Fault diagnosis method and device based on remote packet capture and storage medium

Abstract

The invention discloses a fault diagnosis method and device based on remote packet capture, and a storage medium, and the method comprises the steps: carrying out the packet capture at an LAN / WAN port of a CPE, and carrying out the analysis of a data packet through a Wreshark tool; comprising the steps that a mirror image configuration command and a package capture command are issued through a yang file, and management operation of a network administrator is facilitated; after the local router receives the related configuration issued by the yang, on the local router, the packet capturing is realized according to the configuration and is stored on the router, the current packet capturing state can be showed, and the packet capturing message can be output by using a command show; the router uploads the file to the DC controller after capturing the packet; after the DC controller receives the message, the content of the message can be analyzed so as to assist developers to diagnose fault reasons. According to the invention, real-time packet capture becomes simple, is not limited by whether a person is on site or not, is not limited by whether a physical port is connected with a mirror image or not, and can directly and remotely capture packets and transmit the packets to the controller in real time, so that messages of a fault site can be rapidly captured, and fault analysis is assisted.

Description

Technical Field

[0001] The present invention relates to the technical field of remote fault diagnosis, and in particular to a fault diagnosis method, device and storage medium based on remote packet capture. Background Art

[0002] One of the key demands for networks in the cloud era is network automation, which is not only about configuration automation. For fault diagnosis, it is also hoped that the controller can capture and analyze user traffic or network traffic. Therefore, it is necessary to support interface or flow-based packet capture, store messages on the router, support sending commands to devices through the controller, and support sending files to the controller so that the captured messages can be parsed on the controller to help analyze and solve faults. Summary of the invention

[0003] The present invention proposes a fault diagnosis method, device and storage medium based on remote packet capture, which can solve at least one of the technical problems in the background technology. Specifically, when personnel are not at the fault site, or do not have the mirroring function to capture packets, and need to capture packets in real time to assist in rapid fault analysis, the method of the present invention can be used as a means of fault diagnosis.

[0004] To achieve the above object, the present invention adopts the following technical solutions: A fault diagnosis method based on remote packet capture includes capturing packets at the LAN / WAN port of a CPE and analyzing the data packets using a Wireshark tool; the method includes the following steps: S1: Send configuration mirroring commands and packet capture commands through yang files to facilitate management operations of network administrators; S2: After the local router receives the relevant configuration sent by Yang, it can capture packets according to the configuration and store them on the router. It can also show the current status of packet capture and use commands to show the captured packets. S3: After the router captures the packet, it sends the file to the DC controller; S4: After receiving the message, the DC controller can parse the message content to assist developers in diagnosing the cause of the fault.

[0005] Furthermore, step S1 includes Netconf enabling packet capture, including commands: port mirroring, ACL flow mirroring, packet capture enable / disable, and Netconf is used to issue the above commands to the device.

[0006] Furthermore, in step S3, the controller may query the packet capture completion status on the device. If the controller finds that the packet capture is completed, the controller may actively obtain the captured content from the device.

[0007] Furthermore, in step S3, the controller may query the name of the packet capture file stored on the device, and the controller may determine the file to be obtained according to the name of the packet capture file.

[0008] Furthermore, in step S3, a PCAP packet capture file with a specified name is uploaded to the controller via FTP.

[0009] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0010] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0011] It can be seen from the above technical scheme that the fault diagnosis method based on remote packet capture of the present invention, compared with the prior art, can make real-time packet capture simple, is not limited by whether there are personnel on site, is not limited by whether there are physical port connection mirrors, etc., and can directly capture packets remotely and transmit them to the controller in real time to help quickly capture the messages at the fault site and assist in fault analysis.

[0012] Specifically, when there are personnel on site but mirroring is not possible, you can enable the packet capture function to directly capture and store the messages on the device, and then download the messages to analyze the cause of the fault based on the messages. When there are no personnel on site and mirroring is not possible, you can enable this function on the controller to send commands to the device, and then let the device send the captured messages to the controller via FTP so that developers can unpack them and analyze the cause of the fault. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is the actual networking environment of remote packet capture in the present invention; Figure 2 It is a schematic diagram of the use of remote packet capture in the present invention; Figure 3 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0014] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0015] The fault diagnosis method based on remote packet capture described in this embodiment includes capturing packets at the LAN / WAN port of the CPE and analyzing the data packets using the Wireshark tool; S1: Send configuration mirroring commands and packet capture commands through yang files to facilitate management operations of network administrators; S2: After the local router receives the relevant configuration sent by Yang, it can capture packets according to the configuration and store them on the router. It can also show the current status of packet capture and use commands to show the captured packets. S3: After the router captures the packet, it sends the file to the DC controller; S4: After receiving the message, the DC controller can parse the message content to assist developers in diagnosing the cause of the fault.

