An OVN-based TCP service network state detection method

Abstract

This application provides a TCP service network state detection method based on OVN. The method includes: creating a first monitoring point in the direction from which the server virtual machine enters the logical switch; configuring a first flow table rule in the first monitoring point; determining a first flow table count for the first monitoring point based on the first flow table rule; creating a second monitoring point in the direction from which the server virtual machine enters the logical switch; configuring a second flow table rule in the second monitoring point; determining a second flow table count for the second monitoring point based on the second flow table rule; and determining the connection state of the TCP service network based on the first and second flow table counts of the first and second monitoring points. The method provided by this application can accurately determine the connection state of the client and server.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a TCP service network state detection method based on OVN. Background Technology

[0002] With the continuous development of technology, the internet has become an indispensable part of people's lives. In cloud networks, security groups are used to control traffic access and filtering. Typically, when a client accesses a server, the traffic is routed to the Linux kernel or DPDK's Connection Tracking (CT) table, where the security group rules determine whether to allow the data packet to pass. However, there may be a large number of different clients accessing the server, and security group rules may drop some traffic, making it impossible to accurately determine the connection status between the client and server.

[0003] Therefore, accurately determining the connection status between the client and the server has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] To address the above problems, this application provides a TCP service network state detection method based on OVN, the method comprising the following steps:

[0005] A first monitoring point is created in the direction from which the server virtual machine enters the logical switch. The first monitoring point is used to monitor the synchronization sequence number packet and acknowledgment character packet of the TCP connection initiated from the client virtual machine.

[0006] Configure a first flow table rule in the first monitoring point, and the first flow table rule matches the synchronization sequence number packet and the acknowledgment character packet;

[0007] Based on the first flow table rule, the first flow table count of the first monitoring point is determined. The first flow table count is used to determine whether the synchronization sequence number packet and the acknowledgment character packet pass through the logical switch.

[0008] A second monitoring point is created in the direction from which the server virtual machine enters the logical switch. This second monitoring point is used to monitor the response packets from the server virtual machine to the client virtual machine.

[0009] Configure a second flow table rule in the second monitoring point, and the second flow table rule matches the response packet;

[0010] The second flow table count of the second monitoring point is determined based on the second flow table rule. The second flow table count is used to determine whether the reply packet passes through the logical switch.

[0011] The connection status of the TCP service network is determined based on the first flow table count and the second flow table count of the first monitoring point and the second monitoring point.

[0012] In one possible implementation, the first flow table rule includes:

[0013] The source IP address is matched to the IP address of the client virtual machine, the target IP address is matched to the IP address of the server virtual machine, the target port is matched to the port of the server virtual machine, and the TCP flag is matched to the synchronization sequence number.

[0014] In one possible implementation, the second flow table rule includes:

[0015] The source IP address is the IP address of the client virtual machine, the target IP address is the IP address of the server virtual machine, the target port is the port of the server virtual machine, and the TCP flag is the acknowledgment character.

[0016] In one possible implementation, the first flow table count is specifically used for:

[0017] Determine whether the TCP connection initiated by the client virtual machine has successfully passed through the logical switch;

[0018] If the first flow table count is 0, it means that the synchronization sequence number packet or acknowledgment character packet was discarded by the logical switch;

[0019] If the count of the first flow table is greater than 0, it means that the synchronization sequence number packet and the acknowledgment character packet have successfully passed through the logical switch.

[0020] In one possible implementation, the second flow table count is specifically used for:

[0021] Determine whether the TCP connection returned by the server virtual machine has successfully passed through the logical switch;

[0022] If the second flow table count is 0, it means that the reply packet was dropped by the logical switch;

[0023] If the second flow table count is greater than 0, it means that the reply packet has successfully passed through the logical switch.

[0024] In one possible implementation, the method further includes:

[0025] Based on the flow table counts of the first and second monitoring points, it is determined whether the TCP connection is blocked or lost by network intermediate devices such as security groups, thereby determining the network connection status of the TCP service.

