Network topology discovery method and device

By establishing a binding relationship between the management platform and the data collector, the problems of detection packet unreachability and firewall restrictions are overcome in the existing network topology discovery scheme, and an accurate and reliable network topology diagram is generated to support the rapid response of network security risks.

CN119854133AActive Publication Date: 2025-04-18NEW H3C SECURITY TECH CO LTD

Patent Information

Application Number
CN202411792909.5
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-12-04
Publication Date
2025-04-18
Estimated Expiration
2044-12-04

AI Technical Summary

Technical Problem

The existing network topology discovery scheme is difficult to ensure the accessibility of detection packets in the actual network, and is restricted by the firewall, so it is impossible to effectively detect and draw network topology maps.

Method used

By establishing a binding relationship between the management platform and the data collector, the management platform issues detection tasks to the specific area to be detected, and the data collector bound to the area to be detected performs detection tasks, including device discovery and link discovery, and the detection results are uploaded to the management platform to generate a network topology map.

Benefits of technology

Overcome the network isolation limitations and firewall limitations of active detection, realize the automated asset topology discovery function, and generate an accurate and reliable network topology diagram to assist in judging the impact range of network security risks.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN119854133A_ABST
    Figure CN119854133A_ABST
Patent Text Reader

Abstract

The invention provides a network topology discovery method and device. The method is applied to a target data collector, and comprises the following steps: receiving a detection task for a target to-be-detected area sent by a management platform; executing the detection task to obtain a detection result of the target to-be-detected area, the detection result including an equipment discovery result and a link discovery result; and sending the detection result of the target to-be-detected area to a management platform, so that the management platform generates a network topological graph according to the detection results of all the to-be-detected areas. In the method, a management platform issues a detection task to a specific to-be-detected area, a data acquisition unit bound with the to-be-detected area executes the detection task, and then the management platform generates a network topological graph according to detection results of all the data acquisition units, so that network accessibility limitation and firewall limitation of active detection are overcome, and the detection efficiency is improved. And an automatic network topology discovery function is realized.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network topology discovery method and device. Background Art

[0002] Network topology refers to the connection relationship between various devices in the network (such as hosts, routing devices, switching devices, etc.). Network topology is the basis of network management and network planning, which can help managers understand the network structure for network monitoring and network fault location.

[0003] Network topology discovery is a network management technology whose core purpose is to obtain and maintain the existence information of network devices and the connection relationships between them, and on this basis draw a topology map of the entire network.

[0004] The principle of the current network topology discovery scheme is to send a probe message to the device, compare the fingerprint returned by the device with the fingerprint in the fingerprint library, and thus determine the network topology. The scheme has the following limiting factors in its implementation: First, network accessibility limitation: it is difficult to ensure the accessibility of the probe message in the actual network; second, firewall limitation: the firewall may disable network diagnostic tools (such as PING) and port scanning functions. Summary of the invention

[0005] In order to overcome the problems existing in the related art, the present application provides a network topology discovery method and device.

[0006] According to a first aspect of an embodiment of the present application, a network topology discovery method is provided, the method being applied to a target data collector, the target data collector being bound to a target area to be detected, the method comprising:

[0007] Receiving a detection task for the target area to be detected sent by the management platform;

[0008] Execute the detection task to obtain a detection result of the target area to be detected, wherein the detection result of the target area to be detected includes a device discovery result and a link discovery result;

[0009] The detection result of the target area to be detected is sent to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected, wherein the detection results of all areas to be detected at least include the detection result of the target area to be detected.

[0010] According to a second aspect of an embodiment of the present application, a network topology discovery method is provided, the method being applied to a management platform, the method comprising:

[0011] Generate a detection task for the area to be detected, and send the detection task to a data collector that has a binding relationship with the area to be detected;

[0012] Acquire a detection result of the area to be detected obtained by the data collector through executing the detection task, wherein the detection result includes a device discovery result and a link discovery result;

[0013] A network topology map is generated based on the acquired detection results of all the areas to be detected.

