WO2019080658A1 - 一种网络控制方法、装置和计算机可读存储介质 - Google Patents

一种网络控制方法、装置和计算机可读存储介质

Info

Publication number
WO2019080658A1
WO2019080658A1 PCT/CN2018/105115 CN2018105115W WO2019080658A1 WO 2019080658 A1 WO2019080658 A1 WO 2019080658A1 CN 2018105115 W CN2018105115 W CN 2018105115W WO 2019080658 A1 WO2019080658 A1 WO 2019080658A1
Authority
WO
WIPO (PCT)
Prior art keywords
access control
media access
control address
mac address
source
Prior art date
Application number
PCT/CN2018/105115
Other languages
English (en)
French (fr)
Inventor
林宁
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP18870403.5A priority Critical patent/EP3675422A4/en
Publication of WO2019080658A1 publication Critical patent/WO2019080658A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/06—Generation of reports
    • H04L43/065—Generation of reports related to network devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/18—Loop-free operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring

Definitions

  • the present disclosure relates to network technologies, and more particularly to a network control method and apparatus, and a computer readable storage medium.
  • the method for performing network ring-breaking processing on a network device is mainly port loop detection, or the Spanning Tree Protocol (STP) is enabled.
  • STP Spanning Tree Protocol
  • the central processing unit (CPU, Central Processing Unit) is required to send and receive loop detection packets, which will increase CPU consumption.
  • the loop detection packet After the loop detection packet is sent out by the device, it can be correctly recovered in the network.
  • the network environment is uncertain, and it is not always possible to accurately determine whether there is a loop.
  • the general loop detection finds that there is a loop under the port.
  • the defensive operation is usually to close the port or the spanning tree block. This operation will directly affect the entire port or the forwarding state port in the virtual local area network (VLAN). , all forwarding states in the Virtual Local Area Network).
  • VLAN virtual local area network
  • the STP currently used by devices is likely to cause the following problems:
  • STP performs a defensive block on a port based on a VLAN. This operation affects all forwarding behavior of the port in the VLAN.
  • At least one embodiment of the present disclosure provides a network control method, apparatus, and computer readable storage medium.
  • At least one embodiment of the present disclosure provides a network control method, including:
  • the device detects the rate of reporting the MAC address of the media access control (MAC). When the rate of reporting the MAC address is greater than or equal to the preset rate threshold, the device configures the device to discard the packet from the source.
  • MAC media access control
  • An embodiment of the present disclosure provides a network control apparatus including a memory and a processor, where the memory stores a program, and when the program is read and executed by the processor, the following operations are performed:
  • the rate of reporting the MAC address is detected.
  • the rate of reporting the MAC address is greater than or equal to the preset rate threshold, the packet with the source MAC address is discarded.
  • An embodiment of the present disclosure provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the network described above Control Method.
  • the network control method provided by the embodiment of the present application uses the MAC address to set the source hit and discard mode to perform system protection, which does not increase the CPU interaction caused by too many CPUs, and does not increase the CPU usage. If the detection packet is not received due to the influence of the external environment, it will be missed. Only the MAC address forwarding suppression on the device can determine and defend against an abnormal traffic, and the port will not be affected. Other forwarding traffic on or on this VLAN. With this solution, the loop can be processed in time, and the pressure on the device CPU is small, that is, the impact of the network device can be minimized, and the device can be defended based on the traffic.
  • FIG. 1 is a flowchart of a network control method according to an embodiment of the present disclosure
  • FIG. 2 is a block diagram of a network control apparatus according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a network control method according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a network control method according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic diagram of a switch loop provided by an example of the present disclosure.
  • FIG. 6 is a schematic diagram of a switch loop provided by an example of the present disclosure.
  • the main idea of this application is that when a Layer 2 loop occurs, the MAC address flapping state occurs under normal conditions. That is, the MAC address of the traffic source forwarded by the device will continue on the normal receiving port and the ring-forming port. Drift, and when such a loop occurs, the speed of this MAC address drift will be very fast. Therefore, the device must receive a large number of drift reports of this MAC address. As long as the device writes a MAC address entry for this source MAC address for this MAC address and sets the behavior of dropping the packet after the hit, the device protection for this situation can be completed.
  • the device After setting the MAC address discarding, regardless of whether the looped position is at the device itself or at the far end of the network, the device can determine based on the flow, and it is determined that the traffic has a loop abnormality, so there is no need to make a normal MAC address for the traffic. After learning the report and the forwarding process, the MAC address is set to the behavior of discarding the packet after the hit. The device discards the packet and does not send the MAC address-related drift report to the CPU. On the other hand, the loop message does not impact the bandwidth of the device port. On the other hand, the MAC address flapping information of the loop packet does not impact the device CPU, that is, the protection behavior of the normal state of the device is completed.
  • the defense measures set in this application are only for the MAC address, and the port-based behavior is not based on the behavior of a certain port in a certain VLAN. Therefore, the defense measures only the behavior of the source MAC address of a certain traffic. Effective, without affecting other traffic forwarding on this port.
  • Such defenses especially in the case of a single-port loop, can be very advantageous, because in a single-port loop, there may be only one in the entire port traffic. The flow has a loop impact and the other flows are normal. Under the protection of such defenses, the device can ensure the normal forwarding of other traffic and suppress the forwarding of abnormal traffic and MAC address flapping.
  • An embodiment of the present disclosure provides a network control method, as shown in FIG. 1 , including:
  • Step 101 The device detects a reporting rate of the MAC address.
  • the reporting rate of each MAC address is separately detected.
