Packet detection method and network device

Abstract

The application relates to a message detection method and network equipment. The method comprises the following steps: obtaining reference header information of a to-be-transferred message, detecting the to-be-transferred message according to the reference header information and a message transfer table item, determining a detection result of the to-be-transferred message, and generating abnormal information of the to-be-transferred message in the case that the detection result is abnormal; the to-be-transferred message is obtained by modifying header information of an initial message received by a message transfer device in the network equipment; the abnormal information comprises the reference header information; in the above method, not only is the detection result that the to-be-transferred message is normal or abnormal obtained, but also abnormal information including the reference header information of the to-be-transferred message is generated in the case that the detection result is abnormal, so that subsequent abnormal analysis is provided, instead of simply and roughly discarding the message, fine detection of the message is realized, and the comprehensiveness of message detection is improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a message detection method and network device. Background Technology

[0002] Software-defined networking (SDN) is a new type of network architecture that separates the control plane from the data plane to flexibly control the transmission of packets in the network.

[0003] In practical applications, inconsistencies may arise between the forwarding behaviors of the data plane and the control plane during packet forwarding, potentially leading to network anomalies or failures. In related technologies, network devices in SDN (such as gateways and switches) inspect packets during forwarding, obtain the inspection results, and discard packets directly if the forwarding behaviors of the data plane and the control plane are inconsistent.

[0004] However, the message detection results in the relevant technologies are singular and lack comprehensiveness. Summary of the Invention

[0005] Therefore, it is necessary to provide a message detection method and network device to address the aforementioned technical problems.

[0006] Firstly, this application provides a message detection method applied to a data plane manager deployed on a network device. The method includes:

[0007] Obtain the reference header information of the message to be forwarded; the message to be forwarded is obtained by the message forwarder in the network device after modifying the header information of the received initial message;

[0008] The message to be forwarded is detected based on the reference header information and message forwarding entries to determine the detection result of the message to be forwarded;

[0009] If the detection result is abnormal, an abnormal message is generated for the message to be forwarded; the abnormal message includes reference header information.

[0010] In one embodiment, the message to be forwarded is detected based on the reference header information and message forwarding table entries to determine the detection result of the message to be forwarded, including:

[0011] Determine the expected header information of the message to be forwarded based on the message forwarding table items;

[0012] Based on the reference header information and the expected header information, determine the detection result of the message to be forwarded.

[0013] In one embodiment, the detection result of the message to be forwarded is determined based on the reference header information and the expected header information, including:

[0014] If the reference header information matches the expected header information, the detection result of the message to be forwarded is determined to be normal.

[0015] If the reference header information does not match the expected header information, the detection result of the message to be forwarded is determined to be abnormal.

[0016] In one embodiment, the method further includes:

[0017] The detection identifier of the message to be forwarded is determined based on the message forwarding table entries;

[0018] The detection identifier and detection result of the message to be forwarded are sent to the message forwarder; the message forwarder is used to associate the detection identifier and detection result of the message to be forwarded to obtain the detection completion table.

[0019] In one embodiment, before obtaining the reference header information of the message to be forwarded, the method further includes:

[0020] Receive entry hit information sent by the message forwarder; a message forwarding table entry includes multiple sub-entries; the entry hit information is used to characterize the matching status between the initial message and each sub-entry;

[0021] If the table entry hit information indicates that there are missing sub-table entries, the detection result of the message to be forwarded is determined to be abnormal;

[0022] If the table entry hit information indicates that there are no missing sub-table entries, the step of obtaining the reference header information of the message to be forwarded is executed.

[0023] Secondly, this application provides a packet detection method applied to a packet forwarder in a network device, the method comprising:

[0024] Modify the header information of the received initial message according to the message forwarding table entries to obtain the message to be forwarded;

[0025] Based on the detection identifier of the received packet to be forwarded, a packet notification event including the detection identifier is generated. The packet notification event is used to instruct the data plane manager deployed in the network device to detect the packet to be forwarded based on the reference header information and packet forwarding table entries of the packet to be forwarded, determine the detection result of the packet to be forwarded, and generate an error message for the packet to be forwarded if the detection result is abnormal. The error message includes the reference header information.

[0026] In one embodiment, the message forwarding table entry includes multiple sub-table entries; the header information of the received initial message is modified according to the message forwarding table entry to obtain the message to be forwarded, including:

[0027] Based on the matching status of the initial message and each sub-entry, determine the entry hit information and send the entry hit information to the data plane manager;

[0028] If the table entry hit information indicates that there are no missing sub-table entries, the header information of the initial message is modified according to the table entry hit information to obtain the message to be forwarded.

