Network analysis method, system and device, computer equipment and storage medium

Abstract

The invention relates to a network analysis method, system and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring network detection data generated by target end equipment; the network detection data is data generated according to a transmission result of the detection message on a network link from the source end equipment to the destination end equipment; based on the network detection data obtained from the same source end device to the same destination end device through each network link, analyzing the network quality from the source end device to the destination end device, and respectively obtaining the network quality from each source end device to the same destination end device; based on the network quality from each source end device to the same destination end device, determining the device quality of an intermediate network device associated with the destination end device; the destination is the intermediate network equipment associated with the destination end equipment through which each network link of the destination end equipment passes. By adopting the method, the identification accuracy of the abnormal equipment in the network can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a network analysis method, system, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] With the development of computer technology, more and more businesses are migrating to the network to operate online. To maintain the healthy operation of the network, normal communication between servers is particularly important.

[0003] Traditional techniques probe network links by sending a message from the source, receiving a response from the destination, and then receiving and reporting the result from the source. This process requires a round trip for the probe message. However, in real-world network environments, the "outbound" and "inbound" routes of probe messages do not necessarily follow the same network link. Consequently, traditional methods often fail to accurately locate abnormal devices within the network link. Summary of the Invention

[0004] Therefore, it is necessary to provide a network analysis method, system, device, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of identifying abnormal devices in a network, in order to address the above-mentioned technical problems.

[0005] This application provides a network analysis method, including:

[0006] Acquire network probe data generated by the destination device; the network probe data is generated based on the transmission results of probe packets on the network link from the source device to the destination device.

[0007] Based on network probe data obtained from the same source device to the same destination device through various network links, the network quality from the source device to the destination device is analyzed, and the network quality from each source device to the same destination device is obtained respectively.

[0008] Based on the network quality from each source device to the same destination device, the device quality of the intermediate network devices associated with the destination device is determined; each network link destined for the destination device passes through the intermediate network devices associated with the destination device.

[0009] This application also provides a network analysis system, including a data analysis platform and a destination device;

[0010] The destination device is used to generate network probe data based on the transmission result of probe messages on the network link from the source device to the destination device, and upload the network probe data to the data analysis platform.

[0011] The data analysis platform is used to analyze the network quality from the source device to the destination device based on network probe data obtained from the same source device to the same destination device through various network links, and obtain the network quality from each source device to the same destination device respectively; based on the network quality from each source device to the same destination device, determine the device quality of the intermediate network devices associated with the destination device; and determine the intermediate network devices associated with the destination device through which each network link to the destination device passes.

[0012] This application also provides a network analysis apparatus, comprising:

[0013] The data acquisition module is used to acquire network probe data generated by the destination device; the network probe data is generated based on the transmission results of probe packets on the network link from the source device to the destination device.

[0014] The network quality analysis module is used to analyze the network quality from the source device to the destination device based on the network probe data obtained from each network link from the same source device to the same destination device, and obtain the network quality from each source device to the same destination device.

[0015] The device quality analysis module is used to determine the device quality of intermediate network devices associated with the destination device based on the network quality from each source device to the same destination device; and to determine the intermediate network devices associated with the destination device through which each network link to the destination device passes.

[0016] This application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps described in the network analysis method above.

[0017] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps described in the network analysis method above.

[0018] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps described in the network analysis method above.

[0019] The aforementioned network analysis methods, systems, devices, computer equipment, storage media, and computer program products acquire network probe data generated by the destination device. This network probe data is generated based on the transmission results of probe packets along the network link from the source device to the destination device. Based on the network probe data obtained from the same source device to the same destination device through various network links, the network quality from the source device to the destination device is analyzed, and the network quality from each source device to the same destination device is obtained. Based on the network quality from each source device to the same destination device, the device quality of intermediate network devices associated with the destination device is determined. Each network link destined for the destination device passes through intermediate network devices associated with the destination device. In this way, by probing network links through source-end transmission and destination-end reception and generation of network probe data, probe packets only need to be transmitted from the source to the destination, reducing interference from the backhaul link and helping to accurately locate abnormal network devices in the network link. Analyzing network probing data obtained from various network links from the same source device to the same destination device can improve the accuracy of network quality analysis. Furthermore, by analyzing the network quality from each source device to the same destination device, the device quality of intermediate network devices associated with the destination device can be determined, reducing interference from source devices and effectively ensuring the accuracy of intermediate network device quality. Based on device quality, abnormal intermediate network devices can be identified, thereby improving the accuracy of identifying abnormal devices in the network. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a diagram illustrating the application environment of the network analysis method in one embodiment;

[0022] Figure 2 This is a flowchart illustrating a network analysis method in one embodiment;

[0023] Figure 3 This is a schematic diagram illustrating the transmission of a probe message from the source device to the destination device in one embodiment.

[0024] Figure 4 This is a schematic diagram illustrating periodic probing via IP and port in one embodiment;

[0025] Figure 5This is a flowchart illustrating the network analysis method in another embodiment;

[0026] Figure 6 This is a schematic diagram illustrating how a data analysis platform processes raw data uploaded by a destination device in one embodiment.

[0027] Figure 7 This is a flowchart illustrating the network analysis method in another embodiment;

[0028] Figure 8 This is a system diagram of a network analysis system in one embodiment;

[0029] Figure 9 This is a system diagram of the network analysis system in another embodiment;

[0030] Figure 10 This is a flowchart illustrating a network quality detection method in one embodiment;

[0031] Figure 11 This is a schematic diagram illustrating the detection relationship between detection devices in one embodiment;

[0032] Figure 12 This is a schematic diagram of the interface displaying the detection results in one embodiment;

[0033] Figure 13 This is a schematic diagram of the interface for displaying the detection results in another embodiment;

[0034] Figure 14 This is a schematic diagram of the interface for displaying the detection results in another embodiment;

[0035] Figure 15 This is a schematic diagram of the interface for displaying the detection results in another embodiment;

[0036] Figure 16 This is a schematic diagram of the interface for displaying the detection results in another embodiment;

[0037] Figure 17 This is a schematic diagram of the interface for displaying the detection results in another embodiment;

[0038] Figure 18 This is a schematic diagram of a device alarm message in one embodiment;

[0039] Figure 19 This is a block diagram of a network analysis device in one embodiment;

[0040] Figure 20 This is a diagram of the internal structure of a computer device in another embodiment;

[0041] Figure 21 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0043] The network analysis method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, source device 102 communicates with destination device 106 via intermediate network device 104. Source device 102 sends probe messages to destination device 106, and the probe messages reach destination device 106 via at least one intermediate network device 104. Source device 102 is the sender of probe messages, destination device 106 is the receiver of probe messages, and intermediate network device 104 is the relay point for probe messages. Source device 102 and destination device 106 can be terminals or servers. Intermediate network device 104 can be a switch, router, or other network device. Network devices are used to establish communication between terminals, between servers, and between terminals and servers. Destination device 106 can communicate with data analysis platform 108. Destination device 106 can upload network probe data to data analysis platform 108. Data analysis platform 108 can be a terminal or a server.

[0044] The terminals can be, but are not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle systems. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. Servers can be implemented using independent servers, server clusters composed of multiple servers, or cloud servers.

[0045] Both the terminal and the server can be used independently to execute the network analysis method provided in the embodiments of this application.

[0046] For example, the destination device can be used independently to execute the network analysis method provided in the embodiments of this application. The destination device generates network probe data based on the transmission results of probe packets on the network link from the source device to the destination device. The destination device acquires multiple locally generated network probe data, and analyzes the network quality from the source device to the destination device based on the network probe data obtained from the same source device to the same destination device through various network links, obtaining the network quality from each source device to the same destination device. Based on the network quality from each source device to the same destination device, the destination device determines the device quality of the intermediate network devices associated with the destination device. Each network link destined for the destination device passes through the intermediate network devices associated with the destination device.

[0047] For example, the data analysis platform can be used independently to execute the network analysis method provided in the embodiments of this application. The data analysis platform acquires network probe data uploaded by the destination device. Based on the network probe data obtained from the same source device to the same destination device through various network links, the data analysis platform analyzes the network quality from the source device to the destination device, obtaining the network quality from each source device to the same destination device. Based on the network quality from each source device to the same destination device, the data analysis platform determines the device quality of the intermediate network devices associated with the destination device.

