A network device state-aware differentiation method and related devices

Abstract

The application discloses a network equipment state sensing distinguishing method and related equipment, and the application does not directly determine disconnection when polling is unreachable, but comprehensively judges in combination with an address resolution protocol table, a MAC address table and historical fingerprints of a configuration management database to clearly distinguish different judgment results; the method of the application performs multi-dimensional data source cross verification by fusing direct responses from target equipment, indirect information from link layers of intermediate equipment and historical data from a configuration management database, and the judgment result is more reliable, so that the method can be widely applied to the technical field of data processing.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for distinguishing the status of network devices and related equipment. Background Technology

[0002] In modern large-scale enterprise networks and data center networks, real-time device change awareness is crucial. Device change awareness relies on devices proactively reporting changes using trap or telemetry detection. However, this approach cannot accurately determine device status in a timely manner. Polling based on SNMM or ICMP Ping typically determines device status by checking the reachability of the device's IP address. However, this method has significant drawbacks: 1. Inability to distinguish between device outage and device replacement: When a device is replaced (e.g., due to hardware failure), the new device may use the old IP address and quickly come online. The monitoring system only detects a brief interruption and then resumes operation, mistakenly believing that the original device has restarted. This fails to recognize that the device has been replaced, resulting in outdated CMDB data and inaccurate asset information.

[0003] 2. High false alarm rate: The device may become unreachable due to ACL policy adjustments, SNMP service failures, or other reasons, even though its service forwarding function is normal. Traditional monitoring will mistakenly identify it as "out of contact," generating a large number of invalid alarms and wasting maintenance manpower.

[0004] 3. Reliance on a single data source: Judgment is based solely on the device's own response (such as Ping or SNMP). When there is a network path failure or an anomaly in the device management plane, the judgment result is unreliable. Summary of the Invention

[0005] The main objective of this invention is to provide a method, apparatus, electronic device, storage medium, and program product for distinguishing network device status, aiming to solve at least one problem in the prior art.

[0006] To achieve the above objectives, one aspect of this invention proposes a network device state awareness and differentiation method, the method comprising: The target network device is polled and its polling status is collected through the southbound interface. Target data is collected from the preset configuration management database. The target data includes the historical device fingerprint information and network topology relationship of the target network device. The historical device fingerprint information includes the historical serial number and historical management MAC address. If the polling status is reachable, directly obtain the current device fingerprint information of the target network device, and determine the first status judgment result by comparing the current device fingerprint information with the historical device fingerprint information. If the polling status is unreachable, collect the address resolution protocol table from the gateway or core switch of the network segment where the target network device is located, and then extract the target MAC address based on the IP address of the target network device; Based on the network topology, collect the MAC address table from the upstream switch of the target network device, and query the first port status of the historical managed MAC address and the second port status of the target MAC address based on the MAC address table. Based on the target MAC address, the first port status, and the second port status, the second status judgment result is obtained through comprehensive logical judgment. Based on the result of the first state judgment or the result of the second state judgment, the target action is mapped and executed.

[0007] In some embodiments, the historical serial number and historical management MAC address are obtained by matching the IP address of the target network device from the configuration management database. The current device fingerprint information of the target network device is directly obtained, and the first state judgment result is determined by comparing the current device fingerprint information with the historical device fingerprint information, including the following steps: The current serial number and current management MAC address are directly collected from the target network device via the southbound interface as the current device fingerprint information; The current serial number is compared with the historical serial numbers to obtain the first comparison result; The current management MAC address is compared with the historical management MAC addresses to obtain the second comparison result; If the first comparison result and the second comparison result are both consistent, the first state judgment result is determined to be that the equipment has not been changed; If there is any inconsistency between the first comparison result and the second comparison result, the first state judgment result is determined to be that the equipment has been changed.

[0008] In some embodiments, the Address Resolution Protocol (ARP) table is collected from the gateway or core switch of the network segment where the target network device is located, and then the target MAC address is extracted based on the IP address of the target network device, including the following steps: The southbound interface sends a table request to the gateway or core switch of the network segment where the target network device is located, so that the gateway or core switch responds to the table request and returns the Address Resolution Protocol (ARP) table. Use the IP address of the target network device as the keyword to search the address resolution protocol table; If a corresponding entry is found in the Address Resolution Protocol (ARP) table, the MAC address in that entry is extracted as the target MAC address. If no corresponding entry is found in the Address Resolution Protocol (ARP) table, the target MAC address will be set to empty.

