Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. However, it will be understood by those of ordinary skill in the art that in various embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the present application. The claimed application may be practiced without these specific details and with various changes and modifications based on the following embodiments. The following embodiments are divided for convenience of description, and should not be construed as limiting the specific implementation of the present application, and the embodiments can be mutually combined and referred to without contradiction.
The first embodiment of the invention relates to a service flow detection method, which comprises the steps of determining a service flow to be detected according to related information of the service flow, searching IP flow information of the service flow to be detected in a pre-generated association model, configuring an in-band detection task for the service flow to be detected according to the IP flow information, wherein the association model is used for describing a corresponding relation between the related information of the service flow in a target network and the IP flow information, executing the in-band detection task, and acquiring performance data acquired by the in-band detection task. The execution body of the embodiment is a terminal for performing in-band detection task deployment.
The following describes the present embodiment further with reference to the accompanying drawings, and the service flow detection method in this embodiment is shown in fig. 1, and includes:
and step 101, determining the service flow to be detected in the target network according to the related information of the service flow.
Specifically, the present embodiment is applied to a network that needs to perform quality of service monitoring, that is, the target network mentioned in the present embodiment. In the target network, the related information of the service flow comprises the information of the service name of the service flow, the identification of the access equipment on the bearing side of the service flow, the identification of the access interface, the related network element node and network element interface of the service flow, and the like. The relevant information of the service flows can be obtained by inquiring a network management system in the target network.
In one example, when the terminal deploying the in-band detection task receives the related information of the input service flow, the corresponding service flow is queried in the network management system according to the related information of the service flow and is used as the service flow to be detected. In addition, the terminal for deploying the in-band detection task can also automatically select from the service flows obtained by inquiry based on preset rules.
Further, when the terminal deployed by the in-band detection task receives the related information of the input service flow, the service flow corresponding to the related information of the service flow is searched in the association model according to the related information of the service flow, and then the selected service flow is determined in the corresponding service flow to be used as the service flow to be detected according to the received selection instruction aiming at the service flow. That is, after the terminal queries the corresponding service flows, the terminal may display all the service flows obtained by the query to the user, and the user specifically selects the service flow to be detected.
In practical application, when a user designates related service, or network element sub-interface on a terminal deploying in-band detection tasks, the terminal queries and generates all service flows under the service, or all corresponding service and service flows under the network element sub-interface through a pre-generated association model. The pre-generated association model is used for describing the corresponding relation between the related information of the service flow in the target network and the IP flow information. After the user determines the service flow to be detected through the terminal, the IP flow information corresponding to the service flow to be detected is searched through the association model.
And 102, searching IP flow information of the service flow to be detected in a pre-generated association model.
Specifically, in the related art, when configuring an in-band detection task for a service flow, parameters such as a network element node, a source interface, a source IP address, a destination interface, a destination IP address, and a priority corresponding to the service flow need to be specified. The information is required to be queried through a network management system and then related parameters are manually filled in to complete the configuration of the task.
In one example, the correlation model is generated by a data acquisition end and a terminal for data analysis in the target network according to an IP flow information acquisition task and task related parameters, which are issued by the terminal for deploying the in-band detection task. The generation mode of the association model is as shown in fig. 2, and includes:
Step 201, the data acquisition end acquires an IP flow information acquisition task.
Specifically, the generation of the association model is completed by the data acquisition end and the terminal for data analysis in the target network. When a user needs to establish a correlation model, an IP flow information acquisition task and parameters related to the task are issued to a data acquisition end through a terminal for task deployment. The task issuing, starting and stopping are controlled by the terminal for task deployment. The collection of the IP flow information can be carried out through a NetFlow function, the collected data mainly is the IP flow information related to the service flow, and the parameters related to the task determine the collection object, the collection protocol, the sampling rate, the collection period and the like of the IP flow information.
When the IP flow information is acquired through the NetFlow function, the set parameters comprise an acquisition period, a starting time, an acquisition duration, a flow sampling rate, a flow convergence duration, a monitoring port, a task type and the like. In practical applications, the acquisition period is generally calculated in units of days or weeks, and the attribute of the instant or timed task can be added to the task according to the starting time of the task.
Step 202, the data acquisition end acquires the IP flow information of all the service flows in the target network from the bearing device of the target network.
