CN114584485B

CN114584485B - Method, apparatus, device and computer readable storage medium for detecting edge network quality

Info

Publication number: CN114584485B
Application number: CN202210113745.3A
Authority: CN
Inventors: 沈之光; 黄晓伟; 彭寒秋
Original assignee: Alibaba China Co Ltd
Current assignee: Alibaba China Co Ltd
Priority date: 2022-01-30
Filing date: 2022-01-30
Publication date: 2023-10-31
Anticipated expiration: 2042-01-30
Also published as: CN114584485A

Abstract

The embodiment of the application discloses a method, a device, equipment and a computer readable storage medium for detecting the quality of an edge network. The specific technical scheme comprises the following steps: acquiring and recording a first detection result generated by a first edge node sending a quality detection message to a second edge node according to a preset first frequency, wherein the first detection result comprises at least one of packet loss information, TTL (time to live) information and Round Trip Time (RTT); determining a sliding window by using the first detection result, wherein the sliding window comprises the first detection result and the first detection result which is n times before the first detection result, and n is a preset positive integer; and analyzing the first detection result contained in the sliding window to determine whether network quality abnormality occurs. The application can realize the high-efficiency detection of the edge network quality.

Description

Method, apparatus, device and computer readable storage medium for detecting edge network quality

Technical Field

The present application relates to the field of computer communications technologies, and in particular, to a method, an apparatus, a device, and a computer readable storage medium for detecting quality of an edge network.

Background

The rapid development of global smart devices has driven the development of edge computing. Edge computing refers to providing near-end services in the network edge near the user by adopting an open platform integrating network, computing, storage and application core capabilities. Edge computation sinks some critical services to the access network edge to reduce bandwidth and latency loss due to network transmission and multi-stage forwarding.

In the scene of edge calculation, the stability, reliability and the like of the edge nodes in the service processing process are greatly influenced by the network quality. Therefore, a need exists for a way to efficiently detect edge network quality.

Disclosure of Invention

In view of the foregoing, the present application provides a method, apparatus, device and computer readable storage medium for detecting quality of an edge network, so as to achieve efficient detection of quality of the edge network.

The application provides the following scheme:

according to a first aspect, there is provided a method of detecting edge network quality, the edge network serving edge nodes, the edge nodes comprising a first edge node and a second edge node; the method comprises the following steps:

acquiring and recording a first detection result generated by the first edge node sending a quality detection message to the second edge node according to a preset first frequency, wherein the first detection result comprises at least one of packet loss information, time-to-live TTL information and Round Trip Time (RTT);

Determining a sliding window by using the first detection result, wherein the sliding window comprises the first detection result and the first detection result which is n times before the first detection result, and n is a preset positive integer;

and analyzing the first detection result contained in the sliding window to determine whether network quality abnormality occurs.

According to a second aspect, there is provided a method of detecting network quality, comprising:

acquiring and recording a first detection result generated by a first edge node sending a quality detection message to a second edge node according to a preset first frequency, wherein the first detection result comprises at least one of packet loss information, time-to-live TTL information and Round Trip Time (RTT);

determining a sliding window by using the first detection result, wherein the sliding window comprises the latest first detection result and the first detection results which are continuously performed n times before the latest first detection result, and n is a preset positive integer;

According to one implementable manner of an embodiment, the network serves edge nodes including the first edge node and the second edge node.

According to an implementation manner of the embodiment, the obtaining and recording the first detection result generated by the first edge node sending the quality detection message to the second edge node according to the preset first frequency includes: acquiring and recording each first detection result generated by the first edge node sending a quality detection message to the second edge node according to a preset first frequency;

the determining the sliding window using the first detection result includes: and determining a sliding window by using the latest first detection result, wherein the sliding window comprises the latest first detection result and the first detection results which are n times before the latest first detection result.

According to one implementation manner of the embodiment, analyzing the first detection result included in the sliding window, and determining whether the network quality abnormality occurs includes:

and determining whether network quality abnormality occurs according to at least one of packet loss conditions occurring in the sliding window, comparison of the statistical value of RTT in the sliding window and the historical statistical value of RTT, and comparison of the statistical value of TTL in the sliding window and the historical route detection data.

According to one implementation in an embodiment, the method further includes:

Acquiring and recording a second detection result generated by the first edge node for carrying out route detection on the second edge node according to a preset second frequency, wherein the second detection result comprises route information between the first edge node and the second edge node;

and generating the historical route detection data by using the second detection result, wherein the first frequency is higher than the second frequency.

According to one implementation in an embodiment, the method further includes:

if the network quality abnormality occurs due to the change of the statistical value comparison history route detection data of the TTL in the sliding window, triggering the first edge node to carry out route detection on the second edge node, and recording a second detection result generated by the detection;

if no network quality abnormality occurs, the TTL information included in the latest first detection result is recorded in the historical route detection data.

According to one implementation manner of the embodiment, after the recording of the second detection result generated by the current detection, the method further includes:

and comparing a second detection result generated by the detection with the historical route detection data to locate the network abnormal position.

According to one implementation manner in the embodiment, the message includes: network layer messages and/or transport layer messages.

According to one implementation manner of the embodiment, if the packet includes a transport layer packet, the data stream identifier of the transport layer packet sent by the first edge node each time is sequentially selected within a preset identifier range.

According to one implementation manner in the embodiment, the sequentially selecting, within a preset identifier range, the data flow identifier of the transport layer packet sent each time includes:

the source port number of each transmitted transport layer message is sequentially selected in a preset port value range, and the destination port number adopts a fixed value.

