A method and device for tracking business dynamic paths

Abstract

The present application provides a method and device for tracing a dynamic service path, and relates to the field of computer technology. The method includes: obtaining the network physical topology structure of the network system; determining the traffic topology matrix based on the network physical topology structure, the traffic topology matrix is ​​used to indicate at least one traffic collection point and the traffic access relationship between the traffic collection points; establishing a traffic feature library based on the traffic feature data of the traffic collection point and the corresponding traffic collection time; when a service anomaly is detected, obtaining the service data of the abnormal service, and matching the target data packet characteristics and target performance indicators of the corresponding traffic collection point in the traffic feature library; determining the service traffic path based on the target data packet characteristics of the traffic collection point and the traffic topology matrix; determining the system troubleshooting results used to indicate whether a network system failure has occurred based on the service traffic path and the target performance indicators. The present application can effectively improve the scope of application and the efficiency of fault analysis.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for tracing a business dynamic path. Background Art

[0002] With the rapid development of the Internet, the scale of data centers continues to expand, and the network structure has become more complex. For the network operation and maintenance team, it is crucial to quickly and accurately determine whether the problem is caused by the network.

[0003] The stability and reliability of the network system are crucial to ensuring the continuity of the business system. Once the network fails, interruptions, packet loss, delays and other problems occur, which may reduce the user experience at best, or even lead to customer loss, or even cause immeasurable systemic risks. At present, in the process of network system monitoring, there may be the following problems: First, the Agent needs to be installed, which puts forward certain transformation requirements for the application system and makes the deployment complicated; second, it strongly relies on the upgrade and transformation of hardware; third, due to the diversity of network environments, the assumptions of some methods cannot be met, especially when the network environment has complex environments such as multi-level NAT (Network Address Translation) and reverse proxy, the applicability of the method will be limited. Therefore, the fault analysis efficiency of the existing network monitoring method is low and difficult to be widely used. Summary of the invention

[0004] In order to solve the above-mentioned problems in the prior art, the present invention provides a service dynamic path tracing method and device, which can effectively expand the scope of application and improve the efficiency of network system fault analysis.

[0005] In a first aspect, the present application provides a service dynamic path tracing method, comprising:

[0006] Obtain the network physical topology of the network system;

[0007] Based on the network physical topology structure, determine a traffic topology matrix, wherein the traffic topology matrix is ​​used to indicate at least one traffic collection point and a traffic access relationship between the traffic collection points, and the traffic collection point is used to indicate the collection of traffic data of any traffic type;

[0008] Analyze the traffic data collected by the traffic collection point to obtain traffic characteristic data, and establish a traffic characteristic library based on the traffic characteristic data of the traffic collection point and the corresponding traffic collection time, wherein the traffic characteristic data includes data packet characteristics, performance indicators and service characteristics;

[0009] When a service anomaly is detected, the service data of the abnormal service is obtained, and the target data packet characteristics and target performance indicators of the traffic collection point corresponding to the service data are matched in the traffic feature library, wherein the service data includes the service execution time and the target service characteristics;

[0010] Determining a service traffic path based on target data packet characteristics of the traffic collection point and the traffic topology matrix;

[0011] Based on the service traffic path and the target performance indicator, a system troubleshooting result is determined to indicate whether a fault occurs in the network system.

[0012] In a possible implementation, the network physical topology structure includes at least one physical device between the network and the business server in the network system, and the physical device includes a switch and a router; determining the traffic topology matrix based on the network physical topology structure includes: screening out at least one designated target physical device from the physical devices; configuring a corresponding label for at least one collection port of the target physical device, the label is used to identify the traffic type of the traffic data collected by the collection port, and the traffic type is used to indicate the traffic source or traffic destination of the traffic data; traversing the target physical device, merging the collection ports with the same label into a traffic collection point, and using the traffic data collected by the merged collection ports as the traffic data of the traffic collection point; forming a traffic topology matrix based on the network physical topology structure, the traffic collection point and the corresponding traffic type.

[0013] In a possible implementation, the method further includes: using a pre-built traffic collection architecture to collect traffic data of the traffic collection point; wherein the traffic collection architecture includes an input layer, a forwarding layer and an output layer arranged in sequence, the input layer includes multiple input modules, the forwarding layer includes multiple forwarding modules, the output layer includes multiple output modules, and the input modules and the output modules are respectively connected to each of the forwarding modules; the following steps are performed through the traffic collection architecture, including: mirroring the traffic data collected by the target physical device to the input module, configuring a corresponding data identifier for the traffic data according to the label of the collection port to which it belongs, and transmitting the traffic data carrying the data identifier to the output module through the forwarding module; merging the traffic data with the same data identifier into the traffic data of the traffic collection point corresponding to the data identifier through the output module.

[0014] In a possible implementation, the service traffic path includes a service forward path and a service reverse path; the service traffic path is determined based on the target data packet characteristics of the traffic collection point and the traffic topology matrix, including: generating a service forward path based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix; based on the service forward path, determining the mapping relationship of each traffic collection point with respect to the target data packet characteristics, and forming a service reverse path based on the mapping relationship, wherein the target data packet characteristics include source IP data, destination IP data, source port data and destination port data, and the mapping relationship is used to indicate the data response status of the traffic collection point.

[0015] In a possible implementation, the generating of a service forward path based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix includes: based on the traffic topology matrix and the source IP data, destination IP data, source port data and destination port data contained in the target data packet characteristics, path splicing of the traffic collection point to determine a first path; based on the source port data of the traffic collection point in the first path, determining a second path; based on the destination IP data and source IP data of the traffic collection point in the second path, determining a third path; and splicing a network side node that matches the source port data of the head-end traffic collection point before the head-end traffic collection point of the third path, so that the service forward path is formed by the third path and the network side node.

