TCP retransmission positioning method based on ICMP and TCP association analysis

Abstract

The invention relates to the technical field of computer networks, in particular to a TCP retransmission positioning method based on ICMP and TCP association analysis, which comprises the following steps of: acquiring network flow data, performing multi-layer protocol analysis, and identifying ICMP protocol related information and TCP protocol related information in the network flow data; identifying ICMP error information with limited data packet fragments in the indication path in the ICMP related information, and obtaining corresponding TCP session identification information from the ICMP error information; determining a corresponding TCP session in the network flow data based on the TCP session identifier, and marking the TCP session; analyzing the marked TCP session to judge whether a TCP retransmission behavior occurs or not; performing association analysis on the ICMP error information and the TCP retransmission behavior, and judging whether a preset association condition is met or not; and when the association condition is satisfied, determining that the root cause of the TCP retransmission behavior is related to the path fragment limitation.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a TCP retransmission location method based on ICMP and TCP correlation analysis. Background Technology

[0002] Network maintenance personnel typically need to monitor network traffic to detect anomalies such as TCP retransmissions, packet loss, or delays. TCP retransmission is a crucial indicator of network transmission reliability, reflecting the sender's behavior of retransmitting data segments without receiving acknowledgment. ICMP (Internet Control Message Protocol) error messages are used to report network communication anomalies; for example, a Fragmentation Needed message indicates that data packets cannot be fragmented for transmission along the path, reflecting transmission limitations. Existing solutions usually rely on manual analysis of TCP retransmission records and ICMP messages, comparing timestamps, session information, and message characteristics to determine the cause of retransmissions and thus locate network faults. This process is labor-intensive, and in complex network environments, the protocol parsing, session identification, and event matching involved are extremely cumbersome.

[0003] Existing technologies rely on manual analysis of TCP retransmissions and ICMP error messages, resulting in low diagnostic efficiency and failing to meet the need for rapid network fault location. Summary of the Invention

[0004] To overcome the above shortcomings, this invention provides a TCP retransmission location method based on ICMP and TCP correlation analysis, aiming to improve the problem that relying on manual analysis of TCP retransmission and ICMP error messages leads to low diagnostic efficiency and fails to meet the need for rapid network fault location.

[0005] This invention provides the following technical solution: a TCP retransmission location method based on ICMP and TCP correlation analysis, comprising the following steps:

[0006] S1. Obtain network traffic data and perform protocol parsing on the network traffic data to identify ICMP protocol-related information and TCP protocol-related information;

[0007] S2. In the ICMP protocol-related information, identify ICMP error information used to indicate packet fragmentation limitations in the path, and obtain the corresponding TCP session identification information from the ICMP error information;

[0008] S3. Based on the TCP session identification information, determine the corresponding TCP session in the network traffic data and mark the TCP session;

[0009] S4. Analyze the marked TCP sessions to determine whether TCP retransmission has occurred in the TCP sessions;

[0010] S5. Perform correlation analysis between the ICMP error information and the TCP retransmission behavior in the TCP session to determine whether the two meet the preset correlation conditions.

[0011] S6. When the ICMP error information and the TCP retransmission behavior meet the association conditions, determine that the root cause of the TCP retransmission behavior is related to path fragmentation limitation.

[0012] By adopting the above technical solutions, the automated collection, parsing, and identification of ICMP and TCP packets in network traffic are achieved. This enables the rapid acquisition and classification of relevant protocol data without manual intervention, solving the problem of low diagnostic efficiency and inability to quickly locate network faults due to reliance on manual analysis of TCP retransmissions and ICMP error packets in existing technologies. Furthermore, by systematically processing network traffic data and structurally storing ICMP and TCP protocol-related information, a foundational data support is provided for subsequent session identifier extraction and TCP retransmission root cause analysis, thus automating and increasing the efficiency of the network fault diagnosis process.

[0013] Preferably, the acquisition of network traffic data includes:

[0014] Obtain network traffic data through network interfaces or mirror ports;

[0015] Retrieve network traffic data from the stored capture data file;

[0016] The acquired network traffic data is preprocessed, including recording time information and organizing the data structure;

[0017] The preprocessed network traffic data is stored in a cache or database.

