WO2017118430A1 - Procédé et dispositif pour une détection d'erreur de paquet - Google Patents

Procédé et dispositif pour une détection d'erreur de paquet Download PDF

Info

Publication number
WO2017118430A1
WO2017118430A1 PCT/CN2017/070507 CN2017070507W WO2017118430A1 WO 2017118430 A1 WO2017118430 A1 WO 2017118430A1 CN 2017070507 W CN2017070507 W CN 2017070507W WO 2017118430 A1 WO2017118430 A1 WO 2017118430A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
packet
outgoing
inbound
packets
Prior art date
Application number
PCT/CN2017/070507
Other languages
English (en)
Chinese (zh)
Inventor
吕正勇
刘佳
骆文
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017118430A1 publication Critical patent/WO2017118430A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors

Definitions

  • the present disclosure relates to the field of data communications, for example, to a method and apparatus for implementing message error detection.
  • Network devices of a wide variety and quantity in networks such as carrier networks, enterprise networks, and Internet networks, such as broadband remote access server (BRAS) devices, access/core router devices, and access/core switch devices , three-layer switch equipment and various optical network equipment.
  • BRAS broadband remote access server
  • These network devices run IP network protocols and build a world based on IP network protocols by interconnecting them.
  • BRAS broadband remote access server
  • BRAS broadband remote access server
  • the communication link with area C the communication link between area A and area B, the packet field that should not change due to the IP link problem such as high packet loss rate of the router or switch, system problem, etc.
  • the above system problem may be caused by the failure of the system software or hardware, or the external environment affecting the system performance (such as electromagnetic interference) and other factors affecting the normal transmission of the message. If the message field that should not be changed is changed, for example, the IP address field is modified, the message will be delivered to the wrong destination address, and finally discarded as a bad packet, affecting the normal communication of the network.
  • the network size When the network size is small, after an error packet is found, it can be judged by experienced technicians whether the network device may have problems. Restart the network device that may be faulty, reconnect the network, or replace the network device. And other methods to solve the problem of packet error.
  • the network size is increased to a certain extent, it is very difficult to determine whether the packet has an error.
  • the accuracy of the judgment based on the error packet based on the experience of the network device is greatly reduced.
  • One attempt, and each attempt may cause a complete network interruption, affecting the normal communication of the network. For large-scale Internet networks, it is very difficult to determine the error of a message.
  • the present disclosure provides a method and apparatus for implementing packet error detection, which can It is enough to determine whether an error has occurred in the message when the network size is increased.
  • the present disclosure provides a method for implementing packet error detection, including:
  • the decomposed data block is distributed to two or more pre-established analysis nodes;
  • Each analysis node matches the inbound packet and the outgoing packet in the inbound packet to the data packet that is distributed to itself, and determines the packet that is not in error;
  • the inbound and outbound packets remaining in addition to the packets that are not erroneous are re-allocated according to the preset policy, and the inbound and outbound packets are continued.
  • the matching of the changed part should not occur until all the packets that do not match successfully are in the same analysis node, and it is determined that the packet with no matching success is incorrect.
  • the detected network is a network of one or more network devices.
  • the obtaining the inbound packet and the outgoing packet sent by the detected network may include:
  • the inbound message and the outgoing message are configured to be copied on the network device of the detected network;
  • the optical splitting of the incoming packet and the outgoing packet is performed by the optical splitter of the detected network.
  • storing the inbound packet and the outgoing packet that are transmitted by the detected network may include:
  • the obtained inbound message and the outgoing message are respectively stored in the form of a binary file.
  • the stored inbound packet and the outgoing packet are respectively decomposed into corresponding data blocks, which may include:
  • the stored outgoing message is decomposed into corresponding data blocks according to a preset fixed value or a preset interval value.
  • the stored inbound packet and the outgoing packet are respectively decomposed into corresponding data blocks, which may include:
  • the current data block size is greater than a minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the next report.
  • the data block of the text is used as a decomposed data block.
  • the re-assignment of the inbound and outbound packets, except for the packets that are not in error, according to the preset policy may include:
  • one or more analysis nodes are sequentially selected, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes.
  • the method further includes: distinguishing each packet in the data block.
  • the distinguishing between the packets in the data block may include:
  • each packet in the data block is distinguished by the length of the recorded packet.
  • the inbound packet and the outgoing packet are not changed, and may include:
  • the method before determining that an unmatched packet has an error, the method further includes:
  • the method further includes: performing packet learning on the content of the differentiated field included in the incoming packet and the outgoing packet that should not be changed;
  • the packet learning result obtained by obtaining the content of the distinguishing field included in the incoming message and the outgoing message should not be changed in the incoming message and the outgoing message in the message learning result.
  • the packets matching the matching fields are filtered, and the matching of the changed packets in the incoming packets and the outgoing packets is performed on the remaining packets.
  • determining the message that is not in error may include:
  • Each analysis node performs hash mapping and reduction calculation on the inbound message and the outgoing message respectively included in the data block distributed to itself;
  • the inbound and outbound packets of the inbound and outbound packets that are used for the mapping and the grammar calculations are not matched in the inbound and outbound packets, and the inbound and outbound packets corresponding to the successfully matched key-value pairs are determined.
  • the text is a message that has not gone wrong.
  • culling the determined unerrored message may include:
  • the inbound packet and the outgoing packet that are sent by the detected network are sent to the inbound packet and the outgoing packet that are transmitted by the detected network in the preset time span.
  • the method further includes:
  • the packets whose time attributes in the time interval TR are not matched in the current time span are detected, and are stored in the inbound and outgoing packets of the detected network stored in the next time span T. In the middle, the message is checked.
  • the method further includes: distinguishing the inbound message and the outgoing message.
  • the present disclosure further provides a system for implementing packet error detection, including: a processing device and two or more analysis nodes; wherein
  • the processing device includes: a storage unit, a decomposition distribution unit, and a re-segment unit; wherein
  • Obtaining a storage unit configured to acquire and store an inbound message and an outgoing message transmitted by the detected network
  • the decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;
