CN114363160B - Network management method and device based on wide area network - Google Patents
Network management method and device based on wide area network Download PDFInfo
- Publication number
- CN114363160B CN114363160B CN202111672387.1A CN202111672387A CN114363160B CN 114363160 B CN114363160 B CN 114363160B CN 202111672387 A CN202111672387 A CN 202111672387A CN 114363160 B CN114363160 B CN 114363160B
- Authority
- CN
- China
- Prior art keywords
- abnormal
- network
- message
- session
- candidate
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000007726 management method Methods 0.000 title claims abstract description 48
- 230000002159 abnormal effect Effects 0.000 claims abstract description 287
- 230000005856 abnormality Effects 0.000 claims abstract description 51
- 238000012216 screening Methods 0.000 claims abstract description 29
- 238000000034 method Methods 0.000 claims description 28
- 238000004458 analytical method Methods 0.000 claims description 22
- 238000004891 communication Methods 0.000 claims description 19
- 230000004308 accommodation Effects 0.000 claims description 18
- 238000012790 confirmation Methods 0.000 claims description 13
- 230000007423 decrease Effects 0.000 claims description 12
- 238000004590 computer program Methods 0.000 claims description 10
- 230000005540 biological transmission Effects 0.000 claims description 8
- 238000003860 storage Methods 0.000 claims description 5
- 230000002776 aggregation Effects 0.000 claims description 2
- 238000004220 aggregation Methods 0.000 claims description 2
- 238000010586 diagram Methods 0.000 description 9
- 238000012545 processing Methods 0.000 description 7
- 238000012544 monitoring process Methods 0.000 description 6
- 238000012986 modification Methods 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 230000006870 function Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 238000012423 maintenance Methods 0.000 description 3
- 238000011084 recovery Methods 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network management method and device based on a wide area network, comprising the following steps: preliminary screening is carried out on the session traffic mirrored from the core convergence switching equipment to obtain candidate abnormal sessions; analyzing the message of the candidate abnormal session to determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies; when the abnormal type of the first candidate abnormal session is network abnormality, determining an abnormal position of the first candidate abnormal session according to a preset abnormal position rule; when the ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold, determining that the second candidate abnormal session is abnormal, and outputting an abnormal alarm; the anomaly alert includes one or more of anomaly type, anomaly location. The embodiment of the invention can solve the problem of how to effectively perform network management on the wide area network in the prior art.
Description
Technical Field
The present invention relates to the field of data communication technologies, and in particular, to a network management method and device based on a wide area network.
Background
The wide area network (Wide Area Network, WAN), also known as the extranet, public network, is a remote network connecting computers in local or metropolitan area networks in different areas. Typically span a large physical range, ranging from tens of kilometers to thousands of kilometers, can connect multiple areas, cities and countries, or span several continents and provide long-range communications, forming an international long-range network. Wide area networks have tremendous coverage, with thousands of network devices. While wide area networks perform well by connecting individual areas via a myriad of devices by operators.
With the rapid increase of the network speed, the number of devices of operators is greatly increased, the performance of the devices is rapidly improved, and the flow is greatly increased. This also makes network management of wide area networks difficult to achieve. For example: if a user proposes that own network use is abnormal, an operator needs to determine whether the network problem is a network problem, and if the network problem is a network problem, further positioning of what the network problem is and how to solve the network problem are also needed. On the other hand, if a certain network device such as a switch hardware is abnormal, which causes unstable traffic in a certain area, we also need to find out that the traffic is abnormal in time.
Therefore, the method for monitoring the network in real time, having sufficiently fine monitoring granularity and actively finding the problem and initially positioning the problem range is provided, and the problem which needs to be solved urgently for wide area network management is solved.
Current network management typically uses in-band network telemetry (Inband Network Telemetry, INT) technology. The prior INT technology has the following two schemes:
One is to add information of each hop in a header, and then send the message up at the last hop, thereby obtaining the network state. If the scheme is used, on one hand, network equipment of the whole network needs to support the revision of the message header; on the other hand, because the information related to each hop needs to be added in the header of the message, and the maximum length of the message is limited, the utilization rate of the link is reduced. At the same time, even if the information of the message is sent up in the last hop, the analysis quantity is huge for the server, and the analysis quantity is difficult to support in a wide area network.
Alternatively, each message passes through the switching device and directly sends the required information to the server for analysis. Thus if a message passes 10 intermediate points, the server receives 10 messages, 100 messages are generated within 1 second of a session, and 1000 messages are received by the server in one second. Compared with the first scheme, the scheme improves the utilization rate of the link, but can cause excessive burden of the server and can not be suitable for the wide area network.
Disclosure of Invention
The embodiment of the invention provides a network management method and device based on a wide area network, which are used for solving the problem of how to effectively perform network management on the wide area network in the prior art.
According to an embodiment of the present invention, there is provided a network management method based on a wide area network, which is applicable to a wide area network, where the wide area network includes a client and a server connected through a core convergence switching device, and the method is applied to a network management device that is suspended by the core convergence switching device, and the method includes:
preliminary screening is carried out on the session traffic mirrored from the core convergence switching equipment to obtain candidate abnormal sessions;
analyzing the message of the candidate abnormal session to determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies;
When the abnormal type of the first candidate abnormal session is network abnormality, determining an abnormal position of the first candidate abnormal session according to a preset abnormal position rule; and
When the ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold, determining that the second candidate abnormal session is abnormal, and outputting an abnormal alarm; the anomaly alert includes one or more of anomaly type, anomaly location.