[0014] According to a third aspect of an embodiment of the present application, a network topology discovery device is provided, the device is applied to a target data collector, the target data collector has a binding relationship with a target area to be detected, and the device includes:

[0015] A receiving module, used for receiving a detection task for the target area to be detected sent by the management platform;

[0016] An execution module, used to execute the detection task and obtain a detection result of the target area to be detected, wherein the detection result of the target area to be detected includes a device discovery result and a link discovery result;

[0017] A sending module is used to send the detection results of the target area to be detected to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected, wherein the detection results of all areas to be detected include at least the detection results of the target area to be detected.

[0018] According to a fourth aspect of an embodiment of the present application, a network topology discovery device is provided, the device being applied to a management platform, the device comprising:

[0019] A task generation module, used for generating a detection task for the area to be detected, and sending the detection task to a data collector that has a binding relationship with the area to be detected;

[0020] An acquisition module, used to acquire the detection result of the area to be detected obtained by the data collector through executing the detection task, wherein the detection result includes a device discovery result and a link discovery result;

[0021] The topology generation module is used to generate a network topology map based on the detection results of all the areas to be detected.

[0022] According to a fifth aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the steps of the network topology discovery method described above.

[0023] According to a sixth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the network topology discovery method described above are implemented. The technical solution provided by the embodiment of the present application may include the following beneficial effects:

[0024] In the embodiment of the present application, the management platform sends the detection task to the specific area to be detected, and the data collector bound to the area to be detected executes the detection task. After the detection task is completed, the data collector uploads the detection result to the management platform, and the management platform generates a network topology map based on the detection results of all the areas to be detected. On the one hand, this method overcomes the network isolation limitations and firewall limitations of active detection, and on the other hand, it realizes the automatic asset topology discovery function. Therefore, the management platform can generate an accurate and reliable network topology map. When facing network security risks, the network topology map can assist in judging the scope of influence and facilitate timely response to network problems.

[0025] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0027] Figure 1 A schematic diagram of the process of the network topology discovery method provided in the first embodiment of the present application;

[0028] Figure 2 This is a flow chart of the device discovery process in Embodiment 1 of the present application;

[0029] Figure 3 This is a flowchart of the link discovery process in Embodiment 1 of the present application;

[0030] Figure 4 A flowchart of a network topology discovery method provided in Embodiment 2 of the present application;

[0031] Figure 5 This is a flowchart of the binding process in the second embodiment of the present application;

[0032] Figure 6 This is a flow chart of the process of issuing a detection task in Embodiment 3 of the present application;

[0033] Figure 7 This is a flow chart of the device discovery process in Embodiment 3 of the present application;

[0034] Figure 8This is a flowchart of the link discovery process in Embodiment 3 of the present application;

[0035] Fig. 9 A functional block diagram of a network topology discovery device provided in Embodiment 4 of the present application;

[0036] Fig.10 A functional block diagram of a network topology discovery device provided in Embodiment 5 of the present application;

[0037] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0039] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0040] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0041] The present application provides a network topology discovery method and device. In the present application, the management platform and the data collector cooperate with each other to complete the entire network topology discovery solution, wherein the number of data collectors is multiple, and each data collector has a binding relationship with the area to be detected. In the process of network topology discovery, the management platform first issues a detection task to each data collector, and the detection task instructs the data collector to detect the data to be detected with which it has a binding relationship; then each data collector obtains the detection result by executing the detection task, and sends the detection result back to the management platform; finally, the management platform generates a network topology map according to the detection results sent by all data collectors.

[0042] Next, the embodiments of the present application are described in detail.

[0043] The first embodiment of the present application provides a network topology discovery method, which is applied to a target data collector, and the target data collector has a binding relationship with the target area to be detected, such as Figure 1 As shown, the first embodiment includes the following steps:

[0044] Step 110: receiving a detection task for a target area to be detected sent by a management platform;

[0045] Step 120: Execute the detection task to obtain the detection result of the target area to be detected, wherein the detection result of the target area to be detected includes a device discovery result and a link discovery result;

[0046] Step 130: Send the detection result of the target area to be detected to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected, wherein the detection results of all areas to be detected at least include the detection result of the target area to be detected.

[0047] This embodiment provides a network topology discovery method with a target data collector as the execution subject. The target data collector can be any data collector. For the convenience of description, this embodiment refers to the area to be detected that has a binding relationship with the target data collector as the target area to be detected.