[0018] Preferably, the protocol parsing includes:

[0019] Perform multi-layer protocol parsing on network traffic data, including the IP layer, ICMP protocol layer, and TCP protocol layer;

[0020] Obtain the source IP address, destination IP address, and protocol type during IP layer resolution;

[0021] Obtain the message type and code, as well as related header information, during ICMP protocol layer parsing;

[0022] In TCP protocol layer parsing, obtain source port, destination port, sequence number, acknowledgment number, and flag information.

[0023] Preferably, the ICMP error message includes:

[0024] Determine the ICMP message type and code to identify messages that indicate limited packet fragmentation in the path;

[0025] Obtain the original IP header information from the ICMP error message;

[0026] Obtain TCP / UDP header information from the payload of ICMP error messages.

[0027] Preferably, obtaining the corresponding TCP session identifier information includes:

[0028] Extract the source IP address, destination IP address, source port, and destination port from the ICMP error message;

[0029] A unique session identifier is generated based on the TCP message sequence number, acknowledgment number, and protocol type.

[0030] Preferably, the marking of the TCP session includes:

[0031] Assign a unique identifier to each identified TCP session;

[0032] The session identifier is associated with and recorded with the source IP, destination IP, source port, destination port, and protocol type of the session;

[0033] Based on predefined tagging rules, session state or specific attributes are appended to the corresponding TCP session identifier.

[0034] Preferably, the TCP retransmission behavior includes:

[0035] Detect duplicate sequence number data segments in a TCP session;

[0036] Identify received duplicate acknowledgment messages;

[0037] Determine whether the sender should resend the data segment with the same sequence number if no acknowledgment is received;

[0038] Determine whether to trigger a retransmission operation based on the TCP timer;

[0039] Detected TCP retransmission behavior is recorded as structured information.

[0040] Preferably, the association analysis includes:

[0041] Establish a matching relationship between each TCP session and its corresponding ICMP error message;

[0042] The ICMP error messages and TCP retransmission behavior were compared based on time series data.

[0043] The ICMP error messages that meet the matching criteria are associated with TCP retransmission behavior.

[0044] Preferably, the preset association conditions include:

[0045] Set a time window parameter to determine whether TCP retransmission behavior and ICMP error messages occur within the same time period;

[0046] Match ICMP error messages with TCP retransmission behavior based on TCP session identifiers;

[0047] Records that meet the time and session matching criteria are identified as associated events.

[0048] Preferably, determining that the root cause of the TCP retransmission behavior is related to path fragmentation limitations includes:

[0049] The matching relationship between TCP retransmission behavior and corresponding ICMP error messages is confirmed based on the TCP session identifier.

[0050] Determine whether the matched ICMP error message type and code indicate path fragmentation restrictions;

[0051] TCP retransmission behaviors that meet the criteria are marked as path fragmentation-restricted.

[0052] The present invention has the following beneficial effects:

[0053] 1. In this invention, by intelligently correlating ICMP error information and TCP retransmission behavior in network traffic, the root cause of TCP retransmission is automatically identified, which solves the problem of low diagnostic efficiency caused by relying on manual analysis in the prior art. This enables the TCP retransmission root cause localization process to be completed quickly and systematically, reducing the time and labor costs required for fault diagnosis and improving network operation and maintenance efficiency.

[0054] 2. In this invention, by performing multi-layer protocol parsing on network traffic and generating a unique TCP session identifier, accurate tracking and structured management of different TCP sessions in complex networks are achieved. This solves the problem of insufficient diagnostic accuracy caused by the lack of an automated correlation mechanism in the prior art, enabling retransmission events to accurately match the corresponding ICMP errors and reducing misjudgments and omissions.

[0055] 3. In this invention, by establishing matching rules for time windows and session identifiers, a systematic screening and comparison of TCP retransmission events and ICMP error information is achieved. This solves the technical deficiency of traditional methods in handling highly complex network traffic, making the correlation analysis between retransmission and fragmentation-limited events more accurate and providing a reliable basis for network fault diagnosis.

