WO2017118428A1

WO2017118428A1 - Method and apparatus for realizing message error detection

Info

Publication number: WO2017118428A1
Application number: PCT/CN2017/070505
Authority: WO
Inventors: 王艺霖; 刘娟; 骆文
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-01-06
Filing date: 2017-01-06
Publication date: 2017-07-13
Also published as: CN106953773A

Abstract

Disclosed are a method and apparatus for realizing message error detection. The method comprises: acquiring and distinguishing an inbound message and an outbound message transmitted by a detected network; and matching a specific part of the inbound message with a specific part of the outbound message, so as to determine whether the messages have an error, wherein the detected network is a network composed of one or more network devices.

Description

Method and device for realizing message error detection

Technical field

The present disclosure relates to the field of data communications, for example, to a method and apparatus for implementing message error detection.

Background technique

Network devices such as the Broadband Remote Access Server (BRAS) device, the core router device, the core switch device, and the third are widely used in networks such as the carrier network, the enterprise network, and the Internet network. Layer switch devices and various optical network devices. These network devices operate an Internet Protocol (IP) that interconnects networks and build a world based on IP network protocols by interconnecting them. Some message fields should not change when the message is transmitted through the network device, but a packet error may occur during the message transmission. Taking the enterprise network as an example, it is assumed that there is a communication link between area A and area B, and a communication link between area A and area C, and the communication link between area A and area B has a high packet loss rate due to the router or the switch. The IP link problem, such as the system problem, causes the packet field that should not be changed to change between the area A and the area B, causing packet errors and affecting normal communication. The above system problem may be caused by the failure of the system software or hardware, or the external environment affecting the system performance (such as electromagnetic interference) and other factors affecting the normal transmission of the message. If the message field that should not be changed is changed, for example, the IP address field is modified, the message will be delivered to the wrong destination address, and finally discarded as a bad packet, affecting the normal communication of the network.

When the network size is small, after an error packet is found, an experienced technician can judge the possible problems of the network device based on experience, restart the network device that may have problems, re-connect the network, or replace the network device. Solve the problem of message errors. When the network size increases to a certain extent, the accuracy of the error message and the error message based on experience to determine whether the network device has a problem will be greatly reduced. The problem of solving the error message needs to be tried multiple times, and each attempt is made. It may cause the network to be completely interrupted and affect the normal communication of the network. For large-scale Internet networks, it is more difficult to find error messages and determine network devices that have problems based on experience.

Summary of the invention

The present disclosure provides a method and apparatus for implementing packet error detection, which can determine whether an error occurs in a packet and determine whether a network device is normal when the network size is increased.

The present disclosure provides a method for implementing packet error detection, including:

Obtaining and distinguishing between the inbound packet and the outgoing packet transmitted by the detected network;

Matching a specific part of the inbound message with a specific part of the outgoing message to determine whether the message is in error;

The detected network is a network composed of one or more network devices.

Optionally, the obtaining and distinguishing the inbound packet and the outgoing packet transmitted by the detected network includes:

Receiving, by the preset inbound interface, the inbound packet copied from the transmission interface, and receiving the outgoing packet copied from the transmission interface by using a preset outgoing interface; or

And obtaining, when the inbound packet copied from the transmission interface and the outgoing packet copied from the transmission interface, adding corresponding flow direction information to the obtained incoming packet and the outgoing packet, respectively, to distinguish Describe the incoming message and the outgoing message.

Optionally, obtaining and distinguishing between the inbound packet and the outgoing packet transmitted by the detected network includes:

When the network device is an electrical interface device, the inbound packet and the outgoing packet transmitted by the detected network are copied by configuring the network device of the detected network;

And when the network device is an optical port device, the inbound packet and the outgoing packet transmitted by the detected network are split and replicated by the optical splitter of the detected network.

Optionally, the method further includes:

When the corresponding flow direction information is added to the obtained inbound packet and the outgoing packet respectively, the inbound packet and the outgoing packet to which the flow direction information is added are encapsulated;

Before the matching of the specific part of the inbound packet with the specific part of the outgoing message, the method further includes: encapsulating the inbound packet containing the flow direction information and encapsulating the flow direction information The outgoing message is decapsulated.

Optionally, the encapsulating the inbound packet and the outbound packet that respectively add the corresponding flow direction information includes: performing a universal routing encapsulation GRE or a user on the inbound packet and the outgoing packet respectively respectively adding the corresponding flow direction information. Datagram Protocol UDP encapsulation.

Optionally, the matching, by the specific part of the inbound message with the specific part of the outgoing message, includes:

Performing content of a specific portion of the incoming message with content of a specific portion of the outgoing message Match; or,

Extracting a feature value of the content of the specific portion of the incoming message and a feature value of the content of the specific portion of the outgoing message; and extracting the extracted feature value of the content of the specific portion of the incoming message The feature values of the content of the specific part of the outgoing message are matched.

Optionally, before the matching the specific part of the inbound message with the specific part of the outgoing message, the method further includes:

And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network.

Optionally, before the matching the specific part of the inbound message with the specific part of the outgoing message, the method further includes at least one of the following:

Filtering the packet transmitted by the detected network multicast; and

Filtering the message transmitted by the detected network broadcast.

