IP address monitoring method and system

Abstract

The invention provides an IP address monitoring method and system, and the method comprises the steps that a first switch sends an MAC message, a target IP address in the MAC message is the IP address of the first switch, a second switch receives the MAC message and sends the MAC message, the first switch is in communication connection with the second switch, a data collection and analysis device receives the MAC message and carries out the monitoring of the IP address on the basis of the MAC message, the second switch is used for acquiring the IP address of the first switch, the second switch is used for jointly connecting the data acquisition and analysis equipment and the first switch in the same network, the data acquisition and analysis equipment acquires the corresponding MAC address based on the IP address, and the data acquisition and analysis equipment monitors the IP address based on the MAC address and a preset condition. By monitoring the MAC message in real time, the change of the IP address can be found in time, so that the statistical information of the IP address is quickly updated.

Description

Technical Field

[0001] The present invention relates to the technical field of network management, and in particular to a method and system for monitoring an IP address. Background Art

[0002] In today's digital age, as the scale and complexity of networks continue to expand, it is particularly important to accurately count the existing IP addresses in the network. Whether it is enterprise network management, resource allocation of Internet service providers, or network security protection, a comprehensive and clear understanding of the IP addresses in the network is required. However, traditional IP statistics methods usually rely on manual records, electronic documents, or simple database management, which have many limitations. For example, manual records are not only inefficient, but also prone to errors; electronic documents are not efficient in information query and statistics, and are prone to information islands; and simple database management may not be able to update IP data in real time, making it difficult to cope with dynamic changes in the network environment. Summary of the invention

[0003] In order to solve the above technical problems, the present invention is proposed. The embodiments of the present invention provide a method and system for monitoring IP addresses, thereby solving the problem of low efficiency in counting IP addresses in the prior art.

[0004] According to one aspect of the present invention, there is provided a method for monitoring an IP address, comprising:

[0005] The first switch sends a MAC message; wherein the target IP address in the MAC message is the IP address of the first switch;

[0006] The second switch receives the MAC message and sends the MAC message; wherein the first switch is communicatively connected with the second switch;

[0007] The data collection and analysis device receives the MAC message and obtains the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data collection and analysis device and the first switch to the same network;

[0008] The data collection and analysis device obtains the corresponding MAC address based on the IP address;

[0009] The data collection and analysis device monitors the IP address based on the MAC address and preset conditions.

[0010] In one embodiment, the data collection and analysis device monitors the IP address based on the MAC address and preset conditions, including:

[0011] If it is determined that the IP address corresponds to a different MAC address, a first alarm message is generated; wherein the first alarm message indicates that an address conflict exists in the IP address.

[0012] In one embodiment, before the data collection and analysis device receives the MAC message, the IP address monitoring method further includes:

[0013] The second switch copies the traffic of the port of the first switch to the port of the data collection and analysis device.

[0014] In one embodiment, the data collection and analysis device obtains the corresponding MAC address based on the IP address, including:

[0015] Extracting a subnet mask from the IP address;

[0016] Determine the number of bits of the subnet mask;

[0017] If the number of bits of the subnet mask meets the preset number of bits, an ICMP request is generated;

[0018] Obtain a return value in response to the ICMP request;

[0019] Based on the returned value, the MAC address corresponding to the IP address is obtained.

[0020] In one embodiment, obtaining a return value in response to the ICMP request includes:

[0021] Based on the number of transmissions, the ICMP request is sent to other switches in the network;

[0022] Get the return value of each other switch that responded to the ICMP request.

[0023] In one embodiment, sending the ICMP request to other switches in the network based on the number of transmissions includes:

[0024] Based on the number of bits of the subnet mask, an address range is obtained; wherein the address range includes multiple target IP addresses;

[0025] Based on the number of transmissions, the ICMP request is sent to other switches corresponding to each target IP address.

[0026] In one embodiment, obtaining the MAC address corresponding to the IP address based on the returned value includes:

[0027] If the return value indicates that the other switch can communicate, the MAC address corresponding to the IP address of the other switch is obtained through an arp request.

[0028] In one embodiment, the communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the port of the first switch is communicatively connected to the port of the second switch.

[0029] In one embodiment, the data collection and analysis device monitors the IP address based on the MAC address and preset conditions, including:

[0030] Obtain the sending traffic corresponding to the MAC address;

[0031] If the sending traffic is greater than a preset traffic threshold, the IP address is determined to be an abnormal address.

