An Automated Network Diagnostic and Analysis Method Based on IPTABLES

Abstract

This invention relates to the field of network technology, and in particular to an automatic network diagnostic analysis method based on IPTABLES. The method includes a system diagnostic integration module, multiple import diagnostic modules, a diagnostic execution module, and a diagnostic output result module. The diagnostic integration module is connected to the multiple import diagnostic modules, which in turn are connected to the diagnostic execution module, which is connected to the diagnostic output result module. This invention designs a system that can dynamically import one or more diagnostic execution modules. Each module adopts a standardized structural design, and the system's underlying layer implements a dynamic integration framework, supporting graphical interface-based module import and analysis result execution.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, in particular to an automatic network diagnosis and analysis method based on IPTABLES. BACKGROUND

[0002] Network failure often occurs in mobile terminals, and it is difficult to analyze the failure cause due to the complex failure cause. Now, the failure analysis generally has some problems as follows:

[0003] Problem 1. After the network failure problem occurs, the network engineer generally analyzes it by personal experience and various technical means, and the analysis result and efficiency are related to the personal experience of the engineer.

[0004] Problem 2. If some diagnostic features are not supported in the current version of the system, the kernel needs to be modified and the code needs to be adjusted, and the version needs to be compiled, which is cumbersome to locate the network problem.

[0005] Problem 3. If the network failure cannot be diagnosed in time, the best opportunity to analyze the real cause of the network failure may be missed.

[0006] Problem 4. Sometimes a fault needs to be located repeatedly to find the cause, which requires senior technical personnel to invest a lot of time, and the cost of analyzing the failure is high.

[0007] Taking CPE products as an example, some services need to send data through specific data packets, but there is no specific means to confirm the problem, and the code needs to be modified or the problem needs to be reproduced to confirm the problem, which greatly consumes the cost of manpower and product maintenance cost. SUMMARY

[0008] In order to reduce the difficulty requirement of network diagnosis on technical personnel and quickly analyze the failure cause, the present application provides an automatic network diagnosis and analysis method based on IPTABLES, which designs a dynamic import single or multiple diagnostic execution module, each module adopts a standardized structure design (function description interface, diagnostic execution interface, analysis interface, result output interface), and the system bottom realizes a dynamic integration framework, supports interface import module and executes analysis result operation.

[0009] The technical scheme adopted by the present application to solve its technical problems is:

[0010] An automatic network diagnosis and analysis method based on IPTABLES, comprising a system diagnosis integration module, a plurality of groups of import diagnostic modules, a diagnostic execution module and a diagnostic output result module; the diagnostic integration module is connected to the plurality of groups of import diagnostic modules, the plurality of groups of import diagnostic modules are connected to the diagnostic execution module, and the diagnostic execution module is connected to the diagnostic output result module; as shown in Figure 2 .

[0011] Wherein:

[0012] The system diagnosis integration module is an integrable framework, supporting importing a single or multiple import diagnosis modules; the system diagnosis integration module integrates the overall framework of each diagnosis module, including the configuration of the user interface and the introduction of each configuration, and the corresponding module can be selected by the user according to the user's needs; the diagnosis module can also develop a corresponding expansion module as needed, and only needs to be checked when used.

[0013] Multiple import diagnosis modules implement specific diagnosis functions; each import diagnosis module includes a user state dynamic link file and a kernel state dynamic link file; according to the configuration selected by the diagnosis integration module, the corresponding user and kernel dynamic link files are loaded into the system, at which time the corresponding problems can be diagnosed according to the user's needs, this module can accurately select the corresponding module for the user, and does not need to be imported into the system, accurately matches the user's needs, and reduces the system burden.

[0014] The diagnosis execution module generates a configuration file according to the import diagnosis module of the user interface, automatically issues execution commands, loads the selected single or multiple files into the user space and the kernel space, issues the corresponding files to the single board and reproduces the problem; this has specific implementations for each diagnosis module, such as character or string matching, protocol or flag bit matching, IP range matching, time period matching, MAC address matching, etc., which depend on the code implementation of the specific business module. When the data service is normal, a hook function is added in the transmission process of the data packet to match the corresponding algorithm implementation, and if it is matched, it is handed over to the diagnosis output module for processing.