[0026] This application also provides a TCP service network state detection device based on OVN, the device comprising:

[0027] The first creation module is used to create a first monitoring point in the direction from which the server virtual machine enters the logical switch. The first monitoring point is used to monitor the synchronization sequence number packet and acknowledgment character packet of the TCP connection initiated from the client virtual machine.

[0028] The first configuration module is used to configure a first flow table rule in the first monitoring point, wherein the first flow table rule matches the synchronization sequence number packet and the acknowledgment character packet.

[0029] The first determining module is used to determine the first flow table count of the first monitoring point based on the first flow table rule. The first flow table count is used to determine whether the synchronization sequence number packet and the acknowledgment character packet pass through the logical switch.

[0030] The second creation module is used to create a second monitoring point in the direction from which the server virtual machine enters the logical switch. The second monitoring point is used to monitor the reply packets from the server virtual machine to the client virtual machine.

[0031] The second configuration module is used to configure a second flow table rule in the second monitoring point, and the second flow table rule matches the response packet.

[0032] The second determining module determines the second flow table count of the second monitoring point based on the second flow table rule. The second flow table count is used to determine whether the reply packet passes through the logical switch.

[0033] The judgment module is used to determine the connection status of the TCP service network based on the first flow table count and the second flow table count of the first monitoring point and the second monitoring point.

[0034] This application also provides an electronic device, which includes a processor and a memory:

[0035] The memory is used to store computer programs and to transfer the computer programs to the processor;

[0036] The processor is used to execute the steps of the OVN-based TCP service network state detection method described above according to the instructions in the computer program.

[0037] This application also provides a computer-readable storage medium for storing a computer program that, when executed by an electronic device, implements the steps of the above-described OVN-based TCP service network state detection method.

[0038] Compared with the prior art, this application has the following beneficial effects:

[0039] This application proposes a TCP service network status detection method based on OVN. By setting monitoring points between the server-side virtual machine and the logical switch, and monitoring traffic through flow table rules, it effectively solves the problem of inaccurate client-server connection status determination in existing technologies. Specifically, this application sets a first monitoring point and a second monitoring point in the inbound and outbound traffic directions of the server-side virtual machine, respectively, to accurately monitor and determine the TCP connection establishment process. Especially when security group rules cause traffic drop, it can help identify the specific reasons for connection failure. Compared to traditional methods that rely solely on connection tracking tables (CT tables) and security groups, this application's solution provides more accurate network status information through fine-grained traffic monitoring and counting. Especially when there are numerous different client requests to the server, by statistically analyzing the traffic counts at different monitoring points, it can clearly determine which stage caused the connection failure, thereby helping to locate and resolve network faults. In this way, the system can provide more reliable network status detection and fault diagnosis, avoiding problems caused by security group traffic drop. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart of a TCP service network state detection method based on OVN provided in this application embodiment;

[0042] Figure 2 This is a schematic diagram of the structure of a TCP service network state detection device based on OVN provided in an embodiment of this application. Detailed Implementation

[0043] As described earlier, when a client accesses a server, the traffic is routed to the Linux kernel or DPDK's Connection Tracking (CT) table, where security group rules determine whether packets should be allowed to pass. However, a large number of different clients may access the server, and security group rules may drop some traffic, making it impossible to accurately determine the connection status between the client and server.

[0044] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present application.

[0045] It is understood that the method provided in this application can be applied to a processing device that can create a first monitoring point in the direction from which a server-side virtual machine enters a logical switch, or a terminal device or server that can create a second monitoring point in the direction from which a server-side virtual machine enters a logical switch. The method provided in this application can be executed independently by a terminal device or server, or it can be applied to network scenarios where a terminal device and a server communicate, executing in cooperation. The terminal device can be a computer, mobile phone, or other similar device. The server can be understood as an application server or a web server; in actual deployment, the server can be a standalone server or a cluster server.

[0046] Figure 1 This application provides a flowchart of a TCP service network state detection method based on OVN, the method comprising the following steps:

[0047] S101: Create the first monitoring point in the direction from which the server virtual machine enters the logical switch.

