IPTABLES-based automatic network diagnosis analysis method

Abstract

The invention relates to the technical field of networks, in particular to an IPTABLES-based automatic network diagnosis analysis method, which comprises a system diagnosis integration module, a plurality of groups of import diagnosis modules, a diagnosis execution module and a diagnosis output result module, the diagnosis integration module is respectively connected with the multiple groups of import diagnosis modules, the multiple groups of import diagnosis modules are respectively connected with the diagnosis execution module, and the diagnosis execution module is connected with the diagnosis output result module. According to the method, a single or multiple diagnosis execution module capable of being dynamically imported is designed, each module adopts a standardized structural design, a dynamic integrated framework is realized at the bottom layer of the system, and interface module importing and analysis result execution operation are supported.

Description

Technical Field

[0001] The invention relates to the field of network technology, in particular to an automatic network diagnosis and analysis method based on IPTABLES. Background Art

[0002] Mobile terminals often experience network failures. Since the causes of the failures are very complex, it is difficult to analyze the causes. Currently, there are generally the following problems in failure analysis:

[0003] Question 1. When a network failure occurs, network engineers usually use various technical means to analyze the problem based on their personal experience. The analysis results and efficiency are related to the engineer's personal experience.

[0004] Question 2: If the current version of the system does not support certain diagnostic features, it is necessary to re-modify the kernel and adjust the code and compile the version, which is cumbersome to locate network problems.

[0005] Question 3: Diagnose network fault environment. If the network fault cannot be diagnosed in time, the best time to analyze the real cause of the network fault may be missed.

[0006] Question 4: Sometimes a fault needs to be repeatedly located before the cause is found, which requires senior technicians to invest a lot of time and the labor cost of fault analysis is high.

[0007] Taking CPE products as an example, some services need to send data through specific data packets, but when problems arise, there is no specific means to confirm the problems. It is necessary to modify the code or reproduce the problems to confirm the problems, which greatly consumes manpower costs and product maintenance costs. Summary of the invention

[0008] In order to reduce the difficulty of network diagnosis for technicians and quickly analyze the cause of the fault, the present invention provides an automatic network diagnosis and analysis method based on IPTABLES, and designs a method that can dynamically import a single or multiple diagnosis execution modules. Each module adopts a standardized structural design (function description interface, diagnosis execution interface, analysis interface, result output interface). The system bottom layer implements a dynamic integration framework and supports interface-based import of modules and execution of analysis results operations.

[0009] The technical solution adopted by the present invention to solve its technical problem is:

[0010] An automatic network diagnosis and analysis method based on IPTABLES includes a system diagnosis integration module, multiple groups of imported diagnosis modules, a diagnosis execution module and a diagnosis output result module; the diagnosis integration module is respectively connected to the multiple groups of imported diagnosis modules, the multiple groups of imported diagnosis modules are respectively connected to the diagnosis execution module, and the diagnosis execution module is connected to the diagnosis output result module; Figure 2 shown.

[0011] in:

[0012] The system diagnostic integration module is an integrable framework that supports the import of single or multiple diagnostic modules. The system diagnostic integration module integrates the overall framework of each diagnostic module, including the configuration of the user interface and the introduction of each configuration. The user can select the corresponding module according to their needs. The diagnostic module can also develop corresponding extension modules as needed, which can be selected when used.

[0013] Multiple groups of imported diagnostic modules implement specific diagnostic functions; each imported diagnostic module contains user-state dynamic link files and kernel-state dynamic link files; according to the configuration selected by the diagnostic integration module, the corresponding user and kernel dynamic link files are loaded into the system, at which time the corresponding problems can be diagnosed according to user needs. This module can accurately select the corresponding modules for users, and unnecessary ones do not need to be imported into the system, accurately matching user needs and reducing system burden.

[0014] The diagnostic execution module generates a configuration file based on the imported diagnostic module in the user interface, automatically issues the execution command, loads the selected single or multiple files into the user space and kernel space respectively, issues the corresponding files to the single board and reproduces the problem; this has specific implementations for each diagnostic module, such as character or string matching, protocol or flag bit matching, IP range matching, time period matching, MAC address matching, etc., which depends on the code implementation of the specific business module. When the data service is in normal operation, a hook function is added during the transmission of the data packet to match the corresponding algorithm implementation. If a match is found, it is handed over to the diagnostic output module for processing.