[0048] Of course, the terminal and server can also work together to execute the network analysis method provided in the embodiments of this application.

[0049] It is understood that "multiple" in this application can be at least two, and "multiple clauses" can be at least two.

[0050] In one embodiment, such as Figure 2 As shown, a network analysis method is provided. Taking the application of this method to a computer device as an example, the computer device can be a terminal or a server. It can be understood that this method can be executed independently by the terminal or server, or it can be implemented through interaction between the terminal and the server. Specifically:

[0051] Step S202: Obtain network probe data generated by the destination device; the network probe data is generated based on the transmission results of probe packets on the network link from the source device to the destination device.

[0052] In this context, the source device is used to send probe messages; that is, the sender of the probe messages. The destination device is used to receive probe messages; that is, the receiver of the probe messages. It can be understood that the same device can function as both a source and a destination device.

[0053] A network link between devices refers to the link used to transmit data between devices. A source device sends a probe message, which travels through the network link from the source device to the destination device before reaching the destination device. The network link from the source device to the destination device is the outbound link for the probe message.

[0054] Probe messages are used to probe the network quality of a network link. Probe messages can be any type of message. However, to reduce network load and unnecessary resource waste, probe messages typically contain a small amount of data; their primary purpose is to probe network quality rather than transmitting data needed by the destination device.

[0055] The source device sends probe packets to the destination device, and the destination device generates network probe data based on the transmission result of the probe packets. It can be understood that traditional technology involves the source sending, the destination responding, and the source receiving and generating network probe data, while this application involves the source sending, the destination receiving, and the destination generating network probe data. In this application, the probe packet only needs to be transmitted in one direction (from the source to the destination) between the source and destination, while in traditional technology, the probe packet needs to be transmitted round trip. This application reduces interference on the return link of the probe packet, enabling more accurate location of network faults on the outgoing link.

[0056] The destination device calculates network probe data based on the received information and the transmitted information carried in the probe packets. The transmitted information in the probe packets indicates the transmission status of the probe packets. For example, the transmitted information includes the transmission time of the probe packets. The received information in the probe packets indicates the reception status of the probe packets. For example, the received information includes the reception time of the probe packets and the amount of data received. Network probe data is generated based on the received and transmitted information of the probe packets, and this network probe data is used to evaluate network quality. For example, network probe data includes data such as packet loss rate, latency, and unreachability rate of the probe packets.

[0057] Specifically, the source device sends probe packets to the destination device, and the destination device calculates network probe data based on the transmission results of the probe packets. Computer devices acquire network probe data locally or from other devices, analyze the network quality of the network link based on the network probe data, and then identify abnormal devices in the network link.

[0058] In one embodiment, the source device sends probe packets to the destination device according to a probe cycle, meaning the source device periodically initiates probes against the destination device. For example, a probe cycle could be every 1 second, every 10 seconds, or every minute. Correspondingly, the destination device can calculate network probe data according to the probe cycle. For example, if a probe cycle is 10 seconds, and the destination device does not receive a probe packet within 10 seconds, the packet loss rate in the network probe data for that cycle is 100%, and the latency is 0. If the source device needs to send 5 data packets to the destination device in one probe cycle, the source device can send all 5 data packets to the destination device at once using a single probe packet. The destination device can then calculate the network probe data for one probe cycle based on the transmission result of that single probe packet. Alternatively, the source device can send the 5 data packets to the destination device in batches using multiple probe packets. The destination device can then calculate the network probe data for one probe cycle based on the transmission results of the multiple probe packets.

[0059] It is understandable that if the target device calculates network probe data in units of probe cycles, the subsequent computer equipment can analyze network quality and equipment quality in units of probe cycles.

[0060] Step S204: Based on the network probe data obtained from the same source device to the same destination device through various network links, analyze the network quality from the source device to the destination device, and obtain the network quality from each source device to the same destination device.

[0061] Specifically, there can be multiple network links from the same source device to the same destination device. At least one probe packet can be transmitted through a single network link; therefore, multiple network probe data can be obtained from the same source device to the same destination device. The network link is identified by the 5-tuple information in the probe packet. Different network links correspond to different 5-tuple information, and probe packets with the same 5-tuple information are often hashed to the same link in the network.

[0062] Computer equipment can analyze network quality from a source device to a destination device based on network probe data obtained through various network links. For example, by statistically analyzing multiple network probe data points obtained from the same source device to the same destination device through various network links, a comprehensive network probe data point is obtained. The network quality from the source device to the destination device is then analyzed based on this comprehensive network probe data. To further illustrate, suppose the network links from source device A to destination device B include network link 1 and network link 2. Packet loss rate 1 is calculated based on the transmission results of probe packets on network link 1, and packet loss rate 2 is calculated based on the transmission results of probe packets on network link 2. Packet loss rate 1 and packet loss rate 2 are the network probe data. The average of packet loss rate 1 and packet loss rate 2 is calculated; this average is the comprehensive network probe data. If the average of packet loss rate 1 and packet loss rate 2 exceeds a preset threshold, the network quality from the source device to the destination device is determined to be abnormal.

[0063] For example, based on multiple network probe data obtained from the same source device to the same destination device via the same network link, the link quality of the network links is analyzed to obtain the link quality of each network link from the same source device to the same destination device. The network quality from the source device to the destination device is then analyzed based on the link quality of each network link. To further illustrate, suppose the network links from source device A to destination device B include network link 1, network link 2, and network link 3. Packet loss rate 1 is calculated based on the transmission results of probe packets on network link 1, packet loss rate 2 is calculated based on the transmission results of probe packets on network link 2, and packet loss rate 3 is calculated based on the transmission results of probe packets on network link 3. Packet loss rates 1, 2, and 3 are the network probe data. If the packet loss rate exceeds a preset threshold, the link quality of the network link is determined to be abnormal. If the link quality of more than a preset number of network links from source device A to destination device B is abnormal, the network quality from the source device to the destination device is determined to be abnormal.

[0064] Different source devices can send probe packets to the same destination device. Therefore, through data analysis, computer equipment can obtain the network quality from each source device to the same destination device.

[0065] It is understood that there can be multiple source devices and multiple destination devices. For different destination devices, probe messages can be sent through different source devices or through the same source device; this application does not impose any restrictions on this.

[0066] Step S206: Based on the network quality from each source device to the same destination device, determine the device quality of the intermediate network devices associated with the destination device; each network link destined for the destination device passes through the intermediate network devices associated with the destination device.

[0067] Intermediate network devices serve as relay points for probe messages. The intermediate network devices associated with the destination device are those through which probe messages must pass before reaching the destination device. Each network link destined for the destination device passes through the intermediate network devices associated with that destination device.

[0068] Specifically, probe packets are sent from multiple source devices to the same destination device, and these probe packets pass through intermediate network devices associated with the destination device. To probe the device quality of these intermediate network devices, the computer can determine the device quality of the intermediate network devices associated with the destination device based on the network quality from each source device to the same destination device. For example, for the same destination device, if the network quality from more than a first preset number of source devices to the destination device is abnormal, then the device quality of the intermediate network devices associated with the destination device is determined to be abnormal. Alternatively, quality can be represented by a score; a score below a preset threshold indicates an anomaly. Based on the network probe data obtained from each network link from the same source device to the same destination device, a network quality score from the source device to the destination device is calculated. The average of these network quality scores from each source device to the same destination device is then used to obtain the device quality score of the intermediate network devices associated with the destination device.

[0069] It is understandable that network quality anomalies from the source device to the destination device may be due to a fault in the source device. In this application, by comprehensively analyzing the network quality from each source device to the same destination device and the device quality of intermediate network devices associated with the destination device, the interference from source device anomalies is reduced, and the device anomalies of intermediate network devices associated with the destination device in the outbound link can be more accurately located.

[0070] In one embodiment, a single intermediate network device can be associated with multiple destination devices. For the same intermediate network device, its device quality is determined based on the network quality from multiple source devices to multiple destination devices associated with that intermediate network device. For example, if the network quality of more than a second preset number of source-destination device combinations corresponding to the same intermediate network device is abnormal, then the intermediate network device is determined to have abnormal device quality. A source device and a destination device constitute a source-destination device combination. The source-destination device combination corresponding to an intermediate network device refers to the combination where the destination device is associated with the intermediate network device.