Optionally, the preliminary screening of the session traffic mirrored from the core convergence switching device to obtain a candidate abnormal session specifically includes:
identifying the session flow by a Transmission Control Protocol (TCP) message;
Information acquisition is carried out on the identified TCP message, and acquisition information of the TCP message is obtained;
And calculating the flow rate of the TCP according to the acquired information, and determining that the session corresponding to the TCP message is a candidate abnormal session when the flow rate is smaller than a preset flow rate threshold.
Optionally, the calculating the flow rate of the TCP according to the collected information specifically includes:
and in a timing period, calculating the difference value between the first message sequence number seq1 of the TCP message obtained at the beginning of the timing period and the second message sequence number seq2 of the TCP message obtained at the end of the timing period to obtain the flow rate.
Optionally, the analyzing the message of the candidate abnormal session to determine an abnormal type specifically includes:
acquiring a client receiving capacity parameter, a server sending capacity parameter and a network accommodating capacity parameter corresponding to the candidate abnormal session according to the message and the acquired information;
when the network accommodation capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is smaller than the network accommodation capacity parameter, determining that the abnormality type is server abnormality;
when the server sending capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is larger than the network accommodating capacity parameter, determining that the abnormality type is network abnormality;
And when the server sending capacity parameter is equal to the network accommodating capacity parameter and the server sending capacity parameter is larger than the client receiving capacity parameter, determining that the abnormality type is abnormal of the client.
Optionally, the acquiring, according to the message and the collected information, the client receiving capability parameter, the server sending capability parameter and the network accommodating capability parameter corresponding to the candidate abnormal session specifically includes:
Acquiring the receiving capacity parameter of the client according to the rwnd information of the receiving window carried by the message;
calculating the number flight size of the messages which are sent by the current sending window but not received the confirmation message according to the message sequence number seq and the confirmation sequence number ack in the acquired information, and taking the number flight size as the sending capability parameter of the server;
Determining whether the message is subjected to fast retransmission, and updating the congestion window cwnd of the current network to be half of the current cwnd when the message is subjected to fast retransmission; when no fast retransmission occurs, updating the congestion window cwnd of the current network to be flight size, and taking the updated cwnd as the network accommodation capacity parameter.
Optionally, the analyzing the message of the candidate abnormal session to determine an abnormal type specifically includes:
when the packet loss exceeding the preset packet loss times occurs in the message of the candidate abnormal session, determining that the abnormal type is network abnormality;
when the maximum TCP segment size MSS is greater than the current message length of the candidate abnormal session, determining that the client is abnormal;
When the receiving window rwnd information carried by the message is 0, determining that the client is abnormal;
And when the rwnd exceeds the continuous decline of the preset decline times, determining that the client is abnormal.
Optionally, when the anomaly type of the first candidate abnormal session is a network anomaly, determining, according to a preset anomaly location rule, an anomaly location of the first candidate abnormal session specifically includes:
determining whether the server and the client sense that the first candidate abnormal session loses packets or not according to seq and ack in the acquired information of the TCP message of the first candidate abnormal session;
when the server and the client both sense packet loss, determining that the abnormal position is a network at the server side;
And when the server does not perceive the packet loss and the client side perceives the packet loss, determining the abnormal position as the network at the client side.
According to an embodiment of the present invention, there is also provided a network management apparatus based on a wide area network, which is applicable to a wide area network, where the wide area network includes a client and a server connected through a core convergence switching device, and the apparatus is applied to a network management device that is suspended by the core convergence switching device, and includes: the primary screening unit, the analysis unit and the alarm unit; wherein,
The primary screening unit is used for primarily screening the session flow mirrored from the core convergence exchange equipment to obtain candidate abnormal sessions;
The analysis unit is used for analyzing the message of the candidate abnormal session and determining an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies; the method is also used for determining the abnormal position of the first candidate abnormal session according to a preset abnormal position rule when the abnormal type of the first candidate abnormal session is network abnormality; and
The alarm unit is used for determining that the second candidate abnormal conversation is abnormal and outputting an abnormal alarm when the ratio of the number of abnormal messages of the second candidate abnormal conversation to the total number of messages in a preset period is greater than a preset threshold; the anomaly alert includes one or more of anomaly type, anomaly location.
Optionally, the primary screening unit is configured to perform primary screening on the session traffic mirrored from the core convergence switching device, and when a candidate abnormal session is obtained, specifically configured to identify a transmission control protocol TCP packet for the session traffic; information acquisition is carried out on the identified TCP message, and acquisition information of the TCP message is obtained; and calculating the flow rate of the TCP according to the acquired information, and determining that the session corresponding to the TCP message is a candidate abnormal session when the flow rate is smaller than a preset flow rate threshold.
Optionally, the primary screening unit is configured to calculate, when calculating the flow rate of the TCP according to the collected information, in a timing period, a difference value between a first packet sequence number seq1 of the TCP packet obtained at the beginning of the timing period and a second packet sequence number seq2 of the TCP packet obtained at the end of the timing period, so as to obtain the flow rate.
Optionally, the analysis unit is configured to analyze the message of the candidate abnormal session, and when determining the abnormal type, specifically is configured to:
acquiring a client receiving capacity parameter, a server sending capacity parameter and a network accommodating capacity parameter corresponding to the candidate abnormal session according to the message and the acquired information;
when the network accommodation capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is smaller than the network accommodation capacity parameter, determining that the abnormality type is server abnormality;
when the server sending capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is larger than the network accommodating capacity parameter, determining that the abnormality type is network abnormality;
And when the server sending capacity parameter is equal to the network accommodating capacity parameter and the server sending capacity parameter is larger than the client receiving capacity parameter, determining that the abnormality type is abnormal of the client.
