CN115484193A - Method, system, storage medium and device for monitoring and analyzing network packet loss flow - Google Patents

Abstract

The invention discloses a method, a system, a storage medium and a device for monitoring and analyzing network packet loss flow, belonging to the technical field of network communication, wherein the method comprises the following steps: adding a discarding information message header in a discarding message to obtain a first discarding message; wherein, the discard information message header includes error information; mirroring the first discarded message to obtain a second discarded message; and sending the second discarded message to the monitoring equipment so that the monitoring equipment analyzes error information carried by the second discarded message to obtain the packet loss reason of the discarded message and perform message discarding statistics to obtain statistical information of the discarded message. The invention can realize the purpose of monitoring packet loss based on the flow, and timely finds the packet loss flow to carry out deep message content-based statistics on the packet loss.

Description

Method, system, storage medium and device for monitoring and analyzing network packet loss traffic

technical field

The invention relates to the technical field of network communication, in particular to a method, system, storage medium and computer equipment for monitoring and analyzing network packet loss flow.

Background technique

With the expansion of the network scale, the number of switching devices in the network has also increased sharply, and the search for network packet loss has become more complicated. It is very important to know the network packet loss in time for fault discovery, analysis and troubleshooting of switching devices. Network packet loss is the phenomenon that data packets are lost in the channel due to various reasons when using ping to query the destination station.

Packet loss statistics refers to obtaining packet loss quantity and packet loss rate data according to the difference between all traffic entering the network and traffic leaving the network within a certain measurement time interval. At present, general switching chips only provide port-based packet loss record and packet loss statistics, and can only determine port-based packet loss, but cannot determine specific traffic.

ACL (Access Control List) can be used to distinguish the traffic of ACL matching items. ACL is an access control technology based on packet filtering. It can filter the data packets on the interface according to the set conditions, allowing them to pass or discard. Access control lists are widely used in routers and Layer 3 switches. With the help of access control lists, users' access to the network can be effectively controlled, thereby ensuring network security to the greatest extent. However, the matching items supported by ACL for distinguishing traffic (source MAC, destination MAC, VLAN, quintuple, etc.) are limited, and the identification of packet loss traffic through ACL can only be limited to the matching items supported by ACL, and deep-level services cannot be performed. In addition, ACL is a scarce resource. Using ACL to record the cause of packet loss based on traffic and collect packet loss statistics requires a large amount of ACL.

The information disclosed in this Background section is only for enhancing the understanding of the general background of the present invention and should not be taken as an acknowledgment or any form of suggestion that the information constitutes the prior art that is already known to those skilled in the art.

Contents of the invention

The purpose of the present invention is to provide a method, system, storage medium and equipment for monitoring and analyzing network packet loss traffic, which can quickly read error information by adding a packet loss information header, and then can realize the purpose of packet loss monitoring based on traffic, Timely detection of packet loss traffic statistics based on in-depth packet content.

In order to achieve the above object, the present invention provides a method for monitoring network packet loss traffic, which is applied to the switching chip of the switch, and the method includes the following steps:

Adding a discarding message header to the discarding message to obtain a first discarding message; wherein, the discarding message header includes error information;

Mirroring the first discarded packet to obtain a second discarded packet;

Sending the second discarded message to the monitoring device, so that the monitoring device analyzes the error information carried by the second discarded message, obtains the packet loss cause of the discarded message and performs packet discarding statistics, and obtains Statistical information of the discarded packets.

In one embodiment of the present invention, the error information includes at least an error message identifier and information used for packet discard statistics; the information used for packet discard statistics includes device number ID, source port information, discarded packet length information and error coding; wherein, the error information identifier is used to identify the discarded message, and is used to identify that the error information identifier is followed by the information used for packet discard statistics;

The device number ID is used to determine the device that generated the discarded message; the source port information is used to determine the source port that generated the discarded message; the length information of the discarded message is used to determine the discarded message The length of the message is used to determine whether the discarded message is damaged; the error code is used to identify the error type of the discarded message; The source port of the discarded message, the message damage information and the error type of the discarded message are analyzed and counted to obtain the number of discarded messages generated by each device or source port, and the number of message damages. Statistical information on the number and error types of various discarded packets is used to locate the device and source port that generated the discarded packets.

In an embodiment of the present invention, the mirroring of the first discarded message to obtain the second discarded message specifically includes the following steps: intercepting the first preset bytes of the first discarded message , to obtain the intercepted discarded message, and mirror the intercepted discarded message to obtain a second discarded message containing the discarded information header; wherein, the discarded information header is added to the Discard the first preset bytes of the packet.

In one embodiment of the present invention, the monitoring device is a switch CPU and/or a remote network monitoring device;

When there is a remote network monitoring device, sending the second discarded message to the remote network monitoring device for statistical analysis of errors, the specific steps are as follows:

Encapsulating the second discarded message with a service header according to the destination address of the remote network monitoring device and the source address of the switch, to obtain the encapsulated discarded message;

Forwarding the encapsulated discarded message to a remote network monitoring device, so that the remote monitored device parses the encapsulated discarded message for statistical error analysis;

When there is no remote network monitoring device, the second discarded packet is sent to the switch CPU for error statistical analysis.