[0048] The processing device creates the first monitoring point in the direction from the server virtual machine to the logical switch. The first monitoring point is used to monitor the synchronization sequence number packet (SYN) and acknowledgment character packet (ACK) of the TCP connection initiated from the client virtual machine.

[0049] The processing device first creates a primary monitoring point in the direction from the server-side virtual machine to the logical switch. This point monitors the synchronization sequence number packets (SYN packets) and acknowledgment packets (ACK packets) for TCP connections initiated from the client virtual machine. These packets are core markers for establishing a TCP connection; the SYN packet indicates a connection request, while the ACK packet indicates connection confirmation.

[0050] S102: Configure the first flow table rule in the first monitoring point.

[0051] The processing device configures a first flow table rule at the first monitoring point, and the first flow table rule matches the synchronization sequence number packet and the acknowledgment character packet.

[0052] By configuring first-order flow table rules at this monitoring point, the processing device can match these two types of packets. These first-order flow table rules can include: the source IP address being the client virtual machine's IP address, the destination IP address being the server virtual machine's IP address, the destination port being the server virtual machine's port, and matching the TCP flags as the synchronization sequence number (SYN) and the acknowledgment character (ACK). These matching rules enable the monitoring point to accurately identify and capture these critical TCP packets.

[0053] S103: Determine the first flow table count of the first monitoring point based on the first flow table rules.

[0054] The processing device determines the first flow table count of the first monitoring point based on the first flow table rules. The first flow table count is used to determine whether the synchronization sequence number packet and the acknowledgment character packet have passed through the logical switch.

[0055] Based on the configured first flow table rules, the first flow table count may increase or remain at zero. The first flow table count is used to determine whether synchronization sequence number packets and acknowledgment character packets have successfully passed through the logical switch. If the count is 0, it means that these packets failed to pass through the logical switch and may have been dropped; if the count is greater than 0, it means that these packets successfully passed through the logical switch, and the initial phase of the TCP connection (connection request and acknowledgment) is normal.

[0056] S104: Create a second monitoring point in the direction from which the server virtual machine enters the logical switch.

[0057] The processing device creates a second monitoring point in the direction from which the server virtual machine enters the logical switch. The second monitoring point is used to monitor the response packets from the server virtual machine to the client virtual machine.

[0058] On the server-side virtual machine side, a second monitoring point was created to monitor the server-side virtual machine's TCP response packets to the client-side virtual machine.

[0059] S105: Configure the second flow table rule in the second monitoring point.

[0060] The processing device is configured with a second flow table rule at the second monitoring point, and the second flow table rule matches the response packet.

[0061] The processing device is configured with second-order flow table rules, which are used to match response packets sent by the server virtual machine. These rules can include: source IP address as the server virtual machine's IP address, destination IP address as the client virtual machine's IP address, destination port as the client virtual machine's port, and matching the TCP flag as SYN-ACK. Using these rules, the server's TCP connection response packets to the client can be accurately captured.

[0062] S106: Determine the second flow table count of the second monitoring point based on the second flow table rules.

[0063] The processing device determines the second flow table count of the second monitoring point based on the second flow table rules. The second flow table count is used to determine whether the reply packet passes through the logical switch.

[0064] Based on the rules of the second flow table, the second flow table count may increase or remain at zero. This count is used to determine whether the server virtual machine's reply packet successfully passed through the logical switch. If the count is 0, it means the reply packet was dropped by the logical switch; if the count is greater than 0, it means the reply packet successfully passed through the logical switch, and the TCP connection establishment has been successfully completed.

[0065] S107: The connection status of the TCP service network determined based on the first flow table count and the second flow table count of the first monitoring point and the second monitoring point.

[0066] The processing device determines the connection status of the TCP service network based on the first flow table count and the second flow table count of the first and second monitoring points.

[0067] By comprehensively analyzing the flow table counts at the first and second monitoring points, the processing equipment can determine the network connection status of the entire TCP service. For example, if the traffic count in one direction is zero, while other directions are normal, it may indicate that traffic in that direction is being dropped or blocked, thus affecting the success or failure of the connection. This method can determine whether any intermediate network devices (such as security groups) are blocking or losing traffic by using the traffic counts at the monitoring points.

