Network fault diagnosis method and device, storage medium and electronic equipment

Abstract

The present invention provides a network fault diagnosis method and device, a storage medium, and an electronic device, belonging to the field of security technology. The method comprises: when a target virtual machine service failure occurs, determining the address information of the target virtual machine, and determining the target server where the target virtual machine is located based on the address information; determining device link information, including the link relationship between each physical node; determining the link topology of the target virtual machine based on the target server and device link information; obtaining the TCP message of each physical node based on port mirroring; determining the service forwarding path of the target virtual machine based on the mirrored TCP message and the link topology; and locating the fault based on the TCP message of each physical node on the service forwarding path to obtain the fault link. The method of the present invention can realize the automatic positioning of the virtual machine, restore the service forwarding path, and use the mirrored TCP message to perform fault diagnosis, which is conducive to improving the efficiency and accuracy of fault diagnosis and reducing the diagnosis cost.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a network fault diagnosis method and device, a storage medium and an electronic device. Background Art

[0002] With the development of digital finance, data centers have become a crucial infrastructure for financial institutions to provide financial services. During data center operation, network status monitoring is often required. When network failures occur, they must be diagnosed and located to address them.

[0003] Currently, optical splitters and probes are typically deployed at network boundaries to collect critical service packets. When network fault diagnosis is required, the network topology is restored based on the link relationships between switches and servers. Fault diagnosis is then performed based on the captured critical service packets and the network topology.

[0004] However, due to the growth in business data volume, data center network infrastructure is gradually developing towards cloudification and virtualization. In other words, data center network infrastructure is gradually composed of a combination of physical devices and virtual machines (VMs). Based on existing network fault diagnosis methods, when a virtual machine fault occurs, it is necessary to manually query the link relationship of the virtual machine on each device to obtain the virtual machine's access location and determine the relationship between the virtual machine and the server before fault diagnosis can be performed. This process consumes a lot of time and manpower, resulting in low fault diagnosis efficiency. Secondly, the deployment of splitters and probes requires a certain amount of cost, and the overhead of network fault diagnosis is relatively high. In addition, equipment is generally deployed only at key boundary points of the network to capture business packets. The captured business packets can only restore a limited data path, making it difficult to quickly locate the fault point. Summary of the Invention

[0005] In view of this, an embodiment of the present invention provides a network fault diagnosis method to solve the problem that when diagnosing faults in a cloud network based on existing methods, it is necessary to manually query the link relationship of the virtual machine device by device, which takes a lot of time and requires the deployment of devices such as splitters, resulting in low fault diagnosis efficiency and high cost.

[0006] The embodiment of the present invention further provides a network fault diagnosis device to ensure the practical implementation and application of the above method.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] A network fault diagnosis method, comprising:

[0009] When a virtual machine in a network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0010] Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers;

[0011] Determine device link information corresponding to the network platform; the device link information includes link relationships between the physical nodes;

[0012] Determining a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0013] Determine the mirror message corresponding to each physical node; each mirror message is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP;

[0014] Determining a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0015] Each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the fault of the service forwarding path is located to obtain the fault link on the service forwarding path.

[0016] In the above method, optionally, determining the address information corresponding to the target virtual machine includes:

[0017] Obtaining service failure information corresponding to the target virtual machine;

[0018] Analyze the service fault information to obtain the source IP address and destination IP address corresponding to the target virtual machine;

[0019] The source IP address and the destination IP address are used as the address information.

[0020] Optionally, the method further includes locating the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers, including:

[0021] Creating an interface call request based on the address information; the interface call request is used to request to query server information corresponding to the target virtual machine;

[0022] Based on the interface call request, calling a preset application programming interface;

[0023] Receiving the server information returned by the application programming interface, and parsing the server information to obtain a server identifier;

[0024] The server that matches the server identifier among the servers is used as the target server.

[0025] In the above method, optionally, determining the device link information corresponding to the network platform includes:

[0026] Determine neighbor information corresponding to each of the physical nodes based on a link layer discovery protocol;

[0027] According to the neighbor information corresponding to each of the physical nodes, the link relationship between the physical nodes is determined to determine the device link information.

[0028] In the above method, optionally, the port mirroring function is a mirroring function deployed based on local encapsulation remote switch port mirroring ERSPAN.