[0015] The diagnostic output result module outputs the matched data packets to the corresponding LOG file, and diagnoses the output results by analyzing the data in the LOG. The diagnostic output module needs to analyze whether the data is the data packet required after matching according to the diagnostic execution module. If it is a matched data packet, the diagnostic result is output and reported to the user. The diagnostic data module can identify the problem in detail in the corresponding LOG to achieve more detailed analysis.

[0016] An automatic network diagnosis and analysis method based on IPTABLES includes the following steps:

[0017] Step (1): A problem occurs in the data service and needs to be diagnosed. After analyzing the problem, the direction of diagnosis is determined as needed. According to the direction of diagnosis, the corresponding module is selected through the user interface and a command is issued.

[0018] Step (2): After confirming which modules need to be issued, click Confirm. The system will automatically import the user and kernel link files of these modules into the system, load the corresponding diagnostic modules, and may also include user extension modules.

[0019] Step (3): At this time, you only need to hang up according to the normal data service. When a problem occurs, the kernel hook function will match the data packet and make corresponding processing. If the problem does not occur and the data packet does not match the data packet, the data packet will be executed normally according to the process without affecting the normal function.

[0020] Step (4): If the data packet is matched, it is determined that the data packet is matched according to the rules of the diagnostic module, and according to the requirements of this hook function, the keywords of the data packet are sent to the corresponding LOG file for subsequent problem analysis.

[0021] Step (5): The diagnostic execution module will analyze the problem based on the output LOG file to verify whether it is the problem we speculated. If it is, the diagnostic result will be output, otherwise it will be ignored.

[0022] Step (6): Users can confirm the problem based on the output diagnosis results and discuss solutions based on the problem.

[0023] Automatic network diagnosis and analysis method based on IPTABLES. It simplifies the method of locating problems. You don't need to spend a long time on a problem. You just need to hang up normally and confirm the problem according to the LOG.

[0024] The present invention also has the following additional technical features: the import of the diagnostic module requires the development of the dynamic link file of the corresponding module in advance, and the dynamic link file includes the shared library dynamic link file of the user state and the kernel dynamic link file of the kernel state; the function of the kernel state is called by the corresponding hook function to determine the action of the network packet (receiving, discarding or LOG output, etc.); the corresponding module can realize certain functions, such as packet keyword matching, packet size matching, etc.; after determining the extended function, the relevant module is developed, the user state is compiled into the user layer dynamic link file and copied to the file corresponding to the library of IPTABLES, and the kernel state is developed and compiled into the kernel state dynamic link file, which is dynamically loaded into the kernel when the problem needs to be located; when the problem is reproduced, the key print will be output, the problem will be diagnosed and the diagnosis result will be output; for example, in the packet content filtering module, the code waits for processing the data packet sent from the kernel through an infinite loop, and the matching function therein uses an algorithm to match the keyword in the data packet, if the corresponding keyword is matched, it is printed in the LOG, and the diagnosis result is output according to the keyword analysis in the LOG. Some network security related issues similar to friendly-scanner, pplsip, sundayddr, SIPScan, etc. can be discovered through this module.

[0025] The present invention also has the following additional technical features: the diagnosis execution module includes a function description interface, a diagnosis execution interface, an analysis interface and a result output interface; the function description interface includes the selection of modules and function descriptions, and the corresponding problem can be diagnosed by selecting a certain module; the diagnosis execution interface generates a corresponding script file according to the selected module and automatically sends it to the single board and runs it, and outputs the corresponding LOG to a specific file when a problem occurs; the analysis interface obtains the output LOG file and analyzes whether there is a corresponding result according to the matching function of the corresponding module; the result output interface will output the cause of the fault in the function description according to the content of the analysis interface.

[0026] The present invention also has the following additional technical features: each diagnostic execution module independently implements a diagnostic function, and the user management interface can import pre-developed functional modules; according to the module function description information, select the function set to be added, and implement the analysis and output of the diagnostic execution results at one time. Figure 3 The functional description is shown in the overview diagram.

[0027] The present invention has been implemented in multiple products within the company and has been applied in actual work, basically achieving the expected effect. Compared with the prior art, the present invention has the following advantages:

[0028] Advantages 1. The present invention configures the user interface, dynamically loads the diagnostic execution module, and automatically analyzes the network problem solution.

