CN113645058A - Network link flow monitoring method, device and system - Google Patents

Network link flow monitoring method, device and system Download PDF

Info

Publication number
CN113645058A
CN113645058A CN202110720448.0A CN202110720448A CN113645058A CN 113645058 A CN113645058 A CN 113645058A CN 202110720448 A CN202110720448 A CN 202110720448A CN 113645058 A CN113645058 A CN 113645058A
Authority
CN
China
Prior art keywords
network
network switch
monitoring
data
monitoring platform
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110720448.0A
Other languages
Chinese (zh)
Inventor
李贯中
陈翔
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Suzhou Inspur Intelligent Technology Co Ltd
Original Assignee
Suzhou Inspur Intelligent Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Suzhou Inspur Intelligent Technology Co Ltd filed Critical Suzhou Inspur Intelligent Technology Co Ltd
Priority to CN202110720448.0A priority Critical patent/CN113645058A/en
Publication of CN113645058A publication Critical patent/CN113645058A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/12—Discovery or management of network topologies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H04L43/045—Processing captured monitoring data, e.g. for logfile generation for graphical visualisation of monitoring data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0852—Delays
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/50—Testing arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services

Abstract

The invention provides a network link flow monitoring method, which is applied to a data center network and comprises the following steps: the monitoring platform acquires the connection topological relation of the data center monitoring network according to the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module; sending the acquired flow detection information input by the user to a first network switch node and a second network switch node; the invention further provides a network link flow monitoring device and system, and the accuracy and the comprehensiveness of data center network monitoring are effectively improved.