[0071] It is understandable that network quality anomalies from the source device to the destination device may be due to an anomaly in the destination device. In this application, the network quality of multiple destination devices associated with the same intermediate network device from multiple source devices is analyzed, thereby reducing interference from anomalies in the destination device and enabling more accurate location of anomalies in intermediate network devices associated with the destination device in the outbound link.

[0072] In one embodiment, based on the network quality from multiple source devices to the same destination device, a first device quality of intermediate network devices associated with the destination device is determined, resulting in multiple first device qualities of the intermediate network devices. For example, quality can be represented by a score, and the average of the network quality scores from multiple source devices to the same destination device is used to obtain a first device quality score. As another example, if the network quality from more than a first preset number of source devices to the same destination device is abnormal, then the first device quality of the intermediate network devices associated with the destination device is determined to be abnormal. It can be understood that there can be multiple destination devices associated with the same intermediate network device, therefore there can be multiple first device qualities.

[0073] Based on the network quality of multiple destination devices associated with the same source device and the same intermediate network device, a second device quality of the intermediate network device is determined, resulting in multiple second device quality values ​​for the intermediate network device. For example, quality can be represented by a score; the average of the network quality scores of the multiple destination devices associated with the same source device and the same intermediate network device is used to obtain the second device quality score. Another example is that if the network quality of more than a second preset number of source-destination device combinations corresponding to the same intermediate network device is abnormal, then the second device quality of the intermediate network device is determined to be abnormal. It can be understood that there can be multiple source devices, therefore there can be multiple second device quality values.

[0074] Based on the quality of each first device and each second device within the same intermediate network device, the target device quality of the intermediate network device is determined. The target device quality is the final device quality. For example, if more than a third preset number of device qualities among the first and second device qualities are considered abnormal, then the target device quality of the intermediate network device is determined to be abnormal. Alternatively, quality can be represented by a score. The target device quality score is obtained by averaging the scores of each first and second device quality. If the target device quality score is lower than a preset threshold, it indicates that the intermediate network device has experienced a device abnormality.

[0075] In this way, by combining the first and second device quality of intermediate network devices to determine the final device quality of intermediate network devices, interference from anomalies in source and destination devices can be reduced, and device anomalies in intermediate network devices associated with destination devices in the outbound link can be located more accurately.

[0076] In one embodiment, the source device and the destination device belong to different regions. Communication between devices in different regions is often achieved through intermediate network devices. The intermediate network device associated with the source device enables communication between the source device and other regions, and the intermediate network device associated with the destination device enables communication between the destination device and other regions. (See reference) Figure 3 The source device and the destination device are associated with each other. The source device sends a probe packet to the destination device. The probe packet first passes through the intermediate network devices associated with the source device, then through the intermediate network devices associated with the destination device, and finally reaches the destination device. In this application, the network quality from each source device to the same destination device is comprehensively analyzed, along with the device quality of the intermediate network devices associated with the destination device. This reduces interference from anomalies in the source device and allows for more accurate location of device anomalies in the intermediate network devices associated with the destination device in the outbound link.

[0077] In the aforementioned network analysis method, network links are probed by sending data from the source end and receiving and generating network probe data at the destination end. Probe packets only need to be transmitted from the source end to the destination end, reducing interference from the backhaul link and facilitating accurate location of abnormal network devices within the network link. Analyzing the network quality from the source end to the destination end based on network probe data obtained through various network links from the same source end device improves the accuracy of network quality assessment. Furthermore, determining the device quality of intermediate network devices associated with the destination end device based on the network quality from each source end device to the same destination end device reduces interference from the source end device and effectively ensures the accuracy of intermediate network device quality. Based on device quality, abnormal intermediate network devices can be identified, thereby improving the accuracy of identifying abnormal devices in the network.

[0078] In one embodiment, the network analysis method further includes:

[0079] Acquire at least one detection device in each region; each detection device is associated with an intermediate network device.

[0080] Two detection devices belonging to different regions are designated as source and destination devices, respectively. Multiple detection ports of the source and destination devices are paired to obtain the link information of multiple network links from the source to the destination devices.

[0081] Based on the link information of each network link, a network probe task is sent to the source device, so that the source device can send probe packets to the destination device through the corresponding network link based on the network probe task.

[0082] In this system, at least one detection device is deployed in each area. This detection device can be a terminal or a server. The detection devices are associated with intermediate network devices. Communication between devices in different areas is achieved through these associated intermediate network devices.

[0083] A probe device includes multiple network ports. Multiple probe ports are selected from these network ports to transmit probe packets; therefore, one probe device corresponds to multiple probe ports. It can be understood that probe ports can be selected from the network ports as needed.

[0084] The link information of a network link includes the probe port of the source device and the probe port of the destination device in the network link. Furthermore, the link information also includes the device identifier of the source device and the device identifier of the destination device in the network link. This link information is a crucial component of the five-tuple information in a probe packet.

[0085] A network probe task corresponding to a network link instructs the source device in the network link on how to send probe packets. The network probe task includes link information of the network link, so that the source device knows from which network port to which network port of which destination device to send probe packets. Furthermore, the network probe task may also include a probe period, so that the source device knows the probe frequency for sending probe packets. The network probe task may also include the data transmission volume within a probe period, so that the source device knows how many data packets need to be sent within a probe period.

[0086] Specifically, the computer equipment can acquire the detection equipment in each area, assign network detection tasks to the detection equipment in each area, and the detection equipment in one area is responsible for sending detection messages to the detection equipment in another area.

[0087] The computer equipment identifies two probe devices belonging to different regions as the source and destination devices, respectively, thus assigning them to different regions. The computer equipment pairs multiple probe ports of the source and destination devices, obtaining link information for multiple network links from the source to the destination device based on the pairing results. Each probe port pair includes one probe port from both the source and destination devices, representing one network link from the source to the destination device. Multiple probe port pairs represent multiple network links from the source to the destination device. Then, based on the link information of each network link, the computer equipment sends a network probe task to the source device. The source device, based on the network probe task, sends probe packets to the destination device through the corresponding network link.

[0088] For example, refer to Figure 4 The source device's IP address (source IP) is 1.1.1.1, and the destination device's IP address (destination IP) is 2.2.2.2. The source device's six probe ports form a source port list, and the destination device's six probe ports form a destination port list. The source device uses any one of the source port lists to perform a one-way probe to any one of the destination port lists on the destination device. A probe logical relationship (i.e., link information) like 1.1.1.1:16001 → 2.2.2.2:16012 represents a probe flow. Up to 36 probe flows can be formed from the source device to the destination device, covering 36 links in the network. The source device continuously sends probe packets to the destination device. Probe packets with the same 5-tuple often hash to the same link in the network, forming a continuous stream of packets; this stream is called a probe flow.

[0089] In the above embodiments, two probe devices belonging to different regions are designated as source and destination devices, respectively. The source device sends probe messages to the destination device, thereby enabling the detection of connectivity between different regions. Multiple probe ports of the source and destination devices are paired to obtain link information for multiple network links from the source to the destination device. A pair of devices can generate multiple probe streams through designated ports, covering multiple links in the network. This allows for coverage of more links in the network with a small number of devices, effectively reducing deployment pressure and conserving device resources.

[0090] In one embodiment, the network analysis method further includes:

[0091] Obtain an idle port of the detection device as the detection port of the detection device.

[0092] Specifically, to conserve equipment resources, devices with other uses can be used as probe devices, thereby reducing or avoiding the deployment of new devices and improving the utilization rate of existing equipment. To avoid conflicts between different tasks performed by the same device, idle ports of the probe devices can be acquired and used as probe ports to deploy network probe tasks.

[0093] In the above embodiments, obtaining the idle port of the detection device as the detection port of the detection device can improve the device utilization rate of the existing device.

[0094] In one embodiment, such as Figure 5 As shown, based on network probe data obtained from various network links from the same source device to the same destination device, the network quality from the source device to the destination device is analyzed, and the network quality from each source device to the same destination device is obtained, including:

[0095] Step S502: Statistically analyze the network probe data obtained from the same source device to the same destination device through multiple network links, and obtain the comprehensive network probe data corresponding to each source device to the same destination device.

[0096] Among them, comprehensive network probe data is data obtained by statistically analyzing multiple network probe data. For example, the average value of multiple network probe data is calculated to obtain comprehensive network probe data; the median value is obtained from multiple network probe data as comprehensive network probe data; and so on.