[0029] Advantage 2: The present invention facilitates product maintenance and product promotion, greatly reduces maintenance workload, and reduces product maintenance costs.

[0030] Advantage 3: The present invention is flexible in configuration and maintenance. If a product function needs to be changed, it can be configured through the user interface, which has great flexibility.

[0031] Advantage 4: The present invention can diagnose the cause of a fault quickly and efficiently, and has low technical requirements for fault analysts.

[0032] Advantage 5: The present invention reduces the technical difficulty of front-line technical analysis, and the diagnosis results can be obtained by simply operating the management interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the system framework structure of the present invention;

[0034] Figure 2 It is a functional flow structure schematic diagram of the present invention;

[0035] Figure 3 It is a schematic diagram of the system flow structure of the present invention. DETAILED DESCRIPTION

[0036] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings.

[0037] Example 1

[0038] An automatic network diagnosis and analysis method based on IPTABLES includes a system diagnosis integration module, multiple groups of imported diagnosis modules, a diagnosis execution module and a diagnosis output result module; the diagnosis integration module is respectively connected to the multiple groups of imported diagnosis modules, the multiple groups of imported diagnosis modules are respectively connected to the diagnosis execution module, and the diagnosis execution module is connected to the diagnosis output result module; Figure 2 shown.

[0039] in:

[0040] The system diagnostic integration module is an integrable framework that supports the import of single or multiple diagnostic modules. The system diagnostic integration module integrates the overall framework of each diagnostic module, including the configuration of the user interface and the introduction of each configuration. The user can select the corresponding module according to their needs. The diagnostic module can also develop corresponding extension modules as needed, which can be selected when used.

[0041] Multiple groups of imported diagnostic modules implement specific diagnostic functions; each imported diagnostic module contains user-state dynamic link files and kernel-state dynamic link files; according to the configuration selected by the diagnostic integration module, the corresponding user and kernel dynamic link files are loaded into the system, at which time the corresponding problems can be diagnosed according to user needs. This module can accurately select the corresponding modules for users, and unnecessary ones do not need to be imported into the system, accurately matching user needs and reducing system burden.

[0042] The diagnostic execution module generates a configuration file based on the imported diagnostic module in the user interface, automatically issues the execution command, loads the selected single or multiple files into the user space and kernel space respectively, issues the corresponding files to the single board and reproduces the problem; this has specific implementations for each diagnostic module, such as character or string matching, protocol or flag bit matching, IP range matching, time period matching, MAC address matching, etc., which depends on the code implementation of the specific business module. When the data service is in normal operation, a hook function is added during the transmission of the data packet to match the corresponding algorithm implementation. If a match is found, it is handed over to the diagnostic output module for processing.

[0043] The diagnostic output result module outputs the matched data packets to the corresponding LOG file, and diagnoses the output results by analyzing the data in the LOG. The diagnostic output module needs to analyze whether the data is the data packet required after matching according to the diagnostic execution module. If it is a matched data packet, the diagnostic result is output and reported to the user. The diagnostic data module can identify the problem in detail in the corresponding LOG to achieve more detailed analysis.

[0044] To import the diagnostic module, you need to develop the dynamic link file of the corresponding module in advance. The dynamic link file includes the shared library dynamic link file in user mode and the kernel dynamic link file in kernel mode. The kernel function is called by the corresponding hook function to determine the action of the network packet (receive, discard or LOG output, etc.). The corresponding module can implement certain functions, such as packet keyword matching, packet size matching, etc. After determining the extended function, develop the relevant module, compile the user layer dynamic link file in user mode and copy it to the corresponding file of the IPTABLES library, and compile the kernel mode development into the kernel dynamic link file, which is dynamically loaded into the kernel when the problem needs to be located. When the problem is reproduced, the key print will be output, the problem will be diagnosed and the diagnostic result will be output. For example, in the packet content filtering module, the code waits for the data packet sent from the kernel through an infinite loop, and the matching function uses an algorithm to match the keyword in the data packet. If the corresponding keyword is matched, it will be printed in the LOG, and the diagnostic result will be output according to the keyword analysis in the LOG. This module can be used to discover some network security related issues such as friendly-scanner, pplsip, sundayddr, SIPScan, etc.