Optionally, the analyzing unit is configured to obtain, according to the message and the collected information, a client receiving capability parameter, a server sending capability parameter, and a network accommodating capability parameter corresponding to the candidate abnormal session, where the analyzing unit is specifically configured to:
Acquiring the receiving capacity parameter of the client according to the rwnd information of the receiving window carried by the message;
calculating the number flight size of the messages which are sent by the current sending window but not received the confirmation message according to the message sequence number seq and the confirmation sequence number ack in the acquired information, and taking the number flight size as the sending capability parameter of the server;
Determining whether the message is subjected to fast retransmission, and updating the congestion window cwnd of the current network to be half of the current cwnd when the message is subjected to fast retransmission; when no fast retransmission occurs, updating the congestion window cwnd of the current network to be flight size, and taking the updated cwnd as the network accommodation capacity parameter.
Optionally, the analysis unit is configured to analyze the message of the candidate abnormal session, and when determining the abnormal type, specifically is configured to:
when the packet loss exceeding the preset packet loss times occurs in the message of the candidate abnormal session, determining that the abnormal type is network abnormality;
when the maximum TCP segment size MSS is greater than the current message length of the candidate abnormal session, determining that the client is abnormal;
When the receiving window rwnd information carried by the message is 0, determining that the client is abnormal;
And when the rwnd exceeds the continuous decline of the preset decline times, determining that the client is abnormal.
Optionally, the analysis unit is configured to, when the anomaly type of the first candidate abnormal session is a network anomaly, determine, according to a preset anomaly location rule, an anomaly location of the first candidate abnormal session, where the anomaly location is specifically configured to:
determining whether the server and the client sense that the first candidate abnormal session loses packets or not according to seq and ack in the acquired information of the TCP message of the first candidate abnormal session;
when the server and the client both sense packet loss, determining that the abnormal position is a network at the server side;
And when the server does not perceive the packet loss and the client side perceives the packet loss, determining the abnormal position as the network at the client side.
According to an embodiment of the present invention, there is further provided an electronic device including a processor, a communication interface, a memory, and a communication bus, where the processor, the communication interface, and the memory complete communication with each other through the communication bus;
A memory for storing a computer program;
and the processor is used for realizing the steps of the method when executing the program stored in the memory.
According to an embodiment of the present invention, there is also provided a computer-readable storage medium having stored therein a computer program which, when executed by a processor, implements the above-mentioned method steps.
The invention has the following beneficial effects:
According to the network management method and device based on the wide area network, provided by the embodiment of the invention, the network management equipment is hung beside the core convergence switching equipment, and the network management equipment performs preliminary screening on session traffic mirrored from the core convergence switching equipment to obtain candidate abnormal sessions; analyzing the message of the candidate abnormal session to determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies; when the abnormal type of the first candidate abnormal session is network abnormality, determining an abnormal position of the first candidate abnormal session according to a preset abnormal position rule; and when the ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold, determining that the second candidate abnormal session is abnormal, and outputting an abnormal alarm. In the embodiment of the invention, the network management equipment is hung beside the core convergence switching equipment, so that single equipment deployment can be realized, the realization is easy, the network management equipment can monitor all the flow flowing through the core convergence switching equipment in real time, the monitoring granularity can be accurate to a single message, the abnormal type and the abnormal position of an abnormal session can be positioned by analyzing the message, and abnormal alarm is carried out when the number of abnormal messages reaches the alarm requirement, so that the effective management of the wide area network is realized.
Drawings
Fig. 1 is a flowchart of a network management method based on a wide area network according to an embodiment of the present invention;
fig. 2 is a schematic structural diagram of a network management device based on a wide area network according to an embodiment of the present invention;
Fig. 3 is a schematic structural diagram of an electronic device according to the present application.
Detailed Description
Aiming at the problem that the wide area network in the prior art cannot effectively realize network management, the embodiment of the invention provides a network management method based on the wide area network, which is suitable for the wide area network, wherein the wide area network comprises a client and a server which are connected through a core convergence switching device, and the method is applied to network management equipment which is hung beside the core convergence switching device. The flow of the method of the invention is shown in figure 1, and the execution steps are as follows:
step 101, preliminary screening is carried out on session traffic mirrored from the core convergence switching device to obtain candidate abnormal sessions;
Specifically, this step performs transmission control protocol (Transmission Control Protocol, TCP) packet identification on the session traffic, and when the session traffic is a TCP packet, performs subsequent preliminary screening.
102, Analyzing the message of the candidate abnormal session to determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies;
Specifically, in this step, it may be preliminarily determined that when an abnormal session occurs, the abnormal type corresponding to the abnormal session is determined, and in general, one wide area network is constituted by a client, a server, and a network connecting the client and the server. When the abnormality type is that the client side abnormality or the server abnormality, the client side manufacturer or the server manufacturer can be directly informed to carry out maintenance recovery; however, when the anomaly type is network anomaly, because the network range of the wide area network is larger, the approximate position of the anomaly needs to be further determined, that is, the anomaly position needs to be further determined, and the corresponding personnel can be notified to carry out maintenance recovery.
Step 103, when the abnormal type of the first candidate abnormal session is network abnormality, determining an abnormal position of the first candidate abnormal session according to a preset abnormal position rule;
One network may generally consist of a client-side network near the client and a server-side network near the server. Therefore, when the anomaly type of the first candidate anomaly session is network anomaly, it is required to further determine whether the anomaly location of the first candidate anomaly session is a network on the client side or a network on the server side according to a preset anomaly location rule, so as to further remind corresponding maintenance personnel.
104, Determining that the second candidate abnormal session is abnormal and outputting an abnormal alarm when the ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold; the anomaly alert includes one or more of anomaly type, anomaly location.
