Network problem positioning method and device, electronic equipment and computer program product

Abstract

The invention discloses a network problem positioning method and device, electronic equipment and a computer program product. The network problem positioning method comprises the following steps: monitoring a network state and generating network alarm information when monitoring that a network is abnormal; performing network link analysis according to the network alarm information and the network equipment information to obtain a network equipment set corresponding to the network alarm information; and capturing the traffic data of all the network devices in the network device set during the network alarm period so as to perform problem positioning analysis according to the captured traffic data. According to the method, a whole-process closed loop from warning to capture and analysis is formed by integrating monitoring, path analysis and data packet capture processes, the fault detection, analysis and processing processes are fully automatic through seamless linkage among the three process nodes, the resource investment is reduced by capturing and analyzing the network flow according to needs, and the fault detection, analysis and processing efficiency is improved. The real-time performance and accuracy of troubleshooting are improved, and a more efficient solution is provided for network management and maintenance.

Description

Technical Field

[0001] The present application relates to the technical field of network problem location, and in particular to a network problem location method, device, electronic device, and computer program product. Background Art

[0002] In the network environment of modern enterprises, with the rapid development of business and the sharp increase in network traffic, the stability of network equipment and services has become particularly important. The location and analysis of network link problems are the key to ensuring network stability and performance. The network architecture of an enterprise usually includes multiple key devices, such as firewalls, load balancing devices, routers and switches, which together support daily business operations and data transmission. Any failure or performance problem in the network may have a serious impact on the operation of the enterprise, especially in the face of high-traffic environments and complex network topologies, the detection and analysis of network failures become increasingly difficult.

[0003] Currently, when analyzing network failures, it is unrealistic to fully deploy data capture devices on every device due to deployment cost constraints. Therefore, they are usually deployed only on key network nodes. Network monitoring and packet capture technology are used to mirror traffic on key network devices, interfaces, and lines, copy data packets to traffic analysis devices, and obtain full data packets for analysis.

[0004] However, this approach has at least the following technical problems:

[0005] 1) Large investment in equipment resources: Full packet mirroring consumes a lot of equipment resources, such as the hardware performance of TAP switches and traffic analysis platforms. This method is almost not feasible, especially when the network traffic is high.

[0006] 2) Poor real-time performance: Traditional technologies have difficulty in capturing data immediately when a problem occurs, which may result in the problem being restored after the alarm notification, affecting the timeliness of troubleshooting and even making further troubleshooting impossible.

[0007] 3) Low analysis efficiency: Screening and analyzing all data packets requires a lot of time and effort, especially when checking data packets within a wide time range. Summary of the invention

[0008] The embodiments of the present application provide a network problem locating method, device, electronic device, and computer program product to reduce the resource investment in network problem locating and improve the efficiency and accuracy of problem locating.

[0009] The present application embodiment adopts the following technical solutions:

[0010] In a first aspect, an embodiment of the present application provides a network problem locating method, the network problem locating method comprising:

[0011] Monitor network status and generate network alarm information if abnormal network status is detected;

[0012] Performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information;

[0013] During the network alarm period, the flow data of all network devices in the network device set is captured, and the captured flow data of all network devices in the network device set is uploaded to the server for problem location and analysis.

[0014] Optionally, monitoring the network status and generating network alarm information when an abnormal network status is detected includes:

[0015] Determine the corresponding network monitoring method according to the type of network equipment;

[0016] Acquiring network monitoring data according to a network monitoring method corresponding to the type of the network device;

[0017] When an abnormal network state is detected according to the network monitoring data, network alarm information is generated.

[0018] Optionally, the types of the network devices are divided into key network devices and non-key network devices, and the acquiring of network monitoring data according to the network monitoring method corresponding to the type of the network device includes:

[0019] For the critical network device and the non-critical network device, using the SNMP protocol to receive or actively obtain first network monitoring data of the critical network device and the non-critical network device;

[0020] For the key network device, the second network monitoring data of the key network device is obtained by using traffic mirroring technology.

[0021] Optionally, generating network alarm information when an abnormal network state is detected according to the network monitoring data includes:

[0022] When an abnormal network state is detected according to the network monitoring data of the key network device, generating network alarm information of the key network device;

[0023] When an abnormal network state is detected according to the network monitoring data of the non-critical network device, generating network alarm information of the non-critical network device;

[0024] A global view of the network alarm information is generated according to the network alarm information of the critical network device and the non-critical network device.