According to one implementation in an embodiment, the method further includes:

and if the network quality abnormality is determined to occur, carrying out packet analysis on the first detection result based on the data flow identifier, and determining the abnormal data flow identifier.

According to a third aspect, there is provided an apparatus for detecting edge network quality, comprising:

the first detection unit is configured to acquire and record a first detection result generated by a first edge node sending a quality detection message to a second edge node according to a preset first frequency, wherein the first detection result comprises at least one of packet loss information, time-to-live TTL information and round trip time RTT;

A mass analysis unit configured to determine a sliding window using the first detection result, the sliding window including the first detection result and a first detection result that is n consecutive times before the first detection result, the n being a preset positive integer; and analyzing the first detection result contained in the sliding window to determine whether network quality abnormality occurs.

According to a fourth aspect, there is provided a computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of the method of any of the first and second aspects described above.

According to a fifth aspect, there is provided an electronic device characterized by comprising:

one or more processors; and

a memory associated with the one or more processors, the memory for storing program instructions that, when read for execution by the one or more processors, perform the steps of the method of any one of the first and second aspects above.

According to the specific embodiment provided by the application, the application can have the following advantages:

1) According to the application, a mode of combining continuous detection with sliding window analysis is adopted, network anomaly analysis can be carried out by utilizing the detection result in the sliding window generated by the detection at each time, the method is more efficient, and short-time jitter of a network can be effectively perceived.

2) Network quality can be more sharply and accurately detected by analyzing network quality through three indexes of packet loss information, TTL and RTT.

3) The method combines high-frequency quality detection and low-frequency route detection, and effectively precipitates historical route data while ensuring network quality detection effect, thereby further improving network quality detection effect.

4) The quality detection and the route detection can be realized by adopting network layer messages, so that the friendly forwarding of the network device to the network layer messages is effectively utilized, and the basic realization of network quality detection is ensured. The quality detection and the route detection can also be realized by adopting a transmission layer message, so that the multipath transmission characteristics of the transmission layer message aiming at different data flow identifications are effectively utilized, and the coverage condition of the network quality detection on multipath routes is improved. The quality detection and the route detection can also be realized by adopting the network layer message and the transmission layer message at the same time, thereby taking the advantages of both aspects into consideration.

Of course, it is not necessary for any one product to practice the application to achieve all of the advantages set forth above at the same time.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 illustrates an exemplary system architecture in which embodiments of the present application may be applied;

FIG. 2 shows a main method flow for detecting network quality provided by an embodiment of the present application;

FIG. 3 shows a flow chart of a method for detecting network quality according to another embodiment of the present application;

FIG. 4 is a flow chart of a method for detecting network quality according to a preferred embodiment of the present application;

FIG. 5 shows a schematic block diagram of an apparatus for detecting network quality according to one embodiment;

fig. 6 shows an architecture of an electronic device according to an embodiment of the present application.

Detailed Description

The following description of the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present application, but not all embodiments. All other embodiments, which are derived by a person skilled in the art based on the embodiments of the application, fall within the scope of protection of the application.

The terminology used in the embodiments of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

It should be understood that the term "and/or" as used herein is merely one relationship describing the association of the associated objects, meaning that there may be three relationships, e.g., a and/or B, may represent: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front and rear associated objects are an "or" relationship.

Depending on the context, the word "if" as used herein may be interpreted as "at … …" or "at … …" or "in response to a determination" or "in response to detection". Similarly, the phrase "if determined" or "if detected (stated condition or event)" may be interpreted as "when determined" or "in response to determination" or "when detected (stated condition or event)" or "in response to detection (stated condition or event), depending on the context.

FIG. 1 illustrates an exemplary system architecture to which embodiments of the application may be applied. As shown in fig. 1, the system may comprise a monitoring system and a plurality of edge nodes, of which only two are schematically shown in the system: a first edge node and a second edge node.

The first edge node and the second edge node respectively process the edge service of the area where the first edge node and the second edge node are located. The edge node refers to a service platform constructed near the network edge side of the user, provides storage, calculation, network and other resources, and sinks part of key service application to the access network edge so as to reduce the width and delay loss caused by network transmission and multistage forwarding.

The first and second edge nodes generally must be connected to a network, either by wire or wirelessly, through which communications take place.

Typically, an edge node is disposed in a machine room, and an edge node includes devices in multiple forms, such as an edge server and an edge gateway, in the machine room. The edge server, edge gateway, etc. in the machine room serve as an edge node (typically configured as a virtual machine) of the same operator to provide edge computing services for the area where the edge server, edge gateway, etc. are located.

The monitoring system is responsible for detecting the network quality between the edge nodes, for example, detecting the network quality between the first edge node and the second edge node, and may further execute a corresponding control policy according to the detection result. For example, when the quality of a network link is abnormal, the data flow of the network link may be switched to other network links. The method for detecting the network quality designed in the embodiment of the application is executed by a device for detecting the network quality, which is arranged in a monitoring system. The monitoring system can be a single server or a server cluster consisting of a plurality of servers, and the servers can be cloud servers, also called cloud computing servers or cloud hosts, are host products in a cloud computing service system, so as to solve the defects of high management difficulty and weak service expansibility in the traditional physical host and Virtual Private Server (VPs) service.

In the embodiment of the application, the monitoring system can detect the network quality between the first edge node and the second edge node by acquiring and recording the detection message sent between the first edge node and the second edge node. The method provided by the present application is described below with reference to examples.