Here, not all the candidate abnormal sessions will carry out alarm prompt, only when the ratio of the abnormal message number of the candidate abnormal session to the total message number is greater than a preset threshold, the abnormal condition of the candidate abnormal session is severe enough to affect the normal service, and the abnormal degree of the candidate abnormal session is determined to reach the requirement of alarm, so that the candidate abnormal session is called a second candidate abnormal session for convenience of expression; when the second candidate abnormal conversation is determined to be abnormal, the number of various abnormal types corresponding to the second candidate abnormal conversation can be further judged, and the abnormal type with the largest number of abnormal types is used as a judging result to carry out alarm prompt; specifically, when the number of client exceptions is 3, the number of network exceptions is 5, and the number of server exceptions is 7, then the server exception is given an alarm by taking the exception type of the second candidate exception session as the server exception. It should be understood that the anomaly type with the largest number of consecutive anomalies may also be used as the anomaly type of the second candidate anomaly session, which is not limited by the embodiment of the present invention.
In the embodiment of the invention, the network management device may be one physical device or two physical devices, such as a primary screening network device and an analysis server device; in the case of two physical devices, the process of step 101 may be performed by the primary screen device, and the analysis server device performs the processes of steps 102-104.
Optionally, the preliminary screening of the session traffic mirrored from the core convergence switching device to obtain a candidate abnormal session specifically includes:
identifying the session flow by a Transmission Control Protocol (TCP) message; the TCP identification of the message may be performed in a conventional manner, which is not limited by the present invention.
Information acquisition is carried out on the identified TCP message, and acquisition information of the TCP message is obtained; specifically, the acquired information may include, but is not limited to: the four-tuple information, the message sequence number seq, the confirmation sequence number ack and the like of the message; wherein the four-tuple information includes, but is not limited to, a source internet protocol address (Internet Protocol, IP), a destination IP, a source port, a destination port.
And calculating the flow rate of the TCP according to the acquired information, and determining that the session corresponding to the TCP message is a candidate abnormal session when the flow rate is smaller than a preset flow rate threshold. Specifically, when the flow rate is smaller than the preset flow rate threshold, it is indicated that the flow rate of the current session flow is too slow, and an abnormality may exist, and the session needs to be marked by using the collected four-tuple information, which indicates that the call-back is a candidate abnormal session.
The calculating the flow rate of the TCP according to the acquired information specifically includes:
and in a timing period, calculating the difference value between the first message sequence number seq1 of the TCP message obtained at the beginning of the timing period and the second message sequence number seq2 of the TCP message obtained at the end of the timing period to obtain the flow rate.
The analysis of the message of the candidate abnormal session, and the determination of the abnormal type specifically include:
acquiring a client receiving capacity parameter, a server sending capacity parameter and a network accommodating capacity parameter corresponding to the candidate abnormal session according to the message and the acquired information;
when the network accommodation capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is smaller than the network accommodation capacity parameter, determining that the abnormality type is server abnormality;
when the server sending capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is larger than the network accommodating capacity parameter, determining that the abnormality type is network abnormality;
And when the server sending capacity parameter is equal to the network accommodating capacity parameter and the server sending capacity parameter is larger than the client receiving capacity parameter, determining that the abnormality type is abnormal of the client.
Wherein, according to the message and the acquired information, the method for acquiring the client receiving capacity parameter, the server transmitting capacity parameter and the network accommodating capacity parameter corresponding to the candidate abnormal session specifically comprises the following steps:
Acquiring the receiving capacity parameter of the client according to the rwnd information of the receiving window carried by the message;
Calculating the number flight size of the messages which are sent by the current sending window but not received the confirmation message according to the message sequence number seq and the confirmation sequence number ack in the acquired information, and taking the number flight size as the sending capability parameter of the server; specifically, the fligh size is equal to the seq of the transmitted message minus the previous ack of the last received message.
Determining whether the message is subjected to fast retransmission, and updating the congestion window cwnd of the current network to be half of the current cwnd when the message is subjected to fast retransmission, wherein the fast retransmission means that a client continuously sends a preset number of acknowledgement messages ACK, for example, the preset number is 3; when no fast retransmission occurs, updating the congestion window cwnd of the current network to be flight size, and taking the updated cwnd as the network accommodation capacity parameter.
The analysis of the message of the candidate abnormal session, and the determination of the abnormal type specifically include:
when the packet loss exceeding the preset packet loss times occurs in the message of the candidate abnormal session, determining that the abnormal type is network abnormality;
when the maximum TCP segment size MSS is greater than the current message length of the candidate abnormal session, determining that the client is abnormal;
When the receiving window rwnd information carried by the message is 0, determining that the client is abnormal;
And when the rwnd exceeds the continuous decline of the preset decline times, determining that the client is abnormal.
When the anomaly type of the first candidate anomaly session is network anomaly, determining the anomaly location of the first candidate anomaly session according to a preset anomaly location rule, specifically including:
Determining whether the server and the client sense that the first candidate abnormal session loses packets or not according to seq and ack in the acquired information of the TCP message of the first candidate abnormal session; specifically, after the server senses packet loss, the server can determine whether the server senses packet loss by repeatedly sending messages carrying the same seq; similarly, when a client senses packet loss, an ack is retransmitted, so that whether the client informs the packet loss can be determined through the ack.
When the server and the client both sense packet loss, the server side is indicated that packet loss occurs, so that the abnormal position can be determined as a network of the server side;
When the server does not perceive the packet loss and the client perceives the packet loss, the probability of the occurrence of the fault on the side of the client is larger, so that the abnormal position can be determined as the network on the side of the client.