[0029] In one embodiment, before generating a message notification event including the detection identifier based on the detection identifier of the received message to be forwarded, the method further includes:

[0030] Based on the detection identifier of the message to be forwarded and the detection completion table, determine the detection result of the message to be forwarded; the detection completion table includes different detection identifiers and their corresponding detection results;

[0031] If the detection identifier of the message to be forwarded is not included in the detection completion table, the step of generating a message notification event including the detection identifier is performed based on the detection identifier of the received message to be forwarded.

[0032] In one embodiment, the method further includes:

[0033] Receive the detection identifier and detection result of the message to be forwarded sent by the data plane manager;

[0034] The detection identifier of the message to be forwarded is associated with the detection result to obtain the detection completion table.

[0035] Thirdly, this application provides a network device, which includes a data plane manager and a packet forwarder. The data plane manager is used to implement the steps of the packet detection method applied to the data plane manager described above, and the packet forwarder is used to implement the steps of the packet detection method applied to the packet forwarder described above.

[0036] In the aforementioned message detection method and network device, reference header information of the message to be forwarded is obtained, and the message to be forwarded is detected based on the reference header information and message forwarding table entries to determine the detection result of the message to be forwarded. In the case of an abnormal detection result, abnormal information of the message to be forwarded is generated. The message to be forwarded is obtained by the message forwarder in the network device after modifying the header information of the received initial message. The abnormal information includes the reference header information. In the above method, not only is the detection result of whether the message to be forwarded is normal or abnormal obtained, but also, in the case of an abnormal detection result, abnormal information including the reference header information of the message to be forwarded is generated for subsequent abnormal analysis, instead of simply and crudely discarding the message. This achieves refined detection of messages and improves the comprehensiveness of message detection. Attached Figure Description

[0037] Figure 1This is a schematic diagram of the structure of a network device in one embodiment;

[0038] Figure 2 This is a flowchart illustrating a message detection method in one embodiment;

[0039] Figure 3 This is a flowchart illustrating the process of determining the detection result in one embodiment;

[0040] Figure 4 This is a flowchart illustrating the process of determining the detection result in another embodiment;

[0041] Figure 5 This is a flowchart illustrating the message detection method in another embodiment;

[0042] Figure 6 This is a flowchart illustrating the message detection method in another embodiment;

[0043] Figure 7 This is a flowchart illustrating the process of determining the detection result in another embodiment;

[0044] Figure 8 This is a schematic diagram illustrating the process of obtaining a message to be forwarded in one embodiment;

[0045] Figure 9 This is a flowchart illustrating the process of determining the detection result in another embodiment;

[0046] Figure 10 This is a flowchart illustrating the process of obtaining the detection completion table in one embodiment;

[0047] Figure 11 This is a structural block diagram of a message detection device in one embodiment;

[0048] Figure 12 This is a structural block diagram of a message detection device in another embodiment. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0050] The message detection method provided in this application embodiment can be applied to, for example, Figure 1 The network device shown includes a data plane manager 101 and a packet forwarder 102 deployed on the network device 100. The data plane manager 101 sends information to the packet forwarder 102 through a management channel, and the packet forwarder 102 reports information to the data plane manager 101 through an event notification channel.

[0051] The data plane manager 101 is a software component deployed on the gateway device 100, also known as a data plane management agent, used to manage and control packet forwarding. The packet forwarder 102 is a programmable forwarding chip located in the network device 100, used to implement packet forwarding. The data plane manager 101 can pull tenant configurations from the cloud network controller (such as an SDN controller), generate packet forwarding table entries, and distribute them to the packet forwarder 102 through the management channel, so that the packet forwarder 102 can forward packets according to the packet forwarding table entries.

[0052] In practical applications, the aforementioned network device 100 can be a gateway / centralized gateway or a switch.

[0053] Those skilled in the art will understand that Figure 1 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0054] In one embodiment, such as Figure 2 As shown, a message detection method is provided, which is applied to... Figure 1 Taking the data plane manager deployed on a network device as an example, the following steps are included:

[0055] S210. Obtain the reference header information of the message to be forwarded; the message to be forwarded is sent by the message forwarder in the network device after modifying the header information of the received initial message.

[0056] Optionally, after receiving the initial packet, the packet forwarder in the network device can modify the header information of the initial packet based on the packet forwarding table entry to obtain the packet to be forwarded, and generate a packet notification event to instruct the network device to call the data plane manager to obtain the header information of the packet to be forwarded as the reference header information of the packet to be forwarded.