[0048] Specifically, in this embodiment, the detection results obtained by the target data collector through executing the detection task include device discovery results and link discovery results. The generation methods of the device discovery results and link discovery results are respectively described below.

[0049] like Figure 2 As shown, in this embodiment, the device discovery result is obtained in the following manner:

[0050] Step 210: For each device to be detected in the target area to be detected, a PING request message is sent to the device to be detected;

[0051] Step 220: If a PING response message is received from the device to be detected within a preset time period, it is determined whether the device to be detected supports the SNMP protocol; if the determination result is yes, the process proceeds to step 230;

[0052] Step 230: record the device to be detected into the link discovery list, and obtain basic information of the device to be detected through the SNMP protocol;

[0053] Step 240: Obtain detailed information of the devices to be detected for the devices of different device types;

[0054] Step 250: The basic information and detailed information of all the devices to be detected in the link discovery list are taken as the device discovery result.

[0055] The above-mentioned SNMP (Simple Network Management Protocol) protocol is a protocol for network management, which obtains the configuration information and performance data of network devices by exchanging SNMP messages. In the automatic discovery of network topology, the IP address, device type, connection relationship and other information of network devices can be obtained through the SNMP protocol, so as to construct the topology of the network. In step 230, the basic information of the device to be detected obtained in this embodiment includes at least the device type.

[0056] In the above step 240, the acquired detailed information of the device to be detected may include any one or more of the following: ARP (Address Resolution Protocol) table information, interface information, IP configuration information. The ARP table is used to store the mapping relationship between the IP address and the corresponding MAC address.

[0057] like Figure 3 As shown, this embodiment specifically obtains the link discovery result in the following manner:

[0058] Step 310: for each device to be detected in the link discovery list, determine whether the device to be detected supports the target communication protocol; if the determination result is yes, proceed to step 320; if the determination result is no, proceed to step 330;

[0059] Step 320, determine the link layer connection relationship of the device to be detected according to the table entry of the target communication protocol of the device to be detected, and proceed to step 370;

[0060] Step 330: determine whether the device to be detected is a routing device; if the determination result is yes, proceed to step 340; if the determination result is no, proceed to step 350;

[0061] Step 340, determine the link layer connection relationship of the device to be detected according to the routing table of the device to be detected, and proceed to step 370;

[0062] Step 350: determine whether the device to be detected is a switching device; if the determination result is yes, proceed to step 360;

[0063] Step 360, determine the link layer connection relationship of the device to be detected according to the FDB table of the device to be detected, and proceed to step 370;

[0064] Step 370: Take the link layer connection relationship of all the devices to be detected in the link discovery list as the link discovery result.

[0065] In the above step 310, the target communication protocol refers to a link layer communication protocol whose protocol content includes network device neighbor information, that is, a communication protocol that enables a device to identify and collect relevant information of adjacent devices.

[0066] As a specific implementation method, this embodiment selects LLDP (Link Layer Discovery Protocol) as the above-mentioned target communication protocol. The LLDP protocol is a link layer protocol used to discover and exchange link information between network devices. The LLDP protocol allows network devices to exchange information about the links to which they are connected, so as to better understand the network topology. Therefore, the above-mentioned step 310 can specifically determine whether the device to be detected supports the target communication protocol in the following manner: determine whether the device to be detected supports the LLDP protocol; if the judgment result is yes, determine the link layer connection relationship of the device to be detected according to the LLDP protocol table item of the device to be detected.

[0067] As another implementation, this embodiment can also select NDP (Neighbor Discovery Protocol) as the target communication protocol. Therefore, the above step 310 can specifically determine whether the device to be detected supports the target communication protocol in the following manner: determine whether the device to be detected supports the NDP protocol; if the determination result is yes, determine the link layer connection relationship of the device to be detected according to the NDP protocol table item of the device to be detected.

[0068] The above FDB table is called Forwarding Database. The FDB table of the switching device is mainly used to record the correspondence between the MAC address of the device in the network and the port of the switching device to realize the second-layer data forwarding.