[0016] In a possible implementation, the first path includes a first access path and a second access path; the flow collection points are path-splicing based on the flow topology matrix and the source IP data, destination IP data, source port data and destination port data included in the target data packet characteristics to determine the first path, including: when it is detected that any two flow collection points are completely consistent in source IP data, destination IP data, source port data and destination port data, the currently detected flow collection points are spliced ​​according to the flow topology matrix to form a first access path; when it is detected that any two flow collection points are consistent in source IP data, destination IP data and destination port data, but inconsistent in source port data, the currently detected flow collection points are spliced ​​according to the flow topology matrix to form a second access path; when it is detected that the terminal flow collection point in the current first access path and / or the second access path is a server access node, a server node matching the destination IP data of the server access node is spliced ​​after the terminal flow collection point of the detected first path to update the first path.

[0017] In a possible implementation, the determining of the second path based on the source port data of the traffic collection points in the first path includes: when it is detected that the source port data of the end traffic collection point in any first path is consistent with the source port data of the head-end traffic collection point in other first paths, splicing the detected end traffic collection point with the head-end traffic collection point to obtain the second path.

[0018] In a possible implementation, the determining of the third path based on the destination IP data and source IP data of the traffic collection point in the second path includes: when it is detected that the destination IP data of the node at the end in any second path is consistent with the source IP data of the traffic collection point at the head end in other second paths, the detected node at the end in the second path is spliced ​​with the traffic collection point at the head end to obtain the third path, and the node is one of the traffic collection point and the server node.

[0019] In a possible implementation, the system troubleshooting result indicating whether the network system has a fault is determined based on the business traffic path and the target performance indicator, including: if it is detected that the target performance indicator of the traffic collection point does not meet the preset normal performance conditions, marking the access section where the abnormal traffic collection point is currently located with a corresponding abnormal identification; wherein the access section is the path between any server node on the business traffic path or the network side node to a subsequent server node; displaying the business traffic path and the abnormal identification on the network physical topology structure, and judging whether the network system has a fault based on the abnormal identification, and generating a corresponding system troubleshooting result.

[0020] In a second aspect, the present application provides a service dynamic path tracking device, comprising:

[0021] A data acquisition module is used to acquire a network physical topology structure of a network system; a traffic topology construction module is used to determine a traffic topology matrix based on the network physical topology structure, wherein the traffic topology matrix is ​​used to indicate at least one traffic collection point and the traffic access relationship between the traffic collection points, and the traffic collection point is used to indicate the collection of traffic data of any traffic type; a traffic feature library construction module is used to parse the traffic data collected by the traffic collection point to obtain traffic feature data, and establish a traffic feature library based on the traffic feature data of the traffic collection point and the corresponding traffic collection time, wherein the traffic feature data includes data packet features, performance indicators and service features; a data matching module is used to acquire service data of the abnormal service when a service anomaly is detected, and match the target data packet features and target performance indicators of the traffic collection point corresponding to the service data in the traffic feature library, wherein the service data includes service execution time and target service features; a path construction module is used to determine a service traffic path based on the target data packet features of the traffic collection point and the traffic topology matrix; a system fault troubleshooting module is used to determine a system troubleshooting result indicating whether a fault occurs in the network system based on the service traffic path and the target performance indicator.

[0022] The service dynamic path tracing method and device provided by the present application determine the traffic collection point and the traffic topology matrix through the network physical topology structure, take into account the traffic access relationship and traffic trend of the physical devices between the network and the service server, build a traffic feature library based on the traffic data collected by the traffic collection point, and when a service anomaly is detected, match the target data packet characteristics of the traffic collection point corresponding to the service characteristics of the abnormal service in the traffic feature library, which can effectively improve the efficiency of obtaining network system data, and then determine the service traffic path based on the target data packet characteristics of the traffic collection point and the traffic topology matrix, and realize tracking of the service path, so as to judge whether the network system has a fault based on the service traffic path, the matched target performance indicators and the traffic topology matrix, and realize rapid troubleshooting to determine whether the current anomaly belongs to a network system anomaly or a service logic anomaly, and do not need to rely on additional deployment and hardware support, can be applicable to complex and diverse network environments, and improve the scope of application, thereby improving the efficiency of service fault analysis, quickly locating fault problems, ensuring service continuity, and improving the stability of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flowchart of a method for tracing a dynamic business path provided in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of the structure of the flow collection architecture provided in the embodiment of the present application;

[0025] Figure 3 A schematic diagram of the physical topology of the network provided in the embodiment of the present application;

[0026] Figure 4 A schematic diagram of the structure of the traffic topology matrix provided in the embodiment of the present application;

[0027] Figure 5 A schematic diagram of a first access path provided in an embodiment of the present application;

[0028] Figure 6 A schematic diagram of a second access path provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of a second path provided in an embodiment of the present application;

[0030] Figure 8 A schematic diagram of a third path provided in an embodiment of the present application;

[0031] Fig. 9 A schematic diagram of the structure of the service forward path provided in the embodiment of the present application;

[0032] Fig.10 A schematic diagram showing the display results of the service forward path and performance indicators provided in the embodiment of the present application;

[0033] Fig.11 A schematic diagram of the structure of a business dynamic path tracking device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] Figure 1 A flowchart of a business dynamic path tracing method provided in an embodiment of the present application, the method includes steps S101 to S106.

[0035] S101. Obtain a network physical topology structure of a network system.

[0036] In this application, the network system includes the network (Internet), the business server and the physical devices between the two, which can be switches, routers, load balancers and NAT devices (Network Address Translation), firewalls, etc. Among them, the LB device (Load Balance Device, LB) not only realizes the load balancing function, but also realizes the NAT function, converting the source and destination IP addresses to achieve the purpose of protecting the intranet environment resources and retaining the source port. It should be noted that in order to ensure the stable operation of the business network, the switches, firewalls and load balancers of the entire network are all deployed redundantly.