Description

Network link flow monitoring method, device and system
Technical Field
The present invention relates to the field of network link monitoring, and in particular, to a method, an apparatus, and a system for monitoring network link traffic.
Background
With the large-scale popularization of cloud computing, the technology development of Overlay (a service layer network of a data center network, or a tenant network) network architecture and storage data fusion in the data center network, and the operation and maintenance of the data center network face a great challenge, wherein how to perform link and flow monitoring in a refined and accurate manner becomes very important.
In the prior art, the Network connectivity is generally measured based on SNMP (Simple Network Management Protocol)/RMON (Remote Monitoring) or other technical agents (agent modules) to count the flow of the port, or by using ping packet detection.
Based on the port flow statistical method, for a multi-level and converged network of a data center, the monitoring granularity is too coarse to accurately judge the flow behavior or the flow characteristic of a user; the ping packet detection-based method cannot realistically simulate the user traffic and cannot detect the actual chip forwarding delay of each network passing through the switch node, so that the monitoring accuracy and the comprehensiveness are poor.
Disclosure of Invention
The invention aims to solve the problems in the prior art, and innovatively provides a network link flow monitoring method, device and system, so that the problem that the data center network monitoring accuracy and comprehensiveness are poor due to the prior art is effectively solved, and the accuracy and comprehensiveness of the data center network monitoring are effectively improved.
The first aspect of the present invention provides a method for monitoring network link traffic, which is applied to a data center network, and includes:
building a data center monitoring network, wherein the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch;
the monitoring platform acquires protocol data of the network switch sent by each network element monitoring agent module, and acquires a connection topology relation of the data center monitoring network according to the protocol data of the network switch sent by each network element monitoring agent module;
acquiring flow detection information input by a user, and sending the acquired flow detection information input by the user to a first network switch node and a second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality;
the method comprises the steps of obtaining flow detection data and forwarding delay data which are respectively sent by a first network switch node and a second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the obtained connection topological relation of a data center monitoring network.
Optionally, a data center monitoring network is set up, and the data center monitoring network includes a monitoring platform and a plurality of network element monitoring agent modules running on the network switch, and specifically includes:
establishing a monitoring platform on a server, running a monitoring platform service process on the established monitoring platform, and setting and activating a security access strategy of the service process;
configuring each network switch, and starting LLDP protocol service and SNTP protocol service on a port of each network switch;
and starting a network element monitoring agent module on each network switch, and enabling the network element monitoring agent module to access the monitoring platform by configuring the network element monitoring agent module, and setting and activating a security access strategy corresponding to the service process of the monitoring platform.
Further, the step of acquiring, by the monitoring platform, the protocol data of the network switch of the data center, which is sent by each network element monitoring agent module, and acquiring the connection topology relationship of the data center monitoring network according to the protocol data of the network switch of the data center, which is sent by each network element monitoring agent module, specifically includes:
the network element monitoring agent module periodically collects the LLDP protocol data of the network switch of the network element monitoring agent module and sends the collected LLDP protocol data to the monitoring platform;
and after receiving the LLDP protocol data of the network element monitoring agent module, the monitoring platform acquires the connection topology relation of the data center monitoring network according to the LLDP protocol data.
Further, the LLDP protocol data includes type information of the network switch node, IP address information.
Optionally, the traffic detection data and the forwarding delay data respectively sent by the first network switch node and the second network switch node specifically include:
after receiving user-input flow detection information sent by a monitoring platform, a first network switch node issues a flow detection rule to a first switch chip according to the user-input flow detection information, the first switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the first switch chip is a switch chip in a first network switch;
after receiving the user-input flow detection information forwarded by the first network switch node, the second network switch node issues a flow detection rule to a second switch chip in the second network switch according to the user-input flow detection information, the second switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the second switch chip is a switch chip in the second network switch.
Further, the forwarding delay data is a timestamp entering the first network switch node and a timestamp leaving the first network switch node; and/or a timestamp entering the second network switch node and a timestamp exiting the second network switch node.
Optionally, the traffic detection information input by the user includes: a traffic detection period, the number of detection packets, traffic characteristics to be monitored, and a first network switch node to which traffic is injected; wherein, the flow characteristics to be monitored include: source MAC address, destination MAC address, source IP address, destination IP address, L4 port.
Further, the specific steps of sending the captured detection traffic and the forwarding delay data to the monitoring platform are as follows:
generating a flow detection data packet for the captured detection flow according to the flow detection period and the number of the detection packets;
intercepting the preset number of bytes at the head of each generated flow detection data packet, and replacing the intercepted number of bytes with forwarding time delay data;
and sending the replaced flow detection data packet to a monitoring platform.
The second aspect of the present invention provides a network link flow monitoring apparatus, which is applied in a data center network, and includes:
the system comprises a building unit, a monitoring unit and a monitoring unit, wherein the building unit builds a data center monitoring network, and the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch;
the topology relation obtaining unit is used for obtaining the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module by the monitoring platform and obtaining the connection topology relation of the data center monitoring network according to the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module;
the information sending unit is used for acquiring the flow detection information input by the user and sending the acquired flow detection information input by the user to the first network switch node and the second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality;
the data acquisition unit is used for acquiring the flow detection data and the forwarding delay data which are respectively sent by the first network switch node and the second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the connection topological relation of the acquired data center monitoring network.
The third aspect of the present invention provides a network link flow monitoring system, which is applied in a data center network, and includes:
