WO2023093367A1 - 数据抓包方法、装置、电子设备及存储介质 - Google Patents

数据抓包方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2023093367A1
WO2023093367A1 PCT/CN2022/125759 CN2022125759W WO2023093367A1 WO 2023093367 A1 WO2023093367 A1 WO 2023093367A1 CN 2022125759 W CN2022125759 W CN 2022125759W WO 2023093367 A1 WO2023093367 A1 WO 2023093367A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet capture
data
packet
server
capture
Prior art date
Application number
PCT/CN2022/125759
Other languages
English (en)
French (fr)
Inventor
施政法
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2023093367A1 publication Critical patent/WO2023093367A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/04—Network management architectures or arrangements
    • H04L41/044—Network management architectures or arrangements comprising hierarchical management structures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/12—Discovery or management of network topologies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/12—Network monitoring probes
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Definitions

  • the embodiments of the present application relate to the communication field, and in particular to a data packet capture method, device, electronic equipment, and storage medium.
  • a virtualized resource pool usually adopts a three-layer network: a physical layer network composed of routers, aggregation switches, access switches, and hardware servers, a virtual network composed of virtual switches, and an application layer network composed of application layer software.
  • a three-layer network architecture the forwarding path of the network is long, and the forwarding point crosses layers.
  • the location of network faults is much more complicated than that of traditional network devices.
  • the current method for locating network faults is to capture data packets at possible fault points, and analyze the captured packet data to complete fault location.
  • the commonly used data capture method is to manually use a notebook or PC to directly connect to the device that needs to capture packets for data capture.
  • this manual packet capture method needs to actually connect to the physical device and manually enter commands to capture packets. It can neither capture packets for multiple network devices at the same time, nor can it automatically and remotely provide packet capture services.
  • the main purpose of the embodiments of the present application is to provide a data packet capture method, device, electronic equipment, and storage medium to realize automatic and remote data packet capture for multiple network devices at the same time.
  • the embodiment of the present application provides a data packet capture method, according to the packet capture conditions and the pre-collected network device topology, to obtain the packet capture point of each layer of network equipment that the data traffic passes through during the transmission process;
  • the network equipment to which each of the packet capture points belongs sends respectively a packet capture command for capturing packets of the data traffic, wherein the packet capture command carries a deployment location of a packet capture server corresponding to the network device, and the capture
  • the packet server is a virtual machine, configured to receive the packet capture data sent by the corresponding network device; and acquire the packet capture data from the packet capture server.
  • a data packet capture device including:
  • the packet capture point acquisition module is used to obtain the packet capture points of each layer of network equipment that the data traffic passes through during the transmission process according to the packet capture conditions and the pre-collected network device topology;
  • An instruction sending module configured to respectively send packet capture instructions for capturing packets of the data traffic to network devices to which the packet capture points belong, wherein the packet capture instructions carry packet capture servers corresponding to the network devices
  • the packet capture server is a virtual machine for receiving the packet capture data sent by the corresponding network device
  • a receiving module configured to obtain the packet capture data from the packet capture server.
  • an embodiment of the present application also provides an electronic device, including: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores information that can be used by the at least one processor An instruction executed by a processor, the instruction is executed by the at least one processor, so that the at least one processor can execute the data packet capture method described above.
  • the embodiment of the present application also proposes a computer-readable storage medium storing a computer program, and implementing the above-mentioned data packet capture method when the computer program is executed by a processor.
  • a data packet capture method, device, electronic device and storage medium proposed by the application automatically calculates and obtains the packet capture point according to the packet capture conditions and the pre-collected network device topology, and then automatically sends the packet capture point according to the determined packet capture point
  • the network device to which the point belongs sends a packet capture command, realizing remote, automatic, and simultaneous capture of multiple network devices.
  • the packet capture command carries the deployment location of the packet capture server corresponding to the network device, and the packet capture server is a virtual machine.
  • the packet capture data can be obtained from the packet capture server, and the virtual machine is used as the packet capture server, which avoids the requirement of physical packet capture on the packet capture hardware, and makes full use of the idle resources in the virtualized resource pool. Additional packet capture hardware is required.
  • the whole method can perform remote and automatic packet capture on unattended network devices in remote areas without manual intervention, and is simple, convenient, low in cost and wide in applicability.
  • Fig. 1 is the flow chart one of the data capture method that the embodiment of the present application provides;
  • Fig. 2 is a flowchart two of the data capture method provided by the embodiment of the present application.
  • FIG. 3 is a schematic diagram of a packet capture traffic path topology provided by an embodiment of the present application.
  • Fig. 4 is a flow chart three of the data capture method provided by the embodiment of the present application.
  • Fig. 5 is a schematic structural diagram of a data capture device provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an electronic device provided in an embodiment of the present application.
  • the data packet capture method of this application is applicable to any network, especially for the three-tier network architecture of virtualized resource pools. Due to fault location, it is often necessary to simultaneously capture data packets on multiple network devices in multiple layers, but the currently commonly used
  • the manual packet capture method requires multiple people to operate, and manual input of packet capture instructions requires extremely high professional skills in network communication for operators. When multiple network devices are located in different remote areas, it is necessary to simultaneously It is even more difficult to perform data packet capture operations.
  • the data center network in the three-tier network architecture of the virtual resource pool usually uses more than 10 Gigabit ports, and there are restrictions on notebook or PC network cards. Notebooks or PCs that do not support 10 Gigabit ports cannot capture packets, and the energy industry The scale of the virtualized resource pool is generally small. If you configure independent data packet capture software and hardware, the cost is high and the resources are wasted.
  • this application obtains packet capture points through automatic calculation, automatically sends packet capture commands to all packet capture points, and uses virtual machines as packet capture servers to realize remote, automatic, and multi-layer collaboration of cross-layer network devices in virtualized resource pools.
  • the data packet capture increases the ease of use, accuracy and applicability of data packet capture, improves the efficiency of network fault location, and reduces costs.
  • the embodiment of the present application relates to a method for capturing packets of data, as shown in Figure 1, comprising:
  • Step 101 according to the packet capture conditions and the pre-collected network device topology, obtain the packet capture points of the network devices of each layer that the data flow passes through during the transmission process.
