Network flow table automatic analysis method and system based on OpenFlow technology

Abstract

The invention provides a network flow table automatic analysis method and system based on an OpenFlow technology, relates to the technical field of operation and maintenance of a cloud computing data center network and a software defined network, and aims to carry out automatic routing inspection and positioning aiming at the problems of missing, repetition and inconsistency of a CVK host flow table at a bottom layer of a cloud platform. The method comprises the following steps: inputting target CVK host access information and carrying out connectivity and authentication verification; traversing virtual machine network information on the CVK host, connecting the Redis to query security group information associated with a virtual network card, and detecting missing of a security group flow table; the offline state of the network-cvk-agent service is checked, whether the network-cvk-agent service is caused by missing of a basic flow table of a network port or not is positioned in the offline mode, and missing information is output; detecting repetition and inconsistency of the basic flow table when the basic flow table is not offline or not missing; and finally, all task results are summarized and output to a console, and repair guidance is provided in a knowledge base link form, so that operation and maintenance personnel are helped to quickly position root causes and recover businesses.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing data center network and software-defined network (SDN) operation and maintenance technology, and in particular relates to an automatic network flow table analysis method and system based on OpenFlow technology. Background Technology

[0002] OpenFlow switches are the core components of OpenFlow networks, primarily managing data layer forwarding. Switches maintain FlowTables, whose generation, maintenance, and distribution are typically handled by external controllers. OpenFlow networks abstract forwarding behavior using a match-action model. The match keywords defined in the OpenFlow 1.0 specification are not limited to the IP 5-tuple but also include fields such as input port, MAC source address, MAC destination address, Ethernet type, VLAN ID, IP source address, IP destination address, IP port, TCP source port, and TCP destination port. Furthermore, these fields can be wildcarded, resulting in a large number, many combinations, and frequent changes in flow table rules in real-world networks.

[0003] In hyperscale data centers and cloud computing scenarios, OpenFlow is often used for network control such as dynamic migration of virtual machines, load balancing, and QoS optimization. When anomalies such as missing or duplicate flow tables occur on the platform, engineers often find it difficult to quickly locate the root cause from a large number of complex flow tables, resulting in long business recovery cycles and a wider impact of the failure.

[0004] Meanwhile, the following issues are also common in live network operations and maintenance: First, if the underlying security group-related flow tables are lost after a virtual machine hot migration, it may cause service interruption; Second, if the CVK host is missing basic flow table data, it may be unable to exit the network offline mode; Third, if the CVK host generates residual flow table information due to repeated management, it may cause virtual machine network anomalies.

[0005] Therefore, there is a need for a flow table analysis solution that can automatically perform missing / duplicate / inconsistency checks and provide actionable remediation guidance. Summary of the Invention

[0006] In view of this, the present invention aims to propose an automatic network flow table analysis method and system based on OpenFlow technology, so as to at least solve one of the problems in the background art.

[0007] To achieve the above objectives, the technical solution of the present invention is implemented as follows: An automatic network flow table analysis method based on OpenFlow technology is applied to a CVK host hosting virtual machines in a cloud platform. The CVK host runs a virtual switching component for issuing or hosting OpenFlow flow tables. The method is executed by an analysis tool and includes: S1. Receive the access information of the target CVK host to be analyzed, the access information including at least the host address and authentication information; perform connectivity verification and authentication verification on the target CVK host, and output the failure reason and terminate the subsequent analysis when the verification fails; S2. After the verification is passed, obtain the virtual machine network information on the target CVK host. The virtual machine network information includes at least the virtual machine identifier, the virtual network card identifier, the virtual network port identifier, and the security group identifier associated with the virtual network port. S3. Based on the virtual machine network information, connect to the Redis database, read the security group rule information corresponding to each virtual network card or virtual network port, and generate the expected security group flow table set for each virtual network port according to the preset mapping rules; at the same time, generate the expected basic flow table set for port connectivity and basic forwarding. S4. Collect actual OpenFlow flow table data from the target CVK host to obtain an actual flow table set; perform rule normalization processing on the actual flow table set, the expected security group flow table set, and the expected basic flow table set, and generate a rule fingerprint for each flow table rule; S5. Based on the rule fingerprint, perform missing detection on the actual flow table set to obtain a missing rule list. The missing rule list is at least distinguished into security group flow table missing and basic flow table missing. S6. Read the network-cvk-agent service status of the target CVK host to determine whether it is in network offline mode; when it is in offline mode, further determine whether the offline mode is caused by the missing basic flow table based on the missing rule list, and output the corresponding missing rules and location conclusion. S7. When the target CVK host is not in offline mode or no missing basic flow table is detected, perform duplicate detection on the actual flow table set based on the rule fingerprint and output a duplicate rule list. S8. Perform consistency checks on the actual flow table sets corresponding to different virtual network ports on the target CVK host, and output a list of inconsistent rules. S9. Summarize the missing rule list, duplicate rule list, inconsistent rule list, and corresponding location conclusions to generate analysis results, and output them to the console display page; wherein, the analysis results include at least the target CVK host information, associated virtual machine information, and knowledge base links corresponding to the detection results, for guiding the repair.

