A method and apparatus for constructing a traffic forwarding path topology graph

Abstract

The application discloses a kind of flow forwarding path topological graph construction method, device, computer equipment and storage medium, the method includes: receiving target domain name input by user;Based on the target domain name, draw the public network topology graph of public network forwarding path that flow passes through before entering intranet;Wherein, the starting topological node in the public network topology graph is the target domain name, and the terminal topological node is the address of entry nginx;At the starting topological node of the public network topology graph, continue to draw the intranet topology graph of intranet forwarding path that flow passes through after entering intranet, to obtain the complete topology graph of flow forwarding path;Wherein, the starting topological node in the intranet topology graph is the address of entry nginx, and the terminal topological node is the address of application server for processing business logic.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, computer device, and storage medium for constructing a traffic forwarding path topology map. Background Technology

[0002] In the current technological environment, network operations and maintenance personnel face a significant challenge: when users access services via domain names, it is difficult to quickly and accurately grasp the complete forwarding path of a request from the user's end to the final business service. Traditional network diagnostic methods rely on operations and maintenance personnel manually performing multiple independent operations, including DNS resolution, checking the configuration of various cloud service provider consoles, and analyzing the configuration files of multiple Nginx servers. These operations are not only time-consuming and labor-intensive, but also prone to errors due to human factors.

[0003] While some network topology discovery tools exist, they primarily focus on the physical connections between network devices and cannot automatically reconstruct logical request paths based on domain names. Due to the lack of automated traffic path analysis tools, network troubleshooting typically requires collaboration among multiple teams, involving tedious manual operations to gradually narrow down the problem area. This results in a long Mean Time To Repair (MTTR), impacting business stability and user experience. Furthermore, during architecture evolution and capacity planning, the inability to intuitively understand the actual traffic flow often leads to decisions based on incomplete information, increasing the difficulty and risk of architecture optimization.

[0004] Therefore, there is an urgent need in this field for a method and system that can automatically, accurately, and in real time reconstruct multi-layer network request paths based on domain names and generate a visual topology map to help operations and maintenance personnel quickly understand the network architecture, perform accurate fault location, and conduct effective capacity planning. Summary of the Invention

[0005] The purpose of this invention is to provide a method and apparatus for constructing a traffic forwarding path topology map, which can solve the above-mentioned technical problems.

[0006] According to one aspect of the present invention, a method for constructing a traffic forwarding path topology map is provided, comprising: Receive the target domain name input by the user; A public network topology diagram is drawn based on the target domain name, showing the public network forwarding path that the traffic takes before entering the internal network; wherein, the starting topology node in the public network topology diagram is the target domain name, and the ending topology node is the address of the entry nginx; At the starting topology node of the public network topology map, continue to draw the internal network topology map of the internal network forwarding path that the traffic passes through after entering the internal network, so as to obtain a complete topology map of the traffic forwarding path; wherein, the starting topology node in the internal network topology map is the address of the entry nginx and the ending topology node is the address of the application server used to process business logic.

[0007] Optionally, the step of drawing a public network topology map based on the target domain name, showing the public network forwarding path the traffic traverses before entering the intranet, includes: The target domain name is constructed as the starting topology node in the public network topology graph; Perform DNS resolution on the target domain name to obtain the next-hop address, construct the next-hop address as a new topology node in the public network topology graph, and draw a directed edge from the starting topology node to the new topology node; Determine whether the new topology node has the address of a public network service node; The drawing ends when the new topology node is not the address of a public network service node; wherein, the new topology node is the terminating topology node in the public network topology graph. When the new topology node is the address of a public network service node, the configuration of the public network service node is queried to obtain the new next-hop address. This new next-hop address is then used to construct a new topology node in the public network topology graph. Directed edges are drawn from the previously constructed topology node to the newly constructed topology node. The process then returns to the step of determining whether the new topology node is the address of a public network service node. This process continues until it is determined that the newly constructed topology node is not the address of a public network service node, at which point the drawing process ends. The newly constructed topology node is the terminating topology node in the public network topology graph.

[0008] Optionally, at the starting topology node of the public network topology map, the internal network topology map of the internal network forwarding path traversed by traffic after entering the internal network is continued to be drawn to obtain a complete topology map of the traffic forwarding path, including: The entry nginx is used as the nginx to be analyzed, and the target server block used to process the target domain name is determined from the nginx to be analyzed. Determine the target address associated with the target server block; wherein, when the proxy_pass directive in the root location of the target server block specifies an address, the target address is the address specified by the proxy_pass directive; when the proxy_pass directive specifies the name of the upstream block in the nginx to be analyzed, the target address is the address specified by the server directive in the upstream block; When the target address is the address of an application server used to process business logic, the target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

[0009] Optionally, the step of continuing to draw an intranet topology map at the starting topology node of the public network topology map, showing the intranet forwarding path of the traffic after it enters the intranet, to obtain a complete topology map of the traffic forwarding path, further includes: When the target address is the address of the business nginx, the business nginx is taken as a new nginx to be analyzed, and the steps of determining the target server block used to process the target domain name from the nginx to be analyzed and determining the target address associated with the target server block are repeated until the latest determined target address is the address of the application server used to process the business logic. The newly determined target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

