CN116319353A

CN116319353A - Method, device, equipment and medium for detecting network topology structure

Info

Publication number: CN116319353A
Application number: CN202211718654.9A
Authority: CN
Inventors: 李伟泽
Original assignee: Tianyi Cloud Technology Co Ltd
Current assignee: Tianyi Cloud Technology Co Ltd
Priority date: 2022-12-29
Filing date: 2022-12-29
Publication date: 2023-06-23

Abstract

The embodiment of the application provides a method, a device, equipment and a medium for detecting a network topological structure, wherein the method comprises the following steps: selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the servers to be tested to inject flow into the receiving servers through the switch; obtaining the outflow flow information of a plurality of servers to be tested and the inflow flow information of each port of the switch; according to the outflow flow information and the inflow flow information, the connection relation between a plurality of servers to be tested and ports of the switch is determined, topology structure detection based on flow data analysis is achieved, limitation of factors such as equipment protocols and safety filtering rules is not needed, the defect of a topology discovery method based on the protocols can be effectively overcome, analysis on a service flow path is facilitated, and the root cause of flow abnormality can be positioned, so that fault positioning is conducted on the service flow path.

Description

Method, device, equipment and medium for detecting network topology structure

Technical Field

The present invention relates to the field of networks, and in particular, to a method, an apparatus, a device, and a medium for detecting a network topology structure.

Background

The fault management is a core function of network management, accurate fault diagnosis and accurate positioning have important significance for maintaining normal operation of a network, and a complete network topology structure diagram is a basic guarantee for positioning network faults.

The network topology automatic discovery means that topology information of each node in a network is collected by using a gateway protocol or a tool, a complete network topology structure is obtained through a topology generation algorithm, and at present, a main network topology automatic discovery method comprises the following steps: SNMP based topology discovery, ICMP based topology discovery, OSPF based topology discovery, LLDP based topology discovery.

However, each of the above methods is to obtain network and device information based on a certain communication protocol to perform topology discovery, and each method has advantages and disadvantages, but in practice, the network topology discovery integrity is often insufficient due to factors such as device protocol non-support and security filtering rule limitation.

Disclosure of Invention

In view of the foregoing, embodiments of the present application are provided to provide a method, apparatus, device, and medium for detecting a network topology that overcomes or at least partially solves the foregoing problems.

In order to solve the above problems, an embodiment of the present application discloses a method for detecting a network topology structure, in which a switch and a plurality of servers connected to the switch are arranged in a network, the method includes:

Selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the one server to be tested to inject flow into the receiving server through the switch;

obtaining the outflow flow information of a plurality of servers to be tested and the inflow flow information of each port of the switch;

and determining the connection relation between the plurality of servers to be tested and each port of the switch according to the outflow flow information and the inflow flow information.

Optionally, the outgoing flow information includes a historical outgoing flow average value, the incoming flow information includes a historical incoming flow average value, and determining, according to each outgoing flow information and each incoming flow information, a connection relationship between the plurality of servers to be tested and each port of the switch includes:

and calculating the mean deviation degree between each historical outflow flow mean value and each historical inflow flow mean value, and determining the connection relation between a plurality of servers to be tested and each port of the switch according to the mean deviation degree.

Optionally, the outgoing flow information further includes an outgoing flow total value, the incoming flow information further includes an incoming flow total value, and determining, according to the mean deviation, a connection relationship between the plurality of servers to be tested and each port of the switch includes:

And when the mean deviation is smaller than or equal to the reference threshold, calculating the total value deviation between the total value of the outflow flow and the total value of the inflow flow, and determining the connection relation between the plurality of servers to be tested and each port of the switch according to the total value deviation.

Optionally, determining, according to the total value deviation, a connection relationship between the plurality of servers to be tested and each port of the switch includes:

and determining the target total value deviation degree from the total value deviation degrees, and determining that the server to be tested corresponding to the target total value deviation degree is in a direct connection relationship with the switch port.

Optionally, the target total value deviation is the minimum total value deviation among the total value deviations.

Optionally, calculating the total value deviation between the total value of the outflow and the total value of the inflow includes:

and determining the mutation time corresponding to the occurrence of the flow mutation, and calculating the total value deviation degree between the total value of the outflow flow in the mutation time and the total value of the inflow flow in the mutation time.

Optionally, the obtaining the information of the outgoing flows of the plurality of servers to be tested and the information of the incoming flows of the ports of the switch includes:

obtaining mutation nodes corresponding to the occurrence of flow mutation of a plurality of servers to be tested, and determining an outflow flow value and an outflow time stamp corresponding to each mutation node;

Determining a total value of the outflow flow in the abrupt change time based on the outflow flow value and the outflow time stamp;

determining the inflow flow value and inflow time stamp of each port of the switch corresponding to each abrupt node according to the outflow time stamp;

based on the inflow flow value and the inflow time stamp, a total inflow flow value over the abrupt time is determined.