Fig. 2 shows a main method flow for detecting network quality, which is executed by the monitoring system shown in fig. 1. As shown in fig. 2, the method may include the steps of:

step 201: acquiring and recording a first detection result generated by the first edge node sending a quality detection message to the second edge node according to a preset first frequency; the first probe result includes at least one of packet loss information, TTL (time to live) information, and RTT (Round-trip time).

Step 202: and determining a sliding window by using the first detection result, wherein the sliding window comprises the first detection result and the first detection results which are n times before the first detection result, and n is a preset positive integer.

Step 203: and analyzing the first detection result contained in the sliding window to determine whether network quality abnormality occurs.

As can be seen from the main method flow shown in fig. 2, one of the main concepts of the embodiment of the present application is to use a manner of continuous detection combined with sliding window analysis, and each detection can use the detection result in the sliding window generated by the current detection to perform network anomaly analysis, which is more efficient and can effectively sense the short-time jitter occurring in the network.

The above steps are described in detail below. It should be noted that the "first", "second", and the like in the embodiments of the present application are not limited in size, order, and number, and are merely used to distinguish between the two edge nodes by name, for example, "first edge node" and "second edge node", and further for example, "first frequency" and "second frequency" are used to distinguish between the two frequencies, and further for example, "first detection result" and "second detection result" are used to distinguish between the two detection results, and so on.

First, the above-mentioned step 201, namely "obtaining and recording the first detection result generated by the first edge node sending the quality detection message to the second edge node according to the preset first frequency" will be described in detail with reference to the embodiment.

In the embodiment of the application, the network probes can be deployed in each edge node in advance, and the network probes transmit the detection message to acquire the detection result and transmit the detection result to the monitoring system. The network probe may be an application located at the edge node or may be a functional unit such as a plug-in or software development kit (SoftwareDevelopmentKit, SDK) located in the application of the edge node.

The monitoring system may determine an opposite edge node of the first edge node according to the network deployment condition, and then send information of the opposite edge node to the first edge node, so that a network probe of the first edge node sends a detection message (the detection message may be a quality detection message involved in the step, and may further include a routing detection message involved in the subsequent embodiment) to the opposite edge node. Wherein the opposite edge node of the first edge node may be one or more. In the embodiment of the application, each opposite end edge node can be used as a second edge node to respectively execute the network quality detection of the embodiment of the application.

In this step, the network probe in the first edge node sends a quality detection message to the second edge node according to a preset first frequency, and generates a first detection result of each time. The first frequency may be a higher frequency, for example, sending the quality detection message every 100 ms.

The quality probe message may be a network layer probe message, such as an ICMP (InternetControlMessage Protocol ) probe message. Or may be a transport layer probe, such as a TCP (transmission control protocol) probe, a UDP (user datagram protocol) probe. It may also be that both network layer probe messages and transport layer probe messages are sent, for example ICMP probe messages and TCP probe messages are sent. These specific cases will be described in detail in the following examples.

The initial value of the TTL field may be preset to a larger value in the quality detection message, so as to ensure that the quality detection message can be sent from the first edge node to the second edge node. The initial value can be flexibly set according to the network scale, and an empirical value, an experimental value and the like can be adopted. For example, the initial value of the TTL field is set to 64. Devices in the network, after receiving a quality detection message, such as ICMP, TCP, etc., will decrement the TTL field contained therein by, for example, 1. Since in the embodiment of the application, the initial value of the TTL field in the quality detection message is set to a larger value 64, and the normal network size is not more than 30 hops, the quality detection message can be ensured to be transmitted from the first edge node to the second edge node. The source IP address of the quality detection message is the IP address of the first edge node, and the destination IP address is the IP address of the second edge node.

And the second edge node returns a response message aiming at the quality detection message after receiving the quality detection message. The initial value of the TTL field in the response message is set to 64 as well, and the response message will normally return along the original path of the quality detection message, so if the first edge node can receive the response message, it indicates that no packet loss occurs, and the RTT can be determined by using the time of sending the quality detection message and the time of receiving the response message, and the TTL information obtained by this detection is determined according to the value of the TTL field in the response message. For example, if the TTL field has a value of 30 when the first edge node receives the response message, it indicates that the network path between the first edge node and the second edge node has traveled 23 hops.

If the first edge node does not receive the response message within the set time, the packet loss is indicated, and the packet loss information can be recorded or the route is considered unreachable. It can be seen that the first detection result, which can be obtained by sending the quality detection message between the first edge node and the second edge node, includes at least one of packet loss information, TTL information, and RTT information.

The above step 202, i.e. "determining the sliding window using the first detection result", is described in detail below in connection with an embodiment.

In this step, the length of the sliding window may be determined according to the sensitivity required for network quality detection, for example, the sensitivity of network quality detection needs to reach the second level, and the first frequency may be set to be 100ms, and the length of the sliding window may be set to be 10s. Thus, 100 detection results are contained in one sliding window.

As an achievable way, the sliding window may be determined in this step using the latest first detection result. For example, the first edge node may use the first detection result obtained by the last quality detection message and the previous 99 detection results thereof to form the latest sliding window. That is, the sliding window is fixed in length, and the sliding window slides backwards for 100ms after each detection, so that the sliding window always contains 100 first detection results.

The step 203, that is, "analyzing the first detection result included in the sliding window to determine whether the network quality abnormality occurs", will be described in detail in connection with the embodiment.

