An industrial ring network MAC address drift detection and positioning method

Abstract

The present application relates to the technical field of industrial ring network communication, in particular to a kind of industrial ring network MAC address drift detection and positioning method.The present application is by in ring network core layer switch deployment flow probe collection cross network segment communication flow and extract quintuple and MAC address information, based on quintuple definition same session flow and carry out MAC address consistency comparison to trigger drift alarm, after alarm, by obtaining access layer switch MAC address table confirmation drift source node, using distributed SNMP polling architecture hierarchical collection core layer and access layer switch MAC address table, constructs IP-MAC-port mapping baseline library and carries out time sequence comparison and identifies binding exception, finally, in combination with ring network topology, baseline library and drift source node identification positioning local loop and cross device loop, active, accurate detection and fast positioning of MAC address drift are realized, effectively overcome the lack of active analysis positioning means for the MAC drift hidden danger of industrial ring network of prior art.

Description

Technical Field

[0001] This invention relates to the field of industrial ring network communication technology, and in particular to a method for detecting and locating MAC address drift in industrial ring networks. Background Technology

[0002] Industrial scenarios such as energy, smart manufacturing, and rail transportation have rigid requirements for high reliability, high stability, and low latency networks. Ring network topologies are widely used in industrial networks because their characteristics are well-matched to these requirements. However, industrial environments differ significantly from traditional office networks; if production processes are halted due to network outages, it can lead to huge economic losses or even safety incidents. Therefore, the "uninterruptibility" of the core layer network becomes a primary design goal.

[0003] The stable operation of industrial ring networks relies on a logically unidirectional topology and a stable mapping relationship between switch ports and MAC addresses. MAC address drift essentially occurs when a ring topology, designed for unidirectional communication, unexpectedly transforms into a bidirectional closed loop, thereby disrupting the unique correspondence between MAC addresses and switch ports.

[0004] Its harm is not simply due to abnormal address mapping; it can also trigger a series of serious malfunctions:

[0005] 1) Broadcast storm: Data packets are continuously copied and forwarded in loops, exhausting network bandwidth and switch processing resources.

[0006] 2) Data loss or mistransmission: Data packets are incorrectly forwarded to non-target ports or even dropped directly.

[0007] 3) Port protective shutdown: After detecting a loop, the switch may automatically trigger a protection mechanism to shut down the relevant ports, further expanding the scope of the fault.

[0008] The aforementioned faults directly impact the core requirements of high reliability and low latency for industrial ring networks. At best, they cause communication anomalies; at worst, they lead to control link interruptions and production shutdowns. Therefore, in industrial scenarios, strict prevention and rapid detection of MAC address drift are necessary. Summary of the Invention

[0009] To address the lack of existing technologies for proactive analysis and localization of MAC address drift risks in industrial ring networks, this invention provides a method for detecting and locating MAC address drift in industrial ring networks.

[0010] Therefore, the present invention provides the following technical solution: A method for detecting and locating MAC address drift in an industrial ring network includes the following steps: Deploy traffic probes on the core layer switches of the ring network to collect cross-segment communication traffic passing through the core layer switches and extract the five-tuple and MAC address information (to achieve unified monitoring of critical path traffic across the entire network and provide a data foundation for subsequent session-level MAC consistency comparison). Based on the collected communication traffic and the extracted 5-tuple information, consecutive data packets with the same 5-tuple information are defined as the same session flow. The MAC addresses in the same session flow are compared for consistency. When the preset anomaly judgment conditions are met, a MAC address drift alarm is triggered (accurate comparison is performed in the form of session flow, avoiding the false alarm problem caused by traditional single packet detection and improving the accuracy of drift detection). When a MAC address drift alarm is triggered, the access layer switch related to the drift establishes communication and obtains the MAC address table of the access layer switch. By comparing the mapping relationship between the MAC address in the table and the access layer switch port, the source node of the MAC address drift is identified (achieving rapid source tracing after alarm and directly locating the location where the drift occurred). A distributed SNMP polling architecture is adopted to collect the MAC address tables of the core layer switches and access layer switches of the ring network respectively (improving the efficiency of MAC address table collection, reducing the collection pressure of a single node, and adapting to large-scale industrial ring network deployment). Based on the MAC address tables of the core layer switches and access layer switches of the ring network, construct a baseline library for IP-MAC-port mapping of the ring network (establish a baseline mapping relationship under normal ring network conditions to provide a reference standard for subsequent anomaly identification). The real-time collected IP-MAC-port mapping relationship is compared with the mapping baseline library in a time series to identify binding anomalies; Based on the ring network device topology, mapping baseline library, and source nodes of MAC address drift, identify and locate local loops or cross-device loops that cause MAC address drift.