[0032] According to another aspect of the present invention, there is provided a system for monitoring an IP address, comprising:

[0033] A first switch, configured to send a MAC message; wherein the target IP address in the MAC message is the IP address of the first switch;

[0034] A second switch, configured to receive the MAC message and send the MAC message; wherein the first switch is communicatively connected with the second switch;

[0035] A data collection and analysis device, used to receive the MAC message and obtain the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data collection and analysis device and the first switch together in the same network; based on the IP address, obtain the corresponding MAC address; based on the MAC address and preset conditions, monitor the IP address.

[0036] The present invention provides a method and system for monitoring an IP address, comprising: a first switch sends a MAC message, wherein the target IP address in the MAC message is the IP address of the first switch, a second switch receives the MAC message and sends the MAC message, wherein the first switch is connected to the second switch in communication, a data acquisition and analysis device receives the MAC message and obtains the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data acquisition and analysis device and the first switch together in the same network, the data acquisition and analysis device obtains the corresponding MAC address based on the IP address, and the data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions. By real-time monitoring of the MAC message, the change of the IP address can be discovered in time, so as to quickly update the IP address statistical information. The method of using free MAC messages to count IP addresses has high accuracy. Since the MAC address is the unique identifier of the device, the existence of the device can be accurately determined by analyzing the MAC message, and the corresponding IP address can be further inferred. For example, according to the monitoring of the MAC message by the network traffic analysis tool, the communication behavior of the device can be tracked, so as to determine the IP address used by it. Using free MAC packets to count IP addresses can be widely used in enterprise network management, resource allocation of Internet service providers, and network security protection. In enterprise network management, accurate statistics of IP addresses can better plan network resources and improve network performance and management efficiency. For Internet service providers, knowing the existing IP addresses in the network helps to reasonably allocate IP resources and improve service quality. In terms of network security protection, abnormal traffic and malicious IP addresses can be discovered in time by monitoring MAC packets, thus strengthening network security prevention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The above and other purposes, features and advantages of the present invention will become more apparent by describing the embodiments of the present invention in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0038] Figure 1 It is a flowchart of a method for monitoring an IP address provided by an exemplary embodiment of the present invention.

[0039] Figure 2 Schematic diagram of a method for monitoring an IP address provided by another exemplary embodiment of the present invention

[0040] Figure 3 It is a flowchart of a method for monitoring an IP address provided by another exemplary embodiment of the present invention.

[0041] Figure 4 Schematic diagram of the structure of an IP address monitoring system provided by an exemplary embodiment of the present invention

[0042] Figure 5 is a structural diagram of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0043] Below, the exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments of the present invention, and it should be understood that the present invention is not limited to the exemplary embodiments described here.

[0044] Figure 1 FIG. 1 is a flow chart of a method for monitoring an IP address provided by an exemplary embodiment of the present invention. Figure 1 As shown, the IP address monitoring methods include:

[0045] Step 110: The first switch sends a MAC message, wherein the target IP address in the MAC message is the IP address of the first switch.

[0046] In the embodiment of the present invention, the MAC message is a gratuitous MAC message, also known as a gratuitous ARP (Gratuitous ARP) message. The gratuitous ARP request message is significantly different from the ordinary ARP request message in structure. The target IP address in the ordinary ARP request message is the IP address of another host, and the purpose is to request the resolution of the MAC address corresponding to the IP address. In the gratuitous ARP request, the target IP address of the message is the IP address of the local machine. For example, the target of the ordinary ARP request may be to obtain the MAC address of a certain host, such as: "Host A needs the MAC address of 10.1.1.2, and 10.1.1.2 is the IP of another host." The target of the gratuitous ARP request is to obtain the corresponding MAC address of the local machine's IP address, such as: "Host A needs the MAC address of 10.1.1.1, and 10.1.1.1 is the IP address of the local machine (Host A)."

[0047] The first switch is the core switch, which is an important device in the network used to carry a large amount of data traffic and connect different network areas. It is usually located in the core layer of the network. Its main function is to ensure efficient and reliable data transmission between different departments, subnets, local area networks (LANs) or wide area networks (WANs).

[0048] Free MAC messages have the following important functions:

[0049] First of all, this type of message plays a role of announcement. It sends data packets in the form of broadcast, without receiving a response, just to tell other hosts its own IP address and MAC address. For example, when a host starts up, it sends a free ARP request, that is, requesting the MAC address of its own IP address, so that other devices in the network can quickly learn about the existence of the device and its corresponding IP and MAC address information.