  • the packet capture condition includes one of the following or any combination thereof: IP address, protocol type, port.
  • IP address IP address
  • protocol type IP address
  • port the packet capture point is the port of the network device, and the network device ports through which the data traffic passes can be automatically and quickly calculated through the packet capture conditions and the pre-collected network topology structure. Packet capture point.
  • the determination of the packet capture point can also be manually set, that is, manually specify the packet capture point, which is suitable for operation and maintenance personnel who are familiar with the network.
  • manually specifying the packet capture point only needs to manually set the port of the network device that needs to capture packets, and the issuance of subsequent packet capture commands and the acquisition of packet capture data are still automated and remote.
  • Step 102 Send packet capture instructions for packet capture to data traffic to the network devices to which each packet capture point belongs, wherein the packet capture instructions carry the deployment location of the packet capture server corresponding to the network device, and the packet capture server is a virtual The machine is used to receive the packet capture data sent by the corresponding network device.
  • a packet capture command is issued to the network device to which the packet capture point belongs, and the network device sends the packet capture data to the corresponding packet capture server after receiving the command.
  • the network device sends the packet capture data to the corresponding packet capture server after receiving the command.
  • the specific number of packet capture servers can be determined on demand according to the traffic of packet capture data and available idle resources.
  • the packet capture server is a virtual machine
  • a virtual machine Virtual Machine, VM refers to a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment.
  • This application uses a virtual machine as a packet capture server and deploys it on demand, which avoids the requirement of physical packet capture for packet capture hardware, makes full use of idle resources in the virtualized resource pool, and does not require additional configuration of packet capture hardware.
  • Step 103 acquiring the packet capture data from the packet capture server.
  • the packet capture server may have built-in packet capture software, such as wireshark software, to save the packet capture data to a file and open the file for download.
  • packet capture software such as wireshark software
  • network devices involved in this embodiment may be located in a virtualized layer-3 networking network. That is to say, in this embodiment, data packets can be captured on physical devices (routers, aggregation switches, access switches, hardware servers), and virtual devices (hosts, virtual machines) can also be captured.
  • a data packet capture method proposed in this application automatically calculates and obtains the packet capture point, and then automatically sends the packet capture point to the network device to which the packet capture point belongs according to the determined packet capture point Instructions realize remote, automatic, and simultaneous packet capture for multiple network devices.
  • the packet capture command carries the deployment location of the packet capture server corresponding to the network device.
  • the packet capture server is a virtual machine.
  • the packet capture data can be obtained in the packet server, and the virtual machine is used as the packet capture server, which avoids the requirement of physical packet capture for the packet capture hardware, makes full use of the idle resources in the virtualized resource pool, and does not need additional configuration of packet capture hardware.
  • the whole method can perform remote and automatic packet capture on unattended network devices in remote areas without manual intervention, and is simple, convenient, low in cost and wide in applicability.
  • the embodiment of the present application relates to a method for capturing packets of data, as shown in Figure 2, comprising:
  • Step 201 collecting performance data of each network device.
  • Step 202 according to the packet capture conditions and the pre-collected network device topology, obtain the packet capture points of the network devices at various layers that the data traffic passes through during the transmission process.
  • Step 203 according to the collected performance data of each network device and the location of each network device, determine the deployment location of the packet capture server corresponding to each network device, and create a packet capture server at the deployment location.
  • the packet capture point determines the deployment location of the packet capture server corresponding to each network device, and create a packet capture server at the deployment location, including: If the packet point is a virtual machine port or a host port, and the host where the packet capture point is located meets the resource requirements required by the packet capture server, the host is determined as the deployment location of the corresponding packet capture server; the packet capture point is a virtual machine port or host port, and the host where the packet capture point is located does not meet the resource requirements required by the packet capture server, find the host that meets the resource requirements from the access switch associated with the host as the deployment location of the corresponding packet capture server; When the packet capture point is an access switch port, from the hosts corresponding to the servers directly connected to the access switch where the packet capture point is located, select the host with the smallest load according to the performance data as the deployment location of the corresponding packet capture server ; In the case where the packet capture point is the aggregation switch port, from the hosts corresponding to all the servers
  • the performance data includes one or any combination of the following: CPU, memory, storage availability, memory usage, IO traffic; load includes current load and/or historical load of the same period.
  • the host carrying the packet capture server needs to meet the requirements of the packet capture server. Resource requirements, and ensure that the superposition of packet capture data and normal business data will not exceed the bandwidth limit of the host.
  • the packet capture server after determining the deployment positions of the packet capture servers corresponding to each network device, it also includes: obtaining the packet capture traffic path from the network device to the corresponding packet capture server; Deliver the packet capture configuration information used to send the packet capture data to the corresponding packet capture server.
  • the remote mirroring technology may be used to implement the delivery of the packet capture configuration information.
  • the network device After receiving the packet capture configuration information, the network device sends the packet capture data to the corresponding packet capture server through the data traffic mirroring capability. Packet capture utilizes the traffic mirroring capability generally supported by network devices, does not require additional packet capture agents, has no additional requirements for networking, and has strong applicability.
  • the data traffic at the capture point Copy to the egress port, and set a fixed mirror VLAN for forwarding; for the intermediate device in the packet capture traffic path, pass the mirror data traffic on the fixed mirror VLAN downward; for the destination device in the packet capture traffic path, receive Fix the data traffic on the mirrored VLAN and send it to the egress port connected to the packet capture server.
  • the deployment location of the packet capture server is determined according to the collected performance data of each network device and the location of each network device, and the performance data of each network device changes in real time, that is to say, the location of the packet capture server It is not fixed. Every time you perform data capture, you need to dynamically create a packet capture server according to the performance data and location of the network device. This allows the packet capture server to be deployed nearby, avoiding the capture data from passing through too many devices, and effectively reducing the number of packets captured. The packet capture data generated by the packet preempts the normal business data bandwidth.
  • Figure 3a shows the packet capture traffic path when the packet capture server is fixed
  • Figure 3b shows the packet capture traffic path when the packet capture server is dynamically created.
  • VM means a virtual machine
  • vSwitch means a virtual switch
  • TOR means an access switch
  • EOR means an aggregation switch
  • GW means a resource pool egress gateway.