[0037] The network physical topology is used to describe the connection and layout between various devices in the network system, such as the physical layout and logical structure of the network system. The physical topology in the network physical topology refers to the actual physical connection between network devices and cables, while the logical topology in the network physical topology refers to how data flows in the network. For example, the network physical topology can be an undirected graph ,in It is a collection of device nodes, representing switches and routers in the network system. It is a collection of edges, representing the network connections between device nodes.

[0038] S102. Determine a traffic topology matrix based on the network physical topology structure, wherein the traffic topology matrix is ​​used to indicate at least one traffic collection point and a traffic access relationship between the traffic collection points, and the traffic collection point is used to indicate the collection of traffic data of any traffic type.

[0039] In the present application, the traffic type is used to indicate the traffic source or traffic destination of the traffic data. For example, the traffic type may be the traffic data before load balancing and NAT conversion by the first load balancing device, the traffic data after load balancing and NAT conversion by the first load balancing device, the traffic data before load balancing and NAT conversion by the second load balancing device, the traffic data after load balancing and NAT conversion by the second load balancing device, etc. It should be noted that each physical device is configured with one or more collection ports, which are used to collect traffic data of different traffic types. For physical devices with structures such as master-slave deployment and master-master deployment in a network system, the physical devices and collection ports used to collect traffic data of the same traffic type may be one or more. In this application, the collection ports used to collect traffic data of the same traffic type in the physical device are merged into one traffic collection point to achieve accurate tracking of traffic data, which is conducive to improving the efficiency of subsequent traffic analysis. Furthermore, based on the data source or data destination indicated by the network physical topology structure, the traffic collection points and the traffic type of the traffic collection points, a traffic topology matrix is ​​constructed. The traffic topology matrix is ​​used to indicate the traffic direction and traffic access relationship between the traffic collection points, that is, the traffic topology adjacency relationship between the traffic collection points. The traffic access relationship can be a one-to-one or one-to-many access relationship.

[0040] Therefore, the present application determines the traffic collection points and the traffic topology matrix, takes into account the traffic access relationship and traffic direction of the physical devices between the network and the business server, and is not limited to the path tracking in the prior art that focuses on the access relationship between business nodes and ignores the physical devices between nodes. It realizes dynamic tracking of business paths and quickly locates problems. At the same time, it avoids the problems of NAT front and back being unable to be associated and path discontinuity, thereby greatly improving the ability to troubleshoot problems, shortening the time for business recovery, and ensuring business continuity.

[0041] S103, analyzing the traffic data collected by the traffic collection point to obtain traffic characteristic data, and establishing a traffic characteristic library based on the traffic characteristic data of the traffic collection point and the corresponding traffic collection time, wherein the traffic characteristic data includes data packet characteristics, performance indicators and business characteristics.

[0042] In the present application, the traffic data obtained at the traffic collection point is analyzed according to the specified protocol, such as the HTTP protocol, to obtain traffic characteristic data, and then the traffic characteristic data is structured so that the processed traffic characteristic data and the traffic collection time of the corresponding traffic data are stored in the traffic characteristic library for subsequent characteristic value query, so as to facilitate dynamic path tracing when the business encounters problems.

[0043] It should be noted that the traffic feature data stored in the traffic feature library includes data packet features, service features and performance indicators, rather than storing all service information in full. Optionally, data packet features include source IP, destination IP, source port, destination port, protocol, ipId, ttl, seqNum, outer vlan identifier, packet loss rate, tcp. Performance indicators include server RTT (i.e. server round-trip delay), client RTT (i.e. client round-trip delay), packet loss rate, retransmission rate, reset rate, non-response rate, average response time, maximum response time and number of zero windows. Service features are selected according to different services and can be a unique identifier for the service when interacting in the entire network, such as a service serial number, transaction log identifier, etc.

[0044] S104. When a service anomaly is detected, obtain service data of the abnormal service, and match the target data packet characteristics and target performance indicators of the traffic collection point corresponding to the service data in the traffic feature library, wherein the service data includes service execution time and target service characteristics.

[0045] It should be noted that in the existing technology, when faced with business anomalies, only business information related to the business, such as the business serial number, can be extracted, and the network system equipment related to the business cannot be directly obtained, and the efficiency of business anomaly investigation is low. In this regard, when a business is abnormal, the business execution time and the business feature value of the abnormal business (such as the business serial number) are obtained, and according to the business execution time and business feature value, the data packet features and performance indicators related to the business feature value and business execution time are matched in the traffic feature library.

[0046] S105: Determine a service traffic path based on the target data packet characteristics of the traffic collection point and the traffic topology matrix.

[0047] In some embodiments, the service traffic path includes a service forward path and a service reverse path. This step S105 includes: generating a service forward path based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix; based on the service forward path, determining the mapping relationship of each traffic collection point with respect to the target data packet characteristics, and forming a service reverse path based on the mapping relationship, wherein the target data packet characteristics include source IP data, destination IP data, source port data and destination port data, and the mapping relationship is used to indicate the data response status of the traffic collection point.

[0048] In this embodiment, according to the network physical topology and the above-mentioned target data packet characteristics, the business forward path is dynamically drawn according to the access order planned by the traffic topology matrix. The business forward path can start from the business access and gradually draw the traffic collection points through which the traffic passes. At the same time, according to the network physical topology, the network equipment and security equipment between the network and the business server can be displayed together, so that a business forward path related to the business is obtained. Then, according to the business forward path, the mapping relationship between the source IP, destination IP, source port and destination port of each NAT point is determined, so that the path splicing is performed according to the mapping relationship, so as to determine the business reverse path, taking into account the data response between the traffic collection points. Therefore, this embodiment improves the comprehensiveness and accuracy of the business path by constructing the business forward path and the business reverse path, and provides a full path access display diagram.