[0009] In some embodiments, based on network topology, a MAC address table is collected from the upstream switch of the target network device, and the first port status of historically managed MAC addresses and the second port status of the target MAC address are queried based on the MAC address table, including the following steps: Determine the upstream switch connected to the target network device based on the network topology; Collect the MAC address table of the upstream switch through the southbound interface; Using historical MAC addresses as keywords, a search is performed in the MAC address table. If a corresponding port is found, the status of the first port is determined to exist; otherwise, the status of the first port is determined to not exist. The target MAC address is used as the key to search the MAC address table. If the corresponding port is found, the second port is determined to exist; otherwise, the second port is determined to not exist.

[0010] In some embodiments, based on the target MAC address, the first port status, and the second port status, a second status determination result is obtained through comprehensive logical judgment, including the following steps: If the target MAC address is empty and the first port status is non-existent, the second status judgment result is determined to be that the device is disconnected. If the target MAC address is not empty, the target MAC address is different from the historical management MAC address, and the second port status is present, the second status judgment result is determined to be that the device has been changed. If the target MAC address is not empty, the target MAC address is consistent with the historical management MAC address, and the first port status is present, the second status judgment result is determined to be that the device has not changed but the management plane is abnormal.

[0011] In some embodiments, the first state determination result includes whether the device has been changed or not, and the second state determination result includes whether the device is disconnected, whether the device has been changed, or whether the device has not been changed but the management interface is abnormal. Based on the first state determination result or the second state determination result, a target action is mapped and executed, including the following steps: If the polling status is reachable: When the first state judgment result is that the device has been changed, a device change alarm is triggered, and an update request is sent to the configuration management database to update the asset record corresponding to the IP address of the target network device; When the first state judgment result is that the device has not changed, the device's last online time is updated according to the timestamp corresponding to the polling state. If the polling status is unreachable: When the second state judgment result is that the device is disconnected, a device disconnection alarm is triggered. When the second state judgment result is that the device has been changed, a device change alarm is triggered, and an update request is sent to the configuration management database to update the asset record corresponding to the IP address of the target network device; When the second state judgment result is that the device has not been changed but the management plane is abnormal, the management plane abnormal alarm is triggered and the issuance of the device disconnection alarm is suppressed.

[0012] In some embodiments, when the first state determination result or the second state determination result indicates that the device has not changed, the method further includes the following steps: Initiate a connection to the new device using the IP address of the target network device through the southbound interface, and collect the new device's serial number; Use the new device serial number to confirm the device change. In response to the completion of the device change confirmation operation, the new device serial number is updated to the configuration management database.

[0013] To achieve the above objectives, another aspect of the present invention provides a network device state awareness and differentiation device, the device comprising: The first module is used to poll the target network device through the southbound interface and collect the polling status, and collect target data from the preset configuration management database. The target data includes the historical device fingerprint information and network topology relationship of the target network device. The historical device fingerprint information includes the historical serial number and historical management MAC address. The second module is used to directly obtain the current device fingerprint information of the target network device if the polling status is reachable, and determine the first status judgment result by comparing the current device fingerprint information with the historical device fingerprint information. The third module is used to collect the address resolution protocol table from the gateway or core switch of the network segment where the target network device is located if the polling status is unreachable, and then extract the target MAC address based on the IP address of the target network device. The fourth module is used to collect MAC address tables from the upstream switches of the target network devices based on network topology, and query the first port status of historically managed MAC addresses and the second port status of the target MAC address based on the MAC address tables. The fifth module is used to obtain the second state judgment result based on the target MAC address, the first port status, and the second port status through comprehensive logical judgment. The sixth module is used to map and execute the target action based on the result of the first state judgment or the result of the second state judgment.

[0014] To achieve the above objectives, another aspect of the present invention provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned method.

[0015] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned method.

[0016] To achieve the above objectives, another aspect of the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method.

[0017] The embodiments of the present invention include at least the following beneficial effects: The present invention provides a network device status awareness and differentiation method, device, electronic device, storage medium, and program product. This scheme polls the target network device through a southbound interface and collects the polling status, and collects target data from a preset configuration management database. The target data includes the target network device's historical device fingerprint information and network topology relationship. The historical device fingerprint information includes historical serial number and historical management MAC address. If the polling status is reachable, the current device fingerprint information of the target network device is directly obtained, and a first status judgment result is determined by comparing the current device fingerprint information with the historical device fingerprint information. If the polling status is unreachable, an address resolution protocol table is collected from the gateway or core switch of the network segment where the target network device is located, and then the target MAC address is extracted based on the target network device's IP address. Based on the network topology relationship, a MAC address table is collected from the upstream switch of the target network device, and the first port status of the historical management MAC address and the second port status of the target MAC address are queried based on the MAC address table. Based on the target MAC address, the first port status, and the second port status, a second status judgment result is obtained through comprehensive logical judgment. The target action is executed according to the first or second status judgment result. In this embodiment of the invention, when polling fails to reach the target device, the connection is not directly determined to be lost. Instead, the historical fingerprints of the address resolution protocol table, MAC address table, and configuration management database are combined for a comprehensive judgment to clearly distinguish different judgment results. The method of this invention performs multi-dimensional data source cross-verification by integrating direct responses from the target device, link layer indirect information from intermediate devices (gateways / switches), and historical data from the configuration management database, making the judgment results more reliable. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of an implementation environment for the network device state awareness and differentiation method provided in this embodiment of the invention; Figure 2 This is a flowchart illustrating the network device state awareness and differentiation method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the overall process of the network device state awareness and differentiation method provided in this embodiment of the invention. Figure 4 This is a schematic diagram illustrating an example of the logical decision-making process for intelligent device status judgment provided in an embodiment of the present invention; Figure 5 This is a schematic diagram illustrating an example of a comprehensive information analysis and decision-making process provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the network device state awareness and differentiation device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0020] It is understood that the terms "first," "second," etc., used in this invention may be used to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of embodiments of this invention, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words "if" or "when" as used herein may be interpreted as "when," "in response to determination," or "in the event of a determination."

