Network problem positioning method and apparatus, electronic device, and computer program product

Abstract

The application discloses a network problem positioning method and device, electronic equipment and computer program product. The network problem positioning method comprises the following steps: monitoring a network state and generating network alarm information when monitoring a network exception; performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information; and capturing traffic data of all network devices in the network device set during the network alarm to perform problem positioning analysis according to the captured traffic data. The application forms a whole-process closed loop from alarm to capture and analysis through integrated monitoring, path analysis and packet capture processes. Seamless linkage between the three process nodes enables complete automation of the fault detection, analysis and processing process. In addition, the application reduces resource investment and improves the real-time performance and accuracy of fault troubleshooting by capturing and analyzing network traffic on demand, thereby providing a more efficient solution for network management and maintenance.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network problem positioning, and in particular to a network problem positioning method and device, electronic equipment and a computer program product. BACKGROUND

[0002] In the network environment of modern enterprises, with the rapid development of business and the sharp increase of network traffic, the stability of network devices and services becomes particularly important. The positioning and analysis of network link problems are the key to ensuring network stability and performance. The network architecture of an enterprise usually includes multiple key devices, such as firewalls, load balancing devices, routers and switches, etc., which collectively support daily business operations and data transmission. Any failure or performance problem in the network can have a serious impact on the operation of the enterprise, especially when facing high-traffic environments and complex network topologies, the detection and analysis of network failures become increasingly difficult.

[0003] Currently, when analyzing network failures, due to the limitation of deployment cost, it is not realistic to deploy data capture devices on every device, so it is usually deployed only on key network nodes, using network monitoring and packet capture technology, by mirroring the traffic of key network devices, interfaces and lines to the traffic analysis device, obtaining full-quantity packets for analysis.

[0004] However, this approach at least has the following technical problems:

[0005] 1) Large device resource investment: full-quantity packet mirroring consumes a large amount of device resources, such as TAP switch, hardware performance of traffic analysis platform, especially when network traffic is high, this method is almost infeasible.

[0006] 2) Poor real-time performance: traditional technology is difficult to capture data immediately when the problem occurs, which may cause the problem to have recovered after the alarm notification, affecting the timeliness of troubleshooting, and even further troubleshooting is not possible.

[0007] 3) Low analysis efficiency: full-quantity packet screening and analysis requires a lot of time and effort, especially in a wide range of time packets. SUMMARY

[0008] The embodiments of the present application provide a network problem positioning method, device, electronic equipment and computer program product to reduce the resource investment of network problem positioning and improve the efficiency and accuracy of problem positioning.

[0009] The embodiments of the present application adopt the following technical solutions:

[0010] In a first aspect, the embodiments of the present application provide a network problem positioning method, which comprises:

[0011] monitoring network status and generating network alarm information in case of monitoring network status exception;

[0012] performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information;

[0013] capturing traffic data of all network devices in the network device set during network alarm to upload the captured traffic data of all network devices in the network device set to a server for problem positioning and analysis.

[0014] Optionally, the monitoring network status and generating network alarm information in case of monitoring network status exception comprises:

[0015] determining a corresponding network monitoring manner according to the type of network device;

[0016] obtaining network monitoring data according to the network monitoring manner corresponding to the type of network device;

[0017] generating network alarm information in case of monitoring network status exception according to the network monitoring data.

[0018] Optionally, the type of network device is divided into key network device and non-key network device, and the obtaining network monitoring data according to the network monitoring manner corresponding to the type of network device comprises:

[0019] for the key network device and the non-key network device, receiving or actively obtaining first network monitoring data of the key network device and the non-key network device by using SNMP protocol;

[0020] for the key network device, obtaining second network monitoring data of the key network device by using traffic mirroring technology.

[0021] Optionally, the generating network alarm information in case of monitoring network status exception according to the network monitoring data comprises:

[0022] generating network alarm information of the key network device in case of monitoring network status exception according to the network monitoring data of the key network device;

[0023] generating network alarm information of the non-key network device in case of monitoring network status exception according to the network monitoring data of the non-key network device;

[0024] generating a global view of network alarm information according to the network alarm information of the key network device and the non-key network device.

