A method and system for monitoring IP addresses

Abstract

This invention provides a method and system for monitoring IP addresses, comprising: a first switch sending MAC packets, wherein the target IP address in the MAC packets is the IP address of the first switch; a second switch receiving and sending MAC packets; wherein the first and second switches are communicatively connected; a data acquisition and analysis device receiving the MAC packets and obtaining the IP address of the first switch based on the MAC packets; wherein the second switch is used to connect the data acquisition and analysis device and the first switch to the same network; the data acquisition and analysis device obtaining the corresponding MAC address based on the IP address; and the data acquisition and analysis device monitoring the IP address based on the MAC address and preset conditions. By monitoring MAC packets in real time, changes in IP addresses can be detected promptly, thereby quickly updating IP address statistics.

Description

Technical Field

[0001] This invention relates to the field of network management technology, and in particular to a method and system for monitoring IP addresses. Background Technology

[0002] In today's digital age, with the continuous expansion of network scale and complexity, accurately counting the existing IP addresses in the network has become particularly important. Whether it's enterprise network management, internet service provider resource allocation, or network security protection, a comprehensive and clear understanding of the IP addresses in the network is essential. However, traditional IP statistics methods typically rely on manual recording, electronic documents, or simple database management, all of which have many limitations. For example, manual recording is not only inefficient but also prone to errors; electronic documents are not efficient enough for information retrieval and statistics and can easily lead to information silos; while simple database management may not be able to update IP data in real time and struggles to cope with dynamic changes in the network environment. Summary of the Invention

[0003] To address the aforementioned technical problems, this invention is proposed. Embodiments of this invention provide a method and system for monitoring IP addresses, thereby solving the problem of low efficiency in IP address statistics in the prior art.

[0004] According to one aspect of the present invention, a method for monitoring IP addresses is provided, comprising:

[0005] The first switch sends a MAC packet; wherein the destination IP address in the MAC packet is the IP address of the first switch.

[0006] The second switch receives the MAC packet and sends the MAC packet; wherein the first switch and the second switch are communicatively connected;

[0007] The data acquisition and analysis device receives the MAC packet and obtains the IP address of the first switch based on the MAC packet. The second switch is used to connect the data acquisition and analysis device and the first switch to the same network.

[0008] The data acquisition and analysis equipment obtains the corresponding MAC address based on the IP address;

[0009] The data acquisition and analysis equipment monitors the IP address based on the MAC address and preset conditions.

[0010] In one embodiment, the data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions, including:

[0011] If it is determined that the IP address corresponds to a different MAC address, a first alarm message is generated; wherein, the first alarm message indicates that the IP address has an address conflict.

[0012] In one embodiment, before the data acquisition and analysis device receives the MAC packet, the IP address monitoring method further includes:

[0013] The second switch copies the traffic from the port of the first switch to the port of the data acquisition and analysis device.

[0014] In one embodiment, the data acquisition and analysis device obtains the corresponding MAC address based on the IP address, including:

[0015] Extract the subnet mask from the IP address;

[0016] Determine the number of bits in the subnet mask;

[0017] If the number of bits in the subnet mask meets the preset number of bits, an ICMP request is generated;

[0018] Obtain the return value in response to the ICMP request;

[0019] Based on the return value, obtain the MAC address corresponding to the IP address.

[0020] In one embodiment, obtaining the return value in response to the ICMP request includes:

[0021] Based on the number of transmissions, the ICMP request is sent to other switches in the network;

[0022] Obtain the return value from each other switch that responded to the ICMP request.

[0023] In one embodiment, sending the ICMP request to other switches in the network based on the number of transmissions includes:

[0024] Based on the number of bits in the subnet mask, an address range is obtained; wherein, the address range includes multiple target IP addresses;

[0025] Based on the number of transmissions, the ICMP request is sent to other switches corresponding to each target IP address.

[0026] In one embodiment, obtaining the MAC address corresponding to the IP address based on the return value includes:

[0027] If the return value indicates that the other switches can communicate, then the MAC address corresponding to the IP address of the other switches is obtained through an ARP request.

[0028] In one embodiment, the communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the port of the first switch and the port of the second switch are communicatively connected.

[0029] In one embodiment, the data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions, including:

[0030] Obtain the sending traffic corresponding to the MAC address;

[0031] If the transmitted traffic exceeds a preset traffic threshold, the IP address is determined to be an abnormal address.