[0025] Optionally, the network alarm information is abnormal access alarm information from the source IP address to the destination IP address, and the network link analysis is performed according to the network alarm information and the network device information to obtain a network device set corresponding to the network alarm information, including:

[0026] Obtain table entry information of network devices from the system database;

[0027] According to the table entry information of the network device, a network link analysis is performed using a preset link analysis strategy to obtain a set of network devices between the source IP address and the destination IP address.

[0028] Optionally, the table entry information of the network device stored in the system database is obtained in the following manner:

[0029] Acquire basic information of network devices from a system database, where the basic information of network devices is synchronized from a configuration management database by the system database;

[0030] According to the basic information of the network device, the table item information of the network device is obtained by using a scheduled task and stored in a system database.

[0031] Optionally, capturing the flow data of all network devices in the set of network devices during the network alarm period includes:

[0032] After obtaining the network device set corresponding to the network alarm information, start capturing the flow data of all network devices in the network device set;

[0033] Determine whether the capture termination condition is triggered;

[0034] When the capture termination condition is triggered, the capture of the flow data of all network devices in the network device set is stopped.

[0035] In a second aspect, an embodiment of the present application further provides a network problem locating device, the network problem locating device comprising:

[0036] A monitoring unit, used to monitor the network status and generate network alarm information when an abnormal network status is detected;

[0037] A link analysis unit, configured to perform network link analysis based on the network alarm information and the network device information, and obtain a network device set corresponding to the network alarm information;

[0038] The capture unit is used to capture the flow data of all network devices in the network device set during the network alarm period, so as to upload the captured flow data of all network devices in the network device set to the server for problem analysis and location.

[0039] In a third aspect, an embodiment of the present application further provides an electronic device, including:

[0040] A processor; and a memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor executes any of the aforementioned network problem locating methods.

[0041] In a fourth aspect, an embodiment of the present application further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements any of the aforementioned network problem locating methods.

[0042] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: the network problem location method of the embodiment of the present application first monitors the network status and generates network alarm information when the network status is abnormal; then performs network link analysis based on the network alarm information and network device information to obtain the network device set corresponding to the network alarm information; finally, during the network alarm period, the flow data of all network devices in the network device set is captured to upload the captured flow data of all network devices in the network device set to the server for problem location and analysis. The network problem location method of the embodiment of the present application forms a full-process closed loop from alarm to capture and analysis by integrating monitoring, path analysis and data packet capture processes. Through the seamless linkage between the three process nodes, the fault detection, analysis and processing processes are fully automated, and by capturing and analyzing network traffic on demand, the resource investment of full traffic mirroring in the traditional method is reduced, while the capture capability and analysis efficiency of short-term problems are improved, that is, the real-time and accuracy of troubleshooting are improved, providing a more efficient solution for network management and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 A flowchart of a method for locating a network problem in an embodiment of the present application;

[0045] Figure 2 This is a schematic diagram of a network problem location process in an embodiment of the present application;

[0046] Figure 3 This is a schematic diagram of the structure of a network problem location device in an embodiment of the present application;

[0047] Figure 4 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0049] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0050] The present application embodiment provides a method for locating a network problem, such as Figure 1 As shown, a flow chart of a network problem location method in an embodiment of the present application is provided, and the network problem location method at least includes the following steps S110 to S130:

[0051] Step S110, monitoring the network status and generating network alarm information when an abnormal network status is detected.

[0052] Combination Figure 2 , a schematic diagram of a network problem location process in an embodiment of the present application is provided. When locating a network problem, it is necessary to first monitor the network status in real time. For example, this can be achieved through various monitoring tools or systems deployed in the network, such as network traffic monitors, performance monitors, log collectors, etc. These monitoring tools can collect network status information in real time or regularly, including key indicators such as traffic, delay, packet loss rate, error rate, etc. When these indicators exceed preset thresholds or trigger specific rules, the network status is considered abnormal, thereby automatically generating network alarm information. The network alarm information may include, for example, alarm type, alarm level, alarm time, affected equipment and other information. Of course, the specific way to monitor the network status can be flexibly set by those skilled in the art according to actual needs, and no specific limitation is made here.