The present invention also provides a method for analyzing network packet loss traffic, which is applied to monitoring equipment, and the method includes the following steps:

receiving the second discarded message sent by the switch chip and obtained by mirroring the first discarded message, wherein the first discarded message is a message in which the discarded message header is added by the switch chip, The packet header of the discarding information includes error information;

Analyzing the error information in the second discarded message to obtain the packet loss cause and statistical information of the discarded message.

In one embodiment of the present invention, the error information includes at least an error message identifier and information used for packet discard statistics; the information used for packet discard statistics includes device number ID, source port information, discarded packet length information and error coding; wherein, the error information identifier is used to identify the discarded message, and is used to identify that the error information identifier is followed by the information used for packet discard statistics;

The device number ID is used to determine the device that generated the discarded message; the source port information is used to determine the source port that generated the discarded message; the length information of the discarded message is used to determine the discarded message The length of the message is used to determine whether the discarded message is damaged; the error code is used to identify the error type of the discarded message; The source port of the discarded message, the message damage information and the error type of the discarded message are analyzed and counted to obtain the number of discarded messages generated by each device or source port, and the number of message damages. Statistical information on the number and error types of various discarded packets is used to locate the device and source port that generated the discarded packets.

In an embodiment of the present invention, the parsing the error information in the second discarded message includes:

The second discarded message is a message obtained by intercepting the first predetermined bytes of the first discarded message and mirroring it; wherein, the discarded information message header is added to the pre-preset byte of the discarded message within bytes.

In one embodiment of the present invention, the monitoring device is a switch CPU and/or a remote network monitoring device;

When there is the remote network monitoring device, the remote network monitoring device receives the encapsulated discarded message sent by the switch chip after the second discarded message is encapsulated by the service station, and the encapsulated discarded message is The packet is analyzed to obtain the packet loss reason and statistical information of the discarded packet;

When there is no remote network monitoring device, the CPU of the switch parses the error information in the second discarded message to obtain a packet loss cause and statistical information of the discarded message.

The present invention also provides a monitoring system for network packet loss flow, including:

A message header generating module, configured to add a discard information header to the discard message to obtain a first discard message; wherein, the discard information header includes error information;

A mirroring module, configured to mirror the first discarded message to obtain a second discarded message;

A sending module, configured to send the second discarded message to a monitoring device, so that the monitoring device analyzes the error information carried by the second discarded message, obtains the packet loss cause of the discarded message, and reports Document discard statistics.

The present invention also provides a storage medium, which includes a stored program, wherein the program executes the above-mentioned method for monitoring network packet loss traffic or/and executes the above-mentioned method for analyzing network packet loss traffic.

The present invention also provides a computer device, which includes a processor, a memory, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the above-mentioned network is realized. A method for monitoring packet loss traffic or/and implementing the above-mentioned analysis method for network packet loss traffic.

The present invention also provides an analysis system for network packet loss traffic, including: an analysis module, which is used to analyze the discarded message containing the discarded information message header, wherein the first protocol of the discarded message is read The information after the type information is the error information of the discarded packet.

Compared with the prior art, according to the method, system, storage medium and equipment for monitoring and analyzing network packet loss traffic of the present invention, a discarding information header is added to the discarding message, and the discarding information header can include some Error information, and then directly analyze and count in the subsequent switch CPU or remote network monitoring equipment; in addition, the present invention mirrors the packet loss message to the switch CPU or the remote end by setting the packet loss mirroring purpose on the switching chip Network monitoring equipment, the packet loss analysis and statistics are performed by the switch CPU or network monitoring equipment.

Description of drawings

Fig. 1 is a flow chart of a method for monitoring network packet loss traffic according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a message format according to an embodiment of the present invention;

Fig. 3 is a schematic flow chart of discarding message mirroring in a switching chip according to an embodiment of the present invention;

4 is a flowchart of a method for analyzing network packet loss traffic according to an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of a monitoring system for network packet loss traffic according to an embodiment of the present invention.

detailed description

The specific embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific embodiments.

Unless expressly stated otherwise, throughout the specification and claims, the term "comprise" or variations thereof such as "includes" or "includes" and the like will be understood to include the stated elements or constituents, and not Other elements or other components are not excluded.

As shown in Figures 1 to 3, a method for monitoring network packet loss traffic according to a preferred embodiment of the present invention is mainly applied on the switching chip of the switch, and specifically includes the following steps:

S1: Add a discard information packet header to the discard packet to obtain a first discard packet.

This step is carried out in the switch chip. When the switch chip generates a packet discard, a discard information packet header is added to the discard packet, specifically, the discard information packet header is added after the source mac address of the discard packet. Because, after the source mac address of the discarded message is the specific data content of the discarded message, adding the discarded information packet header after the source mac address can combine the data content added in the discarded information packet header with the original data content of the discarded message The data content of the network is fused together, which is more convenient for subsequent error information statistics on the packet loss situation of the entire network.

The discarded message is the message format of the Ethernet protocol, which includes the destination mac address (DEST_MAC), source mac address (SRC_MAC) and protocol type (ETHTYPE), and specifically adds the discarded information message header to the source mac address (SRC_MAC) and protocol type (ETHTYPE), as shown in Figure 2.