Specifically, the bearer device of the target network includes an access side device and a core side device in the target network. After receiving the service flow acquisition task and the instruction for starting the task execution, the data acquisition end starts to acquire the IP flow information of all the service flows in the target network according to the parameters carried in the acquisition task. Because the collected relevant data of the IP flow information is the original data, the data also need to be analyzed and pre-counted to obtain the IP flow information related to the service flow, and the unique corresponding service flow is identified through the five-tuple, wherein the five-tuple comprises a source IP address, a source port number, a destination IP address, a destination port number, a protocol number and a priority (DIFFERENTIATED SERVICES Code Point). The pre-statistics refers to that the collected service flow is analyzed to obtain preliminary service characteristics.
Step 203, the data analysis end queries the relevant information of all service flows in the network management system of the target network according to the IP flow information.
Specifically, after the data acquisition end completes the task of acquiring the IP stream information and performs analysis and pre-statistics on the original data, the IP stream information after the pre-statistics is sent to a terminal for data analysis. The related information of the service flow comprises a first access device at the bearing side, a first access interface, a second access device at the bearing side, a second access interface, an L3VPN service identifier, creation time, update time and the like.
In practical application, a terminal for data analysis can acquire source IP addresses corresponding to each service flow through a network management system, inquire an L3VPN service routing table, match a target network segment of a virtual routing interface, acquire bearing side first access equipment and a first node access interface corresponding to the service flow source IP addresses, and acquire L3VPN service information to which the service flow belongs. Similarly, the network management system can also obtain the destination IP address corresponding to each service flow, query the L3VPN service routing table, match the target network segment of the virtual routing interface, and obtain the second access device and the second access interface on the bearing side corresponding to the destination IP address of the service flow.
And 204, the data analysis end generates a correlation model according to the related information of all the service flows.
Specifically, the related information of the information related to the service flow and the IP flow information, namely the related information of the bearing side access equipment, the access interface and the service, is established for each service flow and comprises a source IP address, a bearing side first access equipment, a first access interface, a source port number, a destination IP address, a bearing side second access equipment, a second access interface, a destination port number, a protocol number, a priority (DSCP), an L3VPN service identifier, creation time, update time and the like. And then generating a final association model according to the association information and the IP flow information.
Further, the data analysis terminal can also obtain the data related to the performance of each service flow through the network management system of the target network. Parameters such as jitter, time delay, packet loss rate, flow speed and the like of the service flow are used as indexes, and the performance and quality characteristics of the service flow are extracted according to historical data related to performance in different time periods such as busy hours, idle hours, holidays and the like from the index types such as second, minute, moment, hour, day, week and month and the like, the average value or peak value, so that the current service characteristics of the service flow can be used as the current service characteristics of the service flow, and the future change trend of the service characteristics can be predicted. Therefore, through collecting and analyzing all the service IP flow information and service characteristics in the target network, the IP information and the service characteristics of the service are associated with the service flow, and the binding of the detection object and the service characteristics is realized.
In one example, based on the established association model, the service characteristics of the network element nodes, the network element subinterfaces, the service and other objects in the target network, including performance and quality indexes, are known to the user, and the system can automatically display the matched service flows according to the related information of the service flows input by the user. Therefore, when a user deploys an in-band detection task, the user can purposefully input features in a specific area range, namely, a certain range of service, and the terminal automatically screens corresponding service flows in the specific area for the user to deploy the in-band detection task, so that the deployment of the in-band detection task on a target area of interest, such as a high-activity area, a tidal effect obvious area, an area with a possibility of occurrence of flow bottlenecks and the like, can be realized, and the monitoring of service flow performance and quality data can be more intelligently carried out.
And step 103, configuring an in-band detection task for the service flow to be detected according to the IP flow information.
Specifically, in the related art, parameters such as a network element node, a source interface, a source IP address, a destination interface, a destination IP address, and a priority level corresponding to a service flow need to be specified when an in-band detection task for the service flow is configured under an actual networking structure. The IP address of the core side device is allocated by the IP address pool, and it is not known or difficult to learn the specific IP address of the core side device at first, because the IP information is necessary information, and it is not possible to configure the parameters of the downstream in-band detection task at this time. By adopting the technical means in the embodiment, no attention is paid to specific IP addresses of the configuration, and detectable IP flow information can be automatically identified after the network element node is selected. The parameter configuration of the in-band detection task is automatically completed without manual operation. When the configuration of the batch in-band detection tasks is carried out, the terminal for the deployment of the in-band detection tasks can automatically fill out all parameters of the in-band detection tasks aiming at all the service flows to be detected, so that the automatic configuration of the in-band detection tasks is realized.
