Network fault diagnosis method and device, storage medium and electronic equipment

Abstract

The invention provides a network fault diagnosis method and device, a storage medium and electronic equipment, and belongs to the technical field of security, and the method comprises the steps: determining the address information of a target virtual machine when a service fault of the target virtual machine occurs, and determining a target server where the target virtual machine is located according to the address information; determining equipment link information, wherein the equipment link information comprises a link relationship among the physical nodes; determining a link topology of the target virtual machine based on the target server and the equipment link information; obtaining a TCP message of each physical node based on the port mirror image; determining a service forwarding path of the target virtual machine based on the mirrored TCP message and the link topology; and carrying out fault positioning based on the TCP message of each physical node on the service forwarding path to obtain a fault link. By applying the method provided by the invention, the automatic positioning of the virtual machine can be realized, the service forwarding path can be restored, and the fault diagnosis can be carried out by using the mirrored TCP message, so that the fault diagnosis efficiency and accuracy can be improved, and the diagnosis cost can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a network fault diagnosis method and device, a storage medium and an electronic device. Background Art

[0002] With the development of digital finance, data centers have become one of the important infrastructures for financial institutions to provide financial services. During the operation of data centers, it is usually necessary to monitor the network status. When a network failure occurs, it is necessary to diagnose the network failure, identify the fault location, and handle the failure.

[0003] At present, optical splitters and probes are usually deployed at the network boundary points in advance to collect key business packets at the network boundary points. When network fault diagnosis is required, the network topology is restored according to the link relationship between switches and switches, switches and servers in the network, and fault diagnosis is performed based on the network topology and the captured key business packets.

[0004] However, due to the growth of business data volume, the network facilities of data centers are gradually developing towards cloudification and virtualization, that is, the network facilities of data centers are gradually composed of physical devices and virtual machines (VM). Based on the existing network fault diagnosis methods, when a virtual machine fails, it is necessary to manually query the link relationship of the virtual machine one by one to obtain the access location of the virtual machine and determine the association between the virtual machine and the server before fault diagnosis can be performed. The fault diagnosis process requires a lot of time and manpower, making the fault diagnosis efficiency low. Secondly, the deployment of splitters and probes requires a certain cost, and the overhead of network fault diagnosis is relatively large. In general, equipment is deployed only at key boundary points of the network to capture business packets. The captured business packets can restore limited data paths, making it difficult to quickly locate the fault point. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a network fault diagnosis method to solve the problem that when fault diagnosis of a cloud network is performed based on the existing method, it is necessary to manually query the link relationship of the virtual machine device by device, which takes a lot of time and requires the deployment of equipment such as splitters, resulting in low fault diagnosis efficiency and high cost.

[0006] The embodiment of the present invention also provides a network fault diagnosis device to ensure the actual implementation and application of the above method.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] A network fault diagnosis method, comprising:

[0009] When a virtual machine in the network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0010] Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers;

[0011] Determine the device link information corresponding to the network platform; the device link information includes the link relationship between each of the physical nodes;

[0012] Determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0013] Determine the mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP;

[0014] Determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0015] Each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the fault location of the service forwarding path is performed to obtain the fault link on the service forwarding path.

[0016] In the above method, optionally, the determining the address information corresponding to the target virtual machine includes:

[0017] Obtaining service failure information corresponding to the target virtual machine;

[0018] Parse the service fault reporting information to obtain the source IP address and destination IP address corresponding to the target virtual machine;

[0019] The source IP address and the destination IP address are used as the address information.

[0020] The above method, optionally, locating the target virtual machine based on the address information to determine the target server where the target virtual machine is located among the multiple servers, includes:

[0021] Creating an interface call request according to the address information; the interface call request is used to request to query the server information corresponding to the target virtual machine;

[0022] Based on the interface call request, calling a preset application programming interface;

[0023] Receiving the server information returned by the application programming interface, and parsing the server information to obtain a server identifier;

[0024] The server among the servers that matches the server identifier is used as the target server.

[0025] In the above method, optionally, the determining the device link information corresponding to the network platform includes:

[0026] Determine neighbor information corresponding to each of the physical nodes based on a link layer discovery protocol;

[0027] According to the neighbor information corresponding to each of the physical nodes, the link relationship between the physical nodes is determined to determine the device link information.