Optionally, obtaining the abrupt change node corresponding to the abrupt change of the traffic of each server port, and determining the outflow value and the outflow timestamp corresponding to each abrupt change node includes:

obtaining mutation nodes corresponding to the occurrence of flow mutation of a plurality of servers to be tested, and determining index lists corresponding to the mutation nodes;

and determining the outflow flow value and the outflow time stamp corresponding to each abrupt node according to the index list.

Optionally, after controlling the server to be tested to inject the traffic to the receiving server through the switch, the method further includes:

and eliminating the server to be tested from the plurality of servers to be tested, and reselecting one server to be tested.

Optionally, before obtaining the outgoing flow information of the ports of the plurality of servers to be tested and the incoming flow information of each port of the switch, the method further includes:

the non-physical ports are filtered.

and calculating the inflow flow accumulation sum of each port of the switch, and determining that the port of the switch does not flow into the outflow flow of the server to be tested when the inflow flow accumulation sum is smaller than a preset threshold value.

Optionally, after determining that the switch port has not flowed into the outgoing traffic of the server under test, the method further comprises:

the switch port is excluded.

The embodiment of the application also discloses a detection device of a network topology structure, wherein a switch and a plurality of servers connected with the switch are arranged in a network, and the device comprises:

the injection flow control module is used for selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the server to be tested to inject flow into the receiving servers through the switch;

the flow information acquisition module is used for acquiring the outflow flow information of the plurality of servers to be tested and the inflow flow information of each port of the switch;

and the connection relation determining module is used for determining the connection relation between the plurality of servers to be tested and each port of the switch according to the outflow flow information and the inflow flow information.

The embodiment of the application also discloses an electronic device, which comprises a processor, a memory and a computer program stored on the memory and capable of running on the processor, wherein the computer program is executed by the processor to realize the network topology detection method.

The embodiment of the application also discloses a nonvolatile readable storage medium, wherein the nonvolatile readable storage medium stores a computer program, and the computer program realizes the network topology structure detection method when being executed by a processor.

Embodiments of the present application include the following advantages:

in the embodiment of the application, the plurality of servers to be tested and the plurality of receiving servers are selected from the plurality of servers, one server to be tested and one receiving server are selected, the servers to be tested are controlled to inject flow into the receiving servers through the switch, then the outflow flow information of the plurality of servers to be tested and the inflow flow information of each port of the switch are obtained, finally the connection relation between the plurality of servers to be tested and each port of the switch is determined according to each outflow flow information and each inflow flow information, so that the topology structure detection based on flow data analysis is realized, the limitation of factors such as equipment protocols and safety filtering rules is not needed, the defect of a method for topology discovery based on the protocols can be effectively overcome, the analysis of a service flow path is facilitated, and the fault location of the service flow path can be realized by locating the root cause of the flow abnormality.

Drawings

FIG. 1 is a flow chart of steps of an embodiment of a method for detecting a network topology of the present application;

FIG. 2 is a schematic diagram of the architecture of a network in an embodiment of the present application;

FIG. 3 is a flow chart illustrating steps of an embodiment of a method for detecting a network topology according to the present application;

FIG. 4 is a flow chart illustrating another embodiment of a method for detecting a network topology according to the present application;

FIG. 5 is a schematic diagram of an embodiment of a network topology detection system according to the present application;

FIG. 6 is a workflow diagram of an embodiment of a detection system for network topology of the present application;

fig. 7 is a block diagram of an embodiment of a network topology detection apparatus according to the present application.

Detailed Description

In order that the above-recited objects, features and advantages of the present application will become more readily apparent, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings.

Currently, the main network topology auto-discovery method includes:

(1) SNMP-based topology discovery

SNMP (Simple Network Management Protocol ) is an application layer protocol encapsulated in UDP (User Datagram Protocol ), SNMP-based network topology discovery is efficient, but access to MIB (Management Information Base ) may be limited, and thus this approach has certain limitations.

(2) ICMP-based topology discovery

ICMP (Internet Control Message Protocol, internet control message Wen Xie) is a connectionless-oriented network layer protocol encapsulated in IP (Internet Protocol, inter-network protocol) messages, primarily for passing error control messages between source hosts, target hosts and intermediate routers; ICMP has two important applications, namely, a Ping tool (Packet Internet Groper, an internet packet explorer, a procedure for testing network connection quantity), a Traceroute tool (a network monitoring tool for monitoring details of all routing nodes passing between a source host and a destination host), no special requirements on intermediate network devices based on topology discovery of ICMP, wide application range, and low detection efficiency.