[0032] According to another aspect of the present invention, an IP address monitoring system is provided, comprising:

[0033] The first switch is used to send MAC packets; wherein the destination IP address in the MAC packet is the IP address of the first switch.

[0034] The second switch is used to receive the MAC message and send the MAC message; wherein the first switch and the second switch are communicatively connected.

[0035] A data acquisition and analysis device is used to receive the MAC packet and obtain the IP address of the first switch based on the MAC packet, wherein the second switch is used to connect the data acquisition and analysis device and the first switch to the same network; obtain the corresponding MAC address based on the IP address; and monitor the IP address based on the MAC address and preset conditions.

[0036] This invention provides a method and system for monitoring IP addresses, comprising: a first switch sending MAC packets, wherein the target IP address in the MAC packets is the IP address of the first switch; a second switch receiving and sending MAC packets; wherein the first and second switches are communicatively connected; a data acquisition and analysis device receiving the MAC packets and obtaining the IP address of the first switch based on the MAC packets; wherein the second switch is used to connect the data acquisition and analysis device and the first switch to the same network; the data acquisition and analysis device obtaining the corresponding MAC address based on the IP address; and the data acquisition and analysis device monitoring the IP address based on the MAC address and preset conditions. By monitoring MAC packets in real time, changes in IP addresses can be detected promptly, thereby quickly updating IP address statistics. The method of using free MAC packets to count IP addresses has high accuracy. Since a MAC address is a unique identifier for a device, analyzing MAC packets can accurately determine the existence of a device and further infer its corresponding IP address. For example, by monitoring MAC packets using network traffic analysis tools, the communication behavior of a device can be tracked, thereby determining the IP address it uses. Utilizing free MAC address statistics for IP address tracking has wide applications in enterprise network management, internet service provider (ISP) resource allocation, and network security. In enterprise network management, accurate IP address statistics allow for better network resource planning, improving network performance and management efficiency. For ISPs, understanding the existing IP addresses on the network helps in the rational allocation of IP resources and improved service quality. In network security, monitoring MAC addresses allows for the timely detection of abnormal traffic and malicious IP addresses, strengthening network security defenses. Attached Figure Description

[0037] The above and other objects, features, and advantages of the present invention will become more apparent from the more detailed description of the embodiments of the invention in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same parts or steps.

[0038] Figure 1 This is a flowchart illustrating an exemplary embodiment of the IP address monitoring method provided by the present invention.

[0039] Figure 2 This is a flowchart illustrating an IP address monitoring method provided in another exemplary embodiment of the present invention.

[0040] Figure 3 This is a flowchart illustrating an IP address monitoring method provided in another exemplary embodiment of the present invention.

[0041] Figure 4 This is a schematic diagram of the structure of an IP address monitoring system provided in an exemplary embodiment of the present invention.

[0042] Figure 5 This is a structural diagram of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0043] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0044] Figure 1 This is a flowchart illustrating an IP address monitoring method provided in an exemplary embodiment of the present invention. Figure 1 As shown, methods for monitoring IP addresses include:

[0045] Step 110: The first switch sends a MAC packet, wherein the destination IP address in the MAC packet is the IP address of the first switch.

[0046] In this embodiment of the invention, the MAC packet is a gratuitous MAC packet, also known as a gratuitous ARP (ARP) packet. Gratuitous ARP request packets differ significantly in structure from ordinary ARP request packets. In an ordinary ARP request packet, the target IP address is the IP address of another host, with the purpose of requesting the resolution of the MAC address corresponding to that IP address. In a gratuitous ARP request, the target IP address is the local machine's IP address. For example, the target of an ordinary ARP request might be to obtain the MAC address of a host, such as: "Host A needs the MAC address of 10.1.1.2, and 10.1.1.2 is the IP address of another host." The target of a gratuitous ARP request, however, is to obtain the MAC address corresponding to the local machine's IP address, such as: "Host A needs the MAC address of 10.1.1.1, and 10.1.1.1 is the IP address of the local machine (host A)."

[0047] The first switch is the core switch. A core switch is a crucial device in a network used to carry large amounts of data traffic and connect different network areas. It is typically located in the network's core layer. Its main function is to ensure efficient and reliable data transmission between different departments, subnets, local area networks (LANs), or wide area networks (WANs).