In this step, at least one of packet loss information, RTT information, and TTL information in each first detection result in the sliding window may be used to perform analysis, so as to obtain whether a network quality abnormality occurs between the first edge node and the second edge node.

As one of the realizable modes, whether the network quality abnormality occurs is determined according to the packet loss condition occurring in the sliding window. For example, the number of packet losses occurring in the sliding window is counted, and if the number of packet losses is greater than or equal to a preset packet loss threshold, the occurrence of network quality abnormality is considered.

As one of the realizable modes, the statistical value of RTT in the sliding window is compared with the historical statistical value of RTT, so as to determine whether the network quality is abnormal. The RTT history statistics may be an RTT statistics within a first duration preset before the current sliding window. The statistical value of RTT may use the mean, variance, etc. of RTT. For example, the average value of RTTs in the sliding window may be counted, and then the counted average value of RTTs is compared with the average value of RTTs in 120s before the sliding window, and if the average value of RTTs in the sliding window is higher than the average value of RTTs in 120s before the current sliding window by more than a preset RRT change threshold, the network quality is considered to be abnormal.

As one of the realizable modes, the statistical value of TTL in the sliding window is compared with the historical route detection data to determine whether network quality abnormality occurs. The historical route detection data may be route detection data within a second time period preset before the current sliding window, where the route detection data includes TTL values of time points (corresponding to the first frequency) and may further include path information of a plurality of time points (corresponding to the second frequency involved in the subsequent embodiment). The statistical value of TTL can adopt mean value, variance and the like of TTL. For example, the average value of the TTL in the sliding window may be counted, and then the counted average value of the TTL is compared with the average value of the TTL in 1 hour before the sliding window, and if the average value of the TTL in the sliding window is higher than the average value of the TTL in 1 hour before the current sliding window by more than a preset TTL change threshold, the network quality is considered to be abnormal. It can be seen that in the present application, TTL information is taken as another important analysis index in addition to the packet loss information and RTT that are commonly used. Since the edge nodes are typically deployed in the operator's premises, the TTL between the edge nodes is normally in a steady state. The reason for the change of the TTL is a change, configuration change or abnormality of the intermediate routing device, which all have a certain influence on the network quality.

The packet loss threshold, RTT change threshold, TTL change threshold, etc. may be set according to the sensitivity degree to the network quality change, and may be an empirical value or an experimental value.

In addition, besides the three achievable modes, at least two factors of packet loss condition, TTL and RTT can be combined to judge whether network quality abnormality occurs. For example, a certain weight is given to the three factors, and the conditions of the three factors are weighted to obtain the judgment of whether the network quality abnormality occurs. For another example, if both factors determine that the network quality is abnormal, the network quality is finally determined. Etc.

The historical route detection data may be collected based on quality detection messages of the history, for example, TTL values obtained by statistics of sliding windows corresponding to previous non-network abnormal conditions.

However, as a preferred embodiment, the historical route probe data may be maintained by another low frequency route probe mechanism. In this case, as shown in fig. 3, the following steps are additionally performed while the steps shown in fig. 2 are performed:

step 301: obtaining and recording a second detection result generated by the first edge node for carrying out route detection on the second edge node according to a preset second frequency, wherein the second detection result comprises route information between the first edge node and the second edge node, and the first frequency is higher than the second frequency.

The second frequency used in this step may be a lower frequency, such as route probing every 10 minutes. The route probe is also called as route tracking (Tracert), and is actually that the first edge node sends a route probe packet starting from the TTL field with a value of 1, where the source IP address of the route probe packet is the IP address of the first edge node and the destination IP address is the IP address of the second edge node. Each device in the network will decrease the TTL field value by 1 after receiving the route detection message, if the TTL field value is 0, it will reply the message indicating overtime. The first edge node sends the route detection message again after receiving the message indicating that the time has expired and increments the value of the TTL field in the route detection message by, for example, 1. And repeating the steps until a response message returned by the second edge node is received or the TTL field reaches the maximum value. Through the route detection process, the first edge node can learn the TTL between the first edge node and the second edge node. And by recording all the device information of the message which returns the indication overtime, the first edge node can know the path between the second edge nodes. If the value of the TTL field is incremented to a maximum value and no response message is received, the route between the first edge node and the second edge node can be considered unreachable. In view of the fact that route probing is a currently existing technology, this embodiment only makes reasonable use of it, and therefore only a simple description thereof will be made.

The routing information between the first edge node and the second edge node can be obtained once every 10 minutes, for example. The routing information may include a TTL value and may also include path information between the first edge node and the second edge node.

The route probe message may be a network layer probe message, for example, an ICMP probe message. Or may be a transport layer probe message, such as a TCP probe message, a UDP probe message. It may also be that both network layer probe messages and transport layer probe messages are sent, for example ICMP probe messages and TCP probe messages are sent. These specific cases will be described in detail in the following examples.

Step 302: and generating historical route detection data by using the second detection result.

The time information of the route probe and the obtained second probe result may be recorded in the history route probe data.

Since the statistical value of the TTL is compared with the statistical value of the TTL of the second duration preset before the current sliding window when the quality detection is performed each time, in this embodiment, only the second detection result in the length obtained by adding the second duration to the duration of the sliding window may be reserved.

In this case, RTT information may be acquired during the route probe, or the acquired RTT information may be recorded in the historical RTT data.