[0028] In the above method, optionally, the port mirroring function is a mirroring function deployed based on local encapsulation remote switch port mirroring ERSPAN.

[0029] The above method, optionally, determining the service forwarding path corresponding to the target virtual machine based on each of the mirror messages and the link topology includes:

[0030] Perform traffic path restoration on the network platform based on each of the mirrored messages to obtain each traffic path corresponding to the network platform;

[0031] Based on the link topology, a traffic path corresponding to the target virtual machine is determined in each traffic path, and the traffic path corresponding to the target virtual machine is used as the service forwarding path.

[0032] The above method, optionally, locating the fault of the service forwarding path based on the mirrored messages corresponding to each of the target physical nodes to obtain the faulty link on the service forwarding path includes:

[0033] According to the mirror message corresponding to each of the target physical nodes, a TCP port connectivity test is performed on each of the target physical nodes to obtain a connectivity test result of each of the target physical nodes;

[0034] Based on the connectivity test results of each of the target physical nodes, determining a physical node that fails the connectivity test among each of the target physical nodes;

[0035] The physical node that fails the connectivity test is regarded as an abnormal node on the service forwarding path, and the link corresponding to the abnormal node is regarded as the faulty link.

[0036] A network fault diagnosis device, comprising:

[0037] A first determination unit is used to, when a virtual machine in a network platform has a service failure, use the virtual machine with the service failure as a target virtual machine and determine address information corresponding to the target virtual machine; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0038] A virtual machine positioning unit, configured to locate the target virtual machine based on the address information, so as to determine a target server where the target virtual machine is located among the multiple servers;

[0039] A second determining unit is used to determine the device link information corresponding to the network platform; the device link information includes the link relationship between each of the physical nodes;

[0040] A third determining unit, configured to determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0041] The fourth determination unit is used to determine the mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP;

[0042] A fifth determining unit, configured to determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0043] The fault location unit is used to take each physical node on the service forwarding path as a target physical node, and based on the mirror message corresponding to each target physical node, locate the fault of the service forwarding path to obtain the fault link on the service forwarding path.

[0044] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned network fault diagnosis method.

[0045] An electronic device comprises a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors as the above-mentioned network fault diagnosis method.

[0046] A network fault diagnosis method provided based on the above-mentioned embodiment of the present invention includes: when a virtual machine in a network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and the address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; the target virtual machine is located based on the address information to determine the target server where the target virtual machine is located among the multiple servers; the device link information corresponding to the network platform is determined; the device link information includes the link relationship between each physical node; based on the target server and the device link information, the link topology corresponding to the target virtual machine is determined; the mirror message corresponding to each physical node is determined; each mirror message is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP; based on each mirror message and the link topology, the service forwarding path corresponding to the target virtual machine is determined; each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the service forwarding path is fault located to obtain the fault link on the service forwarding path. By applying the method provided in the embodiment of the present invention, the server where the virtual machine is located can be located based on the address information of the virtual machine, and the link topology corresponding to the virtual machine can be determined by combining the corresponding relationship between the virtual machine and the server and the link relationship between each physical node. The TCP messages of each physical node are collected through port mirroring, and the service forwarding path corresponding to the virtual machine is determined by combining the TCP messages of each physical node and the link topology corresponding to the virtual machine, and the TCP messages of each physical node on the service forwarding path are used to locate the faulty link. In the fault diagnosis process, the link topology corresponding to the virtual machine can be automatically restored, and the TCP messages of each physical node can be used to realize fault location, without manually querying the link relationship of the virtual machine from each device, which is conducive to improving the efficiency of fault diagnosis. Secondly, the fault location is realized by TCP messages collected by port mirroring, and there is no need to deploy devices such as splitters and probes in the network platform, which is conducive to reducing costs. In addition, based on the TCP messages of each physical node, the traffic path of each hop can be restored, which is conducive to improving the speed and accuracy of fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0048] Figure 1A method flow chart of a network fault diagnosis method provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of a virtual machine access location restoration process provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of a TCP message mirroring process provided by an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of a network fault diagnosis process provided by an embodiment of the present invention;

[0052] Figure 5 A schematic diagram of the structure of a network fault diagnosis device provided by an embodiment of the present invention;

[0053] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0056] The embodiment of the present invention provides a network fault diagnosis method, which can be applied to a network fault diagnosis system, and the execution subject can be a server that deploys the network fault diagnosis system. The method flow chart of the method is as follows: Figure 1 As shown, including:

[0057] S101: When a virtual machine in a network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0058] The method provided by the embodiment of the present invention is applied to a network fault diagnosis scenario of a cloud-based network platform, where multiple virtual machines and multiple physical nodes are deployed, and each physical node includes physical devices such as switches and servers.

