Network address detection method and system based on network layer service type dyeing

Abstract

The embodiment of the invention provides a network address detection method and system based on network layer service type dyeing. The method comprises the following steps: receiving a network address detection request which is sent by a detection node and aims at a target node; the request carries a network layer service type numerical value and is used for matching an incoming direction flow table and an outgoing direction flow table of a network address detection request, so that the detection flow realizes separation of user flow and detection flow through a user-defined security group and an access control list rule; according to the in-direction flow table, controlling the network address detection request to pass through the in-direction security group and the access control list and be transmitted to the pickup flow table; processing the network address detection request through a pickup flow table to obtain a network address detection response for the target node; and controlling the network address detection response to pass through the out-direction security group and the access control list according to the out-direction flow table, and returning the network address detection response to the detection node, so that the network address state of the target node can be obtained under the condition that a user does not perceive.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a network address detection method and system based on network layer service type coloring. Background Art

[0002] Network address detection (also known as elastic IP address detection) is a common requirement to ensure the normal operation of the cloud network. Traditional network address detection methods may have some problems. For example, when using the UDP (User Datagram Protocol) protocol, if the object bound to the elastic IP address does not open the service of the corresponding port, the target node to be detected will return an error message, affecting the accuracy of the detection result; when the user turns on the firewall, the target node to be detected will return an error message or packet loss, affecting the accuracy of the detection result; during the network address detection process, users who use the target node will see the detection message when capturing packets, affecting the user experience. How to improve the accuracy of network address detection without the user's perception is a problem that needs to be solved. Summary of the invention

[0003] In order to solve the above problems, an embodiment of the present invention discloses a network address detection method and system based on network layer service type coloring.

[0004] In a first aspect, an embodiment of the present invention provides a network address detection method based on network layer service type coloring, the method comprising:

[0005] Receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match an inbound flow table and an outbound flow table of the network address detection request;

[0006] According to the inbound flow table, control the network address detection request to pass through the inbound security group and the inbound access control list and be transmitted to the proxy flow table;

[0007] Processing the network address detection request through the proxy flow table to obtain a network address detection response for the target node;

[0008] According to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list and then be returned to the detection node.

[0009] Optionally, the processing the network address detection request by using the proxy flow table includes:

[0010] The source address and the destination address in the network address detection request are exchanged through the proxy flow table, the source port and the destination port in the network address detection request are exchanged, and the detection message content in the network address detection request is modified to the response message content.

[0011] Optionally, the method further comprises:

[0012] Clear the register information in the network address detection request.

[0013] Optionally, the network address detection request performs network address detection according to a user data message protocol or a network control message protocol.

[0014] In a second aspect, an embodiment of the present invention provides a network address detection system based on network layer service type coloring, including: a detection node and a computing node;

[0015] The detection node is used to send a network address detection request for a target node to the computing node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request;

[0016] The computing node is used to receive a network address detection request for a target node sent by the detection node; according to the inbound flow table, control the network address detection request to pass through the inbound security group and the inbound access control list, and pass it to the proxy flow table; process the network address detection request through the proxy flow table to obtain a network address detection response for the target node; according to the outbound flow table, control the network address detection response to pass through the outbound security group and the outbound access control list, and return to the detection node.

[0017] Optionally, the computing node is used to exchange the source address and the destination address in the network address detection request through the proxy flow table, exchange the source port and the destination port in the network address detection request, and modify the detection message content in the network address detection request to the response message content.

[0018] Optionally, the computing node is further used to clear register information in the network address detection request.

[0019] In a third aspect, an embodiment of the present invention provides a network address detection device based on network layer service type coloring, the device comprising:

[0020] An address detection request receiving module is used to receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request;

[0021] An address detection request delivery module is used to control the network address detection request to pass through the inbound security group and the inbound access control list according to the inbound flow table and to be delivered to the proxy flow table;

[0022] An address detection request processing module, used to process the network address detection request through the proxy flow table to obtain a network address detection response for the target node;

[0023] The address detection response returning module is used to control the network address detection response to be returned to the detection node through the outbound security group and the outbound access control list according to the outbound flow table.

[0024] Optionally, the address detection request processing module includes:

[0025] The address detection request processing submodule is used to exchange the source address and destination address in the network address detection request through the proxy flow table, exchange the source port and destination port in the network address detection request, and modify the detection message content in the network address detection request to the response message content.