[0049] S106. Based on the service traffic path and the target performance indicator, determine a system troubleshooting result indicating whether a fault occurs in the network system.

[0050] It should be noted that when a business anomaly is detected, the cause may be a network system failure or a business logic failure. Network system failures usually originate from network connection problems, router configuration errors, ISP (Internet service provider) problems, network hardware (such as switches, routers, hubs, etc.) failures, etc., while business logic failures are usually caused by software errors, program logic problems, data inconsistencies, system configuration errors, or business rule mismatches when the system is operating normally. In this regard, this application is based on the business traffic path and combines the target performance indicators of each traffic collection point. The target performance indicators include client RTT (i.e., client round-trip delay), server RTT (i.e., server round-trip delay), packet loss rate, and retransmission rate, etc., which can intuitively determine whether the current fault is caused by the network system from the path and performance indicators, thereby narrowing the scope of problem investigation and speeding up problem location.

[0051] In some embodiments, the method further includes: using a pre-built traffic collection architecture to collect traffic data of the traffic collection point; wherein the traffic collection architecture includes an input layer, a forwarding layer and an output layer arranged in sequence, the input layer includes multiple input modules, the forwarding layer includes multiple forwarding modules, the output layer includes multiple output modules, and the input modules and the output modules are respectively connected to each of the forwarding modules.

[0052] In this embodiment, a traffic collection architecture is constructed for collecting traffic data from traffic collection points. Specifically, the business traffic data of the physical device is mirrored to the input layer of the traffic collection architecture, and is forwarded to the output layer at high speed through the forwarding layer, so that traffic processing is performed at the output layer, such as deduplication, cutting, and traffic copying of the traffic data. Optionally, the deduplication rule can be a combination of a four-tuple (source and destination IP and source and destination port), ipId, MAC, and the outermost VLAN tag. The traffic from different physical devices is distinguished based on the deduplication rule, avoiding repeated traffic collection and improving the efficiency of traffic processing. Exemplary, Figure 2 The schematic diagram of the structure of the flow collection architecture provided in the embodiment of the present application adopts the Spine-Leaf networking architecture, wherein the input layer includes input module 1, input module 2 and input module a, the forwarding layer includes forwarding module 1 and forwarding module 2, and the output layer includes output module 1, output module 2 and output module b, and the input module and the output module are respectively interconnected with the forwarding module. The output module also has the traffic processing capability. The input module is used to receive the traffic data mirrored by the physical device (such as a switch, a router), the forwarding module is used for high-speed forwarding, and the output module is used to process the traffic data from the forwarding module. Therefore, the present embodiment collects the traffic data of the physical device through traffic mirroring. The present embodiment has no effect on the original business traffic by mirroring the traffic, thereby improving the accuracy of business path tracking.

[0053] In some embodiments, the network physical topology structure includes at least one physical device between the network and the service server in the network system, and the physical device includes a switch and a router. This step S102 includes: filtering out at least one designated target physical device from the physical devices; configuring a corresponding label for at least one collection port of the target physical device, the label is used to identify the traffic type of the traffic data collected by the collection port, and the traffic type is used to indicate the traffic source or traffic destination of the traffic data; traversing the target physical device, merging the collection ports with the same label into a traffic collection point, and using the traffic data collected by the merged collection ports as the traffic data of the traffic collection point; forming a traffic topology matrix based on the network physical topology structure, the traffic collection point and the corresponding traffic type.

[0054] In this embodiment, physical devices that meet preset deployment conditions are screened out based on the network physical topology as target physical devices, wherein the deployment conditions include master-master mode deployment and master-standby mode deployment. The physical device has at least one collection port, which is associated with different traffic data, and a corresponding label is configured for the collection port of each physical device. Exemplarily, switch A interacts with the LB device for data, and switch A has a first port for transmitting the data to be processed to the LB device, and also has a second port for receiving the data processed by the LB device. Then, for the traffic data collected at switch A, the traffic data before being processed by the LB device and the traffic data after being processed by the LB device are configured with corresponding labels according to the traffic type.

[0055] It should be noted that the label can be used to distinguish different traffic types, and the traffic type can be the traffic source or traffic destination of the traffic data, that is, the label can identify the traffic type of the traffic data collected by the collection port. Then, from the collection ports of all target physical devices, the collection ports with the same label are merged, that is, the collection ports that collect traffic data of the same traffic type are merged and defined as the same traffic collection point, and the traffic data received by the merged collection ports are merged as the traffic data of the traffic collection point. Therefore, this embodiment sets a label to filter at least one collection port related to traffic data of the same traffic type to merge into a traffic collection point, thereby improving processing efficiency. Optionally, the label can adopt the QinQ message encapsulation format, and the label can be the outermost VLAN label, and each physical device is distinguished according to the outermost VLAN label.

[0056] Furthermore, based on the network physical topology, traffic collection points and corresponding traffic types, the traffic access relationship and traffic direction between the traffic collection points are determined to form a traffic topology matrix. Figure 3 A schematic diagram of the physical topology of the network provided in the embodiment of the present application. Figure 3 LB1-1, LB1-2, LB2-1, and LB2-2 represent load balancing and NAT devices; SW1-1, SW1-2, SW2-1, SW2-2, SW3-1, SW3-2, SW4-1, and SW4-2 represent switches; and Fw1-1 and Fw 1-2 represent firewalls. The network physical topology also includes the Internet, business server 1, business server 2, and business server 3. LB1-1 and LB1-2 also have the function of SSL offloading, so that they can perform plain text analysis on traffic in the intranet and obtain the required business feature values. Figure 3 The serial number (referred to as a location point in Table 1 below) indicates the target physical device for traffic collection. In order to accurately track business traffic, a label is configured for each target physical device's collection port to distinguish it. For example, QinQ technology is used to add an external VLAN label to the traffic data collected by each collection port. The specific label configuration is shown in Table 1 below.