[0059] When the server of the network fault diagnosis system receives a service failure report from a virtual machine, the virtual machine with the service failure report can be used as the target virtual machine to locate and diagnose the network failure corresponding to the target virtual machine. First, the system can parse the address information of the target virtual machine to obtain the address information corresponding to the target virtual machine.

[0060] S102: Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers;

[0061] In the method provided in the embodiment of the present invention, the virtual machine information associated with each server in the network platform can be obtained first, and based on the matching of the address information of the target virtual machine with the information of each virtual machine, the server associated with the target virtual machine can be found to determine the target server where the target virtual machine is located, that is, the server to which the target virtual machine is connected.

[0062] S103: Determine the device link information corresponding to the network platform; the device link information includes the link relationship between each of the physical nodes;

[0063] In the method provided by the embodiment of the present invention, the link relationship between each physical device of the network platform can be detected based on a pre-set link discovery strategy, that is, the connection relationship between each physical device and other physical devices can be identified to obtain the link relationship between each physical node, which can specifically include the link relationship between a switch and a server, and the link relationship between switches. The link relationship between each physical node is used as the device link information corresponding to the network platform.

[0064] S104: Determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0065] In the method provided by the embodiment of the present invention, based on the link relationship between each physical node in the target server and the device link information, the physical nodes directly connected to the target server and the physical nodes indirectly connected to the target server are determined, so as to restore the physical network topology corresponding to the target server. On the basis of the physical network topology, combined with the association relationship between the target virtual machine and the target server, the link topology corresponding to the target virtual machine can be constructed.

[0066] S105: Determine a mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP;

[0067] In the method provided in the embodiment of the present invention, the port mirroring function is deployed in the network platform in advance based on the port mirroring technology, and the port mirroring is enabled in each switch. During the operation of the switch, the original message flowing through the switch port will be transmitted to the server of the network fault analysis system according to the predetermined port mirroring protocol. In the embodiment of the present invention, the original message that needs to be mirrored is the message of the control plane of the Transmission Control Protocol (TCP) between devices.

[0068] In the method provided by the embodiment of the present invention, during the network fault diagnosis process, the system can read the mirrored messages of each physical node collected through port mirroring.

[0069] S106: Determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0070] In the method provided by the embodiment of the present invention, based on the message data of each mirror message, the physical nodes through which the same message content flows in the link topology are identified, so as to restore the path of the message flow in the link topology, thereby identifying the traffic path corresponding to the target virtual machine and obtaining the service forwarding path corresponding to the target virtual machine.

[0071] S107: Taking each physical node on the service forwarding path as a target physical node, and locating the fault of the service forwarding path based on the mirror message corresponding to each target physical node, to obtain the faulty link on the service forwarding path.

[0072] In the method provided by the embodiment of the present invention, the message data of the mirror message of each physical node in the service forwarding path is used to detect whether the TCP communication between each physical node and the physical node with which it communicates is normal, so as to identify which link in the service forwarding path has abnormal network communication, and the link with abnormal communication is regarded as a faulty link.