[0048] Free MAC messages have the following important functions:

[0049] First, this type of message serves as an announcement. It broadcasts data packets without expecting a response, solely to inform other hosts of its IP and MAC addresses. For example, when a host starts up, it sends a gratuitous ARP request, requesting its own IP address and MAC address. This allows other devices on the network to quickly learn of the device's existence and its corresponding IP and MAC address information.

[0050] Secondly, it can be used to detect IP address conflicts. When a host sends a gratuitous ARP request packet and receives an ARP response packet, it indicates that a host already exists on the network using that IP address. For example, in a local area network, if a newly joined host sends a gratuitous ARP request and receives a response, an IP address conflict can be detected in time, preventing errors in subsequent communication.

[0051] Finally, it can be used to update the ARP cache tables of other hosts. If a host changes its network card, but other hosts' ARP cache tables still retain the old MAC address, a gratuitous ARP packet can be sent. Upon receiving this packet, other hosts will update their ARP cache tables, replacing the old MAC address with the new one. This ensures the accuracy and stability of network communication.

[0052] Step 120: The second switch receives and sends MAC packets, wherein the first switch and the second switch are connected in communication.

[0053] In this embodiment of the invention, the second switch is an access switch, which is a switching device in a computer network used to connect terminal devices (such as computers, printers, IP phones, etc.) to the network. It is located in the network's access layer.

[0054] Step 130: The data acquisition and analysis device receives MAC packets and obtains the IP address of the first switch based on the MAC packets. The second switch is used to connect the data acquisition and analysis device and the first switch to the same network.

[0055] In this embodiment of the invention, the data acquisition and analysis device receives MAC packets from switches in the network and can extract the IP address of the corresponding first switch based on the packet information. Specifically, the second switch acts as a bridge connecting the data acquisition and analysis device and the first switch in this network architecture, ensuring that they are in the same local area network (LAN). By obtaining the IP address of the first switch, the data acquisition and analysis device can further perform network communication and data exchange, realizing network topology identification and interaction between network devices. This approach not only improves the efficiency of data acquisition and analysis but also effectively supports network monitoring and management, helping network administrators track the operating status of network devices in real time and perform timely fault diagnosis and handling. Furthermore, this mechanism based on MAC address learning and IP address mapping enhances the flexibility and reliability of the network.

[0056] Furthermore, the devices in the network are constantly changing; the addition of new devices and the retirement of old ones can both lead to changes in IP addresses. By monitoring MAC packets in real time, these changes can be detected promptly, and IP address statistics can be updated quickly. For example, using a Security Information and Event Management (SIEM) system, MAC packets in the network can be centrally collected and analyzed to promptly identify and record new IP addresses.

[0057] Step 140: The data acquisition and analysis equipment obtains the corresponding MAC address based on the IP address.

[0058] Step 150: The data acquisition and analysis equipment monitors the IP address based on the MAC address and preset conditions.

[0059] This invention provides a method for monitoring IP addresses, comprising: a first switch sending a MAC packet, wherein the target IP address in the MAC packet is the IP address of the first switch; a second switch receiving and sending a MAC packet; wherein the first and second switches are communicatively connected; a data acquisition and analysis device receiving the MAC packet and obtaining the IP address of the first switch based on the MAC packet; wherein the second switch is used to connect the data acquisition and analysis device and the first switch to the same network; the data acquisition and analysis device obtaining the corresponding MAC address based on the IP address; and the data acquisition and analysis device monitoring the IP address based on the MAC address and preset conditions. By monitoring MAC packets in real time, changes in IP addresses can be detected promptly, thereby quickly updating IP address statistics. The method of using free MAC packets to count IP addresses has high accuracy. Since the MAC address is a unique identifier for a device, analyzing MAC packets can accurately determine the existence of the device and further infer its corresponding IP address. For example, by monitoring MAC packets using network traffic analysis tools, the communication behavior of a device can be tracked, thereby determining the IP address it uses. Utilizing free MAC address statistics for IP address tracking has wide applications in enterprise network management, internet service provider (ISP) resource allocation, and network security. In enterprise network management, accurate IP address statistics allow for better network resource planning, improving network performance and management efficiency. For ISPs, understanding the existing IP addresses on the network helps in the rational allocation of IP resources and improved service quality. In network security, monitoring MAC addresses allows for the timely detection of abnormal traffic and malicious IP addresses, strengthening network security defenses.

