Network state real-time monitoring method based on IP probe

Abstract

The invention discloses a network state real-time monitoring method based on an IP probe, and the method comprises the following steps: network detection parameter configuration: configuring network detection parameters according to a detection demand; generating a timed scheduling task: creating the timed task through task scheduling according to the Cron expression corresponding to the detection period; iP scanning detection: after the timed task is triggered, carrying out equipment network connectivity detection on all IP addresses; updating the equipment network state: updating the equipment network state according to the detection result; alarm rule matching: obtaining an abnormal equipment list according to the equipment network state, the alarm rule and the alarm rule triggering condition; and equipment alarm: generating an alarm record and sending an alarm message according to the abnormal equipment list and the alarm condition in combination with a push strategy. The network state real-time monitoring method is low in cost, easy to deploy, flexible in configuration and few in redundant alarm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network monitoring, and in particular to a network state real-time monitoring method based on an IP probe. BACKGROUND

[0002] With the deepening of information construction, the number of network devices in various enterprises and institutions shows an explosive growth. How to effectively monitor and manage the network status of these devices has become an important issue for operation and maintenance work.

[0003] At present, the monitoring method of network status mainly includes hardware method and software method.

[0004] The hardware method is to deploy special hardware probe devices in the network. These probe devices are connected to the network through series connection or bypass, and capture and analyze network traffic in real time. The hardware probe method is the mainstream method of existing network status monitoring. However, the disadvantage of this method is that the hardware device procurement cost is high, and it needs to be modified at the network physical layer, which has an invasive effect on the existing network architecture.

[0005] Therefore, the existing IP probe and network status monitoring technology has the problems of high hardware cost, complex deployment, inflexible configuration, and multiple redundant alarms. An improved IP probe monitoring method is urgently needed to overcome the above shortcomings while maintaining the advantages of IP probe technology.

[0006] At the same time, whether it is the above hardware IP probe method or the software Agent method, a unified monitoring strategy is adopted, which cannot be configured differently for different business scenarios and different importance levels. Due to the inflexible configuration of the monitoring rules, the monitoring accuracy is not high.

[0007] Finally, the existing IP probe method is usually based on simple threshold judgment, lacks multi-condition combination triggering capability, and the alarm push has the problem of repeated sending, which affects the work efficiency of the operation and maintenance personnel.

[0008] Therefore, the existing technology has the problems of high network status monitoring cost, complex deployment, inflexible configuration, and multiple redundant alarms. SUMMARY

[0009] The purpose of the present application is to provide a network state real-time monitoring method based on an IP probe, which is low in cost, easy to deploy, flexible in configuration, and less in redundant alarms.

[0010] The technical solution for achieving the purpose of the present application is:

[0011] A network state real-time monitoring method based on an IP probe, comprising the following steps:

[0012] Network detection parameter configuration: configure network detection parameters according to detection requirements, including monitoring network segment range, detection period and alarm rule;

[0013] Timing scheduling task generation: according to the Cron expression corresponding to the detection period, create a timing task through task scheduling;

[0014] IP scanning detection: after the triggering of the timing task, device network connectivity detection is performed on all IP addresses in the monitoring network segment range one by one to obtain detection results;

[0015] Device network state update: update the device network state according to the detection results;

[0016] Alarm rule matching: according to the device network state, alarm rule and alarm rule trigger condition, logical operation screening is performed to obtain an abnormal device list;

[0017] Device alarm: according to the abnormal device list and alarm condition, alarm records are generated and alarm messages are sent in combination with a push strategy.

[0018] Compared with the existing IP probe technology, the present application has the following advantages:

[0019] 1. Low construction cost: the present application realizes the IP probe function through software, without the need to purchase and deploy special hardware probe equipment, greatly reducing the construction cost of the monitoring system.

[0020] 2. Easy deployment of non-intrusive monitoring: the present application detects based on standard network protocols, without the need to make any modification to the existing network architecture or install an Agent program on the monitored device, and is deployed non-intrusively without affecting the existing network, realizing truly non-intrusive monitoring.

