Disclosure of Invention
The application aims to provide network data monitoring equipment which can capture interactive network data among communication equipment and monitor and record the captured network data.
In order to solve the technical problem, the application provides a network data monitoring device, which comprises a first network interface, a storage module, a processor and a data capturing module;
the data capturing module is used for capturing interactive network data among communication devices and sending the network data to the processor through the first network interface;
the processor is used for writing the network data into the storage module, judging whether the network data meets preset early warning conditions or not, if so, sending alarm information, and writing the alarm information into the storage module.
Preferably, judge whether network data satisfies predetermined early warning condition, if satisfy, send alarm information, and will alarm information write in the storage module includes:
judging whether the flow of the network data in unit time exceeds a preset flow, and if so, sending first alarm information;
and/or judging whether preset protocol interaction data between the communication devices are received within preset protocol time between the communication devices, and if not, sending second alarm information;
and/or judging whether a preset number of retransmission packets appear in the network data within preset transmission time, and if so, sending third alarm information;
and writing the first alarm information, the second alarm information and the third alarm information into the storage module.
Preferably, writing the first alarm information, the second alarm information, and the third alarm information into the storage module includes:
and dividing the first alarm information, the second alarm information and the third alarm information into independent files according to a preset time range and writing the independent files into the storage module according to a general format or a resolvable format.
Preferably, the data capture module includes:
the switch is connected with the communication equipment through a second network interface and connected with the processor through a mirror image interface, and is used for sending interactive network data between the communication equipment on the second network interface to the processor through the mirror image interface.
Preferably, the method further comprises the following steps:
and the LED display module is connected with the processor and used for displaying the working state of the data capture module and/or the capacity state of the storage module and/or the flow state of the network data according to the control information of the processor.
Preferably, the method further comprises the following steps:
the LCD display module is connected with the processor and is used for displaying the working state of the data capture module and/or the capacity state of the storage module and/or the flow state of the network data according to the control information of the processor; and the processor is also used for sending the operation information acquired by the operation interface to the processor.
Preferably, the processor is further configured to determine whether the file in the storage module meets a preset deletion condition, and if so, delete the oldest file in the storage module.
Preferably, the determining whether the file in the storage module meets a preset deletion condition, and if so, deleting the oldest file in the storage module includes:
judging whether the storage time of the files in the storage module exceeds a preset time threshold value or not, and if so, deleting the oldest files in the storage module;
and/or judging whether the number of the files in the storage module exceeds a preset number threshold, and if the number of the files in the storage module exceeds the preset number threshold, deleting the oldest files in the storage module;
and/or judging whether the storage space occupied by the files in the storage module exceeds a preset storage space threshold value, and if the storage space occupied by the files in the storage module exceeds the preset storage space threshold value, deleting the oldest files in the storage module.
Preferably, the method further comprises the following steps:
and the power supply module is used for supplying power to the processor and the storage module.
Preferably, the method further comprises the following steps:
and the user interface is used for sending configuration information and/or control instructions to the processor and/or acquiring data in the storage module.
The application provides a network data monitoring device, snatchs the module through setting up data and acquires the interactive network data between communication equipment, and the treater writes in network data into storage module to judge whether network data satisfies predetermined early warning condition, when network data satisfies the early warning condition, the treater can send alarm information, and write in alarm information into storage module. Therefore, the network data monitoring equipment can capture the interactive network data among the communication equipment, and monitor and record the captured network data.
Detailed Description
The core of the application is to provide a network data monitoring device, which can capture interactive network data among communication devices and monitor and record the captured network data.
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
Referring to fig. 1, fig. 1 is a schematic structural diagram of a network data monitoring device provided in the present application.
The network detection equipment comprises a data capturing module 1, a first network interface 2, a processor 3 and a storage module 4;
the data capturing module 1 is used for capturing network data interacted between communication devices and sending the network data to the processor 3 through the first network interface 2;
the processor 3 is configured to write the network data into the storage module 4, and determine whether the network data meets a preset early warning condition, and if so, send out alarm information, and write the alarm information into the storage module 4.