[0057] Table 1

[0058]

[0059] Furthermore, the collection ports with the same label are merged, that is, the collection ports that collect the same traffic type are merged and defined as the same traffic collection point. The traffic data received by the merged collection ports are merged as the traffic data of the traffic collection point, thereby obtaining 8 traffic collection points, as shown in Table 2 below.

[0060] Table 2

[0061]

[0062] It should be noted that the collection ports of label Vlan1 are merged into the traffic collection point LB1-In, which is used to collect the service traffic data of LB1 before load balancing and NAT conversion. The collection ports of label Vlan2 are merged into the traffic collection point LB1-Out, which is used to collect the traffic data of LB1 after load balancing, which is the traffic data after load balancing and NAT conversion. Here, the external network IP address is converted into the internal network IP address, realizing the first internal and external network IP address conversion. The collection ports of label Vlan3 are merged into the traffic collection point LB2-In, which is used to collect the traffic data of LB2 before load balancing. The collection ports of label Vlan4 are merged into the traffic collection point LB2-Out, which is used to collect the traffic data of LB2 after load balancing. This realizes the second NAT address conversion from internal network to internal network. The collection ports of label Vlan5 are merged into the traffic collection point FW1-In, which is used to collect the traffic data before the FW1 firewall. The collection ports of label Vlan6 are merged into the traffic collection point Fw1-Out, which is used to collect traffic data behind the FW1 firewall. The collection ports of label Vlan7 and label Vlan8 are merged into the traffic collection point Acc1, and the collection ports of label Vlan9 and label Vlan10 are merged into the traffic collection point Acc2. Acc1 and Acc2 are used to collect traffic data of the real servers at the access layer.

[0063] further, Figure 4 The schematic diagram of the structure of the flow topology matrix provided in the embodiment of the present application forms a flow topology matrix according to the configuration of the flow collection points and the network physical topology structure. And the specific flow topology relationship is shown in Table 3 below.

[0064] Table 3

[0065]

[0066] like Figure 4As shown in Table 3, LB1 is the LB1 device, LB2 is the LB2 device, and Fw1 represents the firewall. The traffic direction and traffic access relationship (i.e., traffic topology relationship) in the traffic topology matrix include: the output of the traffic collection point LB1 In is connected to the input of the traffic collection point LB1 Out, the output of the traffic collection point LB1 Out is connected to the input of the traffic collection point LB2 In, the traffic collection point Acc1, and the traffic collection point Acc2, the output of the traffic collection point LB2 In is connected to the input of the traffic collection point LB2 Out, the output of the traffic collection point LB2 Out is connected to the input of the traffic collection point Acc1 and the traffic collection point Acc2, the output of the traffic collection point Acc1 and the traffic collection point Acc2 is connected to the input of the traffic collection point LB2 In and the traffic collection point Fw1 In, the output of the traffic collection point Fw1 In is connected to the input of the traffic collection point Fw1 Out, and the output of the traffic collection point Fw1 Out is connected to the input of the traffic collection point LB2 In, the traffic collection point Acc1, and the traffic collection point Acc2.

[0067] Therefore, this embodiment realizes dynamic monitoring of traffic by merging ports for indicating the collection of traffic data of the same traffic type into one traffic collection point on one or more target physical devices, which facilitates the analysis of the dynamic trend of traffic. At the same time, it is not necessary to monitor other ports of the target physical device, so as to accurately extract traffic data related to the business path, thereby improving the efficiency and accuracy of data processing. Subsequently, a traffic topology matrix is ​​constructed based on the traffic trend and traffic access relationship between the traffic collection points, and the traffic association of the physical nodes between the network and the business server is taken into account, which improves the accuracy of the traffic topology construction and helps to improve the accuracy of the business traffic path.

[0068] Based on the above embodiments, in some embodiments, the following steps are performed through the traffic collection architecture, including: mirroring the traffic data collected by the target physical device to the input module, configuring a corresponding data identifier for the traffic data according to the label of the collection port to which it belongs, and transmitting the traffic data carrying the data identifier to the output module through the forwarding module; merging the traffic data with the same data identifier into traffic data of the traffic collection point corresponding to the data identifier through the output module.

[0069] In this embodiment, each collection port corresponds to flow data of a flow type, and a corresponding data identifier is configured for the flow data according to the label of the collection port to which it belongs. Optionally, the data identifier can adopt the QinQ message encapsulation format, and the data identifier can be the outermost VLAN tag, which is used to distinguish different flow types and flows. It should be noted that the label acting on the collection port and the data identifier acting on the flow data are a one-to-one mapping relationship, and both are used to indicate the same flow type. Then, the flow data with the same data identifier is merged, that is, the flow data collected by the collection port with the same label is merged, so as to obtain the flow data of the corresponding flow collection point. Therefore, this embodiment obtains the flow data of the flow collection point by merging the flow, thereby determining the flow access relationship and topological relationship between the flow collection points, so as to construct a flow topology matrix, thereby improving the efficiency of data collection.

[0070] In some embodiments, the generating of a service forward path based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix includes: based on the source IP data, destination IP data, source port data and destination port data contained in the traffic topology matrix and the target data packet characteristics, path splicing of the traffic collection point to determine a first path; based on the source port data of the traffic collection point in the first path, determining a second path; based on the destination IP data and source IP data of the traffic collection point in the second path, determining a third path; and splicing a network side node that matches the source port data of the head-end traffic collection point before the head-end traffic collection point of the third path, so that the service forward path is formed by the third path and the network side node.