[0029] Optionally, the method further includes determining the service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology, including:

[0030] Perform traffic path restoration on the network platform based on each of the mirrored messages to obtain each traffic path corresponding to the network platform;

[0031] Based on the link topology, a traffic path corresponding to the target virtual machine is determined in each traffic path, and the traffic path corresponding to the target virtual machine is used as the service forwarding path.

[0032] Optionally, the method further includes locating a fault on the service forwarding path based on the mirrored messages corresponding to the target physical nodes to obtain a faulty link on the service forwarding path, including:

[0033] Performing a TCP port connectivity test on each target physical node according to the mirror message corresponding to each target physical node to obtain a connectivity test result for each target physical node;

[0034] Based on the connectivity test results of the target physical nodes, determining, among the target physical nodes, the physical nodes that failed the connectivity test;

[0035] The physical node that fails the connectivity test is regarded as an abnormal node on the service forwarding path, and the link corresponding to the abnormal node is regarded as the faulty link.

[0036] A network fault diagnosis device, comprising:

[0037] A first determining unit is configured to, when a virtual machine in a network platform reports a service failure, use the virtual machine with the service failure as a target virtual machine and determine address information corresponding to the target virtual machine; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0038] a virtual machine locating unit, configured to locate the target virtual machine based on the address information, so as to determine a target server where the target virtual machine is located among the multiple servers;

[0039] A second determining unit is configured to determine device link information corresponding to the network platform; the device link information includes a link relationship between each of the physical nodes;

[0040] A third determining unit is configured to determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0041] The fourth determining unit is configured to determine a mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP;

[0042] a fifth determining unit, configured to determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0043] The fault location unit is used to take each physical node on the service forwarding path as a target physical node, and locate the fault of the service forwarding path based on the mirror message corresponding to each target physical node to obtain the fault link on the service forwarding path.

[0044] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned network fault diagnosis method.

[0045] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors to perform the above-mentioned network fault diagnosis method.

[0046] A network fault diagnosis method provided based on the above-mentioned embodiment of the present invention includes: when a service failure occurs in a virtual machine in a network platform, the virtual machine with the service failure is used as a target virtual machine, and the address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; the target virtual machine is located based on the address information to determine the target server where the target virtual machine is located among the multiple servers; device link information corresponding to the network platform is determined; the device link information includes the link relationship between each physical node; based on the target server and device link information, the link topology corresponding to the target virtual machine is determined; the mirror message corresponding to each physical node is determined; each mirror message is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP; based on each mirror message and the link topology, the service forwarding path corresponding to the target virtual machine is determined; each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the service forwarding path is fault located to obtain the fault link on the service forwarding path. By applying the method provided in the embodiment of the present invention, the server where the virtual machine is located can be located based on the address information of the virtual machine, and the link topology corresponding to the virtual machine can be determined by combining the correspondence between the virtual machine and the server and the link relationship between each physical node. The TCP packets of each physical node are collected through port mirroring, and the service forwarding path corresponding to the virtual machine is determined by combining the TCP packets of each physical node and the link topology corresponding to the virtual machine. The TCP packets of each physical node on the service forwarding path are used to locate the faulty link. During the fault diagnosis process, the link topology corresponding to the virtual machine can be automatically restored, and the TCP packets of each physical node can be used to locate the fault. There is no need to manually query the link relationship of the virtual machine from each device, which is conducive to improving the efficiency of fault diagnosis. Secondly, by using the TCP packets collected by port mirroring to locate the fault, there is no need to deploy devices such as splitters and probes in the network platform, which is conducive to reducing costs. In addition, based on the TCP packets of each physical node, the traffic path of each hop can be restored, which is conducive to improving the speed and accuracy of fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0048] Figure 1A flowchart of a network fault diagnosis method provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of a virtual machine access location restoration process provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of a TCP message mirroring process provided by an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of a network fault diagnosis process provided by an embodiment of the present invention;

[0052] Figure 5 A schematic diagram of the structure of a network fault diagnosis device provided by an embodiment of the present invention;

[0053] Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0055] In this application, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0056] The embodiment of the present invention provides a network fault diagnosis method, which can be applied to a network fault diagnosis system. The execution subject can be a server that deploys the network fault diagnosis system. The method flow chart of the method is as follows: Figure 1 As shown, including:

[0057] S101: When a virtual machine in a network platform reports a service failure, the virtual machine reporting the service failure is used as a target virtual machine, and address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0058] The method provided by the embodiment of the present invention is applied to a network fault diagnosis scenario of a cloud-based network platform, where multiple virtual machines and multiple physical nodes are deployed, and each physical node includes physical devices such as switches and servers.