[0010] Optionally, determining the target address associated with the target server block includes: Obtain the tree index structure of the nginx to be analyzed; wherein, the tree index structure includes multiple indexes, each index including: the identifier of the server block, a server_name of the server block, and an object specified by the proxy_pass directive in the root location of the server block, wherein the object is an address or the name of the upstream block; Obtain the target server_name that matches the target domain name in the target server block, and determine the target object that has an index relationship with the identifier of the target server block and the target server_name from the index of the tree index structure; When the target object is an address, that address is used as the target address; When the target object is the name of an upstream block, the address specified by the server directive in the upstream block is used as the target address.

[0011] Optionally, obtaining the target server_name that matches the target domain name in the target server block includes: Retrieve all server_names of the target server block; Using a preset regular expression matching algorithm, filter out the server_names that are related to the target domain name from the obtained server_names; Try to determine the server_name that is exactly the same as the target domain name from the filtered server_names; If a server_name that is completely identical to the target domain name is determined, then that server_name is used as the target server_name. If no server_name that is completely identical to the target domain name is found, the server_name with the highest similarity to the target domain name is selected from the filtered server_names and used as the target server_name.

[0012] Optionally, the method further includes: The complete topology map of the traffic forwarding paths was detected and drawn. An alarm is generated when the complete topology map of the traffic forwarding path includes both the complete topology map of the domestic traffic forwarding path and the complete topology map of the overseas traffic forwarding path, and the terminating topology nodes in the internal network topology maps of the two are inconsistent. An alarm message is generated when a loop path exists in the complete topology of the traffic forwarding path; An alarm is generated when there are multiple topology nodes representing public network entry points in the complete topology graph of the traffic forwarding path, and the next topology node pointed to by these multiple topology nodes is different. An alarm message is generated when any one or more topology nodes in the complete topology graph of the traffic forwarding path point to a service node that goes down.

[0013] To achieve the above objectives, the present invention further provides an apparatus for constructing a traffic forwarding path topology map, comprising: The receiving module is used to receive the target domain name input by the user; The first drawing module is used to draw a public network topology map of the public network forwarding path that traffic passes through before entering the intranet based on the target domain name; wherein, the starting topology node in the public network topology map is the target domain name and the ending topology node is the address of the entry nginx; The second drawing module is used to continue drawing the intranet topology map of the intranet forwarding path that traffic passes through after entering the intranet at the starting topology node of the public network topology map, so as to obtain a complete topology map of the traffic forwarding path; wherein, the starting topology node in the intranet topology map is the address of the entry nginx and the ending topology node is the address of the application server used to process business logic.

[0014] To achieve the above objectives, the present invention also provides a computer device, the computer device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for constructing a traffic forwarding path topology as described above.

[0015] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement the steps of the method for constructing a traffic forwarding path topology as described above.

[0016] The method and apparatus for constructing a traffic forwarding path topology map provided by this invention creatively and seamlessly stitches together public network forwarding paths and internal network forwarding paths to generate a complete topology map. This fundamentally solves the problem of the disconnect between public network links and internal network links in traditional operations and maintenance, enabling operations and maintenance personnel to have a comprehensive view and intuitively understand the complete data flow from users to services. The system can automatically deduce and draw the complete path upon receiving a domain name, reducing reliance on the personal experience and skills of operators and improving the standardization and overall efficiency of operations and maintenance work. Attached Figure Description

[0017] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart illustrating the method for constructing the traffic forwarding path topology map provided in Example 1; Figure 2A This is a schematic diagram of the overseas traffic forwarding path topology provided in Example 1; Figure 2B This is a schematic diagram of the domestic traffic forwarding path topology provided in Example 1; Figure 3 This is a schematic diagram of the traffic forwarding path determination process provided in Example 1; Figure 4 A block diagram of the apparatus for constructing a traffic forwarding path topology map provided in Embodiment 2; Figure 5 A block diagram of a computer device suitable for implementing a method for constructing a traffic forwarding path topology map, as provided in Embodiment 3. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0019] Example 1 Embodiment 1 of the present invention provides a method for constructing a traffic forwarding path topology map, such as... Figure 1 As shown, the method includes steps S1 to S3, wherein: Step S1: Receive the target domain name input by the user.

[0020] Step S2: Draw a public network topology diagram based on the target domain name, showing the public network forwarding path that the traffic passes through before entering the intranet; wherein, the starting topology node in the public network topology diagram is the target domain name, and the ending topology node is the address of the entry nginx.

[0021] The topology of the public network forwarding path that traffic takes before entering the internal network is called the public network topology. A public network topology contains two or more topology nodes, with the starting node being the target domain name and the ending node being the address of the ingress nginx. When the public network topology contains more than two topology nodes, the intermediate nodes represent the addresses of various public network service nodes that the traffic passes through. These public network service nodes can be CDN (Content Delivery Network), GTM (Global Traffic Manager), WAF (Web Application Firewall), DDoS (Distributed Denial-of-Service) attacks, protection devices, LB (Load Balancer), etc.