  • the packet capture traffic path is vSwitch2—>TOR12—>EOR1—>TOR22—>vSwitch4—>packet capture server.
  • the packet capture traffic path is TOR22->vSwitch4->packet capture server virtual machine, and two packet capture points (capture point VM3 and packet capture point) are superimposed on TOR22 and vSwitch4 EOR1) data traffic, when the packet capture data traffic is relatively large, it may cause the traffic on the relevant device to exceed the bandwidth capability.
  • the packet capture traffic path of the port on VM3 is vSwtich2—>packet capture server;
  • the port packet capture traffic path on EOR1 is TOR12—>vSwitch2—>packet capture server virtual machine;
  • only vSwitch2 superimposes the data traffic of two packet capture points, the devices through which the packet capture traffic passes are greatly reduced, and the risk of traffic exceeding the limit is greatly reduced.
  • vSwitch2 superimposes the data traffic of two packet capture points, the devices through which the packet capture traffic passes are greatly reduced, and the risk of traffic exceeding the limit is greatly reduced.
  • based on dynamic creation of packet capture servers With this mechanism, when the superposition of data traffic exceeds the limit, you can choose to create another packet capture server to divert the superimposed packet capture data traffic.
  • Step 204 sending packet capture instructions for capturing packets of the data traffic to the network devices to which each packet capture point belongs, wherein the packet capture instructions carry the deployment location of the packet capture server corresponding to the network device, and the packet capture server It is a virtual machine, which is used to receive the packet capture data sent by the corresponding network device.
  • Step 205 acquiring the packet capture data from the packet capture server.
  • step 205 after step 205, it also includes: sending a rollback instruction to each network device that the packet capture traffic path passes through, and deleting the packet capture server; wherein, the rollback instruction is used to indicate the network device that the packet capture traffic path passes through Each network device releases resources configured according to the packet capture configuration information. By issuing a rollback command and deleting the packet capture server, the entire network rolls back to the state before the packet capture.
  • a data packet capture method proposed in this application automatically calculates and obtains the packet capture point, and then automatically sends the packet capture point to the network device to which the packet capture point belongs according to the determined packet capture point Instructions realize remote, automatic, and simultaneous packet capture for multiple network devices.
  • the packet capture command carries the deployment location of the packet capture server corresponding to the network device.
  • the packet capture server is a virtual machine.
  • the packet capture data can be obtained in the packet server, and the virtual machine is used as the packet capture server, which avoids the requirement of physical packet capture for the packet capture hardware, makes full use of the idle resources in the virtualized resource pool, and does not need additional configuration of packet capture hardware.
  • a virtual machine is dynamically created to act as a packet capture server, and the deployment location of the virtual machine can be selected based on the performance data of each device on the virtual resource pool, so as to ensure that the virtual machine can be deployed by making full use of idle resources, and the traffic can be reasonably divided and captured. Packet traffic, reducing the impact of packet capture traffic on normal business traffic.
  • the embodiment of the present application relates to a data capture method, as shown in Figure 4, comprising:
  • Step 401 acquiring forwarding configuration data of each network device.
  • step 402 according to the forwarding configuration data, the next-hop forwarding information matching the packet capture condition is obtained.
  • Step 403 according to the next hop forwarding information and the topology structure of the network device, obtain the packet capture points of the network devices of each layer that the data flow passes through during the transmission process.
  • each network device has a forwarding table
  • the forwarding configuration data can be obtained according to the forwarding table, and the forwarding configuration data can be matched with the packet capture conditions to obtain the corresponding
  • the next hop forwarding information combined with the network device topology collected according to the link layer discovery protocol LLDP (Link Layer Discovery Protocol), generates the path through which the data traffic passes, thereby determining the forwarding point.
  • LLDP Link Layer Discovery Protocol
  • Step 404 Send packet capture instructions for packet capture to data traffic to the network devices to which each packet capture point belongs, wherein the packet capture command carries the deployment location of the packet capture server corresponding to the network device, and the packet capture server is a virtual The machine is used to receive the packet capture data sent by the corresponding network device.
  • Step 405 acquiring packet capture data from the packet capture server.
  • a data packet capture method proposed in this application automatically calculates and obtains the packet capture point, and then automatically sends the packet capture point to the network device to which the packet capture point belongs according to the determined packet capture point Instructions realize remote, automatic, and simultaneous packet capture for multiple network devices.
  • the packet capture command carries the deployment location of the packet capture server corresponding to the network device.
  • the packet capture server is a virtual machine.
  • the packet capture data can be obtained in the packet server, and the virtual machine is used as the packet capture server, which avoids the requirement of physical packet capture for the packet capture hardware, makes full use of the idle resources in the virtualized resource pool, and does not need additional configuration of packet capture hardware.
  • the embodiment of the present application relates to a data capture device, as shown in Figure 5, including:
  • the packet capture point acquisition module 501 is configured to obtain the packet capture points of network devices at various layers that data traffic passes through during transmission according to the packet capture conditions and the pre-collected network device topology.
  • An instruction sending module 502 configured to respectively send packet capture instructions for capturing packets of the data traffic to the network devices to which each packet capture point belongs, wherein the packet capture instructions carry packet capture corresponding to the network device
  • the deployment location of the server, the packet capture server is a virtual machine, configured to receive the packet capture data sent by the corresponding network device.
  • a receiving module 503, configured to obtain the packet capture data from the packet capture server.
  • the entire data packet capture device can be deployed independently or integrated with the management system of the network device itself, such as a network orchestrator and network element management system. When deployed independently, it is connected to the docking device management systems and packet capture servers of each layer through its own external management plane; when it is deployed in one with the management system of network devices, the external management plane of the management system of network devices is reused without additional Networking requirements.
  • the data packet capture device of the present application may also include: a collection module 504, configured to collect performance data of each of the network devices; a packet capture server deployment module 505, used to collect performance data of each of the network devices according to the collection data and the locations of the network devices, determine the deployment locations of the packet capture servers corresponding to the network devices, and create the packet capture servers at the deployment locations.