The packet header of the discarded information includes error information, and the error information includes the information of the discarded packet for collecting statistics on the packet loss traffic. Specifically, the error information at least includes an error message identifier (such as: ETHTYPE (ERRO_CODE)) and information used for message discarding statistics. ETHTYPE (ERRO_CODE) is a special value used as a marker for identifying discarded messages, and identifies subsequent Information is used for packet discard statistics.

The information used for packet discard statistics includes device ID (UNIQUE_ID), source port information (SRC_PORT), length of discarded packets (PACKET_LEN) and error code (ERRO_CODE).

UNIQUE_ID, as the unique identifier of the switching device, is used to determine the device that generates discarded packets, and then can count statistical information such as the number of discarded packets and error types generated by each device based on the device that generated discarded packets. SRC_PORT is the source port information of the message, which is used to determine the source port that generates the discarded message, and then can count statistical information such as the number of discarded messages generated by each source port and the error type according to the source port that generated the discarded message. PACKET_LEN is used to identify the length of the discarded packet, and can be used to determine whether the discarded packet has character loss and other packet damage information. ERRO_CODE is used to identify the error type of discarded packets, so that statistics can be made on the specific error types of discarded packets.

For example, ETHTYPE (ERRO_CODE) can be configured as 0x8809. When the remote network monitoring device receives a message with an ETHTYPE of 0x8809, it can identify the message as a message discarded by the switching chip, and analyze the message according to the format shown in Figure 2. The device number (UNIQUE_ID), source port information (SRC_PORT), length of the discarded packet (PACKET_LEN) and error code 0x8809 of the discarded packet can be obtained, and then the device to which the discarded packet belongs, which port it is sent from and whether it is Character loss and error type occur. If 0x8809 indicates a protocol conversion error, it is determined that a protocol conversion error occurred during the transmission of the discarded message. Based on this, the remote network monitoring device can count the discarding reasons of the discarded packets (such as: protocol conversion error, parsing error, character loss, etc.) number of packets corresponding to different reasons for discarding, which device discarded packets and the number of packets discarded by the device, which source port received packet discards and the number of packets discarded by the source port Statistical information such as the device and source port corresponding to the discarded packet).

By discarding the above-mentioned error information contained in the header of the information message, the device, source port, message damage and error type of the discarded message can be obtained through the information used for message discard statistics in subsequent steps, The monitoring equipment analyzes and counts these information, and can obtain statistics of various discarded information, for example, the number of discarded packets generated by each device or each source port, the number of damaged packets, and the error types of various discarded packets Statistical information in order to locate the device and source port that generated discarded packets, so as to facilitate subsequent optimization of the device and source port based on the number of damaged packets and error types.

As shown in Figure 2, the packet format for adding error information is the discarded packet with the packet header of the discarded information added, where ETHTYPE (ERRO_CODE) is used to identify the subsequent information as error information, and ETHTYPE is the discarded packet itself Bring your own ETHTYPE, the two are not the same.

S2: Perform mirroring on the first discarded packet to obtain the second discarded packet.

In this step, the purpose of mirroring is to mirror the first discarded message out of the switch chip, so as to facilitate analysis by the subsequent switch CPU or remote network monitoring equipment.

In the mirroring process, optionally, in order to save bandwidth, after preset bytes before intercepting the first discarded message, the discarded message after the interception is obtained, and the discarded message after the interception is mirrored, wherein, the intercepted The subsequent discarded packets include at least the discarded information packet header. The preset number of bytes can be 32, 64, etc. bytes.

Since the discard information packet header includes the main information of the discarded packet, the flow information of the discarded packet can be obtained by parsing the discarded information packet header without reading and analyzing the entire discarded packet.

S3: Send the second discarded message to the monitoring device. The monitoring device can be a switch CPU and/or a remote network monitoring device, wherein the discarding information carried in the packet header is checked in the switch CPU and/or the network monitoring device The error information is analyzed to obtain the cause of packet loss and perform packet discard statistics to obtain the statistical information of discarded packets.

As shown in Figure 3, it shows the flow chart of chip discarding message mirroring. After the second discarding message is configured, the mirroring can be configured according to the mirroring configuration (the mirroring is configured locally or configured to the remote network monitoring device, i.e. in Figure 3 Whether the shown is remote mirroring) selects the mirrored discarded message and sends it to the switch CPU and/or the remote network monitoring device.

When there is a remote network monitoring device, you can choose to send the second discarded packet to the remote network monitoring device for error statistical analysis, so as to monitor the entire network.

Specifically, the specific steps of sending the second discarded message to the remote network monitoring device are as follows:

S301: Perform service header encapsulation on the second discarded packet according to the destination address of the remote network monitoring device and the source address of the switch, wherein the service header encapsulation is determined by the reachable network channel from the packet loss node to the remote network monitoring device.

The business header encapsulation is to add the header information corresponding to the remote network monitoring equipment when transmitting data in the network. The main function of the header information is to help the intermediate transmission system transmit the data to a correct destination. For example, if the ordinary L2 is reachable, the encapsulated destination mac address is the mac address of the remote monitoring device, and the corresponding VLAN is encapsulated; if the IP is reachable, the encapsulated destination IP address is the IP address of the remote monitoring device.