Based on the service flow detection method in this embodiment, in practical application, when a user inputs relevant information of a service flow through a terminal for deploying an in-band detection task, for example, a network element name or a network element name and a specific network element interface, if 15 matched service flows are queried in a correlation model through the network element name or the specific network element interface, the 15 service flows are displayed in an interactive interface through the terminal for deploying the in-band detection task for reference by the user, and meanwhile, an IP flow information quintuple corresponding to the network element name or the specific network element interface is synchronously acquired in the background. At this time, if the rule of in-band detection task deployment has been preset by the user, the service flow to be detected is automatically selected, the in-band detection task for the service flow to be detected is configured according to the IP flow information quintuple, and parameters required by configuration are filled in. If the user does not preset the rule of the in-band detection task deployment, waiting for the user to input an instruction for selecting the in-band detection task, configuring the in-band detection task for the service flow to be detected according to the IP flow information, and filling parameters required by configuration.
And 104, executing the in-band detection task and acquiring performance data acquired by the in-band detection task.
Specifically, the terminal for in-band detection task deployment executes the configured in-band detection task, monitors and records performance data of corresponding service flows, and when the performance data of the service flows are found to be abnormal, identifies faults related to network performance and performs positioning and obstacle removal.
Compared with the related art in the field, the service flow detection method in the embodiment establishes a correlation model for describing the corresponding relation between the related information of the service flow in the target network and the IP flow information in advance, and realizes the correlation between the detection object and the service characteristics and the IP flow information. When the in-band detection task for the service flow is established, the IP information corresponding to the service flow is inquired according to the association model, and the configuration of the in-band detection task is automatically completed. Under the scene of batch in-band detection task deployment, the configuration of the in-band detection task can be completed rapidly without manual intervention. The in-band detection technology has the advantages that the application scene is richer, the deployment efficiency is higher, and meanwhile, the task deployment and maintenance cost can be reduced.
It should be noted that, the foregoing examples in the present embodiment are all examples for understanding and are not limited to the technical solution of the present invention.
The second embodiment of the present invention is about the same as the first embodiment in that after the association model is stored in the database, when the IP flow information is changed, that is, when the newly acquired IP flow information is different from the IP flow information existing in the current association model, the IP flow information is modified and the association model is updated according to the modified IP flow information. In addition, after the in-band detection task is executed, if the in-band detection task established for the pre-modification IP flow information is queried, the in-band detection task established for the modified IP flow information is modified or deleted.
The following describes the present embodiment further with reference to the accompanying drawings, and the service flow detection method in this embodiment is shown in fig. 3, and includes:
In step 301, the service flow to be detected is determined according to the related information of the service flow.
And 302, searching IP flow information of the service flow to be detected in a pre-generated association model.
And step 303, configuring an in-band detection task for the service flow to be detected according to the IP flow information.
Step 304, an in-band detection task is executed, and performance data acquired by the in-band detection task is acquired.
Steps 301 to 304 are the same as steps 101 to 104 in the first embodiment of the present invention, and the details of the implementation are specifically described in the first embodiment of the present invention and are not repeated here.
In step 305, if it is queried that there is an in-band detection task established for the pre-modification IP flow information, the in-band detection task established for the modified IP flow information is modified or deleted.
Specifically, in this embodiment, after the association model is generated, if a new task of collecting the IP flow information is received, when the new collected IP flow information is found to be inconsistent with the existing IP flow information in the collection process, the IP flow information is modified to be the new collected IP flow information, and then the data in the association model is modified according to the new IP flow information, so as to generate a new association model. And (5) finishing maintenance of the association model.