[0050] Secondly, it can be used to detect IP address conflicts. When a host sends a free ARP request message, if it receives an ARP response message, it means that there is already a host using the IP address in the network. For example, in a local area network, if a newly added host receives a response after sending a free ARP request, the IP address conflict problem can be discovered in time to avoid errors in subsequent communications.

[0051] Finally, it can be used to update the ARP cache table of other hosts. If the host changes the network card, and the ARP cache table of other hosts still retains the original MAC address. At this time, a free ARP packet can be sent. After receiving the packet, other hosts will update the ARP cache table and replace the original MAC address with the new MAC address. This ensures the accuracy and stability of network communication.

[0052] Step 120: The second switch receives the MAC message and sends the MAC message, wherein the first switch is communicatively connected with the second switch.

[0053] In the embodiment of the present invention, the second switch is an access switch, which is a switching device in a computer network used to connect terminal devices (such as computers, printers, IP phones, etc.) and the network. It is located at the access layer of the network.

[0054] Step 130: The data collection and analysis device receives the MAC message and obtains the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data collection and analysis device and the first switch to the same network.

[0055] In an embodiment of the present invention, the data acquisition and analysis device can extract the IP address of the corresponding first switch based on the message information by receiving the MAC message from the switch in the network. Specifically, the second switch acts as a bridge connecting the data acquisition and analysis device and the first switch in the network architecture to ensure that the two are in the same local area network (LAN). By obtaining the IP address of the first switch, the data acquisition and analysis device can further perform network communication and data exchange, realize the identification of network topology and interaction between network devices. This method not only improves the efficiency of data acquisition and analysis, but also effectively supports network monitoring and management, helps network administrators track the operating status of network devices in real time, and performs fault diagnosis and processing in a timely manner. In addition, this mechanism based on MAC address learning and IP address mapping enhances the flexibility and reliability of the network.

[0056] In addition, the devices in the network are constantly changing, and the addition of new devices and the withdrawal of old devices may cause changes in IP addresses. By monitoring MAC messages in real time, these changes can be discovered in time and IP address statistics can be quickly updated. For example, using a security information and event management (SIEM) system, MAC messages in the network can be centrally collected and analyzed, and new IP addresses can be discovered and recorded in time.

[0057] Step 140: The data collection and analysis device obtains the corresponding MAC address based on the IP address.

[0058] Step 150: The data collection and analysis device monitors the IP address based on the MAC address and preset conditions.

[0059] The present invention provides a method for monitoring an IP address, comprising: a first switch sends a MAC message, wherein the target IP address in the MAC message is the IP address of the first switch, a second switch receives the MAC message and sends the MAC message, wherein the first switch is connected to the second switch in communication, a data acquisition and analysis device receives the MAC message and obtains the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data acquisition and analysis device and the first switch together in the same network, the data acquisition and analysis device obtains the corresponding MAC address based on the IP address, and the data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions. By real-time monitoring of the MAC message, the change of the IP address can be discovered in time, so as to quickly update the IP address statistical information. The method of using free MAC messages to count IP addresses has high accuracy. Since the MAC address is the unique identifier of the device, the existence of the device can be accurately determined by analyzing the MAC message, and the corresponding IP address can be further inferred. For example, according to the monitoring of the MAC message by the network traffic analysis tool, the communication behavior of the device can be tracked, so as to determine the IP address used by it. Using free MAC packets to count IP addresses can be widely used in enterprise network management, resource allocation of Internet service providers, and network security protection. In enterprise network management, accurate statistics of IP addresses can better plan network resources and improve network performance and management efficiency. For Internet service providers, knowing the existing IP addresses in the network helps to reasonably allocate IP resources and improve service quality. In terms of network security protection, abnormal traffic and malicious IP addresses can be discovered in time by monitoring MAC packets, thus strengthening network security prevention.

[0060] Figure 2 FIG. 1 is a flow chart of a method for monitoring an IP address provided by another exemplary embodiment of the present invention. Figure 2 As shown, step 150 may include:

[0061] Step 151: If it is determined that the IP address corresponds to a different MAC address, a first alarm message is generated, wherein the first alarm message indicates that an address conflict exists in the IP address.