[0059] When a network fault diagnosis system server receives a service failure report from a virtual machine, it can use the virtual machine with the service failure report as the target virtual machine to locate and diagnose the network failure corresponding to the target virtual machine. First, the system can resolve the address information of the target virtual machine and obtain the address information corresponding to the target virtual machine.

[0060] S102: Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers;

[0061] In the method provided by the embodiment of the present invention, the virtual machine information associated with each server in the network platform can be obtained first, and based on the matching of the address information of the target virtual machine with the information of each virtual machine, the server associated with the target virtual machine can be found to determine the target server where the target virtual machine is located, that is, the server to which the target virtual machine is connected.

[0062] S103: Determine device link information corresponding to the network platform; the device link information includes link relationships between the physical nodes;

[0063] The method provided in an embodiment of the present invention can detect the link relationships between various physical devices on a network platform based on a pre-set link discovery strategy. Specifically, the method identifies the connection relationship between each physical device and other physical devices to obtain the link relationships between various physical nodes, including the link relationships between switches and servers, and the link relationships between switches. The link relationships between various physical nodes are used as the device link information corresponding to the network platform.

[0064] S104: Determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0065] In the method provided by the embodiment of the present invention, based on the link relationship between the target server and each physical node in the device link information, the physical nodes directly connected to the target server and the physical nodes indirectly connected to the target server are determined, so as to restore the physical network topology corresponding to the target server. On the basis of the physical network topology, combined with the association relationship between the target virtual machine and the target server, the link topology corresponding to the target virtual machine can be constructed.

[0066] S105: Determine a mirrored message corresponding to each physical node; each mirrored message is a message obtained by mirroring the original message of each switch port through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP;

[0067] In the method provided by an embodiment of the present invention, port mirroring is pre-deployed in the network platform based on port mirroring technology. Port mirroring is enabled on each switch. During switch operation, original packets passing through the switch ports are transmitted to the server of the network fault analysis system according to a predetermined port mirroring protocol. In this embodiment of the present invention, the original packets to be mirrored are those on the Transmission Control Protocol (TCP) control plane between devices.

[0068] In the method provided by the embodiment of the present invention, during the network fault diagnosis process, the system can read the mirrored messages of each physical node collected through port mirroring.

[0069] S106: Determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0070] In the method provided by an embodiment of the present invention, based on the message data of each mirror message, the physical nodes through which the same message content flows in the link topology are identified, so as to restore the path of message flow in the link topology, thereby identifying the traffic path corresponding to the target virtual machine and obtaining the service forwarding path corresponding to the target virtual machine.

[0071] S107: Taking each physical node on the service forwarding path as a target physical node, and locating the fault on the service forwarding path based on the mirrored message corresponding to each target physical node, to obtain the faulty link on the service forwarding path.

[0072] In the method provided by the embodiment of the present invention, the message data of the mirror message of each physical node in the service forwarding path is used to detect whether the TCP communication between each physical node and the physical node it communicates with is normal, so as to identify which link in the service forwarding path has network communication abnormalities, and the link with the communication abnormality is regarded as a faulty link.

[0073] Based on the method provided by the embodiment of the present invention, when a service failure occurs in a virtual machine in a network platform, the virtual machine with the service failure is used as the target virtual machine, and the address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; the target virtual machine is located based on the address information to determine the target server where the target virtual machine is located among the multiple servers; the device link information corresponding to the network platform is determined; the device link information includes the link relationship between each physical node; based on the target server and the device link information, the link topology corresponding to the target virtual machine is determined; the mirror message corresponding to each physical node is determined; each mirror message is a message obtained by mirroring the original message of the port of each switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP; based on each mirror message and the link topology, the service forwarding path corresponding to the target virtual machine is determined; each physical node on the service forwarding path is used as the target physical node, and based on the mirror message corresponding to each target physical node, the service forwarding path is fault located to obtain the fault link on the service forwarding path. By applying the method provided in the embodiment of the present invention, the server where the virtual machine is located can be located based on the address information of the virtual machine, and the link topology corresponding to the virtual machine can be determined by combining the correspondence between the virtual machine and the server and the link relationship between each physical node. The TCP packets of each physical node are collected through port mirroring, and the service forwarding path corresponding to the virtual machine is determined by combining the TCP packets of each physical node and the link topology corresponding to the virtual machine. The TCP packets of each physical node on the service forwarding path are used to locate the faulty link. During the fault diagnosis process, the link topology corresponding to the virtual machine can be automatically restored, and the TCP packets of each physical node can be used to locate the fault. There is no need to manually query the link relationship of the virtual machine from each device, which is conducive to improving the efficiency of fault diagnosis. Secondly, by using the TCP packets collected by port mirroring to locate the fault, there is no need to deploy devices such as splitters and probes in the network platform, which is conducive to reducing costs. In addition, based on the TCP packets of each physical node, the traffic path of each hop can be restored, which is conducive to improving the speed and accuracy of fault location.