[0057] S220. Based on the reference header information and message forwarding table entries, detect the message to be forwarded and determine the detection result of the message to be forwarded.

[0058] The detection result of the message to be forwarded is used to characterize whether the forwarding behavior of the message to be forwarded is consistent in the data plane and the control plane. If the detection result of the message to be forwarded is normal, it indicates that the forwarding behavior of the message to be forwarded is consistent in the data plane and the control plane; conversely, if the detection result of the message to be forwarded is abnormal, it indicates that the forwarding behavior of the message to be forwarded is inconsistent in the data plane and the control plane.

[0059] Optionally, after the network device obtains the header information of the packet to be forwarded by calling the data plane manager, it can detect the packet to be forwarded by using the packet forwarding table entry generated based on the tenant configuration and the reference header information of the packet to be forwarded, so as to determine the detection result of the packet to be forwarded.

[0060] For example, the network device can invoke the data plane manager to infer the packet forwarding entry based on the reference header information of the packet to be forwarded, and match the inferred packet forwarding entry with the packet forwarding table entry generated based on the tenant configuration, so as to determine the detection result of the packet to be forwarded according to the matching result. For example, if the matching result is successful, the detection result of the packet to be forwarded is determined to be normal; otherwise, if the matching result is unsuccessful, the detection result of the packet to be forwarded is determined to be abnormal.

[0061] It should be noted that after completing the packet inspection, the network device can call the data plane manager to synchronize the inspection results to the packet forwarder, instructing the packet forwarder to forward or discard the packet to be forwarded according to the inspection results. Specifically, if the inspection result is normal, the packet forwarder can forward the packet to be forwarded to the next node; if the inspection result is abnormal, the packet forwarder will discard the packet to be forwarded.

[0062] S230. If the detection result is abnormal, generate abnormal information for the message to be forwarded; the abnormal information includes reference header information.

[0063] Optionally, if the detection result of the packet to be forwarded is abnormal, the network device may call the data plane manager to generate abnormal information including the reference header information of the packet to be forwarded, and report the abnormal information to the operation and maintenance control center for subsequent abnormal analysis.

[0064] In this embodiment, the reference header information of the packet to be forwarded is obtained, and the packet to be forwarded is detected based on the reference header information and the packet forwarding table entries to determine the detection result of the packet to be forwarded. In the case of an abnormal detection result, abnormal information of the packet to be forwarded is generated. The packet to be forwarded is obtained by the packet forwarder in the network device after modifying the header information of the received initial packet. The abnormal information includes the reference header information. In the above method, not only is the detection result of whether the packet to be forwarded is normal or abnormal obtained, but also, in the case of an abnormal detection result, abnormal information including the reference header information of the packet to be forwarded is generated for subsequent abnormal analysis, instead of simply and crudely discarding the packet. This achieves refined detection of the packet and improves the comprehensiveness of the packet detection.

[0065] To improve the accuracy of the detection results, in one embodiment, such as Figure 3As shown, S220 above involves detecting the message to be forwarded based on the reference header information and message forwarding table entries, and determining the detection result of the message to be forwarded, including:

[0066] S310. Determine the expected header information of the message to be forwarded based on the message forwarding table entries.

[0067] Optionally, after the network device calls the data plane manager to generate a packet forwarding table entry based on the tenant configuration sent by the SDN controller, it can generate the expected header information of the packet to be forwarded based on the packet forwarding table entry.

[0068] S320. Determine the detection result of the message to be forwarded based on the reference header information and the expected header information.

[0069] Optionally, after obtaining the expected header information of the packet to be forwarded, the network device can call the data plane manager to match the expected header information with the reference header information of the packet to be forwarded in order to determine the detection result of the packet to be forwarded.

[0070] In an alternative embodiment, such as Figure 4 As shown, S320 above, based on the reference header information and the expected header information, determines the detection result of the message to be forwarded, including:

[0071] S410. If the reference header information matches the expected header information, determine that the detection result of the message to be forwarded is normal.

[0072] The matching of reference header information with expected header information indicates that the actual forwarding of the message forwarder matches the forwarding configuration of the data plane manager, meaning that the forwarding behavior of the data plane and the control plane is consistent.

[0073] Optionally, the network device may call the data plane manager to match the expected header information with the reference header information of the packet to be forwarded, so as to determine that the detection result of the packet to be forwarded is normal if the reference header information matches the expected header information.