[0071] In this embodiment, by comparing the source IP data, destination IP data, source port data and destination port data of each traffic collection point, the traffic collection points are spliced ​​to obtain the first path, the second path and the third path. Further, due to the lack of tracing of the access IP address of the Internet external network (network side), the source of the external network IP address can be traced by inserting XFF at the head end traffic collection point of the third path and keeping the source port unchanged, that is, configuring the network side node consistent with the source port data of the head end traffic collection point of the third path. It should be noted that the XXF inserted in the business data packet at the Internet entrance of this embodiment does not affect the business transaction and realizes the restoration of the business path. Therefore, this embodiment generates the first path, the second path and the third path through the traffic topology matrix and the target data packet characteristics, thereby forming a business forward path, realizing the restoration of the business access to each traffic collection point, and improving the restoration degree and accuracy of the business path.

[0072] In some embodiments, the first path includes a first access path and a second access path; the path splicing of the traffic collection points based on the source IP data, destination IP data, source port data and destination port data included in the traffic topology matrix and the target data packet characteristics to determine the first path includes: when it is detected that any two traffic collection points are completely consistent in source IP data, destination IP data, source port data and destination port data, splicing the currently detected traffic collection points according to the traffic topology matrix to form a first access path; when it is detected that any two traffic collection points are consistent in source IP data, destination IP data and destination port data, but inconsistent in source port data, splicing the currently detected traffic collection points according to the traffic topology matrix to form a second access path; when it is detected that the terminal traffic collection point in the current first access path and / or the second access path is a server access node, splicing a server node that matches the destination IP data of the server access node after the detected terminal traffic collection point of the first path to update the first path.

[0073] In this embodiment, optionally, if the source IP data, destination IP data, source port data and destination port data of any two traffic collection points are exactly the same, the two traffic collection points are spliced ​​to form a first access path. Optionally, if any two traffic collection points are consistent in source IP data, destination IP data and destination port data, but inconsistent in source port data, the two traffic collection points are spliced ​​to form a second access path. Among them, the first access path and the second access path may include at least two traffic collection points. It should be noted that after the above steps, after the first path is formed, it is detected that the end traffic collection point of the first path is a server access node (such as traffic collection points ACC1, ACC2), then at the location of each server access node, the destination IP address of the server access node is added as a new server node to the current first path to update the first path. Therefore, this embodiment generates and updates the first path by comparing the source IP data, destination IP data, source port data and destination port data, thereby improving the accuracy of the service path and the path restoration degree.

[0074] In some embodiments, determining the second path based on the source port data of the traffic collection point in the first path includes: when it is detected that the source port data of the end traffic collection point in any first path is consistent with the source port data of the head-end traffic collection point in other first paths, splicing the detected end traffic collection point with the head-end traffic collection point to obtain the second path.

[0075] In this embodiment, the end flow collection point of each first path is compared with the head end flow collection point of other first paths for source port data, and when they are consistent, they are spliced ​​to form a second path. Therefore, this embodiment forms a second path by comparing the source port data of the nodes on the first path, thereby improving the restoration degree and accuracy of the path.

[0076] In some embodiments, the determining of the third path based on the destination IP data and source IP data of the traffic collection point in the second path includes: when it is detected that the destination IP data of the node at the end of any second path is consistent with the source IP data of the head-end traffic collection point in other second paths, the detected node at the end of the second path is spliced ​​with the head-end traffic collection point to obtain the third path, and the node is one of the traffic collection point and the server node.

[0077] In this embodiment, the destination IP data of the end node (which may be a traffic collection point or a server node) of each second path is compared with the source IP data of the head-end traffic collection point of other second paths. When they are consistent, they are spliced ​​to form a third path. Therefore, this embodiment forms a third path by comparing the destination IP data and source IP data of the nodes on the second path, thereby improving the restoration degree and accuracy of the path.

[0078] For example, some core businesses have slow transactions from 9:45:23 to 9:50:50 in the morning. The serial number of one of the problematic businesses is: MSI20240805094523000000895, and the business occurred at 9:46:15. In order to accurately obtain the time point, the detailed information of each traffic collection point of the note transaction is extended by 2 seconds before and after the time. The query time range is: 9:46:13 to 9:46:17, so as to match the target data packet features of the traffic collection point in the traffic feature library, as shown in Table 4 below, where the target data packet features are marked with S to represent the source address, D to represent the destination address, P to represent the protocol, N to represent the destination system name, Ng to represent the Nginx reverse proxy, and v to represent the load-balanced Virtual Service.

[0079] Table 4

[0080]

[0081] further, Figure 5 The schematic diagram of the first access path provided in the embodiment of the present application is that when the source IP, destination IP, source port, and destination port of any two traffic collection points are exactly the same, the traffic collection points are concatenated to obtain the first access path. Figure 5As shown, four first access paths are formed, which are respectively from the traffic collection point LB2 Out, Acc 1, and the server node (i.e. Figure 5 The first access path formed by the traffic collection point Acc 1, Fw1 In, Fw1 Out, Acc 2, and the server node, the first access path formed by the traffic collection point Acc 2 and LB2 In, and the first access path formed by the traffic collection point LB2 Out, Acc 2, and the server node.

[0082] Figure 6 The schematic diagram of the second access path provided in the embodiment of the present application is that when the source IP, destination IP, and destination port of any two traffic collection points are exactly the same, the traffic collection points are spliced ​​to obtain the second access path. Figure 6 As shown, a second access path is formed, that is, the second access path formed by the traffic collection points LB1 Out and LB2 In.

