A network state analysis system based on routing protocol packets

Abstract

The application discloses a network state analysis system based on routing protocol messages, comprising a plurality of data acquisition modules and network state analysis modules in communication connection with each data acquisition module, wherein the data acquisition module is used for acquiring network messages, and the network state analysis module is used for processing and analyzing the network messages to obtain network state information. The application adopts the network analysis mode through message acquisition, does not affect the normal operation of the network, can reflect the current state of the network in time through real-time data acquisition and synchronous analysis, and does not exist the difference between devices. The application solves the pain points of more single protocol analysis in the prior art through cross-protocol network state analysis and the fusion of multi-protocol network states, and can provide more comprehensive and accurate network information.

Description

Technical Field

[0001] This invention belongs to the field of network operation and maintenance technology, specifically relating to the design of a network status analysis system based on routing protocol messages. Background Technology

[0002] Existing network operation and maintenance technologies typically rely on SNMP network management systems or SDN control platforms to log into various information on devices and then synthesize this information to perform an overall network situation analysis. These methods have the following drawbacks: (1) It requires the use of equipment resources and affects equipment stability: These systems log in to the equipment to obtain equipment operation data, which requires the response of various protocol software on the equipment. When there is a lot of data, the response time may be long, which will affect the normal operation of the equipment.

[0003] (2) Management difficulties: In large-scale networks, the management platform needs to log in to each device for management, and the management personnel need to understand the network deployment, which puts high demands on the management personnel.

[0004] (3) Poor security: Intrusive data acquisition methods bring great risks, and if the device login method is leaked, it will cause great security problems.

[0005] (4) Poor compatibility among multiple vendors: different vendors may provide different information interfaces, making it difficult to manage them in a unified manner, such as SNMP's private MIB.

[0006] In addition, there are currently methods for network analysis through messages, most of which focus on the analysis of single protocols. However, real networks usually deploy multiple routing protocols, requiring comprehensive analysis to obtain the true information about the network. Summary of the Invention

[0007] The purpose of this invention is to solve the problem that existing network analysis methods based on messages can only perform single protocol analysis, and to propose a network state analysis system based on routing protocol messages.

[0008] The technical solution of the present invention is: a network status analysis system based on routing protocol messages, comprising multiple data acquisition modules and a network status parsing module that is communicatively connected to each data acquisition module.

[0009] The data acquisition module is used to collect network packets.

[0010] The network status parsing module is used to process and analyze network packets to obtain network status information.

[0011] Furthermore, network packets include BGP protocol packets, OSPF protocol packets, and ISIS protocol packets.

[0012] The deployment method for the data acquisition module is as follows: Within the AS system, the data acquisition module is deployed only on the link where the reflector is located. Between AS systems, the data acquisition module is deployed between all EBGP sessions to collect BGP protocol messages.

[0013] Deploy a data acquisition module within each AREA to collect OSPF and ISIS protocol messages.

[0014] Furthermore, the network status analysis module includes a data integration management unit, multiple protocol analysis units, an integration analysis unit, and a data storage unit.

[0015] The data management unit communicates with each data acquisition module to receive, process, and distribute network messages.

[0016] Each protocol analysis unit is communicatively connected to the data integration management unit to receive network packets allocated by the data integration management unit, analyze the network packets to obtain local network status information, and then notify the integration analysis unit of the local network status information.

[0017] The comprehensive analysis unit communicates with each protocol analysis unit to receive local network status information from each protocol analysis unit, performs comprehensive analysis to obtain overall network status information, sends the overall network status information to the data storage unit, provides network status change log information based on the overall network status information, and provides a unified data interface to the outside world.

[0018] The data storage unit is communicatively connected to the comprehensive analysis unit, used to receive and store the overall network status information sent by the comprehensive analysis unit, and to provide a unified data interface to the outside world.

[0019] Furthermore, the data processing method of the data integration management unit is as follows: S1. Sort the network packets collected by each data acquisition module in chronological order.

[0020] S2. Classify the sorted network packets according to protocol type, AS system to which the packet belongs, AREA to which the packet belongs, or a combination of the above three factors.