[0022] The entry Nginx is located at the network boundary, serving as a unified receiving point for external traffic. In distributed systems or microservice architectures, there are typically multiple Nginx server instances, one of which acts as the entry Nginx, and one or more others as business Nginx instances. The entry Nginx usually sits between the client and internal services, responsible for handling external requests and forwarding them to the appropriate business Nginx or the backend application server used to process business logic. The business Nginx is typically deployed within the internal network, directly handling requests from the entry Nginx and forwarding them to specific backend services, such as application servers.

[0023] Optionally, the step of drawing a public network topology map based on the target domain name, showing the public network forwarding path the traffic traverses before entering the intranet, includes: The target domain name is constructed as the starting topology node in the public network topology graph; Perform DNS resolution on the target domain name to obtain the next-hop address, construct the next-hop address as a new topology node in the public network topology graph, and draw a directed edge from the starting topology node to the new topology node; Determine whether the new topology node has the address of a public network service node; The drawing ends when the new topology node is not the address of a public network service node; wherein, the new topology node is the terminating topology node in the public network topology graph. When the new topology node is the address of a public network service node, the configuration of the public network service node is queried to obtain the new next-hop address. This new next-hop address is then used to construct a new topology node in the public network topology graph. Directed edges are drawn from the previously constructed topology node to the newly constructed topology node. The process then returns to the step of determining whether the new topology node is the address of a public network service node. This process continues until it is determined that the newly constructed topology node is not the address of a public network service node, at which point the drawing process ends. The newly constructed topology node is the terminating topology node in the public network topology graph.

[0024] This embodiment is a recursive parsing and visualization algorithm designed to automatically discover and plot all intermediate service nodes a domain name traverses on the public internet until the entry point to the enterprise's intranet is found. Specifically, the target domain name is constructed as the starting topology node in the public internet topology graph. The first-hop address is obtained through DNS resolution, and this first-hop address is created as the second topology node in the public internet topology graph. A directed edge is drawn from the starting topology node to the second topology node. This first-hop address could be the address of a public internet service node or the address of the entry point nginx. When the first-hop address is the address of the entry point nginx, the plotting ends, and the second topology node in the public internet topology graph becomes the ending topology node. When the first-hop address is the address of a public internet service node, the configuration of that public internet service node is queried to obtain the second-hop address. This second-hop address is constructed as the third topology node in the public internet topology graph, and a directed edge is drawn from the second topology node to the third topology node. Further, it is determined whether the second-hop address is the address of a public internet service node or the address of the entry point nginx. If the address is the entry point nginx, the drawing process ends, and the third topology node becomes the termination node of the public network topology graph. If the address is the public network service node, the third hop address is determined, and the public network topology graph continues to be drawn until it is determined that the newly constructed topology node is not the address of a public network service node. At this point, the drawing process ends, and the newly constructed topology node becomes the termination node of the public network topology graph.

[0025] This embodiment, through the design of a recursive algorithm, can cope with complex, multi-layered network architectures in reality. No matter how many layers there are in the public network link, the system can automatically peel off, parse and display them layer by layer without manual operation.

[0026] Optionally, the target domain name corresponds to overseas and / or domestic traffic forwarding paths. If only domestic or overseas traffic forwarding paths exist, a complete topology map of one traffic forwarding path is drawn; if both domestic and overseas traffic forwarding paths exist, a complete topology map of both traffic forwarding paths is drawn, that is, a complete topology map of the domestic traffic forwarding path is drawn, and a complete topology map of the overseas traffic forwarding path is also drawn. For example, Figure 2A and 2B All of these are complete topology diagrams of the traffic forwarding paths for the domain trade.skytigris.cn, where... Figure 2A The diagram shows the topology of overseas traffic forwarding; for example... Figure 2B As shown, a topology diagram of domestic traffic forwarding is presented.

[0027] Step S3: At the starting topology node of the public network topology map, continue to draw the intranet topology map of the intranet forwarding path that the traffic passes through after entering the intranet, so as to obtain a complete topology map of the traffic forwarding path; wherein, the starting topology node in the intranet topology map is the address of the entry nginx and the ending topology node is the address of the application server used to process business logic.

[0028] The topology of the internal network (IDN) is the path that traffic takes after entering the IDN. The starting node of the IDN is the ending node of the public network (WAN) topology, and the ending node of the IDN is the address of the application server used to process business logic. Typically, the IDN topology contains two nodes.

[0029] Optionally, at the starting topology node of the public network topology map, the internal network topology map of the internal network forwarding path traversed by traffic after entering the internal network is continued to be drawn to obtain a complete topology map of the traffic forwarding path, including: The entry nginx is used as the nginx to be analyzed, and the target server block used to process the target domain name is determined from the nginx to be analyzed. Determine the target address associated with the target server block; wherein, when the proxy_pass directive in the root location of the target server block specifies an address, the target address is the address specified by the proxy_pass directive; when the proxy_pass directive specifies the name of the upstream block in the nginx to be analyzed, the target address is the address specified by the server directive in the upstream block; When the target address is the address of an application server used to process business logic, the target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

[0030] This embodiment relates to an automated intranet path discovery algorithm based on nginx configuration analysis. The purpose is to start from the end of the public network path and continue to track the flow of requests in the enterprise intranet until the business application that finally processes the request is found.