When the non-network address translation NAT scenario is performed, the specific part of the inbound message that is at least one of the source address and the destination address is matched with the specific part of the outgoing message;

When in the NAT scenario, the source address of the incoming packet, the destination address of the incoming packet, the source address of the outgoing packet, the destination address of the outgoing packet, and the local address in the NAT scenario. And the global address mapping entry, determining the source address and the destination address of the obtained inbound packet and the outgoing packet, and selecting the inbound packet and the outgoing packet corresponding to the source address and the destination address of the mapping. And matching a specific part of the incoming message with a specific part of the outgoing message.

Optionally, when the packet transmitted by the detected network is a common packet, the method further includes: a content of a distinguishing field included in a specific part of the incoming packet and a specific part of the outgoing packet Contains the content of the distinguishing field to learn the message;

If the distinguishing field included in the specific part of the inbound packet and the distinguishing field included in the specific part of the outgoing packet match in the result of the packet learning, it is determined that the packet does not have an error; if the incoming report is in the result of the packet learning If the distinguishing field included in the specific part of the text does not match the distinguishing field included in the specific part of the outgoing message, the specific part of the incoming message is matched with the specific part of the outgoing message, and the packet is determined. Is it wrong?

Optionally, the distinguishing field includes at least one of the following: a protocol, a message length, and a flag bit.

Optionally, the method further includes: adjusting, according to the packet that determines the error, the network device involved in the error message.

The application also provides an apparatus for implementing packet error detection, including:

An obtaining unit, configured to acquire and distinguish between an inbound message and an outgoing message transmitted by the detected network;

The matching analysis unit is configured to match a specific part of the inbound message with a specific part of the outgoing message to determine whether the message is in error;

The detected network is a network composed of one or more network devices.

Optionally, the obtaining unit is configured to

Optionally, the device further includes an encapsulating unit, configured to add an inbound message and an outgoing message to the flow direction information when the corresponding inbound message is added to the inbound message and the outgoing message respectively. Package;

And a decapsulation unit, configured to: before the matching the specific part of the inbound message with the specific part of the outgoing message, the inbound message containing the flow direction information and the encapsulated outgoing direction including the flow direction information The message is decapsulated.

Optionally, the matching analysis unit is set to,

Extracting a feature value of the content of the specific part of the incoming message and a feature value of the content of the specific part of the outgoing message;

The extracted feature value of the content of the specific portion of the incoming message is matched with the extracted feature value of the content of the specific portion of the outgoing message.

Optionally, the device further includes a first filtering unit, configured to filter the outgoing report that is sent by the detected network before the specific part of the incoming packet is matched with the specific part of the outgoing packet. And an inbound message sent to the detected network.

Optionally, the apparatus further includes: a second filtering unit, configured to filter the reported network multicast transmission report before the specific part of the inbound message is matched with the specific part of the outgoing message And at least one of the messages transmitted by the detected network broadcast.

Optionally, the matching analysis unit is set to,

When the NAT is in the NAT scenario, the source address of the incoming packet, the destination address of the incoming packet, the source address of the outgoing packet, the destination address of the outgoing packet, and the local address in the NAT scenario. The global address mapping entry determines the source address and the destination address of the obtained inbound packet and the outgoing packet, and selects the inbound packet and the outgoing packet corresponding to the source address and the destination address of the mapping. Performing a match between a specific portion of the incoming message and a specific portion of the outgoing message.

Optionally, the device further includes a message learning unit, configured to: when the message transmitted by the detected network is a common message, the content of the distinguishing field included in the specific part of the incoming message and the The message learning is performed on the content of the distinguishing field included in the specific part of the outgoing message;

The matching analysis unit is further configured to determine that the packet does not have an error if the distinguishing field included in the specific part of the incoming packet and the distinguishing field included in the specific part of the outgoing packet are matched in the result of the packet learning; In the result of the packet learning, the distinguishing field included in the specific part of the incoming message and the distinguishing field included in the specific part of the outgoing message do not match, and the specific part of the incoming message and the outgoing report are A specific part of the text is matched to determine if the message is in error.

Optionally, the device further includes an adjusting unit, configured to determine, according to the matching analysis unit, an error message, and adjust the network device involved in the error message.

The present disclosure provides a non-transitory computer readable storage medium storing computer executable instructions, the computer executable instructions being set to any of the above methods for implementing message error detection.

The disclosure also provides a network device, including:

At least one processor;

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform any of the methods described above for implementing message error detection. The technical solution of the present application includes: obtaining and distinguishing between an inbound packet and an outgoing packet transmitted by the detected network; matching a specific part of the inbound packet with a specific part of the outgoing packet to determine whether the packet is in error, wherein The detection network is a network of one or more network devices. The method of the present disclosure determines whether the message is erroneous by matching a specific part of the incoming message and a specific part of the outgoing message, thereby realizing error detection of the message of the error-detected network. At the same time, according to the result of the error detection of the message, the network device is adjusted, and the communication of the network to be detected is timely adjusted to ensure the normal communication of the network.

DRAWINGS

The accompanying drawings, which are set forth in the claims of the claims

1 is a flowchart of a method for implementing packet error detection according to the present disclosure;

FIG. 2 is a structural diagram of an apparatus for implementing packet error detection according to the present disclosure.

3 is a flow chart of a method according to a first embodiment of the present disclosure;

4 is a flow chart of a method according to a second embodiment of the present disclosure;

5 is a schematic diagram of a network topology of a packet passing through a detected network according to a third embodiment of the present disclosure;

Figure 6 is a flow chart of a method according to a fourth embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of hardware of an electronic device according to the present disclosure.

detailed description

In order to make the technical solutions of the present disclosure more clear, embodiments of the present disclosure will be hereinafter described with reference to the accompanying drawings. Be explained. The embodiments in the present application and the features in the embodiments may be arbitrarily combined with each other without conflict.