[0074] exist Figure 1 Based on the method shown, in the method provided by the embodiment of the present invention, the process of determining the address information corresponding to the target virtual machine mentioned in step S101 includes:

[0075] Obtaining service failure information corresponding to the target virtual machine;

[0076] Analyze the service fault information to obtain the source IP address and destination IP address corresponding to the target virtual machine;

[0077] The source IP address and the destination IP address are used as the address information.

[0078] In the method provided by an embodiment of the present invention, upon receiving a service failure report from a target virtual machine, the system can obtain the corresponding service failure report information. The service failure report information is parsed to obtain the source IP address and destination IP address of the target virtual machine, and the IP address pair consisting of the source IP address and the destination IP address is used as the address information of the target virtual machine.

[0079] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of locating the target virtual machine based on the address information in step S102 to determine the target server where the target virtual machine is located among the multiple servers includes:

[0080] Creating an interface call request based on the address information; the interface call request is used to request to query server information corresponding to the target virtual machine;

[0081] In the method provided by the embodiment of the present invention, an open application programming interface (API) is pre-deployed in the network platform. The API interface can obtain the association information between the virtual machines and servers of the network platform, which records the association relationship between each server and each virtual machine.

[0082] In the method provided by an embodiment of the present invention, during the network fault diagnosis process, the system can create an interface call request based on the IP address of the target virtual machine. It can be understood that the interface call request contains the address information of the target virtual machine, which is used to request a query of the server associated with the IP address, that is, the server information corresponding to the target virtual machine.

[0083] Based on the interface call request, calling a preset application programming interface;

[0084] In the method provided by an embodiment of the present invention, the system can send an interface call request to a preset API interface to call the API interface to query the server associated with the virtual machine. In response to the interface call request, the API interface can use the address information carried in the interface call request to find the virtual machine corresponding to the address information in the virtual machine and server association information on the network platform, and return the server information associated with the virtual machine as a response message to the caller.

[0085] Receiving the server information returned by the application programming interface, and parsing the server information to obtain a server identifier;

[0086] In the method provided by the embodiment of the present invention, after the system receives the server information returned by the API interface, it parses the server information to obtain the server identifier carried therein, that is, the identifier of the server corresponding to the target virtual machine.

[0087] The server that matches the server identifier among the servers is used as the target server.

[0088] In the method provided by the embodiment of the present invention, server matching is performed among various servers based on the server identifier returned by the API interface, and the server corresponding to the server identifier is used as the target server.

[0089] exist Figure 1 Based on the method shown, in the method provided by the embodiment of the present invention, the process of determining the device link information corresponding to the network platform mentioned in step S103 includes:

[0090] Determine neighbor information corresponding to each of the physical nodes based on a link layer discovery protocol;

[0091] In the method provided by an embodiment of the present invention, the system calculates neighbor relationships for each physical node in the network platform using the Link Layer Discovery Protocol (LLDP) to obtain neighbor information corresponding to each physical node. The neighbor information corresponding to each physical node includes information about the current physical node's neighbor nodes.

[0092] According to the neighbor information corresponding to each of the physical nodes, the link relationship between the physical nodes is determined to determine the device link information.

[0093] In the method provided by the embodiment of the present invention, the neighbor nodes of each physical node can be determined based on the neighbor information corresponding to each physical node, and a link relationship between each physical node and its neighbor node can be established. Then, the link relationship between each physical node can be determined, and the link relationship between each physical node can be used as device link information.