[0031] Specifically, the Nginx instance to be analyzed includes multiple server blocks and multiple upstream blocks. Among all server blocks, the target server block that processes the target domain name is matched. The system analyzes the root location of this target server block and extracts the object specified by the `proxy_pass` directive within it. There are three possibilities for the object specified by the `proxy_pass` directive: the first is an IP address; the second is a domain name; and the third is the name of the upstream block. The first and second cases can be collectively referred to as the `proxy_pass` directive specifying an address. When the `proxy_pass` directive specifies an address, it means that the directive directly points to a specific backend server. Therefore, this address is the address of the application server used to process the business logic. In this case, the target address is constructed as the endpoint topology node of the internal network topology graph, and directed edges are drawn from the starting topology node to this endpoint topology node to obtain the complete topology graph of the traffic forwarding path.

[0032] This embodiment uses the terminating topology node of the public network topology graph as the starting topology node of the internal network topology graph, realizing seamless connection between public and internal network paths; by parsing the server block and location block of nginx, the dependency relationship between services is automatically derived, transforming the complex and static configuration information of the internal network into dynamic and interactive topology relationships, realizing the unification of network operation and maintenance and business operation and maintenance perspectives.

[0033] Optionally, the step of continuing to draw an intranet topology map at the starting topology node of the public network topology map, showing the intranet forwarding path of the traffic after it enters the intranet, to obtain a complete topology map of the traffic forwarding path, further includes: When the target address is the address of the business nginx, the business nginx is taken as a new nginx to be analyzed, and the steps of determining the target server block used to process the target domain name from the nginx to be analyzed and determining the target address associated with the target server block are repeated until the latest determined target address is the address of the application server used to process the business logic. The newly determined target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

[0034] This embodiment is a continuation of the above-mentioned automated intranet path discovery algorithm based on nginx configuration analysis. Specifically, it involves a recursive processing mechanism to handle the situation where the current target address is not the final business application, but another business nginx.

[0035] Specifically, when the system resolves a target address according to the main process, and then determines through judgment rules that the address is not the final business application but another business nginx, this recursive process is triggered. This business nginx is set as the new nginx to be analyzed, and the process iteratively executes the steps of retrieving the server block used to process the target domain name from the nginx to be analyzed, analyzing the root location of the server block, and extracting the new target address pointed to by the proxy_pass directive, until the latest resolved target address is determined to be the application server used to process the business logic. After exiting the recursive loop, the complete topology map of the traffic forwarding path is drawn.

[0036] Manually tracing multiple layers of Nginx is extremely difficult and error-prone. This recursive process achieves full automation, systematically traversing all possible path branches to ensure the completeness and accuracy of path discovery, preventing any intermediate link from being missed due to human error. Through recursive parsing, this implementation can automatically penetrate multiple layers of proxies, visualizing the complete, deep call chain from the boundary to the innermost service, transforming the complex architecture into a clear topology diagram.

[0037] Optionally, determining the target address associated with the target server block includes: Obtain the tree index structure of the nginx to be analyzed; wherein, the tree index structure includes multiple indexes, each index including: the identifier of the server block, a server_name of the server block, and an object specified by the proxy_pass directive in the root location of the server block, wherein the object is an address or the name of the upstream block; Obtain the target server_name that matches the target domain name in the target server block, and determine the target object that has an index relationship with the identifier of the target server block and the target server_name from the index of the tree index structure; When the target object is an address, that address is used as the target address; When the target object is the name of an upstream block, the address specified by the server directive in the upstream block is used as the target address.

[0038] At the beginning of the analysis, the system does not directly read the nginx configuration file text, but first parses it and transforms it into a structured tree index structure. Each index entry in this structure contains three key pieces of information: the server block identifier: uniquely identifies a server block; server_name: a domain name processed by this server block; and proxy_pass object: the object pointed to by the proxy_pass directive in the root location of this server block, which is either an address or the name of an upstream block.

[0039] When the target address needs to be determined, the system no longer analyzes the original configuration, but instead queries this pre-built index. Using the known target server block identifier and target domain name, it searches the index for an entry that exactly matches, directly retrieving the stored `proxy_pass` object. Further, based on the type of the retrieved `proxy_pass` object, it performs a final resolution: if it's a direct address, it's immediately used as the target address; if it's an upstream name, a second quick lookup is performed to obtain all server addresses under that upstream block.

[0040] It should be noted that the upstream block contains multiple server directives, each specifying an address. When all server directives specify the same address, any address specified by any one of them is used as the target address. When several server directives in the upstream block specify different addresses, each address is treated as a separate target address, resulting in multiple target addresses. When drawing the internal network topology diagram, each target address needs to be drawn in a branching manner.