FIG. 1 is a flowchart of a method for implementing packet error detection according to the present disclosure.

In step 100, the inbound packet and the outgoing packet transmitted by the detected network are obtained and distinguished. The detected network is a network composed of one or more network devices.

The inbound packet may be a packet received by the detected network, and the outgoing packet may be a packet sent by the detected network.

Obtaining and distinguishing between the inbound and outbound packets transmitted by the detected network may include:

Receiving the inbound packet copied from the transmission interface through the preset inbound interface, and receiving the outgoing packet copied from the transmission interface through the preset outgoing interface; or

When the inbound packet is copied from the transmission interface and the outgoing packet is copied from the transmission interface, the corresponding inbound and outbound packets are added to the inbound and outbound packets to distinguish between the inbound and outbound packets.

The disclosed method can also include:

When the corresponding flow direction information is added to the obtained inbound packet and the outgoing packet, the inbound packet and the outgoing packet are added to the flow direction information.

Before the matching of the specific part of the inbound packet with the specific part of the outgoing packet, the method further includes: decapsulating the encapsulated inbound packet containing the flow direction information and the encapsulated outgoing packet containing the flow direction information.

The specific part of the inbound packet is a packet field that should not change in the incoming packet. The specific part of the outgoing packet is a packet field that should not change in the outgoing packet. The message field that should not change can be the source address, the destination address, or the packet length.

Optionally, the encapsulation of the inbound and outbound packets respectively adding the corresponding flow information includes: performing Generic Routing Encapsulation on the inbound and outbound packets respectively adding the corresponding flow information. GRE) or User Datagram Protocol (UDP) encapsulation.

When the network device is an electrical device, the inbound packet and the outgoing packet transmitted by the detected network are copied by configuring the network device of the detected network;

When the network device is an optical interface device, the inbound packet and the outgoing packet transmitted by the detected network are split and replicated by the optical splitter of the detected network.

The electrical interface is a network cable interface, and the optical interface is a fiber interface.

In step 110, a specific part of the incoming message is matched with a specific part of the outgoing message to determine whether the message is in error.

The matching may be that each field of a specific part of the inbound packet of the same network device is compared with each field of the specific part of the outgoing message, and each field of the specific part of the incoming message of the same network device and The match is successful if each field of the specific part of the outgoing message is the same.

The method of the present disclosure further includes: adjusting, according to the packet that determines the error, the network device involved in the error message.

In the method, the inbound packet and the outgoing packet are obtained by using the inbound interface and the outgoing interface to distinguish the inbound packet from the outgoing packet.

Matching a particular portion of the incoming message with a particular portion of the outgoing message may include:

Matching the content of a particular part of the incoming message with the content of a particular part of the outgoing message; or,

Extracting feature values of the content of the specific part of the incoming message and the feature value of the content of the specific part of the outgoing message;

The feature value of the content of the extracted specific portion of the incoming message is matched with the feature value of the content of the extracted specific portion of the outgoing message.

Before the matching of the specific part of the incoming message with the specific part of the outgoing message, the method of the disclosure may further include:

Filtering outgoing packets sent by the detected network and incoming packets sent to the detected network.

The method of the present disclosure further includes at least one of the following before matching a particular portion of the incoming message with a particular portion of the outgoing message:

Filtering packets transmitted by the detected network multicast; and

Filtering the message transmitted by the detected network broadcast.

The outgoing packets sent by the detected network and the incoming packets sent to the detected network can be differentiated and identified by the following methods:

Determining, by the source address, whether an outgoing message is actively sent by the detected network;

The destination address is used to determine whether it is an inbound message sent to the detected network.

Matching a specific part of the incoming message with a specific part of the outgoing message includes:

When in a non-network address translation (NAT) scenario, a specific portion of the same incoming message of at least one of the source address and the destination address is matched with a specific portion of the outgoing message;

When in the NAT scenario, the source address of the incoming packet, the destination address of the incoming packet, the source address of the outgoing packet, the destination address of the outgoing packet, the local address in the NAT scenario, and the global The address mapping entry determines the source address and the destination address of the obtained inbound packet and the outgoing packet, and selects the inbound packet and the outgoing packet corresponding to the source address and the destination address of the mapping. A match between a particular portion of the message and a particular portion of the outgoing message.

When the packet transmitted by the detected network is a common packet, the method of the disclosure may further include: performing packet learning on the content of the distinguishing field included in the specific part of the incoming packet and the content of the distinguishing field included in the specific part of the outgoing packet. ;

If the distinguishing field included in the specific part of the incoming packet and the distinguishing field included in the specific part of the outgoing packet match in the result of the packet learning, it is determined that the packet does not have an error; if the result of the packet learning is Determining that the distinguishing field included in the specific part of the packet does not match the distinguishing field included in the specific part of the outgoing message, and matching the specific part of the incoming message with the specific part of the outgoing message , to determine if the message is wrong.

The common packets include the address resolution protocol (ARP) packet, the IP packet, the PING protocol packet, the transmission control protocol (TCP) packet, and the UDP packet.

Optionally, the distinguishing field may include at least one of the following: a protocol, a message length, and a flag bit.

The method of the present disclosure determines whether the message is erroneous by matching a specific part of the incoming message and a specific part of the outgoing message, thereby realizing error detection of the message of the error-detected network. At the same time, according to the result of the error detection of the message, the network device is adjusted, and the communication of the network to be detected is timely adjusted to ensure the normal communication of the network.