  • the re-segment unit is configured to re-allocate the remaining inbound packets and the outgoing packets in addition to the packets that are determined to be in error according to the preset policy.
  • Each analysis node includes a matching unit, a culling unit, and a determining unit;
  • the matching unit is configured to perform an inbound message and an outgoing message in the data block distributed to itself.
  • the part that should not be changed should be matched to determine the message that has not been erroneous;
  • a culling unit configured to reject the determined unerrored message
  • the determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that are not successfully matched are incorrect.
  • the detected network is a network of one or more network devices.
  • the disclosure further provides a processing device for implementing packet error detection, comprising: acquiring a storage unit, decomposing a distribution unit, and a re-segment unit;
  • Obtaining a storage unit configured to acquire and store an inbound message and an outgoing message transmitted by the detected network
  • the decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;
  • the re-segment unit is configured to re-allocate the remaining inbound packets and the outgoing packets in addition to the packets that are determined to be in error according to the preset policy.
  • the obtaining storage unit can be configured as,
  • the inbound packet and the outgoing packet are configured to be copied on the network device of the detected network, and the inbound packet transmitted by the detected detected network is configured.
  • Outbound message storage
  • the optical splitter of the detected network performs the optical splitting of the incoming packet and the outgoing packet, and the inbound packet transmitted by the detected network of the split optical replica is transmitted. And outgoing messages are stored.
  • the obtaining storage unit can be configured as,
  • the inbound packet and the outgoing packet transmitted by the detected network are obtained, and the obtained incoming packet and the outgoing packet are respectively stored in the form of a binary file.
  • the decomposition distribution unit can be configured to
  • the decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.
  • the decomposition distribution unit can be configured to
  • the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data after the complementary digital processing is completed
  • the block size is equal to the preset fixed value, and the data block that completes the digital processing is used as the decomposed data block;
  • the current data block size is greater than a minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the next report.
  • the data block of the text is used as a decomposed data block;
  • the decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.
  • the processing device further includes a distinguishing unit configured to distinguish each of the packets in the data block.
  • the distinguishing unit can be configured to
  • each packet in the data block is distinguished by the length of the recorded packet.
  • the re-segment unit may be configured to: after rejecting the error-free message determined by each analysis node, select one or more analysis nodes one by one, and select the remaining inbound message and the outgoing direction of the selected analysis node. Messages are distributed to other analysis nodes.
  • the inbound packet and the outgoing packet sent by the detected network are inbound packets and outgoing packets transmitted by the detected network within a preset time span
  • the processing device further includes a boundary processing unit configured to The packets whose time attributes in the time interval TR are not matched in the current time span are detected, and are stored in the inbound and outgoing packets of the detected network stored in the next time span T. In the middle, the message is checked.
  • the processing device further includes an inbound and outbound distinguishing unit configured to distinguish the inbound message from the outgoing message.
  • the disclosure further provides an analysis node that implements packet error detection, including a matching unit, a culling unit, and a determining unit;
  • the matching unit is configured to perform inbound and outbound messages on the received data block.
  • the change part is matched to determine the message that has not been erroneous;
  • a culling unit configured to reject the determined unerrored message
  • the determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that do not match successfully are incorrect.
  • the matching unit may be configured to, for the inbound message and the outgoing message in the data block distributed to itself,
  • the analyzing node further includes a filtering unit, configured to filter an outgoing message actively sent by the detected network and an incoming report sent to the detected network before determining that a packet that is not successfully matched has an error. Text.
  • a filtering unit configured to filter an outgoing message actively sent by the detected network and an incoming report sent to the detected network before determining that a packet that is not successfully matched has an error. Text.
  • the analysis node further includes a message learning unit and a learning filtering unit.
  • the message learning unit is configured to: when the common message of the packet transmitted by the detected network is used, perform packet learning on the content of the distinguishing field included in the incoming message and the outgoing message;
  • the learning filtering unit is configured to obtain the packet learning result of the distinguishing field content included in the incoming message and the outgoing message, and should not be included in the incoming message and the outgoing message in the message learning result.
  • the packet that matches the matching field included in the changed part is filtered, and the remaining packets are sent to the matching unit to perform matching in the incoming packet and the outgoing packet.
  • the matching unit can be configured to
  • the inbound and outbound packets of the inbound and outbound packets that are used for the mapping and the grammar calculations are not matched in the inbound and outbound packets, and the inbound and outbound packets corresponding to the successfully matched key-value pairs are determined.
  • the text is a message that has not gone wrong.
  • the culling unit may be configured to determine the matching according to the hash calculated mapping The position of the corresponding inbound message and the outgoing message in the data block of the successful key value pair is subjected to the culling process.
  • the present disclosure also provides a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the above method.
  • the present disclosure also provides an electronic device, including:
  • At least one processor At least one processor
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the method described above.
  • the technical solution of the present disclosure includes: separately decomposing the stored inbound message and the outgoing message into corresponding data blocks, and distributing the two to two or more analysis nodes that are pre-established; The data block that is distributed to itself is matched with the non-changing part of the incoming message and the outgoing message, and the error-free message is determined; the remaining inbound direction except the message that determines the error is re-allocated according to the preset policy. Packets and outgoing packets, and the matching between the incoming packets and the outgoing packets should not be changed until all the packets that are not successfully matched are in the same analysis node. .
  • the disclosed method performs matching of the portion that should not be changed, thereby realizing the detection of the error message.
  • FIG. 1 is a flowchart of a method for implementing packet error detection according to the present disclosure
  • FIG. 2 is a structural diagram of a system for implementing packet error detection according to the present disclosure
  • FIG. 3 is a structural block diagram of a processing apparatus for implementing packet error detection according to the present disclosure