In addition, the terminal deploying the in-band detection task can also acquire the related information of the service flow through the network management system, so that the related information of the service flow in the target network is monitored in real time. When the load side access equipment, the access interface and the service information are modified and deleted, the system synchronously modifies or deletes the corresponding service flow and the related information in the load side access equipment, the access interface and the service association model, and simultaneously checks whether an in-band OAM detection session constructed for the information exists in the system, and if the in-band OAM detection session exists, the corresponding in-band detection task is modified or deleted. Meanwhile, after the service flow is aged, when the service flow, the bearing side access equipment, the access interface and the associated information of the service are deleted, whether the in-band detection task constructed for the service flow exists in the system is checked, and if the in-band detection task exists, the in-band detection task is deleted together, so that intelligent updating maintenance of the in-band detection task is realized.
In the related art, for the maintenance of the in-band detection task, when the service changes, the detected service flow also changes at the same time, and if the detected service flow does not exist, the user can only analyze whether the detected service flow does not exist, and then determine whether to update the original in-band detection task. When the number of in-band detection tasks reaches a certain scale, the related technology obviously cannot meet the basic operation and maintenance requirements. Therefore, the technical means of in-band detection task maintenance mentioned in the embodiment can more intelligently identify the dead traffic flow and update in time.
Further, after the IP flow information or the related information of the service flow in the association model is changed, the in-band detection task which is currently running is queried in real time, and whether the in-band detection task which is established for the service flow corresponding to the pre-modification IP flow information or the related information of the service flow exists or not is searched. If the in-band detection task established for the service flow corresponding to the pre-modification IP flow information or the related information of the service flow exists currently, deleting the corresponding in-band detection task or redeploying the modified in-band detection task after modifying the configuration parameters of the corresponding in-band detection task. The method further realizes the real-time monitoring of the in-band detection task, so that when the in-band detection task is dead, the in-band detection task can be timely found and reported to a maintenance user, the manual participation degree is reduced, and the intelligent updating maintenance of the in-band detection task to a certain degree is realized.
In a specific implementation, when the bearer side access device, the access interface and the service information are modified and deleted, the terminal deploying the in-band detection task synchronously modifies or deletes the corresponding in-band detection task and the related information of the service flow in the bearer side access device, the access interface and other service association models.
In addition, when the load-bearing side access equipment, the access interface and the service information are increased, a maintenance personnel can manually trigger a service flow real-time acquisition task of a designated monitoring port, and according to the acquired service flow, the related information of the service flow, the load-bearing side access equipment, the access interface and the service flow is generated, and when the service flow is waiting to be acquired at regular time, the related information of the newly increased service flow, the load-bearing side access equipment, the access interface and the service is regenerated.
After the data acquisition end acquires IP flow information according to the newly received IP flow information acquisition task, a service flow is uniquely identified according to five-tuple (source IP address, source port number, destination IP address, destination port number and protocol number), a correlation model of the service flow, the bearing side access equipment, the access interface and the service is built for the newly added service flow, and the update time in the correlation information of the service flow, the bearing side access equipment, the access interface and the service is modified into the time when the relationship is maintained for the existing service flow. And deleting the service flow, the bearing side access equipment, the access interface and the associated information of the service after the time difference between the update time and the current time in the associated information exceeds the set relation aging time.
Compared with the related art in the field, the method and the device for detecting the in-band detection task in the embodiment continuously monitor the state of the in-band detection task after the in-band detection task is deployed, actively inquire whether the in-band detection task is dead when the IP flow information is updated, and simultaneously, when new IP flow information is acquired, the association of the new service flow, the service flow related information and the IP flow information is increased. The method further realizes the real-time monitoring of the in-band detection task, so that when the in-band detection task is a zombie, the zombie can be timely found and reported to a maintenance user, the manual participation degree is reduced, and the intelligent updating maintenance of the in-band detection task is realized to a certain extent.
It should be noted that, the foregoing examples in the present embodiment are all examples for understanding and are not limited to the technical solution of the present invention.
The above steps of the methods are divided into only for clarity of description, and may be combined into one step or split into multiple steps when implemented, so long as the steps include the same logic relationship, and all the steps are within the protection scope of the patent, and adding insignificant modification or introducing insignificant design to the algorithm or the process, but not changing the core design of the algorithm and the process, and all the steps are within the protection scope of the patent.