In consideration of whether the interaction of network data normally determines whether each communication device can normally operate when different communication devices communicate, therefore, the network data during communication between different communication devices needs to be monitored and recorded. The monitored communication device may be two communication devices, or may be more than two communication devices, and the present application is not limited thereto.
Specifically, when the network data monitoring device works, the data capturing module 1 acquires network data interacted between communication devices, the data capturing module 1 sends the acquired network data to the processor 3 through the first network interface 2, the processor 3 analyzes the network data after receiving the network data, writes the analyzed network data into the storage module 4, judges whether the analyzed network data meets preset early warning conditions or not, and monitors the network data, wherein the early warning conditions comprise early warning conditions of flow of the network data, early warning conditions of protocol data and early warning conditions in the aspect of retransmission packets. When the network data meets the early warning condition, the processor 3 sends out alarm information, and the processor 3 stores the alarm information into the storage module 4.
In addition, the Communication devices usually interact with each other in the form of a data packet when interacting, and a data packet of network data may be an IP (Internet Protocol) packet transmitted by a 5G, 4G, 3G, GSM (Global System for Mobile Communication), a wired network or WIFI (Internet Protocol, Internet interconnection Protocol), a UDP (User data Protocol), a TCP (Transmission Control Protocol), an ARP (Address Resolution Protocol), or other data packet, and a File Transfer Protocol (FTP) packet or a HyperText Transfer Protocol (HTTP) packet implemented based on a UDP Protocol or a TCP Protocol.
The storage module may be a large-capacity storage medium such as a Flash Memory, a hard disk, and a ROM (Read-Only Memory), and supports the file system formats of FAT16, FAT32, NTFS, Ext2, and Ext3, and has a function of writing and reading. The present application does not specifically limit which memory module is specifically selected. The module provides original evidence for problem backtracking, defect discovery and big data statistics by recording network data for a long time.
In addition, the network data content obtained by parsing the network data may include a source IP, a destination IP, a length of a data packet, a type of a protocol, a content of the data, and the like.
In summary, the network monitoring device can monitor and record network data by the data capture module 1, the processor 3 and the storage module 4, and reduce the influence of malicious intrusion, network failure and other conditions on network data interaction between communication devices.
Referring to fig. 2, fig. 2 is a schematic structural diagram of another network data monitoring device provided in the present application.
On the basis of the above-described embodiment:
as a preferred embodiment, whether the network data meets the preset early warning condition is judged, if yes, alarm information is sent out, and the alarm information is written into the storage module, including:
judging whether the flow of the network data in unit time exceeds a preset flow, and if so, sending first alarm information;
and/or judging whether preset protocol interaction data between the communication devices are received within preset protocol time between the communication devices, and if not, sending second alarm information;
and/or judging whether a preset number of retransmission packets appear in the network data within preset transmission time, and if so, sending third alarm information;
and writing the first alarm information, the second alarm information and the third alarm information into the storage module 4.
In order to realize the monitoring of the network state when the communication device performs network data interaction, the network state here includes network abnormality, application performance abnormality and network behavior abnormality. In this embodiment, the processor 3 determines the traffic of the network data, and when the traffic exceeds the preset traffic, it indicates that the interaction of the network data between the current communication devices is affected by the abnormal condition of the network, and the processor 3 sends out the first alarm information.
In addition, protocol interaction between the communication devices exists in advance, that is, data interacted between the communication devices is protocol data within the protocol time, the processor 3 can judge whether the communication devices receive the preset protocol interaction data within the preset protocol time, and if the protocol interaction data is not received within the preset protocol time, the processor 3 sends out second alarm information.
In addition to the above two determinations, it may also be determined whether a preset number of retransmission packets may occur in the network data within a preset transmission time, and when the number of retransmission packets exceeds the preset number within the preset time, it indicates that the interaction of the network data between the current communication devices is affected by an abnormal condition of the network behavior or a fault exists in the communication device itself, and a third alarm message needs to be sent. After the processor 3 sends the alarm information, the sent alarm information is written into the storage module 4.
Therefore, by adopting the mode of the embodiment, the abnormal condition of the network data can be judged as accurately as possible, the monitoring and recording of the network data are realized, and the operation guarantee capability and the problem handling efficiency of the equipment maintenance personnel on the service equipment or the system can be improved.