[0015] The diagnosis output result module outputs the matched data packet to the corresponding LOG file, and analyzes the data in the LOG to diagnose the output result. The diagnosis output module needs to analyze whether the data is the data packet required after matching by the diagnosis execution module, and if it is the matched data packet, the diagnosis result is output and reported to the user. The diagnosis data module can identify the problem in detail in the corresponding LOG, and achieve more detailed analysis work.

[0016] An automatic network diagnosis analysis method based on IPTABLES, including the following steps:

[0017] Step (1): When the data service has a problem that needs to be diagnosed, the diagnosis direction is confirmed according to the needs after analyzing the problem, and the corresponding module is selected through the user interface according to the diagnosis direction and the command is issued.

[0018] Step (2): After confirming which modules need to be issued, click to confirm, the system will automatically import the user and kernel link files of these modules into the system, load the corresponding diagnosis module, and also include the user's expansion module.

[0019] Step (3): At this time, only need to hang up according to the normal data service, and the hook function of the kernel will match the data packet and make corresponding processing. If the problem does not occur, the data packet does not match the data packet, and the data packet is executed normally according to the process, which does not affect the normal function.

[0020] Step (4): If the data packet is matched, it is judged that the data packet is matched according to the rule of the diagnosis module, and the key of the data packet is sent to the corresponding LOG file according to the requirement of the hook function, and the problem is analyzed subsequently.

[0021] Step (5): The diagnosis execution module will analyze the problem according to the output LOG file, verify whether it is the problem we speculate, if yes, output the diagnosis result, if not, ignore.

[0022] Step (6): The user can confirm the problem according to the output diagnosis result, and can discuss the solution according to the problem.

[0023] The automatic network diagnosis analysis method based on IPTABLES simplifies the method of positioning the problem, and only needs to be normally hung up, and the problem can be confirmed according to the LOG.

[0024] The present application also has the following additional technical features: the diagnosis module needs to develop a dynamic link file of the corresponding module in advance, the dynamic link file includes a shared library dynamic connection file in a user state and a kernel dynamic connection file in a kernel state; the function in the kernel state is called by the corresponding hook function, and the action (receiving, discarding or LOG output, etc.) of the network packet is determined; the corresponding module can realize some functions, for example, packet key matching, packet size matching, etc.; after the extended function is determined, the related module is developed, the user state is compiled into a user layer dynamic connection file and is copied into the file corresponding to the library of IPTABLES, the kernel state is developed and compiled into a kernel state dynamic connection file, and is dynamically loaded into the kernel when the problem needs to be positioned; when the problem recurs, the key print is output, the problem is diagnosed and the diagnosis result is output; for example, the packet content filtering module, the code waits for the data packet sent from the kernel through an infinite loop, and the matching function in the code is used to match the key in the data packet, if the corresponding key is matched, the key is printed into the LOG, and the diagnosis result is output according to the key in the LOG. Some network security related problems such as friendly-scanner, pplsip, sundayddr, SIPScan, etc. can be found through the module.

[0025] The application also has the following additional technical features: the diagnosis execution module includes a function description interface, a diagnosis execution interface, an analysis interface and a result output interface; the function description interface includes selection of a module and function description, and a corresponding problem can be diagnosed by selecting a module; the diagnosis execution interface generates a corresponding script file according to the selected module, automatically issues the script file to a single board and runs it, and outputs a corresponding LOG to a specific file when a problem occurs; the analysis interface analyzes whether there is a corresponding result according to the matching function of the corresponding module based on the output LOG file; and the result output interface outputs the fault reason of the function description according to the content of the analysis interface.

[0026] The application also has the following additional technical features: each diagnosis execution module independently implements a diagnosis function, and the user management interface can import a function module developed in advance; a function set that needs to be added is selected according to the function description information of the module, and diagnosis execution result analysis output is realized at one time. Figure 3 The function description diagram is shown.

[0027] The application has been implemented in multiple products in a company and has been applied in actual work, and basically achieves the expected effect. Compared with the prior art, the application has the following advantages:

[0028] Advantage 1: The application automatically analyzes network problem solutions by dynamically loading diagnosis execution modules through a user interface.