[0041] This embodiment moves the time-consuming configuration file parsing process to the index building stage. During the actual path query and topology drawing, the system performs almost entirely in-memory hash lookups, resulting in extremely fast speeds. Regardless of the complexity of the original nginx configuration, the system's query performance depends only on the size of the index structure, not on the complexity of the original configuration. This ensures that the system maintains stable high performance even when facing large and complex production environment configurations.

[0042] Optionally, obtaining the target server_name that matches the target domain name in the target server block includes: Retrieve all server_names of the target server block; Using a preset regular expression matching algorithm, filter out the server_names that are related to the target domain name from the obtained server_names; Try to determine the server_name that is exactly the same as the target domain name from the filtered server_names; If a server_name that is completely identical to the target domain name is determined, then that server_name is used as the target server_name. If no server_name that is completely identical to the target domain name is found, the server_name with the highest similarity to the target domain name is selected from the filtered server_names and used as the target server_name.

[0043] The `server` block contains multiple `server_name` values, each representing a domain name that the `server` block can handle. However, the `server_name` in the Nginx configuration may use wildcards (such as *.example.com) or regular expressions, while the user inputs a specific domain name, such as `shop.example.com`. Therefore, a mechanism is needed to intelligently match the specific domain name entered by the user with the wildcard or regular expression patterns that may exist in the configuration, in order to accurately determine the target `server` block to process the request.

[0044] This embodiment achieves this objective through a multi-level filtering process. Specifically, it first collects all server_names configured in the target server block. These server_names may include exact domain names, wildcard domain names, or regular expressions. Then, using a preset regular expression matching algorithm, it quickly filters out server_names that are clearly unrelated to the target domain name, aiming to narrow down the candidate range and improve the efficiency of subsequent steps. For example, for the target domain shop.example.com, *.example.com will be retained, but api.example.com or *.other.com will be filtered out. Furthermore, the system first attempts to find a server_name that is completely identical to the target domain name in the filtered candidate set. If no exact match is found in the candidate set, the system does not simply fail and exit, but instead initiates a fallback strategy, calculates the similarity between each candidate server_name and the target domain name, and selects the one with the highest similarity as the final matching result. For example, for the target domain dev.shop.example.com, if there are *.shop.example.com and *.example.com in the candidate set, the former will be selected due to its higher similarity.

[0045] This embodiment ensures that even if the domain name entered by the user does not match the server_name in the configuration exactly, the system still has a high probability of intelligently finding the correct server block and continuing to build the topology graph, thus avoiding the interruption of the entire analysis process due to minor configuration differences.

[0046] It should be noted that the address in this invention can be an IP address, a domain name, or a port, and this invention does not limit it.

[0047] Optionally, during operation, the system will intelligently store data obtained from various sources (such as DNS resolution results, CDN / WAF configuration returned by cloud service provider APIs, and the resolved Nginx AST, etc.), avoiding repeated expensive network requests and calculations for each query, greatly improving response speed and reducing the load on external APIs, and in particular ensuring the efficiency of topology graph drawing.

[0048] The following is based on Figure 3 Taking this example, the process of determining the traffic forwarding path is explained. First, the system receives the target domain name input by the user and queries the public DNS database to resolve it, obtaining the first-hop address. There are two possibilities: either the first-hop address is the address of the ingress Nginx server, or it is the address of a public service node. If the first-hop address is the address of a public service node, the second-hop address is determined from its configuration. The system then continues to determine which scenario the second-hop address falls under. If the second-hop address is also the address of a public service node, the above steps continue until a new hop address is determined to be the address of the ingress Nginx server. Once the address of the ingress Nginx server is determined, it is necessary to determine where the ingress Nginx server will forward the domain name. If the ingress Nginx server forwards the domain name to the application server that actually processes the business, the entire traffic forwarding path determination process is complete. If the ingress Nginx server forwards the domain name to the business Nginx server, it is necessary to determine again where the business Nginx server will forward the domain name, until the final business application receiving the domain name is determined, thus completing the entire traffic forwarding path determination process.

[0049] Optionally, the method further includes: The complete topology map of the traffic forwarding paths was detected and drawn. An alarm is generated when the complete topology map of the traffic forwarding path includes both the complete topology map of the domestic traffic forwarding path and the complete topology map of the overseas traffic forwarding path, and the terminating topology nodes in the internal network topology maps of the two are inconsistent. An alarm message is generated when a loop path exists in the complete topology of the traffic forwarding path; An alarm is generated when there are multiple topology nodes representing public network entry points in the complete topology graph of the traffic forwarding path, and the next topology node pointed to by these multiple topology nodes is different. An alarm message is generated when any one or more topology nodes in the complete topology graph of the traffic forwarding path point to a service node that goes down.

[0050] The detection mechanism in this embodiment includes: Cross-regional architecture consistency check: An alert is generated when domestic and overseas users access the same domain name but ultimately arrive at different business applications. This may indicate data inconsistency, errors in canary deployments, or configuration errors.