[0056] 4. In this invention, by marking the matched TCP retransmission behavior and determining whether it is related to path fragmentation limitation, the root cause can be traced, which solves the problem that the existing monitoring system only provides surface alarms and lacks in-depth information, enabling operation and maintenance personnel to clearly identify the specific cause of the retransmission event and shorten the problem location and resolution cycle. Attached Figure Description

[0057] Figure 1 This is a flowchart of the TCP retransmission location method based on ICMP and TCP correlation analysis proposed in this invention. Detailed Implementation

[0058] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example 1:

[0060] In the first embodiment of the present invention, the present invention provides a TCP retransmission location method based on ICMP and TCP correlation analysis, such as... Figure 1 As shown, it includes the following steps:

[0061] S1. Obtain network traffic data and perform protocol parsing on the network traffic data to identify ICMP protocol-related information and TCP protocol-related information;

[0062] Furthermore, obtaining network traffic data includes:

[0063] Obtain network traffic data through network interfaces or mirror ports;

[0064] Retrieve network traffic data from the stored capture data file;

[0065] The acquired network traffic data is preprocessed, including recording time information and organizing the data structure;

[0066] The preprocessed network traffic data is stored in a cache or database.

[0067] Furthermore, protocol parsing includes:

[0068] Perform multi-layer protocol parsing on network traffic data, including the IP layer, ICMP protocol layer, and TCP protocol layer;

[0069] Obtain the source IP address, destination IP address, and protocol type during IP layer resolution;

[0070] Obtain the message type and code, as well as related header information, during ICMP protocol layer parsing;

[0071] In TCP protocol layer parsing, obtain source port, destination port, sequence number, acknowledgment number, and flag information.

[0072] Specifically, network traffic data is acquired through network interfaces or mirror ports, and historical data can be read from stored capture data files to support offline analysis. The acquired network traffic data is first preprocessed, including recording timestamps. With organizing data structures The data is categorized according to protocol layer or traffic type; preprocessed data can be stored in a cache or database to support real-time processing and retrospective analysis; in high-concurrency scenarios, the system can obtain data from multiple interfaces in parallel to ensure data integrity.

[0073] In the specific implementation process, network traffic data undergoes multi-layer protocol parsing, including the IP layer, ICMP layer, and TCP layer; during IP layer parsing, the source IP address is extracted. Destination IP address and protocol type Used to uniquely identify network communication connections; in ICMP layer parsing, it is used to obtain the message type. and code It also parses header-related fields, such as checksum and message length, to determine if the message is a path fragmentation restricted message; in the TCP layer parsing, it extracts the source port. Destination port Serial Number Confirmation number and flag position The sequence number and acknowledgment number are used to determine whether a data segment needs to be retransmitted, and the flag bit is used to identify the connection status.

[0074] The parsed multi-layer protocol information is associated with the original data packets to form a structured record. These structured records support subsequent TCP session identifier extraction, session management, and ICMP and TCP correlation analysis; the parsing module can process protocol information at each layer in priority order, and can use caching or queuing mechanisms to temporarily store parsing results to ensure efficient processing of high-concurrency data streams; during the parsing process, the system can select specific types of ICMP packets or TCP port ranges according to a strategy to meet different network environments and diagnostic needs.

[0075] In the specific implementation process, the parsing module can dynamically update the structured records to ensure the consistency of real-time capture and offline analysis data; IP, ICMP, and TCP information form a multi-dimensional index in the structured records, which is used to uniquely identify TCP sessions and support subsequent retransmission detection and root cause analysis; the system can optionally divide the parsing process into time windows. This is to control memory usage and ensure parsing efficiency.

[0076] S2. In the ICMP protocol-related information, identify the ICMP error messages that indicate the packet fragmentation limitation in the path, and obtain the corresponding TCP session identification information from the ICMP error messages;

[0077] Furthermore, ICMP error messages include:

[0078] Determine the ICMP message type and code to identify messages that indicate limited packet fragmentation in the path;

[0079] Obtain the original IP header information from the ICMP error message;

[0080] Obtain TCP / UDP header information from the payload of ICMP error messages.

[0081] Furthermore, obtaining the corresponding TCP session identification information includes:

[0082] Extract the source IP address, destination IP address, source port, and destination port from the ICMP error message;

[0083] A unique session identifier is generated based on the TCP message sequence number, acknowledgment number, and protocol type.