[0029] Advantage 2: The application is convenient for product maintenance and product promotion, greatly reduces the maintenance workload and the product maintenance cost.

[0030] Advantage 3: The application has great flexibility in configuration and maintenance. For example, if a product function needs to be changed, it can be configured through a user interface.

[0031] Advantage 4: The application can quickly and efficiently diagnose fault reasons, and has a relatively low requirement on the technical level of fault analysis personnel.

[0032] Advantage 5: The application reduces the technical difficulty of first-line technical analysis, and can obtain a diagnosis result only by operating a management interface. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 The figure is a system framework structure diagram of the application;

[0034] Figure 2 The figure is a function flow structure diagram of the application;

[0035] Figure 3 The figure is a system flow structure diagram of the application. DETAILED DESCRIPTION

[0036] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings.

[0037] Example 1

[0038] An IPTABLES-based automatic network diagnosis analysis method includes a system diagnosis integration module, multiple sets of import diagnosis modules, a diagnosis execution module, and a diagnosis output result module. The diagnosis integration module is connected to the multiple sets of import diagnosis modules, the multiple sets of import diagnosis modules are connected to the diagnosis execution module, and the diagnosis execution module is connected to the diagnosis output result module. Figure 2

[0039] Among them:

[0040] The system diagnosis integration module is an integrable framework that supports importing a single or multiple import diagnosis modules. The system diagnosis integration module integrates the overall framework of each diagnosis module, includes the configuration of a user interface and the introduction of each configuration, and allows users to select corresponding modules according to their needs. The diagnosis module can also develop corresponding extension modules as needed, and only needs to be checked when used.

[0041] The multiple sets of import diagnosis modules implement specific diagnosis functions. Each import diagnosis module includes a user-mode dynamic link file and a kernel-mode dynamic link file. According to the configuration selected by the diagnosis integration module, the corresponding user and kernel dynamic link files are loaded into the system. At this time, the corresponding problems can be diagnosed according to the user's needs. This module can accurately select the corresponding module for the user, and does not need to be imported into the system. It accurately matches the user's needs and reduces the system burden.

[0042] The diagnosis execution module generates a configuration file according to the import diagnosis module of the user interface, automatically issues an execution command, loads the selected single or multiple files into the user space and the kernel space, issues the corresponding files to the single board and reproduces the problem. This has specific implementations for each diagnosis module, such as character or string matching, protocol or flag bit matching, IP range matching, time period matching, MAC address matching, etc., which depend on the code implementation of the specific business module. When the data service is normal, a hook function is added in the transmission process of the data packet to match the corresponding algorithm implementation. If it is matched, it is handed over to the diagnosis output module for processing.

[0043] The diagnosis output result module outputs the matched data packet to the corresponding LOG file, and outputs the diagnosis result by analyzing the data in the LOG. The diagnosis output module needs to analyze whether the data is the data packet required after matching by the diagnosis execution module. If it is the matched data packet, the diagnosis result is output and reported to the user. The diagnosis data module can identify the problem in detail in the corresponding LOG, and achieve more detailed analysis work.

[0044] ​The dynamic link file of the corresponding module needs to be developed in advance for importing the diagnosis module, and the dynamic link file includes the shared library dynamic link file in the user state and the kernel dynamic link file in the kernel state; the function in the kernel state is called by the corresponding hook function to determine the action (receiving, discarding or LOG output, etc.) of the network packet; the corresponding module can implement certain functions, such as packet keyword matching, packet size matching, etc.; after the extended functions are determined, the related modules are developed, the user state is compiled into the user layer dynamic link file and copied into the file corresponding to the library of IPTABLES, the kernel state is developed and compiled into the dynamic link file in the kernel state and is dynamically loaded into the kernel when the problem needs to be located; when the problem occurs, the key print is output, the problem is diagnosed and the diagnosis result is output; for example, the packet content filtering module, the code waits for the data packet sent from the kernel through an infinite loop, and the matching function in the code uses an algorithm to match the keyword in the data packet, and if the corresponding keyword is matched, the keyword is printed to the LOG, and the diagnosis result is output according to the keyword in the LOG. Some network security related problems such as friendly-scanner, pplsip, sundayddr, SIPScan, etc. can be found through this module.