2 is a structural diagram of an apparatus for implementing packet error detection according to the present disclosure. As shown in FIG. 2, the apparatus includes: an obtaining unit and a matching analyzing unit.

The obtaining unit is configured to acquire and distinguish the inbound packet and the outgoing packet transmitted by the detected network.

The acquisition unit can also be set to,

When the network device is an electrical device, the network device of the detected network is configured to copy the inbound packet and the outgoing packet transmitted by the detected network.

The disclosed apparatus also includes a package unit and a decapsulation unit.

When the encapsulation unit is configured to add the corresponding flow direction information to the incoming inbound packet and the outgoing packet respectively, the encapsulation packet and the outgoing packet are added to the flow direction information.

The decapsulation unit is configured to decapsulate the encapsulated inbound packet containing the flow direction information and the encapsulated outgoing message including the flow direction information before the specific part of the incoming packet is matched with the specific part of the outgoing packet. .

The detected network is a network composed of one or more network devices.

The matching analysis unit is configured to match the inbound and outgoing messages in the incoming message to determine whether the packet is in error.

The matching analysis unit may be further configured to match the content of the specific part of the incoming message with the content of the specific part of the outgoing message; or

The matching analysis unit may be further configured to: when in a non-network address translation (NAT) scenario, match a specific portion of the same incoming message with at least one of the source address and the destination address with a specific portion of the outgoing message ;as well as

When in the NAT scenario, the source address of the incoming packet, the destination address of the incoming packet, the source address of the outgoing packet, the destination address of the outgoing packet, and the local address and global address mapping in the NAT scenario. The entry determines the source address and the destination address of the inbound packet and the destination packet, and selects the inbound and outbound packets corresponding to the source and destination addresses of the mapping. Partial match to a specific part of the outgoing message.

The disclosed apparatus may also include a first filtration unit. The first filtering unit is configured to filter the outgoing message actively sent by the detected network and the incoming message sent to the detected network before the specific part of the incoming message matches the specific part of the outgoing message.

The disclosed apparatus may also include a second filter unit. The second filtering unit is configured to filter at least one of the packet transmitted by the detected network multicast and the packet transmitted by the detected network before the matching of the specific part of the incoming message with the specific part of the outgoing message. Kind of message.

The disclosed apparatus may also include a message learning unit. The packet learning unit is configured to perform packet learning on the content of the distinguishing field included in the specific part of the incoming packet and the content of the distinguishing field included in the specific part of the outgoing packet when the packet transmitted by the detected network is a common packet.

The matching analysis unit may be further configured to determine that the packet does not have an error if the distinguishing field included in the specific part of the incoming packet and the specific part included in the specific part of the outgoing packet are matched in the result of the packet learning; The distinguishing field included in the specific part of the incoming message and the distinguishing field included in the specific part of the outgoing message do not match, and the specific part of the incoming message and the specific part of the outgoing message Partially match to determine if the message is in error.

The disclosed apparatus may also include an adjustment unit. The adjusting unit is configured to determine an error message according to the matching analysis unit, and adjust the network device involved in the error message.

First embodiment

In this embodiment, when the packet is detected, the detected network may be a network composed of one or more network devices, and the network device may be a router or a switch. In this embodiment, the detected network is a network composed of a single network device, and the network device includes a first interface and a second interface. In this embodiment, the inbound and outbound packets of the first interface and the second interface of the network device are distinguished. The packet entering the network device may be copied from the first interface and the second interface, and the packet transmitted through the network device is copied from the first interface and the second interface. Optionally, the corresponding inbound interface and the outgoing interface may be set on the device that detects the error in the disclosure packet, and the copied inbound packet and the outgoing packet are separated and transmitted to the incoming interface through the set inbound interface and the outgoing interface. The device for detecting errors. In this embodiment, the network device can also be set on the device for error detection of the message. The corresponding inbound interface and the outgoing interface of the different interfaces, that is, the first inbound interface that receives the inbound packet and the inbound packet copied from the first interface and the packet that is copied out from the first interface are received on the packet error detecting device. An outgoing interface, configured to receive a second incoming interface that receives the inbound packet copied from the second interface, and receives the second outgoing interface that is copied from the second interface to the second interface; when the interface of the network device increases, the packet is detected incorrectly. The inbound interface and the outbound interface that are set to correspond to the network device interface on the device are also correspondingly increased. 3 is a flow chart of a method of the first embodiment of the present disclosure.

In step 300, the inbound message received by the network device and the outgoing outgoing message are copied.

In this step, if the network device is an electrical interface device, the network device can be configured to copy the inbound packets flowing into the first interface and the second interface, and the outgoing packets from the first interface and the second interface. If the network device is an optical interface device, the inbound packets that flow into the first interface and the second interface are split and replicated on the optical splitter, and the outgoing packets of the first interface and the second interface are split and copied.

In this embodiment, if the inbound packet and the outgoing packet are not distinguished by the inbound interface and the outgoing interface, the inbound packet and the outgoing packet may be distinguished by adding the flow direction information to the transmitted packet. For example, You can add a flow label, a flow direction identifier, or a flow direction attribute field to the transmitted message.

The method in this embodiment may further include: encapsulating an inbound packet and an outgoing packet to which the flow direction information is added, and encapsulating the inbound packet, when the corresponding inbound packet is added to the inbound packet and the outgoing packet. Before the specific part of the packet is matched with the specific part of the outgoing message, the encapsulated incoming message containing the flow direction information and the encapsulated outgoing message containing the flow direction information are decapsulated.