[0097] Specifically, there are multiple network links from the same source device to the same destination device. The source device sends probe packets to the destination device through different network links. Therefore, the destination device can generate network probe data corresponding to each of the multiple network links. The computer can then analyze the network probe data obtained from each of the multiple network links from the same source device to the same destination device to obtain the comprehensive network probe data. Conversely, different source devices can send probe packets to the same destination device. By analyzing the network probe data, the computer can obtain the comprehensive network probe data corresponding to each source device's connection to the same destination device.

[0098] Step S504: Based on the comprehensive network detection data, analyze the network quality from the source device to the destination device, and obtain the network quality from each source device to the same destination device.

[0099] Specifically, computer equipment analyzes network quality from source devices to destination devices based on comprehensive network probing data. For example, it compares the comprehensive network probing data with preset network probing data and determines the network quality from the source devices to the destination devices based on the comparison results. Different source devices can send probe packets to the same destination device, and by analyzing the comprehensive network probing data, the computer equipment can obtain the network quality from each source device to the same destination device.

[0100] In the above embodiments, network probe data obtained from multiple network links from the source device to the destination device are statistically analyzed to obtain comprehensive network probe data from the source device to the destination device. Comprehensive network probe data has higher accuracy. Analyzing the network quality from the source device to the destination device based on comprehensive network probe data can improve the accuracy of network quality analysis, which in turn helps to improve the accuracy of subsequent device quality analysis.

[0101] In one embodiment, network probe data obtained from multiple network links from the same source device to the same destination device are statistically analyzed to obtain comprehensive network probe data corresponding to each source device to the same destination device, including:

[0102] Based on the sending time of the probe messages carried in the network probe data, the corresponding probe period is determined.

[0103] Based on the device identifiers for the source and destination devices carried in the network probe data, the service label corresponding to the network probe data is determined; each network link from the same source device to the same destination device corresponds to the same service label;

[0104] By statistically analyzing the network probe data corresponding to the same business tag and the same probe period, comprehensive network probe data corresponding to each source device and the same destination device within the same probe period can be obtained.

[0105] The network probe data includes the transmission time of the probe packets. This transmission time refers to the time the probe packets were sent by the source device; in other words, the packet transmission time. The network probe data also carries device identifiers for both the source and destination devices. For example, the device identifier could be the device's IP address.

[0106] Service tags corresponding to network probe data are used to distinguish different probe device pairs. Each network link from the same source device to the same destination device corresponds to the same service tag; that is, a source-destination device combination corresponds to one service tag. Different service tags can be for different source devices or different destination devices.

[0107] Specifically, after obtaining network probe data generated by the target device, the computer device can classify the network probe data for subsequent data statistics.

[0108] Computer equipment can determine the detection period corresponding to network probe data based on the transmission time of probe packets in the network probe data. For example, if the network probe task specifies that probe packets are sent starting at 4 o'clock, with each probe period lasting 10 seconds, then if the transmission time of the probe packets carried in the network probe data falls within [4 o'clock, 4:00:10), the detection period corresponding to this network probe data is the first detection period. If the transmission time of the probe packets carried in the network probe data falls within [4:00:30, 4:00:40), the detection period corresponding to this network probe data is the fourth detection period.

[0109] Computer equipment can determine the service label corresponding to the network probe data based on the device identifiers for the source and destination devices carried in the network probe data, so that each network link from the same source device to the same destination device corresponds to the same service label. For example, the device identifiers of the source and destination devices can be combined to form the service label; or the device identifiers of the source and destination devices, along with the region identifiers of the regions to which the source and destination devices belong, can be combined to form the service label.

[0110] At the end of a probing period, or even if the current probing period has not ended but network probe data from the same source device to the same destination device has been acquired within the current probing period, or when other events trigger the initiation of network probe data statistics, the computer device can collect and summarize the network probe data corresponding to the same service tag and the same probing period. This results in comprehensive network probe data for the same source device to the same destination device within the same probing period. If there are multiple source devices, the computer device can ultimately obtain comprehensive network probe data for each source device to the same destination device within the same probing period.

[0111] In the above embodiments, network detection data from the same source device to the same destination device within the same time period can be quickly summarized based on service tags and detection cycles to obtain comprehensive network detection data, thereby improving data processing efficiency.

[0112] In one embodiment, based on the device identifiers for the source and destination devices carried in the network probe data, the service tag corresponding to the network probe data is determined, including:

[0113] Based on the device identifier for the source device carried in the network detection data, obtain the region identifier of the region to which the source device belongs;

[0114] Based on the device identifier for the target device carried in the network probe data, obtain the region identifier of the region to which the target device belongs, and the device identifier of the intermediate network device associated with the target device.

[0115] Based on the region identifiers of the regions to which the source and destination devices belong, and the device identifiers of the intermediate network devices associated with the destination device, service tags corresponding to the network probe data are generated.

[0116] The device identifier is used to identify the device; for example, the device's IP address can be used as the device identifier. The region identifier is used to identify the region; for example, the region name can be used as the region identifier, or the region number can be used as the region identifier.

[0117] Specifically, after acquiring network probe data, the computer device can query the region to which the source device belongs based on the device identifier carried in the network probe data, obtaining the region identifier of the region to which the source device belongs; query the region to which the destination device belongs based on the device identifier carried in the network probe data, obtaining the region identifier of the region to which the destination device belongs; and query the intermediate network devices associated with the destination device based on the device identifier carried in the network probe data, obtaining the device identifier of the intermediate network devices associated with the destination device. Then, the computer device combines the region identifiers of the respective regions to which the source and destination devices belong, and the device identifier of the intermediate network devices associated with the destination device, to form a service tag corresponding to the network probe data.

[0118] In the above embodiments, the region identifiers of the respective regions of the source and destination devices corresponding to the network probe data, and the device identifiers of the intermediate network devices associated with the destination device, are used to generate service tags corresponding to the network probe data. These service tags allow for quick differentiation of network probe data targeting different objectives, helping to ensure the statistical accuracy of network probe data when compiling statistics.

[0119] In a specific application, the source device sends probe packets to the destination device through multiple network links. The probe packet carries the source IP, source port, destination IP, destination port, and time (i.e., transmission time). The destination device calculates network probe data based on the transmission results of the probe packets, obtaining the packet loss value (i.e., packet loss rate) and latency value (i.e., delay). The destination device then uploads the network probe data and the information carried in the probe packets to a data analysis platform. (Reference) Figure 6The data analysis platform preprocesses the raw data uploaded by the destination device to obtain processed data. Further, the source campus to which the source IP belongs, the destination campus to which the destination IP belongs, and the network device identifier of the intermediate network device associated with the destination IP are recorded in the raw data. The source campus, destination campus, and network device identifier constitute a service tag. At the end of a probing cycle, the data analysis platform aggregates multiple processed data sets with the same service tag to obtain aggregated data. The average values ​​of packet loss and latency values ​​from the multiple processed data sets with the same service tag can be calculated separately to obtain the packet loss and latency values ​​in the aggregated data.

[0120] In one embodiment, based on comprehensive network probing data, the network quality from the source device to the destination device is analyzed to obtain the network quality from each source device to the same destination device, including:

[0121] For any source device, the comprehensive network detection data from the source device to the destination device in a single detection cycle is compared with the preset network detection data to obtain the data comparison results from the source device to the destination device in multiple detection cycles.

[0122] For any given source device, the network quality from the source device to the destination device is determined based on the data comparison results over multiple probe cycles.

[0123] The preset network probe data for a single probe cycle from the source device to the destination device is a pre-configured network probe data threshold or range. For example, preset network probe data may include packet loss rate thresholds, latency thresholds, and unreachability rate thresholds. It can be understood that different preset network probe data can be configured for different combinations of source and destination devices; that is, different combinations of source and destination devices have their own corresponding preset network probe data.

[0124] Specifically, when analyzing network quality from the source device to the destination device, the computer acquires preset network probe data from the source device to the destination device within a single probe cycle. It then compares the comprehensive network probe data from the source device to the destination device within the single probe cycle with the preset network probe data to obtain data comparison results from the source device to the destination device across multiple probe cycles. For example, the preset network probe data may include alarm thresholds for network probe data; the data comparison results may show comprehensive network probe data greater than the alarm threshold or comprehensive network probe data less than or equal to the alarm threshold. Alternatively, the preset network probe data may include network probe data intervals corresponding to multiple quality levels; the data comparison results may include the quality level corresponding to the network probe data interval to which the comprehensive network probe data belongs. It can be understood that if the network probe data includes multiple indicator data, each indicator data is compared with its corresponding preset threshold or preset interval. For example, the packet loss rate in the comprehensive network probe data is compared with the packet loss rate threshold in the preset network probe data.