[0021] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.

[0022] Unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used in this invention is for descriptive purposes only and is not intended to limit the invention.

[0023] To facilitate understanding of the technical solution of this invention, the following explanations are provided regarding the technical terms that may be involved in the technical solution of this invention: Device fingerprint: refers to a set of characteristic data used to uniquely identify a network device, including but not limited to device serial number, management MAC address, system object identifier (sysObjectID), and device name (sysName).

[0024] CMDB: Configuration Management Database, a repository used to store and manage the configuration items of all network devices and their interrelationships.

[0025] ARP table: Address Resolution Protocol table, exists in network layer devices (such as routers and Layer 3 switches), and is used to record the mapping relationship between IP addresses and MAC addresses.

[0026] MAC Address Table: The Media Access Control Address Table exists in data link layer devices (such as switches) and is used to record the mapping relationship between MAC addresses and switch ports.

[0027] Southbound interface: In a network system, the interface through which the controller connects to the controlled devices, such as SNMP, CLI, NetConf, etc.

[0028] In related technologies, there is an urgent need for a technical solution that can comprehensively utilize multi-source information, accurately perceive the real state of the device, and intelligently distinguish the different scenarios mentioned above.

[0029] In view of this, this embodiment of the invention provides a network device status awareness and differentiation method and related equipment. This scheme polls the target network device via a southbound interface and collects the polling status, collecting target data from a preset configuration management database. The target data includes historical device fingerprint information and network topology relationships of the target network device. The historical device fingerprint information includes historical serial numbers and historical management MAC addresses. If the polling status is reachable, the current device fingerprint information of the target network device is directly obtained, and a first status judgment result is determined by comparing the current device fingerprint information with the historical device fingerprint information. If the polling status is unreachable, an address resolution protocol table is collected from the gateway or core switch of the network segment where the target network device is located, and then the target MAC address is extracted based on the IP address of the target network device. Based on the network topology relationships, a MAC address table is collected from the upstream switch of the target network device, and the first port status of the historical management MAC address and the second port status of the target MAC address are queried based on the MAC address table. Based on the target MAC address, the first port status, and the second port status, a second status judgment result is obtained through comprehensive logical judgment. The target action is executed according to the first or second status judgment result. In this embodiment of the invention, when polling fails to reach the target device, the connection is not directly determined to be lost. Instead, the historical fingerprints of the address resolution protocol table, MAC address table, and configuration management database are combined for a comprehensive judgment to clearly distinguish different judgment results. The method of this invention performs multi-dimensional data source cross-verification by integrating direct responses from the target device, link layer indirect information from intermediate devices (gateways / switches), and historical data from the configuration management database, making the judgment results more reliable.

[0030] It is understood that the network device state awareness and differentiation method provided by this invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal can be a smartphone, tablet, laptop, or desktop computer, but it is not limited to these.

[0031] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided by an embodiment of the present invention. (Refer to...) Figure 1The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0032] Server 101 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0033] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0034] Terminal 102 can be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the invention does not impose any limitations.

[0035] For example, based on Figure 1 The implementation environment shown in this embodiment of the invention provides a network device state awareness and differentiation method. The following description uses the application of this network device state awareness and differentiation method in server 101 as an example. It can be understood that this network device state awareness and differentiation method can also be applied to terminal 102.

[0036] Reference Figure 2 , Figure 2 This is an optional flowchart of the network device state awareness and differentiation method provided in the embodiments of the present invention. The executing subject of the network device state awareness and differentiation method can be any of the aforementioned computer devices (including servers or terminals). Figure 2 The method may include, but is not limited to, steps S100 to S600.