[0060] Figure 2 This is a flowchart illustrating an IP address monitoring method provided in another exemplary embodiment of the present invention. Figure 2 As shown, step 150 may include:

[0061] Step 151: If it is determined that the IP address corresponds to a different MAC address, then generate the first alarm message, which indicates that there is an address conflict between the IP addresses.

[0062] In this embodiment of the invention, when the system detects that an IP address corresponds to multiple different MAC addresses, it means that there is an address conflict for that IP address, which may lead to network communication instability or interruption. To promptly detect and handle this situation, the data acquisition and analysis device generates a first alarm message, indicating the IP address conflict. Address conflicts typically occur when multiple devices in the network are incorrectly configured with the same IP address, or when conflicts arise during dynamic address allocation within the network. The generation of the first alarm message helps network administrators quickly locate the source of the problem, preventing data loss, network latency, or device communication failures. To resolve address conflicts, administrators can check the configuration of the conflicting devices, reassign IP addresses, or eliminate network configuration errors, ensuring network stability and normal operation. This type of alarm mechanism is particularly important for large-scale networks, as it helps to monitor and optimize network resource allocation in real time, improving the efficiency and reliability of network management.

[0063] In one embodiment, prior to step 120, the IP address monitoring method may be specifically implemented as follows: the second switch copies the traffic of the port of the first switch to the port of the data acquisition and analysis device.

[0064] In this embodiment of the invention, the second switch copies the port traffic of the first switch to the port of the data acquisition and analysis device to achieve real-time monitoring and analysis of the traffic. This process is typically implemented using port mirroring technology, which allows a switch to copy and forward data traffic from a specified port to another port for traffic monitoring, troubleshooting, and performance analysis. Furthermore, in the configuration of the access switch, mirrored port traffic can also be configured to mirror the interconnection port traffic between the access switch and each core switch to the interconnection port connected to the data acquisition and analysis device. In this way, the data acquisition and analysis device can receive network traffic from different switches, providing comprehensive monitoring of the entire network status. Through this method, the data acquisition and analysis device can capture traffic information of all critical network links in real time, helping network administrators perform traffic analysis, performance optimization, and security monitoring.

[0065] In one embodiment, step 140 may be specifically implemented as follows: extracting the subnet mask from the IP address; determining the number of bits in the subnet mask; if the number of bits in the subnet mask meets the preset number of bits, generating an ICMP request; obtaining the return value of the ICMP request response; and obtaining the MAC address corresponding to the IP address based on the return value.

[0066] In this embodiment of the invention, the subnet mask is extracted from the IP address, and the number of bits in the subnet mask is determined. The preset number of bits is set to 24 bits, 16 bits, or 8 bits. When the subnet mask is 24 bits, the last octet (1 to 254) of the IP address is traversed sequentially, and a ping-c3 operation is performed on each IP address, sending three ICMP request packets to confirm whether the IP address is reachable. If the target IP address responds normally, the arp command is used to query the MAC address corresponding to that IP address, and the obtained result is saved to the arp.txt file. This process helps network administrators discover the IP-MAC mapping information of all active devices within the local area network, thereby enabling network device management, monitoring, and troubleshooting.

[0067] When the subnet mask is 16 bits, a larger IP range is scanned, typically from xx0.1 to xx255.254. When the subnet mask is 8 bits, it iterates through all IP addresses from x.0.0.1 to x.255.255.254. The purpose of these operations is to obtain device information across the entire subnet based on its size and automatically generate a detailed list containing IP addresses and their corresponding MAC addresses. Regardless of the subnet mask size, the combination of ping and arp commands enables fast and efficient discovery and mapping of network devices.

[0068] In this way, network administrators can scan the entire network for devices in a short time and obtain the IP and MAC addresses of all active devices, providing crucial support for network optimization, performance analysis, device management, and network security. `ping-c3` sends three ICMP request messages to check the reachability of the target host. An ICMP request is a message used for network connectivity testing; the target host responds to the request with an ICMP echo response message. The `arp` command is used to query the local computer's ARP cache, displaying the mapping between IP addresses and MAC addresses. The `arp.txt` file is a text file that stores ARP query results, recording the IP and MAC address correspondences of devices for subsequent analysis and management.

[0069] In one embodiment, step 140 may be specifically implemented as follows: based on the number of transmissions, sending the ICMP request to other switches in the network; obtaining the return value of each other switch that responded to the ICMP request.