[0125] Furthermore, the computer equipment determines the network quality from the source device to the destination device based on data comparison results across multiple probe cycles. For example, for any given probe cycle, if the total network probe data from the source device to the destination device in that cycle is greater than a preset network probe data, then the network quality from the source device to the destination device in that cycle is determined to be abnormal. Alternatively, within a preset number of consecutive probe cycles, the quality level that appears most frequently among the data comparison results from the source device to the destination device is taken as the network quality from the source device to the destination device within that preset number of consecutive probe cycles.

[0126] In the above embodiments, by comparing the comprehensive network detection data from the source device to the destination device with the preset network detection data, the network quality from the source device to the destination device can be quickly determined.

[0127] In one embodiment, for any source device, based on data comparison results from the source device to the destination device over multiple probe cycles, the network quality from the source device to the destination device over multiple probe cycles is determined, including:

[0128] For any source device, if the total number of all detection cycles in which the comprehensive network detection data is greater than the preset network detection data is greater than the second number within a first number of consecutive detection cycles, then the network quality from the source device to the destination device is determined to be abnormal within the first number of consecutive detection cycles; the first number is greater than the second number.

[0129] The first quantity and the second quantity are preset quantity thresholds, with the first quantity being greater than the second quantity. The first quantity and the second quantity can be set as needed.

[0130] Specifically, in order to improve the accuracy of network quality assessment, computer equipment can analyze whether the comprehensive network probe data from the source device to the destination device is frequently abnormal within multiple consecutive probe cycles. If it is frequently abnormal, it is determined that a network anomaly has occurred from the source device to the destination device within these multiple consecutive probe cycles.

[0131] Within a first number of consecutive detection cycles, the total number of detection cycles in which the comprehensive network detection data from the source device to the destination device exceeds the preset network detection data is counted. If the total number of cycles exceeds the second number, the network quality from the source device to the destination device within the first number of consecutive detection cycles is determined to be abnormal.

[0132] For example, assuming the first number is 30 and the second number is 10, if the packet loss rate is greater than the packet loss rate threshold for 10 out of 30 consecutive detection periods, then it is determined that a network anomaly has occurred within these 30 detection periods.

[0133] In the above embodiments, when the total number of detection cycles in which the comprehensive network detection data is greater than the preset network detection data is greater than the second number within the first number of continuous detection cycles, it indicates that the comprehensive network detection data from the source device to the destination device frequently shows anomalies within a certain period of time, thereby determining that a network anomaly has occurred from the source device to the destination device. This can avoid misjudgment due to random errors.

[0134] In one embodiment, determining the device quality of intermediate network devices associated with the destination device based on the network quality from each source device to the same destination device includes:

[0135] If the network quality of the source devices from multiple regions to the same destination device is abnormal during the same probe cycle, it is determined that the intermediate network devices associated with the destination device have abnormal device quality in the corresponding probe cycle.

[0136] Specifically, devices in multiple regions typically do not fail simultaneously. Therefore, if the network quality from source devices in multiple regions to the same destination device is abnormal during the same probe cycle, it can be ruled out that the network abnormality is caused by the source device or an intermediate network device associated with the source device. Thus, when the network quality from source devices in multiple regions to the same destination device is abnormal during the same probe cycle, the computer device can determine that the intermediate network device associated with the destination device has abnormal device quality during the corresponding probe cycle.

[0137] For example, if the network quality of the source devices from at least two regions to the same destination device is abnormal during the same probe cycle, it is determined that the intermediate network devices associated with the destination device have abnormal device quality in the corresponding probe cycle.

[0138] In the above embodiments, when the network quality from source devices in multiple regions to the same destination device in the same detection period is abnormal, it is determined that the intermediate network device associated with the destination device has abnormal device quality in the corresponding detection period, which can ensure the accuracy of the device abnormality judgment.

[0139] In one embodiment, the intermediate network device is responsible for communication between the intranet and the extranet. Both the source device and the destination device are probe devices deployed by the intranet's creator. The source device and the destination device corresponding to the same probe message belong to different regions.

[0140] An intranet, or intranet, is a computer communication network that connects various devices within a localized geographical area (such as within a company, school, or department). Intranets have a relatively small coverage area, limited to a specific region, and are not directly accessible to the outside world. The entity that establishes the intranet is the organization that creates it. For example, an intranet could be established by a company, school, or department.

[0141] An external network is an open computer communication network with a relatively large coverage area. For example, an external network can be the operator network deployed by various operators that provide communication services.

[0142] Specifically, the intermediate network device is responsible for communication between the intranet and the extranet. The intranet creator can deploy the intermediate network device to enable smooth communication between devices within the intranet and those on the extranet. The intermediate network device can be considered the intranet's exit point. The method described in this application allows for monitoring the quality of the intermediate network device, enabling the intranet creator to promptly detect and maintain any device anomalies, ensuring the normal operation of the online services provided by the intranet creator.

[0143] Both the source and destination devices are probe devices deployed by the party establishing the internal network. Traditional technology involves the source sending, the destination responding, and the source receiving and generating network probe data. Traditional technology only deploys the source device, which is responsible for sending probe packets and calculating probe data. In traditional technology, ordinary user equipment is typically chosen as the destination device. However, this application involves the source sending, the destination receiving, and the destination generating network probe data. This application deploys both source and destination devices. The source device is responsible for sending probe packets, and the destination device is responsible for calculating probe data. Therefore, this application can achieve unidirectional probe from the source device to the destination device. Furthermore, the destination device can perform data analysis on its own or upload the network probe data to a data analysis platform for further analysis.

[0144] It is understandable that multiple intermediate network devices can be deployed in a region. If an intermediate network device is found to be abnormal, traffic passing through that intermediate network device can be migrated to other intermediate network devices in the region.

[0145] Communication between various probe devices within the same area can proceed without intermediary network equipment. Therefore, the source and destination devices corresponding to the same probe message belong to different areas. Transmitting probe messages between different areas allows for accurate detection of the equipment quality of intermediate network devices.

[0146] In a specific embodiment, such as Figure 7 As shown, a network analysis method is provided. Wherein:

[0147] In step S702, the data analysis platform acquires multiple detection devices in each region, designates two detection devices belonging to different regions as source devices and destination devices respectively, pairs multiple detection ports of the source devices and destination devices to obtain link information for multiple network links from the source devices to the destination devices.

[0148] In step S704, the data analysis platform sends a network probe task corresponding to the network link to the source device in the network link based on the link information of the network link.

[0149] Step S706: The source device in the network link sends a probe message to the destination device in the network link based on the network probe task.

[0150] Step S708: The destination device in the network link generates network probe data based on the transmission result of the probe message.

[0151] Step S710: The destination device uploads network detection data to the data analysis platform.

[0152] In step S712, the data analysis platform determines the service tag and detection period corresponding to the network detection data, counts the network detection data corresponding to the same service tag and the same detection period, and obtains the comprehensive network detection data corresponding to each source device to the same destination device in the same detection period.

[0153] Step S714: For any source device, the data analysis platform compares the comprehensive network detection data from the source device to the destination device in a single detection cycle with the preset network detection data. If, within the first number of consecutive detection cycles, the comprehensive network detection data for the second number of detection cycles is greater than the preset network detection data, the network quality from the source device to the destination device in the first number of consecutive detection cycles is determined to be abnormal.

[0154] Step S716: When the network quality from source devices in at least two regions to the same destination device is abnormal during the same detection period, the data analysis platform determines that the intermediate network device associated with the destination device has abnormal device quality in the corresponding detection period.

[0155] The aforementioned network analysis method probes network links by sending data from the source end and receiving and generating network probe data at the destination end. Since probe packets only need to be transmitted from the source to the destination, interference from the backhaul link is reduced, which helps to accurately locate abnormal network devices within the network link. Analyzing the network quality from the source to the destination device based on network probe data obtained through various network links from the same source device to the same destination device improves the accuracy of network quality assessment. Furthermore, by determining the network quality from each source device to the same destination device, the device quality of intermediate network devices associated with the destination device is determined, reducing interference from the source device and effectively ensuring the accuracy of intermediate network device quality. Based on device quality, abnormal intermediate network devices can be identified, thereby improving the accuracy of identifying abnormal devices in the network.

