CN101741617A - Method and device for positioning fault - Google Patents
Method and device for positioning fault Download PDFInfo
- Publication number
- CN101741617A CN101741617A CN200910242860A CN200910242860A CN101741617A CN 101741617 A CN101741617 A CN 101741617A CN 200910242860 A CN200910242860 A CN 200910242860A CN 200910242860 A CN200910242860 A CN 200910242860A CN 101741617 A CN101741617 A CN 101741617A
- Authority
- CN
- China
- Prior art keywords
- message
- sign
- matched rule
- unit
- analyzed
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a method and a device for positioning a fault. The method comprises the following steps: setting identification for acquiring a message aiming at the message which satisfies a matching rule of the message to be analyzed; acquiring the message provided with the identification in the message which performs subsequent treatment; and analyzing the acquired message to obtain an analysis result. Visibly, the method and the device of the invention can acquire the message to be analyzed fast and accurately without consuming a large amount of manual operation any more, thereby effectively improving the positioning efficiency of the fault under the condition of not influencing performance of communication.
Description
Technical field
The present invention relates to the communications field, be specifically related to realize the method and apparatus of fault location.
Background technology
Network development speed now is surprising, and the network equipment is carrying various business, when wherein a kind of business breaks down, in time obtains the message of this kind business and analyzes and seem particularly important.
In order in the network environment of complexity, to obtain the needed information of fault location, adopt the method for Port Mirroring or traffic mirroring at present usually.
Wherein, need all be mirrored on the mirror port when carrying out Port Mirroring all Business Streams of certain port, use the information that this method is obtained to be needed from a large amount of messages, can expend a large amount of manual operations and then cause inefficiency, and it is higher to obtain difficulty; In addition, need when carrying out traffic mirroring that all messages are duplicated a process forwarding matrix and be forwarded to mirror port, this mode of operation can obviously influence the performance and the stability of network of switch under the bigger situation of service traffics.
Summary of the invention
In view of this, main purpose of the present invention is to provide the method and apparatus of realizing fault location, to improve fault location efficient under the situation that does not influence communication performance.
For achieving the above object, technical scheme of the present invention is achieved in that
Realize the method for fault location, this method comprises:
At the message of the matched rule that satisfies message to be analyzed, be provided for obtaining the sign of this message; In the message that carries out subsequent treatment, obtain the message that is provided with described sign; The message that gets access to is analyzed, obtained analysis result.
The method that described sign is set is: interpolation shows that this message is the sign that satisfies matched rule in message.
Described being designated: comprise the flag bit of value, or do not comprise letter, the symbol of value content.
The process of obtaining described message comprises:
That searches in the message to be comprised shows the sign that satisfies matched rule, obtains the message that includes this sign.
This method further comprises with next or all operations:
Pre-determine the matched rule of the message that will analyze;
After obtaining described message, carry out preserving this message before the described analysis.
This device comprises that sign is provided with unit, sign recognition unit, message analysis unit;
Wherein, described sign is provided with the unit, is used for the message at the matched rule that satisfies message to be analyzed, is provided for obtaining the sign of this message;
Described sign recognition unit is used at the message that carries out subsequent treatment, obtains the message that is provided with described sign and sends to described message analysis unit;
Described message analysis unit is used for the message of receiving is analyzed, and obtains analysis result.
Further comprise the matched rule discriminating unit, be used for the matched rule of the definite message that will analyze, and when the message that will carry out subsequent treatment satisfies this matched rule, notify described sign that the unit is set.
Further comprise memory cell, be used for the message that will analyze that described sign recognition unit is obtained is preserved, and when needs are analyzed this message, this message is sent to described message analysis unit.
Described sign recognition unit links to each other with the message performance element, and the message that is provided with described sign obtains by this connection.
Described message performance element is that message is transmitted port unit or business board, and this message performance element is arranged in this device.
As seen, no matter be method or device, the technology of the present invention all can be provided for obtaining the sign of this message at the message of the matched rule that satisfies message to be analyzed; And can from the message that carries out subsequent treatment, obtain the message that is provided with described sign, so that the message that gets access to is analyzed, obtain being used for the analysis result of fault location.Obviously, the inventive method and device all can guarantee effectively to improve fault location efficient under the situation that does not influence communication performance.
Description of drawings
Fig. 1 is the realization fault location flow chart of the embodiment of the invention;
Fig. 2 is a realization fault location general flow chart of the present invention;
Fig. 3 is the realization fault locator figure of the embodiment of the invention.