[0037] Step S100: Poll the target network device and collect the polling status through the southbound interface, and collect target data from the preset configuration management database; The target data includes the historical device fingerprint information and network topology of the target network device. The historical device fingerprint information includes the historical serial number and the historical management MAC address. For example, in some specific implementations, the historical serial number and historical management MAC address are obtained by matching the target network device's IP address from the configuration management database.

[0038] Step S200: If the polling status is reachable, directly obtain the current device fingerprint information of the target network device, and determine the first status judgment result by comparing the current device fingerprint information with the historical device fingerprint information. It should be noted that in some embodiments, directly obtaining the current device fingerprint information of the target network device and determining the first state judgment result by comparing the current device fingerprint information with the historical device fingerprint information may include the following steps: directly collecting the current serial number and the current management MAC address from the target network device as the current device fingerprint information through the southbound interface; comparing the current serial number with the historical serial number to obtain a first comparison result; comparing the current management MAC address with the historical management MAC address to obtain a second comparison result; if the first comparison result and the second comparison result are both consistent, the first state judgment result is determined to be that the device has not been changed; if there is any inconsistency between the first comparison result and the second comparison result, the first state judgment result is determined to be that the device has been changed.

[0039] For example, in some specific implementations, assuming that device Device-A (IP:IP-A) is polled (e.g., by SNMP Get or ICMP Ping), the device is first determined to be reachable and its fingerprint information is matched, as follows: Yes: The current fingerprint of the device (serial number SN-Acur, MAC-Mcur) has been successfully collected. Compare it with the historical fingerprints (SN-Ahis, MAC-Mhis) recorded under this IP (IP-A) in the CMDB.

[0040] If a match is found: the device has not been changed, and the last online time is updated.

[0041] If the device does not match, it is determined that the device has been changed, triggering an alarm and prompting an update to the CMDB.

[0042] No: Proceed with the subsequent judgment.

[0043] Step S300: If the polling status is unreachable, collect the address resolution protocol table from the gateway or core switch of the network segment where the target network device is located, and then extract the target MAC address based on the IP address of the target network device. It should be noted that in some embodiments, collecting the Address Resolution Protocol (ARP) table from the gateway or core switch of the network segment where the target network device is located, and then extracting the target MAC address based on the IP address of the target network device, may include the following steps: sending a table request to the gateway or core switch of the network segment where the target network device is located via a southbound interface, so that the gateway or core switch responds to the table request and returns the ARP table; using the IP address of the target network device as the key, searching in the ARP table; if a corresponding entry is found in the ARP table, extracting the MAC address in that entry as the target MAC address; if no corresponding entry is found in the ARP table, configuring the target MAC address as empty.

[0044] For example, in some specific implementations, the ARP table is queried: the ARP table on the gateway or core switch of the network segment where the target device is located is collected to find the MAC address (MAC-Arp) corresponding to IP-A.

[0045] Step S400: Based on the network topology, collect the MAC address table from the upstream switch of the target network device, and query the first port status of the historical managed MAC address and the second port status of the target MAC address based on the MAC address table; It should be noted that in some embodiments, step S400 may include the following steps: determining the upstream switch to which the target network device is connected based on the network topology; collecting the MAC address table of the upstream switch through the southbound interface; using the historical management MAC address as a keyword to search the MAC address table, and if a corresponding port is found, determining that the first port is present; otherwise, determining that the first port is absent; using the target MAC address as a keyword to search the MAC address table, and if a corresponding port is found, determining that the second port is present; otherwise, determining that the second port is absent.

[0046] For example, in some specific implementations, the MAC address table is queried: based on the topology information recorded in the CMDB, the upstream switch of Device-A is found, its MAC address table is collected, and the port where the historical MAC address (MAC-Mhis) or new MAC address (MAC-Arp) appears is found.

[0047] Step S500: Based on the target MAC address, the first port status, and the second port status, the second status judgment result is obtained through comprehensive logic judgment; It should be noted that in some embodiments, step S500 may include the following steps: if the target MAC address is empty and the first port status is non-existent, determine the second status judgment result as device disconnection; if the target MAC address is not empty, the target MAC address is different from the historical management MAC address, and the second port status is present, determine the second status judgment result as device has been changed; if the target MAC address is not empty, the target MAC address is the same as the historical management MAC address, and the first port status is present, determine the second status judgment result as device has not been changed but management plane is abnormal.

[0048] For example, in some specific implementations, the comprehensive decision-making process can be achieved as follows: Scenario A: The ARP table does not contain an entry for IP-A, and MAC-Mhis cannot be found in the MAC tables of all upstream switches.

[0049] Decision result: The device is confirmed to be out of contact (offline). The device may have been powered off or physically disconnected.

[0050] Scenario B: IP-A in the ARP table corresponds to a new MAC address (MAC-Arp ≠ MAC-Mhis), and the MAC-Arp has been learned on the same or different ports of the upstream switch.