[0074] S420. If the reference header information does not match the expected header information, determine that the detection result of the message to be forwarded is abnormal.

[0075] In this case, the mismatch between the reference header information and the expected header information indicates that the actual forwarding of the message forwarder does not match the forwarding configuration of the data plane manager, meaning that the forwarding behavior of the data plane and the control plane is inconsistent.

[0076] Optionally, the network device may call the data plane manager to match the expected header information with the reference header information of the packet to be forwarded, so as to determine that the detection result of the packet to be forwarded is abnormal if the reference header information does not match the expected header information.

[0077] In this embodiment, the expected header information of the message to be forwarded is determined based on the message forwarding table entry. The detection result of the message to be forwarded is determined based on the reference header information and the expected header information. Specifically, if the reference header information and the expected header information match, the detection result of the message to be forwarded is determined to be normal; if the reference header information and the expected header information do not match, the detection result of the message to be forwarded is determined to be abnormal. In the above method, the expected header information determined based on the message forwarding table entry can accurately characterize the expected forwarding result of the control plane, and the reference header information of the message to be forwarded can accurately characterize the actual forwarding result of the data plane. By comparing the expected forwarding result (i.e., the expected header information) with the actual forwarding result (i.e., the reference header information), the consistency of the forwarding behavior of the message to be forwarded in the data plane and the control plane can be accurately evaluated, thereby improving the accuracy of the obtained detection result.

[0078] To obtain the detection completion table, in one embodiment, such as Figure 5 As shown, the above method also includes:

[0079] S510. Determine the detection identifier of the message to be forwarded based on the message forwarding table entries.

[0080] Each set of message forwarding entries corresponds to a unique detection document (ID). The data stream corresponding to the same message forwarding entry includes multiple messages to be forwarded, and these messages to be forwarded correspond to the same detection ID.

[0081] Optionally, the network device may call the data plane manager to generate a detection ID for the packet to be forwarded based on the packet forwarding table entries, and synchronize it to the packet forwarder so that the packet forwarder can associate the packet to be forwarded with the detection ID.

[0082] S520. Send the detection identifier and detection result of the message to be forwarded to the message forwarder; the message forwarder is used to associate the detection identifier and detection result of the message to be forwarded to obtain the detection completion table.

[0083] The test completion table records the test IDs that have been completed and their corresponding test results.

[0084] Optionally, after obtaining the detection result of the packet to be forwarded, the network device can call the data plane manager to send the detection ID and detection result of the packet to be forwarded to the packet forwarder. The packet forwarder can not only forward or discard the packet to be forwarded based on the detection result, but also associate the detection ID of the packet to be forwarded with the detection result to obtain a detection completion table.

[0085] It should be noted that when the detection result of the packet to be forwarded is abnormal, the abnormal information may also include the detection identifier and expected header information of the packet to be forwarded. The expected header information can reflect the tenant configuration. The generated abnormal information includes the detection identifier, reference header information, and expected header information of the packet to be forwarded, which can be used to quickly locate the corresponding tenant configuration during subsequent anomaly analysis.

[0086] In this embodiment, the detection identifier of the message to be forwarded is determined according to the message forwarding table entry, and the detection identifier and detection result of the message to be forwarded are sent to the message forwarder; the message forwarder is used to associate the detection identifier of the message to be forwarded with the detection result to obtain the detection completion table; in the above method, by feeding back the detection identifier and detection result of the message to be forwarded, the detection completion table is obtained, the message detection record is realized, and the convenience and efficiency of subsequent detection result query are improved.

[0087] Whether the detection result of the message to be forwarded is abnormal can be directly determined based on the entry hit information reported by the message forwarder. Based on this, in one embodiment, such as... Figure 6 As shown, before obtaining the reference header information of the message to be forwarded in S210 above, the method further includes:

[0088] S610, Receive the entry hit information sent by the message forwarder; the message forwarding table entry includes multiple sub-entries; the entry hit information is used to characterize the matching status between the initial message and each sub-entry.

[0089] Different sub-table entries correspond to different routing information. For example, packet forwarding table entries include sub-table entries corresponding to MAC addresses, sub-table entries corresponding to IP addresses, and so on. When the network device is a centralized gateway, packet forwarding table entries include sub-table entries corresponding to next-hop information. Next-hop information may include the destination MAC address, the source IP (SIP) and destination IP (DIP) of the encapsulated Virtual eXtensible Local Area Network (VXLAN) tunnel, and the VXLAN Network Identifier (VNI), etc.