[0069] MIB-II (Management Information Base II) is a set of standards for network management, which includes multiple tables and objects for monitoring and controlling network devices. In MIB-II, the ipAddrEntry table is a table used to provide IP configuration information for network device interfaces; the ipForwarding parameter is a key configuration parameter used to control whether the device acts as an IP gateway to forward packets with non-local destinations. When the ipForwarding parameter is set to true, it means that the current device will act as an IP gateway to forward IP packets with destination addresses other than the local device, which means that the device will participate in the routing function and forward received packets with destinations other than the local device to other networks or hosts.

[0070] Therefore, when a device is a routing device, the device has the following characteristics: the ipAddrEntry table of the device indicates that the number of interfaces of the device is more than two, and the ipForwarding parameter of the device is set to true.

[0071] As a specific implementation method, this embodiment specifically determines whether the device to be detected is a routing device in the following manner: a request message of the ipAddrEntry table is sent to the device to be detected through the SNMP protocol; if a response message of the ipAddrEntry table returned by the device to be detected is received, and the response message indicates that the number of interfaces of the device to be detected is more than two, then the ipForwarding parameter of the device to be detected is obtained; if the value of the ipForwarding parameter of the device to be detected is a preset threshold, it is determined that the device to be detected is a routing device.

[0072] It is worth mentioning that to determine whether a device is a switching device, you can check whether the device supports Bridge-MIB (Bridge Management Information Base). Bridge-MIB contains the topology information of the switching device, including the MAC address and VLAN information connected to each port. In addition, switching devices usually have multiple ports and VLAN configuration information. You can determine whether a device is a switching device by checking the number of ports and VLAN configuration of the device.

[0073] Therefore, when a device is a switching device, the device has the following characteristics: the device supports Bridge-MIB and has multiple ports and VLAN configurations.

[0074] As a specific implementation method, this embodiment specifically determines whether the device to be detected is a switching device in the following manner: determine whether the device to be detected supports Bridge-MIB through the SNMP protocol; if the judgment result is yes, obtain the port configuration and VLAN configuration of the device to be detected; if the port configuration of the device to be detected indicates that the number of ports of the device to be detected is multiple, and the VLAN configuration of the device to be detected indicates that the number of VLANs of the device to be detected is multiple, then determine that the device to be detected is a switching device.

[0075] It is understandable that, according to actual application requirements, the target collector may first perform data operations such as compression and encryption on the detection results, and then upload the operation results to the management platform.

[0076] It can be seen from the above technical solution that this embodiment provides a network topology discovery method, which is applied to the target data collector and can receive the detection task for the target area to be detected sent by the management platform; execute the detection task to obtain the detection result of the target area to be detected, and the detection result includes the device discovery result and the link discovery result; finally, the detection result of the target area to be detected is sent to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected.

[0077] That is to say, on the one hand, the network topology discovery method of this embodiment includes a management platform and a distributed data collector, wherein the data collector is bound to the network area to be detected, and the management platform sends the detection task to the specific area to be detected, and the data collector bound to the area to be detected executes the detection task, including device discovery and link discovery. After the detection task is completed, the data collector uploads the detection results to the management platform, and the management platform generates a network topology map based on the detection results of all areas to be detected.

[0078] On the other hand, the network topology discovery method of this embodiment includes two parts: device discovery and link discovery. Device discovery solves the network isolation limitations of active detection based on distributed data collectors, and link discovery realizes automatic asset topology discovery function. Therefore, the management platform can generate accurate and reliable network topology maps. When facing network security risks, the network topology map can assist in determining the scope of impact and facilitate timely response to network problems.

[0079] Embodiment 2 of the present application provides a network topology discovery method, which is applied to a management platform, such as Figure 4 As shown, the second embodiment includes the following steps:

[0080] Step 410: Generate a detection task for the area to be detected, and send the detection task to a data collector that has a binding relationship with the area to be detected;

[0081] Step 420: Acquire the detection result of the area to be detected obtained by the data collector by executing the detection task, wherein the detection result includes a device discovery result and a link discovery result;

[0082] Step 430: Generate a network topology map based on the acquired detection results of all the areas to be detected.