S302: Forward the message encapsulated with the service header to the remote network monitoring device.

Wherein, the message after the business head encapsulation is parsed by the remote network monitoring device to obtain the switching device from which the discarded message comes, and the discarded message is identified by the first protocol type information (ie ETHTYPE (ERRO_CODE)), and the discarded information The message header is parsed to obtain the source port (SRC_PORT) and error type (ERRO_CODE).

In addition, it is also possible to control the packet loss of the entire network by counting the discarded packets based on the switching device port, quintuple, and in-depth packet content, and by counting the number of discarded packets of each error type.

In this step, the message encapsulated by the service header is forwarded after checking the table in the inbound direction; in the inbound direction of the message, the switch determines whether the message is allowed to enter the forwarded port after checking the table. The port is forwarded to the remote network monitoring equipment.

Moreover, the statistical process of the present application can be completed in the remote network monitoring device, or can be completed in the switch CPU when there is no remote network monitoring device.

When there is no remote network monitoring device, you can choose to send the second discarded packet to the CPU of the local switch for error statistical analysis. Wherein, the switch CPU identifies the discarded message by the first protocol type information (ie ETHTYPE (ERRO_CODE)) carried by the second discarded message, and parses the discarded information message header to obtain the source port (SRC_PORT) and error type (ERRO_CODE), and then can perform error information statistics on discarded packets based on the switching device port, quintuple, and depth packet content. By counting the number of discarded packets under each error type, you can control the packet loss of the entire network. Through the above steps, it is possible to perform error information statistics on packets based on the switching device, switching device port, quintuple, and depth packet content.

The monitoring device can obtain the device, source port, packet damage, and error type of the discarded packet through the information used for packet discard statistics. The monitoring device can analyze and count these information to obtain various discard information. For example, the statistics of the number of discarded packets generated by each device or each source port, the number of damaged packets, and the error types of various discarded packets, so as to locate the device and source port that generated the discarded packets, and facilitate Then optimize the device and source port according to the number of damaged packets and error types.

Through the above steps, it is possible to perform error information statistics on packets based on the switching device, switching device port, quintuple, and depth packet content. The quintuple is a set of five quantities consisting of source IP address, source port, destination IP address, destination port, and transport layer protocol. The quintuple can distinguish different sessions, and the corresponding session is unique. The error information statistics based on the quintuple is to identify the application type through the port number. This method will easily cause some viruses or junk applications to use fake port numbers to disguise themselves as legitimate packets, so they cannot be detected. Therefore, the present application can also detect the content of the in-depth message, which is the analysis of the application layer, and can identify various applications and their content, and realize the refined control and analysis of network traffic.

A method for monitoring network packet loss traffic according to the present invention adds a discarding information header to the discarding message of a switching chip, and when the chip generates a message discarding, the message is added with a discarding information header, and the message is sent according to the mirroring configuration The switch CPU or the remote network monitoring device can obtain the source port and error type by analyzing the header of the discarded information packet. In addition, by analyzing discarded packets, the cause of packet loss can be grasped, and packet discarding statistics can be performed according to traffic according to the information of discarded packets.

As shown in Fig. 4, according to a kind of analysis method of network packet loss flow of the preferred embodiment of the present invention, it can be applied on monitoring equipment (switch CPU or remote network monitoring equipment), to the above-mentioned network packet loss flow by above-mentioned In the monitoring method, the discarded message sent by the switching chip of the switch is analyzed. Specifically, the method includes:

S4: Receive the second discarded message sent by the switch chip and obtain the second discarded message by mirroring the first discarded message, wherein the first discarded message is a message in which the switch chip adds a discarded message header to the discarded message, and the discarded message Include error messages in the header.

The process of adding the discarding information header to the first discarding message is performed in the switch chip, specifically, adding the discarding information header after the source mac address of the discarding message. Because, after the source mac address of the discarded message is the specific data content of the discarded message, adding the discarded information packet header after the source mac address can combine the data content added in the discarded information packet header with the original data content of the discarded message The data content of the network is fused together, which is more convenient for subsequent error information statistics on the packet loss situation of the entire network.

The discarded message is the message format of the Ethernet protocol, which includes the destination mac address (DEST_MAC), source mac address (SRC_MAC) and protocol type (ETHTYPE), and specifically adds the discarded information message header to the source mac address (SRC_MAC) and protocol type (ETHTYPE), as shown in Figure 2.

The packet header of the discarded information includes error information, and the error information includes the information of the discarded packet for collecting statistics on the packet loss traffic. Specifically, the error information includes at least an error message identifier (ETHTYPE (ERRO_CODE)) and information used for packet discarding statistics. ETHTYPE (ERRO_CODE) is a special value used as a tag for identifying discarded packets, and the information after the identifier is Information used to collect packet discard statistics.

The information used for packet discard statistics includes device ID (UNIQUE_ID), source port information (SRC_PORT), length of discarded packets (PACKET_LEN) and error code (ERRO_CODE).