  • Step 102 When the reporting rate of the MAC address is greater than or equal to the preset rate threshold, the device configures to discard the packet whose source hits the MAC address.
  • the reporting rate may be set according to the reporting rate of the MAC address when the loop actually occurs, which is slightly smaller than the value.
  • it can also be set according to other methods, such as network capacity setting.
  • the network control method provided in this embodiment can prevent the MAC address of the loop from being affected by the CPU of the device, and can prevent the packet of the MAC address from continuously impacting the bandwidth of the port. In addition, only the packets of the MAC address are discarded, and other packets of the port are not affected, and the impact on the port is relatively small.
  • the device configured to discard the source to hit the MAC address includes:
  • the device writes the MAC address in a MAC address table or an Access Control List (ACL) and sets the source MAC address to hit the MAC address discarding action.
  • ACL Access Control List
  • the method further includes: when the reporting rate is greater than or equal to a preset rate threshold, the device performs an alarm for looping to the system, where the alarm carries the MAC address.
  • the alarm can prompt the user to check the network health in time and eliminate the loop in time.
  • the method further includes:
  • Step 103 After the device configures to discard the packet that the source hits the MAC address, the device performs timing. When the timing reaches the preset timing threshold, the device deletes the configuration of the packet that the source has hit the MAC address.
  • the configuration of the packet that discards the source hits the MAC address may also be deleted.
  • the preset timing threshold can be set as needed.
  • the method further includes: after the device deletes the configuration of the packet that the source has hit the MAC address, the device detects the reporting rate of the MAC address, where the reporting rate is greater than or equal to the pre-reporting rate. When the rate threshold is set, the device configures to discard the packets whose source hits the MAC address.
  • an embodiment of the present disclosure provides a network control apparatus 20, which includes a memory 210 and a processor 220.
  • the memory 210 stores a program, when the program is read and executed by the processor 220, Implement the above network control method.
  • An embodiment of the present disclosure provides a computer readable storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the network described above Control Method.
  • the computer readable storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like, which can store program codes. Medium.
  • a remote loop occurs on a single port of the device, as shown in FIG. 3, including:
  • Step 301 After receiving the normal uplink port traffic, the device learns the MAC address, and after forwarding to the downlink port, a loop occurs in the remote network.
  • step 302 a continuous MAC address drift occurs on the uplink port of the device and the port in which the loop occurs.
  • the device determines the MAC address to be reported. If the MAC address reported in the unit time (ie, the reporting rate) reaches a preset rate threshold (for example, greater than or equal to a preset rate threshold), the device sends the MAC address. The address is written in the MAC address table, and the source MAC address hit discard flag is set, that is, as long as the source MAC address is the same as the MAC address entry, the packet is discarded; the device sends an alarm to the system, and the alarm is generated. The device has a loop on this MAC address.
  • a preset rate threshold for example, greater than or equal to a preset rate threshold
  • the preset rate threshold may be set by the speed at which the MAC address is sent to the CPU when the device is in a loop, and generally sets a value slightly smaller than the rate at which the MAC address is sent to the CPU when the loop occurs, or according to the actual Network fault tolerance is configured by the user.
  • the packet After the packet is received, the packet is discarded, and the packet is discarded.
  • Step 305 After the device sets the source MAC address to hit the discarding entry, the device also performs timing. After the timing time reaches the preset timing threshold, the MAC address is deleted, that is, the defense mechanism for the MAC address is first removed, and the MAC address is further present. The reporting rate of the MAC address is detected. If the reporting rate is less than or equal to the preset rate threshold, the loop of the MAC address is removed, and the traffic can be forwarded normally. If the reporting rate is greater than the preset rate threshold, If the loop still exists, the defense mechanism is started again, that is, the MAC address is written in the MAC address table, and the source MAC address hit discard flag is set.
  • the detection of the reporting rate of the MAC address can be performed all the time, and is not affected by whether or not the defense mechanism is activated, but after the defense mechanism is started, there is no reported MAC address of the defense.
  • a loop occurs between multiple ports of the device, as shown in FIG. 4, including:
  • step 401 the device receives the normal uplink port traffic, learns the MAC address, and forwards the traffic back to the downlink port.
  • Step 402 A continuous MAC address drift occurs between the uplink port and the downlink port of the device and other loop ports.
  • Step 403 The device determines the MAC address that is reported, and if the MAC address reported in the unit time (ie, the reporting rate) reaches a preset rate threshold (for example, greater than or equal to a preset rate threshold), the device sends the MAC address.
  • a preset rate threshold for example, greater than or equal to a preset rate threshold
  • the address is written in the MAC address table, and the source MAC address hit discard flag is set, that is, as long as the source MAC address is the same as the MAC address entry, the packet is discarded; the device sends an alarm to the system, and the alarm is generated.
  • the device has a loop on this MAC address.
  • the packet After the packet is received, the packet is discarded, and the packet is discarded.
  • Step 405 After the device sets the source MAC address to hit the discarding entry, the device also performs timing. After the timing time reaches the preset timing threshold, the MAC address is deleted, that is, the defense mechanism for the MAC address is first removed, and the MAC address is further present. The reporting rate of the MAC address is detected. If the reporting rate is less than or equal to the preset rate threshold, the loop of the MAC address is removed, and the traffic can be forwarded normally. If the reporting rate is greater than the preset rate threshold, If the loop still exists, the defense mechanism is started again, that is, the MAC address is written in the MAC address table, and the source MAC address hit discard flag is set.
  • the network control method provided by the foregoing embodiment can complete the determination of the port loop without increasing the CPU consumption, and does not need to run any protocol during the period, and does not need to send any detection packet, but only needs to pass through itself.