[0083] As a specific implementation method, Figure 5 As shown, in the third embodiment, the binding operation is performed on the detection area and the data collector in the following manner:

[0084] Step 510, determine whether a data collector is deployed inside the area to be detected; if the determination result is yes, proceed to step 520, otherwise proceed to step 530;

[0085] Step 520: perform a binding operation on the area to be detected and the data collector deployed inside the area to be detected;

[0086] Step 530: Bind the area to be detected with the data collector deployed in the upper level area of ​​the area to be detected.

[0087] Embodiment 3 of the present application provides a network topology discovery method. Embodiment 3 takes actual application as an example to explain the network topology discovery process in detail.

[0088] Figure 6 This is the process of the management platform issuing detection tasks in Example 3. Figure 7 This is the device discovery process of the data collector in Example 3. Figure 8 This is the link discovery process of the data collector in Example 3. Figure 6 , Figure 7 and Figure 8 The network topology discovery method of the third embodiment of the present application is described.

[0089] like Figure 6 As shown, the process of the management platform issuing detection tasks in the embodiment of the present application is as follows:

[0090] Step 61: According to the selection instruction, determine the area A to be detected that needs to create a new detection task;

[0091] Step 62: determine whether the area A to be detected is bound to a data collector;

[0092] Step 63: If the result of the judgment is yes, the data collector bound to the area A to be detected is recorded as data collector 1, a detection task A+1 of data collector 1 is newly created, and the detection task A+1 is added to the system detection task list. The detection task A+1 instructs data collector 1 to perform the detection task of the area A to be detected;

[0093] Step 64, if the result of the judgment is no, then search for the upper level area B of the area to be detected A, and judge whether the upper level area B exists. If the upper level area B exists and the upper level area B has been bound to the data collector 2, then create a new detection task A+2 of the data collector 2 bound to the upper level area B, and add the detection task A+2 to the system detection task list. The detection task A+2 instructs the data collector 2 to perform the detection task for the area to be detected A; if the upper level area B does not exist, it is prompted that the detection task creation fails;

[0094] Step 65: Send each detection task in the system detection task list to the corresponding data collector.

[0095] like Figure 7 As shown, the device discovery process of the data collector in the embodiment of the present application is as follows:

[0096] Step 70: The data collector receives the detection task sent by the management platform;

[0097] Step 71: parse the parameters of the detection task, determine the area to be detected, and each device to be detected in the area to be detected, and obtain a local device discovery list;

[0098] Step 72: Start the device discovery process;

[0099] Step 73: Take out the device n to be detected from the local device discovery list, where n is a positive integer between 1 and N, and N is the total number of devices to be detected in the local device discovery list;

[0100] Step 74, determine whether the device n to be detected can be pinged, that is, send a ping request message to the device to be detected, and determine whether a ping response message returned by the device to be detected is received within a preset time. If so, it is considered that the device n to be detected can be pinged, and proceed to the next step; otherwise, proceed to the next device;

[0101] Step 75, determine whether the device n to be detected supports the SNMP protocol; if yes, proceed to the next step, otherwise, add the device to the list of common devices;

[0102] Step 76: Add the device n to be detected to the list of discovered devices, and obtain the basic information and sysObjectID value of the device n to be detected; through the sysObjectID value, the device model table can be obtained to obtain the device type, device model, and manufacturer information corresponding to the device model;

[0103] Step 77: Obtain the ARP table information, interface information, IP address information, and IP configuration information of the device n to be detected, and add it to the list of discovered devices;

[0104] Step 78: Add the device n to be detected to the link discovery list;

[0105] Step 79, return to step 73, until n=N, complete the list of discovered devices as the device discovery result, and send it to the management platform.

[0106] like Figure 8 As shown, the link discovery process of the data collector in the embodiment of the present application is as follows:

[0107] Step 81: Take out the device m in the link discovery list, where m is a positive integer between 1 and M, and M is the total number of devices to be detected in the link discovery list;

[0108] Step 82: Determine whether the device m supports the LLDP protocol. If it does, obtain the LLDP table of the device m, and determine the link layer connection relationship of the device m according to lldpLocalSystemData and lldpRemoteSystemData.

[0109] lldpLocalSystemData refers to the information sent by the local device to the neighboring device in the LLDP protocol; lldpRemoteSystemData refers to the information received from the neighboring device in the LLDP protocol.

