result of the message to be forwarded is abnormal.

[0095] S630: When the entry hit information indicates that there is no missed sub-entry, execute the step of obtaining reference header information of the message to be forwarded.

[0096] The entry hit information indicates that there is no missed sub-entry, that is, the error code does not include 0.

[0097] Optionally, the network device calls the data plane manager to analyze the error code, and if the error code does not include 0, executes the step of obtaining reference header information of the message to be forwarded in S210 to continue message detection.

[0098] In an embodiment of the present application, by receiving table item hit information sent by a message forwarder, when the table item hit information indicates that there is a missed sub-table item, it is determined that the detection result of the message to be forwarded is abnormal; when the table item hit information indicates that there is no missed sub-table item, the step of obtaining reference header information of the message to be forwarded is performed; the message forwarding table item includes multiple sub-table items; the table item hit information is used to characterize the matching status of the initial message and each sub-table item; in the above method, the table item hit information can intuitively reflect whether the detection result of the message to be forwarded is abnormal, and the detection result of the message to be forwarded is pre-determined based on the table item hit information, so that the situation where the detection result is abnormal can be conveniently and quickly determined, thereby improving the convenience of detecting abnormal results.

[0099] The embodiment of the present application further provides a message detection method, which is described by taking the method applied to the message forwarder in the network device of FIG. 1 as an example. As shown in FIG. 7 , the method includes the following steps:

[0100] S710: Modify the header information of the received initial message according to the message forwarding table entry to obtain a message to be forwarded.

[0101] Optionally, after receiving the initial message forwarded by the previous node, the message forwarder may modify the header information of the initial message based on the matching status between the message forwarding table entry configured by the network device through the data plane manager and the initial message to obtain the message to be forwarded.

[0102] S720. Generate a message notification event including a detection identifier according to the received detection identifier of the message to be forwarded; the message notification event is used to instruct the data plane manager deployed in the network device to detect the message to be forwarded according to the reference header information of the message to be forwarded and the message forwarding table entry, determine the detection result of the message to be forwarded, and generate abnormal information of the message to be forwarded when the detection result is abnormal; the abnormal information includes the reference header information.

[0103] Optionally, after obtaining the message to be forwarded, the message forwarder generates a message notification event including the detection identifier through the event notification channel based on the received detection identifier of the message to be forwarded, so as to instruct the network device to call the data plane manager to detect the message to be forwarded according to the reference header information of the message to be forwarded and the message forwarding table entry, determine the detection result of the message to be forwarded, and generate abnormal information of the message to be forwarded if the detection result is abnormal; the abnormal information includes the reference header information.

[0104] It should be noted that the network device may call the data plane manager to poll and process the message notification event generated by the event notification channel, so as to completely detect the message to be forwarded corresponding to the detection identifier in the message notification event.

[0105] In an embodiment of the present application, the header information of the received initial message is modified according to the message forwarding table entry to obtain the message to be forwarded, and according to the detection identifier of the received message to be forwarded, a message notification event including the detection identifier is generated; the message notification event is used to instruct the data plane manager deployed in the network device to detect the message to be forwarded according to the reference header information of the message to be forwarded and the message forwarding table entry, determine the detection result of the message to be forwarded, and generate abnormal information of the message to be forwarded when the detection result is abnormal; the abnormal information includes the reference header information; in the above method, not only the detection result of the message to be forwarded is obtained, but also when the detection result is abnormal, the abnormal information including the reference header information of the message to be forwarded is generated for subsequent abnormal analysis, instead of simply and rudely discarding the message, thereby improving the comprehensiveness of the message detection.

[0106] The message forwarding table entry includes a plurality of sub-table entries. Based on this, in one embodiment, as shown in FIG8 , the above S710, modifying the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded, includes:

[0107] S810: Determine entry hit information according to the matching status between the initial message and each sub-entry, and send the entry hit information to the data plane manager.