[0073] Based on the method provided by the embodiment of the present invention, when a virtual machine in a network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and the address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; the target virtual machine is located based on the address information to determine the target server where the target virtual machine is located among the multiple servers; the device link information corresponding to the network platform is determined; the device link information includes the link relationship between each physical node; based on the target server and the device link information, the link topology corresponding to the target virtual machine is determined; the mirror message corresponding to each physical node is determined; each mirror message is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP; based on each mirror message and the link topology, the service forwarding path corresponding to the target virtual machine is determined; each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the service forwarding path is fault located to obtain the fault link on the service forwarding path. By applying the method provided in the embodiment of the present invention, the server where the virtual machine is located can be located based on the address information of the virtual machine, and the link topology corresponding to the virtual machine can be determined by combining the corresponding relationship between the virtual machine and the server and the link relationship between each physical node. The TCP messages of each physical node are collected through port mirroring, and the service forwarding path corresponding to the virtual machine is determined by combining the TCP messages of each physical node and the link topology corresponding to the virtual machine, and the TCP messages of each physical node on the service forwarding path are used to locate the faulty link. In the fault diagnosis process, the link topology corresponding to the virtual machine can be automatically restored, and the TCP messages of each physical node can be used to realize fault location, without manually querying the link relationship of the virtual machine from each device, which is conducive to improving the efficiency of fault diagnosis. Secondly, the fault location is realized by TCP messages collected by port mirroring, and there is no need to deploy devices such as splitters and probes in the network platform, which is conducive to reducing costs. In addition, based on the TCP messages of each physical node, the traffic path of each hop can be restored, which is conducive to improving the speed and accuracy of fault location.

[0074] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the address information corresponding to the target virtual machine mentioned in step S101 includes:

[0075] Obtaining service failure information corresponding to the target virtual machine;

[0076] Parse the service fault reporting information to obtain the source IP address and destination IP address corresponding to the target virtual machine;

[0077] The source IP address and the destination IP address are used as the address information.

[0078] In the method provided by the embodiment of the present invention, when the system receives a service failure report of the target virtual machine, it can obtain the corresponding service failure report information. The service failure report information is parsed to obtain the source IP address and the destination IP address of the target virtual machine, and the IP address pair composed of the source IP address and the destination IP address is used as the address information of the target virtual machine.

[0079] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of locating the target virtual machine based on the address information mentioned in step S102 to determine the target server where the target virtual machine is located among the multiple servers includes:

[0080] Creating an interface call request according to the address information; the interface call request is used to request to query the server information corresponding to the target virtual machine;

[0081] In the method provided in the embodiment of the present invention, an open application programming interface (API) is pre-deployed in the network platform. The API interface can obtain the association information between the virtual machines and servers of the network platform, which records the association relationship between each server and each virtual machine.

[0082] In the method provided by an embodiment of the present invention, during the network fault diagnosis process, the system can create an interface call request based on the IP address of the target virtual machine. It can be understood that the interface call request contains the address information of the target virtual machine, which is used to request a query for the server associated with the IP address, that is, the server information corresponding to the target virtual machine.

[0083] Based on the interface call request, calling a preset application programming interface;

[0084] In the method provided by the embodiment of the present invention, the system can send an interface call request to a preset API interface to call the API interface to query the virtual machine associated server. The API interface responds to the interface call request and can find the virtual machine corresponding to the address information in the virtual machine and server association information of the network platform through the address information carried in the interface call request, and return the server information associated with the virtual machine as a response message to the caller.

[0085] Receiving the server information returned by the application programming interface, and parsing the server information to obtain a server identifier;

[0086] In the method provided by the embodiment of the present invention, after the system receives the server information returned by the API interface, it parses the server information to obtain the server identifier carried therein, that is, the identifier of the server corresponding to the target virtual machine.

[0087] The server among the servers that matches the server identifier is used as the target server.

[0088] In the method provided by the embodiment of the present invention, based on the server identifier returned by the API interface, server matching is performed among various servers, and the server corresponding to the server identifier is used as the target server.

[0089] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the device link information corresponding to the network platform mentioned in step S103 includes:

[0090] Determine neighbor information corresponding to each of the physical nodes based on a link layer discovery protocol;

[0091] In the method provided by the embodiment of the present invention, the system calculates neighbor relationships for each physical node in the network platform through the Link Layer Discovery Protocol (LLDP) to obtain neighbor information corresponding to each physical node. The neighbor information corresponding to each physical node includes information about neighbor nodes of the current physical node.

[0092] According to the neighbor information corresponding to each of the physical nodes, the link relationship between the physical nodes is determined to determine the device link information.

[0093] In the method provided by the embodiment of the present invention, the neighbor nodes of each physical node can be determined according to the neighbor information corresponding to each physical node, and a link relationship between each physical node and its neighbor node can be established. Then, the link relationship between each physical node can be determined, and the link relationship between each physical node can be used as device link information.