[0026] Optionally, the address detection request processing submodule is further used to clear register information in the network address detection request.

[0027] Optionally, the network address detection request performs network address detection according to a user data message protocol or a network control message protocol.

[0028] In a fourth aspect, the present invention shows an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned network address detection method based on network layer service type coloring when executing the computer program.

[0029] In a fifth aspect, the present invention shows a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned network address detection method based on network layer service type coloring are implemented.

[0030] The embodiments of the present invention include the following advantages:

[0031] An embodiment of the present invention can receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request, so that the detection traffic can pass through the user-defined security group and access control list rules; according to the inbound flow table, the network address detection request is controlled to pass through the inbound security group and the inbound access control list, and is passed to the proxy flow table; the network address detection request is processed through the proxy flow table to obtain a network address detection response for the target node; according to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list, and is returned to the detection node. During the detection process, the business traffic is separated from the detection traffic, so that the network address status of the target node can be obtained without the user's perception. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 It is a flowchart of the steps of a network address detection method based on network layer service type coloring according to an embodiment of the present invention;

[0034] Figure 2 It is a logic diagram of a network address detection method based on network layer service type coloring according to an embodiment of the present invention;

[0035] Figure 3 It is a logic diagram of another network address detection method based on network layer service type coloring according to an embodiment of the present invention;

[0036] Figure 4 It is a logic diagram of another network address detection method based on network layer service type coloring according to an embodiment of the present invention;

[0037] Figure 5 It is a structural block diagram of a network address detection system based on network layer service type coloring according to an embodiment of the present invention;

[0038] Figure 6 It is a structural block diagram of a network address detection device based on network layer service type coloring according to an embodiment of the present invention.

[0039] Description of reference numerals:

[0040] Detection node 21, calculation node 22, target node 23. DETAILED DESCRIPTION

[0041] In order to ensure that the business logic of the user's product is normal, the elastic IP address needs to be detected to ensure that when the elastic IP address fails, the abnormality can be discovered and restored in the first time. Since the traditional detection method cannot prevent users from customizing security groups and access control lists, or the corresponding port service is not enabled when using the UDP protocol for detection, there is a risk of false alarms when the elastic IP status is normal but cannot be detected. At the same time, the elastic IP in normal detection can sense the existence of the detection process when the target object is captured because the detection traffic enters the target object, which increases the burden on users to filter the detection traffic.

[0042] To solve the above problems, the present invention proposes a network address detection method based on network layer service type coloring, the purpose of which is to improve the accuracy of network address detection without user perception. In order to achieve this goal, the embodiment of the present invention is based on network layer service type coloring, and the network layer service type value can match the inbound flow table and outbound flow table of the network address detection request, so that the detection traffic passes through the user-defined security group and access control list rules, and realizes the separation of business traffic and detection traffic, so that the network address status of the target node can be obtained without the user's perception.

[0043] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0044] Reference Figure 1 , shows a flowchart of a method for detecting a network address based on network layer service type coloring according to an embodiment of the present invention, the method may specifically include the following steps:

[0045] Step 101, receiving a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match an inbound flow table and an outbound flow table of the network address detection request;

[0046] The network address detection method in the embodiment of the present invention can be executed by a computing node, and the detection node and the computing node can negotiate the network layer service type value in advance, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request. When the computing node receives the network address detection request for the target node sent by the detection node, the route of the detection traffic can be matched by the network layer service type value carried in the network address detection request, so that the detection traffic can achieve the purpose.

[0047] The detection node is the node that sends the network address detection request, which can be in the cloud or outside the cloud. The target node is the node being detected, which is a virtual private cloud product associated with the elastic IP address in the cloud, such as a virtual cloud host.

[0048] Step 102, according to the inbound flow table, controlling the network address detection request to pass through the inbound security group and the inbound access control list and be transmitted to the proxy flow table;

[0049] In an embodiment of the present invention, the computing node can control the network address detection request to pass through the inbound security group and the inbound access control list according to the inbound flow table, and then pass it to the proxy flow table. The security group is a virtual private cloud product, which is used to define whether the traffic is passed or discarded according to the characteristics of the message protocol, address, etc., and the object of action is the virtual cloud host. The access control list is a virtual private cloud product, which is used to define whether the traffic is passed or discarded according to the characteristics of the message protocol, address, etc., and the scope of action is the subnet.