[0021] S3. Distribute the classified network packets to each protocol analysis unit.

[0022] Furthermore, the specific method by which the protocol analysis unit analyzes network packets is as follows: Based on the analysis of BGP protocol messages, we can obtain the BGP virtual device information corresponding to the actual network, as well as the neighbor and routing information of the BGP virtual device.

[0023] Based on the analysis of OSPF protocol messages, we can obtain SRv6 information, virtual device information in the OSPF network, and neighbor and routing information of the virtual device.

[0024] Based on the analysis of ISIS protocol messages, we can obtain SRv6 information, virtual device information in the ISIS network, and the neighbor and routing information of the virtual device.

[0025] Furthermore, the comprehensive analysis unit performs network topology analysis, device comprehensive routing information analysis, path analysis, and historical information analysis on the local network status information sent by each protocol analysis unit.

[0026] Furthermore, the network topology information analysis specifically includes: The network topology information of each protocol is obtained by analyzing the BGP, OSPF and ISIS protocols. Virtual devices that represent the same device in different protocols are identified and merged to obtain complete routing information on a single device.

[0027] The specific method for identifying virtual devices that represent the same device in different protocols is as follows: if the source address of the neighbor established by the BGP device exists in the ISIS or OSPF directly connected routing table, then the BGP device and the ISIS or OSPF device are considered to represent the same device.

[0028] Furthermore, the comprehensive routing information analysis of the devices specifically includes: Based on the complete routing information on a device obtained from the analysis of the network topology, the main routing table information is selected according to the priority of the routes and directly used for routing forwarding.

[0029] Based on the directly connected route information obtained from ISIS and OSPF routing analysis, the directly connected routes on the corresponding routers are obtained, and redistribution judgment is performed: on the same device, if the next hop of the same route is itself or 0 in protocol 1, but the next hop is another device in protocol 2, then it is determined that the route is redistributed from protocol 2 to protocol 1.

[0030] Furthermore, the path analysis specifically includes: A1. Based on the analysis of the network topology and the analysis of the device's comprehensive routing information, select two routes as the start and end points, respectively.

[0031] A2. Use the source routing device of the originating route as the query router.

[0032] A3. Query the destination route on the query router to obtain the next-hop information of the destination route.

[0033] A4. If the next hop of the destination route is 0.0.0.0, the query is complete, and the query router is added to the path list; if the next hop of the destination route is not 0.0.0.0, the query router is added to the path list, and the next hop device is set as the new query router. Return to step A3.

[0034] Furthermore, the historical information analysis specifically includes: The system sends the latest network status information to the data storage unit at preset intervals. When historical information needs to be queried, the system retrieves network status information from the data storage unit within a preset time period and analyzes the changes in historical network topology and network routing.

[0035] The beneficial effects of this invention are: (1) The present invention performs network analysis by collecting packets, which will not affect the normal operation of the network. The real-time collection and synchronous analysis of data can reflect the current status of the network in a timely manner. Since the collected packets are protocol packets, they are uniform and there will be no differences between devices.

[0036] (2) This invention integrates the network states of multiple protocols through cross-protocol network state analysis, which solves the problem that existing technologies perform more single protocol analysis and can provide more comprehensive and accurate network information.

[0037] (3) The system of the present invention provides diverse functions. Based on the complete analysis of basic network information, it can perform path analysis, historical data analysis, redistribution route analysis, etc. between any two points, and can also expand new functions at any time.

[0038] (4) The present invention uses a modular design scheme and provides a unified data interface to the outside world, which can be used to develop new business functions and provide basic data support for the development of upper-layer applications. Attached Figure Description

[0039] Figure 1 The diagram shown is a structural block diagram of a network status analysis system based on routing protocol messages provided by the present invention.

[0040] Figure 2 The diagram shown is a schematic diagram of the whole network topology information analysis network provided by the present invention.

[0041] Figure 3 The diagram shows a schematic of the OSPF network topology provided by this invention.

[0042] Figure 4 The diagram shows a BGP network topology provided by this invention.