[0008] Furthermore, generating the desired security group flow table set in S3 includes: converting the security group rule information into OpenFlow rules in the form of match-action, and generating inbound rule sets and outbound rule sets according to virtual network ports respectively.

[0009] Furthermore, the generation of the expected basic flow table set in S3 includes: generating a basic rule template for each virtual network port for port identification, Layer 2 forwarding, address learning, or default discarding, and binding the basic rule template with the virtual network port identifier to form a port-level expected basic flow table set.

[0010] Furthermore, the rule normalization process in S4 includes at least one of the following: Use a uniform default representation for wildcard fields; Normalize the order of fields under the same rule; Remove counter fields or timestamp fields that are irrelevant to the detection; Sort the action list in a preset order and remove differences between equivalent actions.

[0011] Furthermore, the rule fingerprint is calculated from at least the following fields: table number, priority, set of matching fields, and set of action fields, wherein the set of matching fields includes at least a portion of the input port, MAC source address, MAC destination address, Ethernet type, VLAN identifier, IP source address, IP destination address, IP port, TCP source port, and TCP destination port defined by OpenFlow 1.0.

[0012] Furthermore, the missing detection of S5 includes: when any rule fingerprint in the expected security group flow table set or the expected basic flow table set does not exist in the actual flow table set, it is determined to be missing, and the virtual network port identifier and virtual machine identifier to which the missing rule belongs are recorded.

[0013] Furthermore, the duplicate detection in S7 includes: when there are at least two rules in the actual flow table set with the same rule fingerprint and the same action field set, it is determined to be a duplicate; and the source information of the duplicate rule or the associated management identifier is further output to indicate the residual flow table risk caused by duplicate management.

[0014] Furthermore, the consistency check of S8 includes at least one of the following: Consistency detection of instantiation results of the expected security group flow table set corresponding to the same security group identifier on different virtual network ports; Consistency check of the underlying flow table set of different virtual network ports on the same CVK host; When the version number of the security group rule on the Redis side of the same virtual network interface is inconsistent with the version identifier of the actual flow table set, it is determined to be inconsistent and the difference item is output.

[0015] Furthermore, in step S6, determining whether the offline mode is caused by a missing basic flow table includes: when the network-cvk-agent service is in offline mode and there are basic rules related to port connectivity in the missing rule list, the offline reason is marked as a missing basic flow table, and the corresponding missing rule list is output in the analysis results.

[0016] Furthermore, the knowledge base links in the analysis results are generated by triggering the detection results. The generation method includes mapping missing, duplicate, or inconsistent rule types, associated component names, and target CVK host identifiers to preset knowledge base entry addresses, and outputting them as clickable links on the console display page.

[0017] Furthermore, this solution discloses an automatic network flow table analysis system based on OpenFlow technology, characterized by comprising: The verification module is used to perform connectivity and authentication verification on the target CVK host; The information acquisition module is used to obtain the virtual machine network information on the target CVK host and collect the actual flow table set, while reading the network-cvk-agent service status; The expected rule generation module is used to connect to the Redis database to read security group rule information and generate the expected security group flow table set and the expected basic flow table set. The rule processing module is used to perform rule normalization on the actual flow table set and the expected flow table set and generate rule fingerprints; The detection module is used to output a list of missing rules, a list of duplicate rules, and a list of inconsistent rules based on rule fingerprints, and to locate the cause of the offline mode. The results output module is used to generate analysis results containing target CVK host information, associated virtual machine information, and knowledge base links, and output them to the console display page.