[0110] Step 83: If the LLDP protocol is not supported, determine whether the device m is a routing device. If it is a routing device, obtain the routing table of the device m, confirm the routing connection relationship, calculate the subnet range, confirm the subnet device, and finally obtain the link layer connection relationship of the device m.

[0111] Specifically, this embodiment determines whether a device is a routing device in the following manner: query the ipAddrEntry table in the MIB-II in the device through SNMP. If no query result is returned, it can be preliminarily determined that the device is not a routing device. If the device has more than two interfaces and the ipForwarding node is set to true, it can be determined that the device is a routing device.

[0112] Through this router, other network segments can be discovered, and devices in other network segments can be continued to be found.

[0113] Step 84: If it is not a routing device, determine whether device m is a switching device. If it is a switching device, obtain the FDB table of device m, and obtain the port VLAN division and interface and device connection relationship in the BRIDGE-MIB (Management Information Base) to obtain the link layer connection relationship of device m.

[0114] Specifically, this embodiment determines whether a device is a switching device in the following manner: After a device supports SNMP, if it is a switching device, it should implement Bridge-MIB, and should implement several main nodes therein, such as: the number of ports node, the path value from the current bridge node to the root bridge node, the number of ports from the previous bridge node to the root bridge node, etc.

[0115] Step 85, sort out the link layer connection relationships of all devices in the link discovery list to obtain a link discovery result;

[0116] Step 86: Upload the link discovery result to the management platform.

[0117] In summary, the network topology discovery method provided by the present application overcomes the network isolation limitations and firewall access control limitations of active detection based on distributed data collectors. Compared with a single message detection method, the present application provides a variety of asset detection methods, realizes automated network topology discovery function, and provides a basis for automated orchestration.

[0118] Embodiment 4 of the present application provides a network topology discovery device, which is applied to a target data collector, and the target data collector has a binding relationship with a target area to be detected.

[0119] like Fig. 9 As shown, the device comprises:

[0120] A receiving module 910 is used to receive a detection task for the target area to be detected sent by the management platform;

[0121] An execution module 920 is used to execute the detection task and obtain a detection result of the target area to be detected, wherein the detection result of the target area to be detected includes a device discovery result and a link discovery result;

[0122] The sending module 930 is used to send the detection results of the target area to be detected to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected, wherein the detection results of all areas to be detected include at least the detection results of the target area to be detected.

[0123] As a specific implementation, the execution module 920 obtains the device discovery result in the following manner:

[0124] For each device to be detected in the target area to be detected, a PING request message is sent to the device to be detected; if a PING response message returned by the device to be detected is received within a preset time, it is determined whether the device to be detected supports the SNMP protocol; if the judgment result is yes, the device to be detected is recorded in the link discovery list, and the basic information of the device to be detected is obtained through the SNMP protocol, wherein the basic information includes the device type; for devices to be detected of different device types, detailed information of the device to be detected is obtained, wherein the detailed information includes any one or more of the following: ARP table information, interface information, IP configuration information; the basic information and detailed information of all devices to be detected in the link discovery list are used as device discovery results.

[0125] As a specific implementation, the execution module 920 obtains the link discovery result in the following manner:

[0126] For each device to be detected in the link discovery list, determine whether the device to be detected supports the target communication protocol, wherein the target communication protocol is a link layer communication protocol whose protocol content includes network device neighbor information; if the judgment result is yes, determine the link layer connection relationship of the device to be detected according to the table item of the target communication protocol of the device to be detected; if the judgment result is no, determine whether the device to be detected is a routing device; if the judgment result is yes, determine the link layer connection relationship of the device to be detected according to the routing table of the device to be detected; if the judgment result is no, determine whether the device to be detected is a switching device; if the judgment result is yes, determine the link layer connection relationship of the device to be detected according to the FDB table of the device to be detected; take the link layer connection relationship of all devices to be detected in the link discovery list as the link discovery result.

[0127] As a specific implementation, the execution module 920 determines whether the device to be detected supports the target communication protocol in the following manner:

[0128] Determine whether the device to be detected supports the LLDP protocol; if the determination result is yes, determine the link layer connection relationship of the device to be detected according to the LLDP protocol table item of the device to be detected.