[0045] The diagnostic execution module includes a function description interface, a diagnostic execution interface, an analysis interface and a result output interface; the function description interface includes the selection of modules and function description, and the corresponding problem can be diagnosed by selecting a module; the diagnostic execution interface generates a corresponding script file according to the selected module and automatically sends it to the single board and runs it, and outputs the corresponding LOG to a specific file when a problem occurs; the analysis interface obtains the output LOG file and analyzes whether there is a corresponding result according to the matching function of the corresponding module; the result output interface will output the cause of the fault in the function description according to the content of the analysis interface.

[0046] Each diagnostic execution module independently implements a diagnostic function. The user management interface can import pre-developed functional modules; according to the module function description information, select the function set that needs to be added to realize the analysis and output of diagnostic execution results at one time. Figure 3 The functional description is shown in the overview diagram.

[0047] The automatic network diagnosis and analysis method based on IPTABLES includes the following steps:

[0048] Step (1): A problem occurs in the data service and needs to be diagnosed. After analyzing the problem, the direction of diagnosis is determined as needed. According to the direction of diagnosis, the corresponding module is selected through the user interface and a command is issued.

[0049] Step (2): After confirming which modules need to be issued, click Confirm. The system will automatically import the user and kernel link files of these modules into the system, load the corresponding diagnostic modules, and may also include user extension modules.

[0050] Step (3): At this time, you only need to hang up according to the normal data service. When a problem occurs, the kernel hook function will match the data packet and make corresponding processing. If the problem does not occur and the data packet does not match the data packet, the data packet will be executed normally according to the process without affecting the normal function.

[0051] Step (4): If the data packet is matched, it is determined that the data packet is matched according to the rules of the diagnostic module, and according to the requirements of this hook function, the keywords of the data packet are sent to the corresponding LOG file for subsequent problem analysis.

[0052] Step (5): The diagnostic execution module will analyze the problem based on the output LOG file to verify whether it is the problem we speculated. If it is, the diagnostic result will be output, otherwise it will be ignored.

[0053] Step (6): Users can confirm the problem based on the output diagnosis results and discuss solutions based on the problem.

[0054] Automatic network diagnosis and analysis method based on IPTABLES. It simplifies the method of locating problems. You don't need to spend a long time on a problem. You just need to hang up normally and confirm the problem according to the LOG.

[0055] like Figure 2 As shown in the functional description overview, each diagnostic execution module independently implements a diagnostic function, and the user management interface can import pre-developed functional modules. According to the module functional description information, select the function set to be added to realize the analysis and output of the diagnostic execution results at one time.

[0056] Example 2

[0057] Take the friendly-scanner of network security attack as an example. Figure 3 As shown, the basic flow of the function is described.

[0058] During normal operation of the program, random ringing occurred. After preliminary positioning, it was found that it was caused by a network attack. Because it was randomly triggered at night and the remote customer's environment and other factors made the problem difficult to locate, we can check the packet keyword module according to the functional description diagram above, send the configuration to the board and wait for reproduction. We do not need to locate the problem remotely all the time, we only need to send the diagnostic execution module and wait for the result. When the abnormal data packet contains the friendly-scanner field, the data packet will be matched successfully and the LOG will be printed to a specific file output. From the LOG, we found that the data packet contained the friendly-scanner field. At this time, we can determine that a network attack has been received. The result can be reported to the functional description module, which shows that a SIP attack has been received. After confirming the problem, it will be handled by the developer later.

[0059] Although the network diagnosis solution based on IPTABLES provides convenience for relevant personnel in locating problems, adding matching modules will increase network load. The diagnosis execution module is only dynamically loaded during diagnosis, and normal operation is not affected.

[0060] The diagnostic service of this embodiment 2 can be prepared in advance according to the service and problem, so that the front-line diagnostic personnel can select and load it for use.

[0061] The above detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention but merely represents selected embodiments of the present invention.