[0084] Specifically, the parsed ICMP message information is identified to determine whether the message indicates a fragmentation restriction in the path. The judgment criteria include the ICMP message type TTT and code CCC, where the combination of type and code corresponds to a fragmentation restriction indication; for example, an ICMP message of type 3 and code 4 can be identified as this type of error. During the identification process, the system parses key information in the ICMP message header, such as the checksum, message length, and source and destination IP addresses, to ensure accurate identification of the message type and error code. Simultaneously, the system retrieves the original IP header and the first 8 bytes of TCP / UDP header information from the ICMP message's Payload field. This information provides the source and destination ports, sequence number, and other TCP / UDP layer information of the data packet that triggered the ICMP message. The retrieval process can use packet parsing formulas to map the Payload to the corresponding TCP / UDP header structure. ,in This indicates the extracted TCP / UDP header structure.

[0085] In the specific implementation process, based on the parsed ICMP error messages, the system extracts TCP session identification information, including the source IP address. Destination IP address Source port and destination port At the same time, combined with the TCP packet sequence number Confirmation number and protocol type Generate a unique session identifier , where the function Used to combine various fields into a unique identifier to ensure that the TCP session that triggered the ICMP error can be accurately located; during the generation of the session identifier, a hash function or a multi-field combination algorithm can be used to ensure the uniqueness of the session.

[0086] The extracted TCP session identifiers are associated with and saved with ICMP error messages for quick matching of corresponding TCP sessions in subsequent analysis. The system can dynamically maintain a session identifier table, with each record containing the session identifier and corresponding ICMP message information to support real-time or offline analysis. In high-concurrency network environments, indexing or caching mechanisms can be used to accelerate the generation and retrieval of identifier information. Throughout the process, ICMP message parsing and TCP session identifier extraction logic are tightly coupled to ensure that each path fragmentation restriction warning can be accurately mapped to the TCP session that triggered the error, forming a reliable data foundation for subsequent TCP retransmission behavior analysis and root cause localization.

[0087] S3. Based on the TCP session identification information, determine the corresponding TCP session in the network traffic data and mark the TCP session;

[0088] Furthermore, marking TCP sessions includes:

[0089] Assign a unique identifier to each identified TCP session;

[0090] The session identifier is associated with and recorded with the source IP, destination IP, source port, destination port, and protocol type of the session;

[0091] Based on predefined tagging rules, session state or specific attributes are appended to the corresponding TCP session identifier.

[0092] Specifically, firstly, based on the TCP session identifier information extracted from ICMP packets, the corresponding TCP session is retrieved from network traffic data. The retrieval process achieves a unique match by comparing the source IP address, destination IP address, source port, destination port, and protocol type. To handle large-scale networks or high-concurrency session environments, the system can use a hash index structure or a multi-field composite index to store session records. During retrieval, the corresponding session is quickly located through hash calculation, expressed by the formula: ,in and These represent the source IP and destination IP, respectively. and These represent the source port and the destination port, respectively. Indicates protocol type, function Weighted hashing or a combination of multiple fields can be used to ensure that each TCP session has a unique identifier in the system.

[0093] In the specific implementation process, the system assigns a unique session identifier to each identified TCP session and associates and stores this identifier with the corresponding source / destination IP, source / destination port and protocol type to form a structured session table. Each session record contains session identifier, session state, sequence number range, acknowledgment number range, TCP flag bits and timestamp information to fully describe the network layer and transport layer characteristics of the TCP session. The system also maintains historical traffic information in the session table to facilitate subsequent analysis of TCP retransmission behavior or ICMP trigger events.

[0094] The system attaches state and attribute information to TCP sessions according to predefined marking rules. The marking rules may include session activity status, whether path fragmentation is restricted, whether ICMP error trigger records have occurred, and whether abnormal retransmission behavior exists. The marking information is stored in the session table in the form of fields or status flags and is associated with the session identifier. The system can update the marking status in real time or in batches, manage the session lifecycle through time windows, and ensure that the session status remains accurate in a dynamic network environment. The marking information can also be used to filter, classify, or trigger subsequent correlation analysis for specific TCP sessions, realizing structured management and efficient access to session data.

[0095] S4. Analyze the marked TCP sessions to determine whether TCP retransmission behavior has occurred in the TCP sessions;

[0096] Furthermore, TCP retransmission behavior includes:

[0097] Detect duplicate sequence number data segments in a TCP session;

[0098] Identify received duplicate acknowledgment messages;

[0099] Determine whether the sender should resend the data segment with the same sequence number if no acknowledgment is received;

[0100] Determine whether to trigger a retransmission operation based on the TCP timer;

[0101] Detected TCP retransmission behavior is recorded as structured information.