[0129] As a specific implementation, the execution module 920 determines whether the device to be detected is a routing device in the following manner:

[0130] A request message of the ipAddrEntry table is sent to the device to be detected through the SNMP protocol; if a response message of the ipAddrEntry table returned by the device to be detected is received, and the response message indicates that the number of interfaces of the device to be detected is more than two, the ipForwarding parameter of the device to be detected is obtained; if the value of the ipForwarding parameter of the device to be detected is a preset threshold, it is determined that the device to be detected is a routing device.

[0131] As a specific implementation, the execution module 920 determines whether the device to be detected is a switching device in the following manner:

[0132] Determine whether the device to be detected supports Bridge-MIB through the SNMP protocol; if the judgment result is yes, obtain the port configuration and VLAN configuration of the device to be detected; if the port configuration of the device to be detected indicates that the number of ports of the device to be detected is multiple, and the VLAN configuration of the device to be detected indicates that the number of VLANs of the device to be detected is multiple, then determine that the device to be detected is a switching device.

[0133] Embodiment 5 of the present application provides a network topology discovery device, which is applied to a management platform.

[0134] like Fig.10 As shown, the device comprises:

[0135] The task generation module 1010 is used to generate a detection task for the area to be detected, and send the detection task to a data collector that has a binding relationship with the area to be detected;

[0136] An acquisition module 1020 is used to acquire a detection result of the area to be detected obtained by the data collector by executing the detection task, wherein the detection result includes a device discovery result and a link discovery result;

[0137] The topology generation module 1030 is used to generate a network topology map according to the acquired detection results of all the areas to be detected. As a specific implementation, the device also includes:

[0138] A binding module 1000 is used to perform a binding operation on the area to be detected and the data collector;

[0139] The binding module 1000 specifically performs the binding operation on the detection area and the data collector in the following manner:

[0140] Determine whether a data collector is deployed inside the area to be detected; if the judgment result is yes, perform a binding operation on the area to be detected and the data collector deployed inside the area to be detected; if the judgment result is no, perform a binding operation on the area to be detected and the data collector deployed inside the upper-level area of ​​the area to be detected.

[0141] The present application also provides an electronic device, such as Fig.11 As shown, it includes a processor 1110 and a machine-readable storage medium 1120, wherein the machine-readable storage medium 1120 stores machine-executable instructions that can be executed by the processor 1110, and the processor 1110 is prompted by the machine-executable instructions to implement the steps of any of the above-mentioned network topology discovery methods.

[0142] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the processor.

[0143] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0144] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned network topology discovery methods are implemented.

[0145] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A network topology discovery method, characterized in that: The method is applied to a target data collector, and the target data collector has a binding relationship with a target area to be detected, and the method includes: Receiving a detection task for the target area to be detected sent by the management platform; Execute the detection task to obtain a detection result of the target area to be detected, wherein the detection result of the target area to be detected includes a device discovery result and a link discovery result; The detection result of the target area to be detected is sent to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected, wherein the detection results of all areas to be detected at least include the detection result of the target area to be detected.

2. The method according to claim 1, characterized in that The method specifically obtains the device discovery result in the following manner: For each device to be detected in the target area to be detected, sending a PING request message to the device to be detected; If a PING response message is received from the device to be detected within a preset time, it is determined whether the device to be detected supports the SNMP protocol; If the judgment result is yes, the device to be detected is recorded in the link discovery list, and the basic information of the device to be detected is obtained through the SNMP protocol, wherein the basic information includes the device type; For devices to be detected of different device types, obtaining detailed information of the devices to be detected, wherein the detailed information includes any one or more of the following: ARP table information, interface information, IP configuration information; The basic information and detailed information of all the devices to be detected in the link discovery list are used as the device discovery result.