[0094] In order to better illustrate the method provided in the embodiment of the present invention, based on the method provided in the above embodiment, the following is a Figure 1 The overall process of determining the link topology corresponding to the target virtual machine in the method shown is briefly described. Figure 2 As shown, in the method provided in the embodiment of the present invention, the process of determining the link topology corresponding to the target virtual machine mainly includes:

[0095] The LLDP protocol is used to obtain the link relationship between each physical node, including the link relationship between the switch and the server, and the link relationship between switches.

[0096] By calling the open API interface, the association relationship between the target virtual machine (target VM) and the server is obtained.

[0097] The link relationship between each physical node (ie, physical device) and the association relationship between the target virtual machine and the server are analyzed to restore the access location of the target VM and obtain the entire link topology of the target VM.

[0098] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the port mirroring function is a mirroring function based on the local encapsulation remote switch port mirroring ERSPAN deployment.

[0099] In the method provided in the embodiment of the present invention, the port mirroring function is deployed on the switch of the network platform based on the local encapsulated remote switch port mirroring (Encapsulated Remote Switched Port Analyzer, ERSPAN). The ERSPAN protocol is a remote port mirroring technology that allows the traffic of a specific port of a source switch to be mirrored to the observation port of a remote destination switch. ERSPAN is also called three-layer remote mirroring, and its mechanism is to perform a generic routing encapsulation (Generic Routing Encapsulation, GRE) message header on the mirrored message, and then forward the mirrored message to the destination server through a three-layer IP network for parsing. In the embodiment of the present invention, the port mirroring process based on ERSPAN can be as follows: Figure 3 As shown. The switch in the network platform is used as the source switch. The source switch copies the original message flowing through the source port and forwards it to the observation port of this switch. The port performs GRE encapsulation on the message, carries the address of the destination switch in the GRE tunnel protocol header, and forwards it to the source port of the destination switch through the GRE tunnel. The transmission of the message is based on the IP network. The premise for successful mirroring is that the IP network route is reachable. When the GRE-encapsulated mirrored message is transmitted to the destination switch, the destination switch needs to mirror the message locally and mirror it to the destination observation port connected to the destination server so that the destination server can obtain the mirrored message. The destination server performs network fault diagnosis based on the mirrored message. The destination server is the device that analyzes network faults, that is, the server where the network fault diagnosis system is deployed.

[0100] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the service forwarding path corresponding to the target virtual machine based on each of the mirror messages and the link topology mentioned in step S106 includes:

[0101] Perform traffic path restoration on the network platform based on each of the mirrored messages to obtain each traffic path corresponding to the network platform;

[0102] In the method provided by the embodiment of the present invention, the system can analyze which physical nodes the same TCP message has been captured on based on the message data in each mirror message, so as to identify the various flow nodes of the TCP message, and then restore the actual traffic path of the TCP message, thereby obtaining the various traffic paths in the network platform.

[0103] Based on the link topology, a traffic path corresponding to the target virtual machine is determined in each traffic path, and the traffic path corresponding to the target virtual machine is used as the service forwarding path.

[0104] In the method provided by an embodiment of the present invention, by matching the nodes on each traffic path of the network platform with the nodes in the link topology corresponding to the target virtual machine, the traffic path associated with the target virtual machine can be located in each traffic path, and the traffic path can be used as the service forwarding path corresponding to the target virtual machine.

[0105] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of locating the fault of the service forwarding path based on the mirror message corresponding to each of the target physical nodes mentioned in step S107 and obtaining the faulty link on the service forwarding path includes:

[0106] According to the mirror message corresponding to each of the target physical nodes, a TCP port connectivity test is performed on each of the target physical nodes to obtain a connectivity test result of each of the target physical nodes;

[0107] In the method provided by the embodiment of the present invention, based on the mirror message of each physical node on the service forwarding path, the service forwarding path is analyzed hop by hop through TCP connectivity analysis. It can be understood that the service forwarding is realized by multi-hop forwarding of each target physical node in the service forwarding path, and the forwarding process from the current target physical node to the next target physical node is regarded as one-hop forwarding. The hop-by-hop fault analysis is to perform fault analysis on the link of each hop. In the embodiment of the present invention, the TCP port connectivity test is performed for the forwarding link corresponding to each target physical node, that is, to analyze whether the TCP connection of each forwarding link is normal, and then obtain the connectivity test result of each target physical node. The connectivity test result of each target physical node indicates whether the connectivity test is successful, that is, whether the TCP communication of the forwarding link corresponding to the target physical node can be connected normally.