  • Packet capture configuration module 506, configured to obtain the packet capture traffic path from the network device to the corresponding packet capture server; send the packet capture data to each network device passing through the packet capture traffic path Packet capture configuration information to the corresponding packet capture server.
  • modules involved in this embodiment are logical modules, and a logical unit may be a physical unit, or a part of a physical unit, or may be realized by a combination of multiple physical units.
  • a logical unit may be a physical unit, or a part of a physical unit, or may be realized by a combination of multiple physical units.
  • units that are not closely related to solving the technical problem proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.
  • this embodiment is a device embodiment corresponding to the data packet capture method embodiment, and this embodiment can be implemented in cooperation with the above-mentioned embodiments.
  • the relevant technical details mentioned in the foregoing embodiments are still valid in this embodiment, and will not be repeated here in order to reduce repetition.
  • the relevant technical details mentioned in this embodiment can also be applied to the above method embodiments.
  • the embodiment of the present application relates to an electronic device, as shown in FIG. 6 , including: at least one processor 601; and a memory 602 communicatively connected to the at least one processor 601; Instructions executed by the at least one processor 601, the instructions are executed by the at least one processor 601, so that the at least one processor 601 can execute the data packet capture method in the foregoing implementation manner.
  • the memory and the processor are connected by a bus
  • the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors and various circuits of the memory together.
  • the bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein.
  • the bus interface provides an interface between the bus and the transceivers.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium.
  • the data processed by the processor is transmitted on the wireless medium through the antenna.
  • the antenna also receives the data and transmits the data to the processor.
  • the processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory can be used to store data that the processor uses when performing operations.
  • Embodiments of the present application relate to a computer-readable storage medium storing a computer program.
  • the computer program is executed by the processor, the above data packet capture method is realized.
  • a storage medium includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种数据抓包方法、装置、电子设备和存储介质，其中，数据抓包方法包括：根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点(101)；向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，所述抓包指令携带与网络设备对应的抓包服务器的部署位置，所述抓包服务器为虚拟机，用于接收所述对应的网络设备发送的抓包数据(102)；从所述抓包服务器中获取所述抓包数据(103)。

Description

数据抓包方法、装置、电子设备及存储介质
相关申请
本申请要求于2021年11月23号申请的、申请号为202111397093.2的中国专利申请的优先权。
技术领域
本申请实施例涉及通信领域，特别涉及一种数据抓包方法、装置、电子设备及存储介质。
背景技术
随着虚拟化技术在包括能源行业在内的工业领域的快速发展，虚拟化资源池的应用越来越广泛。虚拟化资源池通常采用三层组网：由路由器、汇聚交换机、接入交换机与硬件服务器组成的物理层网络，由虚拟交换机组成的虚拟网络、由应用层软件组成的应用层网络。在这种三层网络架构下，网络的转发路径长、转发点跨层，网络故障的定位相比传统的网络设备复杂得多。目前对网络故障进行定位的方法是对可能的故障点进行数据抓包，分析抓包数据完成故障定位。
常用的数据抓包方法是人工使用笔记本或PC机，直接连接到需要抓包的设备上进行数据抓包。但这种人工抓包方法，需要实际连接到物理设备、手动输入命令进行抓包，既无法对多个网络设备同时抓包，也无法自动、远程提供抓包服务。
发明内容
本申请实施例的主要目的在于提出一种数据抓包方法、装置、电子设备及存储介质，实现自动化、远程化对多个网络设备同时进行数据抓包。