[0062] In an embodiment of the present invention, when the system detects that a certain IP address corresponds to multiple different MAC addresses, it means that there is an address conflict in the IP address, which may cause instability or interruption of network communication. In order to promptly discover and handle this situation, the data acquisition and analysis device will generate a first alarm message to prompt the address conflict problem of the IP address. Address conflicts usually occur when multiple devices in the network are incorrectly configured with the same IP address, or when a device dynamically allocates addresses in the network. The generation of the first alarm message can help network administrators quickly locate the source of the problem and avoid consequences such as data loss, network delays, or inability of devices to communicate normally. In order to resolve address conflicts, administrators can check the configuration of conflicting devices, reallocate IP addresses, or eliminate network configuration errors to ensure the stability and normal operation of the network. This type of alarm mechanism is particularly important for large-scale networks, which can help monitor and optimize the allocation of network resources in real time and improve the efficiency and reliability of network management.

[0063] In one embodiment, before step 120, the IP address monitoring method may be specifically implemented as follows: the second switch copies the traffic of the port of the first switch to the port of the data collection and analysis device.

[0064] In an embodiment of the present invention, the second switch copies the port traffic of the first switch to the port of the data acquisition and analysis device to achieve real-time monitoring and analysis of the traffic. This process is usually implemented through port mirroring technology, which allows the switch to copy and forward the data traffic of a specified port to another port for traffic monitoring, troubleshooting and performance analysis. Furthermore, in the configuration of the access switch, mirror port traffic can also be set to mirror the interconnection port traffic between the access switch and each core switch to the interconnection port connected to the data acquisition and analysis device. In this way, the data acquisition and analysis device can receive network traffic from different switches and provide comprehensive monitoring of the entire network status. In this way, the data acquisition and analysis device can capture the traffic information of all key network links in real time, helping network administrators to perform traffic analysis, performance optimization and security monitoring.

[0065] In one embodiment, step 140 can be specifically implemented as follows: extracting the subnet mask from the IP address; determining the number of bits of the subnet mask; generating an ICMP request if the number of bits of the subnet mask meets the preset number of bits; obtaining the return value of the response to the ICMP request; and obtaining the MAC address corresponding to the IP address based on the return value.

[0066] In an embodiment of the present invention, a subnet mask is extracted from an IP address, and the number of bits of the subnet mask is determined. The preset number of bits is set to 24 bits, 16 bits, or 8 bits. When the subnet mask is 24 bits, the last eight bits (1 to 254) of the IP address are traversed one by one, and the ping-c3 operation is performed on each IP address in turn, and three ICMP request messages are sent to confirm whether the IP address is reachable. If the target IP address responds normally, the arp command is used to query the MAC address corresponding to the IP address, and the obtained result is saved in the arp.txt file. This process can help network administrators discover the IP-MAC mapping information of all active devices in the local area network, so as to manage, monitor and troubleshoot network devices.

[0067] When the subnet mask is 16 bits, a larger IP range is scanned, usually addresses from xx0.1 to xx255.254, while when the subnet mask is 8 bits, all IP addresses from x.0.0.1 to x.255.255.254 are scanned. The purpose of these operations is to obtain device information in the entire subnet according to different subnet sizes, and automatically generate a detailed list of IP addresses and their corresponding MAC addresses. No matter how large the subnet mask is, the combination of ping and arp commands can quickly and effectively discover and map network devices.

[0068] In this way, network administrators can scan the devices in the entire network in a short time and obtain the IP and MAC addresses of all active devices, thus providing important support for network optimization, performance analysis, device management and network security. ping-c3 sends 3 ICMP request messages to check whether the target host is reachable. ICMP request is a message used for network connectivity testing. The target host responds to the request through an ICMP echo response message. The arp command is used to query the ARP cache of the local computer and display the mapping between IP addresses and MAC addresses. The arp.txt file is a text file that stores ARP query results. It is used to record the correspondence between the IP and MAC addresses of the device for subsequent analysis and management.

[0069] In one embodiment, step 140 may be specifically implemented as follows: based on the number of transmissions, sending the ICMP request to other switches in the network; and obtaining a return value of each other switch that responds to the ICMP request.

[0070] Based on the number of ICMP requests sent, the switches in the network will receive and respond to requests from the source device in turn. Specifically, the script sends ICMP requests to each switch in the network, sending multiple ICMP request messages through the ping command, usually 3 times (i.e. ping-c3). Each switch responds to these requests based on its network configuration and connectivity, and returns the corresponding ICMP Echo Reply information. The response contains key information such as the round-trip time of each request and whether there is packet loss, which can help network administrators evaluate network latency and the health of the switch.