In addition, after step 203, if it is determined that the network is abnormal, the monitoring system may perform network abnormality pre-warning on the end-to-end link between the first edge node and the second edge node.

Further, if the statistical value of the TTL changes to cause network quality anomaly, step 305 may be performed as shown in fig. 3; if no network anomaly has occurred, step 304 may be performed.

Step 304: and recording the TTL value in the latest first detection result in the historical route detection data.

In step 305, a route detection is triggered between the first edge node and the second edge node, and a second detection result generated by the detection is recorded.

The process of route detection may be referred to the relevant description in step 301, and will not be described herein. After the route detection, the path information between the first edge node and the second edge node can be obtained. Accordingly, step 306 may be further performed, i.e. the second detection result generated by the current detection is compared with the historical route detection data, so as to locate the network abnormal position.

The historical route detection data can be understood as path information when the network between the first edge node and the second edge node is normal, when the network abnormality is detected and the abnormality is caused by TTL change, the second detection result obtained by the route detection triggered under the condition of the network abnormality can be compared with the historical route detection data to determine which node or nodes are changed, and the changed nodes can be regarded as abnormal positions of the network.

After the monitoring system locates the network abnormal position, the monitoring system can output the network abnormal position at the same time of early warning. For example, displaying the network anomaly location on the alert interface.

The above method will be described in detail below by taking a network layer message ICMP message as an example. As shown in fig. 4, mainly comprises the following steps:

in step 4001, the monitoring system obtains and records a high frequency ICMP quality probe result of the first edge node to the second edge node, for example, each first probe result generated by sending ICMP quality probe messages to the second edge node at a time interval of 100 ms.

The ICMP quality detection message is actually an ICMP message with a TTL initial value specified as a preset larger value, for example, a TTL field initial value is 60. After each device on the path between the first edge node and the second edge node receives the ICMP message, the value of the TTL field is reduced by 1 and forwarded to the next-hop device until the next-hop device is forwarded to the second edge node. And after receiving the ICMP message, the second edge node returns a response message. The first edge node determines a first detection result according to whether the response message is received within a set time length, the time of receiving the response message, the value of a TTL field in the received response message and other information. The first detection result includes whether packet loss, RTT information, and TTL information.

That is, the monitoring system acquires and records a first detection result every 100 ms. Step 4002 is executed each time a first detection result is obtained and recorded, and the sliding window is determined by using the latest first detection result of the ICMP quality detection message.

In this embodiment, taking 10s as an example, one sliding window includes 100 first detection results. Then the latest first detection result and the 99 first detection results before the latest first detection result are determined in the step. Then, step 4003 is executed to analyze packet loss information, RTT information, and TTL information of the first detection result included in the sliding window, and determine whether a network quality abnormality occurs.

For a specific analysis, see the description of step 203 in the embodiment shown in fig. 2, and only one of them is taken here as an example:

judging whether the packet loss times in the sliding window exceeds a preset packet loss threshold value, for example, 2 times, and if so, considering that the network quality between the first edge node and the second edge node is abnormal.

Judging whether the degree of the average value of RTT in the sliding window is higher than the average value of RTT in 120s before the sliding window exceeds a preset RTT change threshold value, and if so, considering that the network quality between the first edge node and the second edge node is abnormal.

And judging whether the average value of TTL in the sliding window is changed compared with the average value of TTL in 1 hour before the sliding window in the first historical route detection data, and if so, considering that the network quality between the first edge node and the second edge node is abnormal.

While executing steps 4001 to 4003, the first edge node performs low-frequency ICMP route detection on the second edge node, that is, performs ICMP route detection on the second edge node once every 10 minutes, so in step 4004, the monitoring system acquires and records each second detection result generated by ICMP route detection on the second edge node by the first edge node every 10 minutes.

When ICMP route detection is carried out, the first edge node sends an ICMP message starting from the TTL field with the value of 1, the source IP address of the ICMP message is the IP address of the first edge node, and the destination IP address is the IP address of the second edge node. Each device in the network will subtract 1 from the TTL field value in the ICMP message after receiving the ICMP message, and if the TTL field value is 0, reply the message indicating that the time has expired. The first edge node receives the message indicating that the time has expired, then sends the ICMP message again and increments the TTL field value in the ICMP message by, for example, 1. And repeating the steps until a response message returned by the second edge node is received or TTL reaches the maximum value. Through the ICMP route detection process, the first edge node can acquire TTL between the first edge node and the second edge node. And by recording all the device information of the message which returns the indication overtime, the first edge node can know the path between the second edge nodes. If the TTL field value is incremented to a maximum value and no response message is received, the route between the first edge node and the second edge node may be considered unreachable.

In step 4005, the monitoring system performs a first historical route probe data precipitation, for example, records a second probe result generated by ICMP route probe in the first historical route probe data (referred to herein as the first historical route probe data in order to distinguish from the historical route probe data generated by TCP route probe in the subsequent flow).

After the above step 4003, step 4006 is continuously executed: judging whether network abnormality occurs, if not, executing step 4005 to precipitate first historical route detection data, namely recording TTL values in the latest first detection results in the first historical route detection data; if so, step 4007 is performed.

Step 4007: triggering the first edge node and the second edge node to carry out ICMP route detection, and recording a second detection result generated by the ICMP route detection.