[0068] This application proposes a TCP service network status detection method based on OVN. By setting monitoring points between the server-side virtual machine and the logical switch, and monitoring traffic through flow table rules, it effectively solves the problem of inaccurate client-server connection status determination in existing technologies. Specifically, this application sets a first monitoring point and a second monitoring point in the inbound and outbound traffic directions of the server-side virtual machine, respectively, to accurately monitor and determine the TCP connection establishment process. Especially when security group rules cause traffic drop, it can help identify the specific reasons for connection failure. Compared to traditional methods that rely solely on connection tracking tables (CT tables) and security groups, this application's solution provides more accurate network status information through fine-grained traffic monitoring and counting. Especially when there are numerous different client requests to the server, by statistically analyzing the traffic counts at different monitoring points, it can clearly determine which stage caused the connection failure, thereby helping to locate and resolve network faults. In this way, the system can provide more reliable network status detection and fault diagnosis, avoiding problems caused by security group traffic drop.

[0069] This application also provides a method such as Figure 2 The diagram shows the structure of an OVN-based TCP service network state detection device 200, which includes:

[0070] The first creation module 201 is used to create a first monitoring point in the direction of the server virtual machine entering the logical switch. The first monitoring point is used to monitor the synchronization sequence number packet and acknowledgment character packet of the TCP connection initiated from the client virtual machine.

[0071] The first configuration module 202 is used to configure a first flow table rule in the first monitoring point, wherein the first flow table rule matches the synchronization sequence number packet and the acknowledgment character packet.

[0072] The first determining module 203 is used to determine the first flow table count of the first monitoring point based on the first flow table rule. The first flow table count is used to determine whether the synchronization sequence number packet and the acknowledgment character packet pass through the logical switch.

[0073] The second creation module 204 is used to create a second monitoring point in the direction from which the server virtual machine enters the logical switch. The second monitoring point is used to monitor the reply packets from the server virtual machine to the client virtual machine.

[0074] The second configuration module 205 is used to configure a second flow table rule in the second monitoring point, wherein the second flow table rule matches the response packet.

[0075] The second determining module 206 determines the second flow table count of the second monitoring point based on the second flow table rule. The second flow table count is used to determine whether the reply packet passes through the logical switch.

[0076] The judgment module 207 is used to determine the connection status of the TCP service network based on the first flow table count and the second flow table count of the first monitoring point and the second monitoring point.

[0077] This application proposes an OVN-based TCP service network status detection device. By setting monitoring points between the server-side virtual machine and the logical switch, and monitoring traffic through flow table rules, it effectively solves the problem of inaccurate client-server connection status determination in existing technologies. Specifically, this application sets a first monitoring point and a second monitoring point in the inbound and outbound traffic directions of the server-side virtual machine, respectively, to accurately monitor and determine the TCP connection establishment process. Especially when security group rules cause traffic drop, it can help identify the specific reasons for connection failure. Compared to traditional methods that rely solely on connection tracking tables (CT tables) and security groups, this application's solution provides more accurate network status information through fine-grained traffic monitoring and counting. Especially when there are numerous different client requests to the server, by statistically analyzing the traffic counts at different monitoring points, it can clearly determine which link caused the connection failure, thereby helping to locate and resolve network faults. In this way, the system can provide more reliable network status detection and fault diagnosis, avoiding problems caused by security group traffic drop.

[0078] This application also provides an OVN-based TCP service network state detection device, wherein the device includes a memory and a processor, the memory is used to store instructions or code, and the processor is used to execute the instructions or code to cause the device to perform the steps of the OVN-based TCP service network state detection method described in any embodiment of this application.

[0079] In practical applications, the computer-readable storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium.