[0018] Compared with existing technologies, the automatic network flow table analysis method and system based on OpenFlow technology described in this invention has the following advantages: (1) This invention is aimed at troubleshooting OpenFlow flow table faults on CVK hosts of cloud platforms. It can transform the work of manually flipping through flow tables and guessing the cause based on experience into a reproducible automatic diagnostic process: First, after the tool passes the connectivity and authentication verification, it outputs the clear cause of failure, avoiding invalid troubleshooting caused by access problems; Second, by traversing the network information of the CVK host virtual machine and connecting to Redis to query the security group information associated with the virtual network card, it generates the expected security group flow table set and the expected basic flow table set at the port level, and then compares them with the actual collected flow table set, so as to give a definite conclusion and corresponding port and virtual machine evidence for the missing security group flow table and the missing basic flow table, reducing missed detections and misjudgments; (2) In response to the problem that the network-cvk-agent is in offline mode but the root cause is difficult to locate, this invention continues to determine whether the offline mode is caused by the missing basic flow table of the network port after detecting the offline mode, and directly outputs the missing basic flow table entries and the location conclusion, making the repair more targeted; For the hidden faults that cause residual flow tables and virtual machine network anomalies due to repeated management, this invention performs repeated checks on the basic flow table when it is not offline or the basic flow table is not missing, and outputs verifiable evidence by merging rule fingerprints and port mapping consistency verification, reducing the risk of false cleanup; (3) The present invention summarizes and displays the results of missing, duplicate, inconsistent and offline reasons on the console page, and automatically outputs the corresponding knowledge base links according to the detection results, forming a closed-loop handling path of discovering problems, providing evidence and guiding repair, reducing the handling threshold and shortening the business recovery time. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a schematic diagram of the method described in an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0021] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0022] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0023] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] In one embodiment, the automatic network flow table analysis method based on OpenFlow technology provided by the present invention is implemented by an operation and maintenance side analysis tool. The analysis tool can be written in Go and deployed on a local Windows host in the form of an executable program. When running, the Windows host is required to establish a network connection with the target CVK host.

[0025] The analysis tool should maintain at least the following data objects to output the chain of evidence: HostInfo (host_ip, connectivity verification result, authentication verification result, and reason for failure); VmNetInfo (virtual machine network information, including virtual machine identifier vm_id, virtual network interface identifier vnic_id, virtual network port identifier port_id, and optional MAC address, VLAN ID, etc.); SgInfo (security group information, including a list of security group identifiers and a list of security group rules associated with vnic_id or port_id); and FlowEntry (flow table entry, including at least table_id, priority, match_fields, action_fields, and their association with vm_id and port_id). These objects are used to support the checking of missing, duplicate, and inconsistent flow tables, as well as the location and output of reasons for offline mode.

[0026] Furthermore, this method can perform the following processing steps in the order of the claims: Step S1: After the analysis tool starts, it receives the target CVK host account and password entered by the user, performs connectivity verification and account / password correctness verification on the target CVK host. If the verification passes, it enters the analysis process; if the verification fails, it generates the failure reason and outputs it to the console display page.

[0027] Step S2: The analysis tool traverses the virtual machine network information on the CVK host to obtain the network identifiers such as vnic_id and port_id for each virtual machine. Based on the network identifiers, it connects to the Redis database to query the security group information of the corresponding virtual network card in the flow table information to obtain the security group rule set, which is used to construct the expected flow table set and check for any missing rules.

[0028] In a reproducible implementation, the analysis tool converts the queried security group rules into a unified rule field set SgRule. Each SgRule includes at least the direction, protocol, source address range (src_cidr), destination address range (dst_cidr), source port range (src_port_range), destination port range (dst_port_range), and action. Then, it generates an expected security group flow table set ExpectedSgFlows at the port_id granularity. During generation, each SgRule is instantiated into a matching field (match_fields) and an action field (action_fields). The match_fields at least include in_port mapped to port_id, and are limited or wildcarded using keywords from the OpenFlow 1.0 tuple such as Ethernet type, IP source address, IP destination address, protocol, TCP source port, and TCP destination port. The action_fields are determined based on the action to either forward or drop the request.

[0029] Meanwhile, the analysis tool generates the expected base flow table set ExpectedBaseFlows based on the base template. The base template at least covers the necessary basic forwarding rules and necessary protocol rules for the port, which is used to support the location of missing base flow tables and avoid the situation where the virtual machine cannot exit offline mode due to missing base flow tables after creation.