In general, devices in the network are more friendly to ICMP messages, and it is less likely that devices discard ICMP messages. But for ICMP messages with fixed source and destination IP addresses, the IP network will typically forward them along a fixed path. This feature may result in quality detection not being able to cover all paths when there is a multipath route between the first edge node and the second edge node. Therefore, another independent branch performed simultaneously with the above steps 4001 to 4007 is the following:

In step 4011, the monitoring system obtains and records a high frequency TCP quality probe result of the first edge node to the second edge node, for example, each first probe result generated by sending a TCP quality probe message to the second edge node at a time interval of 100 ms.

Wherein the TCP quality detection message is actually a TCP message with a TTL initial value specified as a preset larger value, for example, a TTL field initial value of 60. After each device on the path between the first edge node and the second edge node receives the TCP message, the value of the TTL field is reduced by 1 and forwarded to the next-hop device until the next-hop device is forwarded to the second edge node. And after receiving the TCP message, the second edge node returns a response message. The first edge node determines a first detection result according to whether the response message is received within a set time length, the time of receiving the response message, the value of a TTL field in the received response message and other information. The first detection result includes whether packet loss, RTT information, and TTL information.

The load balancing policy employed by most routers in the network is connection-based load balancing. The connection is typically identified based on data flow identification information, i.e. the selection of the forwarding path is made based on the data flow identification of the message. If multi-path routing exists between the first edge node and the second edge node, multi-path transmission of the quality detection message can be achieved by sequentially selecting data flow identifiers carried by the message within a preset identifier range.

Wherein the data flow identification information can be generally identified by information of a source address, a destination address, a source port, a destination port, etc. If multi-path routing exists between the first edge node and the second edge node, multi-path transmission of the quality detection message can be realized by converting the source port address in a transmission layer message such as TCP. As one of the realizable modes, the source port numbers of the TCP quality detection messages sent by the first edge node each time are sequentially selected in a preset port value range, and the destination port numbers adopt fixed values.

For example, after an interval of 100ms, the first edge node sends a batch of TCP quality detection messages, the source IP address and the destination IP address of the batch of TCP quality detection messages are respectively the IP address of the first edge node and the IP address of the second edge node, the destination port numbers are both 80 (the operator network is relatively friendly to the TCP messages with destination ports of 80), and the source port numbers are increased from 50000, and the increasing range is 128. That is, 128 TCP quality detection messages are in a batch, and the source port numbers of each message are different.

Theoretically, the larger the range of port values used by the source port numbers of the TCP quality probe messages, the better the coverage for each path route in the middle, but the cost of the probe itself increases linearly. Therefore, a balance needs to be taken between the two. The specific port value range may be set according to experimental or empirical conditions.

Step 4012: and determining the sliding window by using the latest first detection result of the TCP quality detection message.

In this embodiment, the sliding window may take a length of the order of one minute, for example 1 minute. The first detection result within the last 1 minute is determined.

Step 4013: and analyzing the packet loss information, the RTT information and the TTL information of the first detection result contained in the sliding window to determine whether network quality abnormality occurs.

When the network quality anomaly analysis is performed in this step, the packet analysis may be performed on the first detection result according to the data flow identifier, so as to determine the data flow identifier where the anomaly occurs.

The specific analysis mode is basically the same as the analysis mode of the first detection result of the ICMP quality detection message, and will not be described herein.

However, for TCP, since multipath routes are distinguished and analyzed separately, the utilization of RTT information in the network quality anomaly analysis process can be weakened, and the analysis is performed mainly by using packet loss information and TTL information.

While executing steps 4011-4013, the first edge node performs low-frequency TCP route detection on the second edge node, that is, performs TCP route detection on the second edge node every 10 minutes, so in step 4014, the monitoring system acquires and records each second detection result generated by the first edge node performing TCP route detection on the second edge node every 10 minutes.

Similarly, in this step, the first edge node may sequentially select the data flow identifier carried by the packet within the preset identifier range to implement multipath transmission of the TCP route detection packet.

Wherein the data flow identification information can be generally identified by information of a source address, a destination address, a source port, a destination port, etc. As one of the realizable modes, the source port numbers of the TCP route detection messages sent by the first edge node each time are sequentially selected in a preset port value range, and the destination port numbers adopt fixed values.

For example, after an interval of 10 minutes, the first edge node sends a batch of TCP route probe messages, the source IP address and the destination IP address of the batch of TCP route probe messages are the IP address of the first edge node and the IP address of the second edge node, respectively, the destination port numbers are both 80 (the operator network is relatively friendly to the TCP message with the destination port of 80), and the source port number is incremented from 50000, and the increment range is 128. That is, 128 TCP route detection messages are in a batch, and the source port numbers of each message are different.

For each source port number, the transmitted TCP route probe message starts with a TTL field value of 1. Each device in the network will subtract 1 from the TTL field value after receiving the TCP routing probe message, if the TCP routing probe message with the TTL field value of 0 is received, the device will reply the message indicating that the time has expired. The first edge node receives the message indicating that the time-out has elapsed, and then sends the TCP routing probe again and increments the TTL field value in the TCP routing probe by, for example, 1. And repeating the steps until a response message returned by the second edge node is received or TTL reaches the maximum value. Through the TCP route detection process, the first edge node can know the TTL between the first edge node and the second edge node. And by recording all the device information of the message which returns the indication overtime, the first edge node can know the path between the second edge nodes. If the TTL field value is incremented to a maximum value and no response message is received, the route between the first edge node and the second edge node may be considered unreachable.

Step 4015: the monitoring system performs precipitation of second historical route detection data, and records a second detection result generated by TCP route detection in the second historical route detection data.