[0090] For example, the entry hit information can be represented by an error code. The error code is a string of numbers with a preset number of digits, where the preset number of digits is the number of sub-entries in the message forwarding entry. Each digit in the string is either 1 or 0, and corresponds to one sub-entry. Here, 1 indicates that the corresponding sub-entry was hit, and 0 indicates that the corresponding sub-entry was not hit.

[0091] Optionally, after receiving the initial message, the message forwarder can generate an error code based on the matching status of the initial message and each sub-entry in the message forwarding table, and report the error code as entry hit information to the data plane manager. The data plane manager then receives the entry hit information sent by the message forwarder.

[0092] S620. If the table entry hit information indicates that there are missing sub-table entries, determine that the detection result of the message to be forwarded is abnormal.

[0093] Among them, the table entry hit information indicates that there are missing sub-table entries, that is, the error code includes 0.

[0094] Optionally, the network device calls the data plane manager to analyze the error code, and if the error code includes 0, it determines that the detection result of the packet to be forwarded is abnormal.

[0095] S630. If the table entry hit information indicates that there are no missing sub-table entries, perform the step of obtaining the reference header information of the message to be forwarded.

[0096] Among them, the table entry hit information indicates that there are no missing sub-table entries, that is, the error code does not include 0.

[0097] Optionally, the network device calls the data plane manager to analyze the error code, and if the error code does not contain 0, it then executes the step of obtaining the reference header information of the packet to be forwarded in S210 to continue packet detection.

[0098] In this embodiment, by receiving the entry hit information sent by the message forwarder, if the entry hit information indicates the existence of a missing sub-entry, the detection result of the message to be forwarded is determined to be abnormal; if the entry hit information indicates that there is no missing sub-entry, the step of obtaining the reference header information of the message to be forwarded is executed; the message forwarding entry includes multiple sub-entries; the entry hit information is used to characterize the matching status between the initial message and each sub-entry; in the above method, the entry hit information can intuitively reflect whether the detection result of the message to be forwarded is abnormal. Based on the entry hit information, the detection result of the message to be forwarded is judged in advance, which can conveniently and quickly determine the situation where the detection result is abnormal, thereby improving the convenience of detecting abnormal results.

[0099] This application also provides a message detection method, which can be applied to... Figure 1 Taking a packet forwarder in a network device as an example, for instance... Figure 7 As shown, the above method includes the following steps:

[0100] S710. Modify the header information of the received initial message according to the message forwarding table entries to obtain the message to be forwarded.

[0101] Optionally, after receiving the initial packet forwarded by the previous node, the packet forwarder can modify the header information of the initial packet based on the matching status between the packet forwarding table entry configured by the network device through the data plane manager and the initial packet, and obtain the packet to be forwarded.

[0102] S720. Based on the detection identifier of the received packet to be forwarded, generate a packet notification event including the detection identifier; the packet notification event is used to instruct the data plane manager deployed in the network device to detect the packet to be forwarded based on the reference header information and packet forwarding table entries of the packet to be forwarded, determine the detection result of the packet to be forwarded, and generate an error message for the packet to be forwarded if the detection result is abnormal; the error message includes the reference header information.

[0103] Optionally, after receiving the packet to be forwarded, the packet forwarder generates a packet notification event including the detection identifier through the event notification channel based on the detection identifier of the received packet to be forwarded. This event instructs the network device to call the data plane manager to detect the packet to be forwarded based on the reference header information and packet forwarding table entries of the packet to be forwarded, determine the detection result of the packet to be forwarded, and generate an error message for the packet to be forwarded if the detection result is abnormal. The error message includes the reference header information.

[0104] It should be noted that network devices can call the data plane manager to poll the message notification events generated by the event notification channel in order to fully detect the message to be forwarded corresponding to the detection identifier in the message notification event.

[0105] In this embodiment, the header information of the received initial packet is modified according to the packet forwarding table entry to obtain the packet to be forwarded. A packet notification event including the detection identifier is generated based on the detection identifier of the received packet to be forwarded. The packet notification event is used to instruct the data plane manager deployed in the network device to detect the packet to be forwarded according to the reference header information and the packet forwarding table entry, determine the detection result of the packet to be forwarded, and generate anomaly information for the packet to be forwarded if the detection result is abnormal. The anomaly information includes the reference header information. In the above method, not only is the detection result of the packet to be forwarded obtained, but also, if the detection result is abnormal, anomaly information including the reference header information of the packet to be forwarded is generated for subsequent anomaly analysis, rather than simply discarding the packet, thereby improving the comprehensiveness of packet detection.