[0025] Optionally, the network alarm information is access abnormality alarm information of a source IP address to a destination IP address, and the network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information comprises:

[0026] obtaining table information of the network device from a system database;

[0027] performing network link analysis according to the table information of the network device by using a preset link analysis strategy to obtain a network device set between the source IP address and the destination IP address.

[0028] Optionally, the table information of the network device stored in the system database is obtained by the following method:

[0029] obtaining basic information of the network device from a system database, wherein the basic information of the network device is obtained from a configuration management database by the system database;

[0030] obtaining table information of the network device by using a timing task according to the basic information of the network device and storing the table information into the system database.

[0031] Optionally, the capturing of the traffic data of all the network devices in the network device set during the network alarm comprises:

[0032] capturing the traffic data of all the network devices in the network device set after obtaining the network device set corresponding to the network alarm information;

[0033] determining whether a capturing termination condition is triggered;

[0034] stopping the capturing of the traffic data of all the network devices in the network device set in the case that the capturing termination condition is triggered.

[0035] In a second aspect, the embodiments of the present application further provide a network problem positioning apparatus, which comprises:

[0036] a monitoring unit configured to monitor a network state and generate network alarm information in the case that an abnormal network state is monitored;

[0037] a link analysis unit configured to perform network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information;

[0038] The capturing unit is configured to capture traffic data of all network devices in the network device set during network alarm, and upload the captured traffic data of all network devices in the network device set to a server for problem analysis and positioning.

[0039] In a third aspect, the embodiments of the present application further provide an electronic device, comprising:

[0040] a processor; and a memory arranged to store computer executable instructions that, when executed, cause the processor to perform any of the network problem positioning methods described above.

[0041] In a fourth aspect, the embodiments of the present application further provide a computer program product comprising computer programs or instructions, which, when executed by a processor, implement any of the network problem positioning methods described above.

[0042] The above at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects: the network problem positioning method of the embodiments of the present application first monitors network status and generates network alarm information in the case of monitoring network status exception; then performs network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information; finally, captures traffic data of all network devices in the network device set during network alarm, and uploads the captured traffic data of all network devices in the network device set to a server for problem positioning and analysis. The network problem positioning method of the embodiments of the present application forms a full-process closed loop from alarm to capture and analysis by integrating monitoring, path analysis and packet capture processes, and through seamless linkage between the three process nodes, makes the fault detection, analysis and processing process completely automated, and through on-demand capture and analysis of network traffic, reduces the resource investment of full-amount traffic mirroring in the traditional method, and at the same time improves the capture ability and analysis efficiency of short-time problems, that is, improves the real-time performance and accuracy of fault troubleshooting, and provides a more efficient solution for network management and maintenance. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0044] Figure 1 a flowchart of a network problem positioning method in the embodiments of the present application;

[0045] Figure 2 a flowchart of a network problem positioning method in the embodiments of the present application;

[0046] Figure 3 This is a schematic diagram of the structure of a network problem localization device according to an embodiment of this application;

[0047] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0050] This application provides a method for locating network problems, such as... Figure 1 The diagram illustrates a flowchart of a network problem localization method according to an embodiment of this application. The network problem localization method includes at least the following steps S110 to S130:

[0051] Step S110: Monitor the network status and generate network alarm information if abnormal network status is detected.

[0052] Combination Figure 2 This application provides a schematic diagram of a network problem localization process according to an embodiment. When localizing network problems, it is necessary to first monitor the network status in real time. This can be achieved through various monitoring tools or systems deployed in the network, such as network traffic monitors, performance monitors, and log collectors. These monitoring tools can collect network status information in real time or periodically, including key indicators such as traffic, latency, packet loss rate, and error rate. When these indicators exceed preset thresholds or trigger specific rules, the network status is considered abnormal, thereby automatically generating network alarm information. Network alarm information may include, for example, alarm type, alarm level, alarm time, and affected devices. Of course, those skilled in the art can flexibly configure the specific network status monitoring according to actual needs, and no specific limitations are made here.