Claims

1. An automatic network diagnosis and analysis method based on IPTABLES, characterized in that: It includes a system diagnosis integration module, multiple groups of imported diagnosis modules, a diagnosis execution module and a diagnosis output result module; the diagnosis integration module is respectively connected to the multiple groups of imported diagnosis modules, the multiple groups of imported diagnosis modules are respectively connected to the diagnosis execution module, and the diagnosis execution module is connected to the diagnosis output result module; wherein: The system diagnosis integration module is an integrable framework that supports the import of single or multiple diagnostic modules. The system diagnosis integration module integrates the overall framework of each diagnostic module, including the configuration of the user interface and the introduction of each configuration. Users can select the corresponding module according to their needs. The diagnostic module can also develop corresponding extension modules as needed, which can be selected when in use. Multiple groups of imported diagnostic modules realize specific diagnostic functions; each imported diagnostic module contains dynamic link files in user mode and dynamic link files in kernel mode; according to the configuration selected by the diagnostic integration module, the corresponding dynamic link files of user and kernel are loaded into the system, and the corresponding problems can be diagnosed according to the user's needs. This module can accurately select the corresponding module for the user; The diagnostic execution module generates a configuration file based on the imported diagnostic module of the user interface, automatically issues execution commands, loads the selected single or multiple files into the user space and kernel space respectively, issues the corresponding files to the board and reproduces the problem; The diagnostic output result module outputs the matched data packets to the corresponding LOG file and diagnoses the output results by analyzing the data in the LOG; the diagnostic output module needs to analyze whether the data packets are the data packets required after matching according to the diagnostic execution module. If they are matched data packets, the diagnostic results are output and reported to the user.

2. The automatic network diagnosis and analysis method based on IPTABLES according to claim 1, characterized in that: To import the diagnostic module, you need to develop the dynamic link file of the corresponding module in advance. The dynamic link file includes the shared library dynamic link file in user mode and the kernel dynamic link file in kernel mode. The kernel mode function is called by the corresponding hook function to determine the action of the network packet. The corresponding module can realize certain functions. After determining the extended functions, develop the relevant modules. The user mode is compiled into the user layer dynamic link file and copied to the corresponding file of the IPTABLES library. The kernel mode is developed and compiled into the kernel state dynamic link file, which is dynamically loaded into the kernel when the problem needs to be located. When the problem is reproduced, key printouts are output to diagnose the problem and output the diagnosis results.

3. The automatic network diagnosis and analysis method based on IPTABLES according to claim 1 is characterized in that: The diagnostic execution module includes a function description interface, a diagnostic execution interface, an analysis interface and a result output interface; the function description interface includes the selection of modules and function description, and the corresponding problem can be diagnosed by selecting a module; the diagnostic execution interface generates a corresponding script file according to the selected module and automatically sends it to the single board and runs it, and outputs the corresponding LOG to a specific file when a problem occurs; the analysis interface obtains the output LOG file and analyzes whether there is a corresponding result according to the matching function of the corresponding module; the result output interface will output the cause of the fault in the function description according to the content of the analysis interface.

4. The automatic network diagnosis and analysis method based on IPTABLES according to claim 1 is characterized in that: Each diagnostic execution module independently implements a diagnostic function. The user management interface can import pre-developed functional modules. According to the module function description information, select the function set that needs to be added to realize the analysis and output of the diagnostic execution results at one time.

5. The automatic network diagnosis and analysis method based on IPTABLES according to claim 1 is characterized in that: The following steps are included: Step (1): A problem occurs in the data service and needs to be diagnosed. After analyzing the problem, the direction of diagnosis is determined as needed. According to the direction of diagnosis, the corresponding module is selected through the user interface and a command is issued; Step (2): After confirming which modules need to be issued, click Confirm. The system will automatically import the user and kernel link files of these modules into the system, load the corresponding diagnostic modules, and may also include user extension modules; Step (3): At this time, you only need to hang up according to the normal data service. When a problem occurs, the kernel hook function will match the data packet and make corresponding processing; if the problem does not occur and the data packet does not match the data packet, the data packet will be executed normally according to the process and will not affect the normal function; Step (4): If the data packet is matched, it is determined that the data packet is matched according to the rules of the diagnosis module, and according to the requirements of this hook function, the keywords of the data packet are sent to the corresponding LOG file for subsequent problem analysis; Step (5): The diagnostic execution module will analyze the problem based on the output LOG file to verify whether it is the problem we speculated. If it is, the diagnostic result will be output, otherwise it will be ignored; Step (6): Users can confirm the problem based on the output diagnosis results and discuss solutions based on the problem.

Images