[0051] Loop Path Detection: An alert is triggered immediately upon detecting a loop. This is one of the most serious configuration errors and can instantly cripple the service.

[0052] Public network entry policy consistency check: If the next hop of multiple entry nodes are different, it means that the entry policy of public network traffic is not consistent, which may bring security risks or uneven load.

[0053] Service health status correlation detection: When a failure is detected in a link of the topology path, an alarm is immediately triggered. This upgrades the topology diagram from a static architecture diagram to a dynamic runtime status diagram.

[0054] The complete topology diagram of the traffic forwarding path finally drawn in this embodiment intuitively shows the final effective state of the configuration. By comparing the automatically generated topology with the expected architecture design, configuration errors can be quickly identified, allowing for repairs before problems affect users, thus enhancing system stability and security. In particular, this system can proactively issue alerts before or immediately after a fault occurs. For example, before a loop path causes an avalanche, or before overseas users access faulty services and trigger customer complaints, the system provides early warnings, nipping the fault in the bud. The first and third detection mechanisms effectively enforce that the network architecture adheres to established design principles (such as cross-regional service consistency and unified entry strategy). The system automatically and continuously performs this audit, ensuring the standardization and manageability of the architecture.

[0055] This embodiment relates to an algorithm for automatic identification and topology construction of network request paths based on domain names. It is applicable to scenarios involving complex network architectures both domestically and internationally, including CDN, GTM, WAF, DDoS, protection devices, LB, and multi-layered Nginx reverse proxies. The algorithm automatically associates DNS records, CDN / GTM resolution, WAF / DDOS information, origin server entry configuration, and business-side Nginx configuration by inputting a domain name. It extracts multi-level forwarding relationships such as proxy_pass, static upstream, and dynamic upstream, constructing a complete multi-layered request forwarding chain. The topology is then modeled and visualized in the form of a directed acyclic graph (DAG). Furthermore, the algorithm features automatic resolution, configuration change detection, path consistency verification, and multi-region fusion display, making it suitable for enterprise network operation and maintenance, fault diagnosis, and observability systems.

[0056] Example 2 Embodiment 2 of the present invention provides a device for constructing a traffic forwarding path topology map. Some technical features and effects of Embodiment 2 can be referred to Embodiment 1. For example... Figure 4 As shown, the traffic forwarding path topology construction device 40 specifically includes the following components: Receiver module 401 is used to receive the target domain name input by the user; The first drawing module 402 is used to draw a public network topology map of the public network forwarding path that traffic passes through before entering the intranet based on the target domain name; wherein, the starting topology node in the public network topology map is the target domain name and the ending topology node is the address of the entry nginx; The second drawing module 403 is used to continue drawing the intranet topology map of the intranet forwarding path that the traffic passes through after entering the intranet at the starting topology node of the public network topology map, so as to obtain a complete topology map of the traffic forwarding path; wherein, the starting topology node in the intranet topology map is the address of the entry nginx and the ending topology node is the address of the application server used to process business logic.

[0057] Optionally, the first drawing module is specifically used for: The target domain name is constructed as the starting topology node in the public network topology graph; Perform DNS resolution on the target domain name to obtain the next-hop address, construct the next-hop address as a new topology node in the public network topology graph, and draw a directed edge from the starting topology node to the new topology node; Determine whether the new topology node has the address of a public network service node; The drawing ends when the new topology node is not the address of a public network service node; wherein, the new topology node is the terminating topology node in the public network topology graph. When the new topology node is the address of a public network service node, the configuration of the public network service node is queried to obtain the new next-hop address. This new next-hop address is then used to construct a new topology node in the public network topology graph. Directed edges are drawn from the previously constructed topology node to the newly constructed topology node. The process then returns to the step of determining whether the new topology node is the address of a public network service node. This process continues until it is determined that the newly constructed topology node is not the address of a public network service node, at which point the drawing process ends. The newly constructed topology node is the terminating topology node in the public network topology graph.

[0058] Optionally, the second drawing module is specifically used for: The entry nginx is used as the nginx to be analyzed, and the target server block used to process the target domain name is determined from the nginx to be analyzed. Determine the target address associated with the target server block; wherein, when the proxy_pass directive in the root location of the target server block specifies an address, the target address is the address specified by the proxy_pass directive; when the proxy_pass directive specifies the name of the upstream block in the nginx to be analyzed, the target address is the address specified by the server directive in the upstream block; When the target address is the address of an application server used to process business logic, the target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

[0059] Optionally, the second drawing module is further used for: When the target address is the address of the business nginx, the business nginx is taken as a new nginx to be analyzed, and the steps of determining the target server block used to process the target domain name from the nginx to be analyzed and determining the target address associated with the target server block are repeated until the latest determined target address is the address of the application server used to process the business logic. The newly determined target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

[0060] Optionally, when the second drawing module performs the step of determining the target address associated with the target server block, it is specifically used for: Obtain the tree index structure of the nginx to be analyzed; wherein, the tree index structure includes multiple indexes, each index including: the identifier of the server block, a server_name of the server block, and an object specified by the proxy_pass directive in the root location of the server block, wherein the object is an address or the name of the upstream block; Obtain the target server_name that matches the target domain name in the target server block, and determine the target object that has an index relationship with the identifier of the target server block and the target server_name from the index of the tree index structure; When the target object is an address, that address is used as the target address; When the target object is the name of an upstream block, the address specified by the server directive in the upstream block is used as the target address.