[0108] Specifically, switches and switches, and switches and servers establish links through TCP messages. TCP messages contain IP information. Based on the mirror messages corresponding to each target physical node, that is, the TCP messages of each target physical node, the forwarding link corresponding to each target physical node can be determined. Based on the TCP messages of the target physical nodes at both ends of the forwarding link, it can be analyzed whether the TCP communication between the two is normal. For example, if the TCP messages of the two show that the two have failed to complete the three-way handshake mechanism, the connectivity test of the link fails.

[0109] Based on the connectivity test results of each of the target physical nodes, determining a physical node that fails the connectivity test among each of the target physical nodes;

[0110] The physical node that fails the connectivity test is regarded as an abnormal node on the service forwarding path, and the link corresponding to the abnormal node is regarded as the faulty link.

[0111] In the method provided by the embodiment of the present invention, the connectivity test results of each target physical node can be analyzed, and the target physical node corresponding to the result indicating the failure of the connectivity test is used as the physical node that failed the connectivity test. That is, when the connectivity test result of the target physical node indicates the failure of the connectivity test, the target physical node is used as the physical node that failed the connectivity test, that is, the abnormal node. The service forwarding link corresponding to the abnormal node on the service forwarding path is used as the faulty link. That is, during the connectivity test of the abnormal node, the link that failed the test connection is the faulty link.

[0112] In order to better illustrate the method provided by the embodiment of the present invention, based on the methods provided by the above embodiments, the embodiment of the present invention provides another network fault diagnosis method, and the method provided by the embodiment of the present invention is applied to network fault diagnosis of a cloud platform, that is, a network platform that is deployed by combining physical devices and virtual machines. The method provided by the embodiment of the present invention can be implemented by a network fault diagnosis system, and the network fault diagnosis system can be deployed on a server that provides network fault diagnosis services.

[0113] In the method provided by the embodiment of the present invention, port mirroring is first deployed on each physical device of the network platform based on the ERSPAN protocol. The ERSPAN function, i.e., port mirroring, is enabled on all physical devices to mirror TCP control plane messages (SYN, FIN, RST, etc.) between devices to achieve the collection of TCP flows in the entire network. The schematic diagram of the TCP message mirroring process can be shown as follows: Figure 3 As shown, the mirroring process can refer to the description in the previous embodiment and will not be repeated here.

[0114] Next, combine Figure 4The flowchart shown provides an overall description of the network fault diagnosis method provided by the embodiment of the present invention.

[0115] like Figure 4 As shown, when the network platform starts to run, the ERSPAN function is enabled on the entire network to mirror the TCP messages of each physical device to the network fault diagnosis system in real time.

[0116] The network fault diagnosis system can monitor in real time whether a business fault report is received. When a business fault report associated with a virtual machine is received, the IP address pair (including the source address IP and the destination address IP) of the faulty virtual machine (VM) can be obtained from the business fault report information.

[0117] Call the API of the cloud platform to obtain the server where the virtual machine is located. Specifically, an open API interface is deployed in the cloud platform, which can access the association between each virtual machine and server in the cloud platform. By calling the open API interface provided by the cloud platform, the server where the faulty VM is located can be determined. The minute-level backtracking of the VM access location is achieved, and the VM migration process is made visible, realizing the full life cycle management of VM online, offline, and migration. In addition, combined with the LLDP protocol, the link relationship between the switch-server and the switch-switch in the cloud platform is calculated, and the physical network topology relationship of the faulty VM is restored in combination with the association between the faulty VM and the server and the link relationship of each physical device to restore the access location of the faulty VM. The process of restoring the access location of the faulty VM can also be referred to. Figure 2 .

[0118] Then, based on the mirrored TCP message, the real flow path is restored. As mentioned earlier, the TCP message of the device is mirrored using ERSPAN. For each TCP message, the system can restore the real flow path in the routing switching network by analyzing which devices have captured the same message data, and obtain the service forwarding path corresponding to the faulty VM. Secondly, the mirrored message also contains port information, which can further restore which switch interconnection link the TCP flow has passed through. Then, by performing TCP connectivity analysis on the service forwarding path, the real path is analyzed hop by hop to locate the fault and output the fault location conclusion.