As a preferred embodiment, writing the first alarm information, the second alarm information, and the third alarm information into the storage module 4 includes:
the first alarm information, the second alarm information and the third alarm information are divided into independent files according to a preset time range and written into the storage module 4 according to a general format or a resolvable format.
It is considered that writing alarm information into the storage module 4 out of order causes difficulty in subsequent management. In this embodiment, the alarm information is divided into independent files according to a preconfigured time range, and the independent files are written into the storage module 4 according to a general format (including but not limited to pcap/pcapng) or a parsable format (for example, a coded hexadecimal file), so that the time-sharing management of the files in the storage module 4 can be realized, and the files can be conveniently extracted.
Specifically, the preconfigured time range may be set to be one hour, and the received network data and alarm information may be divided into 24 independent files in one day, and the preset time range is not particularly limited in the present application.
In addition, the network data may be divided into independent files according to a preset time range and written into the storage module 4 according to a general format or a resolvable format.
As a preferred embodiment, the data capture module 1 includes:
and the switch 11 is connected with the communication equipment through a second network interface, is connected with the processor 3 through a mirror image interface, and is used for sending interactive network data between the communication equipment on the second network interface to the processor 3 through the mirror image interface.
When the communication device interacts through the switch 11, the switch 11 is connected with the communication device through the second network interface, in order to obtain network data when the communication device interacts, in this embodiment, the switch 11 is provided with a mirror image port, which is used as the data capture module 1, the switch 11 forwards network data transmitted by one or more second network interfaces to the mirror image port to realize monitoring of the network, and under the condition that normal data transmission of the source port is not seriously affected, the flow of the network can be monitored and analyzed through the mirror image port. When the network fails, the fault can be located quickly.
It can be seen that the monitoring of the network data by the processor 3 can be better achieved by sending the network data to the processor 3 through the mirror port by the switch 11.
Of course, the data capture module 1 is not limited to the switch 11, and may also be a first processor that constitutes a communication processor of the communication device, that is, the communication processor and the first processor in the communication device are multiplexed, and when the communication processor in the communication device sends network data to another communication device, the network data is directly transmitted to the processor 3 through the first network interface, so as to capture the network data.
The present application does not specifically limit which data capture module 1 is specifically selected.
As a preferred embodiment, the method further comprises the following steps:
and an LED (Light-Emitting Diode) display module 5 connected to the processor 3, configured to display a working state of the data capture module 1 and/or a capacity state of the storage module 4 and/or a traffic state of the network data according to control information of the processor 3.
The method is considered to be convenient for directly displaying the state of the network data, the working state of the data capturing module 1 and the capacity state of the storage module 4 so that maintenance personnel can find problems in time. In this embodiment, the LED display module 5 is provided, and based on the control information of the processor 3, the information such as the operating state of the data capture module 1, the capacity state of the storage module 4, and the network data state is displayed by the LEDs with different colors and positions.
In addition, the LED display module 5 has advantages of high brightness, long life, and large viewing angle.
As a preferred embodiment, the method further comprises the following steps:
an LCD (Liquid Crystal Display) Display module 6 connected to the processor 3, configured to Display a working state of the data capture module 1 and/or a capacity state of the storage module 4 and/or a flow state of the network data according to control information of the processor 3; and is also used for sending the operation information acquired by the operation interface to the processor 3.
The method is considered to directly display the state of the network data, the working state of the data capturing module 1 and the capacity state of the storage module 4 so that maintenance personnel can find problems in time. In consideration of the fact that a network detection device is required to facilitate human-computer interaction in part of application scenes, in the embodiment, the LCD display module 6 is arranged, and through a customized UI interface and a screen drawing mode, information such as the working state of the data capture module 1, the capacity state of the storage module 4, the network data state and the like is visually displayed on the embedded color screen, and meanwhile, the LCD display module 6 also supports text information prompting.
In addition, the LCD display module 6 also has the functions of supporting the modification of the early warning condition, the viewing of historical warning information, the deletion of files in the storage module 4 and the like.