  • the number of MAC address flaps in the unit time (that is, the rate of reporting) can determine whether there is a loop risk, and can alert the user to the traffic, and then start the defense policy to cut off the traffic of the abnormal impact device, and can timely ring the ring.
  • the road state is tentatively detected. Once the loop still exists, the device will immediately start the defense again after a brief impact, and once the loop disappears, the system can automatically resume normal without any human intervention.
  • the solution provided by the embodiment of the present disclosure uses the MAC address to set the source hit discarding mode to perform system protection, which does not increase the CPU interaction of the CPU, and the CPU usage rate does not increase. Because the detection packets that are affected by the external environment cannot be received and are missed, only the MAC address forwarding suppression on the device can determine and defend against abnormal traffic, and it will not affect the port. Or other forwarding traffic on this VLAN. Applying this solution can minimize the impact of network devices, and devices can defend against traffic based on traffic.
  • the solution of the embodiment of the present disclosure can automatically cancel the forwarding suppression of the packet of the MAC address, and can alarm the device for an abnormality of the traffic, thereby improving the maintainability and robustness of the network and the fault tolerance of the device. .
  • the source MAC address of a certain traffic of switch A is 00:11:22:33:44:55 vlan 10
  • the ingress port is A1
  • the egress port is A2
  • the A2 port is remotely located.
  • the loop causes the MAC address traffic to be returned to switch A by the loop.
  • the A1 and A2 ports receive the packets with the source MAC address of 00:11:22:33:44:55+vlan10, so the A1 port and The A2 port continuously reports this MAC address learning.
  • Switch A receives a large number of identical MAC addresses from different ports (for example, 100 times of the same MAC address is reported on different ports in one second), exceeds the preset rate threshold, and determines that the MAC address has a loop. MAC address drift.
  • Switch A starts defensive measures, writes the MAC address 00:11:22:33:44:55+vlan10 into the MAC address table, and sets its source hit to discard. At the same time, an abnormal alarm is reported to the system for this MAC address.
  • Switch A When Switch A receives the packet of this source MAC address from A1 or A2, it matches the MAC address table entry and discards the packet.
  • the switch After the switch A passes the preset timing threshold (for example, 5 minutes), the switch deletes the MAC address entry that is discarded by the source MAC address 00:11:22:33:44:55+vlan10 in the MAC address table, that is, the MAC address is removed.
  • Address defense measures At this time, if the loop fault of the switch is not eliminated, and the reporting rate of the MAC address reaches the preset rate threshold (for example, 100 MAC address drift entries are received within 1 second), the defense measures are started again in the MAC address table. Write an entry that is dropped by this MAC address source hit. If the loop fault of the switch is removed and the rate of reporting the MAC address is less than the preset rate threshold, the traffic of the source MAC address can be forwarded normally.
  • the preset timing threshold for example, 5 minutes
  • the source MAC address of a certain traffic of switch A is 00:11:22:33:44:55 vlan 10
  • the ingress port is A1
  • the egress port is A2
  • the A2 of switch A is A loop occurs on the A3 port, causing the MAC address traffic to be returned to the switch A by the loop.
  • the A1 port, the A2 port, and the A3 port continuously receive the source MAC address as 00:11:22:33:44:55+vlan10. Packets, so A1 port, A2 port, and A3 port continuously report this MAC address learning.
  • Switch A receives a large number of identical MAC addresses from different ports (for example, 100 times in 100 seconds, the same MAC address is reported on a different port). If the threshold is exceeded, the MAC address is considered to be ringing. The path MAC address drifts.
  • Switch A starts defensive measures, writes the MAC address 00:11:22:33:44:55+vlan10 into the MAC address table, and sets its source hit to discard. At the same time, an abnormal alarm is reported to the system for this MAC address.
  • the switch When the switch receives the packet with the source MAC address from the A1 port, the A2 port, and the A3 port, the switch matches the entry in the MAC address table. The packet is directly discarded.
  • the switch After the switch A passes the preset timing threshold (for example, 5 minutes), the switch deletes the MAC address entry that is discarded by the source MAC address 00:11:22:33:44:55+vlan10 in the MAC address table, that is, the MAC address is removed.
  • Address defense measures At this time, if the loop fault of the switch is not eliminated, and the reporting rate of the MAC address reaches the preset rate threshold (for example, 100 MAC address drift entries are received within 1 second), the defense measures are started again in the MAC address table. Write an entry that is dropped by this MAC address source hit. If the loop fault of the switch is removed and the rate of reporting the MAC address is less than the preset rate threshold, the traffic of the source MAC address can be forwarded normally.
  • the preset timing threshold for example, 5 minutes
  • Switch A starts defensive measures, sets an ACL rule, hits the MAC address 00:11:22:33:44:55+vlan10, and sets the ACL packet discarding action to take effect on the corresponding port (for example, the MAC address appears.
  • the drifting port takes effect or is valid for all ports of the switch.
  • the system sends an abnormal alarm to the system for this MAC address.
  • the ACL rule is deleted. If the loop does not disappear, the MAC address reporting rate reaches the preset rate threshold again. The ACL rule is set. If it disappears, the device returns to normal. Traffic.
  • the preset timing threshold for example, 5 minutes
  • the method of using the MAC address to set the source hit discarding method for system protection does not increase the message interaction of too many CPUs. As a result, the CPU usage is increased, and the detection packets that are not affected by the external environment are not received, and the error is judged.
  • the MAC address forwarding suppression is performed on the device, and the abnormal traffic can be determined and defended. Moreover, it does not affect other forwarding traffic on this port or on this VLAN.
  • the impact of the network device can be minimized, the device can be defended based on the traffic, and can be automatically restored, and the device can be alerted to the abnormality of a certain traffic, thereby improving the maintainability and robustness of the network and the device. Fault tolerance.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请公开了一种网络控制方法、装置及计算机可读存储介质，该网络控制方法包括：设备检测媒体接入控制地址的上报速率，当媒体接入控制地址的上报速率大于或等于预设速率门限时，所述设备配置丢弃源命中该媒体接入控制地址的报文。