The encapsulation method in this embodiment may be a GRE or UDP encapsulation or the like.

In step 310, a specific part of the incoming message is matched with a specific part of the outgoing message to determine whether the message is in error.

When the inbound packet and the outgoing packet are transmitted through the network device, the specific part of the incoming packet and the specific part of the outgoing packet are from the inflow network device to the outgoing network device, and the content of the specific part and the content of the specific part are not allowed. Changed. If there is no link problem in the network, the content of the specific part of the incoming message is the same as the content of the specific part of the outgoing message. If the content of a specific part is consistent with the content of a specific part, the match is passed, and it is determined that no error has occurred in the message. For example, suppose that the content of a specific part of the incoming message transmitted by the network device and the content of the specific part of the outgoing message should be [0x10, 0x20, 0x30], and the device that detects the error of the packet obtains the specificity of an incoming message. When the content of the part is [0x10, 0x20, 0x30], it is determined that the specific part of the incoming message contains the content and the specific part of the outgoing message contains The content is consistent, so that the message does not have an error. If the specific part of the obtained outgoing message becomes [0x10, 0x20, 0x31], the device that detects the error of the packet cannot match the outgoing packet with the same part of the incoming packet, and determines that the packet has an error. . Different types of packets may be different in the specific part of the packet when the network device transmits. The changed part refers to the content of the packet except the specific part, such as the time-to-live value (TTL) field of the IP packet. The network device will be legally modified during transmission (the network device can be a router at this time).

Matching a particular portion of the incoming message with a particular portion of the outgoing message may be a comparison of the content of the particular portion of the incoming message with the content of the particular portion of the outgoing message. For example, loading the content of a particular portion of the incoming message into the first list loads the content of the particular portion of the outgoing message into the second list. The content of a specific part and the content of a specific part may be loaded into the list according to time sorting, and when the specific part of the same time is compared with the specific part, the content of the specific part of the outgoing message in the second list is extracted one by one. The content of a specific part of the inbound message in a list is matched, and if the matching is successful, it is determined that the message does not have an error. If the specific part of the outgoing message in the second list does not match the content of the specific part of the inbound message that is the same as the specific part of the outgoing message, the packet is determined to have an error. The method in this embodiment may also perform matching by extracting content of a specific part of the incoming message in the first list and a specific part of the second list.

The matching of the specific part of the incoming message with the specific part of the outgoing message may also be performed by extracting the feature value separately from the content of the specific part of the incoming message and the content of the specific part of the outgoing message, and then extracting the incoming direction The feature value of the content of the specific part of the message is matched with the feature value of the content of the outgoing message part, and the matching of the feature value is determined to determine whether the specific part of the incoming message is the same as the specific part of the outgoing message, and the feature value is adopted. The method of matching can improve the efficiency of the matching process. The eigenvalues of the packets and the packets are in the matching process. The hash calculation is used as an example. The eigenvalues corresponding to the packets and packets can pass the VALUE and KEY values of the packets in the hash table. The storage is performed separately, and the VALUE value is successfully matched according to the matching of the KEY value, thereby determining that the message is successfully matched.

Optionally, the method of extracting the feature value may be implemented by calculating a hash value.

In this embodiment, the eigenvalues of the packets transmitted by the detected network are extracted, and the inbound packets and the outgoing packets are distinguished by the eigenvalues, and the eigenvalues are matched to determine whether the packets have errors.

When the method of calculating the hash value is used to match the specific part of the inbound packet with the specific part of the outgoing packet, the method in this embodiment further includes:

At least one of the packet length, the source address, the destination address, the source port, and the destination port is matched as a feature value.

At least one of the packet length, the source address, the destination address, the source port, and the destination port is used as the feature value for matching. When the hash calculation is performed on different packets, the obtained hash value can be reduced. The transmission control protocol (TCP) packet or the user datagram protocol (UDP) packet can be matched by using at least one of the source port and the destination port as the feature value. In addition, when the packet is hashed, if the packet is long, the packet may be segmented and hashed, and the hash value calculated by the segmentation may be used as the feature value of the packet, and may be performed according to the feature value. A match between a specific part of the incoming message and a specific part of the outgoing message.

The obtained outgoing packet and the incoming packet may be delayed. The time of the obtained outgoing packet may be earlier than the time when the incoming packet is obtained. The method of the disclosure may further include: after the preset duration, re-entry the incoming packet. A match between a particular part of the text and a particular part of the outgoing message.

In this embodiment, before performing the matching between the specific part of the incoming packet and the specific part of the outgoing packet, the method in this embodiment may further include sending the outgoing packet sent by the network device and the incoming report sent to the network device. The text is distinguished by exclusion.

The outbound packet sent by the network device can be an administrative maintenance packet. The IP address can be used as the management system address to determine whether the outgoing packet is an administrative maintenance packet. The inbound packet sent to the detected device itself may be a packet sent by the management system to the network device. At this time, it is determined whether the incoming packet is a packet sent by the management system to the network device according to the destination address, for example, the IP address is an IP address of the network device itself.

Second embodiment

The apparatus for error detection of the message in this embodiment includes an obtaining unit and a matching analyzing unit, and the obtaining unit is connected to each interface of the detected network. The detected network may be a network device or a network composed of two or more network devices. 4 is a flow chart of a method of a second embodiment of the present disclosure.