[0108] Optionally, after receiving the initial message, the message forwarder can read the data information of each sub-item in the corresponding message forwarding table item, and for each sub-item, match the data information of the corresponding sub-item with the sub-item, and determine that the sub-item is hit; otherwise, the data information does not match the sub-item, and determine that the sub-item is not hit. The message forwarder can generate an error code based on the matching status of the initial message and each sub-item, and report the error code as the item hit information to the data plane manager.

[0109] S820 . When the entry hit information indicates that there is no missed sub-entry, modify the header information of the initial message according to the entry hit information to obtain a message to be forwarded.

[0110] The entry hit information indicates that there is no missed sub-entry, that is, the error code does not include 0.

[0111] Optionally, when the message forwarder determines that the entry hit information indicates that there is no missed sub-entry, it may modify the header information of the initial message according to the entry hit information to obtain the message to be forwarded.

[0112] Exemplarily, the message forwarder can determine the hit sub-table entry based on the table entry hit information, and modify the corresponding data information in the header information of the initial message according to each sub-table entry, such as modifying the MAC address, adding a VLAN tag, etc., to obtain the message to be forwarded.

[0113] In an embodiment of the present application, according to the matching status of the initial message and each sub-table item, the table item hit information is determined, and the table item hit information is sent to the data plane manager, so that when the table item hit information indicates that there is no missed sub-table item, the header information of the initial message is modified according to the table item hit information to obtain a message to be forwarded; in the above method, the table item hit information is generated for the data plane manager to pre-judge whether the detection result is abnormal, and when the table item hit information indicates that there is no missed sub-table item, the message to be forwarded is obtained for the data plane manager to judge the detection result, and the path for determining the detection result is expanded to adapt to different matching states, thereby improving the convenience of message detection.

[0114] The message forwarder stores a detection completion table. Based on this, in one embodiment, as shown in FIG. 9 , before generating a message notification event including a detection identifier according to the received detection identifier of the message to be forwarded in S720, the method further includes:

[0115] S910. Determine a detection result of the message to be forwarded according to the detection identifier of the message to be forwarded and a detection completion table; the detection completion table includes different detection identifiers and corresponding detection results.

[0116] Optionally, the message forwarder may query the detection result corresponding to the detection ID in the detection completion table according to the detection ID of the message to be forwarded, and use it as the detection result of the message to be forwarded.

[0117] Exemplarily, the message forwarder may use the detection ID of the message to be forwarded as a key to match the detection ID in the detection completion table, thereby obtaining the detection result of the successfully matched detection ID as the detection result of the message to be forwarded.

[0118] S920: When the detection completion table does not include the detection identifier of the message to be forwarded, a step of generating a message notification event including the detection identifier according to the received detection identifier of the message to be forwarded is performed.

[0119] Optionally, if the message forwarder does not search the detection ID of the message to be forwarded in the detection completion table, it executes the step of generating a message notification event including the detection identifier according to the received detection identifier of the message to be forwarded in S720 to continue message detection.

[0120] In an embodiment of the present application, before generating a message notification event, the detection result of the message to be forwarded is determined based on the detection identifier of the message to be forwarded and the detection completion table; when the detection identifier of the message to be forwarded is not included in the detection completion table, the step of generating a message notification event including the detection identifier is performed based on the received detection identifier of the message to be forwarded; the detection completion table includes different detection identifiers and corresponding detection results; in the above method, the detection result is determined based on the detection completion table to reduce the reporting of message notification events, prevent a large number of repeated message notification events from occurring, which may cause the data plane manager to be overloaded and cause equipment failure, thereby improving the stability of message detection.

[0121] In order to obtain the detection completion table, in one embodiment, as shown in FIG10 , the method further includes:

[0122] S1010: Receive a detection identifier and a detection result of a message to be forwarded sent by a data plane manager.