(3) ARP-based topology discovery

ARP (Address Resolution Protocol ) is a TCP/IP protocol (Transmission Control Protocol/Internet Protocol, transmission control protocol/internet protocol, a protocol cluster that enables information transfer between multiple different networks) that obtains a physical address according to an IP address, is a stateless protocol encapsulated in an ethernet data frame, and has a main function of converting a network IP address to a physical MAC address (Media Access Control Address ); basically all network devices support the protocol, an ARP table for recording all active devices in the local area network is maintained locally, the topology discovery efficiency based on ARP is high, but the topology discovery method can only be applied to the local area network, and the network devices cannot be discovered in time due to delay recorded by the ARP table.

(4) OSPF-based topology discovery

OSPF (Open Shortest Path First, open shortest path first, link state routing protocol for Internet Protocol (IP) networks) is a link state protocol encapsulated in IP messages, is a passive topology discovery mode based on OSPF topology discovery, and builds a network topology by detecting information of a host and a router for communication.

(5) LLDP-based topology discovery

LLDP (Link Layer Discovery Protocol ) is a neighbor discovery protocol that defines a standard method for ethernet network devices so that the presence of the device itself can be advertised to other nodes in the network and the discovery information of each neighboring device can be saved; the LLDP information is transmitted periodically and is reserved for a certain period of time, and the information is stored in the LLDP MIB, so that the SNMP protocol can be utilized to obtain the information; the method is suitable for physical topology discovery, but LLDP information is time-efficient and only devices supporting the LLDP protocol are active.

However, the above methods all acquire network and device information based on a certain communication protocol to perform topology discovery, and each method has advantages and disadvantages, but in practice, the network topology discovery is often insufficient due to factors such as unsupported device protocol and limited security filtering rules.

The examples of the present application are further described below:

referring to fig. 1, which is a flowchart illustrating steps of an embodiment of a method for detecting a network topology of the present application, as shown in fig. 2, a switch and a plurality of servers connected to the switch are disposed in a network, the method may include the steps of:

step 101, selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the one server to be tested to inject flow into the receiving server through the switch.

When the network topology structure needs to be determined, a plurality of servers to be detected and a plurality of receiving servers are selected from the plurality of servers, one server to be detected and one receiving server are selected, the server to be detected is controlled to inject flow into the receiving servers through the switch, and the flow injection operation is controlled until all the servers have initiated.

In some embodiments of the present application, after step 101, the method may further include the steps of:

After the server to be tested is controlled to inject the flow into the receiving server through the switch, the server to be tested with the injection flow operation completed can be removed from the plurality of servers to be tested, and one server to be tested without the injection flow operation is reselected, so that the reselected server to be tested is controlled to inject the flow into the receiving server through the switch.

Step 102, obtaining the outflow flow information of a plurality of servers to be tested and the inflow flow information of each port of the switch.

After controlling all servers to finish the operation of injecting the flow, obtaining the outflow flow information of all servers to be tested and the inflow flow information of each port of the switch, so as to analyze the flow data and further determine the network topology.

In some embodiments of the present application, prior to step 102, the method may further include the steps of:

the non-physical ports are filtered.

Before the outflow flow information of all the servers to be tested and the inflow flow information of each port of the switch are acquired, the non-physical ports can be filtered, so that the situation that data for flow data analysis have interference data due to the fact that the data of the non-physical ports are acquired is avoided.

Before the outflow flow information of all the servers to be tested and the inflow flow information of each port of the switch are obtained, the inflow flow accumulation sum of each port of the switch can be calculated, and when the inflow flow accumulation sum is smaller than a preset threshold value, the fact that the port of the switch does not flow into the outflow flow of the servers to be tested is determined, so that data acquisition of invalid ports is avoided.

In some examples of the present application, after determining that the switch port has not flowed into the outgoing traffic of the server under test, the method may further include the steps of:

the switch port is excluded.

After determining the invalid port, the invalid port can be excluded from the object list of the data to be acquired, so that the data acquisition of the invalid port is not performed in the process of acquiring the data.

And step 103, determining the connection relation between the plurality of servers to be tested and each port of the switch according to the information of each outflow flow and the information of each inflow flow.

After the outflow flow information and the inflow flow information are obtained, the connection relation between the plurality of servers to be tested and each port of the switch can be determined according to the outflow flow information and the inflow flow information.

Referring to fig. 3, which is a flowchart illustrating steps of another embodiment of a method for detecting a network topology of the present application, a switch and a plurality of servers connected to the switch are disposed in a network, the method may include the steps of:

Step 301, selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the servers to be tested to inject flow into the receiving servers through the switch.

Step 302, obtaining the outflow flow information of a plurality of servers to be tested and the inflow flow information of each port of the switch; the outflow flow information comprises a historical outflow flow average value, and the inflow flow information comprises a historical inflow flow average value.

After controlling all servers to finish the operation of injecting the flow, acquiring the historical outflow flow average value of all servers to be tested and the historical inflow flow average value of each port of the switch, so as to analyze the flow data and further determine the network topology.