In step 400, the acquiring unit acquires and distinguishes the inbound packet and the outgoing packet transmitted by the detected network.

In step 410, the acquiring unit performs feature value extraction on the specific part of the obtained inbound message and the specific part of the outgoing message.

In step 420, the acquiring unit extracts the feature value and the outgoing message extracted from the specific part of the incoming message. The feature values extracted by the specific part are sent to the matching analysis unit.

In this embodiment, the acquiring unit may obtain the feature value of the packet of each interface, and extract the feature value of the content of the specific part of the incoming message and the feature value of the content of the specific part of the outgoing message. The value is sent to the matching analysis unit.

Optionally, when sending the feature value, the flow direction information may be added to the message. For example, the attribute data is added to the packet to identify the flow direction, and the packet after the identifier is added is encapsulated and transmitted.

In step 430, the analysis matching unit matches the feature value of the content of the specific part of the received incoming message with the feature value extracted by the content of the specific part of the outgoing message to determine whether the message has an error.

Third embodiment

In this embodiment, the method of the present disclosure is described by taking the case where the area A, the area B, and the area C transmit the message through the detected network. FIG. 5 is a schematic diagram of a network topology of a packet passing through a detected network according to a third embodiment of the present disclosure. As shown in FIG. 5, for the area A, the packet flow direction includes the area A to the area B, the area A to the area C, the area B to the area A, and the area C to the area A. By locating the flow of incoming packets and outgoing packets, the range of matching during packet detection can be reduced, and the efficiency of packet error detection can be improved. The packet flow direction can be determined by the source address and destination address, or configuration information.

In the case of a network address translation (NAT) scenario, the packet needs to match when the packet flows to the source and destination addresses as an example to match the specific part of the incoming packet with the specific part of the outgoing packet. After the outgoing packet, the incoming packet is filtered according to the source address and the destination address of the outgoing packet, and the inbound packet with the same source address and destination address is obtained after the outgoing packet is sent to the specific part of the incoming packet. Matches to a specific part of the outgoing message. If the inbound packet is to be matched, the outbound packet is filtered according to the source and destination addresses of the incoming packet, and the outgoing packet with the same source address and destination address is obtained. The match between a particular part and a specific part of the incoming message. If the matching feature value is used for matching, the eigenvalue calculation is performed on the source address and the destination address of the incoming packet and the outgoing packet, and the eigenvalue pair of the source address and the destination address are calculated. Or filter out the message.

In the NAT scenario, the source address and destination address are copied to the inbound interface and the outbound interface of the analysis matching unit. The local address and global address mapping entries in the NAT scenario are modified. Therefore, the source address and destination address cannot be passed. Filtering in the same way. If you need to perform filtering, you can obtain the local address and global address mapping entries in the NAT scenario to obtain the inbound packets based on the mapping entries. Source and destination addresses before or after copying.

Fourth embodiment

When matching packets, if the number of packets is too large, the matching efficiency is too low. You can improve the matching efficiency by learning common messages. The number of common packets is large, the content is relatively fixed, and the probability of abnormal packets is low.

In this embodiment, the message learning may learn a special distinguishing field in a specific part of the incoming message and a special distinguishing field in a specific part of the outgoing message. The special distinguishing field may include at least one of a protocol, a message length, and a flag bit. For example, a large number of TCP SYN packets carry almost the same parameters, such as packet length and SYN flag. Among them, SYN is the flag field of the TCP layer, and SYN is the flag for establishing a connection. In this embodiment, after acquiring the specific part of the incoming message and the specific part of the outgoing message, the acquiring unit extracts at least one of the protocol, the packet length, and the flag bit; and extracts the specific part of the incoming message. The distinguishing field and the distinguishing field extracted from the specific part of the outgoing packet are matched after the packet learning; the matching is successful, and the packet is not found to have an error; if the matching fails, the packet is not a common packet, and the first embodiment is used. The method matches a specific part of the incoming message with a specific part of the outgoing message to determine whether the packet has an error.

Whether the packet learning of distinguishing fields can be determined according to the frequency and quantity of occurrence of such packets. When the message learning is performed, the message learning is automatically triggered once the part of the message is detected.

FIG. 6 is a flowchart of a method according to a fourth embodiment of the present disclosure. As shown in FIG. 6, the method includes:

In step 600, the inbound packet and the outgoing packet transmitted by the detected network are obtained and distinguished.

The obtaining of the inbound message and the outgoing message may further include: acquiring the feature value of the incoming message and the feature value of the outgoing message, or copying the specific part of the incoming message and the specific part of the outgoing message.

The method of distinguishing the inbound and outbound packets can be implemented by using the inbound and outbound interfaces respectively through the corresponding inbound interface and the outgoing interface, or by adding flow information to the packet, for example, adding a differentiated flow. Property information is implemented.

In step 610, a distinguishing field in a specific part of the incoming message and a specific part of the outgoing message is extracted, and packet learning is performed on the distinguished field.

In step 620, the distinguishing fields of the packet learning are matched. If the matching is successful, step 630 is performed; if the matching fails, step 640 is performed.

In step 630, it is determined that no error has occurred in the message.

In step 640, a specific part of the incoming message and a specific part of the outgoing message are matched to determine whether the message has an error.

The inbound packet and the outgoing packet of the packet detection in this embodiment do not include the packet sent to the detected network and the packet sent by the detected network.