[0156] In one embodiment, such as Figure 8 As shown, a network analysis system is provided, which includes a data analysis platform 802 and a destination device 804. Wherein:

[0157] The destination device 802 is used to generate network probe data based on the transmission results of probe messages on the network link from the source device to the destination device, and upload the network probe data to the data analysis platform.

[0158] The data analysis platform 804 is used to analyze the network quality from the source device to the destination device based on network probe data obtained from various network links from the same source device to the same destination device, and to obtain the network quality from each source device to the same destination device; based on the network quality from each source device to the same destination device, to determine the device quality of the intermediate network devices associated with the destination device; and to determine the intermediate network devices associated with the destination device through which each network link to the destination device passes.

[0159] Specifically, the source device sends probe packets to the destination device through various network links. The destination device generates network probe data based on the transmission results of the probe packets and uploads the network probe data to the data analysis platform. The data analysis platform collects the network probe data obtained from the same source device to the same destination device through various network links. Based on this data, it analyzes the network quality from the source device to the destination device, obtaining the network quality from each source device to the same destination device. Furthermore, based on the network quality from each source device to the same destination device, the data analysis platform determines the device quality of the intermediate network devices associated with the destination device.

[0160] It is understood that the analysis process for network quality and the analysis process for device quality can be referred to the content of the aforementioned embodiments, and will not be repeated here.

[0161] In a specific application, refer to Figure 9 The source device sends UDP probe packets (probe packets based on the UDP protocol) to the destination device. The destination device calculates packet loss and latency values ​​based on the transmission results of the UDP probe packets, and summarizes and reports the calculation results and relevant information from the probe packets to the data analysis platform for processing.

[0162] The aforementioned network analysis system probes network links by sending data from the source end and receiving and generating network probe data at the destination end. Probe packets only need to be transmitted from the source to the destination, reducing interference from the backhaul link and facilitating accurate location of abnormal network devices within the network link. Analyzing the network quality from the source to the destination device based on network probe data obtained through various network links from the same source device to the same destination device improves the accuracy of network quality assessment. Furthermore, by analyzing the network quality from each source device to the same destination device, the system determines the device quality of intermediate network devices associated with the destination device, reducing interference from the source device and effectively ensuring the accuracy of intermediate network device quality. Based on device quality, abnormal intermediate network devices can be identified, thereby improving the accuracy of identifying abnormal devices in the network.

[0163] In one embodiment, the data analysis platform is also used to display device alarm messages for the intermediate network device when the device quality of the intermediate network device is abnormal.

[0164] The device alarm messages include parent alarm messages that indicate device anomalies in intermediate network devices and child alarm messages that indicate network anomalies in destination devices associated with the source device to the intermediate network device; the child alarm message is the alarm reason of the parent alarm message.

[0165] Device alarm messages for intermediate network devices are used to notify intermediate network devices of device anomalies. Device alarm messages include parent alarm messages and child alarm messages. The parent alarm message indicates that an intermediate network device has an anomaly. The parent alarm message includes relevant information about the intermediate network device. For example, it includes the device identifier, the region identifier of the area it belongs to, the time of the anomaly, and the anomaly level. If an intermediate network device has associated destination devices, the child alarm message indicates that a network anomaly has occurred from the source device to the associated destination device. The child alarm message is the cause of the parent alarm message. The anomaly in the intermediate network device associated with the destination device was discovered only because a network anomaly occurred from the source device to the destination device. The child alarm message includes relevant information about each source-destination device combination with network quality anomalies. For example, it includes comprehensive network probe data for the source-destination device combination, the time of the network anomaly, and the network anomaly level.

[0166] Specifically, when the data analysis platform detects that the equipment quality of an intermediate network device is abnormal, the data analysis platform can display equipment alarm messages for the intermediate network device so that operation and maintenance personnel can discover and take measures in a timely manner.

[0167] It's understandable that a data analysis platform can be a terminal. The terminal analyzes the network probe data uploaded by the destination device to determine the device quality of the intermediate network devices associated with the destination device. When the intermediate network device's device quality is abnormal, it displays a device alarm message for that intermediate network device. Alternatively, the data analysis platform can include both terminals and a server. The server analyzes the network probe data uploaded by the destination device to determine the device quality of the intermediate network devices associated with the destination device. When the intermediate network device's device quality is abnormal, the server notifies the terminal, and the terminal displays a device alarm message for that intermediate network device. The server can also notify specific personnel's terminals, such as the terminals associated with administrators or maintenance personnel.

[0168] In the above embodiments, when the device quality of the intermediate network device is abnormal, a device alarm message for the intermediate network device is displayed. By displaying the device alarm message, relevant personnel can be notified in a timely manner that the intermediate network device has detected a device abnormality.

[0169] In one embodiment, the data analysis platform is further configured to display a network probe chart corresponding to the intermediate network device in response to a data viewing operation for the intermediate network device; the network probe chart is a chart generated based on network probe data corresponding to the destination device associated with at least one source device to the intermediate network device.

[0170] The data viewing operation for intermediate network devices is an operation triggered on the interface to view network probe data or results related to the intermediate network devices. For example, the data viewing operation involves the user first selecting query conditions such as source campus, destination campus, and probe time on the interface, and then triggering the query control.

[0171] Intermediate network devices have associated destination devices, and the network probe charts corresponding to intermediate network devices are generated based on network probe data from at least one source device to the associated destination devices of the intermediate network devices.

[0172] Specifically, the data analysis platform collects a large amount of network probing data, and users can query the network probing data or the data analysis results on demand. Users can enter query conditions on the terminal interface, and the data analysis platform will obtain relevant network probing data of intermediate network devices that meet the query conditions. Based on the obtained network probing data, it will generate network probing charts that meet the query conditions and display the network probing charts to the user.

[0173] In the above embodiments, the network detection data or the data analysis results of the network detection data are presented in the form of charts, which can facilitate relevant personnel to view them.

[0174] In one specific embodiment, this application provides a specific application scenario: quality monitoring of an intranet egress point. The method described in this application can be applied to this scenario. Internet companies' intranets typically need to support access from a massive number of users, making it crucial to ensure the stability of user access. For example, if an internet company develops a social application, the user's terminal needs to communicate with the internet company's server when accessing the application. Accessing the server requires passing through the internet company's network equipment (which can be called a TIX device). The TIX device serves as the intranet egress point. The method described in this application is a network quality detection method based on unidirectional UDP protocol probing. It performs unidirectional connectivity probing of the target network device using the UDP protocol, covering all links in the network topology by specifying ports. Through source-to-destination and destination-to-receive approach, it achieves high real-time data reporting and can accurately locate faulty network devices based on the direction of the probe flow.

[0175] refer to Figure 10 The network quality detection method based on UDP protocol one-way probing includes the following steps:

[0176] 1. Organize the detection relationships at each level, and determine and distribute network detection tasks to each detection device.

[0177] refer to Figure 11 Internet companies deploy detection equipment in various parks across different cities. To ensure the accuracy of network detection, each city conducts detection independently, with no detection relationships between cities. Within each city, parks conduct detection in a full mesh mode, but there are no detection relationships within the parks themselves. Multiple detection devices can be deployed within a single park.

[0178] 2. The detection equipment in each park initiates detection of the target device based on the UDP protocol.

[0179] The source device is the sender of probe packets, and the destination device is the receiver. The source device specifies a list of source ports, and the destination device also has a list of destination ports. A one-way UDP probe is performed between the source device's source IP address and each source port, and the destination device's destination IP address and each destination port. Each probe stream corresponds to a combination of source IP address, source port, destination IP address, and destination port.

[0180] 3. The detection equipment in each area periodically calculates the detection results to obtain the detection results of all detection streams for the current period.

[0181] 4. Each area's detection equipment will report the detection results of all detection streams in its area to the platform, where the platform will process and summarize the data.

[0182] The source device is responsible for periodically sending UDP probe packets to the destination device. The probe packets do not need to be returned to the source device for calculation. Instead, the results are calculated directly at the destination device, including time, source IP, source port, destination IP, destination port, latency value, packet loss value, etc. These data from a probe stream in one probe cycle are summarized into a message and sent to the upper-layer data analysis platform (also known as the quality probe platform) for processing.