3. The method according to claim 2, characterized in that The method specifically obtains the link discovery result in the following manner: For each device to be detected in the link discovery list, determining whether the device to be detected supports a target communication protocol, wherein the target communication protocol is a link layer communication protocol whose protocol content includes network device neighbor information; If the judgment result is yes, determining the link layer connection relationship of the device to be detected according to the table entry of the target communication protocol of the device to be detected; If the judgment result is no, then determine whether the device to be detected is a routing device; If the judgment result is yes, determining the link layer connection relationship of the device to be detected according to the routing table of the device to be detected; If the judgment result is no, then determine whether the device to be detected is a switching device; If the judgment result is yes, the link layer connection relationship of the device to be detected is determined according to the FDB table of the device to be detected; The link layer connection relationship of all the devices to be detected in the link discovery list is used as the link discovery result.

4. The method according to claim 3, characterized in that The method specifically determines whether the device to be detected supports the target communication protocol by the following method: Determine whether the device to be detected supports the LLDP protocol; If the determination result is yes, the link layer connection relationship of the device to be detected is determined according to the LLDP protocol table entry of the device to be detected.

5. The method according to claim 3, characterized in that: The method specifically determines whether the device to be detected is a routing device by the following method: Send a request message of ipAddrEntry table to the device to be detected through SNMP protocol; If a response message of the ipAddrEntry table returned by the device to be detected is received, and the response message indicates that the number of interfaces of the device to be detected is more than two, then the ipForwarding parameter of the device to be detected is obtained; If the value of the ipForwarding parameter of the device to be detected is a preset threshold, it is determined that the device to be detected is a routing device.

6. The method according to claim 3, characterized in that The method specifically determines whether the device to be detected is a switching device by the following method: Use the SNMP protocol to determine whether the device to be detected supports Bridge-MIB; If the judgment result is yes, then obtain the port configuration and VLAN configuration of the device to be detected; If the port configuration of the device to be detected indicates that the device to be detected has multiple ports, and the VLAN configuration of the device to be detected indicates that the device to be detected has multiple VLANs, then it is determined that the device to be detected is a switching device.

7. A network topology discovery method, characterized in that: The method is applied to a management platform, and the method comprises: Generate a detection task for the area to be detected, and send the detection task to a data collector that has a binding relationship with the area to be detected; Acquire a detection result of the area to be detected obtained by the data collector through executing the detection task, wherein the detection result includes a device discovery result and a link discovery result; A network topology map is generated based on the acquired detection results of all the areas to be detected.

8. The method according to claim 7, characterized in that The method specifically performs the binding operation between the detection area and the data collector in the following manner: Determine whether a data collector is deployed inside the area to be detected; If the judgment result is yes, a binding operation is performed on the area to be detected and the data collector deployed inside the area to be detected; If the judgment result is no, a binding operation is performed on the area to be detected and the data collector deployed in the upper-level area of ​​the area to be detected.

9. A network topology discovery device, characterized in that: The device is applied to a target data collector, and the target data collector is in a binding relationship with a target area to be detected. The device includes: A receiving module, used for receiving a detection task for the target area to be detected sent by the management platform; An execution module, used to execute the detection task and obtain a detection result of the target area to be detected, wherein the detection result of the target area to be detected includes a device discovery result and a link discovery result; A sending module is used to send the detection results of the target area to be detected to the management platform, so that the management platform generates a network topology map according to the detection results of all areas to be detected, wherein the detection results of all areas to be detected include at least the detection results of the target area to be detected.

10. A network topology discovery device, characterized in that: The device is applied to a management platform, and comprises: A task generation module, used for generating a detection task for the area to be detected, and sending the detection task to a data collector that has a binding relationship with the area to be detected; An acquisition module, used to acquire the detection result of the area to be detected obtained by the data collector through executing the detection task, wherein the detection result includes a device discovery result and a link discovery result; The topology generation module is used to generate a network topology map based on the detection results of all the areas to be detected.

11. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 8 are implemented.

Citation Information

Patent Citations

  • Passive finding equipment and method of network topology

    CN102082690A

  • Distributed IP level network topology detection method based on a plurality of protocols

    CN109617728A

  • Network topology automatic discovery method of network equipment based on ICMP, TCP and UDP protocols

    CN110661669A

  • Distributed routing-level network topology detection method based on embedded equipment

    CN112583657A

  • Network topology detection method under non-cooperative condition

    CN114666227A

Cited By

  • A method and system for topology adaptive management of a mimicking computing system

    CN122698456A