[0051] Decision result: The equipment has most likely been changed, and a new device is using IP-A.

[0052] Scenario C: The MAC address corresponding to IP-A in the ARP table is consistent with the historical records (MAC-Arp == MAC-Mhis), and MAC-Mhis can be found on the expected port of the upstream switch.

[0053] Decision result: The device has not been changed but the management interface is abnormal. The device is online and the network connectivity is normal, but the SNMP or ICMP service is unavailable.

[0054] Step S600: Based on the first state judgment result or the second state judgment result, map and execute the target action; It should be noted that the first state judgment result includes whether the device has been changed or not, and the second state judgment result includes whether the device is disconnected, whether the device has been changed, or whether the device has not been changed but the management plane is abnormal. In some embodiments, step S600 may include the following steps: If the polling state is reachable: when the first state judgment result is that the device has been changed, a device change alarm is triggered, and an update request is sent to the configuration management database to update the asset record corresponding to the IP address of the target network device; when the first state judgment result is that the device has not been changed, the last online time of the device is updated in response to the timestamp corresponding to the polling state; if the polling state is unreachable: when the second state judgment result is that the device is disconnected, a device disconnection alarm is triggered; when the second state judgment result is that the device has been changed, a device change alarm is triggered, and an update request is sent to the configuration management database to update the asset record corresponding to the IP address of the target network device; when the second state judgment result is that the device has not been changed but the management plane is abnormal, a management plane abnormality alarm is triggered, and the issuance of a device disconnection alarm is suppressed.

[0055] For example, in some specific implementations, based on the first state judgment result, if it is determined that the device has not changed, the last online time is updated; if it is determined that the device has changed, an alarm is triggered and a prompt to update the CMDB is made. Based on the second state judgment result, if the device has changed, an alarm is triggered and a prompt to update the CMDB is made; if the device is disconnected, a device disconnection alarm is triggered. In this invention, a new scenario is added where the device has not changed but the management plane is abnormal. It can be determined that the device is online and the network connectivity is normal, but the SNMP or ICMP service is unavailable. In this case, a "management plane abnormality" alarm is triggered instead of a "device disconnection" alarm.

[0056] It should be noted that in some embodiments, when the first state judgment result or the second state judgment result is that the device has not changed, the target action of the mapping may also include the following steps: initiating a connection to the new device using the IP address of the target network device through the southbound interface, and collecting the new device serial number of the new device; using the new device serial number to perform a device change confirmation operation; and updating the new device serial number to the configuration management database in response to the completion of the device change confirmation operation.

[0057] For example, in some specific implementations, when the device status is unchanged, the system can attempt to collect the serial number of the new device via SNMP or SSH for final confirmation to complete the device change confirmation operation. At the same time, the relevant information in the configuration management database is updated synchronously, which can serve as the basis for subsequent network device status awareness and differentiation.

[0058] To explain in detail the principle of the technical solution of the present invention, the overall process of the present invention will be described below with reference to some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0059] In view of the shortcomings of existing technologies, the purpose of this invention is to overcome these deficiencies and provide a technical solution for accurate perception and differentiation of network device status based on multi-dimensional information fusion. The method of this invention aims to: 1. Effectively distinguish whether a device is truly offline, has not been changed but has an abnormal management interface, or has been replaced or changed.

[0060] 2. Reduce the false alarm rate and false alarm rate of equipment change sensing, and improve the accuracy and operability of equipment sensing.

[0061] 3. Implement automated verification and updating of CMDB assets to ensure the accuracy of asset information.

[0062] 4. Improve the level of automation and intelligence in network operation and maintenance.

[0063] To achieve the above objectives, the present invention adopts the following technical solution: The core of the method described in this invention lies in the fact that when the monitoring system cannot directly detect the target device through a southbound interface (such as SNMP or ICMP), it does not immediately determine that the device is out of service. Instead, it initiates a multi-dimensional information fusion diagnostic process. This process comprehensively utilizes link layer and network layer information (such as ARP tables and MAC address tables) on intermediate network devices (such as gateway switches and upstream switches), and combines it with historical device "fingerprint" information pre-stored in the CMDB to perform comprehensive logical reasoning, ultimately arriving at an accurate status judgment.

[0064] In some specific embodiments, the technical solution of the present invention can be implemented through the following architecture, i.e., modules: 1. Status Awareness Module: Responsible for periodically polling the target device through the southbound interface to obtain its current status and device fingerprint information.

[0065] 2. CMDB module: Stores historical device fingerprint information, management IP, and network topology relationships (such as upstream switch information of the device) for all network devices.

[0066] 3. Multi-dimensional information acquisition module: When the status awareness module cannot directly connect to the target device, this module is activated to collect information such as ARP table and MAC address table on the intermediate network device.