[0050] Reference Figure 2 , shows a logic diagram of a network address detection method based on network layer service type coloring according to an embodiment of the present invention. During the detection process, the computing node develops high-priority inbound flow tables and outbound flow tables that match the network layer service type in the security group and access control list to ensure that the detection traffic can smoothly pass through the security group and access control list rules in the pipeline without being restricted by user-defined rules, thereby achieving the separation of business traffic and detection traffic.

[0051] Among them, the proxy flow table is the last checkpoint before the detection message enters the target node, which is similar to the "goalkeeper" of the target node. During the network address detection process, if the virtual machine of the target node is shut down or has a configuration error, the detection message will be discarded before the "proxy flow table". Therefore, as long as the detection message can reach the proxy flow table, it means that the detection message can also reach the target node. At this time, the role of the proxy flow table is to intercept the detection message and process it into a reply message to send out the computing node. The process is similar to a football game. The proxy flow table is compared to the goalkeeper, the virtual machine of the target node is compared to the goal, and the detection message is the flying ball. The football (detection message) should enter the goal, but it is intercepted by the goalkeeper (proxy flow table) and kicked back. The goalkeeper's task is to judge whether the ball is kicked accurately (whether the virtual machine of the target node is normal) and tell the player that the direction is correct, but he does not have to actually kick the ball into the goal.

[0052] Step 103, processing the network address detection request through the proxy flow table to obtain a network address detection response for the target node;

[0053] In one embodiment, the network address detection request performs network address detection according to a user data message protocol or a network control message protocol; and the step of processing the network address detection request through the proxy flow table may further include the following sub-steps:

[0054] Sub-step S11, exchanging the source address and the destination address in the network address detection request through the proxy flow table, exchanging the source port and the destination port in the network address detection request, and modifying the detection message content in the network address detection request into the response message content;

[0055] Sub-step S12, clearing the register information in the network address detection request.

[0056] In an embodiment of the present invention, the network address detection request can be performed according to the User Datagram Protocol (UDP) or the Internet Control Message Protocol (ICMP). When the computing node processes the network address detection request through the proxy flow table, different processing procedures can be set for the UDP protocol and the ICMP protocol.

[0057] Reference Figure 3 , shows a logic diagram of another network address detection method based on network layer service type coloring provided by an embodiment of the present invention. Figure 3 As shown, the network address detection request performs network address detection according to the network control message protocol ICMP. Specifically, the computing node controls the network address detection request sent by the detection node according to the inbound flow table, passes through the inbound security group and the inbound access control list, and is transmitted to the proxy flow table; the source MAC address and the destination MAC address in the network address detection request are exchanged through the proxy flow table, and the source IP address and the destination IP address in the network address detection request are exchanged; the IN_PORT field in the network address detection request is set to zero; the detection message content in the network address detection request is modified to the response message content; the register information in the network address detection request is cleared; and the ICMP type is set.

[0058] Among them, the MAC address is the unique identifier of the network interface controller (NIC), which is usually fixed in the hardware; the IP address is a digital label assigned to each device connected to a network that uses the Internet Protocol for communication. The source MAC address and the destination MAC address, as well as the source IP address and the destination IP address are exchanged in order to assemble a reply message to return the network address detection reply to the detection node.

[0059] When the IN_PORT field is equal to zero, it means that the message is sent from the virtual machine of the target node to the outside of the computing node, that is, the simulated network address detection response is returned to the detection node; when IN_PORT is greater than 0, it means that the message is from the virtual machine outside the computing node to the target node (that is, the path of the network address detection request). The purpose of setting the IN_PORT field to zero is to change the message from "a request message sent from the outside of the computing node to the virtual machine" to "a reply message sent from the virtual machine to the outside of the computing node".

[0060] The purpose of modifying the message content is to shield the client from the perception of the internal implementation. For example, the client uses the ping command to send a probe message to detect connectivity. The actual underlying implementation is that the detection node uses the ICMP protocol with colored content to send a probe message echo request (icmp_type=8 is used in the message to identify the request). After the computing node processes the message and finds that it is a probe message, it needs to simulate the logic of the destination's reply message and change the message to icmp_type=0, that is, echo. In this way, the client receives a reply packet, completing the "send and receive" of the message.

[0061] The register information in the network address detection request is cleared because the detection message will overlap with the normal message processing logic. The normal processing logic will mark some registers. If the register information is not cleared, it may affect the detection message processing logic in the subsequent normal logic version iteration process. Therefore, it is necessary to "destroy" it, that is, clear it.