[0183] The UDP probe packets sent by the source device include a packet sending timestamp. When the destination device receives the probe packet, it calculates the packet receiving timestamp. The difference between the two timestamps is the latency value of the probe stream for this probe cycle. If the destination device does not receive any UDP probe packets from the source device in the current cycle, then the packet loss value for this probe cycle is 100%, and the latency value is 0.

[0184] The data analysis platform preprocesses and aggregates the data uploaded by the destination devices. For example, if two TIX devices are deployed in a park, the aggregated data for TIX02 in City 1-Park 2 could be "City 1-Park 1 to City 1-Park 2, TIX02 plane, 20xx-06-01 00:00:00, latency 60ms, packet loss 0%". This aggregated data is generated based on the detection results of each probe stream from City 1-Park 1 to City 1-Park 2 via Park 2, within the detection period including 20xx-06-01 00:00:00.

[0185] Processed data and summary data are stored separately and can be directly queried and used in front-end, alarm and other modules.

[0186] The front-end can display network quality matrix data between parks. For example, Figure 12 This is a view of the network quality between various parks within City 1. The table rows are named "Source Park," and the columns are named "Destination Park." Users can select to query metrics such as packet loss rate, latency, and unreachability rate. These metrics are aggregated values ​​(e.g., current value, maximum value, average value) over a specific period (e.g., within one hour starting from the selected time 20xx-06-03 15:44:4). The TIX plane refers to the TIX plane in the network architecture, representing a specific TIX device within that park.

[0187] The front-end can display network quality curve data between parks. For example, Figure 13 This is a quality curve fluctuation graph for a specific time period across the source and destination dimensions, from City 1-Park 1 to City 1-Park 3. Users can select metrics such as packet loss rate, latency, and unreachability rate for querying. Data point granularity is one point per second. Trigger Figure 13The "Recent Time" control in the middle can trigger a query of the quality curve fluctuation chart within the most recent half hour.

[0188] The front-end can display detailed network quality data between different zones. For example, Figure 14 For a specific time point (e.g., 13:43:42 on June 3rd, 20xx) within the source-destination dimension of City 1-Park 1 to City 1-Park 3, the data includes packet loss rate, latency, unreachability, and other metrics for all probe flows (source IP + source port + destination IP + destination port uniquely identify a probe flow) from the source to the destination. Figure 14 The source device compresses all network probe data generated within a time period into a single message and then reports it to the data analysis platform. For example, it calculates the average of the packet loss rates generated within 20 seconds as the packet loss rate in the message to be reported to the data analysis platform. Figure 14 The incremental data generated in each detection cycle is reported by the target device as a separate message to the data analysis platform.

[0189] 5. Detect data anomalies and issue alarms.

[0190] If the aggregated data from the source device to the destination device exceeds a preset threshold, the data is considered abnormal, indicating an anomaly in network quality from the source device to the destination device. An alarm can be triggered when this anomaly occurs. Furthermore, if network quality from at least two source devices to the same destination device is abnormal, the destination device is considered abnormal, and an alarm can be triggered.

[0191] For example, Figure 15 The diagram shows the network view of mutual exploration between the parks in City 2. As can be seen from the diagram, the unreachability rate of the two quality matrices from City 2-Park 1 and City 2-Park 3 to City 2-Park 2 in the TIX-02 plane is 50%, which the platform judges as an abnormal situation. Therefore, it is clear that the TIX equipment in the TIX-02 plane of City 2-Park 2 is likely to be abnormal.

[0192] For example, Figure 16 The graph shows the packet loss rate curve from City 2 to Park 1 to City 2 to Park 2. It can be seen from the graph that the abnormality started around 15:42:20 on June 3, 20xx, and returned to normal around 15:48:37.

[0193] For example, Figure 17This is a latency curve from City 1 to Park 1 to City 1 to Park 2. The platform can formulate alarm strategies based on such curve data. The alarm strategy can be that if there are 10 periods with a latency value >100ms within 30 consecutive cycles (30s), an alarm will be issued.

[0194] For example, Figure 18 The alarm content (i.e. device alarm message) issued by the platform can accurately pinpoint the cause of network failure. The alarm content includes parent alarm content and child alarm content, specifically including the city, park, TIX plane and the specific alarm time.

[0195] In traditional technologies, bidirectional probing is usually achieved based on ICMP or TCP protocols. The source sends data, the destination responds, and the source receives and reports the results. However, the probing data is inefficient in terms of timeliness and accuracy, and is easily affected by the probing loop link. Probing via IP will consume more IP resources within the same link coverage area.

[0196] However, the method in this application implements one-way probing based on the UDP protocol, with the source sending and the destination receiving and reporting the results. This results in highly timely and accurate probe data that is unaffected by probe loop links. Probing via IP + port significantly conserves IP resources within the same link coverage area. Even if both the source and destination use a single fixed IP, it can generate massive probe streams, covering more links in the network and effectively saving IP resource usage.

[0197] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0198] Based on the same inventive concept, this application also provides a network analysis apparatus for implementing the network analysis method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more network analysis apparatus embodiments provided below can be found in the limitations of the network analysis method described above, and will not be repeated here.

[0199] In one embodiment, such asFigure 19 As shown, a network analysis device is provided, including: a data acquisition module 1902, a network quality analysis module 1904, and a device quality analysis module 1906, wherein:

[0200] The data acquisition module 1902 is used to acquire network probe data generated by the destination device; the network probe data is generated based on the transmission results of probe packets on the network link from the source device to the destination device.

[0201] The network quality analysis module 1904 is used to analyze the network quality from the source device to the destination device based on the network probe data obtained from each network link from the same source device to the same destination device, and obtain the network quality from each source device to the same destination device.

[0202] The device quality analysis module 1906 is used to determine the device quality of intermediate network devices associated with the destination device based on the network quality from each source device to the same destination device; each network link destined for the destination device passes through intermediate network devices associated with the destination device.

[0203] In one embodiment, the network analysis device is also used for:

[0204] Acquire at least one detection device in each region; each detection device is associated with an intermediate network device.

[0205] Two detection devices belonging to different regions are designated as source and destination devices, respectively. Multiple detection ports of the source and destination devices are paired to obtain the link information of multiple network links from the source to the destination devices.

[0206] Based on the link information of each network link, a network probe task is sent to the source device, so that the source device can send probe packets to the destination device through the corresponding network link based on the network probe task.

[0207] In one embodiment, the network analysis device is also used for:

[0208] Obtain an idle port of the detection device as the detection port of the detection device.

[0209] In one embodiment, the network quality analysis module 1904 is further configured to:

[0210] By statistically analyzing the network probe data obtained from multiple network links from the same source device to the same destination device, comprehensive network probe data corresponding to each source device to the same destination device is obtained.

[0211] Based on comprehensive network probing data, the network quality from the source device to the destination device is analyzed, and the network quality from each source device to the same destination device is obtained separately.

[0212] In one embodiment, the network quality analysis module 1904 is further configured to:

[0213] Based on the sending time of the probe messages carried in the network probe data, the corresponding probe period is determined.

[0214] Based on the device identifiers for the source and destination devices carried in the network probe data, the service label corresponding to the network probe data is determined; each network link from the same source device to the same destination device corresponds to the same service label;

[0215] By statistically analyzing the network probe data corresponding to the same business tag and the same probe period, comprehensive network probe data corresponding to each source device and the same destination device within the same probe period can be obtained.

[0216] In one embodiment, the network quality analysis module 1904 is further configured to:

[0217] Based on the device identifier for the source device carried in the network detection data, obtain the region identifier of the region to which the source device belongs;

[0218] Based on the device identifier for the target device carried in the network probe data, obtain the region identifier of the region to which the target device belongs, and the device identifier of the intermediate network device associated with the target device.

[0219] Based on the region identifiers of the regions to which the source and destination devices belong, and the device identifiers of the intermediate network devices associated with the destination device, service tags corresponding to the network probe data are generated.

[0220] In one embodiment, the network quality analysis module 1904 is further configured to:

[0221] For any source device, the comprehensive network detection data from the source device to the destination device in a single detection cycle is compared with the preset network detection data to obtain the data comparison results from the source device to the destination device in multiple detection cycles.

[0222] For any given source device, the network quality from the source device to the destination device is determined based on the data comparison results over multiple probe cycles.