[0083] further, Figure 7 A schematic diagram of a second path provided in an embodiment of the present application, when it is detected that the source port of the end flow collection point in the first path is consistent with the source port of the head end flow collection point in other first paths, the first paths are spliced ​​to obtain the second path. Figure 7 As shown, three second paths are formed, namely, the second path formed by the traffic collection points LB1 Out, LB2 In, LB2 Out, Acc 1, and the server node, the second path formed by the traffic collection points Acc 1, Fw1 In, Fw1Out, Acc 2, and the server node, and the second path formed by the traffic collection points Acc 2, LB2 In, LB2 Out, Acc 2, and the server node. Further, Figure 8 The schematic diagram of the third path provided in the embodiment of the present application, when it is detected that the destination IP of the server node in the second path is consistent with the source IP of the head-end traffic collection point in other second paths, the second paths are spliced ​​to obtain the third path. Figure 8 As shown, the third path is from traffic collection point LB1 Out, LB2 In, LB2 Out, Acc 1, server node, Acc 1, Fw1 In, Fw1 Out, Acc 2, server node, Acc2, LB2 In, LB2 Out, Acc 2, server node.

[0084] Going further, Fig. 9The structural diagram of the business forward path provided in the embodiment of the present application lacks the tracing of the Internet external network (network side) access IP address. By inserting XFF at the head-end traffic collection point of the third path and keeping the source port unchanged, that is, configuring and adding a network side node (that is, traffic collection point LB1Out, S: 183.2.172.185: 12176, D: 121.14.77.201: 443) before the head-end traffic collection point LB1 Out (S: 11.16.244.42: 12176, D: 11.16.130.17: 80 (vs)) of the third path, the external network IP address is traced to form a second business traffic path.

[0085] In some embodiments, the system troubleshooting result indicating whether the network system has a fault is determined based on the business traffic path and the target performance indicator, including: if it is detected that the target performance indicator of the traffic collection point does not meet the preset normal performance conditions, the access section where the abnormal traffic collection point is currently located is marked with a corresponding abnormal identification; wherein the access section is the path between any server node on the business traffic path or the network side node to the subsequent server node; the business traffic path and the abnormal identification are displayed on the network physical topology structure, and based on the abnormal identification, it is determined whether the network system has a fault, and a corresponding system troubleshooting result is generated.

[0086] In this embodiment, the service traffic path (such as the service forward path) is divided into one or more access sections, the starting point of each access section can be a server node or a network side node, and the end point of each access section in the service traffic path is the server node after the starting point, so that the access section is formed according to the path between the starting point and the end point. Thus, each access section is traversed to detect whether the target performance index of the traffic collection point on the access section meets the preset normal performance condition, and if it does not meet the condition, the corresponding abnormal point and the access section where it is located are marked to facilitate subsequent troubleshooting and positioning.

[0087] In addition, if Fig.10As shown, the target performance indicators of the service traffic path and the traffic collection point (such as server round-trip delay, client round-trip delay, packet loss rate, retransmission rate, reset rate, no response rate, average response time, maximum response time and number of zero windows) are superimposed and displayed, which can intuitively determine whether a network system failure occurs, thereby improving the efficiency of troubleshooting. In addition, the service traffic path and abnormal identification are displayed on the network physical topology structure to determine whether the network system fails, so as to quickly and intuitively locate whether a network system failure occurs. Therefore, this embodiment detects the target performance indicators of the traffic collection point on each access section, thereby marking abnormal points and access sections, thereby improving the efficiency of troubleshooting.

[0088] Fig.11 The structure diagram of a business dynamic path tracking device provided in an embodiment of the present application is as follows. The business dynamic path tracking device 200 includes:

[0089] The data acquisition module 201 is used to acquire the network physical topology structure of the network system; the traffic topology construction module 202 is used to determine the traffic topology matrix based on the network physical topology structure, wherein the traffic topology matrix is ​​used to indicate at least one traffic collection point and the traffic access relationship between the traffic collection points, and the traffic collection point is used to indicate the collection of traffic data of any traffic type; the traffic feature library construction module 203 is used to parse the traffic data collected by the traffic collection point to obtain traffic feature data, and establish a traffic feature library based on the traffic feature data of the traffic collection point and the corresponding traffic collection time, wherein the traffic feature data includes data The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention. The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention. The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention. The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention. The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention. The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention. The invention relates to a method for preparing a network structure of the present invention and a method for preparing a network structure of the present invention.

[0090] The specific implementation of the service dynamic path tracing device of the present application is basically the same as the specific implementation of the service dynamic path tracing method described above, and will not be repeated here.

[0091] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for tracing a business dynamic path, characterized in that: include: Obtain the network physical topology of the network system; Based on the network physical topology structure, determine a traffic topology matrix, wherein the traffic topology matrix is ​​used to indicate at least one traffic collection point and a traffic access relationship between the traffic collection points, and the traffic collection point is used to indicate the collection of traffic data of any traffic type; Analyze the traffic data collected by the traffic collection point to obtain traffic characteristic data, and establish a traffic characteristic library based on the traffic characteristic data of the traffic collection point and the corresponding traffic collection time, wherein the traffic characteristic data includes data packet characteristics, performance indicators and service characteristics; When a service anomaly is detected, the service data of the abnormal service is obtained, and the target data packet characteristics and target performance indicators of the traffic collection point corresponding to the service data are matched in the traffic feature library, wherein the service data includes the service execution time and the target service characteristics; Based on the target data packet characteristics of the traffic collection point and the traffic topology matrix, a service traffic path is determined, and the service traffic path includes a service forward path and a service reverse path, including: based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix, a service forward path is generated; based on the service forward path, a mapping relationship of each traffic collection point with respect to the target data packet characteristics is determined, and a service reverse path is formed according to the mapping relationship, wherein the target data packet characteristics include source IP data, destination IP data, source port data and destination port data, and the mapping relationship is used to indicate the data response status of the traffic collection point; Based on the service traffic path and the target performance indicator, a system troubleshooting result is determined to indicate whether a fault occurs in the network system.