[0094] In order to better illustrate the method provided by the embodiment of the present invention, based on the method provided by the above embodiment, the following Figure 1 The overall process of determining the link topology corresponding to the target virtual machine in the method shown is briefly described. Figure 2 As shown, in the method provided in the embodiment of the present invention, the process of determining the link topology corresponding to the target virtual machine mainly includes:

[0095] The LLDP protocol is used to obtain the link relationships between physical nodes, including the link relationships between switches and servers, and the link relationships between switches.

[0096] By calling the open API interface, the association relationship between the target virtual machine (target VM) and the server is obtained.

[0097] The link relationship between each physical node (ie, physical device) and the association relationship between the target virtual machine and the server are analyzed to restore the access location of the target VM and obtain the entire link topology of the target VM.

[0098] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the port mirroring function is a mirroring function based on local encapsulation remote switch port mirroring ERSPAN deployment.

[0099] In the method provided in the embodiment of the present invention, the port mirroring function is deployed on the switch of the network platform based on the local encapsulated remote switch port mirroring (Encapsulated Remote Switched Port Analyzer, ERSPAN). The ERSPAN protocol is a remote port mirroring technology that allows the traffic of a specific port of a source switch to be mirrored to the observation port of a remote destination switch. ERSPAN is also called three-layer remote mirroring. Its mechanism is to encapsulate the mirrored message with a Generic Routing Encapsulation (GRE) message header, and then forward the mirrored message to the destination server for parsing through a three-layer IP network. In the embodiment of the present invention, the port mirroring process based on ERSPAN can be as follows Figure 3 As shown in the figure. The switch in the network platform is used as the source switch. The source switch copies the original packet flowing through the source port and forwards it to the switch's observation port. This port performs GRE encapsulation on the packet, adds the destination switch's address to the GRE tunnel protocol header, and forwards it to the destination switch's source port via the GRE tunnel. This packet is transmitted over the IP network, and successful mirroring requires a reachable IP network route. When the GRE-encapsulated mirrored packet is transmitted to the destination switch, the destination switch needs to mirror the packet locally to the destination observation port connected to the destination server so that the destination server can obtain the mirrored packet and perform network fault diagnosis based on the mirrored packet. The destination server is the device that analyzes network faults and is the server where the network fault diagnosis system is deployed.

[0100] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology mentioned in step S106 includes:

[0101] Perform traffic path restoration on the network platform based on each of the mirrored messages to obtain each traffic path corresponding to the network platform;

[0102] In the method provided by an embodiment of the present invention, the system can analyze the same TCP message based on the message data in each mirror message to determine which physical nodes it has been captured on, so as to identify the various flow nodes of the TCP message, and then restore the actual traffic path of the TCP message, thereby obtaining the various traffic paths in the network platform.

[0103] Based on the link topology, a traffic path corresponding to the target virtual machine is determined in each traffic path, and the traffic path corresponding to the target virtual machine is used as the service forwarding path.

[0104] In the method provided by an embodiment of the present invention, by matching the nodes on each traffic path of the network platform with the nodes in the link topology corresponding to the target virtual machine, the traffic path associated with the target virtual machine can be located in each traffic path, and the traffic path can be used as the service forwarding path corresponding to the target virtual machine.

[0105] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of locating the fault of the service forwarding path based on the mirrored messages corresponding to each of the target physical nodes and obtaining the faulty link on the service forwarding path mentioned in step S107 includes:

[0106] Performing a TCP port connectivity test on each target physical node according to the mirror message corresponding to each target physical node to obtain a connectivity test result for each target physical node;

[0107] In the method provided by the embodiment of the present invention, based on the mirror message of each physical node on the service forwarding path, the service forwarding path is analyzed hop by hop through TCP connectivity analysis. It can be understood that service forwarding is realized by multi-hop forwarding of each target physical node in the service forwarding path, and the forwarding process from the current target physical node to the next target physical node is regarded as one-hop forwarding. Performing hop-by-hop fault analysis means performing fault analysis on the link of each hop. In the embodiment of the present invention, a TCP port connectivity test is performed for the forwarding link corresponding to each target physical node, that is, to analyze whether the TCP connection of each forwarding link is normal, and then obtain the connectivity test result of each target physical node. The connectivity test result of each target physical node indicates whether the connectivity test is successful, that is, whether the TCP communication of the forwarding link corresponding to the target physical node can be connected normally.