UNIQUE_ID, as the unique identifier of the switching device, is used to determine the device that generates discarded packets, and then can count statistical information such as the number of discarded packets and error types generated by each device based on the device that generated discarded packets. SRC_PORT is the source port of the message, which is used to determine the source port that generates the discarded message, and then can count statistical information such as the number of discarded messages generated by each source port and the error type according to the source port that generated the discarded message. PACKET_LEN is used to identify the length of the discarded packet, and can be used to determine whether the discarded packet has character loss and other packet damage information. ERRO_CODE is used to identify the error type of discarded packets, and then statistics can be made based on the specific error types of discarded packets.

For example, ETHTYPE (ERRO_CODE) can be configured as 0x8809. When the remote network monitoring device receives a message with an ETHTYPE of 0x8809, it can identify this message as a mirror message of the message discarded by the chip, and follow the format shown in Figure 2. Packet parsing can obtain the device and source port to which the discarded packet belongs, the reason for discarding, and discard the original packet.

By discarding the above-mentioned error information contained in the header of the information message, the device, source port, message damage and error type of the discarded message can be obtained through the information used for message discard statistics in subsequent steps, The monitoring equipment analyzes and counts these information, and can obtain statistics of various discarded information, for example, the number of discarded packets generated by each device or each source port, the number of damaged packets, and the error types of various discarded packets Statistical information in order to locate the device and source port that generated discarded packets, so as to facilitate subsequent optimization of the device and source port based on the number of damaged packets and error types.

As shown in Figure 2, the packet format for adding error information is the discarded packet with the packet header of the discarded information added, where ETHTYPE (ERRO_CODE) is used to identify the subsequent information as error information, and ETHTYPE is the discarded packet itself Bring your own ETHTYPE, the two are not the same.

The process of mirroring the first discarded message to the second discarded message is carried out in the switch chip. The purpose of mirroring is to mirror the first discarded message out of the switch chip, which is convenient for the subsequent switch CPU or remote network monitoring equipment for analysis.

In the mirroring process, optionally, in order to save bandwidth, after preset bytes before intercepting the first discarded message, the discarded message after the interception is obtained, and the discarded message after the interception is mirrored, wherein, the intercepted The subsequent discarded packets include at least the discarded information packet header. The preset number of bytes can be 32, 64, etc. bytes.

Since the discard information packet header includes the main information of the discarded packet, the flow information of the discarded packet can be obtained by parsing the discarded information packet header without reading and analyzing the entire discarded packet.

S5: Analyzing the error information in the second discarded packet to obtain packet loss reasons and statistical information of the discarded packet.

The monitoring device is a switch CPU and/or a remote network monitoring device, and the discarding report of the mirror image can be reported according to the mirroring configuration (the mirroring is configured locally or configured to the remote network monitoring device, whether it is a remote mirroring as shown in Figure 3). The selected text is sent to the switch CPU and/or the remote network monitoring equipment.

When there is a remote network monitoring device, the remote network monitoring device receives the encapsulated discarded message sent by the switch chip after the second discarded message is encapsulated by the service station, and performs the encapsulation of the encapsulated discarded message Analyze to get the packet loss reasons and statistical information of discarded packets

Among them, the business header encapsulation is to add the header information corresponding to the remote network monitoring equipment when transmitting data in the network. The main function of the header information is to help the intermediate transmission system transmit data to a correct destination. For example, if the ordinary L2 is reachable, the encapsulated destination mac address is the mac address of the remote monitoring device, and the corresponding VLAN is encapsulated; if the IP is reachable, the encapsulated destination IP address is the IP address of the remote monitoring device.

The remote network monitoring device analyzes the encapsulated message of the service header to obtain the switching device from which the discarded message comes, and identifies the discarded message by the first protocol type information (that is, ETHTYPE (ERRO_CODE)), and discards the information message The header is parsed to get the source port (SRC_PORT) and error type (ERRO_CODE). In addition, it is also possible to control the packet loss of the entire network by counting the discarded packets based on the switching device port, quintuple, and in-depth packet content, and by counting the number of discarded packets of each error type.

Moreover, the statistical process of the present application can be completed in the remote network monitoring device, or can be completed in the switch CPU when there is no remote network monitoring device.

When there is no remote network monitoring device, the CPU of the switch parses the error information in the second discarded message to obtain the packet loss cause and statistical information of the discarded message. Wherein, the switch CPU identifies the discarded message by the first protocol type information (ie ETHTYPE (ERRO_CODE)) carried by the second discarded message, and parses the discarded information message header to obtain the source port (SRC_PORT) and error type (ERRO_CODE), and then can perform error information statistics on discarded packets based on the switching device port, quintuple, and depth packet content. By counting the number of discarded packets under each error type, you can control the packet loss of the entire network. Through the above steps, it is possible to perform error information statistics on packets based on the switching device, switching device port, quintuple, and depth packet content.

The monitoring device can obtain the device, source port, packet damage, and error type of the discarded packet through the information used for packet discard statistics. The monitoring device can analyze and count these information to obtain various discard information. For example, the statistics of the number of discarded packets generated by each device or each source port, the number of damaged packets, and the error types of various discarded packets, so as to locate the device and source port that generated the discarded packets, and facilitate Then optimize the device and source port according to the number of damaged packets and error types.