[0053] The setting of the above alarm mechanism not only ensures the timeliness of real-time monitoring, but also provides trigger conditions for subsequent path analysis and traffic data packet capture.

[0054] Step S120: Perform network link analysis based on the network alarm information and network device information to obtain a network device set corresponding to the network alarm information.

[0055] After monitoring the abnormal network status, it is necessary to further combine the network alarm information and the full information of the network equipment to perform path analysis, that is, analyze all network devices involved in the abnormal network link to determine the set of devices that may be affected by the network alarm.

[0056] Step S130, during the network alarm period, the flow data of all network devices in the network device set are captured, and the captured flow data of all network devices in the network device set are uploaded to the server for problem location and analysis.

[0057] After analyzing all network devices associated with the alarm information, the traffic data packet capture mechanism is started to continuously capture the traffic data packets of all network devices associated with the alarm information during the entire alarm period, realizing on-demand capture, which greatly reduces the required resource investment compared to the traditional method of full traffic mirroring. Finally, the captured traffic data packets are uploaded to the server in real time for subsequent data analysis and problem location.

[0058] Specifically, data can be captured in a targeted manner according to the alarm content and the filtering conditions for the network devices associated with the alarm content, thereby improving the efficiency of data capture. For example, if the alarm content contains source and destination IP link access, the source and destination IP can be filtered. If there is IP conversion such as NAT in the middle, the converted IP can also be used as the filtering condition for data capture.

[0059] The network problem locating method of the embodiment of the present application forms a full-process closed loop from alarm to capture and analysis by integrating monitoring, path analysis and data packet capture processes. The fault detection, analysis and processing processes are fully automated through seamless linkage between the three process nodes. In addition, by capturing and analyzing network traffic on demand, the resource investment in full traffic mirroring in traditional methods is reduced, while the capture capability and analysis efficiency of short-term problems are improved, that is, the real-time and accuracy of troubleshooting are improved, providing a more efficient solution for network management and maintenance.

[0060] In some embodiments of the present application, monitoring the network status and generating network alarm information when an abnormal network status is monitored includes: determining a corresponding network monitoring method according to the type of network equipment; acquiring network monitoring data according to the network monitoring method corresponding to the type of network equipment; and generating network alarm information when an abnormal network status is monitored according to the network monitoring data.

[0061] When monitoring the network status, different types of devices may have different monitoring requirements. The most suitable monitoring method can be selected according to the type of network device. The network device type can be divided into key network devices and non-key network devices. Key network devices include Internet egress routers, core switches, border firewalls, etc. Non-key network devices include access switches, management switches, etc. Of course, which network devices are classified as key network devices or non-key network devices can be flexibly set by those skilled in the art according to actual needs, and no specific limitation is made here.

[0062] By selecting the monitoring method according to the device type, you can ensure the pertinence and effectiveness of monitoring and avoid unnecessary waste of resources. At the same time, this also provides a more accurate basis for subsequent alarm generation.

[0063] After determining the monitoring method, you can use the corresponding monitoring method to obtain monitoring data of network devices. This data may come from the local management interface of the device (such as SNMP, CLI, etc.), or from the network management system (NMS) or cloud monitoring service, depending on the type of network device being monitored. By collecting this data in real time and storing it in the database for processing, network alarm information can be quickly generated when abnormal network status is monitored.

[0064] By refining the steps of monitoring the network status and selecting a suitable monitoring method and obtaining monitoring data according to the type of network equipment, the embodiment of the present application can more accurately monitor the network status and generate alarm information. This not only improves the pertinence and effectiveness of monitoring, but also provides a more reliable data foundation and basis for subsequent problem location and resolution, which is of great significance for ensuring the stable operation of the network and timely responding to network failures.

[0065] In some embodiments of the present application, the types of network devices are divided into critical network devices and non-critical network devices, and the network monitoring data is obtained according to the network monitoring method corresponding to the type of the network device, including: for the critical network devices and the non-critical network devices, using the SNMP protocol to receive or actively obtain the first network monitoring data of the critical network devices and the non-critical network devices; for the critical network devices, using traffic mirroring technology to obtain the second network monitoring data of the critical network devices.