[0067] 4. Intelligent Analysis and Decision Engine: This is the core module of the invention. It receives data from the state perception module and the multi-dimensional information acquisition module, compares and analyzes it with historical data in the CMDB, and outputs the final state judgment result based on the preset logical decision tree.

[0068] 5. Action Execution and Alarm Module: Based on the output of the decision engine, execute corresponding actions, such as updating the CMDB, sending precise alarms ("device disconnection" or "device change"), and suppressing alarms.

[0069] like Figure 3 The diagram shows an optional flow example of the network device state awareness and differentiation method according to an embodiment of the present invention. In some specific application scenarios, the method flow of this embodiment of the present invention can be implemented as follows: 1. Initial status check: The status awareness module polls Device-A (IP:IP-A) according to the plan (e.g., SNMP Get or ICMP Ping).

[0070] 2. For example Figure 4 The image shows an example of the logical decision-making process for intelligent device status judgment provided in an embodiment of the present invention. In some specific implementations, the first-level judgment (whether the device is reachable) can be implemented as follows: Yes: The current fingerprint of the device (serial number SN-Acur, MAC-Mcur) has been successfully collected. Compare it with the historical fingerprints (SN-Ahis, MAC-Mhis) recorded under this IP (IP-A) in the CMDB.

[0071] If a match is found: the device has not been changed, and the last online time is updated.

[0072] If the device does not match, it is determined that the device has been changed, triggering an alarm and prompting an update to the CMDB.

[0073] No: Activate the multi-dimensional information collection module.

[0074] 3. For example Figure 5 The image shows an example of a comprehensive information analysis and decision-making process provided by an embodiment of the present invention. In some specific implementations, the second-level judgment (multi-dimensional information collection) can be achieved as follows: Query ARP table: Collect the ARP table on the gateway or core switch of the network segment where the target device is located, and find the MAC address (MAC-Arp) corresponding to IP-A.

[0075] Query the MAC address table: Based on the topology information recorded in the CMDB, find the upstream switch of Device-A, collect its MAC address table, and find which port the historical MAC address (MAC-Mhis) or new MAC address (MAC-Arp) appears on.

[0076] 4. The third-level judgment (comprehensive decision-making) can achieve the following: Scenario A: The ARP table does not contain an entry for IP-A, and MAC-Mhis cannot be found in the MAC tables of all upstream switches.

[0077] Decision result: The device is confirmed to be out of contact (offline). The device may have been powered off or physically disconnected.

[0078] Scenario B: IP-A in the ARP table corresponds to a new MAC address (MAC-Arp ≠ MAC-Mhis), and the MAC-Arp has been learned on the same or different ports of the upstream switch.

[0079] Decision result: The device has most likely been changed, and a new device is using IP-A. The system can attempt to collect the serial number of this new device via SNMP or SSH for final confirmation.

[0080] Scenario C: The MAC address corresponding to IP-A in the ARP table is consistent with the historical records (MAC-Arp == MAC-Mhis), and MAC-Mhis can be found on the expected port of the upstream switch.

[0081] Decision result: The device has not been changed, but the management plane is abnormal. The device is online and network connectivity is normal, but the SNMP or ICMP service is unavailable. A "Management plane abnormality" alarm is triggered instead of a "Device disconnected" alarm.

[0082] In summary, existing technologies mostly collect device change information through SNMP agents on network devices. However, when a device malfunctions, these methods cannot distinguish between scenarios such as device disconnection, device changes, management plane anomalies, and SNMP service unavailability. This invention provides a multi-dimensional information fusion diagnostic process and a comprehensive method for judging device status. Compared to existing technologies, this invention offers at least the following advantages: 1. Accuracy: It fundamentally solves the industry problem that traditional monitoring cannot distinguish between equipment disconnection and equipment changes, greatly improving the accuracy of status judgment.

[0083] 2. Noise Reduction and Burden Reduction: Significantly reduces "false disconnection" alarms caused by misconfiguration of the management interface, alleviating the alarm handling burden on maintenance personnel.

[0084] 3. Automated Asset Governance: It can automatically detect unrecorded device change events and trigger the CMDB update process, realizing automated governance of network assets and ensuring the accuracy of asset data.

[0085] 4. Enhanced reliability: The judgment is made by using network layer (L2 / L3) information, which is usually more reliable and less susceptible to change than application layer services (SNMP), making the judgment results more credible.

[0086] 5. High versatility: This method does not depend on specific vendor equipment. As long as the network equipment supports standard ARP and MAC address learning functions, it can be applied, and has good universality and scalability.