[0045] The diagnosis execution module includes a function description interface, a diagnosis execution interface, an analysis interface and a result output interface; the function description interface includes the selection and function description of the module, and the corresponding problem can be diagnosed by selecting a module; the diagnosis execution interface generates the corresponding script file according to the selected module, automatically issues the script file to the single board and runs, and outputs the corresponding LOG to a specific file when the problem occurs; the analysis interface obtains the output LOG file and analyzes whether there is a corresponding result according to the matching function of the corresponding module; and the result output interface outputs the fault reason of the function description according to the content of the analysis interface.

[0046] Each diagnosis execution module independently implements a diagnosis function, and the user management interface can import the function module developed in advance; according to the function description information of the module, the function set that needs to be added is selected, and the diagnosis execution result analysis output is realized at one time. Figure 3 The function description diagram is shown.

[0047] The automatic network diagnosis analysis method based on IPTABLES includes the following steps:

[0048] Step (1): When the data service has a problem that needs to be diagnosed, the diagnosis direction is confirmed after analyzing the problem, and the corresponding module is selected and a command is issued through the user interface according to the diagnosis direction.

[0049] Step (2): After confirming which modules need to be issued, click to confirm, and the system will automatically import the user and kernel link files of these modules into the system, load the corresponding diagnosis module, and also include the user's extended module.

[0050] Step (3): At this point, simply continue the normal data service process. When a problem occurs, the kernel's hook function will perform packet matching and handle it accordingly. If no problem occurs and no packet matches, the packet will be executed normally according to the process, without affecting normal functionality.

[0051] Step (4): If a data packet is matched, it is determined that the data packet has been matched according to the rules of the diagnostic module. Then, according to the requirements of this hook function, the keywords of the data packet are sent to the corresponding LOG file for subsequent analysis of the problem.

[0052] Step (5): The diagnostic execution module will analyze the problem based on the output LOG file to verify whether it is the problem we speculated. If it is, the diagnostic result will be output; otherwise, it will be ignored.

[0053] Step (6): Users can confirm the problem based on the output diagnostic results and discuss solutions based on the problem.

[0054] An automated network diagnostic and analysis method based on IPTABLES simplifies problem localization, eliminating the need to spend excessive time investigating a single issue; simply keep the system running normally and confirm the problem based on the logs.

[0055] like Figure 2 As shown in the functional description diagram, each diagnostic execution module independently implements a diagnostic function, and the user management interface can import pre-developed functional modules. Based on the module functional description information, users can select the set of functions to be added, and the diagnostic execution result analysis and output can be achieved in one go.

[0056] Example 2

[0057] Taking a friendly-scanner for cybersecurity attacks as an example, according to Figure 3 As shown, this describes the basic flow of the function.

[0058] The program appears random ringing problem during normal operation, through the preliminary positioning found that is due to network attack caused, because it is night triggered randomly, and is the remote customer's environment and other factors lead to problem not easy to locate, at this time we can according to the above function description figure will package keyword module check, issue configuration to the board after hanging up and waiting for recurrence. We do not need to always remote positioning problem, only need to issue the diagnostic execution module after waiting for the result. When the abnormal data packet contains the friendly-scanner field, the data packet will match successfully and print the LOG to the specific file output. From the LOG, we found that the data packet contains the friendly-scanner field, at this time it can be determined that the network attack has been received, the result can be reported to the function description module, the result is that the SIP attack is received, and the problem is confirmed for the subsequent processing of the developer.

[0059] The network diagnosis scheme based on IPTABLES provides convenience for related personnel in locating problems, and increasing the matching module increases the network load. Only the diagnostic execution module is dynamically loaded during diagnosis, and the normal operation is not affected.

[0060] The diagnostic service of the embodiment 2 can be prepared in advance according to the service and the problem, and is selected and used by the front-line diagnostic personnel.

[0061] The above detailed description of the embodiments of the application provided in the drawings is not intended to limit the scope of the claimed application, but only represents selected embodiments of the application.