[0071] During this process, the script will automatically traverse each switch in the network, send ICMP requests to the IP address of each switch, record the response time (RTT, Round Trip Time) of each request and whether it is successfully returned, and then generate a detailed network performance report. These return values ​​can not only reflect the connection status of the switch, but also provide data support for subsequent network optimization and troubleshooting. For example, if the ICMP request response time of a switch is long or there is no response, it may mean that there is a problem with the network link of the device, or the device itself is faulty.

[0072] In addition, by comparing the ICMP response time of different switches, administrators can analyze the bottleneck location in the network and further optimize the network topology or adjust the traffic load balancing strategy. For large enterprises or data center networks, this automated monitoring method based on ICMP requests can effectively improve network management efficiency and promptly discover and handle potential network problems.

[0073] In one embodiment, step 140 can be specifically implemented as follows: based on the number of bits in the subnet mask, an address range is obtained; wherein the address range includes multiple target IP addresses; based on the number of transmissions, an ICMP request is sent to other switches corresponding to each target IP address.

[0074] In an embodiment of the present invention, according to the number of bits of the subnet mask, the valid IP address range in the network can be calculated first. The subnet mask determines the division of the network address part and the host address part, which in turn affects the total number of available IP addresses in the network. For example, if the subnet mask is 24 bits (i.e., 255.255.255.0), the IP address range in the network is usually from .1 to .254, and these addresses can be assigned to devices in the network (such as switches, routers, servers, etc.). According to the number of bits of the subnet mask, the script will calculate the corresponding IP address range and generate target IP addresses one by one for ICMP requests. After obtaining the target IP address range, the script will send ICMP requests (Echo Request) to each target IP address based on the configured number of transmissions (usually 3 times) to test the network connectivity of the target device (such as a switch). Each time an ICMP request is sent, the script will wait for the response of the target device, record the ICMP Echo Reply information returned by it, collect and analyze the response time (round trip time RTT) and whether packet loss occurs. If the target device responds normally, the script will record the response delay time; if the device does not respond, it may indicate that the switch corresponding to the target IP address has a network failure or configuration problem.

[0075] In one embodiment, step 140 may be specifically implemented as follows: if the return value indicates that the other switches can communicate, then obtaining the MAC address corresponding to the IP address of the other switch through an arp request.

[0076] In the embodiment of the present invention, when the return value of the ICMP request indicates that the target switch can communicate, the next step is to obtain the MAC address of the switch through an ARP (Address Resolution Protocol) request. The ARP request is a protocol for resolving the mapping relationship between the IP address of a device in a network and the physical hardware address (MAC address). Specifically, after the switch responds to the ICMP request, the script will initiate an ARP request, send a request to the IP address of the target switch, and inquire about the MAC address corresponding to the IP address. After receiving the ARP request, the target switch will return its own MAC address to the device that initiated the request.

[0077] In this way, network administrators can not only confirm whether the IP address of the switch is reachable, but also obtain the hardware address (MAC address) of the switch, which is crucial for device management, network topology optimization, traffic monitoring and troubleshooting. The MAC address is a unique identifier for each device in the network, which is used for forwarding and locating data frames within the LAN.

[0078] In one embodiment, the communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the port of the first switch is communicatively connected to the port of the second switch.

[0079] In an embodiment of the present invention, in a network, Trunk mode is a communication mode that allows multiple virtual local area network (VLAN) data to be transmitted between switches. Specifically, the port of the first switch and the port of the second switch are both configured as Trunk mode, which means that the ports of the two switches will be able to carry traffic from multiple VLANs at the same time and distinguish data frames from different VLANs by tagging. Through this configuration, the connection between the switches can not only transmit the original Ethernet frame, but also carry VLAN identifiers, thereby transmitting traffic from multiple virtual local area networks between different switches. By establishing a Trunk connection between the first switch and the second switch, the network administrator can ensure that the communication between different VLANs remains independent, while efficiently using physical links, avoiding the redundancy problem of each VLAN requiring an independent physical connection.

[0080] Figure 3 FIG. 1 is a flow chart of a method for monitoring an IP address provided by another exemplary embodiment of the present invention. Figure 3 As shown, step 150 may include:

[0081] Step 152: Obtain the sending traffic corresponding to the MAC address.