[0108] Specifically, switches establish links with each other and with servers via TCP packets. TCP packets contain IP information. Based on the mirrored packets corresponding to each target physical node—that is, the TCP packets of each target physical node—the corresponding forwarding link can be determined. Based on the TCP packets from the target physical nodes at both ends of the forwarding link, the TCP communication between the two nodes can be analyzed to determine whether it is normal. For example, if the TCP packets from both nodes indicate that the three-way handshake mechanism has not been completed, the connectivity test for that link has failed.

[0109] Based on the connectivity test results of the target physical nodes, determining, among the target physical nodes, the physical nodes that failed the connectivity test;

[0110] The physical node that fails the connectivity test is regarded as an abnormal node on the service forwarding path, and the link corresponding to the abnormal node is regarded as the faulty link.

[0111] In the method provided by an embodiment of the present invention, the connectivity test results of each target physical node can be analyzed, and the target physical node corresponding to the result indicating a connectivity test failure is designated as the physical node that failed the connectivity test. That is, when the connectivity test result of a target physical node indicates a connectivity test failure, the target physical node is designated as the physical node that failed the connectivity test, i.e., an abnormal node. The service forwarding link corresponding to the abnormal node on the service forwarding path is designated as a faulty link. In other words, during the connectivity test of the abnormal node, the link that failed the test connection is designated as the faulty link.

[0112] To better illustrate the method provided by the embodiments of the present invention, based on the methods provided in the previous embodiments, the embodiments of the present invention provide another network fault diagnosis method. The method provided by the embodiments of the present invention is applied to network fault diagnosis on a cloud platform, i.e., a network platform deployed by combining physical devices and virtual machines. The method provided by the embodiments of the present invention can be implemented by a network fault diagnosis system, which can be deployed on a server that provides network fault diagnosis services.

[0113] In the method provided by the embodiment of the present invention, port mirroring is first deployed on each physical device of the network platform based on the ERSPAN protocol. The ERSPAN function, i.e., port mirroring, is enabled on all physical devices to mirror TCP control plane messages (SYN, FIN, RST, etc.) between devices, thereby realizing the collection of TCP flows across the entire network. The schematic diagram of the TCP message mirroring process can be shown as follows: Figure 3 As shown, the mirroring process can be referred to the description in the previous embodiment and will not be repeated here.

[0114] Next, combine Figure 4The flowchart shown provides an overall description of the network fault diagnosis method provided by the embodiment of the present invention.

[0115] like Figure 4 As shown in FIG, when the network platform starts running, the ERSPAN function is enabled on the entire network to mirror the TCP packets of each physical device to the network fault diagnosis system in real time.

[0116] The network fault diagnosis system can monitor in real time whether a service fault report is received. When a service fault report associated with a virtual machine is received, the IP address pair (including the source IP address and the destination IP address) of the faulty virtual machine (VM) can be obtained from the service fault report information.

[0117] Call the API of the cloud platform to obtain the server where the virtual machine is located. Specifically, an open API interface is deployed in the cloud platform, and the API interface can access the association between each virtual machine and server in the cloud platform. By calling the open API interface provided by the cloud platform, the server where the faulty VM is located can be determined. The minute-level backtracking of the VM access location is achieved, and the VM migration process is made visible, realizing the full life cycle management of VM online, offline, and migration. In addition, combined with the LLDP protocol, the link relationship between the switch-server and the switch-switch in the cloud platform is calculated, and the association between the faulty VM and the server and the link relationship of each physical device is combined to restore the physical network topology relationship of the faulty VM to restore the access location of the faulty VM. The process of restoring the access location of the faulty VM can also be referred to. Figure 2 .

[0118] Then, based on the mirrored TCP packets, the true flow path is restored. As previously mentioned, ERSPAN mirrors the device's TCP packets. For each TCP packet, the system analyzes which devices captured the same packet data, restoring the true flow path in the routing switching network and obtaining the service forwarding path corresponding to the faulty VM. Furthermore, the mirrored packets also contain port information, further enabling the restoration of the switch interconnect links through which the TCP flow passed. TCP connectivity analysis is then performed on the service forwarding path, and the true path is analyzed hop by hop to locate the fault and output a fault location conclusion.

[0119] The network fault diagnosis method provided by this embodiment of the present invention locates virtual machines (VMs) faster by calling an API. It also utilizes mirrored messages collected by ERSPAN for fault location, making fault location more accurate. For cloud-based platforms, calling an API and using ERSPAN remote mirroring enable cloud-network interoperability and efficient fault diagnosis.