为实现上述目的，本申请实施例提供了一种数据抓包方法，根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点；向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，所述抓包指令携带与网络设备对应的抓包服务器的部署位置，所述抓包服务器为虚拟机，用于接收所述对应的网络设备发送的抓包数据；从所述抓包服务器中获取所述抓包数据。
为实现上述目的，本申请实施例还提出了一种数据抓包装置，包括：
抓包点获取模块，用于根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点；
指令发送模块，用于向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，所述抓包指令携带与网络设备对应的抓包服务器的部署位置，所述抓包服务器为虚拟机，用于接收所述对应的网络设备发送的抓包数据；
接收模块，用于从所述抓包服务器中获取所述抓包数据。
为实现上述目的，本申请实施例还提出了一种电子设备，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个 处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行以上所述的数据抓包方法。
为实现上述目的，本申请实施例还提出了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现以上所述的数据抓包方法。
本申请提出的一种数据抓包方法、装置、电子设备及存储介质，根据抓包条件和预先采集的网络设备拓扑结构，自动计算获取抓包点，然后根据确定的抓包点自动向抓包点所属的网络设备发送抓包指令，实现了对多个网络设备进行远程、自动、同时抓包，其中抓包指令携带了与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，数据抓包完成后从抓包服务器中即可获取抓包数据，采用虚拟机来充当抓包服务器，避免了物理抓包对抓包硬件的要求，充分利用虚拟化资源池内的空闲资源，不需要额外配置抓包硬件。整个方法可以对偏远地区、无人值守的网络设备进行远程、自动抓包，无需人工干预，简单方便，成本低，适用性广。
附图说明
一个或多个实施例通过与之对应的附图中的图片进行示例性说明，这些示例性说明并不构成对实施例的限定。
图1是本申请的实施例提供的数据抓包方法的流程图一；
图2是本申请的实施例提供的数据抓包方法的流程图二；
图3是本申请的实施例提供的抓包流量路径拓扑结构示意图；
图4是本申请的实施例提供的数据抓包方法的流程图三；
图5是本申请的实施例提供的数据抓包装置的结构示意图；
图6是本申请的实施方式提供的电子设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请的数据抓包方法适用于任何网络中，尤其对于虚拟化资源池三层组网架构来说，由于定位故障往往需要对多层的多个网络设备同时进行数据抓包，但目前常用的人工抓包方法需要多人操作，手工输入抓包指令，对于操作人员来说需要极高的网络通信专业技能，且当多个网络设备位于不同的偏远地区时，想要同时对多个网络设备进行数据抓包操作更是难以实现。另外，虚拟化资源池三层组网架构中的数据中心网络通常采用万兆口以上，对笔记本或PC机网卡存在限制，不支持万兆口的笔记本或PC机无法进行抓包，且能源行业的虚拟化资源池规模一般较小，专门配置独立的数据抓包软件和硬件的话，成本较高，资源浪费较大。
而本申请通过自动计算获取抓包点、自动对所有抓包点下发抓包指令、采用虚拟机作为 抓包服务器，实现对虚拟化资源池内跨层网络设备的远程化、自动化、多层协同的数据抓包，增加了数据抓包的易用性、准确性和适用性，提升了网络故障的定位效率，降低了成本。
本申请的实施例涉及一种数据抓包方法，如图1所示，包括：
步骤101，根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点。
在本实施例中，抓包条件包括以下之一或其任意组合：IP地址、协议类型、端口。本领域技术人员可以理解，抓包点即为网络设备的端口，通过抓包条件和预先采集的网络拓扑结构可以自动快速计算出数据流量经过的网络设备端口，这些网络设备端口即为需要进行数据抓包的抓包点。
另外，抓包点的确定还可以采用手工设置的方式，即人工指定抓包点，该方式适用于对网络比较熟悉的运维人员。但需要说明的是，人工指定抓包点只需人工设定需要抓包的网络设备的端口，后续抓包指令的下发、抓包数据的获取仍然为自动化、远程化进行。
步骤102，向各抓包点所属的网络设备分别发送用于对数据流量进行抓包的抓包指令，其中，抓包指令携带与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，用于接收对应的网络设备发送的抓包数据。
在本实施例中，根据确定的抓包点，向抓包点所属的网络设备下发抓包指令，网络设备接收指令后向对应的抓包服务器发送抓包数据。需要说明的是，每个网络设备对应的抓包服务器可以是一个，也可以是多个，具体抓包服务器的数量可以根据抓包数据的流量、可利用的空闲资源等按需确定。
另外，抓包服务器为虚拟机，虚拟机(Virtual Machine，VM)是指通过软件模拟的具有完整硬件系统功能的、运行在一个完全隔离环境中的完整计算机系统。本申请采用虚拟机来充当抓包服务器，按需部署的方式，避免了物理抓包对抓包硬件的要求，充分利用虚拟化资源池内的空闲资源，不需要额外配置抓包硬件。
步骤103，从抓包服务器中获取所述抓包数据。
本实施例中，抓包服务器可以内置抓包软件，比如wireshark软件，将抓包数据保存到文件，并开放文件下载。
需要说明的是，本实施例中涉及到的网络设备可以位于虚拟化三层组网网络中。也就是说，本实施例可以既可以对物理设备进行数据抓包(路由器、汇聚交换机、接入交换机、硬件服务器)，也可以对虚拟设备(主机、虚拟机)进行抓包。
本申请提出的一种数据抓包方法，根据抓包条件和预先采集的网络设备拓扑结构，自动计算获取抓包点，然后根据确定的抓包点自动向抓包点所属的网络设备发送抓包指令，实现了对多个网络设备进行远程、自动、同时抓包，其中抓包指令携带了与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，数据抓包完成后从抓包服务器中即可获取抓包数据，采用虚拟机来充当抓包服务器，避免了物理抓包对抓包硬件的要求，充分利用虚拟化资源池内的空闲资源，不需要额外配置抓包硬件。整个方法可以对偏远地区、无人值守的网络设备进行远程、自动抓包，无需人工干预，简单方便，成本低，适用性广。
本申请的实施例涉及一种数据抓包方法，如图2所示，包括：
步骤201，采集各网络设备的性能数据。
步骤202，根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中 经过的各层网络设备的抓包点。
步骤203，根据所采集的各网络设备的性能数据和各网络设备的位置，确定各网络设备分别对应的抓包服务器的部署位置，并在部署位置创建抓包服务器。
在一实施例中，根据所采集的各网络设备的性能数据和各网络设备的位置，确定各网络设备分别对应的抓包服务器的部署位置，并在部署位置创建抓包服务器，包括：在抓包点为虚拟机端口或主机端口，且抓包点所在的主机满足抓包服务器所需的资源需求的情况下，将主机确定为对应的抓包服务器的部署位置；在抓包点为虚机端口或主机端口，且抓包点所在的主机不满足抓包服务器所需的资源需求的情况下，从主机关联的接入交换机下查找满足资源需求的主机作为对应的抓包服务器的部署位置；在抓包点为接入交换机端口的情况下，从与抓包点所在的接入交换机直连的服务器所对应的主机中，根据性能数据选择负荷最小的主机作为对应的抓包服务器的部署位置；在抓包点为汇聚交换机端口的情况下，从抓包点所在的汇聚交换机下的所有服务器所对应的主机中，根据性能数据选择负荷最小的主机作为所述对应的抓包服务器的部署位置；在抓包点为路由器端口的情况下，从抓包点所在的路由器下的所有服务器所对应的主机中，根据性能数据选择负荷最小的主机作为对应的抓包服务器的部署位置。需要说明的是，此处的虚机端口指的是虚拟机VM的端口。
需要说明的是，性能数据包括以下之一或其任意组合：CPU、内存、存储可用值、内存使用率、IO流量；负荷包括当前负荷和/或历史同期负荷。
本实施例中，在部署抓包服务器时，由于抓包服务器为虚拟机，虚拟机有独立的硬盘和操作系统，因此，承载抓包服务器(虚拟机)的主机需要满足抓包服务器所需的资源需求，并且保证抓包数据和正常的业务数据叠加后不会超过该主机的带宽限制。