Embodiment
On general thought, the method for realization fault location provided by the present invention comprises: at the message of the matched rule that satisfies message to be analyzed, be provided for obtaining the sign of this message; In the message that carries out subsequent treatment, obtain the message that is provided with described sign; The message that gets access to is analyzed, obtained analysis result.
The device of realization fault location provided by the present invention comprises that sign is provided with unit, sign recognition unit, message analysis unit; Wherein, described sign is provided with the unit, is used for the message at the matched rule that satisfies message to be analyzed, is provided for obtaining the sign of this message; Described sign recognition unit is used at the message that carries out subsequent treatment, obtains the message that is provided with described sign and sends to described message analysis unit; Described message analysis unit is used for the message of receiving is analyzed, and obtains analysis result.
Referring to Fig. 1, Fig. 1 is the realization fault location flow chart of the embodiment of the invention, and this flow process may further comprise the steps:
Step 101: the matched rule of the definite message that will analyze.
Need to prove that multiple business is to intert together on the network equipment in the network environment of complexity, and flow has nothing in common with each other, catch relatively difficulty of specific Business Stream definitely.In order to find certain specific Business Stream, can use ACL (Access Control List, Access Control List (ACL)) technical support is provided.
ACL generally comprises two important parts: qualify matched rule part and action action part.Wherein, matched rule part can be classified to packet by a series of matched rules, and these matched rules can be the source addresses, destination address, port numbers of packet etc.; Switch can detect packet according to the matched rule of appointment among the ACL, and pairing action decision is normal the forwarding or packet discard according to this matched rule.
Because ACL has These characteristics, therefore when needs carry out fault location, can be provided with to satisfy the needs of fault location matched rule among the ACL and action.Fault actual generation the whether no matter determined under the follow-up situation of analyzing the message that belongs to certain professional or certain type possibly, can determine the matched rule of the message that will analyze earlier, as: the source address of packet, destination address, port numbers etc.; Concrete definite method has multiple, as: the matched rule of in ACL, searching the message that will analyze, the concern tabulation of preserving the matched rule that will analyze message perhaps directly is set, and the matched rule of the message during this concerns is tabulated directly is defined as the matched rule of the message that will analyze.
Step 102: whether the message that judgement will be carried out subsequent treatment satisfies matched rule, if satisfy, enters step 103; Otherwise, directly enter step 104.
Particularly, when will to message transmit etc. subsequent treatment and this message be follow-up analyze possibly belong to the message of certain professional or certain type the time, can before carrying out corresponding subsequent treatment, obtain the matched rule in this message earlier.Afterwards, the matched rule of the message that gets access to and the matched rule of the predetermined message that will analyze are compared,, determine that then the message that will carry out subsequent treatment satisfies matched rule if consistent; Otherwise, determine that the message that will carry out subsequent treatment does not satisfy matched rule.
Step 103:, enter step 105 for this message is provided with flag bit Flag=1.
Step 104: for this message is provided with flag bit Flag=0.
Step 105: flag bit is carried in the message, this message is carried out corresponding subsequent treatment.
Particularly, but this flag bit can be carried on packet header or other recognizing site of message; The subsequent treatment that message is carried out might be operations such as forwarding.
105 as seen to, because message satisfies matched rule, therefore just be provided with flag bit and set by step 103 before carrying out subsequent treatment in message, this set is that the value by flag bit is set to 1 embodiment.
In fact, the purpose that flag bit is set in message is can effectively identify this message according to this flag bit afterwards, therefore so long as the sign that can effectively discern this message be set in message get final product, as: the sign of representing with letter, symbol etc. is set in message, though this sign is not carried out set by the mode that value is set, can show effectively that equally this message is the message that satisfies matched rule.So, in subsequent operation, as long as this sign is discerned.
Step 106: the equipment of handling message is that 1 message copies to memory cell with the value of flag bit.
Particularly, the equipment of subsequent treatment message might be that message is transmitted port unit or business board etc.; When the equipment of this processing message is received message, then can search the sign that satisfies matched rule that shows that is comprised in this message, and the message that will have this sign copies in the memory cell; This memory cell is preserved the message of receiving, is used for the follow-up message analysis that might carry out.
Step 107: in the time of need carrying out message analysis, from memory cell, obtain the message of being preserved.
Step 108: the message that gets access to is analyzed, obtained analysis result.Operating personnel can use this analysis result and carry out fault location and follow-up corresponding failure maintenance processing.
Above-mentioned technology contents can be simplified as shown in Figure 2, and Fig. 2 is a realization fault location general flow chart of the present invention, and this flow process may further comprise the steps:
Step 210:, be provided for obtaining the sign of this message at the message of the matched rule that satisfies message to be analyzed.