[0102] Specifically, the system first obtains the session identifier and related message sequence information from the marked TCP session, and performs sequential analysis on all TCP data segments in the session. The system detects whether there are duplicate sequence number data segments by comparing the sequence numbers of consecutive data segments. Duplicate sequence numbers indicate that the sender may have retransmitted the data segments that have already been sent. In order to accurately determine TCP retransmission behavior, the system also identifies the received duplicate acknowledgment messages and matches them with the original sequence number information to ensure that the duplicate acknowledgment messages correspond to data segments that have been sent but not acknowledged.

[0103] In its implementation, the system uses the sequence number and acknowledgment number information of the TCP protocol to determine whether the sender should resend a data segment with the same sequence number if no acknowledgment has been received; this determination can be expressed by the formula: ,in and These represent TCP data segments. Indicates the serial number. Represents the confirmation number, set This refers to the set of retransmitted data segments detected in a TCP session; the system can record the sending time, source port, destination port and corresponding session identifier for each retransmitted data segment for subsequent analysis.

[0104] The system further determines whether a retransmission operation is triggered by combining the TCP timer mechanism. Based on the TCP timer timeout information in the session, the system determines whether the sender initiated retransmission logic due to not receiving an acknowledgment, and simultaneously performs correlation analysis with duplicate sequence numbers and duplicate acknowledgment messages. The system records all detected TCP retransmission behaviors as structured information, including session identifier, sequence number range of retransmitted data segments, number of retransmissions, trigger time, and related flag bits, to form a complete data table for subsequent analysis and correlation processing. The structured information can be stored in a database or cache to support fast retrieval and real-time analysis.

[0105] The system can process the message sequence of a TCP session through a rolling time window or batch processing method, ensuring accurate capture of retransmission behavior even under high concurrency or high traffic conditions. Each retransmission record is associated with a TCP session identifier, ensuring accurate matching of the session and time sequence when performing correlation analysis with ICMP error information in the future. Through the above process, the system achieves complete detection, marking, and structured recording of TCP retransmission behavior.

[0106] S5. Perform correlation analysis between ICMP error messages and TCP retransmission behavior in the TCP session to determine whether the two meet the preset correlation conditions.

[0107] Further, association analysis includes:

[0108] Establish a matching relationship between each TCP session and its corresponding ICMP error message;

[0109] The ICMP error messages and TCP retransmission behavior were compared based on time series data.

[0110] The ICMP error messages that meet the matching criteria are associated with TCP retransmission behavior.

[0111] Furthermore, the preset association conditions include:

[0112] Set a time window parameter to determine whether TCP retransmission behavior and ICMP error messages occur within the same time period;

[0113] Match ICMP error messages with TCP retransmission behavior based on TCP session identifiers;

[0114] Records that meet the time and session matching criteria are identified as associated events.

[0115] Specifically, the system first establishes a matching relationship between each TCP session and its corresponding ICMP error message. The system initially associates the TCP session with the ICMP error message using the session identifier, source IP, destination IP, source port, and destination port, and stores the matching relationship in a temporary data structure for subsequent processing. During the matching process, the system can use hash mapping or index table technology to quickly locate the corresponding session and packet record.

[0116] In the specific implementation process, the system further compares ICMP error messages and TCP retransmission behavior based on time series; the system sets time window parameters. The timing of TCP retransmission is as follows: The ICMP error message was generated at the time specified in the original text. If satisfied If this is the case, then it is determined that the TCP retransmission behavior and the corresponding ICMP error message are likely related in time; time window parameter It can be adjusted according to network latency characteristics or traffic sampling frequency to adapt to different network environments.

[0117] The system further matches ICMP error messages with TCP retransmission behavior based on the session identifier; the matching conditions can be expressed as follows: ,in This indicates a record of TCP retransmission behavior. This indicates ICMP error message recording. Represents a unique identifier for a TCP session, set This refers to associated events that meet the time window and session identifier matching conditions; the system marks successfully matched records and stores them in a structured table for subsequent root cause analysis and statistical summarization.