  • FIG. 4 is a structural block diagram of an analysis node for implementing packet error detection according to the present disclosure
  • Figure 5 is a flowchart of a method of the first embodiment of the present disclosure
  • Figure 6 is a flow chart of a method according to a second embodiment of the present disclosure.
  • Figure 7 is a flowchart of a method of a third embodiment of the present disclosure.
  • Figure 8 is a flow chart of a method according to a fourth embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.
  • FIG. 1 is a flowchart of a method for implementing packet error detection according to the present disclosure. As shown in FIG. 1, the method includes:
  • Step 100 Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.
  • the detected network is a network composed of one or more network devices.
  • the inbound and outbound packets transmitted by the detected network may be obtained, and may include:
  • the inbound and outbound packets and the outgoing packets are configured on the network device of the detected network.
  • the optical splitting of the incoming packet and the outgoing packet is performed by the optical splitter of the detected network.
  • Storing the inbound and outbound packets transmitted by the detected network may include:
  • the obtained inbound message and outgoing message are stored in the form of a binary file.
  • Step 101 Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;
  • the stored inbound packet and the outgoing packet are respectively decomposed into corresponding data blocks, which may include:
  • the stored outgoing message is decomposed into corresponding data blocks according to a preset fixed value or a preset interval value.
  • Decomposing the stored inbound and outbound packets into corresponding data blocks, respectively, may include:
  • the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data block size after the completion of the complementary digital processing is equal to the pre- A fixed value is set, and the data block that completes the digital processing is used as the decomposed data block; or
  • the current data block size is greater than the minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the data block of the next message. As a decomposed data block.
  • next message refers to the corresponding incoming message or outgoing message, that is, the data block of the incoming message.
  • the next message must be an incoming message, and the next block of the outgoing message must be an outgoing message.
  • Step 102 Each analysis node performs matching on the inbound packet and the outgoing packet in the data packet distributed to itself, and determines the packet that is not in error;
  • the incoming packet and the outgoing packet are not changed, and may include:
  • the feature value of the content of the extracted inbound message that should not be changed is matched with the feature value of the content of the extracted outgoing message that should not change.
  • the matching means that the content or the feature value is the same.
  • Identify the packets that have not gone wrong which can include:
  • Each analysis node performs hash mapping and reduction calculation on the inbound message and the outgoing message respectively included in the data block distributed to itself;
  • the inbound and outbound packets of the inbound and outbound packets that are used for the mapping and the grammar calculations are not matched in the inbound and outbound packets, and the inbound and outbound packets corresponding to the successfully matched key-value pairs are determined.
  • the text is a message that has not gone wrong.
  • Step 103 After removing the error-free packets determined by each analysis node, reallocating according to the preset policy In addition to determining the inbound and outbound messages remaining in the error-free message, and continuing the match between the incoming message and the outgoing message, the matching part should not be changed until all the unmatched messages are in the same analysis. When a node is determined, it is determined that an unmatched packet has an error.
  • the re-assignment of the inbound and outbound packets, except for the packets that are determined to be in error, according to the preset policy may include:
  • one or more analysis nodes are sequentially selected, and the remaining inbound packets and outgoing messages of the selected analysis node are distributed to other analysis nodes.
  • one or more analysis nodes may be selected one by one, and one analysis node may be selected, and the inbound and outbound messages remaining in the analysis node except the unidentified message are equally divided into other analysis nodes; You can also select two, three, half analysis nodes, and even more analysis nodes. The selected analysis nodes are divided into other analysis nodes except for the inbound packets and outgoing packets.
  • Excluding the determined unerrored messages may include:
  • the location of the corresponding incoming message and the outgoing message in the data block is determined according to the hash-calculated mapping, and the culling process is performed.
  • the mapping calculation when the mapping calculation is performed, the inbound packet and the outgoing packet are extracted from the data block and mapped into the hash list. Since the mapping calculation is required, the incoming packet and the outgoing packet are in the data block. The offset in is the default parameter.
  • the disclosed method also includes distinguishing between pieces of messages in the data block.
  • the distinguishing between the packets in the data block may include: distinguishing each incoming message in the data block of the incoming message; and sending out the outgoing message in the data block of the outgoing message. Make a distinction.
  • Differentiating each packet in a data block may include:
  • each packet in the data block is distinguished by the length of the recorded packet.
  • the disclosed method further includes:
  • the time may be set according to the network configuration and performance.
  • the method of the disclosure further includes: performing packet learning on the content of the distinguishing field included in the incoming packet and the outgoing packet that should not be changed;
  • the difference between the incoming message and the outgoing message in the incoming message should not be changed.
  • the matched packets are filtered, and the matching packets in the incoming packets and outgoing packets should not be matched in the outgoing packets.
  • the distinguished field included in the outgoing packet matches the packet indicating that the partial packet is an error.
  • the method for storing the inbound packet and the outgoing packet transmitted by the detected network is the inbound packet and the outgoing packet transmitted by the detected network in the preset time span.
  • the method further includes:
  • the packets whose time attributes in the time interval (TR) are not matched in the current time span are detected, and are stored in the inbound packet and the outgoing direction of the detected network stored in the next time span (T).
  • T is mainly calculated according to the size of the decomposed data block divided by the flow rate.
  • the data block size is mainly set according to the system performance, and the flow rate is set according to the system capacity; TR is mainly set according to the network delay condition, and the TR value is set. Generally no more than 2 minutes.
  • the method of the present disclosure may use a hash algorithm to perform matching between the inbound message and the outgoing message, and the length of the packet, the time attribute, and the offset of the message in the database during the matching process.
  • the amount can be stored by keyword.
  • the method of the present disclosure also includes: distinguishing between an incoming message and an outgoing message.
  • the disclosed method By storing, decomposing and distributing the inbound message and the outgoing message, the disclosed method performs matching of the portion that should not be changed, thereby realizing the detection of the error message.
  • FIG. 2 is a structural diagram of a system for implementing packet error detection according to the present disclosure. As shown in FIG. 2, the method includes: a processing device and two or more analysis nodes; wherein