In this step, TTL, routing information, etc. may be recorded separately for each data flow identification (i.e., distinguished by source port number) to the second historical route probe data.

In addition, RTT data may be recorded in the historical RTT data for each data flow identifier.

After the above step 4013, step 4016 is continuously performed: judging whether network abnormality occurs, if so, executing step 4017; otherwise, step 4015 may be executed to perform the depositing of the second historical route detection data, i.e. record the TTL value in the latest second detection result in the second historical route detection data.

Step 4017: and triggering TCP route detection (carrying the abnormal data flow identifier, namely adopting a corresponding source port number) between the first edge node and the second edge node aiming at the abnormal data flow identifier, and recording a second detection result generated by the TCP route detection.

Whether the two branches adopting the ICMP and the TCP are respectively and independently executed or not gives consideration to the advantages of the ICMP and the TCP. Namely, the equipment in the network is friendly to ICMP messages, and the situation of discarding the messages is not easy to occur; while TCP may discard packets, it is able to probe for multipath routing for different data flow identifications. Therefore, no matter whether the network quality abnormality is detected through ICMP or TCP, the network quality abnormality can be considered to occur, and the detection accuracy and the comprehensiveness are improved. In step 4008, the network anomaly location may be located and early warned by comprehensively using the second detection result generated by the route detection in step 4007 and step 4017 under the condition of anomaly.

While the above description has been made taking ICMP quality detection and TCP quality detection as an example in the embodiment shown in fig. 4, only one of ICMP quality detection and TCP quality detection may be employed in the embodiment of the present application, that is, only the branch on ICMP shown in fig. 4 is performed or only the branch on TCP shown in fig. 4 is performed.

The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

According to an embodiment of another aspect, an apparatus for detecting network quality is provided. Fig. 5 shows a schematic block diagram of an apparatus for detecting network quality, which is arranged in the monitoring system in the architecture shown in fig. 1, according to one embodiment. As shown in fig. 5, the apparatus 500 includes: the first detection unit 501 and the mass analysis unit 502 may further include a second detection unit 503 and an abnormality processing unit 504. Wherein the main functions of each constituent unit are as follows:

The first detection unit 501 is configured to obtain and record a first detection result generated by the first edge node sending the quality detection message to the second edge node according to a preset first frequency, where the first detection result includes at least one of packet loss information, time-to-live TTL information, and round trip time RTT.

As one of the realizable ways, the first detection unit 501 may acquire and record each first detection result generated by the first edge node sending the quality detection message to the second edge node according to the preset first frequency.

A mass analysis unit 502 configured to determine a sliding window using the first detection result, the sliding window including the first detection result and the first detection result n consecutive times before the first detection result, n being a preset positive integer; and analyzing the first detection result contained in the sliding window to determine whether network quality abnormality occurs.

As one of the realizations, the mass analysis unit 502 may determine a sliding window using the latest first detection result, the sliding window including the latest first detection result and the first detection results n consecutive times before it.

The quality analysis unit 502 may be specifically configured to determine whether a network quality abnormality occurs according to at least one of a packet loss condition occurring in the sliding window, a condition in which a statistical value of RTT in the sliding window is compared with an RTT history statistical value, and a condition in which a statistical value of TTL in the sliding window is compared with history route probe data.

A second detecting unit 503, configured to obtain and record a second detection result generated by the first edge node performing route detection on the second edge node according to a preset second frequency, for example, a second detection result of each time, where the second detection result includes the first edge node and route information between the second edge nodes; and generating the historical route detection data by using a second detection result, wherein the first frequency is higher than the second frequency.

An anomaly processing unit 504 configured to trigger the first edge node to perform route detection on the second edge node if the network quality anomaly occurs due to the change of the historical route detection data compared with the statistical value of the TTL in the sliding window, and record a second detection result generated by the detection; if no network quality abnormality occurs, the TTL information included in the latest first detection result is recorded in the historical route detection data.

Furthermore, after recording the second detection result generated by the current detection, the anomaly processing unit 504 may also compare the second detection result generated by the current detection with the historical route detection data to locate the network anomaly location.

The message may include a network layer message and/or a transport layer message. The network layer message may be an ICMP message, and the transport layer message may be a TCP or UDP message.

If the message includes a transport layer message, the data stream identifier of the transport layer message sent by the first edge node each time may be sequentially selected within a preset identifier range. For example, the source port number of the transport layer message sent each time is sequentially selected in a preset port value range, and the destination port number adopts a fixed value.

In this case, if it is determined that the network quality abnormality occurs, the quality analysis unit 502 may perform packet analysis on the first detection result based on the data flow identification, and determine the data flow identification where the abnormality occurs.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for a system or system embodiment, since it is substantially similar to a method embodiment, the description is relatively simple, with reference to the description of the method embodiment being made in part. The systems and system embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.

It should be noted that, in the embodiment of the present application, the use of user data may be involved, and in practical application, the user specific personal data may be used in the solution described herein within the scope allowed by the applicable legal regulations in the country under the condition of meeting the applicable legal regulations in the country (for example, the user explicitly agrees to the user to notify practically, etc.).

In addition, the embodiment of the application also provides a computer readable storage medium, on which a computer program is stored, which when being executed by a processor, implements the steps of the method of any one of the previous method embodiments.

And an electronic device comprising:

one or more processors; and

a memory associated with the one or more processors for storing program instructions that, when read for execution by the one or more processors, perform the steps of the method of any of the preceding method embodiments.