[0066] Existing solutions usually only deploy data capture devices on key network nodes, and use traffic mirroring technology to capture the full amount of data packets of key network nodes for analysis. However, since the time and node of the failure are unpredictable, this incomplete deployment may result in the inability to fully capture the data packets in the network when the failure occurs, making some problems difficult to reproduce and analyze, and the problems cannot be effectively solved, leaving potential risks in the operation of the existing network.

[0067] Based on this, the monitoring of network status by the embodiment of the present application not only covers critical network devices, but also non-critical network devices. Data packets can be captured 24 / 7 for critical network devices, and real-time data capture is also enhanced for non-critical devices. The accuracy and efficiency of problem location are improved through comprehensive equipment monitoring data.

[0068] Continue to refer Figure 2 In the whole process, the monitoring process node undertakes the key front-end alarm task. On the one hand, for the monitoring of key network devices and non-key network devices, both can be based on the SNMP (Simple Network Management Protocol) protocol to receive abnormal event reports or actively obtain abnormal event information. The reporting of abnormal events can be achieved through SNMP trap, which allows network devices to actively report abnormal event information to the network management system. By combining the receiving of reports and active acquisition, the situation where abnormal event information is not obtained in time due to the failure of a single monitoring method is avoided, and the comprehensiveness and timeliness of network equipment monitoring are fully guaranteed.

[0069] On the other hand, for key network devices, in order to ensure that the data packets in the network can be fully captured when an abnormality occurs in the key network devices, additional full-flow mirroring processing can be performed on the key network devices. For example, traffic mirroring technologies such as SPAN (Switch Port Analyzer) or ERSPAN (Encapsulated Remote SPAN) can be used to monitor the real-time traffic and status of key network devices and interfaces. These technologies allow network administrators to copy and monitor network traffic without interrupting normal network traffic. The monitored data is sent to NPM (Network Performance Monitoring) tools and Splunk security analysis platforms, etc. These tools detect network anomalies through preset thresholds such as traffic and status. When an abnormal situation is detected, such as network performance degradation, traffic anomalies, etc., an alarm will be generated immediately.

[0070] By distinguishing between critical network devices and non-critical network devices, the embodiments of the present application can adopt appropriate monitoring methods in a targeted manner to ensure that network anomalies can be discovered and handled in a timely manner, while reducing unnecessary monitoring resource overhead. In addition, comprehensive monitoring of critical network devices and non-critical network devices helps to improve the accuracy and efficiency of problem location.

[0071] In some embodiments of the present application, generating network alarm information when an abnormal network status is monitored according to the network monitoring data includes: generating network alarm information of the critical network device when an abnormal network status is monitored according to the network monitoring data of the critical network device; generating network alarm information of the non-critical network device when an abnormal network status is monitored according to the network monitoring data of the non-critical network device; generating a global view of the network alarm information based on the network alarm information of the critical network device and the non-critical network device.

[0072] For critical network devices, after abnormal information is monitored based on the SNMP protocol or full-flow mirroring technology, an alarm will be generated immediately, and the alarm information will be aggregated to the monitoring process node through the API or other protocols. For non-critical network devices, the monitoring process node receives abnormal event reports or actively obtains abnormal events through the SNMP protocol, and these events will also trigger alarms. The monitoring process node will uniformly process and analyze the alarm information received or obtained from all devices to form a global view of the network alarm information. The global view can display the alarm information of each network device, so that network administrators can more intuitively understand the overall status of the network.

[0073] The embodiment of the present application can more comprehensively discover network faults by integrating network monitoring data of key network devices and non-key network devices, reducing fault omissions caused by incomplete monitoring. In addition, the global view provides an overall overview of network alarm information, which helps network administrators quickly locate fault points and reduce troubleshooting time.

[0074] In some embodiments of the present application, the network alarm information is access abnormality alarm information from the source IP address to the destination IP address, and the network link analysis is performed based on the network alarm information and the network device information to obtain the network device set corresponding to the network alarm information, including: obtaining the table entry information of the network device from the system database; based on the table entry information of the network device, performing network link analysis using a preset link analysis strategy to obtain the network device set between the source IP address and the destination IP address.

[0075] When an access anomaly occurs in the network, an access anomaly alarm message from the source IP address to the destination IP address is generated. This alarm message contains key information such as the source and destination addresses that triggered the alarm, as well as the alarm type and occurrence time.