And 303, calculating the mean deviation between each historical outflow flow mean value and each historical inflow flow mean value, and determining the connection relation between a plurality of servers to be tested and each port of the switch according to the mean deviation.

The method comprises the steps of calculating the mean deviation degree between each historical outflow flow mean value and each historical inflow flow mean value, determining the ports of the to-be-tested servers and the switch with the direct connection relationship according to the mean deviation degree, and further determining the connection relationship between the multiple to-be-tested servers and the ports of the switch.

In some embodiments of the present application, the outgoing flow information further includes an outgoing flow total value, the incoming flow information further includes an incoming flow total value, and determining, according to the mean deviation in step 303, the connection relationship between the plurality of servers to be tested and each port of the switch may include the following sub-steps:

and step 11, when the mean deviation is smaller than or equal to the reference threshold, calculating the total deviation between the total value of the outflow flow and the total value of the inflow flow, and determining the connection relation between the plurality of servers to be tested and each port of the switch according to the total deviation.

When the mean deviation is smaller than or equal to the reference threshold, it can be determined that the difference between the historical outflow flow mean value of the server to be tested and the historical inflow flow mean value of the port is not large, and the server to be tested and the port may have a direct connection relationship, so that the server to be tested and the port of the switch which have the direct connection relationship need to be further determined according to the total value deviation.

In some examples of the present application, determining the connection relationship between the plurality of servers to be tested and each port of the switch in the substep 11 according to the total value deviation may include:

And determining the combination of the to-be-tested server and the switch port which most probably have a direct connection relationship by determining the target total value deviation degree from the total value deviation degrees and determining the to-be-tested server and the switch port corresponding to the target total value deviation degree.

In a specific embodiment, the target total value deviation is the minimum total value deviation among the respective total value deviations.

If the deviation degree of a certain total value is smaller, it indicates that the direct connection relationship between the server to be tested corresponding to the deviation degree of the total value and the switch port is more likely to exist, so that the deviation degree of the total value with the smallest median value of the deviation degrees of the total values can be determined as the target deviation degree of the total value, and the direct connection relationship between the server to be tested corresponding to the deviation degree of the target total value and the switch port is determined

In some embodiments of the present application, the calculating the total value deviation between the total value of the outflow and the total value of the inflow in step 303 may include the following sub-steps:

And 21, determining mutation time corresponding to the occurrence of flow mutation, and calculating the total value deviation degree between the total value of the outflow flow in the mutation time and the total value of the inflow flow in the mutation time.

When the server to be tested injects flow into the receiving server through the switch, flow mutation occurs, and the direct connection relation between the server to be tested and the switch port can be accurately determined by determining mutation time corresponding to the occurrence of the flow mutation and calculating the total value deviation degree between the total value of the outflow flow in the mutation time and the total value of the inflow flow in the mutation time.

In some examples of the present application, step 302 may include the following sub-steps:

and step 31, obtaining mutation nodes corresponding to the occurrence of flow mutation of the plurality of servers to be tested, and determining the outflow flow value and outflow time stamp corresponding to each mutation node.

Through obtaining the mutation nodes corresponding to the mutation of the flow of the plurality of servers to be detected, the outflow flow value and the outflow time stamp corresponding to each mutation node can be determined, and the total outflow flow value in the mutation time can be calculated.

Substep 32, determining the total value of the outgoing flow in the abrupt time based on the outgoing flow value and the outgoing time stamp.

After determining the outflow value and the outflow time stamp corresponding to each abrupt change node, the total value of the outflow values in the abrupt change time can be calculated according to the outflow value and the outflow time stamp corresponding to each abrupt change node.

And step 33, determining the inflow flow value and inflow time stamp of each port of the switch corresponding to each abrupt change node according to the outflow time stamp.

After determining the outflow time stamp corresponding to the abrupt node, the inflow flow value and the inflow time stamp corresponding to each abrupt node at each port of the switch can be determined according to the outflow time stamp, so as to calculate the total inflow flow value in the abrupt time.

Substep 34, determining the total inflow volume value within the abrupt change time based on the inflow volume value and the inflow time stamp.

After determining the inflow value and inflow time stamp of each port of the switch corresponding to each abrupt node, the total inflow value in the abrupt time can be calculated according to the inflow value and inflow time stamp of each abrupt node.

In a specific embodiment, sub-step 31 may comprise:

obtaining mutation nodes corresponding to the occurrence of flow mutation of a plurality of servers to be tested, and determining index lists corresponding to the mutation nodes; and determining the outflow flow value and the outflow time stamp corresponding to each abrupt node according to the index list.