[0119] The network fault diagnosis method provided by the embodiment of the present invention locates the virtual machine by calling the API, so that the virtual machine location is faster. The mirror message collected by ERSPAN is used to locate the fault, so that the fault location is more accurate. Facing the cloud platform, by calling the API and using ERSPAN remote mirroring, cloud-network mutual visibility is achieved, and efficient fault diagnosis effect is achieved.

[0120] Based on the method provided in the embodiment of the present invention, remote mirroring and calling API interfaces are used to realize automatic positioning of virtual machines and automatic diagnosis of network faults, and the location and migration process of virtual machines can be visualized, and the entire network situation can be quickly diagnosed and visualized, solving the problem of slow fault positioning in cloud scenarios.

[0121] Specifically, by calling the cloud platform API to obtain the correspondence between VM and server, it is faster and more efficient than the traditional method of manually locating VM access points. By deploying the ERSPAN mirroring function in the entire network and collecting the TCP traffic of the entire network for fault diagnosis, compared with the traditional method of deploying splitters and probes, no additional hardware equipment is required. It only needs to enable the corresponding ERSPAN mirroring function of the switch, which makes the function deployment faster and less costly. The real flow path is restored through TCP packets, which is more accurate than the traditional method of deploying splitters and probes. Hop-by-hop fault analysis is performed through TCP connectivity analysis, making the location of network faults more accurate.

[0122] and Figure 1 Corresponding to the network fault diagnosis method shown in FIG. 1 , the embodiment of the present invention further provides a network fault diagnosis device for Figure 1 The specific implementation of the method shown in is shown in the structural diagram Figure 5 As shown, including:

[0123] The first determining unit 201 is used to, when a virtual machine in the network platform has a service failure, use the virtual machine with the service failure as a target virtual machine and determine the address information corresponding to the target virtual machine; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0124] A virtual machine positioning unit 202, configured to position the target virtual machine based on the address information, so as to determine a target server where the target virtual machine is located among the multiple servers;

[0125] The second determining unit 203 is used to determine the device link information corresponding to the network platform; the device link information includes the link relationship between each of the physical nodes;

[0126] A third determining unit 204 is configured to determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0127] The fourth determining unit 205 is used to determine the mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP;

[0128] A fifth determining unit 206, configured to determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0129] The fault location unit 207 is used to take each physical node on the service forwarding path as a target physical node, and based on the mirror message corresponding to each target physical node, locate the fault on the service forwarding path to obtain the faulty link on the service forwarding path.

[0130] By using the device provided in the embodiment of the present invention, the server where the virtual machine is located can be located based on the address information of the virtual machine, and the link topology corresponding to the virtual machine can be determined by combining the correspondence between the virtual machine and the server and the link relationship between each physical node. The TCP messages of each physical node are collected through port mirroring, and the service forwarding path corresponding to the virtual machine is determined by combining the TCP messages of each physical node and the link topology corresponding to the virtual machine, and the TCP messages of each physical node on the service forwarding path are used to locate the faulty link. In the fault diagnosis process, the link topology corresponding to the virtual machine can be automatically restored, and the TCP messages of each physical node can be used to locate the fault, without manually querying the link relationship of the virtual machine from each device, which is conducive to improving the efficiency of fault diagnosis. Secondly, the fault location is realized by the TCP messages collected by port mirroring, and there is no need to deploy devices such as splitters and probes in the network platform, which is conducive to reducing costs. In addition, based on the TCP messages of each physical node, the traffic path of each hop can be restored, which is conducive to improving the speed and accuracy of fault location.

[0131] exist Figure 5 Based on the device shown, the device provided by the embodiment of the present invention can be further expanded into multiple units. The function of each unit can refer to the description of each embodiment provided in the above network fault diagnosis method, and no further examples will be given here.

[0132] An embodiment of the present invention further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned network fault diagnosis method.

[0133] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 6As shown, it specifically includes a memory 301 and one or more instructions 302, wherein the one or more instructions 302 are stored in the memory 301 and are configured to be executed by one or more processors 303 to perform the following operations:

[0134] When a virtual machine in the network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0135] Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers;

[0136] Determine the device link information corresponding to the network platform; the device link information includes the link relationship between each of the physical nodes;

[0137] Determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0138] Determine the mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP;

[0139] Determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0140] Each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the fault location of the service forwarding path is performed to obtain the fault link on the service forwarding path.