[0123] Optionally, after the network device calls the data plane manager to obtain the detection result of the message to be forwarded, the detection ID and the detection result of the message to be forwarded can be synchronized to the message forwarder. The message forwarder receives the detection ID and the detection result of the message to be forwarded in response.

[0124] S1020: Associating the detection identifier of the message to be forwarded with the detection result to obtain a detection completion table.

[0125] Optionally, the message forwarder associates the detection ID of the message to be forwarded with the detection result to obtain a detection completion table.

[0126] Exemplarily, the message forwarder may associate the detection ID of the message to be forwarded with the detection result and fill it into a blank table to obtain a detection completion table, and continuously receive the detection ID and detection result of the new message to be forwarded, so as to associate the detection ID of the new message to be forwarded with the detection result and add it to the detection completion table to update the detection completion table. A preset aging time may also be configured for the detection completion table, and the detection result corresponding to each detection ID in the detection completion table may be determined to determine whether the detection result has reached the preset aging time according to the generation time of the detection result, and the corresponding detection ID and its detection result may be deleted from the detection completion table when the preset aging time is reached.

[0127] In an embodiment of the present application, a detection completion table is obtained by receiving the detection identifier and detection result of the message to be forwarded sent by the data plane manager, and associating the detection identifier of the message to be forwarded with the detection result; in the above method, a detection completion table is constructed based on the detection identifier and detection result of the message to be forwarded for subsequent detection result query, which reduces the reporting of message notification events, improves the stability of message detection and improves the efficiency of message detection.

[0128] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0129] In one of the embodiments, the present application also provides a network device, as shown in Figure 1, the network device 100 includes a data plane manager 101 and a message forwarder 102 deployed on the network device 100; the data plane manager 101 is used to implement the steps of the message detection method applied to the data plane manager in the aforementioned embodiment, and the message forwarder 102 is used to implement the steps of the message detection method applied to the message forwarder in the aforementioned embodiment.

[0130] The message detection method implemented by the data plane manager 101 and the message forwarder 102 can be specifically referred to the aforementioned related embodiments, which will not be described in detail here.

[0131] Based on the same inventive concept, the embodiment of the present application also provides a message detection device for implementing the message detection method applied to the data plane manager involved above, and a message detection device for implementing the message detection method applied to the message forwarder involved above. The implementation solutions provided by the above two devices to solve the problem are similar to the implementation solutions recorded in the above methods, so the specific limitations in one or more message detection device embodiments provided below can refer to the limitations on the message detection method in the above text, and will not be repeated here.

[0132] In one embodiment, as shown in FIG. 11 , a message detection device is provided, including: an information acquisition module 1101, a message detection module 1102, and an anomaly generation module 1103, wherein:

[0133] The information acquisition module 1101 is used to obtain reference header information of the message to be forwarded; the message to be forwarded is obtained by modifying the header information of the received initial message by the message forwarder in the network device;

[0134] The message detection module 1102 is used to detect the message to be forwarded according to the reference header information and the message forwarding table entry, and determine the detection result of the message to be forwarded;

[0135] When the detection result is abnormal, the abnormality generating module 1103 generates abnormality information of the message to be forwarded; the abnormality information includes reference header information.

[0136] In one embodiment, as shown in FIG. 12 , a message detection device is provided, including: a message generation module 1201 and an event notification module 1202, wherein:

[0137] The message generation module 1201 is used to modify the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded;

[0138] The event notification module 1202 is used to generate a message notification event including a detection identifier according to the received detection identifier of the message to be forwarded; the message notification event is used to instruct the data plane manager deployed in the network device to detect the message to be forwarded according to the reference header information of the message to be forwarded and the message forwarding table entry, determine the detection result of the message to be forwarded, and generate abnormal information of the message to be forwarded when the detection result is abnormal; the abnormal information includes the reference header information.

[0139] Each module in the above-mentioned message detection device can be implemented in whole or in part by software, hardware and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0140] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned message detection methods are implemented.