the server runs a monitoring platform, the monitoring platform acquires protocol data of the network switch sent by each network element monitoring agent module, and the connection topology relation of the data center monitoring network is acquired according to the protocol data of the network switch sent by each network element monitoring agent module; acquiring flow detection information input by a user, and sending the acquired flow detection information input by the user to a first network switch node and a second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality; acquiring flow detection data and forwarding delay data respectively sent by a first network switch node and a second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the obtained connection topological relation of the data center monitoring network;
the network element monitoring agent module is started on each network switch, and can access the monitoring platform by configuring the network element monitoring agent module; each network element monitors the protocol data of the network switch sent by the agent module; the method comprises the steps of directly or indirectly receiving flow detection information input by a user and sent by a monitoring platform, capturing detection flow and forwarding time delay data according to the flow detection information input by the user, and sending the captured detection flow and forwarding time delay data to the monitoring platform.
The technical scheme adopted by the invention comprises the following technical effects:
1. according to the invention, the network switch of the data center is divided into the first network switch node and the second network switch node, and the first network switch node and the second network switch node forward the acquired flow detection data and the forwarding delay data to the monitoring platform, so that the problems of poor network monitoring accuracy and comprehensiveness of the data center caused by the prior art are effectively solved, and the accuracy and comprehensiveness of the network monitoring of the data center are effectively improved.
2. According to the technical scheme, the network connection topological relation, the flow detection data and the forwarding delay data of each switch node in the network are obtained, and visual display is carried out based on the obtained connection topological relation of the data center monitoring network, so that the flow detection condition and the forwarding delay condition in each node and each link in the data center network can be clearly displayed, operation and maintenance personnel can know the data center network in time conveniently, and the network operation and maintenance efficiency is improved.
3. According to the technical scheme, the corresponding security access strategies are respectively arranged on the monitoring platform and the network element monitoring agent module, so that the access security of the monitoring platform and the network element monitoring agent module is improved.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.
Drawings
In order to more clearly illustrate the embodiments or technical solutions in the prior art of the present invention, the drawings used in the description of the embodiments or prior art will be briefly described below, and it is obvious for those skilled in the art that other drawings can be obtained based on these drawings without any creative effort.
FIG. 1 is a schematic flow diagram of a process according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart illustrating step S1 of a method according to an embodiment of the present invention;
fig. 3 is a schematic flow chart illustrating step S2 in a method according to an embodiment of the present invention;
FIG. 4 is a schematic structural diagram of an apparatus according to a second embodiment of the present invention;
FIG. 5 is a schematic structural diagram of a building unit 101 in a second apparatus according to an embodiment of the present invention;
fig. 6 is a schematic structural diagram of the topological relation obtaining unit 102 in the second apparatus according to the embodiment of the present invention;
fig. 7 is an exemplary structural diagram of a third system according to an embodiment of the present invention.
Detailed Description
In order to clearly explain the technical features of the present invention, the following detailed description of the present invention is provided with reference to the accompanying drawings. The following disclosure provides many different embodiments, or examples, for implementing different features of the invention. To simplify the disclosure of the present invention, the components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and/or letters in the various examples. This repetition is for the purpose of simplicity and clarity and does not in itself dictate a relationship between the various embodiments and/or configurations discussed. It should be noted that the components illustrated in the figures are not necessarily drawn to scale. Descriptions of well-known components and processing techniques and procedures are omitted so as to not unnecessarily limit the invention.
Example one
As shown in fig. 1, the present invention provides a network link traffic monitoring method, which is applied in a data center network, and includes:
s1, building a data center monitoring network, wherein the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch;
s2, the monitoring platform acquires the protocol data of the network switch sent by each network element monitoring agent module, and acquires the connection topology relation of the data center monitoring network according to the protocol data of the network switch sent by each network element monitoring agent module;
s3, acquiring the flow detection information input by the user, and sending the acquired flow detection information input by the user to the first network switch node and the second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality;
and S4, acquiring the traffic detection data and the forwarding delay data respectively sent by the first network switch node and the second network switch node, and visually displaying the traffic detection data and the forwarding delay data based on the connection topology relation of the acquired data center monitoring network.
In step S1, as shown in fig. 2, the method specifically includes:
s11, creating a monitoring platform on the server, running a monitoring platform service process on the created monitoring platform, and setting and activating a security access strategy of the service process;
s12, configuring each Network switch, and starting LLDP (Link Layer Discovery Protocol) Protocol service and SNTP (Simple Network Time Protocol) Protocol service on a port of each Network switch;
s13, the network element monitoring agent module is opened on each network switch, and by configuring the network element monitoring agent module, the network element monitoring agent module can access the monitoring platform, and set and activate the security access policy corresponding to the service process of the monitoring platform.
In step S11, the security access policy of the service process (the process running on the monitoring platform for providing the service) may be an x509 certificate (a certificate for user security communication), a username/password, or a JWT (JSON web token, a network application security access mechanism, based on the JSON open standard), and may be other security access policies, which is not limited herein.
Configuring each network switch to start LLDP protocol service and SNTP protocol service on a port (port) of each network switch in steps S12-S13; the network element monitoring agent module (agent) is opened on each network switch, and the network element monitoring agent module is configured, so that the network element monitoring agent module can access the monitoring platform, and set and activate a security access policy corresponding to the service process of the monitoring platform, where the security access policy operated by the network element monitoring agent module may be an x509 certificate (certificate of user security communication), a username/password, or a JWT (JSON web token, a network application security access mechanism, based on the JSON open standard), and the like, that is, may be other security access policies, as long as the security access policy corresponding to the service process of the monitoring platform is applicable, and the present invention is not limited herein.
In step S2, as shown in fig. 3, the method specifically includes:
s21, the network element monitoring agent module periodically collects the LLDP protocol data of the network switch and sends the collected LLDP protocol data to the monitoring platform;
and S22, after receiving the LLDP protocol data of the network element monitoring agent module, the monitoring platform obtains the connection topology relation of the data center monitoring network according to the LLDP protocol data.
In step S21, the Network element monitoring agent module on the Network switch periodically (with a period of default of 1 minute, or with flexible configuration by the user) collects the LLDP protocol data of the Network switch itself, and then sends the data to the monitoring platform through the gnni protocol (gRPC) (google Remote Procedure call) Network Management Interface, which is a Network Management protocol based on the gRPC proposed by google.
Specifically, the LLDP protocol data includes type information of the network switch node, IP address information.
In step S22, after receiving the LLDP protocol data sent by the network element monitoring agent module, the monitoring platform obtains the network connection topology according to the neighbor relation data (type information, IP address information, etc. of the neighboring switch node) collected by the LLDP, and then displays the network topology in a graphical manner.
In step S3, the user inputs the traffic detection information through the monitoring platform, where the traffic detection information input by the user includes: a traffic detection period, the number of detection packets, traffic characteristics to be monitored, and a first network switch node to which traffic is injected; wherein, the flow characteristics to be monitored include but are not limited to: a source MAC address (source two-layer address of the data packet), a destination MAC address (destination two-layer address of the data packet), a source IP address (source three-layer address of the data packet), a destination IP address (destination three-layer address of the data packet), and an L4 port (transport layer port of the IP packet).
The monitoring platform issues configuration to each switch node through a restful API interface (a stateless programming interface based on HTTP).
The first network switch node receives user-input flow detection information sent by a monitoring platform, and then sends a flow detection rule to a first switch chip according to the user-input flow detection information, the first switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the first switch chip is a switch chip in a first network switch;
after receiving the user-input flow detection information forwarded by the first network switch node, the second network switch node issues a flow detection rule to a second switch chip in the second network switch according to the user-input flow detection information, the second switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the second switch chip is a switch chip in the second network switch.
Specifically, the forwarding delay data is a timestamp entering the first network switch node and a timestamp leaving the first network switch node; and/or a timestamp entering the second network switch node and a timestamp exiting the second network switch node.
And the first network switch node or the second network switch node acquires hardware forwarding delay data of flow through the first switching chip or the second switching chip according to the captured detection flow and when the configured characteristic flow sequentially flows through the current network switch node, namely a timestamp entering the first network switch node or the second network switch node and a timestamp leaving the first network switch node or the second network switch node, and completes the acquisition of the forwarding delay data.
It should be noted that the forwarding delay data may be a timestamp sent by the first network switch node and entering the first network switch node and a timestamp sent by the first network switch node and leaving the first network switch node, or a timestamp sent by the second network switch node and entering the second network switch node and leaving the second network switch node, and after receiving the timestamp sent by the first network switch node and entering the first network switch node and leaving the first network switch node, or the timestamp sent by the second network switch node and entering the second network switch node and leaving the second network switch node, the monitoring platform performs corresponding calculation (subtraction operation), that is, hardware forwarding delay data of traffic collected by the first switch chip or the second switch chip may be obtained.
Further, the specific steps of sending the captured detection traffic and the forwarding delay data to the monitoring platform are as follows:
generating a flow detection data packet for the captured detection flow according to the flow detection period and the number of the detection packets;
intercepting the preset number of bytes at the head of each generated flow detection data packet, and replacing the intercepted number of bytes with forwarding time delay data;
and sending the replaced flow detection data packet to a monitoring platform.
Preferably, the flow detection period may be set by user, the number of the detection packets may be one or multiple, when multiple detection packets are provided, one flow detection data packet (i.e. detection packet) may be generated for the detected flow captured corresponding to each flow characteristic, so that when the monitoring platform analyzes the flow detection data, the order will be clearer, the preset number of bytes of the head of the detection data packet generated by each detection flow is intercepted and replaced by the forwarding delay data of the corresponding detection flow, so that the monitoring platform can not only obtain the flow forwarding delay data of the first network switch node or the second network switch node, but also obtain the forwarding delay data of the first network switch node or the second network switch node for different types of flows, so that the data center network link monitoring is more accurate and comprehensive, and the efficiency of monitoring or operation and maintenance of the data center network is further improved.
When the first network switch node or the second network switch node sends the detection data to the monitoring platform, the replaced flow detection data packet can be injected into the network, and then the flow detection data packet is sent to the monitoring platform through the network element monitoring agent module on the first network switch node or the second network switch node.
In step S4, after the monitoring platform passes the received probe data of the first network switch node or the second network switch node (the analysis of the monitoring platform does not depend on the sequence of the probe data of each first network switch node or the second network switch node), the monitoring platform displays the analysis result, and marks the corresponding link and the network switch node in a graphical form and in different color levels in combination with the current topological connection relationship, thereby visually displaying the delay levels of the traffic link and the network switch node.
It should be noted that, steps S1-S4 of the present invention can be implemented by hardware or software programming, and the idea of programming implementation corresponds to each step, and can also be implemented by other manners, which is not limited herein.
According to the invention, the network switch of the data center is divided into the first network switch node and the second network switch node, and the first network switch node and the second network switch node forward the acquired flow detection data and the forwarding delay data to the monitoring platform, so that the problems of poor network monitoring accuracy and comprehensiveness of the data center caused by the prior art are effectively solved, and the accuracy and comprehensiveness of the network monitoring of the data center are effectively improved.
According to the technical scheme, the network connection topological relation, the flow detection data and the forwarding delay data of each switch node in the network are obtained, and visual display is carried out based on the obtained connection topological relation of the data center monitoring network, so that the flow detection condition and the forwarding delay condition in each node and each link in the data center network can be clearly displayed, operation and maintenance personnel can know the data center network in time conveniently, and the network operation and maintenance efficiency is improved.