[0030] Step S3: The analysis tool checks whether the network-cvk-agent service of the CVK host is in offline network mode and obtains the offline flag.

[0031] Step S4: When offline is true, the analysis tool performs a basic flow table missing determination for each port_id. The determination includes at least comparing ExpectedBaseFlows with the actual flow table set ActualFlows collected from the CVK host. If there are missing key flow table entries belonging to the basic template, the offline cause is determined to be due to the loss of the network port basic flow table, and the missing flow table information is output as evidence in the returned result.

[0032] In a reproducible implementation, to reduce misjudgments caused by differences in field order and wildcard syntax, the analysis tool normalizes each FlowEntry and generates a rule fingerprint (fp). The rule fingerprint fields at least include table_id, priority, match_fields, and action_fields. These fields are concatenated into a standardized string in a fixed order and hashed to obtain the fp. This allows missing detection to output the MissingBaseFpSet and corresponding FlowEntry details based on the fp set operation. In step S5, when offline is false or no missing basic flow table is detected, the analysis tool performs a duplicate check on the basic flow table of the virtual network port, at least determining whether the same rule fingerprint appears repeatedly under the same port_id, and outputs the duplicate rule group as evidence of duplicate management or residual flow tables.

[0033] In a reproducible implementation, in addition to counting the number of times fp appears within the same port_id, the analysis tool can also perform mapping consistency verification based on the valid port set ValidPortSet obtained in step S2. If the port identifier referenced by the actual flow table entry is not in ValidPortSet, or if the same port shows old rule characteristics inconsistent with the current virtual machine network information, it is marked as a suspected residual entry to reduce the risk of false cleanup. In step S6, the analysis tool performs flow table data inconsistency checks. The inconsistency checks include at least comparing ExpectedSgFlows with ActualFlows. If the action under the same matching condition does not conform to the expected action, or if there are unexpected differences in the instantiation rule sets of the same security group rule on different ports, the inconsistency item details and its associated vm_id, vnic_id, and port_id are output as evidence for location.

[0034] After completing the above tasks, the analysis tool will summarize and return the inspection and analysis results of each task and display them in the console. The displayed content will include at least the target CVK host information, associated virtual machine and port information, missing and duplicate items and their evidence fields.

[0035] Furthermore, to ensure that the results can directly guide the repair process, the analysis tool in this embodiment automatically generates knowledge base links based on the detection conclusions and outputs them along with the returned results. Maintenance personnel can refer to the links in the returned results for repair.

[0036] In a reproducible implementation, the analysis tool incorporates a knowledge base link mapping table, KbMap. KbMap includes at least the issue type (issue_type), the knowledge base topic key (kb_topic), the link template (kb_url_template), and the required evidence fields (required_evidence_fields). The issue_type covers at least the following types: missing security group flow table, missing basic flow table, offline cause location, duplicate basic flow table, and inconsistent flow table. When generating each issue result, the analysis tool first determines the issue_type based on the missing set, duplicate set, and offline judgment conditions. Then, it concatenates parameters such as host_ip, vm_id, and port_id into the kb_url_template to generate the kb_url and outputs it, thereby achieving the goal of automatically outputting solutions based on the detection results.