  • the processing device includes: a storage unit, a decomposition distribution unit, and a re-segment unit; wherein
  • Obtaining a storage unit configured to acquire and store an inbound message and an outgoing message transmitted by the detected network
  • the decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;
  • the re-segment unit is configured to re-allocate the remaining inbound packets and the outgoing packets in addition to the packets that are determined to be in error according to the preset policy.
  • Each analysis node includes a matching unit, a culling unit, and a determining unit;
  • the matching unit is configured to perform matching on the inbound packet and the outgoing packet in the data packet distributed to itself, and determine the packet that is not in error;
  • a culling unit configured to reject the determined unerrored message
  • the determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that are not successfully matched are incorrect.
  • the detected network is a network of one or more network devices.
  • the method includes: acquiring a storage unit, decomposing a distribution unit, and a re-segment unit;
  • Obtaining a storage unit configured to acquire and store an inbound message and an outgoing message transmitted by the detected network
  • Obtaining a storage unit can be configured to
  • the inbound and outbound packets transmitted by the detected network are configured to be stored in the network device of the network to be detected, and the inbound and outbound packets transmitted by the detected network are configured to be stored;
  • the optical splitter of the detected network performs the optical splitting of the incoming packet and the outgoing packet, and stores the incoming packet and the outgoing packet transmitted by the detected network.
  • Obtaining a storage unit can be configured to
  • the decomposition distribution unit is configured to respectively decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data blocks to the pre-established analysis nodes;
  • the decomposition distribution unit can be configured to
  • the decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.
  • the decomposition distribution unit can be configured to
  • the current data block size is smaller than the preset fixed value, and the next message data block size is greater than the preset fixed value, the current data block is subjected to complementary digital processing, so that the data block size after the completion of the complementary digital processing is equal to the pre- A fixed value is set, and the data block that completes the digital processing is used as the decomposed data block; or
  • the current data block size is greater than the minimum value of the preset interval value, and the data block size of the next message is less than or equal to the maximum value of the preset interval value, the current data block is added to the data block of the next message.
  • the current data block is added to the data block of the next message.
  • the decomposed data blocks are distributed to the pre-established analysis nodes for message error detection.
  • the re-segment unit is configured to re-allocate the remaining inbound packets and the outgoing packets in addition to the packets that are determined to be in error according to the preset policy.
  • the re-segment unit may be configured to, after rejecting the unerrored message determined by each analysis node, successively select one or more analysis nodes, and distribute the remaining inbound and outbound messages of the selected analysis node to other analysis. node.
  • the disclosed processing apparatus further includes a distinguishing unit configured to distinguish between pieces of messages in the data block.
  • the distinguishing unit can be configured to
  • each packet in the data block is distinguished by the length of the recorded packet.
  • the disclosed processing apparatus further includes a boundary processing unit configured to set the current time The packets whose time attributes are in the time boundary (TR) are detected in the packets that are not matched in the span, and are stored in the inbound and outgoing packets of the detected network that is stored in the next time span (T). , the message error detection.
  • TR time boundary
  • T next time span
  • the disclosed processing apparatus further includes an inbound and outbound distinguishing unit configured to distinguish between an incoming message and an outgoing message.
  • the method includes a matching unit, a culling unit, and a determining unit.
  • the matching unit is configured to match the inbound packet of the received data block with the unchanged portion of the outgoing packet, and determine the packet that is not erroneous;
  • the matching unit may be configured to, for the inbound message and the outgoing message in the data block distributed to itself,
  • the feature value of the content of the extracted inbound message that should not be changed is matched with the feature value of the content of the extracted outgoing message that should not change.
  • a culling unit configured to reject the determined unerrored message
  • the determining unit is configured to determine that all the packets that are not successfully matched are in themselves, and determine that the packets that do not match successfully are incorrect.
  • the present disclosure analysis node further includes a filtering unit configured to filter the outgoing message actively sent by the detected network and the incoming message sent to the detected network before the packet with the unmatched success is determined to be in error.
  • the disclosed analysis node further includes a message learning unit and a learning filtering unit.
  • the packet learning unit is configured to perform packet learning on the content of the distinguishing field included in the incoming packet and the outgoing packet in the incoming packet and the outgoing packet when the packet is detected by the detected network;
  • the learning filtering unit is configured to obtain the packet learning result of the distinguishing field content included in the incoming message and the outgoing message, and should not be included in the incoming message and the outgoing message in the message learning result.
  • the packets matching the matching fields included in the change part are filtered, and the remaining packets are sent to the matching unit to perform matching between the incoming packets and the outgoing packets.
  • the matching unit can be configured to
  • the inbound and outbound packets of the inbound and outbound packets that are used for the mapping and the grammar calculations are not matched in the inbound and outbound packets, and the inbound and outbound packets corresponding to the successfully matched key-value pairs are determined.
  • the text is a message that has not gone wrong.
  • the culling unit may be configured to determine, according to the hash calculated mapping, the location of the incoming message and the outgoing message in the data block corresponding to the successfully matched key value pair for culling processing.
  • the detected network when the packet is detected, the detected network may be a network composed of one or more network devices, and the network device may be a router or a switch.
  • the inbound packet and the outgoing packet transmitted by the detected network are obtained.
  • the inbound packet and the outgoing packet are separately stored; the storage mode can be performed in the form of a file, and each incoming packet or outgoing packet is stored with corresponding packet content, time attribute, and packet. Flow direction information, etc.; after the stored message is decomposed into data blocks according to a preset decomposition strategy, the decomposed data block is sent to two or more analysis nodes for inbound and outgoing messages.
  • the matching of the changed part determines whether the packet has an error by the matching result.
  • FIG. 5 is a flowchart of a method according to a first embodiment of the present disclosure. As shown in FIG. 5, the method includes:
  • Step 500 Acquire and store the inbound packet and the outgoing packet transmitted by the detected network.