[0061] Optionally, when the second drawing module executes the step of obtaining the target server_name that matches the target domain name in the target server block, it is specifically used for: Retrieve all server_names of the target server block; Using a preset regular expression matching algorithm, filter out the server_names that are related to the target domain name from the obtained server_names; Try to determine the server_name that is exactly the same as the target domain name from the filtered server_names; If a server_name that is completely identical to the target domain name is determined, then that server_name is used as the target server_name. If no server_name that is completely identical to the target domain name is found, the server_name with the highest similarity to the target domain name is selected from the filtered server_names and used as the target server_name.

[0062] Optionally, the device further includes: The detection module is used to detect the complete topology map of the traffic forwarding path drawn; Alarm module, used for: An alarm is generated when the complete topology map of the traffic forwarding path includes both the complete topology map of the domestic traffic forwarding path and the complete topology map of the overseas traffic forwarding path, and the terminating topology nodes in the internal network topology maps of the two are inconsistent. An alarm message is generated when a loop path exists in the complete topology of the traffic forwarding path; An alarm is generated when there are multiple topology nodes representing public network entry points in the complete topology graph of the traffic forwarding path, and the next topology node pointed to by these multiple topology nodes is different. An alarm message is generated when any one or more topology nodes in the complete topology graph of the traffic forwarding path point to a service node that goes down.

[0063] Example 3 This embodiment also provides a computer device, such as a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including a standalone server or a server cluster composed of multiple servers), etc., capable of executing programs. Figure 5 As shown, the computer device 50 in this embodiment includes, but is not limited to, a memory 501 and a processor 502 that are communicatively connected to each other via a system bus. It should be noted that... Figure 5 Only a computer device 50 with components 501-502 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0064] In this embodiment, the memory 501 (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 501 may be an internal storage unit of the computer device 50, such as the hard disk or memory of the computer device 50. In other embodiments, the memory 501 may also be an external storage device of the computer device 50, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 50. Of course, the memory 501 may include both the internal storage unit and the external storage device of the computer device 50. In this embodiment, the memory 501 is typically used to store the operating system and various application software installed on the computer device 50. In addition, the memory 501 may also be used to temporarily store various types of data that have been output or will be output.

[0065] In some embodiments, processor 502 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 502 is typically used to control the overall operation of computer device 50.

[0066] Specifically, in this embodiment, the processor 502 is used to execute a program for constructing a traffic forwarding path topology map stored in the memory 501.

[0067] For a detailed description of the above method steps, please refer to Example 1. This example will not be repeated here.

[0068] Example 4 This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, App application store, etc., which stores a computer program. When the computer program is executed by a processor, it is used to implement the steps of a method for constructing a traffic forwarding path topology map.

[0069] For a detailed description of the above method steps, please refer to Example 1. This example will not be repeated here.

[0070] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0071] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0072] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0073] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for constructing a traffic forwarding path topology graph, characterized in that, include: Receive the target domain name input by the user; A public network topology diagram is drawn based on the target domain name, showing the public network forwarding path that the traffic takes before entering the internal network; wherein, the starting topology node in the public network topology diagram is the target domain name, and the ending topology node is the address of the entry nginx; At the starting topology node of the public network topology map, continue to draw the internal network topology map of the internal network forwarding path after the traffic enters the internal network, so as to obtain a complete topology map of the traffic forwarding path; wherein, the starting topology node in the internal network topology map is the address of the entry nginx and the ending topology node is the address of the application server used to process business logic. The step of drawing a public network topology diagram based on the target domain name, showing the public network forwarding path the traffic traverses before entering the intranet, includes: The target domain name is constructed as the starting topology node in the public network topology graph; Perform DNS resolution on the target domain name to obtain the next-hop address, construct the next-hop address as a new topology node in the public network topology graph, and draw a directed edge from the starting topology node to the new topology node; Determine whether the new topology node has the address of a public network service node; The drawing ends when the new topology node is not the address of a public network service node; wherein, the new topology node is the terminating topology node in the public network topology graph. When the new topology node is the address of a public network service node, the configuration of the public network service node is queried to obtain the new next-hop address. This new next-hop address is then used to construct a new topology node in the public network topology graph. Directed edges are drawn from the previously constructed topology node to the newly constructed topology node. The process then returns to the step of determining whether the new topology node is the address of a public network service node. This process continues until it is determined that the newly constructed topology node is not the address of a public network service node, at which point the drawing process ends. The newly constructed topology node is the terminating topology node in the public network topology graph.