[0076] Based on the above alarm information, the table information of the network device can be further obtained from the database. The table information includes key data such as the routing table, ARP table, interface table, etc. of the network device. These data are crucial for subsequent network link analysis because they provide information such as the connection relationship and forwarding rules between network devices.

[0077] When an alarm is generated, the path analysis node is immediately started to analyze the network links, which may include the following process:

[0078] 1) Use the ARP table entry to determine the device connected to the service system, such as a Leaf switch.

[0079] 2) Based on the destination address in the alarm, match the next hop IP from the routing table and locate the next device through the interface IP.

[0080] 3) If there is a NAT device in the path, the IP address will be translated according to the NAT table entry, and recursive query will continue. This step ensures that the complete network path map can be accurately drawn even in the presence of network address translation.

[0081] 4) Through recursive query, the network path between the source device and the target device involved in the alarm is gradually confirmed until the complete path diagram is drawn.

[0082] Through the above path analysis process, all network devices between the source IP and the destination IP can be obtained to form a network device set, which serves as the basis for the next step of automatic data packet capture.

[0083] The embodiment of the present application can quickly locate the network device between the source IP and the destination IP through path analysis, thereby quickly locking the possible location of the network fault, greatly shortening the time to locate the network fault, and improving the efficiency of network fault handling. By comprehensively utilizing the table information of network devices (such as routing tables, ARP tables, interface tables, etc.) for network link analysis, a network path map can be drawn more accurately, improving the accuracy of network monitoring, and helping to promptly discover and solve potential network problems.

[0084] In some embodiments of the present application, the table item information of the network device stored in the system database is obtained in the following manner: basic information of the network device is obtained from the system database, and the basic information of the network device is synchronized by the system database from the configuration management database; based on the basic information of the network device, the table item information of the network device is obtained by using a scheduled task and stored in the system database.

[0085] The table entry information of the network device is the key information for realizing the network link analysis in the above-mentioned embodiments. When obtaining the table entry information of the network device from the system database, it is necessary to first determine which network devices to obtain and monitor, that is, it is necessary to first obtain the basic information of the network devices to be monitored. The system database stores the basic information of the network devices, for example, it may include the ID of the network device, the management IP address of the network device (used to interact with the device), the responsible person, and the related system information. This information can be synchronized from the configuration management database (CMDB) by the system database regularly. The configuration management database is a database specifically used to store and manage IT asset information such as network devices, servers, and applications. By synchronizing the basic information of the network devices to the system database, the system can realize comprehensive management and monitoring of IT asset information, and provide strong support for network problem location, troubleshooting, performance optimization, etc.

[0086] After obtaining the basic information of the network device, you can automatically trigger the acquisition of the table information of the network device at a predetermined time interval based on the basic information of the network device by setting a scheduled task, and synchronize the acquired table information of the network device to the system database. During the synchronization process, it is necessary to ensure the integrity, accuracy and consistency of the data to avoid data loss or duplication.

[0087] In some embodiments of the present application, capturing the flow data of all network devices in the network device set during the network alarm period includes: after obtaining the network device set corresponding to the network alarm information, starting to capture the flow data of all network devices in the network device set; determining whether a capture termination condition is triggered; and if the capture termination condition is triggered, stopping capturing the flow data of all network devices in the network device set.

[0088] Continue to refer Figure 2 , data packet capture is the third link of the entire process, which is automatically started after the path analysis of the aforementioned embodiment is completed, and captures the network traffic packets of the specified device and interface through the device's own commands or pre-installed agents. Unlike traditional full-volume traffic mirroring, the embodiment of the present application only captures data during the alarm period through on-demand capture, reducing the waste of network bandwidth and storage resources. During the capture process, the data packet will be uploaded to the storage server in real time, and engineers can quickly find the corresponding data packet file and analyze it through the alarm number. When the alarm ends, the capture will stop automatically, thereby improving operational efficiency and avoiding excessive data storage requirements.

[0089] It should be noted here that the "network alarm period" defined in the embodiment of the present application does not simply refer to the period from the start of the alarm to the end of the alarm, but actually refers to the period from the start of the alarm to the triggering of the capture termination condition. The capture termination condition may include a capture termination condition set for whether the alarm has ended, and may also include a capture termination condition set for whether the size of the captured data traffic has reached a preset traffic threshold, because in some specific scenarios, there will be particularly large traffic. If the capture of data traffic is controlled solely by whether the alarm has ended, the amount of captured data may be overloaded. Therefore, a threshold limit for traffic data capture can be set, that is, data capture needs to be stopped after capturing traffic data of a certain threshold size.