Step 303 is illustrated below:

selecting a server i to be tested, and calculating the historical outflow flow average value of the server i to be tested

Selecting one port j of the switch, calculating the historical inflow flow average value +.>

Then pass->

Calculating to obtain the mean deviation degree D _ij If D _ij >0.3, the difference between the historical outflow flow average value of the server i to be tested and the historical inflow flow average value of the port j is too much, and it is determined that the direct connection relationship between the server i to be tested and the port j is impossible, if D _ij And less than or equal to 0.3, the difference between the historical outflow flow average value of the server i to be tested and the historical inflow flow average value of the port j is not great, and the direct connection relation between the server i to be tested and the port j possibly exists, so that further determination is needed.

Setting a reference value according to the size of the injection flow, performing 0-1 conversion on the flow value of each server to be tested, marking the flow value smaller than the reference value as 0, marking the flow value larger than or equal to the reference value as 1, and converting the flow sequence of each server to be tested into a 01 character string

The abrupt change caused by the injection flow includes two character string modes of '010' and '0110', as shown in fig. 4, the embodiment of the present application takes the '010' character string mode as an example, and uses the corresponding 01 character string

Matching the '010' character string, thereby obtaining an index list corresponding to the '010' character string, and obtaining an outflow flow value sequence of the corresponding node of the server to be tested according to the index list>

And outflow traffic timestamp sequence->

If D _ij Less than or equal to 0.3, utilizing the time stamp sequence of the server i to be tested

Obtain ingress traffic timestamp sequence of port j +.>

And inflow value sequence +.>

With the outgoing timestamp sequence [ t ] of server port i _i (n),t _i (n+1),t _i (n+2)]For example, the corresponding sequence of outflow flow values is [ v ] _i (n),v _i (n+1),v _i (n+2)]The ingress timestamp sequence for port j is [ t ] _j (m),t _j (m+1),t _j (m+2)]The corresponding inflow flow value sequence is [ v ] _j (m),v _j (m+1),v _j (m+2)]Wherein t is _j (m) the first of the historical traffic sequences for port j is t or less _i Inflow time stamp of (n), t _j (m+2) is the first t or less _i (n+2) an inflow time stamp.

Recalculating [ t ] _j (m),t _j (m+2)]Outflow S of server i to be measured in time interval _i And ingress traffic S at port j _j Wherein S is _i (n)＝v _i (n)*t _i (n)-t _j (m)]+v _i (n+1)*[t _i (n+1)-t _i (n)]+v _i (n+2)*[t _j (m+2)-t _i (n+1)]，S _j (n)＝v _j (m+2)*t _j (m+2)-t _j (m+1)]+v _j (m+1)*t _j (m+1)-t _j (m)]Then pass through

Calculating the degree of deviation d of the total value _ij (n)。

By the method, the character string is subjected to

And calculating the total value deviation degree one by one of the matched sub-sequence flows in the '010' mode, and obtaining the combination of the server to be tested and the switch port, wherein the total value deviation degree is smaller than a set threshold value, so as to determine the network topology structure.

In the embodiment of the application, a plurality of servers to be tested and a plurality of receiving servers are selected from a plurality of servers, one server to be tested and one receiving server are selected, the servers to be tested are controlled to inject flow into the receiving servers through an exchanger, then the outflow flow information of the plurality of servers to be tested and the inflow flow information of each port of the exchanger are acquired, wherein the outflow flow information comprises a historical outflow flow mean value, the inflow flow information comprises a historical inflow flow mean value, finally the mean deviation degree between each historical outflow flow mean value and each historical inflow flow mean value is calculated, and according to the mean deviation degree, the connection relation between the plurality of servers to be tested and each port of the exchanger is determined, so that the topology structure detection based on flow data analysis is realized, the limitation of factors such as equipment protocols and safety filtering rules is not needed, the defect of a topology discovery method based on the protocols can be effectively made up, the analysis of service flow paths is more convenient, and the fault location of the service flow paths can be realized by locating the root causes of flow anomalies.

It should be noted that, for simplicity of description, the method embodiments are shown as a series of acts, but it should be understood by those skilled in the art that the embodiments are not limited by the order of acts described, as some steps may occur in other orders or concurrently in accordance with the embodiments. Further, those skilled in the art will appreciate that the embodiments described in the specification are all preferred embodiments and that the acts referred to are not necessarily required by the embodiments of the present application.

Referring to fig. 5, there is shown a block diagram of an embodiment of a network topology detection system of the present application, which may include the following modules:

and the flow management module is responsible for screening and acquiring the required historical flow sampling data from the monitoring Server.

And the traffic injection module is responsible for deploying the traffic injection script in the physical server and monitoring remote execution functions of the API (Application Program Interface ) on the script.

And the port screening module is responsible for finishing the preliminary screening and filtering of the physical ports according to the port type and the flow size of the switch.

The port direct connection analysis module is responsible for analyzing the screened physical ports to determine the similarity of the outflow flow of each port of the switch and the inflow flow of each physical server, so as to determine whether the ports of the switch and the servers are in direct connection.