在一实施例中，在确定各网络设备分别对应的抓包服务器的部署位置后，还包括：获取网络设备到达对应的抓包服务器的抓包流量路径；向抓包流量路径经过的各网络设备下发用于将抓包数据发送至对应的抓包服务器的抓包配置信息。
在本实施例中，在向抓包流量路径经过的各网络设备下发抓包配置信息时，可以使用远程镜像技术实现抓包配置信息的下发。网络设备接收抓包配置信息后通过数据流量镜像能力将抓包数据发送至对应的抓包服务器。抓包利用网络设备普遍支持的流量镜像能力，不需要额外的抓包代理，对组网无额外要求，适用性强，比如：对于抓包流量路径中的源设备，将抓包点的数据流量复制到出口端口，并设置固定的镜像VLAN用于转发；对于抓包流量路径中的中间设备，将固定的镜像VLAN上的镜像数据流量向下传递；对于抓包流量路径中的目的设备，接收固定镜像VLAN上的数据流量，将其发送到连接抓包服务器的出口端口上。
需要强调的是，抓包服务器的部署位置根据所采集的各网络设备的性能数据和各网络设备的位置来确定，而各网络设备的性能数据是实时变化的，也就是说抓包服务器的位置不是固定的，每次进行数据抓包时，都需要根据网络设备的性能数据和位置动态创建抓包服务器，如此可以使得抓包服务器就近部署，避免抓包数据经过过多设备，可以有效减少抓包生成的抓包数据抢占正常的业务数据带宽的问题。
如图3所示，图3a展示的是固定抓包服务器时的抓包流量路径，图3b展示的是动态创建抓包服务器时的抓包流量路径。其中，VM表示虚拟机，vSwitch表示虚拟交换机，TOR表示接入交换机，EOR表示汇聚交换机，GW表示资源池出口网关当对图3b中的VM3和EOR1同时进行数据抓包、且采用固定位置的抓包服务器时，对网络设备VM3进行数据抓包时，抓 包流量路径为vSwitch2—>TOR12—>EOR1—>TOR22—>vSwitch4—>抓包服务器。对网络设备EOR1进行数据抓包时，抓包流量路径为TOR22->vSwitch4->抓包服务器虚机，可以看到TOR22和vSwitch4上叠加了两个抓包点(抓包点VM3和抓包点EOR1)的数据流量，当抓包数据流量比较大时，可能导致相关设备上的流量超过带宽能力。
当对图3b中的VM3和EOR1同时进行数据抓包、且采用动态创建的抓包服务器时，VM3上端口的抓包流量路径为vSwtich2—>抓包服务器；EOR1上的端口抓包流量路径为TOR12—>vSwitch2—>抓包服务器虚机；仅vSwitch2叠加了两个抓包点的数据流量，抓包流量经过的设备大大减少，造成流量超限的风险大大减少，同时基于动态创建抓包服务器的这种机制，当数据流量叠加超限，可以选择再创建一个抓包服务器，分流叠加的抓包数据流量。
步骤204，向各抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，抓包指令携带与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，用于接收对应的网络设备发送的抓包数据。
步骤205，从抓包服务器中获取所述抓包数据。
在一实施例中，在步骤205之后，还包括：向抓包流量路径经过的各网络设备下发回退指令，并删除抓包服务器；其中，回退指令用于指示抓包流量路径经过的各网络设备释放根据抓包配置信息配置的资源。通过下发回退指令并删除抓包服务器，使得整个网络回退到抓包前的状态。
本申请提出的一种数据抓包方法，根据抓包条件和预先采集的网络设备拓扑结构，自动计算获取抓包点，然后根据确定的抓包点自动向抓包点所属的网络设备发送抓包指令，实现了对多个网络设备进行远程、自动、同时抓包，其中抓包指令携带了与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，数据抓包完成后从抓包服务器中即可获取抓包数据，采用虚拟机来充当抓包服务器，避免了物理抓包对抓包硬件的要求，充分利用虚拟化资源池内的空闲资源，不需要额外配置抓包硬件。此外，通过动态创建虚拟机来充当抓包服务器，同时虚拟机的部署位置可以基于虚拟资源池上各设备的性能数据进行选择，从而保证能够充分利用空闲的资源来部署虚拟机，并且能够合理分流抓包流量，减少抓包流量对正常业务流量的影响。
本申请的实施例涉及一种数据抓包方法，如图4所示，包括：
步骤401，获取各网络设备的转发配置数据。
步骤402，根据转发配置数据获取与抓包条件匹配的下一跳转发信息。
步骤403，根据下一跳转发信息和网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点。
在本实施例中，本领域技术人员可以理解的是，每个网络设备都有一个转发表，根据转发表即可获取转发配置数据，将转发配置数据与抓包条件进行匹配获取各设备上对应的下一跳转发信息，结合根据链路层发现协议LLDP(Link Layer Discovery Protocol)采集到的网络设备拓扑结构，生成数据流量经过的路径，从而确定转发点。
步骤404，向各抓包点所属的网络设备分别发送用于对数据流量进行抓包的抓包指令，其中，抓包指令携带与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，用于接收对应的网络设备发送的抓包数据。
步骤405，从抓包服务器中获取抓包数据。
本申请提出的一种数据抓包方法，根据抓包条件和预先采集的网络设备拓扑结构，自动计算获取抓包点，然后根据确定的抓包点自动向抓包点所属的网络设备发送抓包指令，实现了对多个网络设备进行远程、自动、同时抓包，其中抓包指令携带了与网络设备对应的抓包服务器的部署位置，抓包服务器为虚拟机，数据抓包完成后从抓包服务器中即可获取抓包数据，采用虚拟机来充当抓包服务器，避免了物理抓包对抓包硬件的要求，充分利用虚拟化资源池内的空闲资源，不需要额外配置抓包硬件。
此外，应当理解的是，上面各种方法的步骤划分，只是为了描述清楚，实现时可以合并为一个步骤或者对某些步骤进行拆分，分解为多个步骤，只要包括相同的逻辑关系，都在本申请的保护范围内；对流程中添加无关紧要的修改或者引入无关紧要的设计，但不改变其流程的核心设计都在该申请的保护范围内。
本申请的实施例涉及一种数据抓包装置，如图5所示，包括：
抓包点获取模块501，用于根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点。
指令发送模块502，用于向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，所述抓包指令携带与网络设备对应的抓包服务器的部署位置，所述抓包服务器为虚拟机，用于接收所述对应的网络设备发送的抓包数据。
接收模块503，用于从所述抓包服务器中获取所述抓包数据。
需要说明的是，整个数据抓包装置可以独立部署，也可以与网络设备本身的管理系统，比如：网络编排器、网元管理系统等合一部署。独立部署时，通过自身的对外管理平面与对接的各层设备管理系统以及抓包服务器相连；与网络设备的管理系统合一部署时，复用网络设备的管理系统的对外管理平面，无额外的组网要求。
另外，本申请的数据抓包装置还可以包括：采集模块504，用于采集各所述网络设备的性能数据；抓包服务器部署模块505，用于根据所述采集的各所述网络设备的性能数据和所述各网络设备的位置，确定各所述网络设备分别对应的抓包服务器的部署位置，并在所述部署位置创建抓包服务器。抓包配置模块506，用于获取所述网络设备到达所述对应的抓包服务器的抓包流量路径；向所述抓包流量路径经过的各网络设备下发用于将所述抓包数据发送至所述对应的抓包服务器的抓包配置信息。
值得一提的是，本实施例中所涉及到的各模块均为逻辑模块，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施例中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施例中不存在其它的单元。
不难发现，本实施例为与数据抓包方法实施例相对应的装置实施例，本实施例可与上述实施例互相配合实施。上述实施例中提到的相关技术细节在本实施例中依然有效，为了减少重复，这里不再赘述。相应地，本实施例中提到的相关技术细节也可应用在上述方法实施例中。
本申请的实施方式涉及一种电子设备，如图6所示，包括：至少一个处理器601；以及，与所述至少一个处理器601通信连接的存储器602；其中，所述存储器602存储有可被所述至少一个处理器601执行的指令，所述指令被所述至少一个处理器601执行，以使所述至少一个处理器601能够执行上述实施方式的数据抓包方法。