2. The method for constructing a traffic forwarding path topology map according to claim 1, characterized in that, At the starting node of the public network topology map, the internal network topology map is further drawn, showing the internal network forwarding path that traffic takes after entering the internal network, to obtain a complete topology map of the traffic forwarding path, including: The entry nginx is used as the nginx to be analyzed, and the target server block used to process the target domain name is determined from the nginx to be analyzed. Determine the target address associated with the target server block; wherein, when the proxy_pass directive in the root location of the target server block specifies an address, the target address is the address specified by the proxy_pass directive; when the proxy_pass directive specifies the name of the upstream block in the nginx to be analyzed, the target address is the address specified by the server directive in the upstream block; When the target address is the address of an application server used to process business logic, the target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

3. The method for constructing a traffic forwarding path topology map according to claim 2, characterized in that, The step of drawing an internal network topology map at the starting node of the public network topology map, showing the internal network forwarding path of traffic after it enters the internal network, to obtain a complete topology map of the traffic forwarding path, also includes: When the target address is the address of the business nginx, the business nginx is taken as a new nginx to be analyzed, and the steps of determining the target server block used to process the target domain name from the nginx to be analyzed and determining the target address associated with the target server block are repeated until the latest determined target address is the address of the application server used to process the business logic. The newly determined target address is constructed as the endpoint topology node of the intranet topology graph, and directed edges from the starting topology node to the endpoint topology node are drawn to obtain the complete topology graph of the traffic forwarding path.

4. The method for constructing a traffic forwarding path topology map according to claim 2 or 3, characterized in that, Determining the target address associated with the target server block includes: Obtain the tree index structure of the nginx to be analyzed; wherein, the tree index structure includes multiple indexes, each index including: the identifier of the server block, a server_name of the server block, and an object specified by the proxy_pass directive in the root location of the server block, wherein the object is an address or the name of the upstream block; Obtain the target server_name that matches the target domain name in the target server block, and determine the target object that has an index relationship with the identifier of the target server block and the target server_name from the index of the tree index structure; When the target object is an address, that address is used as the target address; When the target object is the name of an upstream block, the address specified by the server directive in the upstream block is used as the target address.

5. The method for constructing a traffic forwarding path topology map according to claim 4, characterized in that, The step of obtaining the target server_name that matches the target domain name in the target server block includes: Retrieve all server_names of the target server block; Using a preset regular expression matching algorithm, filter out the server_names that are related to the target domain name from the obtained server_names; Try to determine the server_name that is exactly the same as the target domain name from the filtered server_names; If a server_name that is completely identical to the target domain name is determined, then that server_name is used as the target server_name. If no server_name that is completely identical to the target domain name is found, the server_name with the highest similarity to the target domain name is selected from the filtered server_names and used as the target server_name.

6. The method for constructing a traffic forwarding path topology map according to claim 1, characterized in that, The method further includes: The complete topology map of the traffic forwarding paths was detected and drawn. An alarm is generated when the complete topology map of the traffic forwarding path includes both the complete topology map of the domestic traffic forwarding path and the complete topology map of the overseas traffic forwarding path, and the terminating topology nodes in the internal network topology maps of the two are inconsistent. An alarm message is generated when a loop path exists in the complete topology of the traffic forwarding path; An alarm is generated when there are multiple topology nodes representing public network entry points in the complete topology graph of the traffic forwarding path, and the next topology node pointed to by these multiple topology nodes is different. An alarm message is generated when any one or more topology nodes in the complete topology graph of the traffic forwarding path point to a service node that goes down.

7. A device for constructing a traffic forwarding path topology map, characterized in that, include: The receiving module is used to receive the target domain name input by the user; The first drawing module is used to draw a public network topology map of the public network forwarding path that traffic passes through before entering the intranet based on the target domain name; wherein, the starting topology node in the public network topology map is the target domain name and the ending topology node is the address of the entry nginx; The second drawing module is used to continue drawing the intranet topology map of the intranet forwarding path that traffic passes through after entering the intranet at the starting topology node of the public network topology map, so as to obtain a complete topology map of the traffic forwarding path; wherein, the starting topology node in the intranet topology map is the address of the entry nginx and the ending topology node is the address of the application server used to process business logic. Specifically, the first drawing module is used for: The target domain name is constructed as the starting topology node in the public network topology graph; Perform DNS resolution on the target domain name to obtain the next-hop address, construct the next-hop address as a new topology node in the public network topology graph, and draw a directed edge from the starting topology node to the new topology node; Determine whether the new topology node has the address of a public network service node; The drawing ends when the new topology node is not the address of a public network service node; wherein, the new topology node is the terminating topology node in the public network topology graph. When the new topology node is the address of a public network service node, the configuration of the public network service node is queried to obtain the new next-hop address. This new next-hop address is then used to construct a new topology node in the public network topology graph. Directed edges are drawn from the previously constructed topology node to the newly constructed topology node. The process then returns to the step of determining whether the new topology node is the address of a public network service node. This process continues until it is determined that the newly constructed topology node is not the address of a public network service node, at which point the drawing process ends. The newly constructed topology node is the terminating topology node in the public network topology graph.

8. A computer device, the computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it is used to implement the steps of the method according to any one of claims 1 to 6.

Images