The following describes the workflow of the embodiment of the network topology detection system:

as shown in fig. 2, monitoring systems (such as Zabbix Server and Zabbix Agent) are deployed on four physical servers, the monitoring items are respectively configured for the inflow and outflow of the four physical servers in an automatic network card discovery mode, and then the inflow and outflow of each port of the tera switch SW1 are collected by the online Zabbix monitoring systems; the flow collection time interval of the switch port is 5 minutes, and the sampled data is the average value of flow change in 5 minutes.

Referring to table 1, the port true direct connection relationship between the four physical servers and the switch SW1 is shown, accordingly.

TABLE 1

Referring to table 2, the correspondence between the outflow monitoring item of the server port and the inflow monitoring item of the switch SW1 port is shown.

TABLE 2

Referring to table 3, a correspondence relationship between an inflow monitoring item of a server port and an outflow monitoring item of a switch SW1 port is shown.

/>

TABLE 3 Table 3

In order to acquire the relationship of all direct ports between the four physical servers and the switch SW1, traffic packets need to be packed between the four servers to obtain traffic monitoring data that varies significantly.

The main operation flow of the flow injection in this embodiment is as follows:

the command "python runzxscript. Py-c < agent_name > -s < server_ip > -n < network_traffic >" is executed at the springboard machine terminal, wherein "agent_name" indicates a monitored server host name, i.e. a server outputting traffic, and "server_ip" indicates a server receiving traffic, and "network_traffic" is used to adjust the size of a traffic packet.

The script runzxscript. Py will access the zadbix Server, querying if there is a "makeflow_udp_client" script item; if so, updating the corresponding command value; if not, a "makeflow_udp_client" script item is created.

The makeflow.py script is executed on the server specified by "agent_name" and the traffic packet is sent to the server specified by "server_ip" for a default duration of 20s.

And after the makeflow.py script operation is finished, returning an execution result to the springboard machine terminal.

Referring to Table 4, giving some traffic monitoring data for switch SW1 port 10GE1/0/30, it can be seen that there is a significant rise in traffic over the time interval 1571743765 s-1571744360 s.

/>

TABLE 4 Table 4

Referring to Table 5, partial outgoing traffic data of port p4p2 of server SVR208, which is directly connected to switch SW1 port 10GE1/0/30, is given.

itemid	time(s)	value(bps)
			28658	1571741258	536
28658	1571741558	536
			28658	1571741858	536
28658	1571742158	536
			28658	1571742458	536
28658	1571742758	536
			28658	1571743058	536
28658	1571743358	536
			28658	1571743658	536
28658	1571743958	536
			28658	1571744258	1642176
28658	1571744558	536
			28658	1571744858	536
28658	1571745158	536

TABLE 5

As shown in fig. 6, the main steps of the workflow of the above-mentioned network topology detection system embodiment include:

step 1, one physical server which is directly connected with the switch in the target environment is selected, and the flow with the preset duration and size is injected into another optional physical server.

And 2, acquiring inflow and outflow flow of each port of the switch and the server through a monitoring system deployed in the target environment.

And 3, removing the selected physical machine which initiates the injection flow at intervals, re-selecting one physical machine, and repeating the

steps

1 and 2.

And 4, repeating the step 3 until all physical machines in the target environment are covered.

And 5, calculating and acquiring the physical connection relation of each port between the switch and the server based on the flow sampling data.

Wherein, step 5 includes:

1) Taking calculation of the outgoing flow of the port of the server SVR208 and the incoming flow of the port of the switch SW1 as an example, historical flow data with a certain duration T is obtained from a database, and the screening of the ports is completed.

2) Selecting one port i of the server SVR208, and calculating the historical outflow flow average value of the port i

3) Setting a reference value according to the size of the injection flow, performing 0-1 conversion on the flow value of the port i, marking the flow value smaller than the reference value as 0, marking the flow value larger than or equal to the reference value as 1, and converting the flow sequence of the port i into a 01 character string

4) The abrupt change caused by the injection flow comprises two character string modes of 010 and 0110, and the embodiment takes the 010 character string mode as an example, and uses the corresponding 01 character string

And matching the '010' character string, thereby obtaining an index list corresponding to the '010' character string.

Obtaining the flow value sequence of the corresponding node of the server to be tested according to the index list

And outflow traffic timestamp sequence- >

5) Obtaining an outflow flow value sequence corresponding to the port i according to the index list

And outflow traffic timestamp sequence->

6) Selecting one port j of the switch SW1, calculating the historical inflow traffic mean value of the port j

And pass through

Calculating the mean deviation degree D _ij If D _ij And if the flow is more than 0.3, the flow of the two ports is not similar as a whole, the next server port is selected, and the historical outflow flow average value and the corresponding average deviation degree are calculated again.