[0141] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of any of the above-mentioned message detection methods when executed by a processor.

[0142] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0143] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0144] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A message detection method, characterized in that: Applied to a data plane manager deployed on a network device, the method comprises: Acquire reference header information of a message to be forwarded; the message to be forwarded is obtained by modifying the header information of an initial message received by a message forwarder in the network device; Detecting the message to be forwarded according to the reference header information and the message forwarding table entry, and determining a detection result of the message to be forwarded; When the detection result is abnormal, abnormal information of the message to be forwarded is generated; the abnormal information includes the reference header information.

2. The method according to claim 1, characterized in that The detecting the message to be forwarded according to the reference header information and the message forwarding table entry to determine the detection result of the message to be forwarded includes: Determining expected header information of the message to be forwarded according to the message forwarding table entry; Determine a detection result of the message to be forwarded according to the reference header information and the expected header information.

3. The method according to claim 2, characterized in that The determining, according to the reference header information and the expected header information, a detection result of the message to be forwarded, comprises: In a case where the reference header information matches the expected header information, determining that the detection result of the message to be forwarded is normal; In a case where the reference header information does not match the expected header information, it is determined that the detection result of the message to be forwarded is abnormal.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Determine the detection identifier of the message to be forwarded according to the message forwarding table entry; The detection identifier and the detection result of the message to be forwarded are sent to the message forwarder; the message forwarder is used to associate the detection identifier of the message to be forwarded with the detection result to obtain a detection completion table.

5. The method according to any one of claims 1 to 3, characterized in that: Before obtaining the reference header information of the message to be forwarded, the method further includes: receiving table entry hit information sent by the message forwarder; the message forwarding table entry includes a plurality of sub-table entries; the table entry hit information is used to characterize the matching status between the initial message and each of the sub-table entries; In a case where the entry hit information indicates that there is a missed sub-entry, determining that the detection result of the message to be forwarded is abnormal; In a case where the entry hit information indicates that there is no missed sub-entry, the step of obtaining the reference header information of the message to be forwarded is performed.

6. A message detection method, characterized in that: A message forwarder applied to a network device, the method comprising: Modify the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded; According to the received detection identifier of the message to be forwarded, a message notification event including the detection identifier is generated; the message notification event is used to instruct the data plane manager deployed in the network device to detect the message to be forwarded according to the reference header information of the message to be forwarded and the message forwarding table entry, determine the detection result of the message to be forwarded, and generate abnormal information of the message to be forwarded when the detection result is abnormal; the abnormal information includes the reference header information.

7. The method according to claim 6, characterized in that The message forwarding table entry includes a plurality of sub-table entries; the step of modifying the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded includes: Determining table entry hit information according to a matching status between the initial message and each of the sub-table entries, and sending the table entry hit information to the data plane manager; In a case where the entry hit information indicates that there is no missed sub-entry, the header information of the initial message is modified according to the entry hit information to obtain the message to be forwarded.

8. The method according to claim 6 or 7, characterized in that: Before generating a message notification event including the detection identifier according to the received detection identifier of the message to be forwarded, the method further includes: Determine the detection result of the message to be forwarded according to the detection identifier of the message to be forwarded and the detection completion table; the detection completion table includes different detection identifiers and corresponding detection results; In the case that the detection completion table does not include the detection identifier of the message to be forwarded, the step of generating a message notification event including the detection identifier according to the received detection identifier of the message to be forwarded is performed.

9. The method according to claim 6 or 7, characterized in that: The method further comprises: Receiving a detection identifier and a detection result of the message to be forwarded sent by the data plane manager; The detection identifier of the message to be forwarded is associated with the detection result to obtain a detection completion table.

10. A network device, characterized in that: The network device includes a data plane manager and a packet forwarder, the data plane manager is used to implement the steps of the method in any one of claims 1 to 5, and the packet forwarder is used to implement the steps of the method in any one of claims 6 to 9.

Images