[0021] 3. Flexible configuration: the present application supports independent configuration at the project level, different projects can set different monitoring network segments and detection periods, and the alarm rule supports multi-condition combination and logical operation, which can meet diversified business requirements.

[0022] 4. Fewer redundant alarms: the present application controls the push frequency according to the alarm period, effectively prevents repeated alarms, realizes intelligent alarm, reduces redundant alarms and improves operation and maintenance efficiency.

[0023] The present application will be described in further detail below in combination with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is the main flowchart of the network state real-time monitoring method based on the IP probe of the present application.

[0025] Figure 2 isFigure 1 A flowchart of the steps for configuring network detection parameters.

[0026] Figure 3 yes Figure 1 A flowchart of the S2 step in generating a timed scheduling task.

[0027] Figure 4 yes Figure 1 A flowchart of the IP scanning and detection steps.

[0028] Figure 5 yes Figure 1 A flowchart of the S4 step for updating the network status of devices.

[0029] Figure 6 yes Figure 1 A flowchart of the S5 steps for matching alarm rules.

[0030] Figure 7 yes Figure 1 A flowchart of the device alarm procedure. Detailed Implementation

[0031] like Figure 1 As shown, the present invention provides a real-time network status monitoring method based on IP probes, comprising the following steps:

[0032] S1. Network detection parameter configuration: Configure network detection parameters according to detection requirements, including monitoring network segment range, detection cycle and alarm rules.

[0033] The monitoring network segment range is determined by the starting IP address and ending IP address entered through the user interface.

[0034] The detection cycle can be selected from 1 to 23 hours as needed and can be entered through the user interface.

[0035] Alarm rules include rule name, alarm type, alarm level, trigger conditions, alarm cycle, and push strategy.

[0036] Users configure the monitoring network segment range and monitoring period through the interface. The monitoring network segment is determined by the start IP address and end IP address. The system verifies whether the start IP and end IP belong to the same network segment to ensure the continuity of the IP address range. The monitoring period supports a configurable range of 1 to 23 hours to meet the monitoring frequency requirements of different scenarios. The first step is to configure network detection. Users enter network detection parameters through the management interface, including project ID, network type ID, start IP address of the monitoring network segment, end IP address, and monitoring period. The system verifies the validity of the entered parameters, ensuring that the start IP and end IP belong to the same network segment and that the start IP is less than the end IP. The valid range of the monitoring period is 1 to 23 hours; configurations outside this range will be rejected. Multiple monitoring network segments can be configured for the same project; the system will merge the IP addresses of these network segments for unified detection.

[0037] like Figure 2 As shown, the S1 step of configuring network detection parameters includes:

[0038] S11. Input parameters: Users input network detection parameters through the management interface, including project ID, network type ID, start IP address of the monitored network segment, end IP address, detection period, and alarm rules.

[0039] S12. Parameter verification: Verify the legality of the entered network detection parameters, and verify whether the starting IP address and the ending IP address belong to the same network segment, and whether the starting IP is less than the ending IP.

[0040] S13. Multi-segment processing: When multiple monitoring segments are configured for the same project, the system merges the IP addresses of these segments and performs unified detection.

[0041] S2. Timed task generation: Based on the Cron expression corresponding to the detection period, a timed task is created through task scheduling.

[0042] The system automatically generates corresponding Cron expressions based on the configured detection period and creates scheduled tasks through task scheduling. When the network detection configuration changes, the system asynchronously notifies the task scheduler via a message queue. The scheduler reloads the configuration and generates new scheduled tasks after a preset delay, ensuring that configuration changes take effect promptly. After configuration, the system needs to generate scheduled tasks. The system converts the detection period value into a corresponding Cron expression. For example, when the detection period is 2 hours, the Cron expression is "0 0 / 2 * * *", indicating that the detection task will be executed every 2 hours. The system uses task scheduling to manage these scheduled tasks. When a user modifies the network detection configuration, the system sends a configuration change notification via a message queue. Upon receiving the notification, the task scheduler reloads the configuration and updates the scheduled tasks after a 5-second delay, avoiding task scheduling chaos caused by frequent configuration changes.