[0043] Figure 5The diagram shown is a schematic diagram of the ISIS network topology provided by the present invention.

[0044] Figure 6 The diagram shown is a schematic of the path analysis network provided by the present invention. Detailed Implementation

[0045] Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the drawings are merely exemplary and are intended to illustrate the principles and spirit of the invention, and are not intended to limit the scope of the invention.

[0046] This invention provides a network status analysis system based on routing protocol messages, such as... Figure 1 As shown, it includes multiple data acquisition modules and a network status analysis module that is communicatively connected to each data acquisition module.

[0047] The data acquisition module is used to collect network packets; the network status parsing module is used to process and analyze the network packets to obtain network status information.

[0048] In this embodiment of the invention, the data acquisition module needs to be deployed at a critical location in the network to collect network packets. The network packets collected by the data acquisition module are mainly routing protocol packets, and its deployment location needs to ensure that routing protocol packets can be collected. These routing protocol packets include, but are not limited to, BGP, OSPF, and ISIS packets. The data acquisition module can be configured for intrusive and non-intrusive collection methods.

[0049] Specifically, the data acquisition module is deployed as follows: Since each BGP protocol message carries routing and neighbor information between the devices sending and receiving the message, within an AS system, the number of BGP sessions can usually be reduced by deploying reflectors. In this case, the data acquisition module can be deployed only on the link where the reflector is located. Between AS systems, the data acquisition module can be deployed between all EBGP session links to collect BGP protocol messages.

[0050] Since the neighbor and routing information of OSPF and ISIS will eventually be synchronized within the AREA, a data collection module needs to be deployed in each AREA to collect OSPF protocol messages and ISIS protocol messages.

[0051] like Figure 1 As shown, the network status analysis module includes a data management unit, multiple protocol analysis units, a comprehensive analysis unit, and a data storage unit.

[0052] The data management unit communicates with each data acquisition module to receive, process, and distribute network messages.

[0053] Each protocol analysis unit is communicatively connected to the data integration management unit to receive network packets allocated by the data integration management unit, analyze the network packets to obtain local network status information (including device, neighbor and routing information), and announce the local network status information to the integration analysis unit.

[0054] The comprehensive analysis unit communicates with each protocol analysis unit to receive local network status information from each unit and perform comprehensive analysis to obtain overall network status information (including device, network topology, and routing information). This overall network status information is then sent to the data storage unit. Simultaneously, it provides network status change log information (including topology changes, routing changes, and neighbor changes) based on the overall network status information. Furthermore, it provides a unified data interface for querying data on devices, topology, routing, neighbors, and other aspects, providing a foundation for the development of upper-layer applications, such as path analysis between nodes and redistribution route analysis based on network status information.

[0055] The data storage unit is communicatively connected to the comprehensive analysis unit to receive and store the overall network status information sent by the comprehensive analysis unit, and provides a unified data interface to the outside world to query the network status information, providing a data foundation for the development of upper-layer applications, such as performing historical data analysis.

[0056] In this embodiment of the invention, the data processing method of the data integration management unit is as follows: S1. Since each data acquisition module collects data independently, it is necessary to sort the network packets collected by each data acquisition module in chronological order.

[0057] S2. Classify the sorted network packets according to protocol type, AS system to which the packet belongs, AREA to which the packet belongs, or a combination of the above three factors. The purpose is to enable distributed computing when dealing with large amounts of network data, or to allocate packets with different functions to different protocol analysis processes. In smaller-scale networks, packet classification may not be necessary. In larger-scale networks, simply classifying the packets appropriately and increasing the number of protocol analysis modules can improve overall efficiency.

[0058] S3. Distribute the classified network packets to each protocol analysis unit.

[0059] In this embodiment of the invention, the specific method by which the protocol analysis unit analyzes network packets is as follows: Based on the analysis of BGP protocol messages, we can obtain the BGP virtual device information corresponding to the actual network, as well as the neighbor and routing information of the BGP virtual device.

[0060] Based on the analysis of OSPF protocol messages, we can obtain SRv6 information, virtual device information in the OSPF network, and neighbor and routing information of the virtual device.