[0090] In summary, the key points and technical effects of the network problem location method of this application are as follows:

[0091] 1) Full-process closed-loop design: A closed-loop mechanism is formed by effectively integrating real-time monitoring, network path analysis, and data capture.

[0092] 2) Alarm triggering: The monitoring process node automatically generates alarms based on traffic and status anomalies and triggers path analysis.

[0093] 3) Path analysis: The path analysis node locates the devices and network paths involved in the alarm and feeds the path information back to the packet capture node.

[0094] 4) Packet capture: The packet capture node performs on-demand traffic capture during the alarm duration based on the results of path analysis, and automatically stops capturing after the alarm ends.

[0095] Through the above linkage design scheme, this application fully automates the fault detection, analysis and processing processes, and by capturing and analyzing network traffic on demand, it reduces the resource investment in full traffic mirroring in traditional methods, while improving the ability to capture short-term problems and the efficiency of analysis, that is, the real-time and accuracy of troubleshooting, providing a more efficient solution for network management and maintenance.

[0096] The present application embodiment also provides a network problem location device 300, such as Figure 3 As shown, a schematic diagram of the structure of a network problem location device in an embodiment of the present application is provided, wherein the network problem location device 300 includes: a monitoring unit 310, a link analysis unit 320 and a capture unit 330, wherein:

[0097] The monitoring unit 310 is used to monitor the network status and generate network alarm information when the network status is abnormal;

[0098] A link analysis unit 320, configured to perform network link analysis according to the network alarm information and the network device information, and obtain a network device set corresponding to the network alarm information;

[0099] The capture unit 330 is used to capture the flow data of all network devices in the network device set during the network alarm period, so as to upload the captured flow data of all network devices in the network device set to the server for problem analysis and location.

[0100] In some embodiments of the present application, the monitoring unit 310 is specifically used to: determine the corresponding network monitoring method according to the type of network equipment; obtain network monitoring data according to the network monitoring method corresponding to the type of network equipment; and generate network alarm information when an abnormal network status is monitored according to the network monitoring data.

[0101] In some embodiments of the present application, the types of network devices are divided into critical network devices and non-critical network devices, and the monitoring unit 310 is specifically used for: obtaining network monitoring data according to the network monitoring method corresponding to the type of the network device includes: for the critical network devices and the non-critical network devices, using the SNMP protocol to receive or actively obtain the first network monitoring data of the critical network devices and the non-critical network devices; for the critical network devices, using traffic mirroring technology to obtain the second network monitoring data of the critical network devices.

[0102] In some embodiments of the present application, the monitoring unit 310 is specifically used to: generate network alarm information of the critical network device when an abnormal network status is monitored according to the network monitoring data of the critical network device; generate network alarm information of the non-critical network device when an abnormal network status is monitored according to the network monitoring data of the non-critical network device; generate a global view of the network alarm information based on the network alarm information of the critical network device and the non-critical network device.

[0103] In some embodiments of the present application, the network alarm information is access abnormality alarm information from the source IP address to the destination IP address, and the link analysis unit 320 is specifically used to: obtain table entry information of the network device from the system database; perform network link analysis based on the table entry information of the network device using a preset link analysis strategy to obtain a set of network devices between the source IP address and the destination IP address.

[0104] In some embodiments of the present application, the table item information of the network device stored in the system database is obtained by: obtaining basic information of the network device from the system database, the basic information of the network device is obtained by synchronizing the system database from the configuration management database; according to the basic information of the network device, the table item information of the network device is obtained by using a scheduled task and stored in the system database

[0105] In some embodiments of the present application, the capture unit 330 is specifically used to: after obtaining the network device set corresponding to the network alarm information, start capturing the flow data of all network devices in the network device set; determine whether the capture termination condition is triggered; and when the capture termination condition is triggered, stop capturing the flow data of all network devices in the network device set.

[0106] It can be understood that the above-mentioned network problem locating device can implement each step of the network problem locating method provided in the above-mentioned embodiment, and the relevant explanations about the network problem locating method are applicable to the network problem locating device, which will not be repeated here.