[0087] like Figure 6 As shown, this embodiment of the invention also provides a network device state awareness and differentiation device 900, which can implement the above-described method. This device may include: The first module 901 is used to poll the target network device through the southbound interface and collect the polling status, and collect target data from the preset configuration management database; wherein, the target data includes the historical device fingerprint information and network topology relationship of the target network device, and the historical device fingerprint information includes the historical serial number and historical management MAC address; The second module 902 is used to directly obtain the current device fingerprint information of the target network device if the polling status is reachable, and determine the first status judgment result by comparing the current device fingerprint information with the historical device fingerprint information. The third module 903 is used to collect the address resolution protocol table from the gateway or core switch of the network segment where the target network device is located if the polling status is unreachable, and then extract the target MAC address based on the IP address of the target network device. The fourth module 904 is used to collect the MAC address table from the upstream switch of the target network device based on the network topology, and query the first port status of the historical managed MAC address and the second port status of the target MAC address based on the MAC address table; The fifth module 905 is used to obtain the second state judgment result based on the target MAC address, the first port state, and the second port state through comprehensive logical judgment. The sixth module 906 is used to map and execute the target action based on the result of the first state judgment or the result of the second state judgment.

[0088] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0089] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described above. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0090] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0091] like Figure 7 As shown, Figure 7The hardware structure of an electronic device 1000 according to another embodiment is illustrated. The electronic device 1000 includes: The processor 1001 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (aSIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention. The memory 1002 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RaM). The memory 1002 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1002 and is called and executed by the processor 1001. Input / output interface 1003 is used to implement information input and output; The communication interface 1004 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 1005 transmits information between various components of the device (e.g., processor 1001, memory 1002, input / output interface 1003, and communication interface 1004); The processor 1001, memory 1002, input / output interface 1003 and communication interface 1004 are connected to each other within the device via bus 1005.

[0092] The electronic device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0094] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0095] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0096] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0097] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0098] The network device status awareness and differentiation method, apparatus, electronic device, storage medium, and program product provided in this invention poll the target network device and collect its polling status through a southbound interface, and collect target data from a preset configuration management database. The target data includes historical device fingerprint information and network topology relationships of the target network device. The historical device fingerprint information includes historical serial numbers and historical management MAC addresses. If the polling status is reachable, the current device fingerprint information of the target network device is directly obtained, and a first status judgment result is determined by comparing the current device fingerprint information with the historical device fingerprint information. If the polling status is unreachable, an address resolution protocol table is collected from the gateway or core switch of the network segment where the target network device is located, and then the target MAC address is extracted based on the IP address of the target network device. Based on the network topology relationships, a MAC address table is collected from the upstream switch of the target network device, and the first port status of the historical management MAC address and the second port status of the target MAC address are queried based on the MAC address table. Based on the target MAC address, the first port status, and the second port status, a second status judgment result is obtained through comprehensive logical judgment. The target action is executed according to the first or second status judgment result. In this embodiment of the invention, when polling fails to reach the target device, the connection is not directly determined to be lost. Instead, the historical fingerprints of the address resolution protocol table, MAC address table, and configuration management database are combined for a comprehensive judgment to clearly distinguish different judgment results. The method of this invention performs multi-dimensional data source cross-verification by integrating direct responses from the target device, link layer indirect information from intermediate devices (gateways / switches), and historical data from the configuration management database, making the judgment results more reliable.

[0099] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0100] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0101] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0102] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0103] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.

Claims

1. A method for distinguishing the state of network devices, characterized in that, The method includes the following steps: The target network device is polled and its polling status is collected via the southbound interface, and target data is collected from the preset configuration management database. The target data includes the historical device fingerprint information and network topology relationship of the target network device. The historical device fingerprint information includes the historical serial number and historical management MAC address. If the polling status is reachable, the current device fingerprint information of the target network device is directly obtained, and the first status judgment result is determined by comparing the current device fingerprint information with the historical device fingerprint information. If the polling status is unreachable, the address resolution protocol table is collected from the gateway or core switch of the network segment where the target network device is located, and then the target MAC address is extracted based on the IP address of the target network device. Based on the network topology, a MAC address table is collected from the upstream switch of the target network device, and the first port status of the historical managed MAC address and the second port status of the target MAC address are queried based on the MAC address table. Based on the target MAC address, the first port status, and the second port status, the second status judgment result is obtained through comprehensive logical judgment. Based on the result of the first state determination or the result of the second state determination, the target action is mapped and executed.

2. The method according to claim 1, characterized in that, The historical serial number and the historical management MAC address are obtained by matching the IP address of the target network device from the configuration management database. The step of directly obtaining the current device fingerprint information of the target network device and determining the first state judgment result by comparing the current device fingerprint information with the historical device fingerprint information includes the following steps: The current serial number and current management MAC address are directly collected from the target network device through the southbound interface as the fingerprint information of the current device. The current serial number is compared with the historical serial number to obtain the first comparison result; The current management MAC address is compared with the historical management MAC address to obtain a second comparison result; If the first comparison result and the second comparison result are both consistent, the first status judgment result is determined to be that the equipment has not been changed; If there is any inconsistency between the first comparison result and the second comparison result, the first status judgment result is determined to be that the device has been changed.