[0118] The system can use batch or streaming processing to compare TCP retransmission behavior and ICMP error information occurring concurrently in multiple sessions in real time or periodically. The system ensures that each retransmission record and ICMP error information are strictly matched in terms of time and session identifier to form an accurate set of related events. The set of related events can be further used to analyze the impact of packet fragmentation constraints in the path, thereby supporting complete TCP retransmission root cause localization.

[0119] S6. When ICMP error messages and TCP retransmission behavior meet the correlation conditions, the root cause of TCP retransmission behavior is determined to be related to path fragmentation limitation.

[0120] Furthermore, determining the root cause of TCP retransmission behavior and its relation to path fragmentation limitations includes:

[0121] The matching relationship between TCP retransmission behavior and corresponding ICMP error messages is confirmed based on the TCP session identifier.

[0122] Determine whether the matched ICMP error message type and code indicate path fragmentation restrictions;

[0123] TCP retransmission behaviors that meet the criteria are marked as path fragmentation-restricted.

[0124] Specifically, the system first confirms the matching relationship between TCP retransmission behavior and corresponding ICMP error information based on the TCP session identifier; the system accurately matches each TCP retransmission record with its associated ICMP error information through the session identifier and forms a corresponding relationship in the data structure; during the matching process, an index table or hash mapping method can be used to quickly locate the corresponding session and packet record to support efficient processing.

[0125] In the specific implementation process, the system further determines whether the matched ICMP error message type and code indicate path fragmentation restriction; the judgment rules can be based on the ICMP message type field and code field definition, for example, when the type field equals And the code field equals When this occurs, it is determined that the ICMP message indicates that packet fragmentation is restricted in the path; among which... Indicates a specific ICMP type value. This represents the ICMP code value associated with fragmentation limitations; the system can establish a mapping table for different types and code combinations to quickly determine matching ICMP error messages.

[0126] The system marks TCP retransmission behaviors that meet the judgment criteria as path fragmentation-restricted. The marking information includes the unique TCP session identifier, retransmission sequence number, and associated ICMP error information identifier, and stores them in a structured data table. The system can use status flags or attribute fields to record path fragmentation-restricted associations for subsequent statistical, analytical, or visualization operations. In this way, each TCP retransmission behavior can be clearly associated with the network path fragmentation restriction that caused it, thus forming a complete root cause analysis link.

[0127] Example 2:

[0128] In the internal networks of large enterprise data centers, complex network links and dense traffic exist. Traditional manual analysis of TCP retransmissions and ICMP error packets cannot quickly locate TCP retransmission problems caused by link fragmentation limitations, resulting in long network fault diagnosis cycles and high maintenance costs. To solve the above problems, this invention provides a TCP retransmission location method based on ICMP and TCP correlation analysis, the structure of which is as follows: Figure 1 As shown. The specific implementation process of this method is as follows:

[0129] First, real-time network traffic data is acquired through the network interfaces or mirror ports of the enterprise core switch and edge router. Optionally, traffic records are imported from stored historical capture data files. The acquired network traffic data is preprocessed, including recording timestamps and organizing the data structure. The preprocessed data is then stored in a database or cache system. Subsequently, the network traffic data undergoes multi-layer protocol parsing, including the IP layer, ICMP layer, and TCP layer. In IP layer parsing, the source IP, destination IP, and protocol type are extracted. In ICMP layer parsing, the packet type, code, and related header information are obtained. In TCP layer parsing, the source port, destination port, sequence number, acknowledgment number, and flag information are extracted to generate structured data records.

[0130] Identify ICMP error messages in ICMP protocol-related information that indicate packet fragmentation limitations in the path, extract the original IP header and TCP header information from the error messages, generate corresponding TCP session identifiers based on the extracted information, including source IP, destination IP, source port, destination port, TCP sequence number and acknowledgment number, determine the corresponding TCP session in network traffic data, assign a unique identifier to each TCP session, associate the session identifier with source IP, destination IP, source port, destination port and protocol type, and append session state or specific attributes to the corresponding session identifier according to predefined rules.

[0131] The system analyzes the marked TCP sessions, detecting duplicate sequence number segments, duplicate acknowledgment messages, and retransmission behavior when no acknowledgment is received. It also uses a TCP timer to determine whether a retransmission operation is triggered and records the detected TCP retransmission behavior in structured information. A matching relationship is established for each TCP session and its corresponding ICMP error information. The ICMP error information and TCP retransmission behavior are compared according to the time series, and it is determined whether the set time window and session matching conditions are met. Records that meet the conditions are identified as associated events.