Those skilled in the art will appreciate that the more network management devices that are attached to the core aggregation switching device in the network, the more accurate the location of the anomaly will be determined.
Based on the same inventive concept, an embodiment of the present invention provides a network management apparatus based on a wide area network, where the apparatus is applicable to a wide area network, the wide area network includes a client and a server connected through a core convergence switching device, and the apparatus is applied to a network management device that is suspended by the core convergence switching device, and the structure is shown in fig. 2, and includes: a preliminary screening unit 21, an analysis unit 22, and an alarm unit 23; wherein,
The primary screening unit 21 is configured to perform primary screening on session traffic mirrored from the core convergence switching device to obtain candidate abnormal sessions;
The analysis unit 22 is configured to analyze the message of the candidate abnormal session, and determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies; the method is also used for determining the abnormal position of the first candidate abnormal session according to a preset abnormal position rule when the abnormal type of the first candidate abnormal session is network abnormality; and
The alarm unit 23 is configured to determine that the second candidate abnormal session is abnormal and output an abnormal alarm when a ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold; the anomaly alert includes one or more of anomaly type, anomaly location.
Optionally, the primary screening unit 21 is configured to perform primary screening on the session traffic mirrored from the core convergence switching device, and specifically is configured to identify a transmission control protocol TCP packet for the session traffic when a candidate abnormal session is obtained; information acquisition is carried out on the identified TCP message, and acquisition information of the TCP message is obtained; and calculating the flow rate of the TCP according to the acquired information, and determining that the session corresponding to the TCP message is a candidate abnormal session when the flow rate is smaller than a preset flow rate threshold.
Optionally, the preliminary screening unit 21 is configured to calculate, in a timing period, a difference between a first packet sequence number seq1 of the TCP packet obtained at the beginning of the timing period and a second packet sequence number seq2 of the TCP packet obtained at the end of the timing period, when calculating the flow rate of the TCP according to the collected information, so as to obtain the flow rate.
Optionally, the analysis unit 22 is configured to analyze the message of the candidate abnormal session, and specifically is configured to, when determining the abnormal type:
acquiring a client receiving capacity parameter, a server sending capacity parameter and a network accommodating capacity parameter corresponding to the candidate abnormal session according to the message and the acquired information;
when the network accommodation capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is smaller than the network accommodation capacity parameter, determining that the abnormality type is server abnormality;
when the server sending capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is larger than the network accommodating capacity parameter, determining that the abnormality type is network abnormality;
And when the server sending capacity parameter is equal to the network accommodating capacity parameter and the server sending capacity parameter is larger than the client receiving capacity parameter, determining that the abnormality type is abnormal of the client.
Optionally, the analysis unit 22 is configured to obtain, according to the message and the collected information, a client receiving capability parameter, a server sending capability parameter, and a network accommodating capability parameter corresponding to the candidate abnormal session, where the analysis unit is specifically configured to:
Acquiring the receiving capacity parameter of the client according to the rwnd information of the receiving window carried by the message;
calculating the number flight size of the messages which are sent by the current sending window but not received the confirmation message according to the message sequence number seq and the confirmation sequence number ack in the acquired information, and taking the number flight size as the sending capability parameter of the server;
Determining whether the message is subjected to fast retransmission, and updating the congestion window cwnd of the current network to be half of the current cwnd when the message is subjected to fast retransmission; when no fast retransmission occurs, updating the congestion window cwnd of the current network to be flight size, and taking the updated cwnd as the network accommodation capacity parameter.
Optionally, the analysis unit 22 is configured to analyze the message of the candidate abnormal session, and specifically is configured to, when determining the abnormal type:
when the packet loss exceeding the preset packet loss times occurs in the message of the candidate abnormal session, determining that the abnormal type is network abnormality;
when the maximum TCP segment size MSS is greater than the current message length of the candidate abnormal session, determining that the client is abnormal;
When the receiving window rwnd information carried by the message is 0, determining that the client is abnormal;
And when the rwnd exceeds the continuous decline of the preset decline times, determining that the client is abnormal.
Optionally, the analysis unit 22 is configured to, when the anomaly type of the first candidate abnormal session is a network anomaly, determine, according to a preset anomaly location rule, an anomaly location of the first candidate abnormal session, specifically configured to:
determining whether the server and the client sense that the first candidate abnormal session loses packets or not according to seq and ack in the acquired information of the TCP message of the first candidate abnormal session;
when the server and the client both sense packet loss, determining that the abnormal position is a network at the server side;
And when the server does not perceive the packet loss and the client side perceives the packet loss, determining the abnormal position as the network at the client side.
It should be understood that the implementation principle and the process of the network management device based on the wide area network according to the embodiment of the present invention are similar to those of the embodiment shown in fig. 1 and described above, and are not repeated here.
According to the network management method and device based on the wide area network, provided by the embodiment of the invention, the network management equipment is hung beside the core convergence switching equipment, and the network management equipment performs preliminary screening on session traffic mirrored from the core convergence switching equipment to obtain candidate abnormal sessions; analyzing the message of the candidate abnormal session to determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies; when the abnormal type of the first candidate abnormal session is network abnormality, determining an abnormal position of the first candidate abnormal session according to a preset abnormal position rule; and when the ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold, determining that the second candidate abnormal session is abnormal, and outputting an abnormal alarm. In the embodiment of the invention, the network management equipment is hung beside the core convergence switching equipment, so that single equipment deployment can be realized, the realization is easy, the network management equipment can monitor all the flow flowing through the core convergence switching equipment in real time, the monitoring granularity can be accurate to a single message, the abnormal type and the abnormal position of an abnormal session can be positioned by analyzing the message, and abnormal alarm is carried out when the number of abnormal messages reaches the alarm requirement, so that the effective management of the wide area network is realized.