[0070] Based on the number of ICMP requests sent, the switches in the network sequentially receive and respond to requests from the source device. Specifically, the script sends ICMP requests to every switch in the network, sending multiple ICMP request packets via the ping command, typically three times (i.e., ping-c3). Each switch responds to these requests according to its network configuration and connectivity, returning corresponding ICMP Echo Reply information. The response includes key information such as the round-trip time for each request and whether packet loss occurred, helping network administrators assess network latency and switch health.

[0071] During this process, the script automatically iterates through each switch in the network, sending ICMP requests to each switch's IP address, recording the response time (RTT, Round Trip Time) and whether each request returned successfully, and generating a detailed network performance report. These return values ​​not only reflect the connection status of the switches but also provide data support for subsequent network optimization and troubleshooting. For example, if a switch's ICMP request response time is long or there is no response, it may mean that there is a problem with the network link of that device or that the device itself is faulty.

[0072] Furthermore, by comparing the ICMP response times of different switches, administrators can analyze the location of bottlenecks in the network and further optimize the network topology or adjust traffic load balancing strategies. For large enterprise or data center networks, this automated monitoring method based on ICMP requests can effectively improve network management efficiency and promptly identify and address potential network problems.

[0073] In one embodiment, step 140 may be specifically implemented as follows: obtaining an address range based on the number of bits in the subnet mask; wherein the address range includes multiple target IP addresses; and sending ICMP requests to other switches corresponding to each target IP address based on the number of transmissions.

[0074] In this embodiment of the invention, the effective IP address range in the network can first be calculated based on the number of bits in the subnet mask. The subnet mask determines the division between the network address portion and the host address portion, thus affecting the total number of available IP addresses in the network. For example, if the subnet mask is 24 bits (i.e., 255.255.255.0), the IP address range in the network is typically from .1 to .254, and these addresses can be assigned to devices in the network (such as switches, routers, servers, etc.). Based on the number of bits in the subnet mask, the script calculates the corresponding IP address range and generates target IP addresses one by one to send ICMP requests. After obtaining the target IP address range, the script sends ICMP requests (Echo Requests) to each target IP address based on the configured number of transmissions (usually 3 times) to test the network connectivity of the target device (such as a switch). After each ICMP request is sent, the script waits for the target device's response, records the returned ICMP Echo Reply information, and collects and analyzes the response time (round-trip time, RTT) and whether packet loss occurred. If the target device responds normally, the script will record the response delay time; if the device does not respond, it may indicate that the switch corresponding to the target IP address has a network failure or configuration problem.

[0075] In one embodiment, step 140 can be specifically implemented as follows: if the return value indicates that other switches can communicate, then obtain the MAC address corresponding to the IP address of other switches through an ARP request.

[0076] In this embodiment of the invention, when the ICMP request returns a value indicating that the target switch is communicable, the next step is to obtain the switch's MAC address using an ARP (Address Resolution Protocol) request. An ARP request is a protocol used to resolve the mapping between device IP addresses and physical hardware addresses (MAC addresses) in a network. Specifically, after the switch responds to the ICMP request, the script initiates an ARP request, sending a request to the target switch's IP address to inquire about the MAC address corresponding to that IP address. Upon receiving the ARP request, the target switch sends its own MAC address back to the device that initiated the request.

[0077] In this way, network administrators can not only confirm the reachability of a switch's IP address, but also obtain the switch's hardware address (MAC address), which is crucial for device management, network topology optimization, traffic monitoring, and troubleshooting. A MAC address is a unique identifier for each device in a network, used for data frame forwarding and location within a local area network.

[0078] In one embodiment, the communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the ports of the first switch and the ports of the second switch are connected for communication.

[0079] In this embodiment of the invention, Trunk mode is a communication mode that allows switches to transmit data from multiple Virtual Local Area Networks (VLANs). Specifically, the ports of both the first and second switches are configured in Trunk mode, meaning that these two switch ports can simultaneously carry traffic from multiple VLANs and distinguish data frames from different VLANs through tagging. With this configuration, the connection between the switches can transmit not only raw Ethernet frames but also VLAN identifiers, thereby enabling the transmission of traffic from various VLANs between different switches. By establishing a Trunk connection between the first and second switches, network administrators can ensure that communication between different VLANs remains independent while efficiently utilizing physical links, avoiding the redundancy problem of each VLAN requiring a separate physical connection.