[0061] Based on the analysis of ISIS protocol messages, we can obtain SRv6 information, virtual device information in the ISIS network, and the neighbor and routing information of the virtual device.

[0062] The correspondence between BGP protocol message fields and related protocol information in the network is shown in Table 1.

[0063] Table 1 In this embodiment of the invention, information on virtual devices that have deployed the BGP protocol is obtained through 1, 2, and 3 in Table 1; neighbor information of the BGP virtual device is obtained through 15; routing information between BGP neighbors (including routing address families, sub-address families, routing prefixes, routing attributes, etc.) is obtained through 4 to 12; online information of neighbors is obtained through 13; offline information of neighbors is obtained through 14; and then the neighbors are deleted.

[0064] The correspondence between OSPF protocol message fields and related protocol information in the network is shown in Table 2.

[0065] Table 2 In this embodiment of the invention, the virtual device information in the OSPF network is obtained by analyzing 1 and 2 in Table 2, the neighbor information of the OSPF virtual device is obtained by analyzing 3 and 4, the OSPF routing information is obtained by analyzing 3 to 7, and the SRv6 information is obtained by analyzing 8 and 9.

[0066] The correspondence between ISIS protocol message fields and related protocol information in the network is shown in Table 3.

[0067] Table 3 In this embodiment of the invention, virtual device information in the ISIS network is obtained through analysis of 1 and 2 in Table 3, neighbor information of ISIS virtual devices is obtained through analysis of 3, ISIS routing information is obtained through analysis of 4, and SRv6 information is obtained through analysis of 5 and 6.

[0068] In this embodiment of the invention, the comprehensive analysis unit performs network topology analysis, device comprehensive routing information analysis, path analysis, and historical information analysis on the local network status information sent by each protocol analysis unit.

[0069] Specifically, the network topology information analysis includes: The network topology information deployed by BGP, OSPF and ISIS protocols is obtained through analysis. There are overlapping and separate relationships between them. The comprehensive analysis unit needs to integrate them to form the complete network topology information.

[0070] like Figure 2 The network shown contains AS1 and AS2. AS1 contains two areas, AREA1 and AREA2, both running the OSPF protocol. An IBGP neighbor synchronization service route is established between R12 and R14. AS2 contains one area, AREA1, running the ISIS protocol. An IBGP neighbor synchronization service route is established between R21 and R12. An EBGP neighbor management synchronization inter-AS route is established between R14 and R21 devices in AS1 and AS2.

[0071] According to the protocol analysis unit in this embodiment of the invention, the OSPF network topology is obtained as follows: Figure 3 As shown, R11-1 corresponds to R11 in the actual network. Its flag is the OSPF router-id carried in the OSPF message. It is a neighbor of R12-1 and R13-1, and so on for the other routers. The BGP network topology is as follows. Figure 4 As shown, R12-2 corresponds to R12 in the actual network, and its neighbor is R14-2, with other routers following the same pattern. The ISIS network topology is as follows: Figure 5 As shown, R21-3 corresponds to R21 in the actual network, and its neighbors are R22-3 and R23-3, and so on for the other routers.

[0072] Network topology analysis requires piecing together the three network topologies mentioned above to form a real network. The core of this process lies in identifying virtual devices that represent the same device in different protocols and then merging them. For example, device R11, based on the protocol analysis module, yields R11-1 for OSPF and R11-2 for BGP, which are then merged into device R11. Similarly, R14-1 and R14-2 are merged into R14, and so on. This process yields a complete network topology.

[0073] In this embodiment of the invention, the specific method for identifying virtual devices representing the same device in different protocols is as follows: if the source address of a BGP device establishing a neighbor exists in the ISIS or OSPF directly connected routing table, then the BGP device and the ISIS or OSPF device are considered to represent the same device. This method can determine the association relationship between all devices within an AS. The principle is that BGP neighbors typically establish connections using logical interfaces, which require advertising the address through the ISIS or OSPF protocol. Therefore, the address used by a BGP neighbor will exist in the ISIS or OSPF directly connected routing table.

