CN-122027462-A - Network fault positioning method and device, electronic equipment and storage medium

CN122027462ACN 122027462 ACN122027462 ACN 122027462ACN-122027462-A

Abstract

The application provides a network fault positioning method, a network fault positioning device, electronic equipment and a storage medium. According to the application, the probe is used for identifying the message transmission direction of the port bound by the probe, the first link KPI index of the target session to which the current message belongs at the port corresponds to the port is generated, and when the current message is found to be used for responding to the request message forwarded before the port, the second link KPI index of the target session at the port is generated, so that the analysis platform can automatically construct an accurate physical path according to the message transmission direction of each port, and network faults in the physical path are positioned by comparing KPI differences of different ports on the physical path, thereby realizing accurate and automatic fault positioning from a virtual interval to a physical entity and greatly improving operation and maintenance efficiency.

Inventors

ZHANG YU

Assignees

新华三技术有限公司

Dates

Publication Date: 20260512
Application Date: 20260228

Claims (12)

1. A network fault positioning method is characterized in that the method is applied to probes, probes are bound to at least one port on at least one network device, probes bound to different ports are different, and the method comprises the following steps: identifying the transmission direction of the current message transmitted by each port with the probe; Determining a target session to which the current message belongs, and generating a first link KPI (key performance indicator) corresponding to the target session at the port, wherein the first link KPI indicator at least comprises the size of the current message and the total number of message transmission in the target session; If the current message is found to be used for responding to the request message forwarded before the port, generating a second link KPI (key performance indicator) corresponding to the target session at the port, wherein the second link KPI indicator at least comprises time delay information, and the time delay information is determined based on the time of receiving the current message and the time of forwarding the request message; And reporting the transmission direction of the message in the target session at each port, the first link KPI index corresponding to the target session at each port and the second link KPI index corresponding to the target session at each port to an analysis platform aiming at each target session, so that the analysis platform determines a physical path corresponding to the target session based on the transmission direction of the message in the target session at each port, and locates network faults in the physical path based on the difference of the link KPI indexes corresponding to different ports.
2. The method of claim 1, wherein the current message encapsulates a source MAC address and a destination MAC address, and wherein identifying the direction of transmission of the current message transmitted by the port comprises: if the destination MAC address of the current message transmitted by the port is matched with the MAC address of the port, determining that the current message transmitted by the port is a message entering the port, wherein the transmission direction of the current message at the port is that the port sends the current message to network equipment to which the port belongs; If the source MAC address of the current message transmitted by the port is matched with the MAC address of the port, determining that the current message transmitted by the port is a message forwarded from the port, wherein the transmission direction of the current message at the port is that the network equipment to which the port belongs sends the current message to the port.
3. The method according to claim 1, wherein the determining the target session to which the current message belongs includes: Extracting five-tuple information of the current message; And if no matched session exists in the session record of the port based on the quintuple information, establishing the newly established session according to the quintuple information and determining that the newly established session is the target session to which the current message belongs.
4. The method of claim 1, wherein the delay information is determined according to the following method: determining a difference value between a second timestamp of the received current message and a first timestamp of the forwarded request message; and determining the difference value as time delay information between the port and the sending end of the current message.
5. A network fault location method, wherein the method is applied to an analysis platform, and the method comprises: Receiving a transmission direction of a message in each target session reported by each probe at each port, a first link KPI index corresponding to each port of each target session, and a second link KPI index corresponding to each port of each target session, wherein at least one port on at least one network device is bound with probes, probes bound by different ports are different, the first link KPI is generated when the probes recognize that the message is a message forwarded from the port bound by the probes, and the first link KPI index at least comprises the size of the message; determining an end-to-end physical path of each target session according to the transmission direction of the message in each target session at each port; And for each target session, positioning a fault interval according to the end-to-end physical path of the target session and the first link KPI index corresponding to each port of the target session and/or the second link KPI index corresponding to each port of the target session.
6. The method of claim 5, wherein each probe further reports TTL information carried by each target session at each port, and wherein determining the end-to-end physical path of each target session according to the transmission direction of the message in each target session at each port comprises: for each target session, determining the global sequence of the message in the target session flowing through each port according to TTL information carried by the target session at each port; Determining the relative position relation between the port and the network equipment to which the port belongs in a physical path corresponding to a target session according to the transmission direction of a message at the port for each port in the global sequence, wherein the port is determined to be positioned before the network equipment to which the port belongs if the transmission direction is that the message enters the port; and generating the end-to-end physical path based on the global sequence and the relative position relation between each port and the network equipment to which the port belongs.
7. The method according to claim 5, wherein locating the failure interval according to the end-to-end physical path of the target session and the first link KPI indicator corresponding to the target session at each port and/or the second link KPI indicator corresponding to the target session at each port comprises: Comparing the total number of message transmissions in a first link KPI index at an adjacent port on the end-to-end physical path, if the ratio of the total number of message transmissions of an upstream port to the total number of message transmissions of a downstream port in the adjacent port is found to be smaller than a first threshold value, determining that the fault interval is located between the upstream port and the downstream port, enabling the message of the target session to flow through the upstream port and then flow through the downstream port, and/or, Comparing delay information in a second link KPI index at an adjacent port on the end-to-end physical path, and if the difference value between the delay information of an upstream port and the delay information of a downstream port in the adjacent port is found to be larger than a second threshold value, determining that the fault interval is positioned between the upstream port and the downstream port.
8. The method of claim 5, further comprising, after locating the failure interval according to the end-to-end physical path of the target session and the first link KPI indicator corresponding to the target session at each port and/or the second link KPI indicator corresponding to each port for each target session: And acquiring health indexes of all network equipment included in the fault interval, and positioning the network equipment with faults based on the health indexes, wherein the deviation between the health indexes of the network equipment with faults and a preset health index threshold value is larger than the preset threshold value, and the health indexes are used for indicating the running state of the network equipment.
9. A network fault positioning device is characterized in that the device is applied to probes, probes are bound to at least one port on at least one network device, probes bound to different ports are different, and the device comprises: the direction identification unit is used for identifying the transmission direction of the current message transmitted by each port with the probe bound to the port; The first generation unit is used for determining a target session to which the current message belongs and generating a first link KPI (key performance indicator) corresponding to the target session at the port, wherein the first link KPI indicator at least comprises the size of the current message and the total number of message transmission in the target session; The second generating unit is used for generating a second link KPI index corresponding to the target session at the port if the current message is found to be used for responding to the request message forwarded before the port, wherein the second link KPI index at least comprises time delay information, and the time delay information is determined based on the time of receiving the current message and the time of forwarding the request message; The index reporting unit is used for reporting the transmission direction of the message in the target session at each port, the first link KPI index corresponding to each port of the target session and the second link KPI index corresponding to each port of the target session to the analysis platform aiming at each target session, so that the analysis platform determines a physical path corresponding to the target session based on the transmission direction of the message in the target session at each port, and locates network faults in the physical path based on the difference of the link KPI indexes corresponding to different ports.
10. A network fault location device for use with an analysis platform, the device comprising: The receiving unit is used for receiving the transmission direction of the message in each target session reported by each probe at each port, the first link KPI index corresponding to each port of each target session and the second link KPI index corresponding to each port of each target session; the network equipment comprises at least one port, a first link KPI, a second link KPI, a first link KPI and a second link KPI, wherein the at least one port on the at least one network equipment is bound with probes, probes bound by different ports are different, the first link KPI is generated when the probes recognize that the message is a message forwarded from the port bound by the probes, the first link KPI at least comprises the size of the message, the second link KPI is generated when the probes recognize that the message enters the port and the message is used for responding to a request message forwarded before the port, and the second link KPI at least comprises time delay information, wherein the time delay information is determined based on the time for receiving the message and the time for forwarding the request message; a determining unit, configured to determine an end-to-end physical path of each target session according to a transmission direction of a packet in each target session at each port; The positioning unit is used for positioning a fault interval according to the end-to-end physical path of each target session and the first link KPI index corresponding to each port of the target session and/or the second link KPI index corresponding to each port of each target session.
11. An electronic device comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor for executing the machine-executable instructions to perform the method of any one of claims 1 to 8.
12. A machine-readable storage medium having stored thereon computer instructions which, when executed by a processor, cause the processor to perform the method of any of claims 1 to 8.