[0223] In one embodiment, the network quality analysis module 1904 is further configured to:

[0224] For any source device, if the total number of all detection cycles in which the comprehensive network detection data is greater than the preset network detection data is greater than the second number within a first number of consecutive detection cycles, then the network quality from the source device to the destination device is determined to be abnormal within the first number of consecutive detection cycles; the first number is greater than the second number.

[0225] In one embodiment, the equipment quality analysis module 1906 is further configured to:

[0226] If the network quality of the source devices from multiple regions to the same destination device is abnormal during the same probe cycle, it is determined that the intermediate network devices associated with the destination device have abnormal device quality in the corresponding probe cycle.

[0227] In one embodiment, the intermediate network device is responsible for communication between the intranet and the extranet. Both the source device and the destination device are probe devices deployed by the intranet's creator. The source device and the destination device corresponding to the same probe message belong to different regions.

[0228] The aforementioned network analysis device probes network links by sending data from the source end and receiving and generating network probe data at the destination end. Since probe packets only need to be transmitted from the source to the destination, interference from the backhaul link is reduced, which helps to accurately locate abnormal network devices within the network link. Analyzing the network quality from the source to the destination device based on network probe data obtained through various network links from the same source device to the same destination device improves the accuracy of network quality assessment. Furthermore, by determining the network quality from each source device to the same destination device, the device quality of intermediate network devices associated with the destination device is determined, reducing interference from the source device and effectively ensuring the accuracy of intermediate network device quality. Based on device quality, abnormal intermediate network devices can be identified, thereby improving the accuracy of identifying abnormal devices in the network.

[0229] Each module in the aforementioned network analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0230] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 20As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores network probe data, integrated network probe data, and other data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a network analysis method.

[0231] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 21 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a network analysis method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0232] Those skilled in the art will understand that Figure 20 , Figure 21The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0233] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0234] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0235] In one embodiment, a computer program product is provided, the computer program product including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0236] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0237] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0238] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0239] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network analysis method characterized by, The method comprises: obtaining network probe data generated by a destination device; the network probe data is data generated according to a transmission result of a probe packet on a network link from a source device to the destination device; based on network probe data obtained from the same source device to the same destination device through each network link, analyzing the network quality from the source device to the destination device, and obtaining the network quality from each source device to the same destination device respectively; based on the network quality from each source device to the same destination device respectively, determining the device quality of an intermediate network device associated with the destination device; each network link to the destination device passes through the intermediate network device associated with the destination device.

2. The method of claim 1, wherein, The method further comprises: obtaining at least one probe device for each region respectively; the probe device has a respective associated intermediate network device; pairing a plurality of probe ports of the source device and the destination device two by two to obtain link information of each network link from the source device to the destination device, by taking two probe devices belonging to different regions as the source device and the destination device respectively; based on the link information of each network link, sending a network probe task to the source device, so that the source device sends a probe packet to the destination device through the corresponding network link based on the network probe task.

3. The method of claim 2, wherein, The method further comprises: obtaining an idle port of the probe device as a probe port of the probe device.

4. The method of claim 1, wherein, Based on the network probe data obtained from the same source device to the same destination device through each network link, analyzing the network quality from the source device to the destination device, and obtaining the network quality from each source device to the same destination device respectively, comprising: statistically obtaining network probe data obtained from the same source device to the same destination device through a plurality of network links respectively, and obtaining comprehensive network probe data corresponding to each source device to the same destination device respectively; based on the comprehensive network probe data, analyzing the network quality from the source device to the destination device, and obtaining the network quality from each source device to the same destination device respectively.

5. The method of claim 4, wherein, The statistical network probe data obtained from the same source device to the same destination device through a plurality of network links respectively, and obtaining comprehensive network probe data corresponding to each source device to the same destination device respectively, comprising: based on the sending time of the probe packet carried by the network probe data, determining the probe period corresponding to the network probe data; based on the device identifier of the source device and the destination device carried by the network probe data, determining the service tag corresponding to the network probe data; each network link from the same source device to the same destination device corresponds to the same service tag; statistically obtaining each network probe data corresponding to the same service tag and the same probe period, and obtaining comprehensive network probe data corresponding to each source device to the same destination device in the same probe period respectively.

6. The method of claim 5, wherein, Based on the device identifier of the source device and the destination device carried by the network probe data, determining the service tag corresponding to the network probe data, comprising: obtain the area identifier of the area to which the source end device belongs based on the device identifier of the source end device carried by the network detection data; obtain the area identifier of the area to which the destination end device belongs and the device identifier of the intermediate network device associated with the destination end device based on the device identifier of the destination end device carried by the network detection data; generate the service label corresponding to the network detection data based on the area identifiers of the areas to which the source end device and the destination end device belong respectively and the device identifier of the intermediate network device associated with the destination end device.

7. The method of claim 4, wherein, The network quality from the source end device to the destination end device is analyzed based on the comprehensive network detection data, and the network quality from each source end device to the same destination end device is obtained, including: For any one source end device, the data comparison results of the network quality from the source end device to the destination end device in multiple detection periods are obtained by comparing the comprehensive network detection data and the preset network detection data of the network quality from the source end device to the destination end device in a single detection period; For any one source end device, the network quality from the source end device to the destination end device in the multiple detection periods is determined based on the data comparison results of the network quality from the source end device to the destination end device in the multiple detection periods.

8. The method of claim 7, wherein, For any one source end device, the network quality from the source end device to the destination end device in the multiple detection periods is determined based on the data comparison results of the network quality from the source end device to the destination end device in the multiple detection periods, including: For any one source end device, when the cycle total number of the detection periods in which the comprehensive network detection data is greater than the preset network detection data is greater than a second number in a first number of continuous detection periods, it is determined that the network quality from the source end device to the destination end device in the first number of continuous detection periods is network abnormality; the first number is greater than the second number.

9. The method of claim 1, wherein, The device quality of the intermediate network device associated with the destination end device is determined based on the network quality from each source end device to the same destination end device, including: When the network quality from the source end devices of multiple areas to the same destination end device in the same detection period is network abnormality, it is determined that the device quality of the intermediate network device associated with the destination end device in the corresponding detection period is device abnormality.

10. The method according to any one of claims 1 to 9, characterized in that, The intermediate network device is responsible for communication between the internal network and the external network, the source end device and the destination end device are both detection devices deployed by the establishment party of the internal network, and the source end device and the destination end device corresponding to the same detection packet belong to different areas.

11. A network analysis system, characterized by The system includes a data analysis platform and a destination end device; The destination end device is configured to generate network detection data according to the transmission result of a detection packet on a network link from a source end device to the destination end device, and upload the network detection data to the data analysis platform; The data analysis platform is configured to analyze the network quality from the source end device to the destination end device based on the network detection data obtained from the same source end device to the same destination end device through each network link, and obtain the network quality from each source end device to the same destination end device respectively; The device quality of the intermediate network device associated with the destination end device is determined based on the network quality from each source end device to the same destination end device. The destination of each network link is a destination end device. The intermediate network device associated with the destination end device is passed through by each network link.

12. The system of claim 11, wherein, The data analysis platform is further configured to display a device alarm message for the intermediate network device when the device quality of the intermediate network device is abnormal. The device alarm message includes a parent alarm message for prompting the occurrence of device abnormality of the intermediate network device, and a child alarm message for prompting the occurrence of network abnormality from the source end device to the destination end device associated with the intermediate network device. The child alarm message is an alarm cause of the parent alarm message.

13. The system of claim 11, wherein, The data analysis platform is further configured to display a network probe chart corresponding to the intermediate network device in response to a data viewing operation for the intermediate network device. The network probe chart is a chart generated based on network probe data corresponding to the network probe data from at least one source end device to the destination end device associated with the intermediate network device.

14. A network analysis apparatus characterized by comprising: The apparatus comprises: A data acquisition module configured to acquire network probe data generated by a destination end device. The network probe data is data generated according to a transmission result of a probe packet on a network link from a source end device to the destination end device. A network quality analysis module configured to analyze network quality from a source end device to a destination end device based on network probe data obtained from the same source end device to the same destination end device through each network link, and to obtain network quality from each source end device to the same destination end device, respectively. A device quality analysis module configured to determine device quality of an intermediate network device associated with a destination end device based on network quality from each source end device to the same destination end device. The destination of each network link is the destination end device. The intermediate network device associated with the destination end device is passed through by each network link.

15. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method of any one of claims 1 to 10.

16. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 10.

17. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 10.

Images