其中，存储器和处理器采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器处理的数据通过天线在无线介质上进行传输，在一实施方式中，天线还接收数据并将数据传送给处理器。
处理器负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储处理器在执行操作时所使用的数据。
本申请的实施方式涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述数据抓包方法。
即，本领域技术人员可以理解，实现上述实施方式方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施方式所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施例是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (11)

  1. 一种数据抓包方法，包括：
    根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点；
    向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，所述抓包指令携带与网络设备对应的抓包服务器的部署位置，所述抓包服务器为虚拟机，用于接收所述对应的网络设备发送的抓包数据；
    从所述抓包服务器中获取所述抓包数据。
  2. 根据权利要求1所述的数据抓包方法，其中，在所述根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点之前，还包括：
    采集各所述网络设备的性能数据；
    在所述向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令之前，还包括：
    根据所述采集的各所述网络设备的性能数据和所述各网络设备的位置，确定各所述网络设备分别对应的抓包服务器的部署位置，并在所述部署位置创建抓包服务器。
  3. 根据权利要求2所述的数据抓包方法，其中，所述根据所述采集的各所述网络设备的性能数据和所述各网络设备的位置，确定各所述网络设备分别对应的抓包服务器的部署位置，包括：
    在所述抓包点为虚机端口或主机端口，且所述抓包点所在的主机满足抓包服务器所需的资源需求的情况下，将所述主机确定为所述对应的抓包服务器的部署位置；
    在所述抓包点为虚机端口或主机端口，且所述抓包点所在的主机不满足抓包服务器所需的资源需求的情况下，从所述主机关联的接入交换机下查找满足所述资源需求的主机作为所述对应的抓包服务器的部署位置；
    在所述抓包点为接入交换机端口的情况下，从与所述抓包点所在的接入交换机直连的服务器所对应的主机中，根据所述性能数据选择负荷最小的主机作为所述对应的抓包服务器的部署位置；
    在所述抓包点为汇聚交换机端口的情况下，从所述抓包点所在的汇聚交换机下的所有服务器所对应的主机中，根据所述性能数据选择负荷最小的主机作为所述对应的抓包服务器的部署位置；
    在所述抓包点为路由器端口的情况下，从所述抓包点所在的路由器下的所有服务器所对应的主机中，根据所述性能数据选择负荷最小的主机作为所述对应的抓包服务器的部署位置。
  4. 根据权利要求3所述的数据抓包方法，其中，所述性能数据包括以下之一或其任意组合：
    CPU、内存、存储可用值、内存使用率、IO流量；
    所述负荷包括当前负荷和/或历史同期负荷。
  5. 根据权利要求2所述的数据抓包方法，其中，在所述确定各所述网络设备分别对应的抓包服务器的部署位置后，还包括：
    获取所述网络设备到达所述对应的抓包服务器的抓包流量路径；
    向所述抓包流量路径经过的各网络设备下发用于将所述抓包数据发送至所述对应的抓包服务器的抓包配置信息。
  6. 根据权利要求5所述的数据抓包方法，其中，在所述从所述抓包服务器中获取所述抓包数据之后，还包括：
    向所述抓包流量路径经过的各网络设备下发回退指令，并删除所述抓包服务器；
    其中，所述回退指令用于指示所述抓包流量路径经过的各网络设备释放根据所述抓包配置信息配置的资源。
  7. 根据权利要求1至6中任一项所述的数据抓包方法，其中，所述抓包条件包括以下之一或其任意组合：IP地址、协议类型、端口；
    所述根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点，包括：
    获取各网络设备的转发配置数据；
    根据所述转发配置数据获取与所述抓包条件匹配的下一跳转发信息；
    根据所述下一跳转发信息和所述网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点。
  8. 根据权利要求1至6中任一项所述的数据抓包方法，其中，所述网络设备位于虚拟化三层组网网络中。
  9. 一种数据抓包装置，包括：
    抓包点获取模块，用于根据抓包条件和预先采集的网络设备拓扑结构，获取数据流量在传输过程中经过的各层网络设备的抓包点；
    指令发送模块，用于向各所述抓包点所属的网络设备分别发送用于对所述数据流量进行抓包的抓包指令，其中，所述抓包指令携带与网络设备对应的抓包服务器的部署位置，所述抓包服务器为虚拟机，用于接收所述对应的网络设备发送的抓包数据；
    接收模块，用于从所述抓包服务器中获取所述抓包数据。
  10. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至8中任一项所述的数据抓包方法。
  11. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至8中任一项所述的数据抓包方法。
PCT/CN2022/125759 2021-11-23 2022-10-17 数据抓包方法、装置、电子设备及存储介质 WO2023093367A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111397093.2 2021-11-23
CN202111397093.2A CN116155682A (zh) 2021-11-23 2021-11-23 数据抓包方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2023093367A1 true WO2023093367A1 (zh) 2023-06-01

Family

ID=86353115

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125759 WO2023093367A1 (zh) 2021-11-23 2022-10-17 数据抓包方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN116155682A (zh)
WO (1) WO2023093367A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116566865A (zh) * 2023-07-11 2023-08-08 湖南星汉数智科技有限公司 抓包系统和方法
CN116938895A (zh) * 2023-09-15 2023-10-24 云粒智慧科技有限公司 媒体数据包采集方法、装置、电子设备和存储介质
CN117240552A (zh) * 2023-09-19 2023-12-15 中国人民解放军32039部队 跨场区数据传输自动化验证方法和装置
CN117749672A (zh) * 2023-12-08 2024-03-22 中化现代农业有限公司 数据包抓取方法及数据包传输方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110296390A1 (en) * 2010-05-25 2011-12-01 Seth Kelby Vidal Systems and methods for generating machine state verification using number of installed package objects