3. The method according to claim 1, characterized in that, The step of collecting the Address Resolution Protocol (ARP) table from the gateway or core switch of the network segment where the target network device is located, and then extracting the target MAC address based on the IP address of the target network device, includes the following steps: The southbound interface sends a table request to the gateway or core switch of the network segment where the target network device is located, so that the gateway or the core switch responds to the table request and returns the address resolution protocol table. The IP address of the target network device is used as the keyword to search the address resolution protocol table; If a corresponding entry is found in the Address Resolution Protocol table, the MAC address in that entry is extracted as the target MAC address. If no corresponding entry is found in the address resolution protocol table, the target MAC address is configured to be empty.

4. The method according to claim 1, characterized in that, The step of collecting a MAC address table from the upstream switch of the target network device based on the network topology, and querying the first port status of the historical managed MAC address and the second port status of the target MAC address based on the MAC address table, includes the following steps: The upstream switch connected to the target network device is determined based on the network topology. The MAC address table of the upstream switch is collected through the southbound interface; The historical management MAC address is used as a keyword to search the MAC address table. If the corresponding port is found, the first port is determined to exist; otherwise, the first port is determined to not exist. The target MAC address is used as a keyword to search the MAC address table. If the corresponding port is found, the second port is determined to exist; otherwise, the second port is determined to not exist.

5. The method according to claim 1, characterized in that, The process of obtaining the second state determination result based on the target MAC address, the first port status, and the second port status through comprehensive logical judgment includes the following steps: If the target MAC address is empty and the first port status is non-existent, the second status judgment result is determined to be that the device is disconnected. If the target MAC address is not empty, the target MAC address is different from the historical management MAC address, and the second port status is present, the second status judgment result is determined to be that the device has been changed. If the target MAC address is not empty, the target MAC address is consistent with the historical management MAC address, and the first port status is present, the second status judgment result is determined to be that the device has not changed but the management plane is abnormal.

6. The method according to claim 1, characterized in that, The first status judgment result includes whether the device has been changed or not, and the second status judgment result includes whether the device is disconnected, whether the device has been changed, or whether the device has not been changed but the management interface is abnormal. The step of mapping and executing the target action based on the first status judgment result or the second status judgment result includes the following steps: If the polling state is reachable: When the first status judgment result is that the device has been changed, a device change alarm is triggered, and an update request is sent to the configuration management database to update the asset record corresponding to the IP address of the target network device; When the first state judgment result is that the device has not changed, the device's last online time is updated in response to the timestamp corresponding to the polling state. If the polling status is unreachable: When the second status judgment result is that the device is disconnected, a device disconnection alarm is triggered. When the second status judgment result is that the device has been changed, a device change alarm is triggered, and an update request is sent to the configuration management database to update the asset record corresponding to the IP address of the target network device; When the second state judgment result is that the device has not changed but the management plane is abnormal, a management plane abnormality alarm is triggered, and the issuance of the device disconnection alarm is suppressed.

7. The method according to claim 6, characterized in that, When the first state judgment result or the second state judgment result indicates that the device has not changed, the mapping execution target action further includes the following steps: Initiate a connection to a new device using the IP address of the target network device through the southbound interface, and collect the new device's serial number; Use the new device serial number to confirm the device change. In response to the completion of the device change confirmation operation, the new device serial number is updated to the configuration management database.

8. A network device status awareness and differentiation device, characterized in that, The apparatus, applicable to the method of any one of claims 1 to 7, comprises: The first module is used to poll the target network device through the southbound interface and collect the polling status, and collect target data from the preset configuration management database; wherein, the target data includes the historical device fingerprint information and network topology relationship of the target network device, and the historical device fingerprint information includes historical serial number and historical management MAC address; The second module is used to directly obtain the current device fingerprint information of the target network device if the polling status is reachable, and determine the first status judgment result by comparing the current device fingerprint information with the historical device fingerprint information. The third module is used to collect the Address Resolution Protocol (ARP) table from the gateway or core switch of the network segment where the target network device is located if the polling status is unreachable, and then extract the target MAC address based on the IP address of the target network device. The fourth module is used to collect a MAC address table from the upstream switch of the target network device based on the network topology, and query the first port status of the historical managed MAC address and the second port status of the target MAC address based on the MAC address table. The fifth module is used to obtain a second state judgment result based on the target MAC address, the first port status, and the second port status through comprehensive logical judgment. The sixth module is used to map and execute the target action based on the result of the first state judgment or the result of the second state judgment.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images