7) If D _ij Less than or equal to 0.3, utilizing the time stamp sequence of the server i to be tested

Obtain ingress traffic timestamp sequence of port j +.>

And inflow value sequence +.>

8) Calculation t _j (m),t _j (m+2)]Outflow S of server i to be measured in time interval _i And ingress traffic S at port j _j Wherein S is _i (n)＝v _i (n)*t _i (n)-t _j (m)]+v _i (n+1)*[t _i (n+1)-t _i (n)]+v _i (n+2)*[t _j (m+2)-t _i (n+1)]，S _j (n)＝v _j (m+2)*[t _j (m+2)-t _j (m+1)]+v _j (m+1)*t _j (m+1)-t _j (m)]Then pass through

Calculating the degree of deviation d of the total value _ij (n)。

9) By the method, the character string is subjected to

And calculating the total value deviation degree one by one according to the matched sub-sequence flow of the '010' mode. />

10 Obtaining a combination of the server to be tested and the switch port, the total value deviation of which is smaller than the set threshold value, so as to determine the network topology.

Referring to fig. 7, which is a block diagram illustrating an embodiment of a network topology detection apparatus of the present application, a switch and a plurality of servers connected to the switch are disposed in a network, the apparatus may include the following modules:

the injection flow control module 701 is configured to select a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, and select one server to be tested and one receiving server, and control the servers to be tested to inject flow into the receiving servers through the switch.

The flow information obtaining module 702 is configured to obtain the outgoing flow information of the plurality of servers to be tested and the incoming flow information of each port of the switch.

The connection relationship determining module 703 is configured to determine a connection relationship between the plurality of servers to be tested and each port of the switch according to each outgoing flow information and each incoming flow information.

In some embodiments of the present application, the apparatus may further include the following modules:

and the rejecting reselection execution module is used for rejecting the server to be tested from a plurality of servers to be tested and reselecting one server to be tested.

And the non-physical port filtering module is used for filtering the non-physical ports.

And the switch port primary screening module is used for calculating the inflow flow accumulation sum of each port of the switch, and determining that the switch port does not flow into the outflow flow of the server to be tested when the inflow flow accumulation sum is smaller than a preset threshold value.

And the invalid port eliminating module is used for eliminating the switch port.

In some embodiments of the present application, the outflow information includes a historical outflow average, the inflow information includes a historical inflow average, and the connection determining module 703 may include the following sub-modules:

the mean deviation calculating submodule is used for calculating the mean deviation between each historical outflow flow mean value and each historical inflow flow mean value and determining the connection relation between a plurality of servers to be tested and each port of the switch according to the mean deviation.

In some examples of the present application, the outflow flow information further includes an outflow flow total value, the inflow flow information further includes an inflow flow total value, and the mean deviation calculation submodule may include:

and the total value deviation degree calculation unit is used for calculating the total value deviation degree between the total value of the outflow flow and the total value of the inflow flow when the mean value deviation degree is smaller than or equal to the reference threshold value, and determining the connection relation between the plurality of servers to be tested and each port of the switch according to the total value deviation degree.

In a specific embodiment, the total value deviation calculation unit may include the following sub-units:

and the target total value deviation degree subunit is used for determining the target total value deviation degree from the total value deviation degrees and determining that the server to be tested corresponding to the target total value deviation degree is in a direct connection relationship with the switch port.

And the flow mutation time determining subunit is used for determining mutation time corresponding to the occurrence of flow mutation, and calculating the total value deviation degree between the total value of the outflow flow in the mutation time and the total value of the inflow flow in the mutation time.

In some embodiments of the present application, the traffic information acquisition module 702 may include the following sub-modules:

and the outflow flow information sub-module is used for acquiring mutation nodes corresponding to the occurrence of flow mutation of the plurality of servers to be tested, and determining outflow flow values and outflow time stamps corresponding to the mutation nodes.

And the outflow flow total value submodule is used for determining the outflow flow total value in the abrupt change time based on the outflow flow value and the outflow time stamp.

And the inflow flow information sub-module is used for determining the inflow flow value and the inflow time stamp of each port of the switch corresponding to each abrupt change node according to the outflow time stamp.

And the inflow flow total value submodule is used for determining the inflow flow total value in the abrupt change time based on the inflow flow value and the inflow time stamp.

In some examples of the present application, the outgoing traffic information sub-module may include the following elements:

the index list determining unit is used for obtaining mutation nodes corresponding to the occurrence of flow mutation of the plurality of servers to be tested, and determining index lists corresponding to the mutation nodes.

And the outflow flow information unit is used for determining the outflow flow value and the outflow time stamp corresponding to each abrupt node according to the index list.

For the device embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points.

The embodiment of the application also provides electronic equipment, which can comprise a processor, a memory and a computer program stored on the memory and capable of running on the processor, wherein the computer program is executed by the processor to realize the network topology detection method.

The embodiment of the application also provides a nonvolatile readable storage medium, wherein the nonvolatile readable storage medium stores a computer program, and the computer program realizes the network topology structure detection method when being executed by a processor.