As a preferred embodiment, the processor 3 is further configured to determine whether the files in the storage module 4 satisfy a preset deletion condition, and if so, delete the oldest file in the storage module 4.
Considering that the storage space of the storage module 4 is limited and an old file no longer having a function needs to be deleted irregularly, in this embodiment, the processor 3 determines whether the file in the storage module 4 meets a preset deletion condition according to the preset deletion condition, and deletes the oldest file in the storage module 4 when the file in the storage module 4 meets the preset deletion condition.
As a preferred embodiment, the determining whether the file in the storage module 4 meets a preset deletion condition, and if yes, deleting the oldest file in the storage module 4 includes:
judging whether the storage time of the files in the storage module 4 exceeds a preset time threshold, and if so, deleting the oldest files in the storage module 4;
and/or judging whether the number of the files in the storage module 4 exceeds a preset number threshold, and if the number of the files in the storage module 4 exceeds the preset number threshold, deleting the oldest files in the storage module 4;
and/or judging whether the storage space occupied by the files in the storage module 4 exceeds a preset storage space threshold, and if the storage space occupied by the files in the storage module 4 exceeds the preset storage space threshold, deleting the oldest files in the storage module 4.
The storage module 4 needs to record network data and alarm information in consideration of the limited storage space of the storage module 4. In this embodiment, the processor 3 may determine the storage time of the file in the storage module 4, and the storage time of the file stored in the storage module 4 is too long and is out of function, so that the processor 3 determines whether the file whose storage time exceeds the preset time threshold exists in the storage module 4, and if the file exists, the oldest file in the storage module 4 is deleted, so that the space of the storage module 4 may be cleared, useless files may be deleted, and the processor 3 may monitor the file in the storage module 4 conveniently. In addition, since the number of files that can be stored in the storage module 4 is limited, in order to facilitate management and search of the files in the storage module 4, the processor 3 may further determine whether the number of files stored in the storage module 4 exceeds a preset number threshold, and if the number of files exceeds the preset number threshold, delete the oldest file in the storage module 4, thereby facilitating management and search of the files. In addition, in order to facilitate writing of a new file, the storage module 4 needs to have a reserved storage space during operation, so the processor 3 may determine whether the storage space occupied by the file of the storage module 4 exceeds a preset storage space threshold, and if the storage space occupied by the file of the storage module 4 exceeds the preset storage space threshold, delete the oldest file in the storage module 4. The storage space threshold may be 80%, and the application is not particularly limited herein.
And judging from three aspects of storage time, storage quantity and occupied space, and deleting the oldest file in the storage module 4 when the storage time exceeds a preset value, so as to modify, delete and monitor the files stored in the storage module 4.
As a preferred embodiment, the method further comprises the following steps:
a power supply module 8 for supplying power to the processor 3, the storage module 4, the LED display module 5 and the LCD display module 6.
In consideration of the requirement of long-time operation of the device, in the embodiment, when no battery is added, the direct current power supply is used as the power supply module.
As a preferred embodiment, the method further comprises the following steps:
a user interface 7 for sending configuration information and/or control instructions to the processor 3 and/or retrieving data in the memory module 4.
Considering that in part of the application scenarios, in order to facilitate the user to directly upload user instructions to the processor 3 and to derive data in the storage module 4 through the processor 3, the data is analyzed manually, such as when the communication terminal is a PC, a workstation, a server, or an embedded device with a large capacity storage space. In this embodiment, a user interface 7 is provided, and a user can upload configuration information of the data capture module 1 and the storage module 4 to the processor 3 through the user interface 7, where the configuration information may be information of the aforementioned preset early warning condition and/or deletion condition, and the user can monitor network data and files in the storage module 4 conveniently. The user can also upload control instructions, such as control instructions for deleting files in the storage module 4 and/or controlling the display state of the LED display module, through the processor 3, so that the user can conveniently perform human-computer interaction. In order to facilitate the user to manually analyze the network data in a part of the application scenarios, the user interface 7 may further extract the File in the storage module 4 through the processor 3, such as an FTP (File Transfer Protocol) mode. The user may send configuration information and/or control instructions to the processor 3 via the user interface 7 and may also derive data in the memory module 4.
It should be noted that, in the present specification, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.