[0053] The above alarm mechanism not only ensures the timeliness of real-time monitoring, but also provides triggering conditions for subsequent path analysis and traffic packet capture.

[0054] Step S120: Perform network link analysis based on the network alarm information and network device information to obtain the set of network devices corresponding to the network alarm information.

[0055] After monitoring the network abnormal state, further combined with network alarm information and full information of network equipment, path analysis is needed, that is, all network equipment involved in the abnormal network link is analyzed to determine the device set that may be affected by network alarm.

[0056] Step S130, capturing traffic data of all network equipment in the network equipment set during network alarm to upload the captured traffic data of all network equipment in the network equipment set to the server for problem positioning and analysis.

[0057] After analyzing all network equipment associated with the alarm information, the traffic data packet capturing mechanism is started, and the traffic data packets of all network equipment associated with the alarm information are captured continuously during the entire alarm period, realizing on-demand capturing, which greatly reduces the required resource investment compared with the traditional full-amount traffic mirroring method. Finally, the captured traffic data packets are uploaded to the server in real time for subsequent data analysis and problem positioning.

[0058] Specifically, the network equipment associated with the alarm content can be captured according to the filtering conditions according to the alarm content, thereby improving the efficiency of data capture. For example, if the alarm content contains source and destination IP link access, the source and destination IP can be filtered, and if the IP conversion such as NAT is contained in the middle, the converted IP can be used as the filtering condition for data capture.

[0059] The network problem positioning method of the embodiments of the present application integrates monitoring, path analysis and data packet capturing processes to form a complete process closed loop from alarm to capture and analysis. Through seamless linkage between the three process nodes, the fault detection, analysis and processing process is completely automated, and through on-demand capturing and analysis of network traffic, the resource investment of full-amount traffic mirroring in the traditional method is reduced, and the short-time problem capturing ability and analysis efficiency are improved, that is, the real-time and accuracy of fault troubleshooting are improved, providing a more efficient solution for network management and maintenance.

[0060] In some embodiments of the present application, the monitoring network state and generating network alarm information in the case of monitoring network state abnormality comprises: determining the corresponding network monitoring mode according to the type of network equipment; obtaining network monitoring data according to the network monitoring mode corresponding to the type of network equipment; generating network alarm information in the case of monitoring network state abnormality according to the network monitoring data.

[0061] When monitoring the network status, different types of devices can have different monitoring requirements, and the most suitable monitoring method can be selected according to the type of network device. The network device type can be divided into, for example, critical network devices and non-critical network devices. The critical network devices include, for example, Internet exit routers, core switches, border firewalls, etc. The non-critical network devices include, for example, access switches, management switches, etc. Of course, specific network devices that are classified as critical network devices or non-critical network devices can be flexibly set by a person skilled in the art according to actual needs, and are not specifically limited here.

[0062] By selecting a monitoring method according to the device type, the pertinence and effectiveness of monitoring can be ensured, and unnecessary resource waste can be avoided. At the same time, this also provides a more accurate basis for subsequent alarm generation.

[0063] After determining the monitoring method, the monitoring data of the network device can be obtained using the corresponding monitoring method. These data can come from the local management interface of the device (such as SNMP, CLI, etc.), or from the network management system (NMS) or cloud monitoring service, depending on the type of network device being monitored. By collecting these data in real time and storing them in a database for processing, network alarm information can be quickly generated in the event of an abnormal network status.

[0064] By refining the steps of monitoring the network status and selecting a suitable monitoring method and obtaining monitoring data according to the type of network device, the embodiments of the present application can more accurately monitor the network status and generate alarm information. This not only improves the pertinence and effectiveness of monitoring, but also provides a more reliable data basis and basis for subsequent problem positioning and solving, which is of great significance for ensuring the stable operation of the network and responding to network faults in a timely manner.