  • the packet flowing through the detected network is differentiated according to the inflow interface and the outbound interface, and then copied and stored in the form of a binary file. ;
  • the inbound and outbound packets and the outgoing packets may be configured on the network device; if the optical device is in the optical device, the inflow is on the optical splitter.
  • the incoming packet and the outgoing outgoing packet are split-spectrum.
  • the time attribute ie, transmission time
  • the flow direction information of the packet the length of the packet, and the like
  • the like may be stored. Check the error in the message.
  • Step 501 Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;
  • each packet in the data block is distinguished by the length of the recorded packet; the length of each packet is added in the preset position by, for example, recording the length of the packet in an int before recording a packet, and then adding Corresponding report
  • each message is distinguished according to the length of the recorded message, and the message is read based on the difference of the message.
  • this embodiment in order to ensure load balancing of each analysis node, this embodiment first needs to determine the size of each data block, and the data block size is generally determined by the performance of the analysis node, and the data block size is generally 2 to the power of N; currently, A general PC can satisfy the matching of the inbound packet data block and the outgoing packet data block with the data block size of 64M.
  • This embodiment is decomposed into the stored inbound packet according to a preset fixed value or a preset interval value.
  • the preset fixed value is 64M.
  • the current data block size is less than 64M, the current data block is added to the size of the next message. If it is greater than 64M, the current data block is supplemented with digital processing. For example, the process of supplementing the number of digits of 0 is such that the data block that completes the zero-padding process reaches 64M as a decomposed data block; the next message is decomposed into the next data block. in.
  • the preset interval value needs to be limited first.
  • the preset interval value is set to be a reasonable size from 63M to 65M, that is, the current data block is added to the size of the next message.
  • the current data block is added to the data block of the next message as the decomposed data block.
  • the number of the analysis nodes is generally determined according to the traffic volume of the network port to be detected. When the average network traffic reaches 1 Gigabit, an analysis node needs to change the inbound and outbound packets. Partial match.
  • Step 502 Each analysis node performs matching on the inbound packet and the outgoing packet in the data block distributed to itself, and determines the packet that is not in error;
  • the change does not change from the incoming network device to the outgoing network device, and the content does not change, that is, if the link does not occur on the network, the incoming packet is sent.
  • the message field that should not change in the middle part of the message field and the message field that should not change in the outgoing message part are the same.
  • the message is determined to have no error; for example, the network is assumed. If the message transmitted by the device should not change, the content of the message is [0x10, 0x20, 0x30].
  • the device that detects the error of the packet obtains an incoming message, the content of the change should not be [0x10, 0x20, 0x30]; The device for error detection of the packet determines that the packet does not have an error according to the matching of the incoming packet and the outgoing packet. In this embodiment, if the packet should not change, the transmission occurs during the transmission. If the change is made, for example, the outgoing message obtained becomes [0x10, 0x20, 0x31], at this time, The device that detects the error of the packet cannot match the outgoing packet with the same change as the incoming packet, and determines that the packet has an error.
  • Different types of packets may be different in the field of the message field that does not change when the network device transmits the information, and may be determined according to common knowledge of those skilled in the art.
  • the changed message field refers to the message except that the change does not occur.
  • the content of the text field, such as the TTL field of the IP packet, is legally modified by the network device during transmission (for example, a router for the network device at this time).
  • the matching between the incoming message and the outgoing message should not be changed.
  • the content of the incoming message should not be changed, and the content of the outgoing message should not be changed.
  • Loading the unchanged part of the incoming message into the first list, loading the outgoing part of the outgoing message into the second list, and the order of loading into the list is generally sorted by time.
  • the outbound packets in the second list are matched one by one to match the inbound packets in the first list until the inbound packets of the same content are matched.
  • the matching between the incoming message and the outgoing message should not be changed.
  • the feature value can be extracted separately after the change should not be made in the incoming message and the change should not be made in the outgoing message.
  • the feature value extracted in the packet should not match the feature value extracted in the outgoing packet, and the feature value extracted from the outgoing packet can be improved.
  • the method of extracting the eigenvalues can be implemented by calculating the hash value.
  • the eigenvalues of the packets are mapped to the packets in the matching process.
  • the hash calculation is used as an example.
  • the eigenvalues of the packets and the packets are corresponding.
  • the VALUE value and the KEY value corresponding to the message in the hash table may be separately stored, and the VALUE value is successfully matched according to the matching of the KEY value, thereby determining that the message is successfully matched.
  • the position offset of each packet can be calculated, and when the inbound packet and the outgoing packet are hashed, the position offset of each packet is calculated. According to the position offset, the message that determines that no error has occurred is deleted from the hash calculation.
  • the method in this embodiment further includes:
  • the obtained hash value may be the same, the source port, and/or destination port is mainly for TCP/UDP.
  • the message when the message is hashed, if the message is long, the message can be segmented and then hashed, and the hash value calculated by the segmentation is used as the feature value of the message. There should be no matching part of the incoming message and the outgoing message.
  • Step 503 After the undue error message determined by each analysis node is removed, one or more analysis nodes are selected one by one, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes, and the continuation is performed. The match between the incoming packet and the outgoing packet should not be changed until all the packets that do not match successfully are in the same analysis node.
  • FIG. 6 is a flowchart of a method according to a second embodiment of the present disclosure. As shown in FIG. 6, the method includes:
  • Step 600 Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.
  • Step 601 Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;
  • Step 602 Each analysis node performs mapping and reduction calculation on the inbound message and the outgoing message included in the data block distributed to itself.
  • Step 603 Perform matching on the inbound and outbound messages of the inbound and outbound packets for completing the mapping and the protocol calculation, and remove the unchanged packets from the data block.
  • the culling of the message that determines that no error has occurred can be implemented by the method of position offset calculation in Embodiment 1, that is, the message in which no error occurs in the data block is determined by the position offset to perform the culling process.