Description

一种网络控制方法、装置和计算机可读存储介质
相关申请的交叉引用
本申请基于申请号为201711014177.7、申请日为2017年10月25日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本公开涉及网络技术，尤指一种网络控制方法和装置、计算机可读存储介质。
背景技术
一般情况下，网络设备进行断环处理的方法主要是端口环路检测，或者启用生成树协议(STP，Spanning Tree Protocol)。
目前普遍设备使用的端口环路检测，可能导致以下问题：
1、需要使用中央处理器(CPU，Central Processing Unit)对环路检测报文进行收发，会加大CPU的消耗。
2、环路检测报文在被设备发出之后，在网络中是否能正确回收，受到网络环境的影响有不确定性，不一定能准确地判定是否存在环路。
3、一般环路检测发现端口下存在环路，所做防御性操作一般是关闭端口，或生成树状态阻塞(block)，这样的操作都会直接影响整个端口或的转发状态端口在虚拟局域网(VLAN，Virtual Local Area Network)中的所有转发状态。
目前普遍设备使用的STP，可能导致以下问题：
1、STP无法计算单端口成环状态。
2、STP会导致CPU计算量增加，加大CPU的消耗。
3、STP基于VLAN对某个端口进行防御性block，此操作会影响这个端口在VLAN中的所有转发行为。
由此可见，目前的相关技术中，不管使用哪种方式，都可能造成CPU的消耗增加，并且目前的相关技术中，所有的防御性操作都是针对某端口或者某VLAN中的某端口来进行处理的，这样的处理必然会导致某端口或者某VLAN中的某端口的所有转发流量都被截断，而且目前的相关技术中，不管用哪种方式，都有可能出现即使网络中出现环路，也无法正确判断的情况，例如端口环路检测报文无法收到，或STP无法计算单端口环路的情况。
发明内容
本公开至少一实施例提供了一种网络控制方法、装置和计算机可读存储介质。
本公开至少一实施例提供了一种网络控制方法，包括：
设备检测媒体接入控制(MAC，Media Access Control)地址的上报速率，当MAC地址的上报速率大于或等于预设速率门限时，所述设备配置丢弃源命中该MAC地址的报文。
本公开一实施例提供一种网络控制装置，包括存储器和处理器，所述存储器存储有程序，所述程序在被所述处理器读取执行时，执行以下操作：
检测MAC地址的上报速率，当MAC地址的上报速率大于或等于预设速率门限时，配置丢弃源命中该MAC地址的报文。
本公开一实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现上述网络控制方法。
与相关技术相比，本申请一实施例提供的网络控制方法，利用MAC地址设置源命中丢弃的方式来进行系统防护，既不会增加太多CPU的报文交互导致CPU占用率上升，又不会因为受到外界环境影响而导致的检测报文无法收到而出现漏判，只是在设备上进行MAC地址的转发抑制，即可针对 某异常流量进行判定和防御，而且，还不会影响此端口上或者此VLAN上的其他转发流量。应用该方案，能及时对环路进行处理，且对设备CPU的压力较小，也就是说，可以使得网络设备的影响最小化，设备可以基于流量进行防御。
本公开的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本公开而了解。本公开的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本公开技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本公开的技术方案。
图1为本公开一实施例提供的网络控制方法流程图；
图2为本公开一实施例提供的网络控制装置框图；
图3为本公开一实施例提供的网络控制方法流程图；
图4为本公开一实施例提供的网络控制方法流程图；
图5为本公开一实例提供的交换机环路示意图；
图6为本公开一实例提供的交换机环路示意图。
具体实施方式
为使本公开的目的、技术方案和优点更加清楚明白，下文中将结合附图对本公开的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请的主要思想是：设备在出现二层环路的时候，在正常情况下会出现MAC地址漂移的状态，即设备转发的流量源MAC地址会在正常的接 收端口和成环的端口上不断进行漂移，而这样的环路出现的时候，此MAC地址漂移的速度将会是非常快的。因此设备必然收到大量此MAC地址的漂移上报。而设备只要针对这个MAC地址，写入一条针对此源MAC地址的MAC地址条目，并且设置其命中后丢弃报文的行为，即可完成对于此种情况的设备防护。
因为在设置MAC地址丢弃之后，无论成环的位置在设备本身还是在网络远端，设备都可以基于流进行判定，认定此流量已经出现环路异常，因此无需再针对此流量做正常的MAC地址学习上报以及转发的处理，即刻将此MAC地址设置为命中后丢弃报文的行为，设备就直接将此报文丢弃，不会再上送CPU该MAC地址相关的漂移上报，通过此行为，一方面使得环路报文不会冲击设备端口带宽，另一方面，使得环路报文的MAC地址漂移信息不会冲击设备CPU，即完成了对设备的正常状态的保护行为。
另外，本申请设置的防御措施仅针对MAC地址，而不是基于端口的行为也不是基于某个端口在某VLAN内的行为，因此，此防御措施仅会针对某条流量的源MAC地址命中的行为生效，而不会影响此端口的其他的流量转发，这样的防御措施，尤其在单端口环路的情况下，会非常有优势，因为单端口环路时，可能整个端口流量中，只有某一条流出现环路的冲击而其他流量都是正常的。在这样的防御措施保护下，设备可以最大程度的保证其他流量的正常转发，并抑制此异常流量的转发和MAC地址漂移上报。