Step 220: in the message that carries out subsequent treatment, obtain the message that is provided with described sign.
Step 230: the message that gets access to is analyzed, obtained analysis result.
As seen, the method for the realization fault location described in Fig. 1, Fig. 2 no longer expends a large amount of manual operations owing to carried out sign to be provided with, and then can obtain accurately and rapidly and need the message analyzed; Message as prerequisite obtains and stores performance and the stability of network that also no longer influences switch.
In order to guarantee above-mentioned technical process energy smooth implementation, device as shown in Figure 3 can be set.Referring to Fig. 3, Fig. 3 is the realization fault locator figure of the embodiment of the invention, and this device comprises fault locator, message processor, the memory cell that can link to each other in twos; Be provided with in the fault locator continuous matched rule discriminating unit, the sign unit, message analysis unit are set, be provided with in the message processor continuous message performance element, the sign discriminating unit.
Wherein, the matched rule discriminating unit can be determined the matched rule of the message that will analyze, can also judge whether the message that will carry out subsequent treatment satisfies matched rule, and the notice sign is provided with the unit when satisfying; Sign is provided with the unit and shows the sign that satisfies matched rule according to being provided with in message from the notice of matched rule discriminating unit, and notifies the message performance element to carry out at subsequent treatment such as message forwarding.
When the message performance element carries out subsequent treatment to message, whether the sign discriminating unit can get access to this message and differentiate wherein to include and show the sign that satisfies matched rule from the message performance element, and the message that will comprise this sign sends to the memory cell preservation in modes such as duplicating.
When needs carried out message analysis, the message analysis unit can get access to the message of being preserved from memory cell, and the message that gets access to is analyzed, and obtained analysis result.Operating personnel can use this analysis result and carry out fault location and follow-up corresponding failure maintenance processing.
Need to prove that not needing usually between any two in fault locator, message processor and the memory cell connects equipment such as switch.In fact, two even three in above-mentioned three devices are closed usually and are located in the equipment, message performance element wherein is exactly that message in this equipment is transmitted message process devices such as port unit or business board usually, and this can be avoided switch performance in the network to be affected and guarantee network stabilization.
In sum, no matter be method or device, the technology of the present invention all can be provided for obtaining the sign of this message at the message of the matched rule that satisfies message to be analyzed; And can from the message that carries out subsequent treatment, obtain the message that is provided with described sign, so that the message that gets access to is analyzed, obtain being used for the analysis result of fault location.Obviously, the inventive method and device all can guarantee effectively to improve fault location efficient under the situation that does not influence communication performance.
The above is preferred embodiment of the present invention only, is not to be used to limit protection scope of the present invention, all any modifications of being done within the spirit and principles in the present invention, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.
Claims (10)
1. realize the method for fault location, it is characterized in that this method comprises:
At the message of the matched rule that satisfies message to be analyzed, be provided for obtaining the sign of this message; In the message that carries out subsequent treatment, obtain the message that is provided with described sign; The message that gets access to is analyzed, obtained analysis result.
2. method according to claim 1 is characterized in that, the method that described sign is set is: interpolation shows that this message is the sign that satisfies matched rule in message.
3. method according to claim 2 is characterized in that, described being designated: comprise the flag bit of value, or do not comprise letter, the symbol of value content.
4. according to each described method of claim 1 to 3, it is characterized in that the process of obtaining described message comprises:
That searches in the message to be comprised shows the sign that satisfies matched rule, obtains the message that includes this sign.
5. method according to claim 4 is characterized in that, this method further comprises with next or all operations:
Pre-determine the matched rule of the message that will analyze;
After obtaining described message, carry out preserving this message before the described analysis.
6. realize the device of fault location, it is characterized in that this device comprises that sign is provided with unit, sign recognition unit, message analysis unit;
Wherein, described sign is provided with the unit, is used for the message at the matched rule that satisfies message to be analyzed, is provided for obtaining the sign of this message;
Described sign recognition unit is used at the message that carries out subsequent treatment, obtains the message that is provided with described sign and sends to described message analysis unit;
Described message analysis unit is used for the message of receiving is analyzed, and obtains analysis result.
7. device according to claim 6 is characterized in that, further comprises the matched rule discriminating unit, is used for the matched rule of the definite message that will analyze, and notifies described sign that the unit is set when the message that will carry out subsequent treatment satisfies this matched rule.
8. according to claim 6 or 7 described devices, it is characterized in that, further comprise memory cell, be used for the message that will analyze that described sign recognition unit is obtained is preserved, and when needs are analyzed this message, this message is sent to described message analysis unit.