[0107] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 4 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0108] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0109] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0110] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a network problem location device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

[0111] Monitor network status and generate network alarm information if abnormal network status is detected;

[0112] Performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information;

[0113] During the network alarm period, the flow data of all network devices in the network device set is captured, and the captured flow data of all network devices in the network device set is uploaded to the server for problem location and analysis.

[0114] The above application Figure 1The method performed by the network problem location device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in software form. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0115] The present application also provides a computer program product, including a computer program or an instruction, which is implemented when the computer program or the instruction is executed by a processor. Figure 1 The network problem location method in the illustrated embodiment is specifically used to perform:

[0116] Monitor network status and generate network alarm information if abnormal network status is detected;

[0117] Performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information;

[0118] During the network alarm period, the flow data of all network devices in the network device set is captured, and the captured flow data of all network devices in the network device set is uploaded to the server for problem location and analysis.

[0119] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0120] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0123] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0124] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0125] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0126] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0127] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0128] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A network problem location method, characterized in that: The network problem locating method comprises: Monitor network status and generate network alarm information if abnormal network status is detected; Performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information; During the network alarm period, the flow data of all network devices in the network device set is captured, and the captured flow data of all network devices in the network device set is uploaded to the server for problem location and analysis.

2. The network problem location method according to claim 1, characterized in that: The monitoring of the network status and generating network alarm information when an abnormal network status is detected includes: Determine the corresponding network monitoring method according to the type of network equipment; Acquiring network monitoring data according to a network monitoring method corresponding to the type of the network device; When an abnormal network state is detected according to the network monitoring data, network alarm information is generated.

3. The network problem location method according to claim 2, characterized in that: The types of network devices are divided into key network devices and non-key network devices, and the network monitoring data is obtained according to the network monitoring method corresponding to the type of network device, including: For the critical network device and the non-critical network device, using the SNMP protocol to receive or actively obtain first network monitoring data of the critical network device and the non-critical network device; For the key network device, the second network monitoring data of the key network device is obtained by using traffic mirroring technology.

4. The network problem location method according to claim 3, characterized in that: The generating of network alarm information when an abnormal network state is detected according to the network monitoring data includes: When an abnormal network state is detected according to the network monitoring data of the key network device, generating network alarm information of the key network device; When an abnormal network state is detected according to the network monitoring data of the non-critical network device, generating network alarm information of the non-critical network device; A global view of the network alarm information is generated according to the network alarm information of the critical network device and the non-critical network device.

5. The network problem location method according to claim 1, characterized in that: The network alarm information is access abnormality alarm information from the source IP address to the destination IP address. The network link analysis is performed according to the network alarm information and the network device information to obtain the network device set corresponding to the network alarm information, including: Obtain table entry information of network devices from the system database; According to the table entry information of the network device, a network link analysis is performed using a preset link analysis strategy to obtain a set of network devices between the source IP address and the destination IP address.

6. The network problem location method according to claim 5, characterized in that: The table entry information of the network device stored in the system database is obtained in the following manner: Acquire basic information of network devices from a system database, where the basic information of network devices is synchronized from a configuration management database by the system database; According to the basic information of the network device, the table item information of the network device is obtained by using a scheduled task and stored in a system database.

7. The network problem location method according to claim 1, characterized in that: The capturing of the flow data of all network devices in the network device set during the network alarm period includes: After obtaining the network device set corresponding to the network alarm information, start capturing the flow data of all network devices in the network device set; Determine whether the capture termination condition is triggered; When the capture termination condition is triggered, the capture of the flow data of all network devices in the network device set is stopped.

8. A network problem location device, characterized in that: The network problem locating device comprises: A monitoring unit, used to monitor the network status and generate network alarm information when an abnormal network status is detected; A link analysis unit, configured to perform network link analysis based on the network alarm information and the network device information, and obtain a network device set corresponding to the network alarm information; The capture unit is used to capture the flow data of all network devices in the network device set during the network alarm period, so as to upload the captured flow data of all network devices in the network device set to the server for problem analysis and location.

9. An electronic device, comprising: processor; and a memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor executes the network problem locating method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program or an instruction, wherein the computer program or the instruction, when executed by a processor, implements the network problem locating method according to any one of claims 1 to 7.

Images