本公开一实施例提供一种网络控制方法，如图1所示，包括：
步骤101，设备检测MAC地址的上报速率。
其中，分别检测各MAC地址的上报速率。
步骤102，当MAC地址的上报速率大于或等于预设速率门限时，所述设备配置丢弃源命中该MAC地址的报文。
其中，步骤101中，上报速率可以根据实际出现环路时MAC地址的上报速率进行设定，略小于该值即可。当然，也可以根据其他方式设定，比如网络容量进行设定。
本实施例提供的网络控制方法，既可防止出现环路的MAC地址漂移冲 击设备的CPU，也可以防止此MAC地址的报文持续冲击端口的带宽。另外，只对该MAC地址的报文进行丢弃，该端口的其他报文不受影响，对端口的影响比较小。
在一可选实施例中，所述设备配置丢弃源命中该MAC地址的报文包括：
所述设备在MAC地址表或访问控制列表(ACL，Access Control List)中写入该MAC地址并设置源MAC地址命中该MAC地址丢弃动作。
在一可选实施例中，所述方法还包括：当所述上报速率大于或等于预设速率门限时，所述设备向系统进行出现环路的告警，所述告警中携带所述MAC地址。通过告警可以提示用户及时对网络健康性进行检查，及时消除环路。
在一可选实施例中，所述方法还包括：
步骤103，所述设备配置丢弃源命中该MAC地址的报文后，进行计时，当计时时间达到预设计时门限后，所述设备删除丢弃源命中该MAC地址的报文的配置。
当然，也可以在接收到用户指令后，删除丢弃源命中该MAC地址的报文的配置。
其中，预设计时门限的大小可以根据需要设定。
在一可选实施例中，所述方法还包括：所述设备删除丢弃源命中该MAC地址的报文的配置后，所述设备检测MAC地址的上报速率，当所述上报速率大于或等于预设速率门限时，所述设备配置丢弃源命中该MAC地址的报文。
如图2所示，本公开一实施例提供一种网络控制装置20，包括存储器210和处理器220，所述存储器210存储有程序，所述程序在被所述处理器220读取执行时，实现上述网络控制方法。
本公开一实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现上述网络控制方法。
所述计算机可读存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
下面通过具体实施例进一步说明本申请。
实施例一
本实施例中，设备单端口出现远端环路，如图3所示，包括：
步骤301，设备收到正常上行端口流量，学习MAC地址，转发至下行端口后，远端网络中出现环路。
步骤302，所述设备的上行端口和出现环路的端口出现连续的MAC地址漂移。
步骤303，所述设备对上报的MAC地址进行判定，如果单位时间内上报的MAC地址(即上报速率)达到预设速率门限(比如大于或等于预设速率门限)，则所述设备将此MAC地址写入MAC地址表中，设置源MAC地址命中丢弃标记，即只要命中此MAC地址的流量，源MAC与此MAC地址条目相同，则丢弃此报文；所述设备向系统发送告警，告警此设备此MAC地址出现环路。
所述预设速率门限可以通过设备在出现环路时MAC地址上送CPU的速度来进行设置，一般设置一个比真实出现环路时MAC地址上送CPU的速率略小的值，或者根据实际的网络容错能力由用户进行配置。
步骤304，之后，接收到源MAC地址命中设置的MAC地址的报文后，丢弃该报文，即产生环路的报文被丢弃，不会再对设备造成冲击。
步骤305，设备设置了源MAC地址命中丢弃条目之后，还进行计时，计时时间达到预设计时门限后，删除此MAC地址，即先解除针对此MAC地址的防御机制，此时又有该MAC地址的上报，检测该MAC地址的上报速率，若上报速率小于或等于预设速率门限，则说明此MAC地址流量的环路已经消除，该流量即可正常转发；若上报速率大于预设速率门限，则表明环路仍然存在，则再次启动防御机制，即将此MAC地址写入MAC地址表中，设置源MAC地址命中丢弃标记。
需要说明的是，在本实施例中，MAC地址的上报速率的检测可以一直执行，并不受是否启动防御机制的影响，只不过启动了防御机制后，无被防御的MAC地址的上报。
实施例二
本实施例中，设备多个端口之间出现环路，如图4所示，包括：
步骤401，设备收到正常上行端口流量，学习MAC地址，转发至下行端口后，设备的其他端口又收到此流量环回回来的流量。
步骤402，所述设备的上行端口和下行端口和其他环路端口之间即出现连续的MAC地址漂移。
步骤403，所述设备对上报的MAC地址进行判定，如果单位时间内上报的MAC地址(即上报速率)达到预设速率门限(比如大于或等于预设速率门限)，则所述设备将此MAC地址写入MAC地址表中，设置源MAC地址命中丢弃标记，即只要命中此MAC地址的流量，源MAC与此MAC地址条目相同，则丢弃此报文；所述设备向系统发送告警，告警此设备此MAC地址出现环路。
步骤404，之后，接收到源MAC地址命中设置的MAC地址的报文后，丢弃该报文，即产生环路的报文被丢弃，不会再对设备造成冲击。
步骤405，设备设置了源MAC地址命中丢弃条目之后，还进行计时，计时时间达到预设计时门限后，删除此MAC地址，即先解除针对此MAC地址的防御机制，此时又有该MAC地址的上报，检测该MAC地址的上报速率，若上报速率小于或等于预设速率门限，则说明此MAC地址流量的环路已经消除，该流量即可正常转发；若上报速率大于预设速率门限，则表明环路仍然存在，则再次启动防御机制，即将此MAC地址写入MAC地址表中，设置源MAC地址命中丢弃标记。
上述实施例提供的网络控制方法，既可以完成对端口环路的判定，又没有增加过多的CPU消耗，期间不需要运行任何的协议，也不需要发送任何的检测报文，只需要通过自身的单位时间内的MAC地址漂移次数(即上 报速率)，即可判定是否存在环路风险，并且可以针对流量对用户进行告警，并随即启动防御策略切断异常冲击设备的流量，并且可以及时对环路状态进行尝试性的检测，一旦环路依旧存在，则短暂冲击之后，设备会立刻再次启动防御措施，而环路一旦消失，则系统可以在无任何人为干预的情况下自动恢复正常。