[0016] The following are specific instructions: 1. Netconf enables packet capture, including port mirroring, ACL flow mirroring, and packet capture enable / disable. You can use Netconf to issue the above commands to the device; 2. The controller can query the packet capture completion status on the device. If the controller finds that the packet capture is completed, it can also actively obtain the captured content from the device; 3. The controller can query the name of the captured file stored on the device. Since multiple captures can be performed, the captured files are named by time. The controller can determine the file to be obtained based on the name of the captured file. 4. You can upload the PCAP packet capture file with the specified name to the controller via FTP. sFTP is preferred. There are several ways to upload the message to the controller. The above sFTP is the main method. 5. The controller can obtain the PCAP packet capture file with the specified name through Netconf, and the controller can also actively obtain the required packet capture file from the device; 6. Use configuration commands directly on the device to enable packet capture, including port mirroring, ACL flow mirroring, and packet capture enable / disable. If there are personnel on site, you can also manually configure related commands directly on the device without going through the controller; 7. The packet capture completion status on the device can be queried on the device. If there are personnel on site, the packet capture completion status on the device can be manually queried directly on the device without going through the controller; 8. The name of the captured packet file stored on the device can be queried on the device. If there are personnel on site, the name of the captured packet file stored on the device can be manually queried directly on the device without going through the controller; 9. The captured messages can be displayed on the device. If there are personnel on site, they can directly query the content of a specific message stored on the device that is suspected to have a problem and cause the fault. 10. You can capture the messages of a certain port, or capture the corresponding messages based on ACL to reduce the amount of messages captured and improve the efficiency of fault analysis.

[0017] like Figure 1 As shown, the device whose packets are captured needs to be under the jurisdiction of the DC controller in order to remotely capture packets in real time. Otherwise, the invented method can only be used to capture packets without the purpose of mirroring.

[0018] like Figure 2 As shown, the source of packet capture in the present invention can be on the user side or on the network side, and the inbound and outbound traffic can be captured at the same time for use in message comparison. Figure 2 The following are specific points where packets can be captured. These points are where faults are prone to occur. Capturing packets at these locations can improve the fault detection rate.

[0019] like Figure 3 As shown in the figure, it is a packet capture process of an embodiment of the present invention. The DC controller sends a packet capture or stop command, and the router takes corresponding actions. Then the captured information is formed and stored in a txt file and transmitted to the SDC controller. The controller converts it into a pcap file and parses it for analysis.

[0020] In general, the fault diagnosis method based on remote packet capture in the embodiment of the present invention has the following characteristics: any type of controller can be used to issue commands to the device, and the relevant commands can be directly configured on the rack. The captured packets can be directly viewed on the local router for analysis. The controller can access the packet capture files stored on the packet capture device at any time. The controller can write and analyze the packets.

[0021] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0022] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0023] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any of the fault diagnosis methods based on remote packet capture in the above embodiments.

[0024] It is understandable that the system, device and storage medium provided in the embodiments of the present invention correspond to the method provided in the embodiments of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above methods.

[0025] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0026] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0027] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0028] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A fault diagnosis method based on remote packet capture, characterized in that: This includes capturing packets at the LAN / WAN port of the CPE and analyzing the data packets using the Wireshark tool; The following steps are included: S1: Send configuration mirroring commands and packet capture commands through yang files to facilitate management operations of network administrators; S2: After the local router receives the relevant configuration sent by Yang, it can capture packets according to the configuration and store them on the router. It can also show the current status of packet capture and use commands to show the captured packets. S3: After the router captures the packet, it sends the file to the DC controller; S4: After receiving the message, the DC controller can parse the message content to assist developers in diagnosing the cause of the fault.

2. The fault diagnosis method based on remote packet capture according to claim 1 is characterized in that: Step S1 includes Netconf enabling packet capture, including commands: port mirroring, ACL flow mirroring, packet capture enable / disable, and Netconf is used to issue the above commands to the device.

3. The fault diagnosis method based on remote packet capture according to claim 1 is characterized in that: In step S3, the controller may query the packet capture completion status on the device. If the controller finds that the packet capture is completed, it may also actively obtain the captured content from the device.

4. The fault diagnosis method based on remote packet capture according to claim 1 is characterized in that: In step S3, the controller may query the name of the packet capture file stored on the device, and may determine the file to be obtained based on the name of the packet capture file on the controller.

5. The fault diagnosis method based on remote packet capture according to claim 1 is characterized in that: In step S3, the PCAP packet capture file with the specified name is uploaded to the controller via FTP.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 5.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the computer program is executed by the processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 5.

Images