Claims

1. An automatic network diagnostic analysis method based on IPTABLES, characterized in that: The system diagnosis integration module is a frame that can be integrated, supports import of a single or multiple import diagnosis modules, integrates the overall frame of each diagnosis module, contains configuration of a user interface and introduction of each configuration, and allows a user to select a corresponding module according to a user demand; the diagnosis module can also develop a corresponding extension module according to a need, and only needs to be checked when used; The multiple import diagnosis modules implement specific diagnosis functions; each import diagnosis module contains a user-mode dynamic link file and a kernel-mode dynamic link file; according to a configuration selected by the system diagnosis integration module, corresponding user and kernel dynamic link files are loaded into the system, at this time, a corresponding problem can be diagnosed according to a user demand, and the module can accurately select a corresponding module for the user; The diagnosis execution module generates a configuration file according to an import diagnosis module of a user interface, automatically issues an execution command, loads selected single or multiple files into a user space and a kernel space, issues corresponding files to a single board, and reproduces a problem; The diagnosis output result module outputs a matched data packet to a corresponding LOG file, and diagnoses an output result by analyzing data in the LOG; the diagnosis output module needs to analyze whether the data is a data packet required after matching by the diagnosis execution module, if it is the matched data packet, a diagnosis result is output and reported to a user. The import diagnosis module needs to develop a dynamic link file of a corresponding module in advance, the dynamic link file includes a user-mode shared library dynamic link file and a kernel-mode kernel dynamic link file; a kernel-mode function is called by a corresponding hook function, and determines an action of a network packet; a corresponding module can implement certain functions, after the extension functions are determined, a related module is developed, a user mode is compiled into a user-layer dynamic link file, and is copied into a corresponding file of a library of the IPTABLES, a kernel mode is developed and compiled into a kernel-mode dynamic link file, and is dynamically loaded into a kernel when a problem needs to be located; 2. The method of claim 1, wherein the method is based on IPTABLES. When a problem is reproduced, key printing is output, a problem is diagnosed, and a diagnosis result is output. The diagnosis execution module includes a function description interface, a diagnosis execution interface, an analysis interface, and a result output interface; the function description interface includes selection and function description of a module, and can diagnose a corresponding problem by selecting a certain module; the diagnosis execution interface generates a corresponding script file according to the selected module, automatically issues the script file into a single board, and runs, outputs corresponding LOG into a specific file when a problem occurs; the analysis interface obtains the output LOG file, and analyzes whether there is a corresponding result according to a matching function of a corresponding module; and the result output interface outputs a fault reason of the function description according to content of the analysis interface.

3. The method of claim 1, wherein the method is based on IPTABLES. ​ 4. The method of claim 1, wherein the method is based on IPTABLES. Each diagnostic execution module implements a diagnostic function independently, and the user management interface can import the function module developed in advance; according to the module function description information, the function set that needs to be added is selected, and the diagnostic execution result analysis output is realized at one time.

5. The method of automatic network diagnostic analysis based on iptables as claimed in claim 1, wherein: It comprises the following steps: Step (1): When the data service has a problem that needs to be diagnosed, the direction of diagnosis is confirmed according to the needs after analyzing the problem, the corresponding module is selected through the user interface according to the direction of diagnosis, and the command is issued; Step (2): After confirming which modules need to be issued, click to confirm, the system will automatically import the user and kernel link files of these modules into the system, load the corresponding diagnostic module, and the user's extension module; Step (3): At this time, only need to hang up according to the normal data service, when the problem occurs, the kernel's hook function will match the data packet and make corresponding processing; if the problem does not occur, the data packet does not match the data packet, and the data packet is executed normally according to the process, which does not affect the normal function; Step (4): If the data packet is matched, it is judged that the data packet is matched according to the rules of the diagnostic module, and the key of the data packet is sent to the corresponding LOG file according to the requirements of the hook function, and the problem is analyzed later; Step (5): The diagnostic execution module will analyze the problem according to the output LOG file, verify whether it is the problem, and if so, output the diagnostic result, otherwise ignore it; Step (6): The user can confirm the problem according to the output diagnostic result, and can discuss the solution according to the problem.

Images