According to the technical scheme, the corresponding security access strategies are respectively arranged on the monitoring platform and the network element monitoring agent module, so that the access security of the monitoring platform and the network element monitoring agent module is improved.
Example two
As shown in fig. 4, the technical solution of the present invention further provides a network link traffic monitoring apparatus, which is applied to a data center network, and includes:
the system comprises a building unit 101 for building a data center monitoring network, wherein the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch;
the topology relation obtaining unit 102 is configured to obtain, by the monitoring platform, protocol data of the network switch itself sent by each network element monitoring agent module, and obtain a connection topology relation of the data center monitoring network according to the protocol data of the network switch itself sent by each network element monitoring agent module;
an information sending unit 103, configured to obtain traffic detection information input by a user, and send the obtained traffic detection information input by the user to a first network switch node and a second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality;
the data obtaining unit 104 obtains the traffic detection data and the forwarding delay data respectively sent by the first network switch node and the second network switch node, and visually displays the traffic detection data and the forwarding delay data based on the obtained connection topology relationship of the data center monitoring network.
As shown in fig. 5, the building unit 101 specifically includes:
a creating subunit 1011, creating a monitoring platform on the server, running a monitoring platform service process on the created monitoring platform, and setting and activating a security access policy of the service process;
a configuration starting subunit 1012, which configures each network switch, and starts LLDP protocol service and SNTP protocol service on a port of each network switch;
the configuration access subunit 1013 starts a network element monitoring agent module on each network switch, and enables the network element monitoring agent module to access the monitoring platform by configuring the network element monitoring agent module, and sets and activates a security access policy corresponding to a service process of the monitoring platform.
In the creating subunit 1011, the security access policy of the service process (the process running on the monitoring platform to provide the service) may be an x509 certificate (a certificate for user security communication), a username/password, or a JWT (JSON web token, a network application security access mechanism, based on the JSON open standard), and may be other security access policies, which is not limited herein.
In configuration opening subunit 1012 and configuration access subunit 1013, each network switch is configured, and LLDP protocol service and SNTP protocol service are opened on a port (port) of each network switch; the network element monitoring agent module (agent) is opened on each network switch, and the network element monitoring agent module is configured, so that the network element monitoring agent module can access the monitoring platform, and set and activate a security access policy corresponding to the service process of the monitoring platform, where the security access policy operated by the network element monitoring agent module may be an x509 certificate (certificate of user security communication), a username/password, or a JWT (JSON web token, a network application security access mechanism, based on the JSON open standard), and the like, that is, may be other security access policies, as long as the security access policy corresponding to the service process of the monitoring platform is applicable, and the present invention is not limited herein.
As shown in fig. 6, the topological relation obtaining unit 102 specifically includes:
the acquisition and transmission subunit 1021 is used for acquiring the LLDP protocol data of the network switch of the network element monitoring agent module periodically and transmitting the acquired LLDP protocol data to the monitoring platform;
the obtaining subunit 1022 is configured to, after receiving the LLDP protocol data of the network element monitoring agent module, obtain the connection topology relationship of the data center monitoring network according to the LLDP protocol data.
In the acquisition and transmission subunit 1021, the network element monitoring agent module on the network switch acquires LLDP protocol data of its own network switch periodically (with a default period of 1 minute, or with flexible configuration by a user), and then transmits the data to the monitoring platform via the gnni protocol.
Specifically, the LLDP protocol data includes type information of the network switch node, IP address information.
In the obtaining subunit 1022, after receiving the LLDP protocol data sent by the network element monitoring agent module, the monitoring platform obtains a network connection topology according to neighbor relation data (type information of an adjacent switch node, IP address information, and the like) collected by the LLDP, and then displays the network topology in a graphical manner.
In the information sending unit 103, a user inputs traffic detection information through the monitoring platform, where the traffic detection information input by the user includes: a traffic detection period, the number of detection packets, traffic characteristics to be monitored, and a first network switch node to which traffic is injected; wherein, the flow characteristics to be monitored include but are not limited to: a source MAC address (source two-layer address of the data packet), a destination MAC address (destination two-layer address of the data packet), a source IP address (source three-layer address of the data packet), a destination IP address (destination three-layer address of the data packet), and an L4 port (transport layer port of the IP packet).
And the monitoring platform issues configuration to each switch node through a RESTful API interface.
The first network switch node receives user-input flow detection information sent by a monitoring platform, and then sends a flow detection rule to a first switch chip according to the user-input flow detection information, the first switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the first switch chip is a switch chip in a first network switch;
after receiving the user-input flow detection information forwarded by the first network switch node, the second network switch node issues a flow detection rule to the second switch chip according to the user-input flow detection information, the second switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the second switch chip is a switch chip inside the second network switch.
Specifically, the forwarding delay data is a timestamp entering the first network switch node and a timestamp leaving the first network switch node; and/or a timestamp entering the second network switch node and a timestamp exiting the second network switch node.
And the first network switch node or the second network switch node acquires hardware forwarding delay data of flow through the first switching chip or the second switching chip according to the captured detection flow and when the configured characteristic flow sequentially flows through the current network switch node, namely a timestamp entering the first network switch node or the second network switch node and a timestamp leaving the first network switch node or the second network switch node, and completes the acquisition of the forwarding delay data.
It should be noted that the forwarding delay data may be a timestamp sent by the first network switch node and entering the first network switch node and a timestamp sent by the first network switch node and leaving the first network switch node, or a timestamp sent by the second network switch node and entering the second network switch node and leaving the second network switch node, and after receiving the timestamp sent by the first network switch node and entering the first network switch node and leaving the first network switch node, or the timestamp sent by the second network switch node and entering the second network switch node and leaving the second network switch node, the monitoring platform performs corresponding calculation (subtraction operation), that is, hardware forwarding delay data of traffic collected by the first switch chip or the second switch chip may be obtained.