[0080] Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0081] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0082] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0083] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0084] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. The components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment solution according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0085] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for network state detection of OVN-based TCP traffic, characterized in that, The method comprises: creating a first monitoring point in the direction of the server virtual machine entering the logical switch, the first monitoring point being used for monitoring a synchronization sequence number packet and an acknowledgement character packet initiated by a client virtual machine for a TCP connection; configuring a first flow table rule in the first monitoring point, the first flow table rule matching the synchronization sequence number packet and the acknowledgement character packet; determining a first flow table count of the first monitoring point based on the first flow table rule, the first flow table count being used for judging whether the synchronization sequence number packet and the acknowledgement character packet pass through the logical switch; creating a second monitoring point in the direction of the server virtual machine entering the logical switch, the second monitoring point being used for monitoring a reply packet replied by the server virtual machine to the client virtual machine; configuring a second flow table rule in the second monitoring point, the second flow table rule matching the reply packet; determining a second flow table count of the second monitoring point based on the second flow table rule, the second flow table count being used for judging whether the reply packet passes through the logical switch; determining a connection state of a TCP service network according to the first flow table count and the second flow table count of the first monitoring point and the second monitoring point.

2. The method of claim 1, wherein, The first flow table rule comprises: matching a source IP address as an IP address of the client virtual machine, matching a target IP address as an IP address of the server virtual machine, matching a target port as a port of the server virtual machine, and matching a TCP flag as a synchronization sequence number.

3. The method of claim 1, wherein, The second flow table rule comprises: matching a source IP address as an IP address of the client virtual machine, matching a target IP address as an IP address of the server virtual machine, matching a target port as a port of the server virtual machine, and matching a TCP flag as an acknowledgement character.

4. The method of claim 1, wherein, The first flow table count is specifically used for: judging whether a TCP connection initiated by the client virtual machine successfully passes through the logical switch; if the first flow table count is 0, it indicates that the synchronization sequence number packet or the acknowledgement character packet is discarded by the logical switch; if the first flow table count is greater than 0, it indicates that the synchronization sequence number packet and the acknowledgement character packet successfully pass through the logical switch.

5. The method of claim 1, wherein, The second flow table count is specifically used for: judging whether a TCP connection replied by the server virtual machine successfully passes through the logical switch; if the second flow table count is 0, it indicates that the reply packet is discarded by the logical switch; if the second flow table count is greater than 0, it indicates that the reply packet successfully passes through the logical switch.

6. The method of claim 1, wherein, The method further comprises: judging whether a TCP connection is blocked or lost by a network intermediate device based on the flow table counts of the first monitoring point and the second monitoring point, and further determining a network connection state of a TCP service.

7. An OVN-based TCP traffic network state detection apparatus, characterized by comprising: The method comprises: a first creating module, configured to create a first monitoring point in the direction of a server virtual machine entering a logical switch, the first monitoring point being used for monitoring a synchronization sequence number packet and an acknowledgement character packet initiated by a client virtual machine for a TCP connection; a first configuring module, configured to configure a first flow table rule in the first monitoring point, the first flow table rule matching the synchronization sequence number packet and the acknowledgement character packet; a first determining module, configured to determine a first flow table count of the first monitoring point based on the first flow table rule, the first flow table count being used for judging whether the synchronization sequence number packet and the acknowledgement character packet pass through the logical switch; The first determining module is configured to determine a first flow table count of the first monitoring point based on the first flow table rule, and the first flow table count is used to determine whether the synchronization sequence number packet and the acknowledgement character packet pass through the logical switch. The second creating module is configured to create a second monitoring point in a direction in which the server virtual machine enters the logical switch, and the second monitoring point is used to monitor a reply packet that the server virtual machine replies to the client virtual machine. The second configuring module is configured to configure a second flow table rule in the second monitoring point, and the second flow table rule matches the reply packet. The second determining module is configured to determine a second flow table count of the second monitoring point based on the second flow table rule, and the second flow table count is used to determine whether the reply packet passes through the logical switch. The judging module is configured to determine a connection state of the TCP service network according to the first flow table count and the second flow table count of the first monitoring point and the second monitoring point.

8. An electronic device, comprising: The computer device comprises a memory and a processor, wherein: The memory is configured to save a computer program. The processor is configured to execute the computer program to implement the OVN-based TCP service network state detection method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer device is configured to save a computer program, and the computer program is executed by a processor to implement the OVN-based TCP service network state detection method in any one of claims 1-6.

Images