从上面的描述可以看出，本公开实施例提供的方案，利用MAC地址设置源命中丢弃的方式来进行系统防护，既不会增加太多CPU的报文交互导致CPU占用率上升，又不会因为受到外界环境影响而导致的检测报文无法收到而出现漏判，只是在设备上进行MAC地址的转发抑制，即可针对某异常流量进行判定和防御，而且，还不会影响此端口上或者此VLAN上的其他转发流量。应用该方案，可以使得网络设备的影响最小化，设备可以基于流量进行防御。
另外，本公开实施例的方案，可自动解除对该MAC地址的报文的转发抑制，并可以针对某流量的异常对设备进行告警，提高了网络的可维护性和健壮性以及设备的容错性。
下面通过具体实例进一步说明本公开。
实例1
如图5所示，本实施例中，交换机A的某流量，其源MAC地址为00:11:22:33:44:55vlan 10，入端口为A1，出端口为A2；A2端口远端出现环路，导致此MAC地址流量被环路返回交换机A；此时A1和A2端口因为不断收到源MAC地址为00:11:22:33:44:55+vlan10的报文，因此A1端口和A2端口不断上报此MAC地址学习。
交换机A在不同端口收到大量相同的某个MAC地址上报(例如一秒内收到100次此同样的MAC地址在不同端口的上报)，超过预设速率门限，判定此MAC地址出现了环路MAC地址漂移。
交换机A开始进行防御性措施，将此MAC地址00:11:22:33:44:55+vlan10写入MAC地址表中，并设置其源命中丢弃。同时，针对此MAC地址向系统上报异常告警。
交换机A再从A1或A2收到此源MAC地址的报文时，匹配到此MAC地址表条目，直接丢弃该报文。
交换机A经过预设计时门限(例如5分钟)之后，尝试将MAC地址表中的源MAC地址00:11:22:33:44:55+vlan10命中丢弃的MAC地址条目删除，即解除针对此MAC地址的防御措施。此时，若交换机的环路故障未消除，该MAC地址的上报速率又达到预设速率门限(例如1秒内收到100个MAC地址漂移条目)，则再次启动防御措施，在MAC地址表中写入此MAC地址源命中丢弃的条目。若交换机的环路故障已经消除，该MAC地址的上报速率小于预设速率门限，则此源MAC地址的流量又可以正常转发了。
实例2
如图6所示，本实施例中，交换机A的某流量，其源MAC地址为00:11:22:33:44:55vlan 10，入端口为A1，出端口为A2；交换机A的A2和A3端口出现环路，导致此MAC地址流量被环路返回交换机A，此时A1端口、A2端口和A3端口因为不断收到源MAC地址为00:11:22:33:44:55+vlan10的报文，因此A1端口、A2端口和A3端口不断上报此MAC地址学习。
交换机A在不同端口收到大量相同的某个MAC地址上报(例如一秒内收到100次此同样的MAC地址在不同端口的上报)，超过预设速率门限，即认定此MAC地址出现了环路MAC地址漂移。
交换机A开始进行防御性措施，将此MAC地址00:11:22:33:44:55+vlan10写入MAC地址表中，并设置其源命中丢弃。同时，针对此MAC地址对系统上报异常告警。
交换机再从A1端口、A2端口和A3端口收到此源MAC地址的报文时，匹配到此MAC地址表条目，该报文直接被丢弃。
交换机A经过预设计时门限(例如5分钟)之后，尝试将MAC地址表中的源MAC地址00:11:22:33:44:55+vlan10命中丢弃的MAC地址条目 删除，即解除针对此MAC地址的防御措施。此时，若交换机的环路故障未消除，该MAC地址的上报速率又达到预设速率门限(例如1秒内收到100个MAC地址漂移条目)，则再次启动防御措施，在MAC地址表中写入此MAC地址源命中丢弃的条目。若交换机的环路故障已经消除，该MAC地址的上报速率小于预设速率门限，则此源MAC地址的流量又可以正常转发了。
实例3
本实例中，提供一种使用ACL来进行防御的实现方式。
类似实例1和实例2中的情景，源MAC地址为00:11:22:33:44:55vlan 10的流量出现环路，交换机A判定出现MAC地址漂移且到达预设速率门限。
交换机A开始进行防御性措施，设置一个ACL规则，命中此MAC地址00:11:22:33:44:55+vlan10，并设置ACL报文丢弃动作，在相应端口生效(例如在此MAC地址出现漂移的端口生效，或者针对交换机所有端口生效)。以及，针对此MAC地址对系统上报异常告警。
经过预设计时门限(例如5分钟)后，删除此ACL规则，若环路未消失，则MAC地址上报速率再次达到预设速率门限，设置此ACL规则，若消失，则设备恢复正常，转发此条流量。
由以上的技术方案可见，与一般的设备的环路抑制和系统防护机制相比，利用此MAC地址设置源命中丢弃的方式来进行系统防护的方法，既不会增加太多CPU的报文交互导致CPU利用率上升，又不会因为受到外界环境影响而导致的检测报文无法收到而出现漏判，只是在设备上进行MAC地址的转发抑制，即可针对某异常流量进行判定和防御，而且，还不会影响此端口上或者此VLAN上的其他转发流量。应用这样的方法，可以使得网络设备的影响最小化，设备可以基于流量进行防御，并且可自动恢复，并可以针对某流量的异常对设备进行告警，提高了网络的可维护性和健壮性以及设备的容错性。
虽然本公开所揭露的实施方式如上，但所述的内容仅为便于理解本公 开而采用的实施方式，并非用以限定本公开。任何本公开所属领域内的技术人员，在不脱离本公开所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本公开的专利保护范围，仍须以所附的权利要求书所界定的范围为准。