[0037] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An automatic network flow table analysis method based on OpenFlow technology, applied to a CVK host hosting virtual machines in a cloud platform, wherein the CVK host runs a virtual switching component for issuing or hosting OpenFlow flow tables, and the method is executed by an analysis tool, characterized in that... include: S1. Receive the access information of the target CVK host to be analyzed, wherein the access information includes at least the host address and authentication information; Perform connectivity and authentication checks on the target CVK host. If the checks fail, output the reason for the failure and terminate the subsequent analysis. S2. After the verification is passed, obtain the virtual machine network information on the target CVK host. The virtual machine network information includes at least the virtual machine identifier, the virtual network card identifier, the virtual network port identifier, and the security group identifier associated with the virtual network port. S3. Based on the virtual machine network information, connect to the Redis database, read the security group rule information corresponding to each virtual network card or virtual network port, and generate the expected security group flow table set for each virtual network port according to the preset mapping rules; at the same time, generate the expected basic flow table set for port connectivity and basic forwarding. S4. Collect actual OpenFlow flow table data from the target CVK host to obtain the actual flow table set; Perform rule normalization processing on the actual flow table set, the expected security group flow table set, and the expected basic flow table set, and generate a rule fingerprint for each flow table rule; S5. Based on the rule fingerprint, perform missing detection on the actual flow table set to obtain a missing rule list. The missing rule list is at least distinguished into security group flow table missing and basic flow table missing. S6. Read the network-cvk-agent service status of the target CVK host to determine whether it is in network offline mode; when it is in offline mode, further determine whether the offline mode is caused by the missing basic flow table based on the missing rule list, and output the corresponding missing rules and location conclusion. S7. When the target CVK host is not in offline mode or no missing basic flow table is detected, perform duplicate detection on the actual flow table set based on the rule fingerprint and output a duplicate rule list. S8. Perform consistency checks on the actual flow table sets corresponding to different virtual network ports on the target CVK host, and output a list of inconsistent rules. S9. Summarize the missing rule list, duplicate rule list, inconsistent rule list, and corresponding location conclusions to generate analysis results, and output them to the console display page; wherein, the analysis results include at least the target CVK host information, associated virtual machine information, and knowledge base links corresponding to the detection results, for guiding the repair.

2. The method according to claim 1, characterized in that, The generation of the desired security group flow table set in S3 includes: converting the security group rule information into OpenFlow rules in the form of match-action, and generating inbound rule sets and outbound rule sets according to virtual network ports respectively.

3. The method according to claim 1, characterized in that, The generation of the expected basic flow table set in S3 includes: generating a basic rule template for each virtual network port for port identification, Layer 2 forwarding, address learning or default discarding, and binding the basic rule template with the virtual network port identifier to form a port-level expected basic flow table set.

4. The method according to claim 1, characterized in that, The rule normalization process in S4 includes at least one of the following: Use a uniform default representation for wildcard fields; Normalize the order of fields under the same rule; Remove counter fields or timestamp fields that are irrelevant to the detection; Sort the action list in a preset order and remove differences between equivalent actions.

5. The method according to claim 1, characterized in that, The rule fingerprint is calculated from at least the following fields: table number, priority, set of matching fields, and set of action fields, wherein the set of matching fields includes at least a portion of the input port, MAC source address, MAC destination address, Ethernet type, VLAN identifier, IP source address, IP destination address, IP port, TCP source port, and TCP destination port defined by OpenFlow 1.

0.

6. The method according to claim 1, characterized in that, The missing detection of S5 includes: when any rule fingerprint in the expected security group flow table set or the expected basic flow table set does not exist in the actual flow table set, it is determined to be missing, and the virtual network port identifier and virtual machine identifier to which the missing rule belongs are recorded.

7. The method according to claim 1, characterized in that, The duplication detection in S7 includes: when there are at least two rules in the actual flow table set with the same rule fingerprint and the same action field set, it is determined to be a duplication; and the source information of the duplicate rule or the associated management identifier is further output to indicate the residual flow table risk caused by duplicate management.

8. The method according to claim 1, characterized in that, The step S6, determining whether the offline mode is caused by a missing basic flow table, includes: when the network-cvk-agent service is in offline mode and there are basic rules related to port connectivity in the missing rule list, marking the offline reason as a missing basic flow table, and outputting the corresponding missing rule list in the analysis results.

9. The method according to claim 1, characterized in that, The knowledge base links in the analysis results are generated by triggering the detection results. The generation method includes mapping the missing, duplicate or inconsistent rule types, associated component names and target CVK host identifiers to preset knowledge base entry addresses, and outputting them as clickable links on the console display page.

10. An automatic network flow table analysis system based on OpenFlow technology, characterized in that, include: The verification module is used to perform connectivity and authentication verification on the target CVK host; The information acquisition module is used to obtain the virtual machine network information on the target CVK host and collect the actual flow table set, while reading the network-cvk-agent service status; The expected rule generation module is used to connect to the Redis database to read security group rule information and generate the expected security group flow table set and the expected basic flow table set. The rule processing module is used to perform rule normalization on the actual flow table set and the expected flow table set and generate rule fingerprints; The detection module is used to output a list of missing rules, a list of duplicate rules, and a list of inconsistent rules based on rule fingerprints, and to locate the cause of the offline mode. The results output module is used to generate analysis results containing target CVK host information, associated virtual machine information, and knowledge base links, and output them to the console display page.

Images