[0082] Step 153: If the sent traffic is greater than the preset traffic threshold, the IP address is determined to be an abnormal address.

[0083] In an embodiment of the present invention, by obtaining the MAC address of a device, a network administrator can further analyze the network traffic associated with the device. Specifically, the system can monitor the sending traffic corresponding to the MAC address and compare it with a preset traffic threshold. If the sending traffic of the device exceeds the preset threshold, the IP address of the device can be determined to be an abnormal address. This detection of traffic anomalies is usually used to identify potential problems in the network, such as network attacks (e.g., DoS attacks), malware propagation, or device failures.

[0084] When the device's sending traffic increases abnormally, it may mean that the device is performing abnormal data transmission, such as excessive broadcast storms, a large number of data packets, or unnecessary traffic, which may occupy a large amount of bandwidth and affect the performance of the entire network. By real-time monitoring of the sending traffic corresponding to the MAC address and combining it with the preset traffic threshold, these abnormal behaviors can be discovered and located in time, so that corresponding measures can be taken, such as isolating the abnormal device, analyzing its traffic content, or adjusting the network configuration to reduce the impact.

[0085] Figure 4 FIG. 1 is a schematic diagram of a monitoring system for an IP address provided by an exemplary embodiment of the present invention. Figure 4 As shown, the IP address monitoring system includes: a first switch 201, used to send MAC messages; wherein the target IP address in the MAC message is the IP address of the first switch; a second switch 202, used to receive MAC messages and send MAC messages; wherein the first switch is communicatively connected to the second switch; a data acquisition and analysis device 203, used to receive MAC messages and obtain the IP address of the first switch based on the MAC messages, wherein the second switch is used to connect the data acquisition and analysis device and the first switch together in the same network; based on the IP address, obtain the corresponding MAC address; based on the MAC address and preset conditions, monitor the IP address.

[0086] The present invention provides an IP address monitoring system, comprising: a first switch, used to send MAC messages; wherein the target IP address in the MAC message is the IP address of the first switch; a second switch, used to receive MAC messages and send MAC messages; wherein the first switch is connected to the second switch in communication; a data acquisition and analysis device, used to receive MAC messages and obtain the IP address of the first switch based on the MAC messages, wherein the second switch is used to connect the data acquisition and analysis device and the first switch together in the same network; the data acquisition and analysis device obtains the corresponding MAC address based on the IP address; the data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions. By real-time monitoring of MAC messages, changes in the IP address can be discovered in a timely manner, thereby quickly updating IP address statistics.

[0087] The embodiment of the present invention provides an IP address monitoring system. The system embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, in addition to the CPU, memory, network interface, and non-volatile memory, the device in the embodiment where the system is located can generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, as a device in a logical sense, it is formed by the CPU of the device where it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them.

[0088] In one embodiment, the data collection and analysis device may be specifically configured to generate a first alarm message if it is determined that the IP address corresponds to a different MAC address; wherein the first alarm message indicates that there is an address conflict in the IP address.

[0089] In one embodiment, before the data collection and analysis device receives the MAC message, the IP address monitoring system may be specifically configured as follows: the second switch copies the traffic of the port of the first switch to the port of the data collection and analysis device.

[0090] In one embodiment, the data collection and analysis device can be specifically configured as follows: extracting the subnet mask from the IP address; determining the number of bits of the subnet mask; generating an ICMP request if the number of bits of the subnet mask meets a preset number of bits; obtaining a return value in response to the ICMP request; and obtaining a MAC address corresponding to the IP address based on the return value.

[0091] In one embodiment, the data collection and analysis device may be specifically configured to: send the ICMP request to other switches in the network based on the number of transmissions; and obtain the return value of each other switch that responds to the ICMP request.

[0092] In one embodiment, the data collection and analysis device can be specifically configured as follows: based on the number of bits in the subnet mask, an address range is obtained; wherein the address range includes multiple target IP addresses; based on the number of transmissions, an ICMP request is sent to other switches corresponding to each target IP address.

[0093] In one embodiment, the data collection and analysis device may be specifically configured as follows: if the return value indicates that other switches can communicate, then the MAC address corresponding to the IP address of the other switch is obtained through an arp request.

[0094] In one embodiment, the communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the port of the first switch is communicatively connected to the port of the second switch.