Further, the specific steps of sending the captured detection traffic and the forwarding delay data to the monitoring platform are as follows:
generating a flow detection data packet for the captured detection flow according to the flow detection period and the number of the detection packets;
intercepting the preset number of bytes at the head of each generated flow detection data packet, and replacing the intercepted number of bytes with forwarding time delay data;
and sending the replaced flow detection data packet to a monitoring platform.
Preferably, the flow detection period may be set by user, the number of the detection packets may be one or multiple, when multiple detection packets are provided, one flow detection data packet (i.e. detection packet) may be generated for the detected flow captured corresponding to each flow characteristic, so that when the monitoring platform analyzes the flow detection data, the order will be clearer, the preset number of bytes of the head of the detection data packet generated by each detection flow is intercepted and replaced by the forwarding delay data of the corresponding detection flow, so that the monitoring platform can not only obtain the flow forwarding delay data of the first network switch node or the second network switch node, but also obtain the forwarding delay data of the first network switch node or the second network switch node for different types of flows, so that the data center network link monitoring is more accurate and comprehensive, and the efficiency of monitoring or operation and maintenance of the data center network is further improved.
When the first network switch node or the second network switch node sends the detection data to the monitoring platform, the replaced flow detection data packet can be injected into the network, and then the flow detection data packet is sent to the monitoring platform through the network element monitoring agent module on the first network switch node or the second network switch node.
In the data obtaining unit 104, after the monitoring platform passes through the received probe data of the first network switch node or the second network switch node (the analysis of the monitoring platform does not depend on the sequence of the probe data of each first network switch node or the second network switch node), the analysis result is displayed, and the corresponding link and the network switch node are marked in a graphical form and in different color levels by combining the current topological connection relationship, so that the delay levels of the traffic link and the network switch node are visually displayed.
According to the invention, the network switch of the data center is divided into the first network switch node and the second network switch node, and the first network switch node and the second network switch node forward the acquired flow detection data and the forwarding delay data to the monitoring platform, so that the problems of poor network monitoring accuracy and comprehensiveness of the data center caused by the prior art are effectively solved, and the accuracy and comprehensiveness of the network monitoring of the data center are effectively improved.
According to the technical scheme, the network connection topological relation, the flow detection data and the forwarding delay data of each switch node in the network are obtained, and visual display is carried out based on the obtained connection topological relation of the data center monitoring network, so that the flow detection condition and the forwarding delay condition in each node and each link in the data center network can be clearly displayed, operation and maintenance personnel can know the data center network in time conveniently, and the network operation and maintenance efficiency is improved.
According to the technical scheme, the corresponding security access strategies are respectively arranged on the monitoring platform and the network element monitoring agent module, so that the access security of the monitoring platform and the network element monitoring agent module is improved.
EXAMPLE III
As shown in fig. 7, the technical solution of the present invention further provides a network link traffic monitoring system, which is applied to a data center network, and includes:
the server 201 runs a monitoring platform 2011, the monitoring platform 2011 acquires the protocol data of the network switch per se sent by each network element monitoring agent module 2021, and acquires the connection topology relationship of the data center monitoring network according to the protocol data of the network switch per se sent by each network element monitoring agent module 2021; acquiring flow detection information input by a user, and sending the acquired flow detection information input by the user to a first network switch node and a second network switch node; the first network switch node is configured to receive traffic injection from the monitoring platform 2011, where the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality; acquiring flow detection data and forwarding delay data respectively sent by a first network switch node and a second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the obtained connection topological relation of the data center monitoring network;
the network element monitoring agent modules 2021 are started on each network switch, and the network element monitoring agent modules 2021 are configured so that the network element monitoring agent modules 2021 can access the monitoring platform; the protocol data of the network switch itself sent by each network element monitoring agent module 2021; the system and method may directly or indirectly receive the traffic detection information input by the user and sent from the monitoring platform 2011, capture the detection traffic and the forwarding delay data according to the traffic detection information input by the user, and send the captured detection traffic and forwarding delay data to the monitoring platform 2011.
The network switch 202 further includes, before the network element monitoring agent module 2021 is started, starting LLDP protocol service and SNTP protocol service on a port of each network switch.
According to the invention, the network switch of the data center is divided into the first network switch node and the second network switch node, and the first network switch node and the second network switch node forward the acquired flow detection data and the forwarding delay data to the monitoring platform, so that the problems of poor network monitoring accuracy and comprehensiveness of the data center caused by the prior art are effectively solved, and the accuracy and comprehensiveness of the network monitoring of the data center are effectively improved.
According to the technical scheme, the network connection topological relation, the flow detection data and the forwarding delay data of each switch node in the network are obtained, and visual display is carried out based on the obtained connection topological relation of the data center monitoring network, so that the flow detection condition and the forwarding delay condition in each node and each link in the data center network can be clearly displayed, operation and maintenance personnel can know the data center network in time conveniently, and the network operation and maintenance efficiency is improved.
According to the technical scheme, the corresponding security access strategies are respectively arranged on the monitoring platform and the network element monitoring agent module, so that the access security of the monitoring platform and the network element monitoring agent module is improved.
Although the embodiments of the present invention have been described with reference to the accompanying drawings, it is not intended to limit the scope of the present invention, and it should be understood by those skilled in the art that various modifications and variations can be made without inventive efforts by those skilled in the art based on the technical solution of the present invention.