[0141] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0142] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0143] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network fault diagnosis method, characterized in that: include: When a virtual machine in the network platform reports a service failure, the virtual machine with the service failure is used as the target virtual machine, and the address information corresponding to the target virtual machine is determined; The network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers; Determine the device link information corresponding to the network platform; The device link information includes the link relationship between each of the physical nodes; Determine a link topology corresponding to the target virtual machine based on the target server and the device link information; Determine the mirror message corresponding to each physical node; each mirror message is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP; Determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology; Each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the fault location of the service forwarding path is performed to obtain the fault link on the service forwarding path.

2. The network fault diagnosis method according to claim 1, characterized in that: The determining the address information corresponding to the target virtual machine includes: Obtaining service failure information corresponding to the target virtual machine; Parse the service fault reporting information to obtain the source IP address and destination IP address corresponding to the target virtual machine; The source IP address and the destination IP address are used as the address information.

3. The network fault diagnosis method according to claim 1, characterized in that: The locating the target virtual machine based on the address information to determine the target server where the target virtual machine is located among the multiple servers includes: Creating an interface call request according to the address information; the interface call request is used to request to query the server information corresponding to the target virtual machine; Based on the interface call request, calling a preset application programming interface; Receiving the server information returned by the application programming interface, and parsing the server information to obtain a server identifier; The server among the servers that matches the server identifier is used as the target server.

4. The network fault diagnosis method according to claim 1, characterized in that: The determining the device link information corresponding to the network platform includes: Determine neighbor information corresponding to each of the physical nodes based on a link layer discovery protocol; According to the neighbor information corresponding to each of the physical nodes, the link relationship between the physical nodes is determined to determine the device link information.

5. The network fault diagnosis method according to claim 1, characterized in that: The port mirroring function is a mirroring function deployed based on local encapsulation remote switch port mirroring ERSPAN.

6. The network fault diagnosis method according to claim 1, characterized in that: The determining, based on each of the mirrored messages and the link topology, a service forwarding path corresponding to the target virtual machine includes: Perform traffic path restoration on the network platform based on each of the mirrored messages to obtain each traffic path corresponding to the network platform; Based on the link topology, a traffic path corresponding to the target virtual machine is determined in each traffic path, and the traffic path corresponding to the target virtual machine is used as the service forwarding path.

7. The network fault diagnosis method according to claim 1, characterized in that: The method of locating a fault on the service forwarding path based on the mirrored messages corresponding to each of the target physical nodes to obtain a faulty link on the service forwarding path includes: According to the mirror message corresponding to each of the target physical nodes, a TCP port connectivity test is performed on each of the target physical nodes to obtain a connectivity test result of each of the target physical nodes; Based on the connectivity test results of each of the target physical nodes, determining a physical node that fails the connectivity test among each of the target physical nodes; The physical node that fails the connectivity test is regarded as an abnormal node on the service forwarding path, and the link corresponding to the abnormal node is regarded as the faulty link.

8. A network fault diagnosis device, characterized in that: include: A first determination unit is used to, when a virtual machine in a network platform has a service failure, use the virtual machine with the service failure as a target virtual machine and determine address information corresponding to the target virtual machine; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; A virtual machine positioning unit, configured to locate the target virtual machine based on the address information, so as to determine a target server where the target virtual machine is located among the multiple servers; A second determining unit, configured to determine device link information corresponding to the network platform; The device link information includes the link relationship between each of the physical nodes; A third determining unit, configured to determine a link topology corresponding to the target virtual machine based on the target server and the device link information; The fourth determination unit is used to determine the mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the transmission control protocol TCP; A fifth determining unit, configured to determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology; The fault location unit is used to take each physical node on the service forwarding path as a target physical node, and based on the mirror message corresponding to each target physical node, locate the fault of the service forwarding path to obtain the fault link on the service forwarding path.

9. A storage medium, characterized in that: The storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the network fault diagnosis method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It comprises a memory and one or more instructions, wherein the one or more instructions are stored in the memory and are configured to be executed by one or more processors to perform the network fault diagnosis method as described in any one of claims 1 to 7.

Images