A third embodiment of the present invention relates to a traffic flow detection apparatus, as shown in fig. 3, including:
a determining module 401, configured to determine a service flow to be detected according to the related information of the service flow;
The query module 402 is configured to search IP flow information of a service flow to be detected in a pre-generated association model, where the association model is used to describe a correspondence between relevant information of the service flow in the target network and the IP flow information;
a configuration module 403, configured to configure an in-band detection task for the detected traffic flow according to the root IP flow information;
And the execution module 404 is configured to execute the in-band detection task and acquire performance data acquired according to the in-band detection task.
It should be noted that each module involved in the present embodiment is a logic module, and in practical application, one logic unit may be one physical unit, or may be a part of one physical unit, or may be implemented by a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, units less closely related to solving the technical problem presented by the present invention are not introduced in the present embodiment, but it does not indicate that other units are not present in the present embodiment.
A fourth embodiment of the present invention relates to a traffic flow detection system, as shown in fig. 5, which includes a data acquisition end 502 and a data analysis end 503, where the data acquisition end 502 and the data analysis end 503 are both communicatively connected to the traffic flow detection device 501, and the data acquisition end 502 is also communicatively connected to a carrier device of a target network.
The traffic flow detection device 501 further includes an indication module, configured to instruct the data acquisition end to obtain IP flow information of all traffic flows in the target network from the bearer device of the target network.
The data collection end 502 is configured to obtain IP flow information of all service flows in the target network from the bearer device of the target network, and send the obtained IP flow information to the data analysis end.
The data analysis end 503 is configured to query relevant information of all service flows in a network management system of the target network according to the IP flow information, generate a correlation model according to the relevant information of all service flows, and store the correlation model in a local database for retrieval by a query module of the service flow detection device.
In one example, the traffic flow detection device 501 is further configured to modify or delete the in-band detection task established for the modified IP flow information when it is queried that there is an in-band detection task established for the pre-modified IP flow information.
In another example, the service flow detection device 501 is further configured to receive related information of an input service flow, search a service flow corresponding to the related information of the service flow in the association model according to the related information of the service flow, and determine, according to the received selection instruction, the selected service flow as a service flow to be detected in the corresponding service flow.
In another example, the service flow detection device 501 is further configured to search the association model for a service flow corresponding to the network element information according to the network element information.
In one example, the data analysis end 503 is further configured to modify the IP flow information and update the association model according to the modified IP flow information when the newly acquired IP flow information differs from the existing IP flow information.
It should be noted that each module involved in the present embodiment is a logic module, and in practical application, one logic unit may be one physical unit, or may be a part of one physical unit, or may be implemented by a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, units less closely related to solving the technical problem presented by the present invention are not introduced in the present embodiment, but it does not indicate that other units are not present in the present embodiment.
A fifth embodiment of the invention relates to a terminal, as shown in fig. 6, comprising at least one processor 601 and a memory 602 communicatively connected to the at least one processor 601, wherein the memory 602 stores instructions executable by the at least one processor 601, the instructions being executable by the at least one processor 601 to enable the at least one processor 601 to perform the traffic detection method of the first, or second, embodiment.
Where the memory 602 and the processor 601 are connected by a bus, the bus may comprise any number of interconnected buses and bridges, the buses connecting the various circuits of the one or more processors 601 and the memory 602. The bus may also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver may be one element or may be a plurality of elements, such as a plurality of receivers and transmitters, providing a means for communicating with various other apparatus over a transmission medium. The data processed by the processor 601 is transmitted over a wireless medium via an antenna, which further receives the data and transmits the data to the processor 601. The processor 601 is responsible for managing the bus and general processing and may also provide various functions including timing, peripheral interfaces, voltage regulation, power management, and other control functions. And memory 602 may be used to store data used by processor 601 in performing operations.
A sixth embodiment of the present invention relates to a computer-readable storage medium storing a computer program. The computer program implements the above-described method embodiments when executed by a processor.
That is, it will be understood by those skilled in the art that all or part of the steps in implementing the methods of the embodiments described above may be implemented by a program stored in a storage medium, where the program includes several instructions for causing a device (which may be a single-chip microcomputer, a chip or the like) or a processor (processor) to perform all or part of the steps in the methods of the embodiments of the application. The storage medium includes a U disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, an optical disk, or other various media capable of storing program codes.
It will be understood by those of ordinary skill in the art that the foregoing embodiments are specific examples of carrying out the invention and that various changes in form and details may be made therein without departing from the spirit and scope of the invention.