Claims (10)

1. A network link flow monitoring method is applied to a data center network and is characterized by comprising the following steps:
building a data center monitoring network, wherein the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch;
the monitoring platform acquires protocol data of the network switch sent by each network element monitoring agent module, and acquires a connection topology relation of the data center monitoring network according to the protocol data of the network switch sent by each network element monitoring agent module;
acquiring flow detection information input by a user, and sending the acquired flow detection information input by the user to a first network switch node and a second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality;
the method comprises the steps of obtaining flow detection data and forwarding delay data which are respectively sent by a first network switch node and a second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the obtained connection topological relation of a data center monitoring network.
2. The method for monitoring network link traffic according to claim 1, wherein a data center monitoring network is established, the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch, and the method specifically comprises the following steps:
establishing a monitoring platform on a server, running a monitoring platform service process on the established monitoring platform, and setting and activating a security access strategy of the service process;
configuring each network switch, and starting LLDP protocol service and SNTP protocol service on a port of each network switch;
and starting a network element monitoring agent module on each network switch, and enabling the network element monitoring agent module to access the monitoring platform by configuring the network element monitoring agent module, and setting and activating a security access strategy corresponding to the service process of the monitoring platform.
3. The method for monitoring network link traffic according to claim 2, wherein the step of acquiring, by the monitoring platform, the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module, and the step of acquiring, according to the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module, the connection topology relationship of the data center monitoring network specifically includes:
the network element monitoring agent module periodically collects the LLDP protocol data of the network switch of the network element monitoring agent module and sends the collected LLDP protocol data to the monitoring platform;
and after receiving the LLDP protocol data of the network element monitoring agent module, the monitoring platform acquires the connection topology relation of the data center monitoring network according to the LLDP protocol data.
4. The method of claim 3, wherein the LLDP protocol data includes type information of the network switch node and IP address information.
5. The method for monitoring network link traffic according to claim 1, wherein the traffic probing data and the forwarding delay data respectively sent by the first network switch node and the second network switch node specifically include:
after receiving user-input flow detection information sent by a monitoring platform, a first network switch node issues a flow detection rule to a first switch chip according to the user-input flow detection information, the first switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the first switch chip is a switch chip in a first network switch;
after receiving the user-input flow detection information forwarded by the first network switch node, the second network switch node issues a flow detection rule to the second switch chip according to the user-input flow detection information, the second switch chip captures detection flow and forwarding delay data according to the user-input flow detection information, and sends the captured detection flow and forwarding delay data to the monitoring platform, wherein the second switch chip is a switch chip inside the second network switch.
6. The method of claim 5, wherein the forwarding delay data is a timestamp entering the first network switch node and a timestamp leaving the first network switch node; and/or a timestamp entering the second network switch node and a timestamp exiting the second network switch node.
7. The method for monitoring network link traffic according to any of claims 1-6, wherein the traffic probing information inputted by the user comprises: a traffic detection period, the number of detection packets, traffic characteristics to be monitored, and a first network switch node to which traffic is injected; wherein, the flow characteristics to be monitored include: source MAC address, destination MAC address, source IP address, destination IP address, L4 port.
8. The method for monitoring network link traffic according to claim 7, wherein the sending of the captured probe traffic and the forwarding delay data to the monitoring platform specifically comprises:
generating a flow detection data packet for the captured detection flow according to the flow detection period and the number of the detection packets;
intercepting the preset number of bytes at the head of each generated flow detection data packet, and replacing the intercepted number of bytes with forwarding time delay data;
and sending the replaced flow detection data packet to a monitoring platform.
9. A network link flow monitoring device is applied to a data center network and is characterized by comprising:
the system comprises a building unit, a monitoring unit and a monitoring unit, wherein the building unit builds a data center monitoring network, and the data center monitoring network comprises a monitoring platform and a plurality of network element monitoring agent modules running on a network switch;
the topology relation obtaining unit is used for obtaining the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module by the monitoring platform and obtaining the connection topology relation of the data center monitoring network according to the protocol data of the network switch of the monitoring platform sent by each network element monitoring agent module;
the information sending unit is used for acquiring the flow detection information input by the user and sending the acquired flow detection information input by the user to the first network switch node and the second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality;
the data acquisition unit is used for acquiring the flow detection data and the forwarding delay data which are respectively sent by the first network switch node and the second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the connection topological relation of the acquired data center monitoring network.
10. A network link flow monitoring system is applied to a data center network and is characterized by comprising:
the server runs a monitoring platform, the monitoring platform acquires protocol data of the network switch sent by each network element monitoring agent module, and the connection topology relation of the data center monitoring network is acquired according to the protocol data of the network switch sent by each network element monitoring agent module; acquiring flow detection information input by a user, and sending the acquired flow detection information input by the user to a first network switch node and a second network switch node; the monitoring platform comprises a first network switch node, a second network switch node and a monitoring platform, wherein the first network switch node is used for receiving flow injection of the monitoring platform, and the number of the first network switch nodes is one; the second network switch nodes are used for receiving the flow injection of the monitoring platform through the first network switch nodes, and the number of the second network switch nodes is a plurality; acquiring flow detection data and forwarding delay data respectively sent by a first network switch node and a second network switch node, and visually displaying the flow detection data and the forwarding delay data based on the obtained connection topological relation of the data center monitoring network;
the network element monitoring agent module is started on each network switch, and can access the monitoring platform by configuring the network element monitoring agent module; each network element monitors the protocol data of the network switch sent by the agent module; the method comprises the steps of directly or indirectly receiving flow detection information input by a user and sent by a monitoring platform, capturing detection flow and forwarding time delay data according to the flow detection information input by the user, and sending the captured detection flow and forwarding time delay data to the monitoring platform.
CN202110720448.0A 2021-06-28 2021-06-28 Network link flow monitoring method, device and system Pending CN113645058A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110720448.0A CN113645058A (en) 2021-06-28 2021-06-28 Network link flow monitoring method, device and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110720448.0A CN113645058A (en) 2021-06-28 2021-06-28 Network link flow monitoring method, device and system