[0080] Figure 3 This is a flowchart illustrating an IP address monitoring method provided in another exemplary embodiment of the present invention. Figure 3 As shown, step 150 may include:

[0081] Step 152: Obtain the sending traffic corresponding to the MAC address.

[0082] Step 153: If the sent traffic exceeds the preset traffic threshold, the IP address is determined to be an abnormal address.

[0083] In this embodiment of the invention, by obtaining the MAC address of a device, network administrators can further analyze network traffic related to that device. Specifically, the system can monitor the traffic transmitted corresponding to that MAC address and compare it with a preset traffic threshold. If the transmitted traffic of the device exceeds the preset threshold, the device's IP address can be determined to be an abnormal address. This detection of abnormal traffic is typically used to identify potential problems in the network, such as network attacks (e.g., DoS attacks), malware propagation, or device malfunctions.

[0084] When a device's transmit traffic increases abnormally, it may indicate that the device is performing abnormal data transmission, such as excessive broadcast storms, large amounts of data packets, or unnecessary traffic. This can consume significant bandwidth and impact the performance of the entire network. By monitoring the transmit traffic corresponding to a MAC address in real time, and combining this with preset traffic thresholds, these abnormal behaviors can be detected and located promptly, allowing for appropriate measures to be taken, such as isolating the abnormal device, analyzing its traffic content, or adjusting network configurations to mitigate the impact.

[0085] Figure 4 This is a schematic diagram of the structure of an IP address monitoring system provided in an exemplary embodiment of the present invention. For example... Figure 4 As shown, the IP address monitoring system includes: a first switch 201, used to send MAC packets; wherein the target IP address in the MAC packet is the IP address of the first switch; a second switch 202, used to receive and send MAC packets; wherein the first switch and the second switch are communicatively connected; a data acquisition and analysis device 203, used to receive MAC packets and obtain the IP address of the first switch based on the MAC packets; wherein the second switch is used to connect the data acquisition and analysis device and the first switch to the same network; obtain the corresponding MAC address based on the IP address; and monitor the IP address based on the MAC address and preset conditions.

[0086] This invention provides an IP address monitoring system, comprising: a first switch for sending MAC packets, wherein the target IP address in the MAC packet is the IP address of the first switch; a second switch for receiving and sending MAC packets, wherein the first switch and the second switch are communicatively connected; and a data acquisition and analysis device for receiving MAC packets and obtaining the IP address of the first switch based on the MAC packets, wherein the second switch connects the data acquisition and analysis device and the first switch to the same network; the data acquisition and analysis device obtains the corresponding MAC address based on the IP address; and the data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions. By monitoring MAC packets in real time, changes in IP addresses can be detected promptly, thereby quickly updating IP address statistics.

[0087] This invention provides an IP address monitoring system. The system can be implemented in software, hardware, or a combination of both. From a hardware perspective, in addition to the CPU, memory, network interface, and non-volatile memory, the device housing the system in the embodiment typically includes other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, as a logical device, it is formed by the CPU of the device loading the corresponding computer program instructions from the non-volatile memory into memory for execution.

[0088] In one embodiment, the data acquisition and analysis device may be specifically configured to generate a first alarm message if it is determined that an IP address corresponds to a different MAC address; wherein the first alarm message indicates that there is an address conflict between the IP addresses.

[0089] In one embodiment, before the data acquisition and analysis device receives MAC packets, the IP address monitoring system can be specifically configured such that the second switch copies the traffic of the port of the first switch to the port of the data acquisition and analysis device.

[0090] In one embodiment, the data acquisition and analysis device may be specifically configured to: extract the subnet mask from the IP address; determine the number of bits in the subnet mask; if the number of bits in the subnet mask meets the preset number of bits, generate an ICMP request; obtain the return value of the ICMP request response; and obtain the MAC address corresponding to the IP address based on the return value.

[0091] In one embodiment, the data acquisition and analysis device may be specifically configured to: send ICMP requests to other switches in the network based on the number of transmissions; and obtain the return value of each other switch that responds to the ICMP request.

[0092] In one embodiment, the data acquisition and analysis device may be specifically configured to: obtain an address range based on the number of bits in the subnet mask; wherein the address range includes multiple target IP addresses; and send ICMP requests to other switches corresponding to each target IP address based on the number of transmissions.