[0106] The message forwarding table entry includes multiple sub-table entries. Based on this, in one embodiment, such as Figure 8 As shown, in step S710 above, the header information of the received initial message is modified according to the message forwarding table entries to obtain the message to be forwarded, including:

[0107] S810. Based on the matching status of the initial message and each sub-entry, determine the entry hit information and send the entry hit information to the data plane manager.

[0108] Optionally, after receiving the initial message, the message forwarder can read the data information of each sub-entry in the corresponding message forwarding table entry. For each sub-entry, the data information of the corresponding sub-entry is matched against the sub-entry. If the data information matches the sub-entry, the sub-entry is determined to be matched; otherwise, if the data information does not match the sub-entry, the sub-entry is determined to be matched. The message forwarder can generate an error code based on the matching status of the initial message and each sub-entry, and report the error code as entry match information to the data plane manager.

[0109] S820. If the table entry hit information indicates that there are no missing sub-table entries, modify the header information of the initial message according to the table entry hit information to obtain the message to be forwarded.

[0110] Among them, the table entry hit information indicates that there are no missing sub-table entries, that is, the error code does not include 0.

[0111] Optionally, if the message forwarder determines that the entry hit information indicates that there are no missing sub-entries, it can modify the header information of the initial message according to the entry hit information to obtain the message to be forwarded.

[0112] For example, the packet forwarder can determine the hit sub-entry based on the entry hit information, and modify the corresponding data information in the header information of the initial packet according to each sub-entry, such as modifying the MAC address, adding VLAN tags, etc., so as to obtain the packet to be forwarded.

[0113] In this embodiment, based on the matching status of the initial message and each sub-entry, the entry hit information is determined and sent to the data plane manager. If the entry hit information indicates that there are no missing sub-entries, the header information of the initial message is modified according to the entry hit information to obtain the message to be forwarded. In the above method, entry hit information is generated for the data plane manager to pre-determine whether the detection result is abnormal. If the entry hit information indicates that there are no missing sub-entries, the message to be forwarded is obtained for the data plane manager to determine the detection result. This expands the path for determining the detection result, adapting to different matching states and improving the convenience of message detection.

[0114] The message forwarder stores a detection completion table, based on which, in one embodiment, such as Figure 9 As shown, before generating a message notification event including the detection identifier based on the detection identifier of the received message to be forwarded in S720, the method further includes:

[0115] S910. Determine the detection result of the message to be forwarded based on the detection identifier and the detection completion table; the detection completion table includes different detection identifiers and their corresponding detection results.

[0116] Optionally, the message forwarder can query the detection result corresponding to the detection ID in the detection completion table based on the detection ID of the message to be forwarded, and use it as the detection result of the message to be forwarded.

[0117] For example, the packet forwarder can use the detection ID of the packet to be forwarded as the key to match the detection ID in the detection completion table, thereby obtaining the detection result of the successfully matched detection ID, which is used as the detection result of the packet to be forwarded.

[0118] S920. If the detection identifier of the message to be forwarded is not included in the detection completion table, perform the step of generating a message notification event including the detection identifier based on the detection identifier of the received message to be forwarded.

[0119] Optionally, if the message forwarder does not find the detection ID in the detection completion table based on the detection ID of the message to be forwarded, it executes step S720 to generate a message notification event including the detection identifier based on the detection identifier of the received message to be forwarded, so as to continue message detection.

[0120] In this embodiment, before generating a message notification event, the detection result of the message to be forwarded is determined based on the detection identifier of the message to be forwarded and the detection completion table. If the detection completion table does not include the detection identifier of the message to be forwarded, the step of generating a message notification event including the detection identifier is performed based on the received detection identifier of the message to be forwarded. The detection completion table includes different detection identifiers and their corresponding detection results. In the above method, the detection result is determined based on the detection completion table to reduce the reporting of message notification events, prevent a large number of duplicate message notification events from causing excessive processing burden on the data plane manager and leading to device failure, thereby improving the stability of message detection.

[0121] To obtain the detection completion table, in one embodiment, such as Figure 10 As shown, the above method also includes:

[0122] S1010: Receive the detection identifier and detection result of the message to be forwarded sent by the data plane manager.

[0123] Optionally, after the network device obtains the detection result of the packet to be forwarded by calling the data plane manager, it can synchronize the detection ID of the packet to be forwarded and the detection result to the packet forwarder. The packet forwarder then receives the detection ID and detection result of the packet to be forwarded.