[0062] Set the ICMP type, specifically: set the ICMP type of IPv4 to 0, and set the ICMPv6 type of IPv6 to 129. IPv4 is the fourth version of the Internet Protocol. The IPv4 address consists of a 32-bit binary number, and the address space is limited, with a total of about 4.3 billion addresses (2^32). IPv6 is the sixth version of the Internet Protocol. The IPv6 address consists of a 128-bit binary number, and the address space is very large, with a total of about 3.4x10^38 addresses (2^128). Set the ICMP type of IPv4 to 0, and set the ICMPv6 type of IPv6 to 129, to test the reachability and latency of the network connection, that is, to respond to network address detection requests.

[0063] Reference Figure 4 , shows a logic diagram of another network address detection method based on network layer service type coloring provided by an embodiment of the present invention. Figure 4As shown, the network address detection request performs network address detection according to the user datagram protocol UDP. Specifically, the computing node controls the network address detection request sent by the detection node according to the inbound flow table, passes through the inbound security group and the inbound access control list, and passes it to the proxy flow table; exchanges the source MAC address and the destination MAC address in the network address detection request through the proxy flow table, and exchanges the source IP address and the destination IP address in the network address detection request; sets the IN_PORT field in the network address detection request to zero, that is, modifies the detection message content in the network address detection request to the response message content; clears the register information in the network address detection request; exchanges the source port number and the destination port number. Among them, exchanging the source port number and the destination port number is also for assembling the response message to return the network address detection response to the detection node.

[0064] Step 104: According to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list and be returned to the detection node.

[0065] In an embodiment of the present invention, when a computing node receives a network address detection request for a target node sent by a detection node, it can generate a network address detection response for the target node on behalf of the flow table. The computing node can then control the network address detection response to pass through the outbound security group and the outbound access control list according to the outbound flow table and return to the detection node. In this way, the business needs of IP address detection can be met without entering the virtual machine of the target node. While being able to promptly detect abnormalities in the target node, the user experience is also guaranteed.

[0066] An embodiment of the present invention can receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request, avoiding the user's security group configuration and access control list configuration as dependencies, so that the detection traffic can pass through the user-defined security group and access control list rules; according to the inbound flow table, the network address detection request is controlled to pass through the inbound security group and the inbound access control list, and is passed to the proxy flow table; the network address detection request is processed through the proxy flow table to obtain a network address detection response for the target node; according to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list, and is returned to the detection node. During the detection process, the business traffic is separated from the detection traffic, so that the network address status of the target node can be obtained without the user's perception.

[0067] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0068] Reference Figure 5 , shows a structural block diagram of a network address detection system based on network layer service type coloring provided by an embodiment of the present invention, the system includes: a detection node 21, a computing node 22 and a target node 23;

[0069] The detection node 21 is used to send a network address detection request for the target node 23 to the computing node 22; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request;

[0070] The computing node 22 is used to receive a network address detection request for a target node 23 sent by the detection node 21; according to the inbound flow table, control the network address detection request to pass through the inbound security group and the inbound access control list, and pass it to the proxy flow table; process the network address detection request through the proxy flow table to obtain a network address detection response for the target node 23; according to the outbound flow table, control the network address detection response to pass through the outbound security group and the outbound access control list, and return to the detection node 21.

[0071] In an embodiment of the present invention, the computing node 22 is used to exchange the source address and the destination address in the network address detection request through the proxy flow table, exchange the source port and the destination port in the network address detection request, and modify the detection message content in the network address detection request to the response message content.

[0072] In the embodiment of the present invention, the computing node 22 is further configured to clear register information in the network address detection request.

[0073] The network address detection system of the embodiment of the present invention includes: a detection node, a computing node and a target node. The computing node can receive a network address detection request for a target node sent by the detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request, so that the detection traffic can pass through the user-defined security group and access control list rules; according to the inbound flow table, the network address detection request is controlled to pass through the inbound security group and the inbound access control list and be passed to the proxy flow table; the network address detection request is processed through the proxy flow table to obtain a network address detection response for the target node; according to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list and be returned to the detection node, and the business traffic is separated from the detection traffic during the detection process, so that the network address status of the target node can be obtained without the user's perception.