CN109525509A (zh) * 2017-09-19 2019-03-26 中兴通讯股份有限公司 网卡镜像抓包方法、终端以及可读存储介质
CN110708209A (zh) * 2019-08-28 2020-01-17 无锡华云数据技术服务有限公司 虚拟机流量采集方法、装置、电子设备及存储介质
CN111224832A (zh) * 2018-11-26 2020-06-02 阿里巴巴集团控股有限公司 抓取网络数据的方法、控制设备、代理服务器及系统
CN112688916A (zh) * 2020-12-10 2021-04-20 展讯半导体(成都)有限公司 远程自动化抓包的实现方法、装置及系统
CN112994982A (zh) * 2021-03-11 2021-06-18 苏州沁游网络科技有限公司 一种云真机的抓包控制方法、装置、系统及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110296390A1 (en) * 2010-05-25 2011-12-01 Seth Kelby Vidal Systems and methods for generating machine state verification using number of installed package objects
CN109525509A (zh) * 2017-09-19 2019-03-26 中兴通讯股份有限公司 网卡镜像抓包方法、终端以及可读存储介质
CN111224832A (zh) * 2018-11-26 2020-06-02 阿里巴巴集团控股有限公司 抓取网络数据的方法、控制设备、代理服务器及系统
CN110708209A (zh) * 2019-08-28 2020-01-17 无锡华云数据技术服务有限公司 虚拟机流量采集方法、装置、电子设备及存储介质
CN112688916A (zh) * 2020-12-10 2021-04-20 展讯半导体(成都)有限公司 远程自动化抓包的实现方法、装置及系统
CN112994982A (zh) * 2021-03-11 2021-06-18 苏州沁游网络科技有限公司 一种云真机的抓包控制方法、装置、系统及存储介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ERICSSON, CHINA MOBILE: "SCAS: Security requirements on traffic separation", 3GPP DRAFT; S3-142592, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. San Francisco, USA; 20141117 - 20141121, 21 November 2014 (2014-11-21), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP050924157 *
WANG YIDONG: "Method of Analyzing Network Faults Using Ethereal Packet Capture", XINXI YU DIANNAO - CHINA COMPUTER & COMMUNICATION, XINXI YU DIANNAO ZAZHISHE, CN, 30 November 2010 (2010-11-30), CN , pages 94 - 94, XP093068597, ISSN: 1003-9767 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116566865A (zh) * 2023-07-11 2023-08-08 湖南星汉数智科技有限公司 抓包系统和方法
CN116938895A (zh) * 2023-09-15 2023-10-24 云粒智慧科技有限公司 媒体数据包采集方法、装置、电子设备和存储介质
CN116938895B (zh) * 2023-09-15 2023-12-29 云粒智慧科技有限公司 媒体数据包采集方法、装置、电子设备和存储介质
CN117240552A (zh) * 2023-09-19 2023-12-15 中国人民解放军32039部队 跨场区数据传输自动化验证方法和装置
CN117240552B (zh) * 2023-09-19 2024-06-11 中国人民解放军32039部队 跨场区数据传输自动化验证方法、装置、电子设备和计算机可读存储介质
CN117749672A (zh) * 2023-12-08 2024-03-22 中化现代农业有限公司 数据包抓取方法及数据包传输方法

Also Published As

Publication number Publication date
CN116155682A (zh) 2023-05-23

Similar Documents

Publication Publication Date Title
WO2023093367A1 (zh) 数据抓包方法、装置、电子设备及存储介质
US10452422B2 (en) Method and apparatus for deploying virtual machine instance, and device
EP3031174B1 (en) Hybrid network management
TWI543566B (zh) 基於軟體定義網路的資料中心網路系統及其封包傳送方法、位址解析方法與路由控制器
CN102334112B (zh) 用于虚拟机网络的方法和系统
CN107370642B (zh) 一种基于云平台多租户网络平稳度监测系统和方法
CN105681191A (zh) 基于路由器虚拟化的sdn平台及实现方法
CN103858394B (zh) 负载降低系统和负载降低方法
CN105099789A (zh) 一种网元升级方法及设备
US9712462B2 (en) Expandable distributed core architectures having reserved interconnect bandwidths
CN104468791B (zh) 私有云IaaS平台的构建方法
CN104468219A (zh) 虚拟组网网络拓扑发现方法和设备
CN110838964B (zh) 一种虚拟网络与物理网络的网络对接系统
US10992526B1 (en) Hyper-converged infrastructure networking configuration system
US20210194803A1 (en) A System and a Method for Using a Network Cloud Software
CN110855509A (zh) 一种新型的云化sptn网络架构
CN108777640A (zh) 一种服务器探测方法、装置、系统及存储介质
WO2020114017A1 (zh) 数据中心流量互通方法、装置、设备及存储介质
US8489834B1 (en) Automatic class of service provisioning for data transfer within a data center
CN106899478A (zh) 电力测试业务通过云平台实现资源弹性扩展的方法
CN113300952B (zh) 一种用于云安全资源池的分布式引流系统及其引流方法
CN109379239A (zh) 一种OpenStack环境中配置接入交换机的方法及装置
US11652692B2 (en) Multi-fabric VLAN configuration system
Wu et al. Programmable virtual network instantiation in IaaS cloud based on SDN
CN104052665A (zh) 一种流量转发路径的确定方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897450

Country of ref document: EP

Kind code of ref document: A1