[0043] like Figure 3 As shown, step S2, the timed task generation step, includes:

[0044] S21, Cron Expression Generation: The system converts the values ​​of the detection period into the corresponding Cron expression;

[0045] For example, when the detection cycle is 2 hours, the Cron expression is "0 0 / 2 * * *", which means that the detection task is executed once every 2 hours;

[0046] S22. Configuration Change Handling: When a user modifies the network detection configuration, the system sends a configuration change notification through the message queue. After receiving the notification, the task scheduler delays for 5 seconds to reload the configuration and update the scheduled task to avoid frequent configuration changes causing task scheduling chaos.

[0047] S3, IP Scan Detection: After the scheduled task is triggered, the network connectivity of all IP addresses within the monitoring network segment is checked one by one to obtain the detection results.

[0048] All IP addresses within the monitored network segment are obtained from a deduplicated IP list.

[0049] The deduplicated IP list is generated after verification to ensure that the starting IP address and the ending IP address belong to the same network segment, and then the IP list is deduplicated.

[0050] Once the scheduled task is triggered, the system iterates through all IP addresses within the monitored network segment and performs a network connectivity test on each IP address. To improve detection efficiency, the system pre-calculates the IP address range and generates a complete IP list, while also deduplicating the list to avoid repeatedly testing the same IP address.

[0051] After the scheduled task is triggered, the system begins performing IP scanning and detection. First, the system generates a complete list of IP addresses based on the configured start and end IP addresses of the monitored network segments using an IP address range calculation algorithm. For example, if the start IP is 192.168.1.1 and the end IP is 192.168.1.10, a list of 10 IP addresses will be generated. If multiple network segments are configured, the system will merge the IP lists of all segments and deduplicate the merged list to prevent the same IP address from being detected multiple times. After the IP list is generated, the system performs network connectivity checks on each IP address in the list sequentially. The detection uses the ICMPPing protocol, a standard network protocol of the operating system that requires no additional service support. The system sets reasonable timeouts and retries to ensure the accuracy of the detection results. For batch IP detection, the system can consider using parallel processing to improve detection efficiency.

[0052] like Figure 4 As shown, the S3, IP scanning detection steps include:

[0053] S31. IP List Generation: The system generates a complete IP address list based on the configured start and end IP addresses of the monitoring network segment using an IP address range calculation algorithm.

[0054] S32. List Merging and Deduplication: When multiple network segments are configured, the system merges and processes the IP lists of all network segments to avoid the same IP address being detected multiple times.

[0055] S33. Connectivity Detection: The system uses the ICMP Ping protocol to perform network connectivity detection on each IP address in the IP list in turn, and obtains the detection results.

[0056] The system ensures the accuracy of the test results based on the set timeout time and number of retries.

[0057] The test results may be:

[0058] The device can respond to Ping requests normally;

[0059] The device is unable to respond to Ping requests even though it was previously online;

[0060] The device is powered on and online, but the network is not working.

[0061] S4. Device network status update: Update the device network status based on the detection results.

[0062] The device network status may be one of the following:

[0063] Online status indicates that the device can respond to Ping requests normally;

[0064] Offline status indicates that the device is unable to respond to Ping requests and was previously online;

[0065] The fault status indicates that the device is powered on and online, but the network is not accessible.

[0066] The device's network status is updated based on the Ping test results. The updated device status is then synchronously written to the database, providing a data foundation for subsequent alarm detection.

[0067] After obtaining the test results, the system needs to update the device's network status. The system categorizes device status into three types based on the Ping response: When a successful Ping response is received, the device is marked as online; when there is no Ping response and the device was previously online, the device is marked as offline; when the device is powered on and online but the network is unavailable, the device is marked as faulty. After updating the device status, the system writes the latest status information to the database, completing the status update process for this test.