[0011] Furthermore, the traffic probe is deployed on the core layer switch in an embedded or side-mounted manner to collect cross-segment communication traffic flowing through the core layer switch (the deployment method is flexible and does not affect the original services and topology of the industrial ring network).

[0012] Furthermore, the step of performing MAC address consistency comparison on the same session stream, and triggering a MAC address drift alarm when a preset anomaly judgment condition is met, includes: Real-time comparison of the source MAC addresses of adjacent data packets in the session stream; When a source MAC address is inconsistent, it is marked as a suspected drift; The session stream is continuously verified within a preset period. When the number of suspected drifts reaches a preset abnormal threshold, it is determined to be MAC address drift and a MAC address drift alarm is triggered (by multiple verifications and threshold determinations, false alarms caused by instantaneous abnormalities are reduced and detection reliability is improved).

[0013] Furthermore, obtaining the MAC address table of the access layer switch and confirming the source node of the MAC address drift includes: The MAC address table is read from the access layer switch according to a preset period. If the same MAC address appears on different ports of the access layer switch within a preset time, the access layer switch is determined to be the drift source node (the drift source is located directly based on the port mapping change, the judgment logic is simple and efficient, and it is suitable for the real-time requirements of industrial sites).

[0014] Furthermore, the distributed SNMP polling architecture consists of a master collector and several slave collectors, and the master collector and slave collectors communicate through a heartbeat link; The distributed SNMP polling architecture is used to collect the MAC address tables of the core layer switches and access layer switches within the ring network, including: The master collector collects MAC address tables from the core layer switches according to a first preset period, and the slave collectors collect MAC address tables from the access layer switches according to a second preset period.

[0015] Furthermore, the binding exception includes at least one of the following: The same IP address appears on different ports of the same switch within a preset time period; The same IP address can appear simultaneously on different switches with isolated topologies.

[0016] Furthermore, the identification and location of local loops or cross-device loops that cause MAC address drift includes: If the MAC address anomaly only occurs within the same switch, it is determined to be a local loop; If the MAC address anomaly occurs between different switches, it is determined to be a cross-device loop.

[0017] Advantages and positive effects of the present invention: This invention collects cross-segment communication traffic by deploying traffic probes on the core layer switches of a ring network and extracts 5-tuple and MAC address information. Based on the 5-tuple, it defines the same session flow and performs MAC address consistency comparison to trigger a drift alarm. After the alarm, it confirms the drift source node by obtaining the MAC address table of the access layer switches. It adopts a distributed SNMP polling architecture to collect the MAC address tables of the core layer and access layer switches in a layered manner, builds an IP-MAC-port mapping baseline library, and performs time-series comparison to identify binding anomalies. Finally, it combines the ring network topology, baseline library, and drift source node to identify and locate local loops and cross-device loops, realizing the proactive, accurate detection and rapid location of MAC address drift. It effectively overcomes the shortcomings of existing technologies that lack proactive analysis and location methods for MAC drift hazards in industrial ring networks. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] This invention provides a method for detecting and locating MAC address drift in industrial ring networks, comprising the following steps: Deploy traffic probes on the core layer switches of the ring network to collect cross-segment communication traffic passing through the core layer switches and extract the five-tuple (source IP, destination IP, source port, destination port, transport layer protocol) and MAC address information; the traffic probes are deployed on the core layer switches in an embedded or side-mounted manner to collect cross-segment communication traffic flowing through the core layer switches.

[0020] Based on the collected communication traffic and extracted 5-tuple information, consecutive data packets with the same 5-tuple information are defined as the same session flow. A consistency comparison is performed on the MAC addresses within the same session flow. When preset anomaly detection conditions are met, a MAC address drift alarm is triggered, including: The source MAC addresses of adjacent data packets in the session stream are compared in real time.

[0021] When a source MAC address is inconsistent (e.g., the source MAC changes from a8c9-8a0c-a95a to b2d4-3e1f-8c9a), it is marked as a suspected drift.

[0022] The session stream is continuously verified within a preset period. When the number of suspected drifts reaches a preset abnormal threshold, it is determined to be MAC address drift and a MAC address drift alarm is triggered.

[0023] When a MAC address migration alarm is triggered, the access layer switch associated with the migration establishes communication and obtains its MAC address table (the MAC address table collection period for this access layer switch is ≤5 minutes). By comparing the mapping relationship between MAC addresses and access layer switch ports in the table, the source node of the MAC address migration is identified, including: The MAC address table is read from the access layer switch according to a preset period. If the same MAC address appears on different ports of the access layer switch within 10 seconds, the access layer switch is determined to be the source node of the drift.