[0065] In some embodiments of the present application, the type of network device is divided into critical network devices and non-critical network devices, and the network monitoring data is obtained according to the corresponding network monitoring method of the type of network device, which includes: for the critical network devices and the non-critical network devices, using the SNMP protocol to receive or actively obtain the first network monitoring data of the critical network devices and the non-critical network devices; for the critical network devices, using the traffic mirroring technology to obtain the second network monitoring data of the critical network devices.

[0066] The existing scheme usually only deploys data capture devices on critical network nodes to capture full data packets of critical network nodes for analysis through traffic mirroring technology. However, since the time and node of the fault occurrence cannot be predicted, such incomplete deployment can result in incomplete capture of data packets in the network when the fault occurs, thereby making it difficult to reproduce and analyze part of the problem, the problem cannot be effectively solved, and potential risks of running in the live network are left.

[0067] Based on this, the embodiments of the present application cover not only key network devices but also non-key network devices for network state monitoring, and can perform 7*24-hour packet capture for key network devices, and enhance real-time data capture for non-key devices, thereby improving the accuracy and efficiency of problem positioning through comprehensive device monitoring data.

[0068] With reference to the foregoing Figure 2 In the whole process, the monitoring process node undertakes the key front-end alarm task. On the one hand, the monitoring of key network devices and non-key network devices can be based on the SNMP (Simple Network Management Protocol) protocol to receive abnormal event reports or actively acquire abnormal event information. For abnormal event reporting, SNMP trap can be used, which allows network devices to actively report abnormal event information to the network management system. Through the combination of receiving reports and active acquisition, the situation that abnormal event information is not acquired in time due to the failure of a single monitoring method is avoided, and the comprehensiveness and timeliness of network device monitoring are fully guaranteed.

[0069] On the other hand, for key network devices, in order to ensure that the data packets in the network can be captured completely when the key network devices are abnormal, additional full-flow mirroring processing can be performed on the key network devices, such as using SPAN (Switch Port Analyzer) or ERSPAN (Encapsulated Remote SPAN) flow mirroring technology to monitor the real-time flow and state of the key network devices and interfaces. These technologies allow network administrators to copy and monitor network traffic without interrupting normal network traffic. The data obtained by monitoring is sent to NPM (Network Performance Monitoring) tools and Splunk security analysis platforms, etc. These tools detect network abnormalities through preset flow, state, etc. thresholds, and when an abnormal situation is detected, such as network performance degradation, flow anomaly, etc., an alarm is generated immediately.

[0070] The embodiments of the present application can take appropriate monitoring methods by distinguishing key network devices from non-key network devices, ensure that network abnormalities can be discovered and processed in time, reduce unnecessary monitoring resource overhead, and through comprehensive monitoring of key network devices and non-key network devices, help to improve the accuracy and efficiency of problem positioning.

[0071] In some embodiments of the present application, the generating the network alarm information in the case of monitoring network state abnormalities according to the network monitoring data comprises: generating network alarm information of the key network device in the case of monitoring network state abnormalities according to the network monitoring data of the key network device; generating network alarm information of the non-key network device in the case of monitoring network state abnormalities according to the network monitoring data of the non-key network device; and generating a global view of the network alarm information according to the network alarm information of the key network device and the non-key network device.

[0072] For the key network device, after monitoring abnormal information based on the SNMP protocol or the full-flow mirroring technology, an alarm is immediately generated, and the alarm information is aggregated to the monitoring process node through the API or other protocols. For the non-key network device, the monitoring process node receives abnormal event reports or actively acquires abnormal events through the SNMP protocol. These events also trigger alarms. The monitoring process node uniformly processes and analyzes all the alarm information of the devices received or acquired, and forms a global view of the network alarm information. The global view can display the alarm information of each network device, so that the network administrator can more intuitively understand the overall state of the network.