[0120] Based on the method provided in the embodiment of the present invention, remote mirroring and calling API interfaces are used to achieve automatic virtual machine positioning and network fault diagnosis. The location and migration process of the virtual machine can be visualized, and the entire network situation can be quickly diagnosed and visualized, solving the problem of slow fault positioning in cloud scenarios.

[0121] Specifically, by calling the cloud platform API to obtain the mapping between VMs and servers, it is faster and more efficient than the traditional method of manually locating VM access points. By deploying the ERSPAN mirroring function across the entire network and collecting network-wide TCP traffic for fault diagnosis, compared to the traditional deployment of splitters and probes, this method requires no additional hardware and only requires enabling the ERSPAN mirroring function on the corresponding switches, making deployment faster and more cost-effective. The actual flow path is restored through TCP packets, which is more accurate than the traditional deployment of splitters and probes. Hop-by-hop fault analysis through TCP connectivity analysis makes network fault location more accurate.

[0122] and Figure 1 Corresponding to the network fault diagnosis method shown in FIG, the embodiment of the present invention further provides a network fault diagnosis device for Figure 1 The specific implementation of the method shown in is shown in the structural diagram. Figure 5 As shown, including:

[0123] A first determining unit 201 is configured to, when a service failure occurs on a virtual machine in a network platform, use the virtual machine with the service failure as a target virtual machine and determine address information corresponding to the target virtual machine; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0124] A virtual machine positioning unit 202 is configured to locate the target virtual machine based on the address information, so as to determine a target server where the target virtual machine is located among the multiple servers;

[0125] The second determining unit 203 is configured to determine device link information corresponding to the network platform; the device link information includes link relationships between the physical nodes;

[0126] A third determining unit 204 is configured to determine a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0127] The fourth determining unit 205 is configured to determine a mirrored message corresponding to each physical node; each mirrored message is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP;

[0128] A fifth determining unit 206 is configured to determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0129] The fault location unit 207 is used to take each physical node on the service forwarding path as a target physical node, and locate the fault on the service forwarding path based on the mirror message corresponding to each target physical node to obtain the fault link on the service forwarding path.

[0130] By applying the device provided by the embodiment of the present invention, the server where the virtual machine is located can be located based on the address information of the virtual machine, and the link topology corresponding to the virtual machine can be determined by combining the correspondence between the virtual machine and the server and the link relationship between each physical node. The TCP packets of each physical node are collected through port mirroring, and the service forwarding path corresponding to the virtual machine is determined by combining the TCP packets of each physical node and the link topology corresponding to the virtual machine. The TCP packets of each physical node on the service forwarding path are used to locate the faulty link. During the fault diagnosis process, the link topology corresponding to the virtual machine can be automatically restored, and the TCP packets of each physical node can be used to locate the fault. There is no need to manually query the link relationship of the virtual machine from each device, which is conducive to improving the efficiency of fault diagnosis. Secondly, by using the TCP packets collected by port mirroring to locate the fault, there is no need to deploy devices such as splitters and probes in the network platform, which is conducive to reducing costs. In addition, based on the TCP packets of each physical node, the traffic path of each hop can be restored, which is conducive to improving the speed and accuracy of fault location.

[0131] exist Figure 5 Based on the device shown, the device provided by the embodiment of the present invention can be further expanded to include multiple units. The functions of each unit can be found in the description of each embodiment provided for the network fault diagnosis method above, and no further examples will be given here.

[0132] An embodiment of the present invention further provides a storage medium, which includes stored instructions. When the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned network fault diagnosis method.

[0133] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 6As shown, the system specifically includes a memory 301 and one or more instructions 302, wherein the one or more instructions 302 are stored in the memory 301 and are configured to be executed by one or more processors 303 to perform the following operations:

[0134] When a virtual machine in a network platform reports a service failure, the virtual machine with the service failure is used as a target virtual machine, and address information corresponding to the target virtual machine is determined; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers;

[0135] Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers;

[0136] Determine device link information corresponding to the network platform; the device link information includes link relationships between the physical nodes;

[0137] Determining a link topology corresponding to the target virtual machine based on the target server and the device link information;

[0138] Determine the mirror message corresponding to each physical node; each mirror message is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP;

[0139] Determining a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology;

[0140] Each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the fault of the service forwarding path is located to obtain the fault link on the service forwarding path.