2. The business dynamic path tracing method according to claim 1, characterized in that: The network physical topology structure includes at least one physical device between the network and the service server in the network system, and the physical device includes a switch and a router; The determining of a traffic topology matrix based on the network physical topology structure includes: Filtering out at least one designated target physical device from the physical devices; Configuring a corresponding label for at least one collection port of the target physical device, wherein the label is used to identify a traffic type of the traffic data collected by the collection port, and the traffic type is used to indicate a traffic source or a traffic destination of the traffic data; Traversing the target physical device, merging collection ports with the same label into a flow collection point, and using the flow data collected by the merged collection ports as the flow data of the flow collection point; A traffic topology matrix is ​​formed based on the network physical topology structure, the traffic collection points and the corresponding traffic types.

3. The business dynamic path tracing method according to claim 2, characterized in that: The method further comprises: Using a pre-built traffic collection architecture, collecting traffic data of the traffic collection point; The traffic collection architecture includes an input layer, a forwarding layer and an output layer arranged in sequence, the input layer includes a plurality of input modules, the forwarding layer includes a plurality of forwarding modules, the output layer includes a plurality of output modules, and the input modules and the output modules are respectively connected to the forwarding modules; The following steps are performed by the traffic collection architecture, including: Mirroring the traffic data collected by the target physical device to the input module, configuring corresponding data identifiers for the traffic data according to the labels of the corresponding collection ports, and transmitting the traffic data carrying the data identifiers to the output module through the forwarding module; The output module combines the flow data with the same data identifier into flow data of the flow collection point corresponding to the data identifier.

4. The business dynamic path tracing method according to claim 3, characterized in that: The generating of a service forward path based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix includes: Based on the traffic topology matrix and the source IP data, destination IP data, source port data, and destination port data included in the target data packet characteristics, path splicing is performed on the traffic collection points to determine a first path; Determining a second path based on source port data of traffic collection points in the first path; Determine a third path based on the destination IP data and the source IP data of the traffic collection point in the second path; A network side node matching the source port data of the head-end traffic collection point is spliced ​​before the head-end traffic collection point of the third path, so as to form a service forward path by the third path and the network side node.

5. The business dynamic path tracing method according to claim 4, characterized in that: The first path includes a first access path and a second access path; the flow collection point is path spliced ​​based on the flow topology matrix and the source IP data, the destination IP data, the source port data and the destination port data included in the target data packet characteristics to determine the first path, including: When it is detected that any two traffic collection points are completely consistent in source IP data, destination IP data, source port data and destination port data, the currently detected traffic collection points are spliced ​​according to the traffic topology matrix to form a first access path; When it is detected that any two traffic collection points are consistent in source IP data, destination IP data and destination port data, but inconsistent in source port data, the currently detected traffic collection points are spliced ​​according to the traffic topology matrix to form a second access path; When it is detected that the terminal traffic collection point in the current first access path and / or the second access path is a server access node, a server node matching the destination IP data of the server access node is spliced ​​after the detected terminal traffic collection point of the first path to update the first path.

6. The business dynamic path tracing method according to claim 5, characterized in that: The determining the second path based on the source port data of the traffic collection point in the first path includes: When it is detected that the source port data of the terminal flow collection point in any first path is consistent with the source port data of the head end flow collection point in other first paths, the detected terminal flow collection point is spliced ​​with the head end flow collection point to obtain a second path.

7. The business dynamic path tracing method according to claim 6, characterized in that: The determining of the third path based on the destination IP data and the source IP data of the traffic collection point in the second path includes: When it is detected that the destination IP data of the node at the end of any second path is consistent with the source IP data of the head-end traffic collection point in other second paths, the node at the end of the detected second path is spliced ​​with the head-end traffic collection point to obtain a third path, and the node is one of the traffic collection point and the server node.

8. The business dynamic path tracing method according to claim 7, characterized in that: The determining, based on the service traffic path and the target performance indicator, a system troubleshooting result indicating whether a fault occurs in the network system includes: If it is detected that the target performance index of the traffic collection point does not meet the preset normal performance condition, the access section where the abnormal traffic collection point is currently located is marked with a corresponding abnormal identifier; wherein the access section is a path between any server node on the service traffic path or the network side node to a subsequent server node; The service traffic path and the abnormal identification are displayed on the network physical topology structure, and whether the network system fails is determined based on the abnormal identification to generate corresponding system troubleshooting results.

9. A business dynamic path tracking device, characterized in that: include: A data acquisition module, used to acquire the network physical topology structure of the network system; A traffic topology building module, used to determine a traffic topology matrix based on the network physical topology structure, wherein the traffic topology matrix is ​​used to indicate at least one traffic collection point and the traffic access relationship between the traffic collection points, and the traffic collection point is used to indicate the collection of traffic data of any traffic type; A traffic feature library building module is used to parse the traffic data collected by the traffic collection point to obtain traffic feature data, and to build a traffic feature library based on the traffic feature data of the traffic collection point and the corresponding traffic collection time, wherein the traffic feature data includes data packet features, performance indicators and service features; A data matching module is used to obtain the service data of the abnormal service when a service anomaly is detected, and match the target data packet characteristics and target performance indicators of the traffic collection point corresponding to the service data in the traffic feature library, wherein the service data includes the service execution time and the target service characteristics; A path construction module is used to determine a service traffic path based on the target data packet characteristics of the traffic collection point and the traffic topology matrix, wherein the service traffic path includes a service forward path and a service reverse path, including: generating a service forward path based on the target data packet characteristics of the traffic collection point and the traffic access relationship indicated by the traffic topology matrix; determining a mapping relationship of each traffic collection point with respect to the target data packet characteristics based on the service forward path, and forming a service reverse path based on the mapping relationship, wherein the target data packet characteristics include source IP data, destination IP data, source port data and destination port data, and the mapping relationship is used to indicate the data response status of the traffic collection point; A system troubleshooting module is used to determine a system troubleshooting result indicating whether a fault occurs in the network system based on the service traffic path and the target performance indicator.

Images