  • step 604 one or more analysis nodes are selected one by one, and the remaining inbound packets and outgoing packets of the selected analysis node are distributed to other analysis nodes, and the inbound and outbound messages are not changed. Partial matches until all unmatched messages are on the same analysis node.
  • Step 605 Filter the outgoing packets that are sent by the detected network and the incoming packets that are sent to the detected network, and obtain the packets that determine the error.
  • step 605 can be processed before the matching of the incoming message and the outgoing message should not be changed, thereby reducing data transmission and improving matching efficiency.
  • the inbound packet and the outgoing packet transmitted by the detected network are stored according to the time span T.
  • the stored inbound packet and the outgoing packet may be stored in files stored in different time spans.
  • a time-boundary TR is used to prevent incoming packets and outgoing packets from appearing in files stored in different time spans.
  • the unmatched packets in the time boundary are added to the stored inbound traffic of the next time span according to the flow direction. Text and outgoing messages.
  • FIG. 7 is a flowchart of the method according to the third embodiment of the present disclosure. As shown in FIG. 7, the method includes:
  • Step 700 Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.
  • the Nth packet is successfully added in the step S700;
  • Step 701 Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;
  • Step 702 Each analysis node performs mapping and reduction calculation on the inbound message and the outgoing message included in the data block distributed to itself.
  • Step 703 Perform matching on the inbound and outbound messages of the inbound and outbound packets that complete the mapping and the protocol calculation, and remove the unchanged packets from the data block.
  • Step 704 Select one or more analysis nodes one by one, and distribute the remaining inbound packets and outgoing packets of the selected analysis node to other analysis nodes, and continue to perform inbound and outbound messages. Partial matching, until all the packets that do not match successfully are in the same analysis node, it is determined that the packet with no matching success is incorrect.
  • Step 705 Filter the outgoing packets that are sent by the detected network and the incoming packets that are sent to the detected network, and obtain the packets that determine the error.
  • Step 706 The packet whose time attribute in the time interval TR is not matched in the current time span is detected, and is stored in the inbound packet of the detected network stored in the next time span T. In the outgoing message, the message is checked for error.
  • the matching efficiency is too low. You can improve the matching efficiency by learning common packets. The number of common packets is large, the content is fixed, and the packets are abnormal. Possibility is low.
  • the packet learning is mainly for special distinguishing fields in the incoming and outgoing packets that should not change, including protocols and/or lengths and/or flags, for example, a large number of TCP SYNs.
  • the parameters carried by the message are almost the same, such as the length, SYN flag, and so on.
  • the obtaining unit extracts the distinguishing field of the protocol and/or the length and/or the flag bit, and does not occur in the incoming packet and the outgoing packet.
  • the distinguishing field extracted by the change part is matched after the packet learning; the matching is successful, and it is determined that the packet does not have an error. If the match fails, the packet is not a common packet.
  • the method in the first embodiment is used to match the inbound packet and the outgoing packet in the inbound packet to determine whether the packet has an error.
  • whether the packet learning of the distinguishing field is performed may be analyzed by a person skilled in the art to analyze the frequency and quantity of the packet, and when the packet learning is determined by analysis, the presence or absence of the packet is monitored. When the part of the packet is detected, the packet learning is automatically triggered.
  • FIG. 8 is a flowchart of a method according to a fourth embodiment of the present disclosure. As shown in FIG. 8, the method includes:
  • Step 800 Acquire and store an inbound packet and an outgoing packet transmitted by the detected network.
  • Step 801 Decompose the stored inbound message and the outgoing message into corresponding data blocks, and then distribute the decomposed data block to two or more pre-established analysis nodes;
  • Step 802 Each analysis node performs mapping and reduction calculation on the inbound message and the outgoing message included in the data block distributed to itself.
  • Step 803 Each analysis node extracts a distinguishing field in the inbound and outbound messages that should not change, and performs packet learning on the differentiated field.
  • Step 804 Match the distinguishing field of the packet learning; if the matching is successful, go to step 8050; if the matching fails, go to step 8060;
  • Step 8050 Determine that the packet matching the successfully matched packet is a packet with no error, and remove the packet that determines that no error occurs in the data block.
  • step 8060 a matching part of the incoming message and the outgoing message is not matched, and the packet that does not have an error is determined.
  • the inbound packet and the outgoing packet that are sent to the detected network and the detected network are sent by the detected network.
  • Step 8061 After each of the analysis nodes culls the determined unerrored message, one or more analysis nodes are sequentially selected, and the remaining inbound and outgoing packets of the selected analysis node are distributed to other analysis nodes, and the continuation is continued. The match between the incoming packet and the outgoing packet should not be changed until all the packets that do not match successfully are in the same analysis node.
  • the present disclosure also provides a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the method of any of the above embodiments.
  • the present disclosure also provides a schematic structural diagram of an electronic device.
  • the electronic device includes:
  • At least one processor 90 which is exemplified by a processor 90 in FIG. 9; and a memory 91, may further include a communication interface 92 and a bus 93.
  • the processor 90, the communication interface 92, and the memory 91 can complete communication with each other through the bus 93.
  • Communication interface 92 can be used for information transfer.
  • Processor 90 can invoke logic instructions in memory 91 to perform the methods of the above-described embodiments.
  • logic instructions in the memory 91 described above may be implemented in the form of a software functional unit and sold or used as a stand-alone product, and may be stored in a computer readable storage medium.
  • the memory 91 is a computer readable storage medium and can be used to store a software program, a computer executable program, and a program instruction/module corresponding to the method in the embodiment of the present invention.
  • the processor 90 executes the function application and the data processing by executing the software program, the instruction and the module stored in the memory 91, that is, the method for implementing the message error detection in the above method embodiment.
  • the memory 91 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the terminal device, and the like.
  • the memory 91 may include a high speed random access memory, and may also include Non-volatile memory.
  • the technical solution of the embodiment of the present invention may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, or a network) The device or the like) performs all or part of the steps of the method described in the embodiments of the present invention.
  • the foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like.
  • the method and apparatus for implementing message error detection of the present disclosure implements detection of an error message.