In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described by differences from other embodiments, and identical and similar parts between the embodiments are all enough to be referred to each other.

It will be apparent to those skilled in the art that embodiments of the present application may be provided as a method, apparatus, or computer program product. Accordingly, the present embodiments may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application may take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While preferred embodiments of the present embodiments have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the embodiments of the present application.

Finally, it is further noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or terminal device comprising the element.

The foregoing describes in detail a method, apparatus, device and medium for detecting a network topology provided in the present application, and specific examples are applied to illustrate the principles and embodiments of the present application, where the foregoing examples are only used to help understand the method and core idea of the present application; meanwhile, as those skilled in the art will have modifications in the specific embodiments and application scope in accordance with the ideas of the present application, the present description should not be construed as limiting the present application in view of the above.

Claims

1. A method for detecting a network topology, wherein a switch and a plurality of servers connected to the switch are arranged in the network, the method comprising:

selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the servers to be tested to inject flow into the receiving servers through the switch;

obtaining the outflow flow information of the plurality of servers to be tested and the inflow flow information of each port of the switch;

2. The method of claim 1, wherein the outgoing flow information comprises a historical outgoing flow mean, the incoming flow information comprises a historical incoming flow mean, and determining the connection relationship between the plurality of servers under test and the ports of the switch based on the outgoing flow information and the incoming flow information comprises:

and calculating the mean deviation degree between each historical outflow flow mean value and each historical inflow flow mean value, and determining the connection relation between the plurality of servers to be tested and each port of the switch according to the mean deviation degree.

3. The method of claim 2, wherein the outgoing flow information further includes an outgoing flow total value, the incoming flow information further includes an incoming flow total value, and determining, according to the mean deviation, a connection relationship between the plurality of servers to be tested and ports of the switch includes:

and when the mean deviation is smaller than or equal to a reference threshold, calculating the total value deviation between the total value of the outflow flow and the total value of the inflow flow, and determining the connection relation between the plurality of servers to be tested and each port of the switch according to the total value deviation.

4. The method of claim 3, wherein determining the connection relationship between the plurality of servers under test and the ports of the switch according to the total value deviation comprises:

and determining a target total value deviation degree from the total value deviation degrees, and determining that the server to be tested corresponding to the target total value deviation degree is in a direct connection relationship with the switch port.

5. The method of claim 4, wherein the target total value deviation is a minimum median total value deviation of each of the total value deviations.

6. A method according to claim 3, wherein said calculating a total value deviation between said outflow and inflow total values comprises:

and determining mutation time corresponding to the occurrence of flow mutation, and calculating the total value deviation degree between the total value of the outflow flow in the mutation time and the total value of the inflow flow in the mutation time.

7. The method of claim 6, wherein the obtaining the outgoing traffic information of the plurality of servers under test and the incoming traffic information of each port of the switch comprises:

obtaining mutation nodes corresponding to the occurrence of flow mutation of the plurality of servers to be tested, and determining an outflow flow value and an outflow time stamp corresponding to each mutation node;

determining the total value of the outflow in the abrupt time based on the outflow value and the outflow timestamp;

the total inflow flow value within the abrupt time is determined based on the inflow flow value and the inflow time stamp.

8. The method of claim 7, wherein the obtaining the abrupt node corresponding to the occurrence of the abrupt change in the traffic at each server port, and determining the traffic flow value and the traffic time stamp corresponding to each abrupt node comprises:

Obtaining mutation nodes corresponding to the occurrence of flow mutation of the plurality of servers to be tested, and determining index lists corresponding to the mutation nodes;

9. The method according to any one of claims 1 to 8, wherein after said controlling said server under test to inject traffic to said socket server through said switch, said method further comprises:

10. The method according to any one of claims 1 to 8, wherein before the obtaining the outgoing traffic information of the plurality of server ports to be tested and the incoming traffic information of each port of the switch, the method further comprises:

the non-physical ports are filtered.

11. The method according to any one of claims 1 to 8, wherein before the obtaining the outgoing traffic information of the plurality of server ports to be tested and the incoming traffic information of each port of the switch, the method further comprises:

12. The method of claim 11, wherein after said determining that the switch port is not flowing into the outgoing traffic of the server under test, the method further comprises:

and eliminating the switch port.

13. A device for detecting a network topology, wherein a switch and a plurality of servers connected to the switch are arranged in the network, the device comprising:

the injection flow control module is used for selecting a plurality of servers to be tested and a plurality of receiving servers from the plurality of servers, selecting one server to be tested and one receiving server, and controlling the servers to be tested to inject flow into the receiving servers through the switch;

14. An electronic device comprising a processor, a storage device and a computer program stored on the storage device and capable of running on the processor, which when executed by the processor, implements the method of any one of claims 1 to 12.

15. A non-transitory readable storage medium, characterized in that it has stored thereon a computer program which, when executed by a processor, implements the method according to any of claims 1 to 12.