[0073] The embodiments of the present application can more comprehensively discover faults in the network by comprehensively monitoring the network monitoring data of the key network device and the non-key network device, and reduce the omission of faults due to incomplete monitoring. In addition, the global view provides an overall overview of the network alarm information, which helps the network administrator quickly locate the fault point and reduce the troubleshooting time.

[0074] In some embodiments of the present application, the network alarm information is access abnormality alarm information of a source IP address to a destination IP address, and the network link analysis according to the network alarm information and the network device information to obtain a network device set corresponding to the network alarm information comprises: obtaining table item information of the network device from a system database; and performing network link analysis according to the table item information of the network device by using a preset link analysis strategy to obtain a network device set between the source IP address and the destination IP address.

[0075] When access abnormalities occur in the network, access abnormality alarm information of a source IP address to a destination IP address is generated. These alarm information contains the source address and the destination address that trigger the alarm, as well as the type and occurrence time of the alarm and other key information.

[0076] Based on the above alarm information, the network device table item information can be further obtained from the database, which includes, for example, the network device routing table, ARP table, interface table and other key data. These data are crucial for subsequent network link analysis, because they provide information such as connection relationship between network devices and forwarding rules.

[0077] When the alarm is generated, the path analysis node is immediately started to begin network link analysis, which can include the following processes, for example:

[0078] 1) Determine the device connected to the service system, such as a Leaf switch, through the ARP table item.

[0079] 2) Based on the destination address in the alarm, match the next hop IP from the routing table. Locate the next device through the interface IP.

[0080] 3) If there is a NAT device in the path, IP address conversion will be performed according to the NAT table item, and recursive query will be continued. This step ensures that even in the presence of network address translation, the complete network path diagram can be accurately drawn.

[0081] 4) Through recursive query, the network path between the source device and the target device involved in the alarm is gradually confirmed, until the complete path diagram is drawn.

[0082] Through the above path analysis process, all network devices passed between the source IP and the destination IP can be obtained to form a network device set, which serves as the basis for the next step of automatic packet capture.

[0083] The embodiments of the present application can quickly locate the network devices passed between the source IP and the destination IP through path analysis, thereby quickly locking the possible location of the network fault, greatly shortening the positioning time of the network fault and improving the efficiency of network fault processing. By comprehensively utilizing the table item information (such as routing table, ARP table, interface table, etc.) of the network device for network link analysis, the network path diagram can be more accurately drawn, the accuracy of network monitoring is improved, and potential network problems can be discovered and solved in time.

[0084] In some embodiments of the present application, the table item information of the network device stored in the system database is obtained in the following way: the basic information of the network device is obtained from the system database, which is synchronized from the configuration management database; and the table item information of the network device is obtained by using a timing task according to the basic information of the network device and stored in the system database.

[0085] The table item information of the network device is the key information for implementing the network link analysis in the above-mentioned embodiments. When obtaining the table item information of the network device from the system database, it is necessary to determine which network devices are to be obtained and monitored, that is, it is necessary to obtain the basic information of the network device to be monitored. The system database stores the basic information of the network device, which can include, for example, the ID of the network device, the management IP address of the network device (used for interaction with the device), the person in charge, and related system information. These information can be synchronized from the configuration management database (CMDB) to the system database regularly. The configuration management database is a database specially used for storing and managing the information of IT assets such as network devices, servers, and applications. By synchronizing the basic information of the network device to the system database, the system can achieve comprehensive management and monitoring of the IT asset information, and provide strong support for network problem positioning, fault troubleshooting, and performance optimization.

[0086] After obtaining the basic information of the network device, the table item information of the network device can be obtained automatically at a predetermined time interval based on the basic information of the network device through a set timing task, and the obtained table item information of the network device is stored in the system database. During the synchronization process, the data integrity, accuracy, and consistency need to be ensured to avoid data loss or duplication.