[0124] S1020. Associate the detection identifier of the message to be forwarded with the detection result to obtain the detection completion table.

[0125] Optionally, the message forwarder associates the detection ID of the message to be forwarded with the detection result to obtain a detection completion table.

[0126] For example, the packet forwarder can associate the detection ID and detection result of the packet to be forwarded and fill them into a blank table to obtain a detection completion table. It can also continuously receive new detection IDs and detection results of packets to be forwarded, and add the new packet's detection ID and detection result to the detection completion table, thus updating the detection completion table. Furthermore, a preset aging time can be configured for the detection completion table. Based on the generation time of the detection result corresponding to each detection ID in the table, it can determine whether the detection result has reached the preset aging time. If the preset aging time has been reached, the corresponding detection ID and its detection result are deleted from the detection completion table.

[0127] In this embodiment, the detection identifier and detection result of the message to be forwarded are received from the data plane manager, and the detection identifier and detection result of the message to be forwarded are associated to obtain a detection completion table. In the above method, the detection completion table is constructed based on the detection identifier and detection result of the message to be forwarded, so as to query the detection result later. This reduces the reporting of message notification events, improves the stability of message detection, and improves the efficiency of message detection.

[0128] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0129] In one embodiment, this application also provides a network device, such as... Figure 1 As shown, the network device 100 includes a data plane manager 101 and a packet forwarder 102 deployed on the network device 100; the data plane manager 101 is used to implement the steps of the packet detection method applied to the data plane manager in the foregoing embodiments, and the packet forwarder 102 is used to implement the steps of the packet detection method applied to the packet forwarder in the foregoing embodiments.

[0130] The packet detection method implemented by the data plane manager 101 and the packet forwarder 102 can be found in the aforementioned related embodiments, and will not be repeated here.

[0131] Based on the same inventive concept, embodiments of this application also provide a packet detection apparatus for implementing the packet detection method for a data plane manager as described above, and a packet detection apparatus for implementing the packet detection method for a packet forwarder as described above. The solutions provided by the above two apparatuses are similar to the solutions described in the above methods; therefore, the specific limitations in one or more packet detection apparatus embodiments provided below can be found in the limitations of the packet detection method described above, and will not be repeated here.

[0132] In one embodiment, such as Figure 11 As shown, a message detection device is provided, including: an information acquisition module 1101, a message detection module 1102, and an anomaly generation module 1103, wherein:

[0133] The information acquisition module 1101 is used to acquire the reference header information of the message to be forwarded; the message to be forwarded is obtained by the message forwarder in the network device after modifying the header information of the received initial message;

[0134] The message detection module 1102 is used to detect the message to be forwarded based on the reference header information and message forwarding table entries, and to determine the detection result of the message to be forwarded;

[0135] When the detection result is abnormal, the anomaly generation module 1103 generates anomaly information for the message to be forwarded; the anomaly information includes reference header information.

[0136] In one embodiment, such as Figure 12 As shown, a message detection device is provided, including: a message generation module 1201 and an event notification module 1202, wherein:

[0137] The message generation module 1201 is used to modify the header information of the received initial message according to the message forwarding table entries to obtain the message to be forwarded;

[0138] The event notification module 1202 is used to generate a message notification event including the detection identifier of the received message to be forwarded. The message notification event is used to instruct the data plane manager deployed in the network device to detect the message to be forwarded according to the reference header information and message forwarding table entries of the message to be forwarded, determine the detection result of the message to be forwarded, and generate an error message of the message to be forwarded if the detection result is abnormal. The error message includes the reference header information.

[0139] Each module in the aforementioned message detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0140] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described message detection methods.

[0141] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of any of the above-described message detection methods.

[0142] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0143] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0144] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A message detection method, characterized in that, A data plane manager deployed on a network device, the method comprising: Upon receiving a message notification event sent by the message forwarder in the network device through the event notification channel, the reference header information of the message to be forwarded is obtained; the message to be forwarded is obtained by the message forwarder after modifying the header information of the received initial message. The system retrieves tenant configurations from the software-defined network controller, generates packet forwarding table entries, and determines the expected header information of the packet to be forwarded based on the packet forwarding table entries. Based on the reference header information and the expected header information, the detection result of the packet to be forwarded is determined; the detection result is used to characterize whether the forwarding behavior of the packet to be forwarded is consistent in the data plane and the control plane. If the detection result is abnormal, an anomaly information is generated for the message to be forwarded; the anomaly information includes the reference header information; After completing the packet inspection, the network device calls the data plane manager to synchronize the inspection results to the packet forwarder, instructing the packet forwarder to forward or discard the packet to be forwarded according to the inspection results; wherein, if the inspection result is normal, the packet forwarder forwards the packet to be forwarded to the next node; if the inspection result is abnormal, the packet forwarder discards the packet to be forwarded.