[0074] In this embodiment of the invention, the comprehensive routing information analysis of the device specifically includes: Based on the complete routing information on a device obtained from the analysis of the network topology, the main routing table information is selected according to the priority of the routes and directly used for routing forwarding.

[0075] Based on the directly connected route information obtained from ISIS and OSPF routing analysis, the directly connected routes on the corresponding routers are obtained, and redistribution judgment is performed (introducing a route from one protocol into another protocol is called redistribution. When a route is introduced into another protocol, the information of the original protocol will be lost, which may cause routing loops and other problems in the actual network): on the same device, if the next hop of the same route is itself or 0 in protocol 1, but the next hop is another device in protocol 2, then it is determined that the route is redistributed from protocol 2 to protocol 1.

[0076] The principle behind redistribution determination is as follows: If a route has its own next hop in Protocol 1, it means the route was generated by this device. However, if its next hop is another device in Protocol 2, it means the route was generated by another router. This indicates that the route was actually generated by another router using Protocol 1, and then introduced from Protocol 1 to Protocol 2 within this device. Due to information loss during redistribution, the next hop becomes 0.

[0077] In this embodiment of the invention, path analysis refers to analyzing the path list between two routes. Given two routes as a start point and an end point, the analysis examines the routers traversed along the forwarding path from the start point to the end point. The set of the start point + routers along the path + the end point constitutes the path list between these two routes. The path analysis function can help users quickly determine the connectivity and specific forwarding paths between two points in the network.

[0078] like Figure 6 As shown, route 100.1.1.1 / 32 is introduced on R11 and route 110.1.1.1 / 32 is introduced on R14. After transmission via the routing protocol, the routing tables on each router are as follows: Figure 6 As shown in the dashed box. By Figure 6 It can be seen that the path list from 100.1.1.1 / 32 to 110.1.1.1 / 32 is R11, R12, R13, R14.

[0079] The specific method for path analysis is as follows: A1. Information on each device and its main routing table obtained from the analysis of the overall network topology and the comprehensive routing information of the devices (e.g., ... Figure 6 (As shown in the dashed box), select two routes as the start and end points respectively (e.g.) Figure 6 (100.1.1.1 / 32 and 110.1.1.1 / 32 in the text).

[0080] A2. Use the source routing device of the originating route as the query router, i.e. Figure 6 R11 in the middle.

[0081] A3. Query the destination route on the query router to obtain the next-hop information of the destination route.

[0082] A4. If the next hop of the destination route is 0.0.0.0, the query is complete, and the query router is added to the path list; if the next hop of the destination route is not 0.0.0.0, the query router is added to the path list, and the next hop device is set as the new query router. Return to step A3.

[0083] In this embodiment of the invention, the historical information analysis specifically includes: The system sends the latest network status information to the data storage unit at preset intervals. When historical information needs to be queried, the system retrieves network status information from the data storage unit within a preset time period and analyzes the changes in historical network topology and network routing.

[0084] Historical information analysis can help users find and analyze problems, or intuitively show users changes in topology and routing over a period of time.

[0085] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A network status analysis system based on routing protocol messages, characterized in that, It includes multiple data acquisition modules and a network status analysis module that communicates with each data acquisition module. The data acquisition module is used to collect network packets; The network status parsing module is used to process and analyze network packets to obtain network status information.

2. The network status analysis system based on routing protocol messages according to claim 1, characterized in that, The network packets include BGP protocol packets, OSPF protocol packets, and ISIS protocol packets; The deployment method of the data acquisition module is as follows: Within the AS system, the data acquisition module is deployed only on the link where the reflector is located. Between AS systems, the data acquisition module is deployed between all EBGP sessions to collect BGP protocol messages. Deploy a data acquisition module within each AREA to collect OSPF and ISIS protocol messages.