Fig. 6 illustrates an architecture of an electronic device, which may include a processor 610, a video display adapter 611, a disk drive 612, an input/output interface 613, a network interface 614, and a memory 620, to name a few. The processor 610, video display adapter 611, disk drive 612, input/output interface 613, network interface 614, and memory 620 may be communicatively coupled via a communications bus 630.

The processor 610 may be implemented by a general-purpose CPU, a microprocessor, an Application-specific integrated circuit (Application SpecificIntegratedCircuit, ASIC), or one or more integrated circuits, etc. for executing related programs to implement the technical solution provided by the present application.

The memory 620 may be implemented in the form of ROM (read only memory), RAM (RandomAccess Memory ), a static storage device, a dynamic storage device, or the like. The memory 620 may store an operating system 621 for controlling the operation of the electronic device 600, and a Basic Input Output System (BIOS) 622 for controlling the low-level operation of the electronic device 600. In addition, a web browser 623, a data storage management system 624, a device 625 for detecting network quality, and the like may also be stored. The device 625 for detecting network quality may be an application program for implementing the operations of the foregoing steps in the embodiment of the present application. In general, when the technical solution provided by the present application is implemented by software or firmware, relevant program codes are stored in the memory 620 and invoked by the processor 610 to be executed.

The input/output interface 613 is used to connect with an input/output module to realize information input and output. The input/output module may be configured as a component in a device (not shown) or may be external to the device to provide corresponding functionality. Wherein the input devices may include a keyboard, mouse, touch screen, microphone, various types of sensors, etc., and the output devices may include a display, speaker, vibrator, indicator lights, etc.

The network interface 614 is used to connect communication modules (not shown) to enable communication interactions of the device with other devices. The communication module may implement communication through a wired manner (such as USB, network cable, etc.), or may implement communication through a wireless manner (such as mobile network, WIFI, bluetooth, etc.).

Bus 630 includes a path to transfer information between components of the device (e.g., processor 610, video display adapter 611, disk drive 612, input/output interface 613, network interface 614, and memory 620).

It should be noted that although the above devices illustrate only the processor 610, video display adapter 611, disk drive 612, input/output interface 613, network interface 614, memory 620, bus 630, etc., the device may include other components necessary to achieve proper operation in an implementation. Furthermore, it will be appreciated by those skilled in the art that the apparatus may include only the components necessary to implement the present application, and not all of the components shown in the drawings.

From the above description of embodiments, it will be apparent to those skilled in the art that the present application may be implemented in software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the embodiments or some parts of the embodiments of the present application.

While the foregoing has been presented in a detail description of the application, the principles and embodiments of the application have been described herein with reference to specific examples, the above examples being provided only to assist in understanding the method of the application and its core ideas; also, it is within the scope of the present application to be modified by those of ordinary skill in the art in light of the present teachings. In view of the foregoing, this description should not be construed as limiting the application.

Claims

1. A method of detecting edge network quality, the edge network serving edge nodes, the edge nodes comprising a first edge node and a second edge node; the method comprises the following steps:

Analyzing a first detection result contained in the sliding window to determine whether network quality abnormality occurs;

if the change of the statistical value of TTL in the sliding window compared with the historical route detection data causes network quality abnormality, triggering the first edge node to carry out route detection on the second edge node, and comparing a second detection result generated by the detection with the historical route detection data to locate the network abnormality position;

2. A method of detecting network quality, comprising:

3. The method of claim 2, wherein the network serves edge nodes, the edge nodes comprising the first edge node and the second edge node.

4. The method of claim 2, wherein the obtaining and recording the first detection result generated by the first edge node sending the quality detection message to the second edge node according to the preset first frequency includes: acquiring and recording each first detection result generated by the first edge node sending a quality detection message to the second edge node according to a preset first frequency;

determining a sliding window using the first detection result includes: and determining a sliding window by using the latest first detection result, wherein the sliding window comprises the latest first detection result and the first detection results which are n times before the latest first detection result.

5. The method of claim 2, wherein analyzing the first probe result contained in the sliding window to determine whether a network quality anomaly has occurred comprises:

6. The method of claim 2, the method further comprising:

7. The method according to any one of claims 2 to 6, wherein the message comprises: network layer messages and/or transport layer messages.

8. The method of claim 7, wherein if the message includes a transport layer message, the data flow identifier of the transport layer message sent by the first edge node each time is sequentially selected within a preset identifier range.

9. The method of claim 8, wherein sequentially selecting the data flow identifier of each transmitted transport layer packet within the preset identifier range includes:

10. The method of claim 8, the method further comprising:

11. An apparatus for detecting edge network quality, comprising:

a mass analysis unit configured to determine a sliding window using the first detection result, the sliding window including the first detection result and a first detection result that is n consecutive times before the first detection result, the n being a preset positive integer; analyzing a first detection result contained in the sliding window to determine whether network quality abnormality occurs;

The anomaly processing unit is configured to trigger the first edge node to perform route detection on the second edge node if network quality anomaly occurs due to change of historical route detection data compared with the statistical value of TTL in the sliding window, and compare a second detection result generated by the detection with the historical route detection data to locate a network anomaly position; if no network quality abnormality occurs, the TTL information included in the latest first detection result is recorded in the historical route detection data.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the steps of the method of any of claims 1 to 10.

13. An electronic device, comprising:

one or more processors; and

a memory associated with the one or more processors for storing program instructions that, when read for execution by the one or more processors, perform the steps of the method of any of claims 1 to 10.