Landscapes

  • Engineering & Computer Science (AREA)
  • Environmental & Geological Engineering (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

L'invention concerne un procédé et un dispositif pour une détection d'erreur de paquet. Le procédé consiste : à décomposer des paquets entrants et des paquets sortants stockés respectivement en blocs de données correspondants, et à distribuer ceux-ci à au moins deux nœuds d'analyse préétablis ; les nœuds d'analyse effectuent, sur les blocs de données distribués à ceux-ci, une mise en correspondance des parties des paquets entrants et des paquets sortants qui doivent être inchangées, pour déterminer des paquets sans erreur ; à ré-attribuer, selon une politique préétablie, en excluant ces paquets qui sont déterminés comme étant sans erreur, les paquets entrants et les paquets sortants restants, et à continuer d'effectuer une mise en correspondance des parties des paquets entrants et des paquets sortants qui doivent être inchangées, jusqu'à ce que tous les paquets non mis en correspondance soient au niveau du même nœud d'analyse, auquel cas il est déterminé que des erreurs se sont produites dans les paquets non mis en correspondance. Le procédé divulgué dans la présente invention permet une détection de paquets dans lesquels des erreurs se sont produites, par stockage, décomposition et distribution de paquets entrants et de paquets sortants, puis par mise en correspondance des parties qui doivent être inchangées.
PCT/CN2017/070507 2016-01-06 2017-01-06 Procédé et dispositif pour une détection d'erreur de paquet WO2017118430A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610009902.0 2016-01-06
CN201610009902.0A CN106953775A (zh) 2016-01-06 2016-01-06 一种实现报文检错的方法及装置