3. The network status analysis system based on routing protocol messages according to claim 2, characterized in that, The network status analysis module includes a data management unit, multiple protocol analysis units, a comprehensive analysis unit, and a data storage unit; The data management unit is communicatively connected to each data acquisition module and is used to receive, process, and distribute the network packets. Each of the protocol analysis units is communicatively connected to the data integration management unit, and is used to receive network packets allocated by the data integration management unit, analyze the network packets to obtain local network status information, and notify the integration analysis unit of the local network status information. The comprehensive analysis unit is communicatively connected to each protocol analysis unit, and is used to receive local network status information sent by each protocol analysis unit and perform comprehensive analysis to obtain overall network status information. The overall network status information is then sent to the data storage unit. At the same time, network status change log information is provided based on the overall network status information, and a unified data interface is provided to the outside world. The data storage unit is communicatively connected to the comprehensive analysis unit, and is used to receive and store the overall network status information sent by the comprehensive analysis unit, and to provide a unified data interface to the outside world.

4. The network status analysis system based on routing protocol messages according to claim 3, characterized in that, The data processing method of the data integration management unit is as follows: S1. Sort the network packets collected by each data acquisition module in chronological order; S2. Classify the sorted network packets according to protocol type, AS system to which the packet belongs, AREA to which the packet belongs, or a combination of the above three factors; S3. Distribute the classified network packets to each protocol analysis unit.

5. The network status analysis system based on routing protocol messages according to claim 3, characterized in that, The specific method by which the protocol analysis unit analyzes network packets is as follows: Based on the analysis of BGP protocol messages, we can obtain the BGP virtual device information corresponding to the actual network, as well as the neighbor and routing information of the BGP virtual device; Based on the analysis of OSPF protocol messages, we can obtain SRv6 information, virtual device information in the OSPF network, and neighbor and routing information of the virtual device. Based on the analysis of ISIS protocol messages, we can obtain SRv6 information, virtual device information in the ISIS network, and the neighbor and routing information of the virtual device.

6. The network status analysis system based on routing protocol messages according to claim 3, characterized in that, The comprehensive analysis unit performs network topology analysis, device routing information analysis, path analysis, and historical information analysis on the local network status information sent by each protocol analysis unit.

7. The network status analysis system based on routing protocol messages according to claim 6, characterized in that, The network topology information analysis specifically includes: The network topology information of each protocol is obtained by analyzing the BGP, OSPF and ISIS protocols. Virtual devices that represent the same device in different protocols are identified and merged to obtain complete routing information on a single device. The specific method for identifying virtual devices that represent the same device in different protocols is as follows: if the source address of the neighbor established by the BGP device exists in the ISIS or OSPF direct connection routing table, then the BGP device and the ISIS or OSPF device are considered to represent the same device.

8. The network status analysis system based on routing protocol messages according to claim 6, characterized in that, The comprehensive routing information analysis of the device specifically includes: Based on the complete routing information on a device obtained from the analysis of the network topology information, the main routing table information is obtained according to the priority of the routes and is directly used for route forwarding; Based on the directly connected route information obtained from ISIS and OSPF routing analysis, the directly connected routes on the corresponding routers are obtained, and redistribution judgment is performed: on the same device, if the next hop of the same route is itself or 0 in protocol 1, but the next hop is another device in protocol 2, then it is determined that the route is redistributed from protocol 2 to protocol 1.

9. The network status analysis system based on routing protocol messages according to claim 6, characterized in that, The path analysis specifically refers to: A1. Based on the analysis of the network topology information and the analysis of the device's comprehensive routing information, select two routes as the start and end points respectively for each device and its main routing table. A2. Use the source routing device of the originating route as the query router; A3. Query the destination route on the query router to obtain the next-hop information of the destination route; A4. If the next hop of the destination route is 0.0.0.0, the query is complete, and the queried router is added to the path list; If the next hop of the destination route is not 0.0.0.0, add the query router to the path list and set the next hop device as the new query router, then return to step A3.

10. The network state analysis system based on routing protocol messages according to claim 6, characterized in that, The historical information analysis specifically includes: The system sends the latest network status information to the data storage unit at preset intervals. When historical information needs to be queried, the system retrieves network status information from the data storage unit within a preset time period and analyzes the changes in historical network topology and network routing.

Images