The embodiment of the present application further provides an electronic device, please refer to fig. 3, which includes a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 complete communication with each other through the communication bus 540.
A memory 530 for storing a computer program;
the processor 510 is configured to implement the network management method based on the wide area network according to any one of the above embodiments when executing the program stored in the memory 530.
The communication interface 520 is used for communication between the electronic device and other devices.
The Memory may include random access Memory (Random Access Memory, RAM) or may include Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the aforementioned processor.
The processor may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; but may also be a digital signal processor (DIGITAL SIGNAL Processing, DSP), application SPECIFIC INTEGRATED Circuit (ASIC), field-Programmable gate array (Field-Programmable GATE ARRAY, FPGA) or other Programmable logic device, discrete gate or transistor logic device, discrete hardware components.
According to the scheme, the network management equipment is hung beside the core convergence switching equipment, single equipment deployment can be achieved, the network management equipment is easy to achieve, the flow of all flows flowing through the core convergence switching equipment can be monitored in real time, the monitoring granularity can be accurate to a single message, the abnormal type and the abnormal position of an abnormal session can be positioned through analyzing the message, abnormal alarm is carried out when the number of abnormal messages reaches the alarm requirement, and effective management of a wide area network is achieved.
Accordingly, embodiments of the present application also provide a computer readable storage medium having instructions stored therein, which when run on a computer, cause the computer to perform the wide area network based network management method of any of the above embodiments.
According to the scheme, the network management equipment is hung beside the core convergence switching equipment, single equipment deployment can be achieved, the network management equipment is easy to achieve, the flow of all flows flowing through the core convergence switching equipment can be monitored in real time, the monitoring granularity can be accurate to a single message, the abnormal type and the abnormal position of an abnormal session can be positioned through analyzing the message, abnormal alarm is carried out when the number of abnormal messages reaches the alarm requirement, and effective management of a wide area network is achieved.
Those of ordinary skill in the art will appreciate that: the drawing is a schematic diagram of one embodiment and the modules or flows in the drawing are not necessarily required to practice the invention.
From the above description of embodiments, it will be apparent to those skilled in the art that the present invention may be implemented in software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method described in the embodiments or some parts of the embodiments of the present invention.
In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for apparatus or system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, with reference to the description of method embodiments in part. The apparatus and system embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
In addition, in some of the above embodiments and the flows described in the drawings, a plurality of operations appearing in a specific order are included, but it should be clearly understood that the operations may be performed out of the order in which they appear herein or performed in parallel, the sequence numbers of the operations such as 201, 202, 203, etc. are merely used to distinguish between the various operations, and the sequence numbers themselves do not represent any order of execution. In addition, the flows may include more or fewer operations, and the operations may be performed sequentially or in parallel. It should be noted that, the descriptions of "first" and "second" herein are used to distinguish different messages, devices, modules, etc., and do not represent a sequence, and are not limited to the "first" and the "second" being different types.
The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While alternative embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following appended claims be interpreted as including alternative embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various modifications and variations can be made to the embodiments of the present invention without departing from the spirit or scope of the embodiments of the invention. Thus, if such modifications and variations of the embodiments of the present invention fall within the scope of the claims and the equivalents thereof, the present invention is also intended to include such modifications and variations.
Claims (16)
1. A network management method based on a wide area network, which is applicable to the wide area network, wherein the wide area network comprises a client and a server which are connected through a core convergence switching device, and the method is applied to a network management device which is hung beside the core convergence switching device, and comprises the following steps:
preliminary screening is carried out on the session traffic mirrored from the core convergence switching equipment to obtain candidate abnormal sessions;
analyzing the message of the candidate abnormal session to determine an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies;
When the abnormal type of the first candidate abnormal session is network abnormality, determining an abnormal position of the first candidate abnormal session according to a preset abnormal position rule; and
When the ratio of the number of abnormal messages of the second candidate abnormal session to the total number of messages in a preset period is greater than a preset threshold, determining that the second candidate abnormal session is abnormal;
Judging the number of various abnormal types corresponding to the second abnormal candidate session, taking the abnormal type with the largest number of abnormal types as a judging result, and outputting an abnormal alarm; the anomaly alert includes one or more of anomaly type, anomaly location.
2. The method of claim 1, wherein the preliminary screening of session traffic mirrored from the core aggregation switching device to obtain candidate abnormal sessions specifically includes:
identifying the session flow by a Transmission Control Protocol (TCP) message;
Information acquisition is carried out on the identified TCP message, and acquisition information of the TCP message is obtained;
And calculating the flow rate of the TCP according to the acquired information, and determining that the session corresponding to the TCP message is a candidate abnormal session when the flow rate is smaller than a preset flow rate threshold.
3. The method according to claim 2, wherein said calculating the flow rate of the TCP from the collected information comprises:
and in a timing period, calculating the difference value between the first message sequence number seq1 of the TCP message obtained at the beginning of the timing period and the second message sequence number seq2 of the TCP message obtained at the end of the timing period to obtain the flow rate.
4. The method according to claim 2, wherein the analyzing the message of the candidate abnormal session to determine the abnormal type specifically includes:
acquiring a client receiving capacity parameter, a server sending capacity parameter and a network accommodating capacity parameter corresponding to the candidate abnormal session according to the message and the acquired information;
when the network accommodation capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is smaller than the network accommodation capacity parameter, determining that the abnormality type is server abnormality;
when the server sending capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is larger than the network accommodating capacity parameter, determining that the abnormality type is network abnormality;
And when the server sending capacity parameter is equal to the network accommodating capacity parameter and the server sending capacity parameter is larger than the client receiving capacity parameter, determining that the abnormality type is abnormal of the client.