[0087] In some embodiments of the present application, the capturing the traffic data of all network devices in the network device set during the network alarm includes: after obtaining the network device set corresponding to the network alarm information, starting to capture the traffic data of all network devices in the network device set; determining whether a capture termination condition is triggered; and in the case that the capture termination condition is triggered, stopping capturing the traffic data of all network devices in the network device set.

[0088] With reference to Figure 2 , the packet capture is the third link of the whole process, which is automatically started after the path analysis of the above-mentioned embodiments is completed. The network traffic packets of the specified device and interface are captured through the commands of the device or the pre-installed agent. Unlike the traditional full-amount traffic mirroring, the embodiments of the present application capture data only during the alarm through the on-demand capturing manner, which reduces the waste of network bandwidth and storage resources. During the capturing process, the data packets are uploaded to the storage server in real time, and the engineers can quickly find the corresponding data packet file and analyze it through the alarm number. When the alarm is over, the capturing is automatically stopped, thereby improving the operation efficiency and avoiding excessive data storage requirements.

[0089] It should be noted that the "network alarm period" defined in the embodiments of the present application is not simply a period from the start of the alarm to the end of the alarm, but essentially a period from the start of the alarm to the triggering of the capture termination condition. The capture termination condition can include a capture termination condition set for whether the alarm is over, and can also include a capture termination condition set for whether the size of the captured data flow reaches a preset flow threshold. Because in some specific scenarios, there may be a situation of particularly large flow, if the capture of data flow is simply controlled by whether the alarm is over, the amount of captured data may be overloaded, therefore a threshold limit for flow data capture can be set, that is, the capture of data flow is also stopped after a certain threshold size of flow data is captured.

[0090] In summary, the key points and technical effects of the network problem positioning method of the present application are as follows:

[0091] 1) Full-process closed-loop design: by effectively integrating real-time monitoring, network path analysis and data capture together, a closed-loop mechanism is formed.

[0092] 2) Alarm triggering: the monitoring process node automatically generates an alarm according to flow and state abnormalities, and triggers path analysis.

[0093] 3) Path analysis: the path analysis node locates the devices and network paths involved in the alarm, and feeds back the path information to the data packet capture node.

[0094] 4) Data packet capture: the data packet capture node performs on-demand flow capture during the alarm duration according to the results of path analysis, and automatically stops capture after the alarm is over.

[0095] Through the above linkage design scheme, the present application makes the fault detection, analysis and processing process completely automated, and reduces the resource investment of full-amount flow mirroring in the traditional method by capturing and analyzing network flow on demand, while improving the capture ability and analysis efficiency of short-time problems, that is, the real-time and accuracy of fault troubleshooting, thereby providing a more efficient solution for network management and maintenance.

[0096] The embodiments of the present application also provide a network problem positioning device 300, as shown in Figure 3 Fig. 1 shows a structural schematic diagram of a network problem positioning device in the embodiments of the present application, and the network problem positioning device 300 comprises a monitoring unit 310, a link analysis unit 320 and a capture unit 330, wherein:

[0097] The monitoring unit 310 is configured to monitor the network state and generate network alarm information in the case of monitoring network state abnormalities;

[0098] The link analysis unit 320 is configured to perform network link analysis according to the network alarm information and the network device information, to obtain a network device set corresponding to the network alarm information.

[0099] The capturing unit 330 is configured to capture traffic data of all network devices in the network device set during a network alarm, to upload the captured traffic data of all network devices in the network device set to a server for problem analysis and positioning.

[0100] In some embodiments of the present application, the monitoring unit 310 is specifically configured to: determine a corresponding network monitoring manner according to a type of the network device; acquire network monitoring data according to the network monitoring manner corresponding to the type of the network device; and generate network alarm information in a case where network state abnormality is monitored according to the network monitoring data.

[0101] In some embodiments of the present application, the type of the network device is divided into a key network device and a non-key network device, and the monitoring unit 310 is specifically configured to: acquire, for the key network device and the non-key network device, first network monitoring data of the key network device and the non-key network device by using an SNMP protocol to receive or actively acquire the first network monitoring data; and acquire, for the key network device, second network monitoring data of the key network device by using a traffic mirroring technology.