[0068] like Figure 5 As shown, the S4 step, the device network status update step, includes:

[0069] S41. Status Judgment: The system classifies the device status into three types based on the Ping response: When a successful Ping response is received, the device status is marked as online; when there is no Ping response and the device was previously online, the device status is marked as offline; when the device is powered on and online but the network is not accessible, the device status is marked as faulty.

[0070] S42. Status Persistence: After the device status is updated, the system writes the latest status information to the database, completing the status update process for this test.

[0071] S5. Alarm rule matching: Based on the device network status, alarm rules, and alarm rule triggering conditions, a list of abnormal devices is obtained through logical operations.

[0072] The system retrieves all enabled alarm rules and their trigger conditions, and filters out a list of abnormal devices based on the trigger condition type and logical operation relationships. Trigger condition types include point type, point spatial location, point room type, point network type, etc., and support both AND and OR operations for flexible combinations of alarm rules.

[0073] like Figure 6 As shown, the S5 alarm rule matching step includes:

[0074] S51. Rule Acquisition: The system first acquires all enabled alarm rules, then iterates through each rule to prepare for condition matching;

[0075] S52. Status Filtering: Perform preliminary filtering of devices based on the monitoring status (online, offline, or fault) defined by the rules;

[0076] S53, Condition Matching: Further filter devices based on trigger condition type and condition value.

[0077] Trigger conditions include location type conditions (filtered by device type), location spatial location conditions (filtered by device location), location room type conditions (filtered by room function type), and location network type conditions (filtered by network type).

[0078] S54. Logical Operations: Multiple triggering conditions support AND and OR operations. The AND operation means that the alarm is triggered only when all conditions are met simultaneously. The OR operation means that the alarm is triggered when any one condition is met.

[0079] S55. Anomaly List Generation: Based on the above filtering process, generate a list of anomaly devices that meet the criteria.

[0080] After the update is complete, the system begins matching alarm rules. Alarm rules are pre-configured by the user, and each rule includes elements such as rule name, alarm type, alarm level, trigger conditions, alarm cycle, and push strategy. Trigger conditions are the core of alarm rules. The system supports multiple trigger condition types, including location type conditions (filtered by device type), location spatial location conditions (filtered by device location), location room type conditions (filtered by room function type), and location network type conditions (filtered by network type). Multiple trigger conditions support AND and OR operations. AND operation means that an alarm is triggered only when all conditions are met simultaneously, while OR operation means that an alarm is triggered when any one condition is met.

[0081] The system first retrieves all enabled alarm rules, then iterates through each rule, filtering out abnormal devices that meet the trigger conditions. The filtering process consists of two steps: the first step is network status filtering, which filters devices based on the monitoring status (online, offline, or faulty) defined by the rules; the second step is trigger condition filtering, which further filters devices based on the trigger condition type and value. For example, if the trigger condition is that the location type equals "network switch," then only abnormal devices with the device type "network switch" are filtered.

[0082] S6. Device Alarm: Based on the list of abnormal devices and alarm conditions, and in conjunction with the push strategy, generate alarm records and send alarm messages.

[0083] like Figure 7 As shown, the S6, device alarm step includes:

[0084] S61, Alarm Condition Judgment: Determine whether the list of abnormal devices meets the alarm conditions. If it does, proceed to the next step S62, Alarm Record Generation. If it does not meet the conditions, jump to S64, Alarm End Step.

[0085] The determination of alarm conditions mainly considers two aspects: the sending time strategy and the alarm cycle. The sending time strategy includes two types: immediate sending and scheduled sending. Immediate sending means that an alarm is pushed immediately after each abnormal device is detected, while scheduled sending means that an alarm is pushed uniformly at a set time. The alarm cycle is used to control the push frequency. By setting the alarm cycle, different push frequencies can be achieved, such as daily pushes or every other day pushes. For example, if the alarm cycle is set to 1 day, only one alarm will be pushed per day, avoiding duplicate alarms.

[0086] S62. Alarm record generation: After alarm idempotency processing, alarm records are generated using an alarm record information template.

[0087] The alarm idempotency processing specifically involves:

[0088] Before generating each alarm record, the system checks whether there is already an alarm record with the same alarm rule for the day. If it already exists, the alarm generation is skipped; otherwise, the alarm is generated.