2. The method according to claim 1, characterized in that, The step of determining the detection result of the message to be forwarded based on the reference header information and the expected header information includes: If the reference header information matches the expected header information, the detection result of the message to be forwarded is determined to be normal. If the reference header information does not match the expected header information, the detection result of the message to be forwarded is determined to be abnormal.

3. The method according to claim 1 or 2, characterized in that, The method further includes: The detection identifier of the message to be forwarded is determined based on the message forwarding table entries; The detection identifier and detection result of the message to be forwarded are sent to the message forwarder; the message forwarder is used to associate the detection identifier and detection result of the message to be forwarded to obtain a detection completion table.

4. The method according to claim 1 or 2, characterized in that, Before obtaining the reference header information of the message to be forwarded, the method further includes: The message forwarding table entry receives the entry hit information sent by the message forwarder; the message forwarding table entry includes multiple sub-table entries; the entry hit information is used to characterize the matching status between the initial message and each of the sub-table entries; If the table entry hit information indicates that there are missing sub-table entries, the detection result of the message to be forwarded is determined to be abnormal; If the table entry hit information indicates that there are no missing sub-table entries, then the step of obtaining the reference header information of the message to be forwarded is performed.

5. A message detection method, characterized in that, The method, applied to a packet forwarder in a network device, includes: Modify the header information of the received initial message according to the message forwarding table entries to obtain the message to be forwarded; Based on the detection identifier of the received packet to be forwarded, a packet notification event including the detection identifier is generated and sent to the data plane manager in the network device. Upon receiving a packet notification event sent by the packet forwarder in the network device through the event notification channel, the data plane manager obtains the reference header information of the packet to be forwarded. The packet to be forwarded is obtained by the packet forwarder modifying the header information of the received initial packet. Tenant configuration is retrieved from the software-defined network controller, packet forwarding table entries are generated, and the expected header information of the packet to be forwarded is determined based on the packet forwarding table entries. The expected header information of the packet to be forwarded is determined based on the reference header information and the expected header information. The detection result of the packet is used to characterize whether the forwarding behavior of the packet to be forwarded is consistent in the data plane and control plane. If the detection result is abnormal, abnormal information of the packet to be forwarded is generated. The abnormal information includes the reference header information. After the packet detection is completed, the network device calls the data plane manager to synchronize the detection result to the packet forwarder, so as to instruct the packet forwarder to forward or discard the packet to be forwarded according to the detection result. Wherein, if the detection result is normal, the packet forwarder forwards the packet to be forwarded to the next node; if the detection result is abnormal, the packet forwarder discards the packet to be forwarded.

6. The method according to claim 5, characterized in that, The message forwarding table entry includes multiple sub-table entries; the step of modifying the header information of the received initial message according to the message forwarding table entry to obtain the message to be forwarded includes: Based on the matching status of the initial message and each of the sub-table entries, the table entry hit information is determined and sent to the data plane manager; If the table entry hit information indicates that there are no missing sub-table entries, the header information of the initial message is modified according to the table entry hit information to obtain the message to be forwarded.

7. The method according to claim 5 or 6, characterized in that, Before generating a message notification event including the detection identifier based on the received detection identifier of the message to be forwarded, the method further includes: The detection result of the message to be forwarded is determined based on the detection identifier and the detection completion table; the detection completion table includes different detection identifiers and their corresponding detection results. If the detection identifier of the message to be forwarded is not included in the detection completion table, the step of generating a message notification event including the detection identifier based on the received detection identifier of the message to be forwarded is performed.

8. The method according to claim 5 or 6, characterized in that, The method further includes: Receive the detection identifier and detection result of the message to be forwarded sent by the data plane manager; The detection identifier of the message to be forwarded is associated with the detection result to obtain the detection completion table.

9. A network device, characterized in that, The network device includes a data plane manager and a packet forwarder, wherein the data plane manager is used to implement the steps of the method according to any one of claims 1 to 4, and the packet forwarder is used to implement the steps of the method according to any one of claims 5 to 8.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the steps of any one of the message detection methods of claims 1 to 8.

Images