[0102] In some embodiments of the present application, the monitoring unit 310 is specifically configured to: generate network alarm information of the key network device in a case where network state abnormality is monitored according to the network monitoring data of the key network device; generate network alarm information of the non-key network device in a case where network state abnormality is monitored according to the network monitoring data of the non-key network device; and generate a global view of network alarm information according to the network alarm information of the key network device and the network alarm information of the non-key network device.

[0103] In some embodiments of the present application, the network alarm information is access abnormality alarm information of a source IP address to a destination IP address, and the link analysis unit 320 is specifically configured to: acquire table item information of a network device from a system database; and perform network link analysis according to the table item information of the network device by using a preset link analysis strategy, to obtain a network device set between the source IP address and the destination IP address.

[0104] In some embodiments of the present application, the entry information of the network device stored in the system database is obtained by: obtaining the basic information of the network device from the system database, the basic information of the network device being obtained by the system database from the configuration management database; and obtaining the entry information of the network device by using a timing task according to the basic information of the network device and storing the entry information of the network device into the system database

[0105] In some embodiments of the present application, the capturing unit 330 is specifically configured to: after obtaining the set of network devices corresponding to the network alarm information, start capturing the traffic data of all the network devices in the set of network devices; determine whether a capturing termination condition is triggered; and in the case that the capturing termination condition is triggered, stop capturing the traffic data of all the network devices in the set of network devices.

[0106] It can be understood that the network problem positioning apparatus can realize each step of the network problem positioning method provided in the foregoing embodiments, and the related explanations about the network problem positioning method are all applicable to the network problem positioning apparatus, which will not be described herein again.

[0107] Figure 4 is a structural schematic diagram of an electronic device according to an embodiment of the present application. Please refer to Figure 4 At the hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The memory can include a memory such as a random-access memory (RAM), and can further include a non-volatile memory such as at least one disk memory. Of course, the electronic device can further include other hardware required by a business.

[0108] The processor, the network interface, and the memory can be connected to each other through the internal bus. The internal bus can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, and a control bus, etc. For the convenience of representation, Figure 4 In the figure, only one bidirectional arrow is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0109] The memory is configured to store a program. Specifically, the program can include program code including computer operation instructions. The memory can include an internal memory and a non-volatile memory, and provide instructions and data to the processor.

[0110] The processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs, and forms the network problem positioning device at a logical level. The processor executes the program stored in the memory, and is specifically configured to perform the following operations:

[0111] monitoring a network state and generating network alarm information in a case that an abnormal network state is monitored;

[0112] performing network link analysis according to the network alarm information and network device information, to obtain a network device set corresponding to the network alarm information;

[0113] capturing traffic data of all network devices in the network device set during network alarm, to upload the captured traffic data of all network devices in the network device set to a server for problem positioning and analysis.

[0114] The above as described in the present application Figure 1The method performed by the network problem positioning apparatus disclosed in the embodiment can be applied in a processor or implemented by the processor. The processor can be an integrated circuit chip with processing capability. In the implementation, the steps of the method can be completed by integrated logic circuits or instructions in the form of software in the processor. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. It can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method.

[0115] The embodiments of the present application also propose a computer program product, including a computer program or instructions, which are executed by a processor to implement Figure 1 the network problem positioning method in the embodiments, and are specifically used for executing

[0116] monitoring a network state and generating network alarm information in the case of monitoring network state abnormity;

[0117] performing network link analysis according to the network alarm information and network device information to obtain a network device set corresponding to the network alarm information;

[0118] capturing traffic data of all network devices in the network device set during network alarm to upload the captured traffic data of all network devices in the network device set to a server for problem positioning and analysis.

[0119] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0120] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0121] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 Figure 1

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 ​

[0123] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0124] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory. The memory can also include non-volatile memory, such as read-only memory (ROM), electrically programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), flash memory, or a combination of non-volatile memories in different forms. The memory is an example of computer readable storage media. ​​​​​​

[0125] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0126] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but also other elements not explicitly listed, or other elements inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0127] Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0128] The above only describes the embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the scope of the claims of the present application.

Claims

1. A network problem localization method, characterized in that, The network problem positioning method comprises: monitoring network status and generating network alarm information in the case of monitoring network status exception; network link analysis according to the network alarm information and network device information, obtaining a network device set corresponding to the network alarm information; capturing traffic data of all network devices in the network device set during network alarm to upload the captured traffic data of all network devices in the network device set to a server for problem positioning and analysis; the monitoring network status and generating network alarm information in the case of monitoring network status exception comprises: determining the corresponding network monitoring mode according to the type of network device; obtaining network monitoring data according to the network monitoring mode corresponding to the type of network device; generating network alarm information in the case of monitoring network status exception according to the network monitoring data; the type of network device is divided into key network device and non-key network device, and the obtaining network monitoring data according to the network monitoring mode corresponding to the type of network device comprises: for the key network device and the non-key network device, receiving or actively obtaining the first network monitoring data of the key network device and the non-key network device by using SNMP protocol; for the key network device, obtaining the second network monitoring data of the key network device by using traffic mirroring technology.

2. The network problem locating method of claim 1, wherein, the generating network alarm information in the case of monitoring network status exception according to the network monitoring data comprises: in the case of monitoring network status exception according to the network monitoring data of the key network device, generating network alarm information of the key network device; in the case of monitoring network status exception according to the network monitoring data of the non-key network device, generating network alarm information of the non-key network device; generating a global view of network alarm information according to the network alarm information of the key network device and the non-key network device.

3. The method of claim 1, wherein, The network alarm information is source IP address to destination IP address access exception alarm information, and the network link analysis according to the network alarm information and network device information, obtaining a network device set corresponding to the network alarm information comprises: obtaining network device table item information from a system database; network link analysis according to the network device table item information by using a preset link analysis strategy, obtaining a network device set between the source IP address and the destination IP address.

4. The network problem locating method according to claim 3, wherein, The network device table item information stored in the system database is obtained by the following way: obtaining network device basic information from a system database, the network device basic information being obtained from a configuration management database by the system database; obtaining network device table item information by using a timing task according to the network device basic information and storing the network device table item information into the system database.

5. The method of claim 1, wherein, the capturing traffic data of all network devices in the network device set during network alarm comprises: after obtaining the network device set corresponding to the network alarm information, capturing traffic data of all network devices in the network device set; determining whether to trigger a capture termination condition; stopping capturing traffic data of all network devices in the set of network devices in a case where the capture termination condition is triggered.

6. A network problem localization apparatus, characterized by The network problem positioning apparatus comprises: a monitoring unit configured to monitor network status and generate network alarm information in a case where an abnormal network status is monitored; a link analysis unit configured to perform network link analysis according to the network alarm information and network device information to obtain a set of network devices corresponding to the network alarm information; a capturing unit configured to capture traffic data of all network devices in the set of network devices during network alarm and upload the captured traffic data of all network devices in the set of network devices to a server for problem analysis and positioning; the monitoring unit is specifically configured to: determine a corresponding network monitoring manner according to a type of network device; obtain network monitoring data according to the network monitoring manner corresponding to the type of network device; generate network alarm information in a case where an abnormal network status is monitored according to the network monitoring data; the type of network device is divided into a key network device and a non-key network device, and the monitoring unit is specifically configured to: receive or actively obtain first network monitoring data of the key network device and the non-key network device by using an SNMP protocol for the key network device and the non-key network device; obtain second network monitoring data of the key network device by using a traffic mirroring technology for the key network device.

7. An electronic device comprising: a processor; and a memory arranged to store computer executable instructions that, when executed, cause the processor to perform the network problem positioning method of any one of claims 1-5.

8. A computer program product comprising computer programs or instructions that, when executed by a processor, implement the network problem positioning method of any one of claims 1-5.

Images