Publications (1)

Publication Number Publication Date
CN113645058A true CN113645058A (en) 2021-11-12

Family

ID=78416367

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110720448.0A Pending CN113645058A (en) 2021-06-28 2021-06-28 Network link flow monitoring method, device and system

Country Status (1)

Country Link
CN (1) CN113645058A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114465931A (en) * 2021-12-30 2022-05-10 深信服科技股份有限公司 Network detection method, device, electronic equipment and storage medium
CN114666238A (en) * 2022-03-16 2022-06-24 平安科技（深圳）有限公司 Visual monitoring method, system, equipment and medium for data link

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105357046A (en) * 2015-11-23 2016-02-24 北京邮电大学 Network information detection method for software defined networking (SDN)
US20160277272A1 (en) * 2015-03-18 2016-09-22 Arista Networks, Inc. System and method for continuous measurement of transit latency in individual data switches and multi-device topologies
CN107347021A (en) * 2017-07-07 2017-11-14 西安交通大学 One kind is based on SDN method for reliable transmission
CN110430080A (en) * 2019-08-07 2019-11-08 国家计算机网络与信息安全管理中心 Network topology probe method and device
CN112291115A (en) * 2020-11-20 2021-01-29 桂林航天工业学院 High-precision real-time delay monitoring method based on software defined data center

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160277272A1 (en) * 2015-03-18 2016-09-22 Arista Networks, Inc. System and method for continuous measurement of transit latency in individual data switches and multi-device topologies
CN105357046A (en) * 2015-11-23 2016-02-24 北京邮电大学 Network information detection method for software defined networking (SDN)
CN107347021A (en) * 2017-07-07 2017-11-14 西安交通大学 One kind is based on SDN method for reliable transmission
CN110430080A (en) * 2019-08-07 2019-11-08 国家计算机网络与信息安全管理中心 Network topology probe method and device
CN112291115A (en) * 2020-11-20 2021-01-29 桂林航天工业学院 High-precision real-time delay monitoring method based on software defined data center

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114465931A (en) * 2021-12-30 2022-05-10 深信服科技股份有限公司 Network detection method, device, electronic equipment and storage medium
CN114465931B (en) * 2021-12-30 2023-12-29 深信服科技股份有限公司 Network detection method, device, electronic equipment and storage medium
CN114666238A (en) * 2022-03-16 2022-06-24 平安科技（深圳）有限公司 Visual monitoring method, system, equipment and medium for data link
CN114666238B (en) * 2022-03-16 2023-07-25 平安科技（深圳）有限公司 Visual monitoring method, system, equipment and medium for data link

Similar Documents

Publication Publication Date Title
CN106130766B (en) System and method for realizing automatic network fault analysis based on SDN technology
CN107465565B (en) Link test method and apparatus and system
US9306819B2 (en) Controller driven OAM for split architecture network
US7773611B2 (en) Method and apparatus for packet loss detection
US8780731B2 (en) Ethernet performance monitoring
JP5840788B2 (en) Method, apparatus and communication network for root cause analysis
CN108429637B (en) System and method for dynamically detecting process layer network topology of intelligent substation
US9602374B2 (en) Systems and methods for collecting and analyzing data to determine link quality and stability in layer two networks
CN113645058A (en) Network link flow monitoring method, device and system
WO2021093574A1 (en) Network quality detection method and apparatus, network element device, computer device, and computer readable medium
CN111934936B (en) Network state detection method and device, electronic equipment and storage medium
CN101145977B (en) A QoS monitoring system and its measuring method of IP data network
CN101321095A (en) Communication system implementing link measurement and its link measuring method
US20130042020A1 (en) Quick Network Path Discovery
CN103401716B (en) The method of network performance measurement, Network Management Equipment and network element device
WO2015196636A1 (en) Packet collection method and system, network device and network management centre
AU2010256133B2 (en) Method and apparatus for detecting ethernet operation, administration and maintenance (OAM)
CN104104548A (en) Network security posture information acquisition system and method based on SFLOW and OWAMP (One Way Active Measurement Protocol)
CN106209552B (en) Plug and play network-building method, apparatus and system
CN106161124B (en) Message test processing method and device
US8868764B2 (en) System and method for management of ethernet premise devices
CN112312376A (en) Method and system for remotely and interactively managing multifunctional electric meter
CN110048913A (en) The method that NAT passes through two-way detection processing is realized based on BFD
CN101164288A (en) Method of detecting IPv6 network application layer protocol
US20230231773A1 (en) Determining an organizational level network topology

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20211112

RJ01 Rejection of invention patent application after publication