9. device according to claim 6 is characterized in that, described sign recognition unit links to each other with the message performance element, and the message that is provided with described sign obtains by this connection.
10. device according to claim 9 is characterized in that, described message performance element is that message is transmitted port unit or business board, and this message performance element is arranged in this device.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910242860A CN101741617A (en) | 2009-12-17 | 2009-12-17 | Method and device for positioning fault |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910242860A CN101741617A (en) | 2009-12-17 | 2009-12-17 | Method and device for positioning fault |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101741617A true CN101741617A (en) | 2010-06-16 |
Family
ID=42464551
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200910242860A Pending CN101741617A (en) | 2009-12-17 | 2009-12-17 | Method and device for positioning fault |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101741617A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101969404A (en) * | 2010-10-25 | 2011-02-09 | 杭州华三通信技术有限公司 | Method and equipment for processing messages |
| CN105704035A (en) * | 2014-11-25 | 2016-06-22 | 中兴通讯股份有限公司 | Message matching processing method and device |
| CN108121613A (en) * | 2017-12-28 | 2018-06-05 | 努比亚技术有限公司 | Localization method, mobile terminal and readable storage medium storing program for executing are restarted based on page |
| CN113452564A (en) * | 2021-06-29 | 2021-09-28 | 杭州迪普科技股份有限公司 | Fault diagnosis method and device based on ACL |
-
2009
- 2009-12-17 CN CN200910242860A patent/CN101741617A/en active Pending
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101969404A (en) * | 2010-10-25 | 2011-02-09 | 杭州华三通信技术有限公司 | Method and equipment for processing messages |
| CN101969404B (en) * | 2010-10-25 | 2012-09-26 | 杭州华三通信技术有限公司 | Method and equipment for processing messages |
| CN105704035A (en) * | 2014-11-25 | 2016-06-22 | 中兴通讯股份有限公司 | Message matching processing method and device |
| CN105704035B (en) * | 2014-11-25 | 2020-02-14 | 中兴通讯股份有限公司 | Message matching processing method and device |
| CN108121613A (en) * | 2017-12-28 | 2018-06-05 | 努比亚技术有限公司 | Localization method, mobile terminal and readable storage medium storing program for executing are restarted based on page |
| CN108121613B (en) * | 2017-12-28 | 2022-03-18 | 努比亚技术有限公司 | Memory page-based restart positioning method, mobile terminal and readable storage medium |
| CN113452564A (en) * | 2021-06-29 | 2021-09-28 | 杭州迪普科技股份有限公司 | Fault diagnosis method and device based on ACL |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108701187B (en) | Apparatus and method for hybrid hardware-software distributed threat analysis | |
| US20090109872A1 (en) | Method and an apparatus for analyzing a communication network | |
| CN106209920B (en) | A kind of safety protecting method and device of dns server | |
| CN114172854B (en) | Report Wen Jingxiang, mirror image configuration method, virtual switch and mirror image configuration device | |
| US8677015B2 (en) | Link trace frame transfer program recording medium, switching hub, and link trace frame transfer method | |
| CN106506242A (en) | A kind of Network anomalous behaviors and the accurate positioning method and system of flow monitoring | |
| JPWO2009090723A1 (en) | Packet transmission equipment | |
| CN110557342A (en) | Apparatus for analyzing and mitigating dropped packets | |
| US20230237265A1 (en) | Method and apparatus for detecting anomalies in mission critical environments | |
| CN105791248A (en) | Network attack analysis method and device | |
| CN103124226A (en) | Household broadband net-system play monitoring system and method | |
| CN105357114A (en) | Distributed network equipment | |
| CN103747026A (en) | Alarm method and alarm device of openflow flow table | |
| CN101741617A (en) | Method and device for positioning fault | |
| CN101917341A (en) | Packet marking probability selecting method and device for inter-domain retrospect | |
| CN111404768A (en) | DPI recognition realization method and equipment | |
| CN107241307B (en) | Self-learning network isolation safety device and method based on message content | |
| CN111130821A (en) | Power failure alarm method, processing method and device | |
| CN1983955A (en) | Method and system for monitoring illegal message | |
| CN101714950A (en) | Method and device for realizing fault positioning | |
| JP2014099777A (en) | Network abnormality detection system, measuring device and analyzer | |
| CN110855566B (en) | Method and device for dragging upstream flow | |
| EP2978172A1 (en) | Network statistical information providing system, network statistical information providing method, and program | |
| US9838312B2 (en) | Method and apparatus for improving forwarding performance of chip | |
| CN108881255B (en) | Method for detecting botnet based on C & C communication state conversion |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C12 | Rejection of a patent application after its publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20100616 |