Claims (11)

  1. 一种网络控制方法，包括：
    设备检测媒体接入控制地址的上报速率，当媒体接入控制地址的上报速率大于或等于预设速率门限时，所述设备配置丢弃源命中该媒体接入控制地址的报文。
  2. 如权利要求1所述的网络控制方法，其中，所述设备配置丢弃源命中该媒体接入控制地址的报文包括：
    所述设备在媒体接入控制地址表或访问控制列表中写入该媒体接入控制地址并设置源媒体接入控制地址命中该媒体接入控制地址丢弃动作。
  3. 如权利要求1所述的网络控制方法，其中，所述方法还包括：当所述上报速率大于或等于所述预设速率门限时，所述设备向系统发送出现环路的告警，所述告警中携带所述媒体接入控制地址。
  4. 如权利要求1至3任一项所述的网络控制方法，其中，所述方法还包括：
    所述设备配置丢弃源命中该媒体接入控制地址的报文后，进行计时，当计时时间达到预设计时门限后，所述设备删除丢弃源命中该媒体接入控制地址的报文的配置。
  5. 如权利要求4所述的网络控制方法，其中，所述方法还包括：
    所述设备删除丢弃源命中该媒体接入控制地址的报文的配置后，所述设备检测所述媒体接入控制地址的上报速率，当所述上报速率大于或等于预设速率门限时，所述设备配置丢弃源命中该媒体接入控制地址的报文。
  6. 一种网络控制装置，包括存储器和处理器，所述存储器存储有程序，所述程序在被所述处理器读取执行时，执行以下操作：
    检测媒体接入控制地址的上报速率，当媒体接入控制地址的上报速率大于或等于预设速率门限时，配置丢弃源命中该媒体接入控制地址的报文。
  7. 如权利要求6所述的网络控制装置，其中，所述进行丢弃源命中该媒体接入控制地址的报文的配置包括：
    在媒体接入控制地址表或访问控制列表中写入该媒体接入控制地址并设置源媒体接入控制地址命中该媒体接入控制地址丢弃动作。
  8. 如权利要求6所述的网络控制装置，其中，所述程序在被所述处理器读取执行时，还执行以下操作：
    当所述上报速率大于或等于所述预设速率门限时，向系统发送出现环路的告警，所述告警中携带所述媒体接入控制地址。
  9. 如权利要求6至8任一项所述的网络控制装置，其中，所述程序在被所述处理器读取执行时，还执行以下操作：
    配置丢弃源命中该媒体接入控制地址的报文后，进行计时，当计时时间达到预设计时门限后，删除丢弃源命中该媒体接入控制地址的报文的配置。
  10. 如权利要求9所述的网络控制装置，其中，所述程序在被所述处理器读取执行时，还执行以下操作：
    删除丢弃源命中该媒体接入控制地址的报文的配置后，检测所述媒体接入控制地址的上报速率，当所述上报速率大于或等于所述预设速率门限时，配置丢弃源命中该媒体接入控制地址的报文。
  11. 一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现如权利要求1至5任一项所述的网络控制方法。
PCT/CN2018/105115 2017-10-25 2018-09-11 一种网络控制方法、装置和计算机可读存储介质 WO2019080658A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP18870403.5A EP3675422A4 (en) 2017-10-25 2018-09-11 NETWORK CONTROL PROCESS AND DEVICE, AND COMPUTER READABLE STORAGE MEDIA

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711014177.7A CN109714182B (zh) 2017-10-25 2017-10-25 一种网络控制方法、装置和计算机可读存储介质
CN201711014177.7 2017-10-25

Publications (1)

Publication Number Publication Date
WO2019080658A1 true WO2019080658A1 (zh) 2019-05-02

Family

ID=66247752

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/105115 WO2019080658A1 (zh) 2017-10-25 2018-09-11 一种网络控制方法、装置和计算机可读存储介质

Country Status (3)