Description

Network fault positioning method and device, electronic equipment and storage medium Technical Field The present application relates to the field of computer networks, and in particular, to a network fault positioning method, a device, an electronic device, and a storage medium. Background In the current network operation and maintenance process, network performance indexes (such as time delay, packet loss rate and the like) are monitored through deployment of acquisition points to realize fault location. However, there is a significant limitation in this manner, when the performance index is found to be abnormal, the fault can only be located in a virtual logic section (such as a virtual path between some two collection points) in general, and the specific physical path where the fault is located cannot be accurately locked. Therefore, the operation and maintenance personnel must rely on personal experience to manually check which physical devices are included in the logical space. This highly manual approach makes the overall fault localization process time consuming, and difficult to ensure accuracy. Disclosure of Invention In view of the above, the present application provides a network fault location method, apparatus, electronic device and storage medium, so as to implement automatic fault location and improve fault location efficiency. The technical scheme provided by the application is as follows: according to an embodiment of the first aspect of the present application, there is provided a network fault location method, the method being applied to probes, at least one port on at least one network device being bound with probes, probes bound by different ports being different, the method comprising: For each port bound with a probe, identifying whether the current message transmitted by the port is a message entering the port or a message forwarded from the port, so as to determine the transmission direction of the current message at the port; Determining a target session to which the current message belongs, and generating a first link KPI (key performance indicator) corresponding to the target session at the port, wherein the first link KPI indicator at least comprises the size of the current message and the total number of message transmission in the target session; If the current message is found to be used for responding to the request message forwarded before the port, generating a second link KPI (key performance indicator) corresponding to the target session at the port, wherein the second link KPI indicator at least comprises time delay information, and the time delay information is determined based on the time of receiving the current message and the time of forwarding the request message; And reporting the transmission direction of the message in the target session at each port, the first link KPI index corresponding to the target session at each port and the second link KPI index corresponding to the target session at each port to an analysis platform aiming at each target session, so that the analysis platform determines a physical path corresponding to the target session based on the transmission direction of the message in the target session at each port, and locates network faults in the physical path based on the difference of the link KPI indexes corresponding to different ports. Optionally, the identifying whether the current message transmitted by the port is a message entering the port or a message forwarded from the port to determine the transmission direction of the current message at the port includes: if the destination MAC address of the current message transmitted by the port is matched with the MAC address of the port, determining that the current message transmitted by the port is a message entering the port, wherein the transmission direction of the current message at the port is that the port sends the current message to network equipment to which the port belongs; If the source MAC address of the current message transmitted by the port is matched with the MAC address of the port, determining that the current message transmitted by the port is a message forwarded from the port, wherein the transmission direction of the current message at the port is that the network equipment to which the port belongs sends the current message to the port. Optionally, the determining the target session to which the current message belongs includes: Extracting five-tuple information of the current message; And if no matched session exists in the session record of the port based on the quintuple information, establishing the newly established session according to the quintuple information and determining that the newly established session is the target session to which the current message belongs. Optionally, the delay information is determined according to the following method: determining a difference value between a second timestamp of the received current message and a first timestam