[0074] Reference Figure 6 , shows a structural block diagram of a network address detection device based on network layer service type coloring provided by an embodiment of the present invention, which may specifically include the following modules:

[0075] An address detection request receiving module 301 is used to receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request;

[0076] The address detection request transmission module 302 is used to control the network address detection request to pass through the inbound security group and the inbound access control list according to the inbound flow table and transmit it to the proxy flow table;

[0077] The address detection request processing module 303 is used to process the network address detection request through the proxy flow table to obtain a network address detection response for the target node;

[0078] The address detection response returning module 304 is used to control the network address detection response to be returned to the detection node through the outbound security group and the outbound access control list according to the outbound flow table.

[0079] In the embodiment of the present invention, the address detection request processing module 303 includes:

[0080] The address detection request processing submodule is used to exchange the source address and destination address in the network address detection request through the proxy flow table, exchange the source port and destination port in the network address detection request, and modify the detection message content in the network address detection request to the response message content.

[0081] In the embodiment of the present invention, the address detection request processing submodule is further used to clear the register information in the network address detection request.

[0082] In the embodiment of the present invention, the network address detection request performs network address detection according to the user data message protocol or the network control message protocol.

[0083] An embodiment of the present invention can receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request, so that the detection traffic can pass through the user-defined security group and access control list rules; according to the inbound flow table, the network address detection request is controlled to pass through the inbound security group and the inbound access control list, and is passed to the proxy flow table; the network address detection request is processed through the proxy flow table to obtain a network address detection response for the target node; according to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list, and is returned to the detection node. During the detection process, the business traffic is separated from the detection traffic, so that the network address status of the target node can be obtained without the user's perception.

[0084] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0085] An embodiment of the present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned network address detection method based on network layer service type coloring when executing the computer program.

[0086] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned network address detection method based on network layer service type coloring are implemented.

[0087] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0088] Those skilled in the art will appreciate that the embodiments of the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more machine-readable media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0089] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0092] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0093] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0094] The above is a detailed introduction to the network address detection method and system based on network layer service type coloring provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network address detection method based on network layer service type coloring, characterized in that: The method comprises: Receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match an inbound flow table and an outbound flow table of the network address detection request; According to the inbound flow table, control the network address detection request to pass through the inbound security group and the inbound access control list and be transmitted to the proxy flow table; Processing the network address detection request through the proxy flow table to obtain a network address detection response for the target node; According to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list and then be returned to the detection node.

2. The method according to claim 1, characterized in that: The processing of the network address detection request by using the proxy flow table includes: The source address and the destination address in the network address detection request are exchanged through the proxy flow table, the source port and the destination port in the network address detection request are exchanged, and the detection message content in the network address detection request is modified to the response message content.

3. The method according to claim 2, characterized in that The method further comprises: Clear the register information in the network address detection request.

4. The method according to claim 1, characterized in that: The network address detection request performs network address detection according to the user data message protocol or the network control message protocol.

5. A network address detection system based on network layer service type coloring, characterized in that: include: Detection nodes and computation nodes; The detection node is used to send a network address detection request for a target node to the computing node; The network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request; The computing node is used to receive a network address detection request for a target node sent by the detection node; according to the inbound flow table, control the network address detection request to pass through the inbound security group and the inbound access control list to the proxy flow table; process the network address detection request through the proxy flow table to obtain a network address detection response for the target node; According to the outbound flow table, the network address detection response is controlled to pass through the outbound security group and the outbound access control list and then be returned to the detection node.

6. The system according to claim 5, characterized in that The computing node is used to exchange the source address and the destination address in the network address detection request through the proxy flow table, exchange the source port and the destination port in the network address detection request, and modify the detection message content in the network address detection request to the response message content.

7. The system according to claim 6, characterized in that The computing node is further used to clear the register information in the network address detection request.

8. A network address detection device based on network layer service type coloring, characterized in that: The device comprises: An address detection request receiving module is used to receive a network address detection request for a target node sent by a detection node; the network address detection request carries a network layer service type value, and the network layer service type value is used to match the inbound flow table and the outbound flow table of the network address detection request; An address detection request delivery module is used to control the network address detection request to be delivered to the proxy flow table through the inbound security group and the inbound access control list according to the inbound flow table; An address detection request processing module, used to process the network address detection request through the proxy flow table to obtain a network address detection response for the target node; The address detection response returning module is used to control the network address detection response to be returned to the detection node through the outbound security group and the outbound access control list according to the outbound flow table.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of a network address detection method based on network layer service type coloring as described in any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the network address detection method based on network layer service type coloring as described in any one of claims 1 to 4 are implemented.

Images