Through the above steps, it is possible to perform error information statistics on packets based on the switching device, switching device port, quintuple, and depth packet content. The quintuple is a set of five quantities consisting of source IP address, source port, destination IP address, destination port, and transport layer protocol. The quintuple can distinguish different sessions, and the corresponding session is unique. The error information statistics based on the quintuple is to identify the application type through the port number. This method will easily cause some viruses or junk applications to use fake port numbers to disguise themselves as legitimate packets, so they cannot be detected. Therefore, the present application can also detect the content of the in-depth message, which is the analysis of the application layer, and can identify various applications and their content, and realize the refined control and analysis of network traffic.

By parsing the packet header of the discarded information, the method can read the error information of the discarded packet, and can detect the packet loss flow in time, and perform statistics on the packet loss based on the deep message content.

As shown in Figure 5, the present invention also provides a monitoring system for network packet loss traffic, including:

A message header generation module 1, configured to add a discard information header to the discarded message to obtain a first discarded message.

The message header generation module 1 is set in the switch chip, and when the switch chip generates a message discard, it adds the discard information message header in the discard message, specifically, adds the discard information message header to the discard message After the source MAC address. Because, after the source MAC address of the discarded packet is the specific data content of the discarded packet, adding the packet header of the discarded information after the source MAC address can combine the data content added in the header of the discarded information with the original data content of the discarded packet. The data content of the network is fused together, which is more convenient for subsequent error information statistics on the packet loss situation of the entire network.

The discarded message is the message format of the Ethernet protocol, which includes the destination mac address (DEST_MAC), source mac address (SRC_MAC) and protocol type (ETHTYPE), and specifically adds the discarded information message header to the source mac address (SRC_MAC) and protocol type (ETHTYPE), as shown in Figure 2.

The packet header of the discarded information includes error information, and the error information includes the information of the discarded packet for collecting statistics on the packet loss traffic. Specifically, the error information includes at least an error message identifier (ETHTYPE(ERRO_CODE)), a device number ID (UNIQUE_ID), source port information (SRC_PORT), a length of discarded packets (PACKET_LEN) and an error code (ERRO_CODE).

UNIQUE_ID, as the unique identifier of the switching device, is used to determine the device that generates discarded packets, and then can count statistical information such as the number of discarded packets and error types generated by each device based on the device that generated discarded packets. SRC_PORT is the source port of the message, which is used to determine the source port that generates the discarded message, and then can count statistical information such as the number of discarded messages generated by each source port and the error type according to the source port that generated the discarded message. PACKET_LEN is used to identify the length of the discarded packet, and can be used to determine whether the discarded packet has character loss and other packet damage information. ERRO_CODE is used to identify the error type of discarded packets, so that statistics can be made on the specific error types of discarded packets.

For example, ETHTYPE (ERRO_CODE) can be configured as 0x8809. When the remote network monitoring device receives a message with an ETHTYPE of 0x8809, it can identify this message as a mirror message of the message discarded by the chip, and follow the format shown in Figure 2. Packet analysis can obtain the device and source port to which the discarded packet belongs, the reason for discarding, and discard the original packet.

By discarding the above-mentioned error information contained in the header of the information message, the device, source port, message damage and error type of the discarded message can be obtained through the information used for message discard statistics in subsequent steps, The monitoring equipment analyzes and counts these information, and can obtain statistics of various discarded information, for example, the number of discarded packets generated by each device or each source port, the number of damaged packets, and the error types of various discarded packets Statistical information in order to locate the device and source port that generated discarded packets, so as to facilitate subsequent optimization of the device and source port based on the number of damaged packets and error types.

As shown in Figure 2, the packet format for adding error information is the discarded packet with the packet header of the discarded information added, where ETHTYPE (ERRO_CODE) is used to identify the subsequent information as error information, and ETHTYPE is the discarded packet itself Bring your own ETHTYPE, the two are not the same.

The mirroring module 2 is configured to mirror the first discarded packet to obtain the second discarded packet.

The purpose of mirroring by the mirroring module 2 is to mirror the first discarded message out of the switch chip, so as to facilitate analysis in the subsequent switch CPU or remote network monitoring equipment.

In the mirroring process, optionally, in order to save bandwidth, after preset bytes before intercepting the first discarded message, the discarded message after the interception is obtained, and the discarded message after the interception is mirrored, wherein, the intercepted The subsequent discarded packets include at least the discarded information packet header. The preset number of bytes can be 32, 64, etc. bytes.

Since the discard information packet header includes the main information of the discarded packet, the flow information of the discarded packet can be obtained by parsing the discarded information packet header without reading and analyzing the entire discarded packet.

The sending module 3 is configured to send the second discarded message to the switch CPU and/or the remote network monitoring device, wherein the error information carried in the discarded message header is analyzed in the switch CPU and/or the network monitoring device, Obtain the cause of packet loss, perform packet discard statistics, and obtain statistical information about discarded packets.

Sending module 3 can choose to send the discarded message of mirroring to switch CPU and/or far-end according to mirroring configuration (mirroring is configured locally or configured to remote network monitoring equipment, namely whether it is remote mirroring as shown in Figure 3) network monitoring equipment.