5. The method of claim 4, wherein the obtaining, according to the message and the collected information, the client receiving capability parameter, the server sending capability parameter, and the network accommodating capability parameter corresponding to the candidate abnormal session specifically includes:
Acquiring the receiving capacity parameter of the client according to the rwnd information of the receiving window carried by the message;
calculating the number flight size of the messages which are sent by the current sending window but not received the confirmation message according to the message sequence number seq and the confirmation sequence number ack in the acquired information, and taking the number flight size as the sending capability parameter of the server;
Determining whether the message is subjected to fast retransmission, and updating the congestion window cwnd of the current network to be half of the current cwnd when the message is subjected to fast retransmission; when no fast retransmission occurs, updating the congestion window cwnd of the current network to be flight size, and taking the updated cwnd as the network accommodation capacity parameter.
6. The method according to claim 2, wherein the analyzing the message of the candidate abnormal session to determine the abnormal type specifically includes:
when the packet loss exceeding the preset packet loss times occurs in the message of the candidate abnormal session, determining that the abnormal type is network abnormality;
when the maximum TCP segment size MSS is greater than the current message length of the candidate abnormal session, determining that the client is abnormal;
When the receiving window rwnd information carried by the message is 0, determining that the client is abnormal;
And when the rwnd exceeds the continuous decline of the preset decline times, determining that the client is abnormal.
7. The method according to claim 2, wherein when the anomaly type of the first candidate anomaly session is a network anomaly, determining the anomaly location of the first candidate anomaly session according to a preset anomaly location rule specifically includes:
determining whether the server and the client sense that the first candidate abnormal session loses packets or not according to seq and ack in the acquired information of the TCP message of the first candidate abnormal session;
when the server and the client both sense packet loss, determining that the abnormal position is a network at the server side;
And when the server does not perceive the packet loss and the client side perceives the packet loss, determining the abnormal position as the network at the client side.
8. A network management apparatus based on a wide area network, which is applicable to a wide area network, wherein the wide area network comprises a client and a server connected through a core convergence switching device, and the apparatus is applied to a network management device which is suspended by the core convergence switching device, and comprises: the primary screening unit, the analysis unit and the alarm unit; wherein,
The primary screening unit is used for primarily screening the session flow mirrored from the core convergence exchange equipment to obtain candidate abnormal sessions;
The analysis unit is used for analyzing the message of the candidate abnormal session and determining an abnormal type; the anomaly type comprises client anomalies, network anomalies and server anomalies; the method is also used for determining the abnormal position of the first candidate abnormal session according to a preset abnormal position rule when the abnormal type of the first candidate abnormal session is network abnormality; and
The alarm unit is used for determining the abnormal of the second candidate abnormal conversation when the ratio of the abnormal message number of the second candidate abnormal conversation to the total message number in a preset period is greater than a preset threshold, judging the number of various abnormal types corresponding to the second abnormal candidate conversation, taking the abnormal type with the largest abnormal type number as a judging result, and outputting an abnormal alarm; the anomaly alert includes one or more of anomaly type, anomaly location.
9. The apparatus of claim 8, wherein the primary screening unit is configured to perform primary screening on session traffic mirrored from the core convergence switching device, and when a candidate abnormal session is obtained, specifically configured to identify a transmission control protocol TCP packet for the session traffic; information acquisition is carried out on the identified TCP message, and acquisition information of the TCP message is obtained; and calculating the flow rate of the TCP according to the acquired information, and determining that the session corresponding to the TCP message is a candidate abnormal session when the flow rate is smaller than a preset flow rate threshold.
10. The apparatus according to claim 9, wherein the preliminary screening unit is configured to calculate, in a timing period, a difference between a first packet sequence number seq1 of the TCP packet obtained at a start of the timing period and a second packet sequence number seq2 of the TCP packet obtained at an end of the timing period, when calculating the flow rate of the TCP based on the collected information, so as to obtain the flow rate.
11. The apparatus of claim 9, wherein the analyzing unit is configured to analyze the message of the candidate abnormal session, and when determining an abnormality type, specifically configured to:
acquiring a client receiving capacity parameter, a server sending capacity parameter and a network accommodating capacity parameter corresponding to the candidate abnormal session according to the message and the acquired information;
when the network accommodation capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is smaller than the network accommodation capacity parameter, determining that the abnormality type is server abnormality;
when the server sending capacity parameter is equal to the client receiving capacity parameter and the server sending capacity parameter is larger than the network accommodating capacity parameter, determining that the abnormality type is network abnormality;
And when the server sending capacity parameter is equal to the network accommodating capacity parameter and the server sending capacity parameter is larger than the client receiving capacity parameter, determining that the abnormality type is abnormal of the client.
12. The apparatus of claim 11, wherein the analyzing unit is configured to, when acquiring, according to the message and the collected information, the client receiving capability parameter, the server sending capability parameter, and the network accommodating capability parameter corresponding to the candidate abnormal session, specifically:
Acquiring the receiving capacity parameter of the client according to the rwnd information of the receiving window carried by the message;
calculating the number flight size of the messages which are sent by the current sending window but not received the confirmation message according to the message sequence number seq and the confirmation sequence number ack in the acquired information, and taking the number flight size as the sending capability parameter of the server;
Determining whether the message is subjected to fast retransmission, and updating the congestion window cwnd of the current network to be half of the current cwnd when the message is subjected to fast retransmission; when no fast retransmission occurs, updating the congestion window cwnd of the current network to be flight size, and taking the updated cwnd as the network accommodation capacity parameter.