Fifth embodiment

In this embodiment, packet error detection processing is performed on a packet that is multicast-transmitted during the matching process or a packet that is transmitted by the broadcast. If the incoming packet and the outgoing packet are not multicast packets or broadcast packets, the network device will cause the outgoing packets of the multiple interfaces to be the same as the incoming packets. System network resources cause a lot of waste, and it is also easy to cause network congestion. Therefore, the case where the incoming message and the outgoing message are multicast-transmitted messages or broadcast-transmitted messages need to be distinguished from the case where the packets are erroneous.

In this embodiment, the destination address and the mask information can be used to determine whether the inbound packet and the outgoing packet are multicast transmission packets or broadcast transmission packets. When the inbound packet and the outgoing packet are determined to be multicast, When a transmitted message or a broadcasted message is received, it is determined that the message is not error. Mask information can be obtained through a configuration file. If it is determined that the inbound packet and the outgoing packet are neither the multicast transmission nor the broadcast transmission, the packet detection may be performed according to the technical solution of the disclosure, and the specific part of the incoming packet is When a specific part of the outgoing packet matches, the packet can be judged to be an error message.

The present disclosure also provides a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the method of implementing message error detection in any of the above embodiments.

The present disclosure also provides a hardware structure diagram of an electronic device. Referring to FIG. 7, the electronic device includes:

At least one processor 701, which is exemplified by a processor 701 in FIG. 7; and a memory 702, may further include a communications interface 704 and a bus 703. The processor 701, the communication interface 704, and the memory 703 can complete communication with each other through the bus 703. Communication interface 704 can be used for information transfer. The processor 701 can call logic instructions in the memory 702 to perform the above method.

Moreover, the logic instructions in the memory 702 described above may be implemented in the form of software functional units and sold or used as separate products, and may be stored in a computer readable storage medium.

The memory 702 is a computer readable storage medium that can be configured to store software programs, calculations The machine executable program, such as the program instruction or module corresponding to the method in the embodiment of the present disclosure. The processor 701 performs a function application and data processing by executing a software program, an instruction, or a module stored in the memory 702, that is, a method of implementing message error detection.

The memory 702 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the terminal device, and the like. Further, the memory 702 may include a high speed random access memory, and may also include a nonvolatile memory.

The technical solution of the present disclosure may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) Performing all or part of the steps of the method of the embodiments of the present disclosure. The foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, a mobile hard disk, a read only memory (Read Only Memory ROM), a random access memory (RAM), a magnetic disk, or an optical disk. A medium that can store program code or a transient storage medium.

Industrial applicability

The method and device for implementing packet error detection provided by the present disclosure determine whether a packet is in error by matching a specific part of an incoming message with a specific part of an outgoing message, and realizing error detection of a packet of the error-detected network. .

Claims

A method for implementing packet error detection, including:

Obtaining and distinguishing between the inbound packet and the outgoing packet transmitted by the detected network;

Matching a specific part of the inbound message with a specific part of the outgoing message to determine whether the message is in error;

The detected network is a network composed of one or more network devices.
The method according to claim 1, wherein the obtaining and distinguishing between the inbound message and the outgoing message transmitted by the detected network comprises:

Receiving, by the preset inbound interface, the inbound packet copied from the transmission interface, and receiving the outgoing packet copied from the transmission interface by using a preset outgoing interface; or

And obtaining, when the inbound packet copied from the transmission interface and the outgoing packet copied from the transmission interface, adding corresponding flow direction information to the obtained incoming packet and the outgoing packet, respectively, to distinguish Describe the incoming message and the outgoing message.
The method according to claim 1, wherein the obtaining and distinguishing between the inbound message and the outgoing message transmitted by the detected network comprises:

When the network device is an electrical interface device, the inbound packet and the outgoing packet transmitted by the detected network are copied by configuring the network device of the detected network;

And when the network device is an optical port device, the inbound packet and the outgoing packet transmitted by the detected network are split and replicated by the optical splitter of the detected network.
The method of claim 2, wherein the method further comprises:

When the corresponding flow direction information is added to the obtained inbound packet and the outgoing packet respectively, the inbound packet and the outgoing packet to which the flow direction information is added are encapsulated;

Before the matching the specific part of the inbound packet with the specific part of the outgoing packet, the method further includes: encapsulating the inbound packet containing the flow direction information and encapsulating the flow direction message The outbound message of the message is decapsulated.
The method of claim 4, wherein the encapsulating the inbound packet and the outgoing packet respectively adding the corresponding flow direction information comprises:

The inbound and outgoing packets of the respective flow direction information are respectively encapsulated into a general route encapsulation GRE or a user datagram protocol UDP encapsulation.
The method according to any one of claims 1 to 5, wherein the matching the specific part of the incoming message with the specific part of the outgoing message comprises:

Matching the content of the specific portion of the incoming message with the content of the specific portion of the outgoing message; or

Extracting a feature value of the content of the specific portion of the incoming message and a feature value of the content of the specific portion of the outgoing message; and extracting the extracted feature value of the content of the specific portion of the incoming message The feature values of the content of the specific part of the outgoing message are matched.
The method according to any one of claims 1 to 5, before the matching of the specific part of the incoming message with the specific part of the outgoing message, the method further includes:

And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network.
The method according to any one of claims 1 to 5, before the matching of the specific part of the incoming message with the specific part of the outgoing message, the method further comprising at least one of the following:

Filtering the packet transmitted by the detected network multicast; and

Filtering the message transmitted by the detected network broadcast.
The method according to any one of claims 1 to 5, wherein the matching the specific part of the incoming message with the specific part of the outgoing message comprises:

When in a non-network address translation NAT scenario, at least one of the source address and the destination address is the same. Matching a particular portion of the incoming message with a particular portion of the outgoing message;

When in the NAT scenario, the source address of the incoming packet, the destination address of the incoming packet, the source address of the outgoing packet, the destination address of the outgoing packet, and the local address in the NAT scenario. And the global address mapping entry, determining the source address and the destination address of the obtained inbound packet and the outgoing packet, and selecting the inbound packet and the outgoing packet corresponding to the source address and the destination address of the mapping. And matching a specific part of the incoming message with a specific part of the outgoing message.
The method according to any one of claims 1 to 5, when the packet transmitted by the detected network is a common packet, the method further includes: a distinguishing field included in a specific part of the incoming packet The content and the content of the distinguishing field included in the specific part of the outgoing message are used for message learning;

If the distinguishing field included in the specific part of the incoming packet and the distinguishing field included in the specific part of the outgoing packet match in the result of the packet learning, it is determined that the packet does not have an error; if the result of the packet learning is Determining that the distinguishing field included in the specific part of the packet does not match the distinguishing field included in the specific part of the outgoing message, and matching the specific part of the incoming message with the specific part of the outgoing message, Determine if the message is in error.
The method of claim 10, wherein the distinguishing field comprises at least one of: a protocol, a message length, and a flag bit.
The method according to any one of claims 1 to 5, further comprising: adjusting a network device involved in the error message according to the packet determining the error.
A device for implementing message error detection, comprising:

An obtaining unit, configured to acquire and distinguish between an inbound message and an outgoing message transmitted by the detected network;

The matching analysis unit is configured to match a specific part of the inbound message with a specific part of the outgoing message to determine whether the message is in error;

The detected network is a network composed of one or more network devices.
The apparatus according to claim 13, wherein said acquisition unit is configured to

Receiving the copied incoming message through a preset inbound interface, and receiving the copied outgoing message through a preset outgoing interface; or

When the inbound packet and the outgoing packet are obtained, corresponding flow direction information is added to the obtained inbound packet and the outgoing packet to distinguish the inbound packet from the outbound packet. Text.
The apparatus according to claim 13, wherein said acquisition unit is configured to

When the network device is an electrical interface device, the inbound packet and the outgoing packet transmitted by the detected network are copied by configuring the network device of the detected network;

And when the network device is an optical port device, the inbound packet and the outgoing packet transmitted by the detected network are split and replicated by the optical splitter of the detected network.
The device of claim 14, the device further comprising:

The encapsulating unit is configured to, when adding the corresponding flow direction information to the obtained inbound packet and the outgoing packet respectively, encapsulating the inbound packet and the outgoing packet to which the flow direction information is added;

And a decapsulation unit, configured to: before the matching the specific part of the inbound message with the specific part of the outgoing message, the inbound message containing the flow direction information and the encapsulated outgoing direction including the flow direction information The message is decapsulated.
The apparatus according to any one of claims 13 to 16, wherein the matching analysis unit is configured to

Matching the content of the specific portion of the incoming message with the content of the specific portion of the outgoing message; or

Extracting a feature value of the content of the specific portion of the incoming message and a feature value of the content of the specific portion of the outgoing message; and extracting the feature value of the content of the extracted specific portion of the incoming message The feature values of the content of the specific part of the outgoing message are matched.
The apparatus according to any one of claims 13 to 16, further comprising a first filtering unit configured to filter a specific portion of the incoming message before matching with a specific portion of the outgoing message An outgoing packet actively sent by the detected network and an incoming packet sent to the detected network.
The apparatus according to any one of claims 13 to 16, further comprising a second filtering unit configured to filter a specific portion of the incoming message before matching with a specific portion of the outgoing message At least one of the packet transmitted by the detected network multicast and the packet transmitted by the detected network broadcast.
The apparatus according to any one of claims 13 to 16, wherein the matching analysis unit is configured to

When the non-network address translation NAT scenario is performed, the specific part of the inbound message that is at least one of the source address and the destination address is matched with the specific part of the outgoing message;

When the NAT is in the NAT scenario, the source address of the incoming packet, the destination address of the incoming packet, the source address of the outgoing packet, the destination address of the outgoing packet, and the local address in the NAT scenario. The global address mapping entry determines the source address and the destination address of the obtained inbound packet and the outgoing packet, and selects the inbound packet and the outgoing packet corresponding to the source address and the destination address of the mapping. Performing a match between a specific portion of the incoming message and a specific portion of the outgoing message.
The device according to any one of claims 13 to 16, further comprising a message learning unit, configured to: when the message transmitted by the detected network is a common message, to the incoming message The content of the distinguishing field included in the specific part and the content of the distinguishing field included in the specific part of the outgoing message are used for message learning;

The matching analysis unit is further configured to: if the result of the message learning enters a specific part of the message The included distinguishing field matches the distinguishing field included in the specific part of the outgoing message, and determines that the packet does not have an error; if the packet learning result includes the distinguishing field and the outgoing message included in the specific part of the incoming message The specific part of the specific part does not match, and the specific part of the inbound message is matched with the specific part of the outgoing message to determine whether the message is in error.
The apparatus according to any one of claims 13 to 16, further comprising an adjustment unit configured to determine an error message according to the matching analysis unit to adjust a network device involved in the error message.
A non-transitory computer readable storage medium storing computer executable instructions arranged to perform the method of any of claims 1-12.