[0132] Based on the TCP session identifier, the matching relationship between TCP retransmission behavior and corresponding ICMP error messages is confirmed. It is determined whether the ICMP error message type and code indicate path fragmentation restriction. TCP retransmission behaviors that meet the conditions are marked as path fragmentation restriction related, thereby realizing automated root cause localization of TCP retransmission in complex data center networks.

[0133] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A TCP retransmission location method based on ICMP and TCP correlation analysis, characterized in that, Includes the following steps: S1. Obtain network traffic data and perform protocol parsing on the network traffic data to identify ICMP protocol-related information and TCP protocol-related information; S2. In the ICMP protocol-related information, identify ICMP error information used to indicate packet fragmentation limitations in the path, and obtain the corresponding TCP session identification information from the ICMP error information; S3. Based on the TCP session identification information, determine the corresponding TCP session in the network traffic data and mark the TCP session; S4. Analyze the marked TCP sessions to determine whether TCP retransmission has occurred in the TCP sessions; S5. Perform correlation analysis between the ICMP error information and the TCP retransmission behavior in the TCP session to determine whether the two meet the preset correlation conditions. S6. When the ICMP error information and the TCP retransmission behavior meet the association conditions, determine that the root cause of the TCP retransmission behavior is related to path fragmentation limitation.

2. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The acquisition of network traffic data includes: Obtain network traffic data through network interfaces or mirror ports; Retrieve network traffic data from the stored capture data file; The acquired network traffic data is preprocessed, including recording time information and organizing the data structure; The preprocessed network traffic data is stored in a cache or database.

3. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The protocol parsing includes: Perform multi-layer protocol parsing on network traffic data, including the IP layer, ICMP protocol layer, and TCP protocol layer; Obtain the source IP address, destination IP address, and protocol type during IP layer resolution; Obtain the message type and code, as well as related header information, during ICMP protocol layer parsing; In TCP protocol layer parsing, obtain source port, destination port, sequence number, acknowledgment number, and flag information.

4. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The ICMP error messages include: Determine the ICMP message type and code to identify messages that indicate limited packet fragmentation in the path; Obtain the original IP header information from the ICMP error message; Obtain TCP / UDP header information from the payload of ICMP error messages.

5. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The process of obtaining the corresponding TCP session identifier information includes: Extract the source IP address, destination IP address, source port, and destination port from the ICMP error message; A unique session identifier is generated based on the TCP message sequence number, acknowledgment number, and protocol type.

6. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The process of marking TCP sessions includes: Assign a unique identifier to each identified TCP session; The session identifier is associated with and recorded with the source IP, destination IP, source port, destination port, and protocol type of the session; Based on predefined tagging rules, session state or specific attributes are appended to the corresponding TCP session identifier.

7. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The TCP retransmission behavior includes: Detect duplicate sequence number data segments in a TCP session; Identify received duplicate acknowledgment messages; Determine whether the sender should resend the data segment with the same sequence number if no acknowledgment is received; Determine whether to trigger a retransmission operation based on the TCP timer; Detected TCP retransmission behavior is recorded as structured information.

8. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The association analysis includes: Establish a matching relationship between each TCP session and its corresponding ICMP error message; The ICMP error messages and TCP retransmission behavior were compared based on time series data. The ICMP error messages that meet the matching criteria are associated with TCP retransmission behavior.

9. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The preset association conditions include: Set a time window parameter to determine whether TCP retransmission behavior and ICMP error messages occur within the same time period; Match ICMP error messages with TCP retransmission behavior based on TCP session identifiers; Records that meet the time and session matching criteria are identified as associated events.

10. The TCP retransmission location method based on ICMP and TCP correlation analysis according to claim 1, characterized in that, The determination that the root cause of the TCP retransmission behavior is related to path fragmentation limitations includes: The matching relationship between TCP retransmission behavior and corresponding ICMP error messages is confirmed based on the TCP session identifier. Determine whether the matched ICMP error message type and code indicate path fragmentation restrictions; TCP retransmission behaviors that meet the criteria are marked as path fragmentation-restricted.

Images