13. The apparatus of claim 9, wherein the analyzing unit is configured to analyze the message of the candidate abnormal session, and when determining an abnormality type, specifically configured to:
when the packet loss exceeding the preset packet loss times occurs in the message of the candidate abnormal session, determining that the abnormal type is network abnormality;
when the maximum TCP segment size MSS is greater than the current message length of the candidate abnormal session, determining that the client is abnormal;
When the receiving window rwnd information carried by the message is 0, determining that the client is abnormal;
And when the rwnd exceeds the continuous decline of the preset decline times, determining that the client is abnormal.
14. The apparatus of claim 9, wherein the analysis unit is configured to, when the anomaly type of the first candidate abnormal session is a network anomaly, determine an anomaly location of the first candidate abnormal session according to a preset anomaly location rule, specifically configured to:
determining whether the server and the client sense that the first candidate abnormal session loses packets or not according to seq and ack in the acquired information of the TCP message of the first candidate abnormal session;
when the server and the client both sense packet loss, determining that the abnormal position is a network at the server side;
And when the server does not perceive the packet loss and the client side perceives the packet loss, determining the abnormal position as the network at the client side.
15. An electronic device, characterized in that the electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory are in communication with each other through the communication bus;
A memory for storing a computer program;
A processor for implementing the method steps of any of claims 1-7 when executing a program stored on a memory.
16. A computer readable storage medium, characterized in that the computer readable storage medium has stored therein a computer program which, when executed by a processor, implements the method of any of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111672387.1A CN114363160B (en) | 2021-12-31 | 2021-12-31 | Network management method and device based on wide area network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111672387.1A CN114363160B (en) | 2021-12-31 | 2021-12-31 | Network management method and device based on wide area network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114363160A CN114363160A (en) | 2022-04-15 |
| CN114363160B true CN114363160B (en) | 2024-10-25 |
Family
ID=81104879
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111672387.1A Active CN114363160B (en) | 2021-12-31 | 2021-12-31 | Network management method and device based on wide area network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114363160B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111865667A (en) * | 2020-06-28 | 2020-10-30 | 新华三技术有限公司 | Network connectivity fault root cause positioning method and device |
| CN113595784A (en) * | 2021-07-26 | 2021-11-02 | 招商银行股份有限公司 | Network flow detection method, device, equipment, storage medium and program product |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6334219B1 (en) * | 1994-09-26 | 2001-12-25 | Adc Telecommunications Inc. | Channel selection for a hybrid fiber coax network |
| CN105187228A (en) * | 2015-06-12 | 2015-12-23 | 中国通信建设集团设计院有限公司 | Network quality detection method and router |
| CN110198298B (en) * | 2018-10-11 | 2021-08-27 | 腾讯科技（深圳）有限公司 | Information processing method, device and storage medium |
| CN111930882B (en) * | 2020-06-30 | 2024-04-02 | 国网电力科学研究院有限公司 | Server anomaly tracing method, system and storage medium |
| CN112153020A (en) * | 2020-09-10 | 2020-12-29 | 深圳供电局有限公司 | Industrial control flow analysis method and device |
-
2021
- 2021-12-31 CN CN202111672387.1A patent/CN114363160B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111865667A (en) * | 2020-06-28 | 2020-10-30 | 新华三技术有限公司 | Network connectivity fault root cause positioning method and device |
| CN113595784A (en) * | 2021-07-26 | 2021-11-02 | 招商银行股份有限公司 | Network flow detection method, device, equipment, storage medium and program product |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114363160A (en) | 2022-04-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10666537B2 (en) | Managing connections for data communications using heartbeat messaging | |
| US11502932B2 (en) | Indirect testing using impairment rules | |
| US10355961B2 (en) | Network traffic capture analysis | |
| US9992117B2 (en) | Network apparatus, communication system, abnormal traffic detection method, and program | |
| CN119743349B (en) | Intelligent gateway system integrating communication protocol and thermal internet of things platform communication | |
| EP3205054B1 (en) | Method, traffic monitor (tm), request router (rr) and system for monitoring a content delivery network (cdn) | |
| US10218563B2 (en) | Monitoring connections for data communications | |
| CN112866338B (en) | Server state detection method and device | |
| CN107222403A (en) | A kind of data transmission method, system and electronic equipment | |
| CN114363160B (en) | Network management method and device based on wide area network | |
| CN110808917A (en) | Multilink aggregation data retransmission method and transmitting equipment | |
| JP4616020B2 (en) | Network monitoring program and network system | |
| CN116232442B (en) | Communication method, device and storage medium based on TCP/IP protocol and CCSDS protocol | |
| JP6310405B2 (en) | Service impact cause estimation apparatus, service impact cause estimation program, and service impact cause estimation method | |
| JP3961415B2 (en) | Protocol defect automatic detection method and protocol defect automatic detection device | |
| CN106385384B (en) | Message sending method and network equipment | |
| CN105611406B (en) | One kind access net service provider monitors user to video server lag characteristic method | |
| CN115842717A (en) | Service fault positioning method and related equipment | |
| CN112751728A (en) | Link health state monitoring method and device | |
| CN113726574B (en) | A method and device for generating SNMP response message | |
| JP2017034403A (en) | Device, program and method for estimating service influence cause | |
| CN114615170B (en) | Message processing method, device and computer storage medium | |
| CN109167682B (en) | Method and device for remote retrieval of alarm information of electric power automation system | |
| CN110933076A (en) | Client uploading monitoring method, device, equipment and computer storage medium | |
| CN116980199A (en) | Network quality detection method, system, device and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |