Multicast message monitoring method based on domestic platform

Abstract

The invention discloses a multicast message monitoring method based on a domestic platform, and relates to the field of message monitoring methods. The method comprises the following steps: S1, creating a socket on a domestic operating system, and binding multicast and a port for receiving a multicast message from a local area network environment in which a terminal is located; s2, capturing a UDP (User Datagram Protocol) message on a multicast and a corresponding port, and analyzing header information or message content of the multicast message in a customized manner according to service requirements; and S3, counting the number of different multicast messages and analysis result information, and storing the information in a domestic database at regular time. Based on an existing domestic platform, the UDP messages on the multicast and the corresponding ports are captured after the multicast and the ports are bound, meanwhile, message data can be automatically received and stored, multicast message data content can be customized and analyzed according to specific service scenes and use requirements, and meanwhile a storage method of historical data and analysis results is provided.

Description

Technical Field

[0001] The present invention relates to the technical field of computer networks, and in particular to a multicast message monitoring method based on a domestic platform. Background Art

[0002] The development of domestic platforms, namely the current mainstream such as Kylin and Kylin operating systems. Against the background of the rapid development of existing domestic operating systems, tcpdump and wireshark are the mainstream network packet capture software.

[0003] TCPDump can completely capture the data packets transmitted in the network and provide analysis. It supports filtering for network layer, protocol, host, network or port, and provides logical statements such as and, or, not to help you remove useless information.

[0004] Wireshark is an open source network protocol analyzer for Unix and Windows. It can detect network communication data in real time or in snapshot files of captured network communication data.

[0005] Regarding the above-mentioned related technologies, it is found that the existing mainstream network message capture software has shortcomings in automatic message content parsing, customized parsing and historical message data summary display. Summary of the invention

[0006] In order to achieve the effect of automatic parsing of message content, customized parsing and summary display of historical message data, the present application provides a multicast message monitoring method based on a domestic platform.

[0007] The present invention is achieved in that:

[0008] A multicast message monitoring method based on a domestic platform includes the following steps:

[0009] S1: Create a socket on the domestic operating system, bind the multicast and port, and receive multicast messages from the local area network environment where the terminal is located;

[0010] S2: Capture UDP packets on multicast and corresponding ports, and analyze multicast packet header information or packet content according to business needs;

[0011] S3: Count the number of different multicast messages and analysis results, and store them in the domestic database regularly;

[0012] S4: According to the stored results, data points are taken from the domestic database and refreshed and displayed in real time.

[0013] Furthermore, in S1, the multicast address and the receiving port are determined in advance according to the protocol.

[0014] Furthermore, the S1 comprises the following steps:

[0015] S11: Get multicast and port information;

[0016] S12: traverse the multicast and port key-value pair list to determine whether the port has been monitored by the system. If so, go to S14;

[0017] S13: Create a socket, bind a port, and start a child thread to listen to messages on the multicast port;

[0018] S14: Get the socket bound to this port, and start a child thread to listen to the message on the multicast port;

[0019] S15: After all multicast ports start sub-thread monitoring, start the sub-thread and store the filtered message data into the domestic database at regular intervals.

[0020] Furthermore, it also includes:

[0021] S16: The main thread starts monitoring abnormal events of all child threads. When an abnormality occurs, the abnormal event is recorded in a log file, and all child threads are ejected in sequence.

[0022] Furthermore, in step S2, the business requirements and message content analysis method should be determined according to the protocol or custom requirements.

[0023] Furthermore, the S2 comprises the following steps:

[0024] S21: When the child thread captures a multicast message, it determines whether it comes from the X port of multicast A or the Y port of multicast B. If it comes from the X port of multicast A, it jumps to S22; if it comes from the Y port of multicast B, it jumps to S23;

[0025] S22: judging whether the message structure of the message complies with the protocol specification according to the specific information format, and storing the judgment result in the memory;

[0026] S23: Obtain the content field of this message, determine whether this content meets the grammatical structure of the JSON string, and store the determination result in the memory.

[0027] Furthermore, in S3, the data content stored according to different scenarios should include a timestamp field for determining the generation time of various data during the analysis of historical data.

[0028] Furthermore, the S3 comprises the following steps:

[0029] S31: Establish a timer;

[0030] S32: Create a client connection to the domestic database;

[0031] S33: When the timer of the custom duration is triggered, the multicast message analysis result in the memory is taken out, and a timestamp field is added thereto, and stored in the domestic database.

[0032] Furthermore, in S4, based on the stored results, a comparison is made to analyze whether there are any abnormalities in the LAN messages, and for multicast messages without abnormalities and in compliance with the protocol specification, only the message data in the network is valid.

[0033] Further, the S4 comprises the following steps:

[0034] S41: Establish data analysis server;

[0035] S42: Displaying the data value of the analysis result and the time stamp in the data entry of the domestic database in a two-dimensional coordinate system;

[0036] S43: Set a custom data point automatic refresh duration.

[0037] Compared with the prior art, the beneficial effects of the present invention are as follows: the present application is based on the existing domestic platform, and captures the UDP messages on the multicast and the corresponding port after binding the multicast and the port. At the same time, according to the specific business scenarios and usage requirements, the message data can be automatically received and stored, and the customized analysis and parsing of the multicast message data content can be performed. At the same time, a storage method for historical data and analysis results is provided, and the cause of the fault can be analyzed according to the historical data and results after the fault occurs. Therefore, the design principle of the present invention is reliable, the structure is simple, and it has a very broad application prospect. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 It is a flow chart of the monitoring method shown in the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention.

[0041] Reference Figure 1 As shown, a multicast message monitoring method based on a domestic platform includes the following steps:

[0042] Step 1: Create a socket in the desktop version of the domestic operating system Kylin v10 (creating a socket is a basic step in network programming, used to establish an endpoint for network communication), determine the multicast address and receiving port in advance according to the protocol, bind the multicast and port, and receive multicast messages from the local area network environment where the terminal is located. The specific steps are as follows:

[0043] First, get the multicast and port information.

[0044] Next, traverse the list of multicast and port key-value pairs to determine whether the port has been monitored by the system. If it has been monitored, obtain the socket bound to this port and start a child thread to monitor the messages on the multicast-port. If it has not been monitored by the system, you can create a socket, bind the port, and start a child thread to monitor the messages on the multicast-port. Get the socket bound to this port and start a child thread to monitor the messages on the multicast-port.

[0045] Finally, after all multicast ports start sub-thread monitoring, start the sub-thread and regularly store the filtered message data in the domestic database. In the main thread, start monitoring of abnormal events of all sub-threads. When an abnormality occurs, record the abnormal event in the log file and launch all sub-threads in sequence.

[0046] Step 2: Capture the UDP messages on the multicast and corresponding ports, and analyze the multicast message header information or message content according to customized business needs. Business needs and message content analysis methods should be determined according to the protocol or customized needs.

[0047] The specific steps are as follows:

[0048] When the child thread captures a multicast message, it determines whether it comes from port X of multicast A or port Y of multicast B.

[0049] If the message comes from the X port of multicast A, it determines whether the message structure of this message conforms to the protocol specification according to the specific information format, and stores the determination result in the memory.

[0050] If it comes from the Y port of multicast B, the content field of this message is obtained, and it is determined whether this content meets the grammatical structure of the json string, and the determination result is stored in the memory.

[0051] Step 3: Count the number of different multicast messages and the analysis result information, and store them in the domestic database regularly. The data content stored according to different scenarios should include a timestamp field to determine the generation time of various data in the process of analyzing historical data.

[0052] The specific steps are:

[0053] Create a timer to facilitate subsequent customization and timing use.

[0054] Create a client connection for the domestic database to facilitate subsequent data operations (allow the program to execute SQL statements to add, delete, query, and modify data in the database, thereby improving data processing efficiency).

[0055] When the timer with a custom duration is triggered, the multicast message analysis results in the memory are taken out, and a timestamp field is added to it and stored in the domestic database.

[0056] Step 4: According to the storage results, take out the data points from the domestic database, refresh the display in real time, and compare and analyze whether there are any abnormalities in the LAN messages. For multicast messages without abnormalities and in compliance with protocol specifications, it is only valid for the message data in the network.

[0057] The specific steps are as follows: First, establish a data analysis server to collect, process, analyze and visualize data. Secondly, display the timestamp and analysis result data value in the data entry in the domestic database in a two-dimensional coordinate system. Finally, set the custom data point automatic refresh time.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A multicast message monitoring method based on a domestic platform, characterized in that: The steps include: S1: Create a socket on the domestic operating system, bind the multicast and port, and receive multicast messages from the local area network environment where the terminal is located; S2: Capture UDP packets on multicast and corresponding ports, and analyze multicast packet header information or packet content according to business needs; S3: Count the number of different multicast messages and analysis results, and store them in the domestic database regularly; S4: According to the stored results, data points are taken from the domestic database and refreshed and displayed in real time.

2. According to claim 1, a method for monitoring multicast messages based on a domestic platform is characterized in that: In S1, the multicast address and the receiving port are determined in advance according to the protocol.

3. According to claim 2, a method for monitoring multicast messages based on a domestic platform is characterized in that: The S1 comprises the following steps: S11: Get multicast and port information; S12: traverse the multicast and port key-value pair list to determine whether the port has been monitored by the system. If so, go to S14; S13: Create a socket, bind a port, and start a child thread to listen to messages on the multicast port; S14: Get the socket bound to this port, and start a child thread to listen to the message on the multicast port; S15: After all multicast ports start sub-thread monitoring, start the sub-thread and store the filtered message data into the domestic database at regular intervals.

4. According to claim 3, a method for monitoring multicast messages based on a domestic platform is characterized in that: Also includes: S16: In the main thread, monitoring of abnormal events of all child threads is enabled. When an abnormality occurs, the abnormal event is recorded in a log file, and all child threads are ejected in sequence.

5. According to claim 1, a method for monitoring multicast messages based on a domestic platform is characterized in that: In S2, the business requirements and message content analysis methods should be determined according to the protocol or custom requirements.

6. A method for monitoring multicast messages based on a domestic platform according to claim 5, characterized in that: The S2 comprises the following steps: S21: When the child thread captures a multicast message, it determines whether it comes from the X port of multicast A or the Y port of multicast B. If it comes from the X port of multicast A, it jumps to S22; if it comes from the Y port of multicast B, it jumps to S23; S22: judging whether the message structure of the message complies with the protocol specification according to the specific information format, and storing the judgment result in the memory; S23: Obtain the content field of this message, determine whether this content meets the grammatical structure of the JSON string, and store the determination result in the memory.

7. A method for monitoring multicast messages based on a domestic platform according to claim 1, characterized in that: In S3, the data content stored according to different scenarios should include a timestamp field, which is used to determine the generation time of various data during the analysis of historical data.

8. A method for monitoring multicast messages based on a domestic platform according to claim 7, characterized in that: The S3 comprises the following steps: S31: Establish a timer; S32: Create a client connection to the domestic database; S33: When the timer of the custom duration is triggered, the multicast message analysis result in the memory is taken out, and a timestamp field is added thereto, and stored in the domestic database.

9. A method for monitoring multicast messages based on a domestic platform according to claim 1, characterized in that: In S4, based on the stored results, the LAN message is compared and analyzed to see whether there is any abnormality. For multicast messages without abnormality and in compliance with the protocol specification, only the message data in the network is valid.

10. A method for monitoring multicast messages based on a domestic platform according to claim 9, characterized in that: The S4 comprises the following steps: S41: Establish data analysis server; S42: Displaying the data value of the analysis result and the time stamp in the data entry of the domestic database in a two-dimensional coordinate system; S43: Set a custom data point automatic refresh duration.

Images