When there is a remote network monitoring device, you can choose to send the second discarded packet to the remote network monitoring device for error statistical analysis, so as to monitor the entire network.

Specifically, the specific steps of sending the second discarded message to the remote network monitoring device are as follows:

S301: Perform service header encapsulation on the second discarded packet according to the destination address of the remote network monitoring device and the source address of the switch, wherein the service header encapsulation is determined by the reachable network channel from the packet loss node to the remote network monitoring device.

The business header encapsulation is to add the header information corresponding to the remote network monitoring equipment when transmitting data in the network. The main function of the header information is to help the intermediate transmission system transmit the data to a correct destination. For example, if the ordinary L2 is reachable, the encapsulated destination MAC address is the MAC address of the remote monitoring device, and the corresponding VLAN is encapsulated; if the IP is reachable, the encapsulated destination IP address is the IP address of the remote monitoring device.

S302: Forward the message encapsulated with the service header to the remote network monitoring device.

Wherein, the message after the business head encapsulation is parsed by the remote network monitoring device to obtain the switching device from which the discarded message comes, and the discarded message is identified by the first protocol type information (ie ETHTYPE (ERRO_CODE)), and the discarded information The message header is parsed to obtain the source port (SRC_PORT) and error type (ERRO_CODE). In addition, it is also possible to control the packet loss of the entire network by counting the discarded packets based on the switching device port, quintuple, and in-depth packet content, and by counting the number of discarded packets of each error type.

In this step, the message encapsulated by the service header is forwarded after checking the table in the inbound direction; in the inbound direction of the message, the switch determines whether the message is allowed to enter the forwarded port after checking the table. The port is forwarded to the remote network monitoring equipment.

Moreover, the statistical process of the present application can be completed in the remote network monitoring device, or can be completed in the switch CPU when there is no remote network monitoring device.

When there is no remote network monitoring device, you can choose to send the second discarded packet to the CPU of the local switch for error statistical analysis. Wherein, the switch CPU identifies the discarded message by the first protocol type information (ie ETHTYPE (ERRO_CODE)) carried by the second discarded message, and parses the discarded information message header to obtain the source port (SRC_PORT) and error type (ERRO_CODE), and then can perform error information statistics on discarded packets based on the switching device port, quintuple, and depth packet content. By counting the number of discarded packets under each error type, you can control the packet loss of the entire network. Through the above steps, it is possible to perform error information statistics on packets based on the switching device, switching device port, quintuple, and depth packet content.

The monitoring device can obtain the device, source port, packet damage, and error type of the discarded packet through the information used for packet discard statistics. The monitoring device can analyze and count these information to obtain various discard information. For example, the statistics of the number of discarded packets generated by each device or each source port, the number of damaged packets, and the error types of various discarded packets, so as to locate the device and source port that generated the discarded packets, and facilitate Then optimize the device and source port according to the number of damaged packets and error types.

Through the monitoring device, it is possible to perform error information statistics on packets based on switching devices, switching device ports, quintuples, and in-depth packet content. The quintuple is a set of five quantities consisting of source IP address, source port, destination IP address, destination port, and transport layer protocol. The quintuple can distinguish different sessions, and the corresponding session is unique. The error information statistics based on the quintuple is to identify the application type through the port number. This method will easily cause some viruses or junk applications to use fake port numbers to disguise themselves as legitimate packets, so they cannot be detected. Therefore, the present application can also detect the content of the in-depth message, which is the analysis of the application layer, and can identify various applications and their content, and realize the refined control and analysis of network traffic.

The present invention also includes an analysis system for network packet loss traffic, and a receiving module for receiving the second discarded message sent by the switch chip and obtained by mirroring the first discarded message, wherein the first discarded message is the Said switch chip adds the message of discarding information packet header in discarding message, and said discarding information packet header includes error information;

The parsing module is configured to parse the error information in the second discarded message, and obtain the packet loss cause and statistical information of the discarded message.

By parsing the packet header of the discarded information, the method can read the error information of the discarded packet, and can detect the packet loss flow in time, and perform statistics on the packet loss based on the deep message content.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

The foregoing descriptions of specific exemplary embodiments of the present invention have been presented for purposes of illustration and description. These descriptions are not intended to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling others skilled in the art to make and use various exemplary embodiments of the invention, as well as various Choose and change. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims (12)