Country Link
EP (1) EP3675422A4 (zh)
CN (1) CN109714182B (zh)
WO (1) WO2019080658A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117857222A (zh) * 2024-03-07 2024-04-09 国网江西省电力有限公司电力科学研究院 一种基于动态ip的新能源集控站网络动态防御系统及方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114666200A (zh) * 2022-02-14 2022-06-24 国电南瑞科技股份有限公司 一种智能变电站网络的环路检测方法、装置及存储介质
CN118101515B (zh) * 2024-04-24 2024-07-19 珠海星云智联科技有限公司 异常拓扑处理方法、系统、设备以及集群

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1941775A (zh) * 2006-07-19 2007-04-04 华为技术有限公司 一种防止网络消息攻击的方法及设备
CN102014062A (zh) * 2010-12-01 2011-04-13 中兴通讯股份有限公司 Mac地址漂移的控制方法和装置
EP2966798A1 (en) * 2013-04-24 2016-01-13 ZTE Corporation Active and standby changeover method, apparatus, device, and system for network device
CN106230632A (zh) * 2016-07-29 2016-12-14 锐捷网络股份有限公司 网络环路的处理方法及装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7496030B2 (en) * 2003-03-26 2009-02-24 Lucent Technologies, Inc. Managing loops between network devices by monitoring MAC moves
US7515530B2 (en) * 2004-03-25 2009-04-07 Alcatel-Lucent Usa Inc. Detecting loops between network devices by monitoring MAC moves
JP2006013737A (ja) * 2004-06-24 2006-01-12 Fujitsu Ltd 異常トラヒック除去装置
CN101227400B (zh) * 2008-02-01 2011-12-28 中兴通讯股份有限公司 用于以太网的数据包处理方法和装置
US8885486B2 (en) * 2009-03-31 2014-11-11 Cisco Technology, Inc. Detecting and mitigating data plane bridging loops
CN102136960A (zh) * 2010-01-27 2011-07-27 华为技术有限公司 交换机端口控制方法和装置
CN102223269B (zh) * 2011-06-23 2015-06-17 瑞斯康达科技发展股份有限公司 一种报文处理方法、mac地址漂移的检测方法及装置
WO2013082819A1 (zh) * 2011-12-09 2013-06-13 华为技术有限公司 一种二层网络环路处理的方法、装置及网络设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1941775A (zh) * 2006-07-19 2007-04-04 华为技术有限公司 一种防止网络消息攻击的方法及设备
CN102014062A (zh) * 2010-12-01 2011-04-13 中兴通讯股份有限公司 Mac地址漂移的控制方法和装置
EP2966798A1 (en) * 2013-04-24 2016-01-13 ZTE Corporation Active and standby changeover method, apparatus, device, and system for network device
CN106230632A (zh) * 2016-07-29 2016-12-14 锐捷网络股份有限公司 网络环路的处理方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117857222A (zh) * 2024-03-07 2024-04-09 国网江西省电力有限公司电力科学研究院 一种基于动态ip的新能源集控站网络动态防御系统及方法
CN117857222B (zh) * 2024-03-07 2024-07-05 国网江西省电力有限公司电力科学研究院 一种基于动态ip的新能源集控站网络动态防御系统及方法

Also Published As

Publication number Publication date
EP3675422A1 (en) 2020-07-01
CN109714182B (zh) 2022-01-25
CN109714182A (zh) 2019-05-03
EP3675422A4 (en) 2021-04-14

Similar Documents

Publication Publication Date Title
US11637845B2 (en) Method and apparatus for malicious attack detection in a software defined network (SDN)
WO2019080658A1 (zh) 一种网络控制方法、装置和计算机可读存储介质
US8958318B1 (en) Event-based capture of packets from a network flow
US10574555B2 (en) Network data stream tracer
US20150350049A1 (en) Method and device for generating cnm
US9407602B2 (en) Methods and apparatus for redirecting attacks on a network
US9979695B2 (en) Method, device, and system for monitoring a security network interface unit
TWI713501B (zh) 識別網路環路的方法、裝置、流量清洗設備及系統
US20080267081A1 (en) Link layer loop detection method and apparatus
CN107438066B (zh) 一种基于SDN控制器的DoS/DDoS攻击防御模块及方法
CN102577240B (zh) 用于采用速率限制进行病毒扼制的方法和装置
WO2014108029A1 (zh) 网络异常通知方法和装置
CN104539461B (zh) 一种抑制协议端口振荡上报的装置及方法
KR20100095626A (ko) Ｍａｃ 테이블 오버플로우 공격에 대해 방어하는 방법 및 이더넷 스위치
US20210014249A1 (en) Packet Transmission Method and Apparatus
US8159948B2 (en) Methods and apparatus for many-to-one connection-rate monitoring
US8948002B2 (en) Method and device for preventing repeated refreshing of address table of Ethernet ring network node
WO2016139910A1 (ja) 通信システム、通信方法、及びプログラムを格納した非一時的なコンピュータ可読媒体
US8885486B2 (en) Detecting and mitigating data plane bridging loops
US10944695B2 (en) Uplink port oversubscription determination
WO2011032456A1 (zh) 一种检测访问控制列表生效的方法和装置
WO2022057647A1 (zh) 一种报文的处理方法、系统及设备
WO2015154548A1 (zh) 端口处理方法及装置
JP2007259223A (ja) ネットワークにおける不正アクセスに対する防御システム、方法およびそのためのプログラム
CN113114578B (zh) 一种流量拥塞隔离方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18870403

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018870403

Country of ref document: EP

Effective date: 20200326

NENP Non-entry into the national phase

Ref country code: DE