[0089] The system generates alarm records based on alarm idempotency processing and user-defined alarm record information templates.

[0090] Idempotent alarm handling refers to the process of checking whether a record with the same alarm rule already exists on the same day before generating each alarm record in order to avoid duplicate alarms. If a record already exists, the generation of this alarm is skipped.

[0091] Alarm log information templates refer to user-defined information templates for alarm logs. These templates support the insertion of dynamic parameters, using placeholders (such as `{device name}`, `{IP address}`, `{abnormal status}`, `{detection time}`, etc.) to mark the location of dynamic content. When the system generates an alarm, it automatically extracts the actual data of the corresponding device from the database, replaces these placeholders with the real values, and generates the final complete alarm message, making the alarm message clearer and easier to understand.

[0092] For example:

[0093] Custom template: `Device {Device Name} (IP: {IP Address}) detected an anomaly at {Detection Time}, with the status: {Abnormal Status}`.

[0094] Actual push message: `Device core switch 01 (IP: 192.168.1.100) detected an anomaly at 14:30:00 on 2025-01-15, and its status is: offline`.

[0095] S63, Alarm Message Push: The system generates alarm records and pushes alarm messages.

[0096] Alarm logs include alarm rule ID, project ID, alarm time, alarm type, alarm level, and alarm message. Alarm messages are pushed via application push and internal message push. Application push is sent to maintenance personnel in real time through the mobile client application, while internal message push stores alarm notifications in the system's internal message center.

[0097] S64, Alarm End: End the alarm procedure.

[0098] End the alarm procedure, complete this round of monitoring, and begin the next cycle.

[0099] The "real-time" aspect of this invention is primarily reflected in the following steps: Step S2 automatically triggers detection according to the configured detection cycle via a timed task, requiring no manual intervention; Step S3 immediately performs network connectivity detection on all IP addresses within the monitored network segment after the timed task is triggered, acquiring device status in real time; Step S4 updates the device network status in real time based on the detection results and writes it to the database; Step S6 sends alarm messages in real time via application push when alarm conditions are met, ensuring that maintenance personnel can be promptly informed of network anomalies. These steps collectively achieve real-time monitoring of network status.

[0100] This invention employs a pure software implementation, with all functional modules deployed on the server side. No software installation is required on the monitored device, nor is any hardware deployment necessary in the network. The system uses standard network protocols for detection, ensuring strong compatibility and applicability to various types of IP network devices. The system supports independent configuration for multiple projects, allowing for different monitoring parameters and alarm rules to be set for different projects, thus achieving a reasonable allocation of monitoring resources. The system adopts a distributed architecture design, supporting horizontal scaling and meeting the monitoring needs of large-scale networks. This invention implements IP probe functionality in pure software, retaining the advantages of traditional IP probe technology while achieving low cost, easy deployment, flexible configuration, and fewer redundant alarms through technological innovation. It effectively solves the problems of high cost, strong invasiveness, rigid configuration of existing hardware IP probe methods, and complex deployment of software agent methods.

[0101] In practical applications, this invention can be deployed in an enterprise's integrated cabling management system to achieve real-time monitoring of equipment in the computer room, office, and network. Maintenance personnel can configure the monitoring scope and alarm rules through the interface, and the system automatically executes detection tasks and promptly pushes alarm messages, greatly improving the efficiency and accuracy of network maintenance.

Claims

1. A method for real-time network status monitoring based on IP probes, characterized in that, Includes the following steps: Network detection parameter configuration: Configure network detection parameters according to detection requirements, including monitoring network segment range, detection cycle and alarm rules; Scheduled task generation: Based on the Cron expression corresponding to the detection period, a scheduled task is created through task scheduling; IP Scan Detection: After the scheduled task is triggered, the network connectivity of all IP addresses within the monitoring network segment is checked one by one to obtain the detection results; Device network status update: Update the device network status based on the detection results; Alarm rule matching: Based on the device network status, alarm rules, and alarm rule triggering conditions, logical operations are used to filter and obtain a list of abnormal devices; Device alarm: Based on the list of abnormal devices and alarm conditions, and in conjunction with the push strategy, an alarm record is generated and an alarm message is sent.