[0093] In one embodiment, the data acquisition and analysis device may be specifically configured such that if the return value indicates that other switches can communicate, the device obtains the MAC address corresponding to the IP address of the other switch through an ARP request.

[0094] In one embodiment, the communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the ports of the first switch and the ports of the second switch are connected for communication.

[0095] In one embodiment, the data acquisition and analysis device may be specifically configured to: acquire the transmission traffic corresponding to the MAC address; if the transmission traffic is greater than a preset traffic threshold, then determine that the IP address is an abnormal address.

[0096] Figure 5 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0097] like Figure 5 As shown, the electronic device 10 includes one or more processors 11 and memory 12.

[0098] The processor 11 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 10 to perform desired functions.

[0099] The memory 12 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 11 may execute the program instructions to implement the IP address monitoring methods and / or other desired functions described in the various embodiments of this application above. Various contents such as input signals, signal components, and noise components may also be stored in the computer-readable storage medium.

[0100] In one example, the electronic device 10 may also include an input device 13 and an output device 14, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0101] When the electronic device 10 is a standalone device, the input device 13 can be a communication network connector for receiving the collected input signals from the first device and the second device.

[0102] In addition, the input device 13 may also include, for example, a keyboard, a mouse, etc.

[0103] The output device 14 can output various information to the outside, including determined distance information, direction information, etc. The output device 14 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0104] Of course, for the sake of simplicity, Figure 5 Only some of the components of the electronic device 10 relevant to this application are shown in this illustration; components such as buses, input / output interfaces, etc., are omitted. In addition, the electronic device 10 may include any other suitable components depending on the specific application.

[0105] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0106] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0107] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

[0108] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for monitoring IP addresses, characterized in that, include: The first switch sends a MAC packet; wherein the destination IP address in the MAC packet is the IP address of the first switch. The second switch receives the MAC packet and sends the MAC packet; wherein the first switch and the second switch are communicatively connected; The MAC message is a gratuitous MAC message, also known as a gratuitous ARP message; The data acquisition and analysis device receives the MAC packet and obtains the IP address of the first switch based on the MAC packet. The second switch is used to connect the data acquisition and analysis device and the first switch to the same network. The data acquisition and analysis equipment obtains the corresponding MAC address based on the IP address; The data acquisition and analysis equipment monitors the IP address based on the MAC address and preset conditions; The data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions, including: If it is determined that the IP address corresponds to a different MAC address, a first alarm message is generated; wherein, the first alarm message indicates that the IP address has an address conflict; Before the data acquisition and analysis device receives the MAC message, it also includes: The second switch copies the traffic from the port of the first switch to the port of the data acquisition and analysis device. The data acquisition and analysis device obtains the corresponding MAC address based on the IP address, including: Extract the subnet mask from the IP address; Determine the number of bits in the subnet mask; If the number of bits in the subnet mask meets the preset number of bits, an ICMP request is generated; Obtain the return value in response to the ICMP request; Based on the return value, obtain the MAC address corresponding to the IP address.

2. The method for monitoring IP addresses according to claim 1, characterized in that, The process of obtaining the return value of the ICMP request response includes: Based on the number of transmissions, the ICMP request is sent to other switches in the network; Obtain the return value from each other switch that responded to the ICMP request.

3. The IP address monitoring method according to claim 2, characterized in that, The step of sending the ICMP request to other switches in the network based on the number of transmissions includes: Based on the number of bits in the subnet mask, an address range is obtained; wherein, the address range includes multiple target IP addresses; Based on the number of transmissions, the ICMP request is sent to other switches corresponding to each target IP address.

4. The IP address monitoring method according to claim 3, characterized in that, The step of obtaining the MAC address corresponding to the IP address based on the return value includes: If the return value indicates that the other switches can communicate, then the MAC address corresponding to the IP address of the other switches is obtained through an ARP request.

5. The IP address monitoring method according to claim 4, characterized in that, The communication mode of the port of the first switch is trunk mode, the communication mode of the port of the second switch is trunk mode, and the port of the first switch and the port of the second switch are connected for communication.

6. The method for monitoring IP addresses according to claim 5, characterized in that, The data acquisition and analysis device monitors the IP address based on the MAC address and preset conditions, including: Obtain the sending traffic corresponding to the MAC address; If the transmitted traffic exceeds a preset traffic threshold, the IP address is determined to be an abnormal address.

Images