[0024] On the network management server of the industrial control network, an SNMP data acquisition cluster is deployed, employing a distributed SNMP polling architecture to collect the MAC address tables of the core layer switches and access layer switches in the ring network. The distributed SNMP polling architecture consists of one master collector and several slave collectors, communicating with each other via a heartbeat link. The MAC address tables of the core layer switches and access layer switches within the ring network are collected using this distributed SNMP polling architecture, including: The main collector collects the MAC address table of the core layer switch according to the first preset period (2 minutes).

[0025] The collector collects the MAC address table of the access layer switch according to the second preset period (1 minute, high frequency coverage of areas with high drift).

[0026] Based on the MAC address tables of the core layer switches and access layer switches in the ring network, construct a baseline library for IP-MAC-port mapping of the ring network.

[0027] The real-time collected IP-MAC-port mapping relationships are compared with the mapping baseline database in a time series to identify binding anomalies; binding anomalies include at least one of the following: The MAC address corresponding to the same IP appears on different ports of the same switch within a preset time (<30 seconds).

[0028] The same IP address can appear simultaneously on different switches with isolated topologies.

[0029] Based on the ring network device topology, mapping baseline library, and source nodes of MAC address drift, identify and locate local loops or cross-device loops that cause MAC address drift, including: If the MAC address anomaly only occurs within the same switch, it is determined to be a local loop.

[0030] If the MAC address anomaly occurs between different switches, it is determined to be a cross-device loop.

[0031] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting and locating MAC address drift in an industrial ring network, characterized in that, Includes the following steps: Deploy traffic probes on the core layer switches of the ring network to collect cross-segment communication traffic passing through the core layer switches and extract the 5-tuple and MAC address information. Based on the collected communication traffic and the extracted 5-tuple information, consecutive data packets with the same 5-tuple information are defined as the same session flow. The MAC addresses in the same session flow are compared for consistency. When the preset abnormal judgment conditions are met, a MAC address drift alarm is triggered. When a MAC address drift alarm is triggered, the access layer switch related to the drift establishes communication and obtains the MAC address table of the access layer switch. By comparing the mapping relationship between the MAC address in the table and the access layer switch port, the source node of the MAC address drift is identified. A distributed SNMP polling architecture is adopted to collect the MAC address tables of the core layer switches and access layer switches of the ring network respectively; Based on the MAC address tables of the core layer switches and access layer switches of the ring network, construct a baseline library for IP-MAC-port mapping of the ring network; The real-time collected IP-MAC-port mapping relationship is compared with the mapping baseline library in a time series to identify binding anomalies; Based on the ring network device topology, mapping baseline library, and source nodes of MAC address drift, identify and locate local loops or cross-device loops that cause MAC address drift.

2. The method for detecting and locating MAC address drift in an industrial ring network according to claim 1, characterized in that, The traffic probes are deployed on the core layer switch in an embedded or side-mounted manner to collect cross-segment communication traffic flowing through the core layer switch.

3. The method for detecting and locating MAC address drift in an industrial ring network according to claim 1, characterized in that, The step of performing MAC address consistency comparison on the same session stream, and triggering a MAC address drift alarm when a preset anomaly judgment condition is met, includes: Real-time comparison of the source MAC addresses of adjacent data packets in the session stream; When a source MAC address is inconsistent, it is marked as a suspected drift; The session stream is continuously verified within a preset period. When the number of suspected drifts reaches a preset abnormal threshold, it is determined to be MAC address drift and a MAC address drift alarm is triggered.

4. The method for detecting and locating MAC address drift in an industrial ring network according to claim 1, characterized in that, The step of obtaining the MAC address table of the access layer switch and identifying the source node of the MAC address drift includes: The MAC address table is read from the access layer switch according to a preset period. If the same MAC address appears on different ports of the access layer switch within a preset time, the access layer switch is determined to be the source node of the drift.

5. The method for detecting and locating MAC address drift in an industrial ring network according to claim 1, characterized in that, The distributed SNMP polling architecture consists of a master collector and several slave collectors, and the master collector and slave collectors communicate through a heartbeat link. The distributed SNMP polling architecture is used to collect the MAC address tables of the core layer switches and access layer switches within the ring network, including: The master collector collects MAC address tables from the core layer switches according to a first preset period, and the slave collectors collect MAC address tables from the access layer switches according to a second preset period.

6. The method for detecting and locating MAC address drift in an industrial ring network according to claim 1, characterized in that, The binding exception includes at least one of the following: The same IP address appears on different ports of the same switch within a preset time period; The same IP address can appear simultaneously on different switches with isolated topologies.

7. The method for detecting and locating MAC address drift in an industrial ring network according to claim 1, characterized in that, The identification and location of local or cross-device loops that cause MAC address drift includes: If the MAC address anomaly only occurs within the same switch, it is determined to be a local loop; If the MAC address anomaly occurs between different switches, it is determined to be a cross-device loop.