1. a monitoring method of network packet loss flow, is characterized in that, is applied on the exchange chip of switch, and described method comprises the following steps: Adding a discarding message header to the discarding message to obtain a first discarding message; wherein, the discarding message header includes error information; Mirroring the first discarded packet to obtain a second discarded packet; Sending the second discarded message to the monitoring device, so that the monitoring device analyzes the error information carried by the second discarded message, obtains the packet loss cause of the discarded message and performs packet discarding statistics, and obtains Statistical information of the discarded packets. 2. the monitoring method of network packet loss traffic as claimed in claim 1, is characterized in that, described error information comprises at least error information identification and the information that is used for message discarding statistics; The information that described message is used for message discarding statistics Including device number ID, source port information, length information of the discarded message and error code; wherein, the error information identifier is used to identify the discarded packet, and is used to identify the error information identifier followed by the used Packet discard statistics information; The device number ID is used to determine the device that generated the discarded message; the source port information is used to determine the source port that generated the discarded message; the length information of the discarded message is used to determine the discarded message The length of the message is used to determine whether the discarded message is damaged; the error code is used to identify the error type of the discarded message; The source port of the discarded message, the message damage information and the error type of the discarded message are analyzed and counted to obtain the number of discarded messages generated by each device or source port, and the number of message damages. Statistical information on the number and error types of various discarded packets is used to locate the device and source port that generated the discarded packets. 3. the monitoring method of network packet loss traffic as claimed in claim 1, is characterized in that, described first discarding message is mirrored, obtains in the second discarding message, specifically comprises the following steps: intercepting described Preset bytes before the first discarded message, obtain the discarded message after interception, mirror the discarded message after the interception, and obtain the second discarded message including the discarded information message header; wherein , adding the packet header of the discarding information to the first preset bytes of the discarding packet. 4. the monitoring method of network packet loss flow as claimed in claim 2, is characterized in that, described monitoring device is switch CPU and/or remote network monitoring device; When there is a remote network monitoring device, sending the second discarded message to the remote network monitoring device for statistical analysis of errors, the specific steps are as follows: Encapsulating the second discarded message with a service header according to the destination address of the remote network monitoring device and the source address of the switch, to obtain the encapsulated discarded message; Forwarding the encapsulated discarded message to a remote network monitoring device, so that the remote monitored device parses the encapsulated discarded message for statistical error analysis; When there is no remote network monitoring device, the second discarded packet is sent to the switch CPU for error statistical analysis. 5. A method for analyzing network packet loss traffic, characterized in that it is applied to monitoring equipment, and the method may further comprise the steps: receiving the second discarded message sent by the switch chip and obtained by mirroring the first discarded message, wherein the first discarded message is a message in which the discarded message header is added by the switch chip, The packet header of the discarding information includes error information; Analyzing the error information in the second discarded message to obtain the packet loss cause and statistical information of the discarded message. 6. the analysis method of network packet loss traffic as claimed in claim 5, is characterized in that, described error information comprises at least error information identification and the information that is used for message discarding statistics; The information that described message is used for message discarding statistics Including device number ID, source port information, length information of the discarded message and error code; wherein, the error information identifier is used to identify the discarded packet, and is used to identify the error information identifier followed by the used Packet discard statistics information; The device number ID is used to determine the device that generated the discarded message; the source port information is used to determine the source port that generated the discarded message; the length information of the discarded message is used to determine the discarded message The length of the message is used to determine whether the discarded message is damaged; the error code is used to identify the error type of the discarded message; The source port of the discarded message, the message damage information and the error type of the discarded message are analyzed and counted to obtain the number of discarded messages generated by each device or source port, and the number of message damages. Statistical information on the number and error types of various discarded packets is used to locate the device and source port that generated the discarded packets. 7. the analysis method of network packet loss traffic as claimed in claim 5, is characterized in that, described error information in the second discarding message is analyzed and comprises: The second discarded message is a message obtained by intercepting the first predetermined bytes of the first discarded message and mirroring it; wherein, the discarded information message header is added to the pre-preset byte of the discarded message within bytes. 8. the analysis method of network packet loss traffic as claimed in claim 5, is characterized in that, described monitoring device is switch CPU and/or remote network monitoring device; When there is the remote network monitoring device, the remote network monitoring device receives the encapsulated discarded message sent by the switch chip after the second discarded message is encapsulated by the service station, and the encapsulated discarded message is The packet is analyzed to obtain the packet loss reason and statistical information of the discarded packet; When there is no remote network monitoring device, the CPU of the switch parses the error information in the second discarded message to obtain a packet loss cause and statistical information of the discarded message. 9. A monitoring system for network packet loss traffic, characterized in that it comprises: A message header generating module, configured to add a discard information header to the discard message to obtain a first discard message; wherein, the discard information header includes error information; A mirroring module, configured to mirror the first discarded message to obtain a second discarded message; A sending module, configured to send the second discarded message to a monitoring device, so that the monitoring device analyzes the error information carried by the second discarded message, obtains the packet loss cause of the discarded message, and reports Document discard statistics. 10. An analysis system for network packet loss traffic, characterized in that, comprising: The receiving module is configured to receive the second discarded message sent by the switch chip and obtained by mirroring the first discarded message, wherein the first discarded message is a discarded message added by the switch chip to the discarded message Header message, including error information in the discarding information message header; The parsing module is configured to parse the error information in the second discarded message, and obtain the packet loss cause and statistical information of the discarded message. 11. A storage medium, characterized in that the storage medium includes a stored program, wherein the program executes the method for monitoring network packet loss traffic according to any one of claims 1 to 4 or/and executes the following steps: The method for analyzing network packet loss traffic described in any one of claims 5 to 8. 12. A computer device, characterized in that it comprises a processor, a memory, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program, it realizes the The method for monitoring network packet loss traffic described in any one of claims 1 to 4 or/and realizing the analysis method for network packet loss traffic described in any one of claims 5 to 8.

Images