[0141] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple. For relevant parts, refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0142] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0143] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network fault diagnosis method, characterized in that: include: When a virtual machine in the network platform reports a service failure, the virtual machine with the service failure is used as the target virtual machine, and the address information corresponding to the target virtual machine is determined; The network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; Positioning the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers; Determine device link information corresponding to the network platform; The device link information includes the link relationship between each of the physical nodes; Determining a link topology corresponding to the target virtual machine based on the target server and the device link information; Determine the mirror message corresponding to each physical node; each mirror message is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP; Determining a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology; Each physical node on the service forwarding path is used as a target physical node, and based on the mirror message corresponding to each target physical node, the fault of the service forwarding path is located to obtain the fault link on the service forwarding path.

2. The network fault diagnosis method according to claim 1, characterized in that: The determining the address information corresponding to the target virtual machine includes: Obtaining service failure information corresponding to the target virtual machine; Analyze the service fault information to obtain the source IP address and destination IP address corresponding to the target virtual machine; The source IP address and the destination IP address are used as the address information.

3. The network fault diagnosis method according to claim 1, wherein: The locating the target virtual machine based on the address information to determine a target server where the target virtual machine is located among the multiple servers includes: Creating an interface call request based on the address information; the interface call request is used to request to query server information corresponding to the target virtual machine; Based on the interface call request, calling a preset application programming interface; Receiving the server information returned by the application programming interface, and parsing the server information to obtain a server identifier; The server that matches the server identifier among the servers is used as the target server.

4. The network fault diagnosis method according to claim 1, wherein: The determining of the device link information corresponding to the network platform includes: Determine neighbor information corresponding to each of the physical nodes based on a link layer discovery protocol; According to the neighbor information corresponding to each of the physical nodes, the link relationship between the physical nodes is determined to determine the device link information.

5. The network fault diagnosis method according to claim 1, characterized in that: The port mirroring function is a mirroring function deployed based on local encapsulation remote switch port mirroring ERSPAN.

6. The network fault diagnosis method according to claim 1, characterized in that: The determining, based on each of the mirrored messages and the link topology, a service forwarding path corresponding to the target virtual machine includes: Perform traffic path restoration on the network platform based on each of the mirrored messages to obtain each traffic path corresponding to the network platform; Based on the link topology, a traffic path corresponding to the target virtual machine is determined in each traffic path, and the traffic path corresponding to the target virtual machine is used as the service forwarding path.

7. The network fault diagnosis method according to claim 1, characterized in that: The performing fault location on the service forwarding path based on the mirrored messages corresponding to each of the target physical nodes to obtain a faulty link on the service forwarding path includes: Performing a TCP port connectivity test on each target physical node according to the mirror message corresponding to each target physical node to obtain a connectivity test result for each target physical node; Based on the connectivity test results of the target physical nodes, determining, among the target physical nodes, the physical nodes that failed the connectivity test; The physical node that fails the connectivity test is regarded as an abnormal node on the service forwarding path, and the link corresponding to the abnormal node is regarded as the faulty link.

8. A network fault diagnosis device, characterized in that: include: A first determining unit is configured to, when a virtual machine in a network platform reports a service failure, use the virtual machine with the service failure as a target virtual machine and determine address information corresponding to the target virtual machine; the network platform includes multiple virtual machines and multiple physical nodes, and the multiple physical nodes include multiple switches and multiple servers; a virtual machine locating unit, configured to locate the target virtual machine based on the address information, so as to determine a target server where the target virtual machine is located among the multiple servers; A second determining unit, configured to determine device link information corresponding to the network platform; The device link information includes the link relationship between each of the physical nodes; A third determining unit is configured to determine a link topology corresponding to the target virtual machine based on the target server and the device link information; The fourth determining unit is configured to determine a mirror message corresponding to each of the physical nodes; each of the mirror messages is a message obtained by mirroring the original message of each port of the switch through the deployed port mirroring function; the original message is a message transmitted based on the Transmission Control Protocol TCP; a fifth determining unit, configured to determine a service forwarding path corresponding to the target virtual machine based on each of the mirrored messages and the link topology; The fault location unit is used to take each physical node on the service forwarding path as a target physical node, and locate the fault of the service forwarding path based on the mirror message corresponding to each target physical node to obtain the fault link on the service forwarding path.

9. A storage medium, characterized in that: The storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the network fault diagnosis method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The system comprises a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors to perform the network fault diagnosis method according to any one of claims 1 to 7.

Images