[0095] In one embodiment, the data collection and analysis device may be specifically configured to: obtain the sending traffic corresponding to the MAC address; if the sending traffic is greater than a preset traffic threshold, determine that the IP address is an abnormal address.

[0096] Figure 5 A block diagram of an electronic device according to an embodiment of the present application is illustrated.

[0097] like Figure 5 As shown, the electronic device 10 includes one or more processors 11 and a memory 12 .

[0098] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0099] The memory 12 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may run the program instructions to implement the IP address monitoring method and / or other desired functions of the various embodiments of the present application described above. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0100] In one example, the electronic device 10 may further include: an input device 13 and an output device 14, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0101] When the electronic device 10 is a stand-alone device, the input device 13 may be a communication network connector for receiving collected input signals from the first device and the second device.

[0102] In addition, the input device 13 may also include, for example, a keyboard, a mouse, and the like.

[0103] The output device 14 can output various information to the outside, including the determined distance information, direction information, etc. The output device 14 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0104] Of course, to simplify, Figure 5 Only some of the components related to the present application in the electronic device 10 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 10 may also include any other appropriate components.

[0105] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0106] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0107] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present application to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0108] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for monitoring an IP address, characterized in that: include: The first switch sends a MAC message; wherein the target IP address in the MAC message is the IP address of the first switch; The second switch receives the MAC message and sends the MAC message; wherein the first switch is communicatively connected with the second switch; The data collection and analysis device receives the MAC message and obtains the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data collection and analysis device and the first switch to the same network; The data collection and analysis device obtains the corresponding MAC address based on the IP address; The data collection and analysis device monitors the IP address based on the MAC address and preset conditions.

2. The method for monitoring an IP address according to claim 1, characterized in that: The data collection and analysis device monitors the IP address based on the MAC address and preset conditions, including: If it is determined that the IP address corresponds to a different MAC address, a first alarm message is generated; wherein the first alarm message indicates that an address conflict exists in the IP address.

3. The method for monitoring an IP address according to claim 1, characterized in that: Before the data collection and analysis device receives the MAC message, the method further includes: The second switch copies the traffic of the port of the first switch to the port of the data collection and analysis device.

4. The method for monitoring an IP address according to claim 1, characterized in that: The data collection and analysis device obtains the corresponding MAC address based on the IP address, including: Extracting a subnet mask from the IP address; Determine the number of bits of the subnet mask; If the number of bits of the subnet mask meets the preset number of bits, an ICMP request is generated; Obtain a return value in response to the ICMP request; Based on the returned value, the MAC address corresponding to the IP address is obtained.

5. The method for monitoring an IP address according to claim 4, characterized in that: The obtaining of the return value in response to the ICMP request includes: Based on the number of transmissions, the ICMP request is sent to other switches in the network; Get the return value of each other switch that responded to the ICMP request.

6. The method for monitoring an IP address according to claim 5, characterized in that: The sending of the ICMP request to other switches in the network based on the number of sending times includes: Based on the number of bits of the subnet mask, an address range is obtained; wherein the address range includes multiple target IP addresses; Based on the number of transmissions, the ICMP request is sent to other switches corresponding to each target IP address.

7. The method for monitoring an IP address according to claim 4, characterized in that: The acquiring, based on the returned value, a MAC address corresponding to the IP address comprises: If the return value indicates that the other switch can communicate, the MAC address corresponding to the IP address of the other switch is obtained through an arp request.

8. The method for monitoring an IP address according to claim 1, characterized in that: The communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the port of the first switch is communicatively connected to the port of the second switch.

9. The method for monitoring an IP address according to claim 1, characterized in that: The data collection and analysis device monitors the IP address based on the MAC address and preset conditions, including: Obtain the sending traffic corresponding to the MAC address; If the sending traffic is greater than a preset traffic threshold, the IP address is determined to be an abnormal address.

10. A system for monitoring IP addresses, characterized in that: include: A first switch, configured to send a MAC message; wherein the target IP address in the MAC message is the IP address of the first switch; A second switch, configured to receive the MAC message and send the MAC message; wherein the first switch is communicatively connected with the second switch; A data collection and analysis device, used to receive the MAC message and obtain the IP address of the first switch based on the MAC message, wherein the second switch is used to connect the data collection and analysis device and the first switch together in the same network; based on the IP address, obtain the corresponding MAC address; based on the MAC address and preset conditions, monitor the IP address.

Images