Publications (1)

Publication Number Publication Date
WO2017118430A1 true WO2017118430A1 (fr) 2017-07-13

Family

ID=59273314

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/070507 WO2017118430A1 (fr) 2016-01-06 2017-01-06 Procédé et dispositif pour une détection d'erreur de paquet

Country Status (2)

Country Link
CN (1) CN106953775A (fr)
WO (1) WO2017118430A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834411B (zh) * 2023-02-16 2023-06-27 北京派网软件有限公司 一种网络性能分析方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102594600A (zh) * 2012-02-21 2012-07-18 中兴通讯股份有限公司 一种确定双向转发检测会话故障位置的方法及系统
CN103051629A (zh) * 2012-12-24 2013-04-17 华为技术有限公司 一种基于软件定义网络中数据处理的系统、方法和节点
CN103580953A (zh) * 2013-10-21 2014-02-12 华为技术有限公司 一种故障检测的方法及设备
CN104243093A (zh) * 2013-06-14 2014-12-24 西门子公司 用于在将数据从发送器传输到至少一个接收器时识别错误的方法和系统
CN104243348A (zh) * 2014-09-22 2014-12-24 曙光信息产业(北京)有限公司 一种数据处理方法和装置
US20150200827A1 (en) * 2014-01-13 2015-07-16 Cisco Technology, Inc. Network performance diagnostics system

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101783786B (zh) * 2009-01-19 2013-01-16 中兴通讯股份有限公司 数据包过滤方法和装置
CN203027498U (zh) * 2012-11-27 2013-06-26 北京交控科技有限公司 测试装置
CN103746868B (zh) * 2013-12-23 2017-07-04 普联技术有限公司 一种发送及接收测试报文的方法、装置及测试设备
CN105141583B (zh) * 2015-07-28 2019-02-15 中国电子科技集团公司第三十六研究所 一种字符串匹配方法和系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102594600A (zh) * 2012-02-21 2012-07-18 中兴通讯股份有限公司 一种确定双向转发检测会话故障位置的方法及系统
CN103051629A (zh) * 2012-12-24 2013-04-17 华为技术有限公司 一种基于软件定义网络中数据处理的系统、方法和节点
CN104243093A (zh) * 2013-06-14 2014-12-24 西门子公司 用于在将数据从发送器传输到至少一个接收器时识别错误的方法和系统
CN103580953A (zh) * 2013-10-21 2014-02-12 华为技术有限公司 一种故障检测的方法及设备
US20150200827A1 (en) * 2014-01-13 2015-07-16 Cisco Technology, Inc. Network performance diagnostics system
CN104243348A (zh) * 2014-09-22 2014-12-24 曙光信息产业(北京)有限公司 一种数据处理方法和装置

Also Published As

Publication number Publication date
CN106953775A (zh) 2017-07-14

Similar Documents

Publication Publication Date Title
CN110401662B (zh) 一种工控设备指纹识别方法、存储介质
CN113259143B (zh) 信息处理方法、设备、系统及存储介质
CN109379390B (zh) 一种基于全流量的网络安全基线生成方法
WO2022048668A1 (fr) Procédé et appareil de construction de graphe de connaissances, procédé de vérification et support de stockage
EP3832960A1 (fr) Établissement d'une table de transfert rapide
CN108833430B (zh) 一种软件定义网络的拓扑保护方法
CN114281676A (zh) 针对工控私有协议的黑盒模糊测试方法及系统
CN114553730B (zh) 一种应用识别方法、装置、电子设备及存储介质
CN111404768A (zh) 一种dpi识别的实现方法及设备
CN110266603B (zh) 基于http协议的身份认证业务网络流量分析系统及方法
CN113507431B (zh) 一种报文管理方法、装置、设备及机器可读存储介质
WO2017118430A1 (fr) Procédé et dispositif pour une détection d'erreur de paquet
CN111010362B (zh) 一种异常主机的监控方法及装置
CN116015796A (zh) 一种流表更新方法、装置、防火墙设备及存储介质
CN104917623B (zh) 一种实现sdn网络通信管理的方法及装置
US11949570B2 (en) Methods, systems, and computer readable media for utilizing machine learning to automatically configure filters at a network packet broker
CN111901138B (zh) 一种工业网络非法接入的可视化审计方法
CN113064906B (zh) 一种Binlog日志数据适配迁移方法和系统
WO2017118428A1 (fr) Procédé et appareil pour réaliser une détection d'erreur de message
CN111294280B (zh) 消息查重方法和装置、数据转发方法、设备和系统
CN109067603B (zh) 一种确定变电站网络vlan配置问题的方法及系统
CN111884919A (zh) 一种清除无效虚拟ip的方法、装置、设备及可读介质
CN106789150B (zh) 一种网络故障检测方法及装置
CN113992495B (zh) 告警信息的处理方法、装置、计算机设备和存储介质
CN111258845A (zh) 事件风暴的检测

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17735868

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17735868

Country of ref document: EP

Kind code of ref document: A1