2. The real-time network status monitoring method according to claim 1, characterized in that, The steps for configuring monitoring parameters include: Input parameters: Users input network detection parameters through the management interface, including project ID, network type ID, start IP address of the monitored network segment, end IP address, detection period, and alarm rules; Parameter validation: The legality of the entered network detection parameters is validated, verifying whether the starting IP address and the ending IP address belong to the same network segment, and whether the starting IP is less than the ending IP. Multi-segment processing: When multiple monitoring segments are configured for the same project, the system merges the IP addresses of these segments and performs unified detection.

3. The real-time network status monitoring method according to claim 2, characterized in that: The alarm rules include rule name, alarm type, alarm level, triggering conditions, alarm cycle, and push strategy.

4. The real-time network status monitoring method according to claim 1, characterized in that, The steps for generating the timed scheduling task include: Cron expression generation: The system converts the values ​​of the detection period into corresponding Cron expressions; Configuration change handling: When a user modifies the network detection configuration, the system sends a configuration change notification through a message queue. After receiving the notification, the task scheduler delays for 5 seconds to reload the configuration and update the scheduled task, thus avoiding task scheduling chaos caused by frequent configuration changes.

5. The real-time network status monitoring method according to claim 1, characterized in that, The IP scanning and detection steps include: IP List Generation: The system generates a complete IP address list based on the configured start and end IP addresses of the monitoring network segment using an IP address range calculation algorithm; List merging and deduplication: When multiple network segments are configured, the system merges the IP lists of all network segments and performs deduplication processing on the merged list to prevent the same IP address from being detected multiple times. Connectivity detection: The system uses the ICMP Ping protocol to perform network connectivity detection on each IP address in the IP list in turn, and obtain the detection results.

6. The real-time network status monitoring method according to claim 5, characterized in that, The test result may be one of the following: The device can respond to Ping requests normally; The device is unable to respond to Ping requests even though it was previously online; The device is powered on and online, but the network is not working.

7. The real-time network status monitoring method according to claim 1, characterized in that, The device network status update steps include: Status determination: The system classifies device status into three types based on Ping response: When a successful Ping response is received, the device status is marked as online; when there is no Ping response and the device was previously online, the device status is marked as offline; when the device is powered on and online but the network is unavailable, the device status is marked as faulty. Persistent Status: After the device status is updated, the system writes the latest status information to the database, completing the status update process for this test.

8. The method for real-time network status monitoring according to claim 1, characterized in that, The alarm rule matching steps include: Rule Acquisition: The system first acquires all enabled alarm rules, then iterates through each rule in preparation for condition matching; Status filtering: Initial filtering of devices based on the monitoring status defined by the rules; Conditional matching: Further filter devices based on trigger condition type and condition value; Logical operations: Multiple triggering conditions support AND and OR operations. The AND operation means that the alarm is triggered only when all conditions are met simultaneously, and the OR operation means that the alarm is triggered only when any one condition is met. Anomaly list generation: Based on the above filtering process, a list of anomaly devices that meet the criteria is generated.

9. The method for real-time network status monitoring according to claim 1, characterized in that, The device alarm procedure includes: Alarm condition judgment: Determine whether the list of abnormal devices meets the alarm conditions. If it does, proceed to the next step of alarm record generation. If it does not meet the conditions, jump to the alarm termination step. Alarm record generation: After alarm idempotency processing, alarm records are generated using an alarm record information template; Alarm message push: The system generates alarm records and pushes alarm messages; Alarm terminated: The alarm procedure is terminated.

10. The method for real-time network status monitoring according to claim 9, characterized in that, The alarm idempotency processing specifically involves: Before generating each alarm record, the system checks whether there is already an alarm record with the same alarm rule for the day. If it already exists, the alarm generation is skipped; otherwise, the alarm is generated.

Images