CN115733721A - Network management device, network management system, and network management method - Google Patents

Abstract

The present application relates to a network management device, including a logic processor and a first communication interface and a second communication interface coupled to the logic processor, wherein the first communication interface can also be coupled to a network switch and the The second communication interface can also be coupled to one or more computing devices. The logical processor is configured to receive a data packet from the network switch via the first communication interface and determine whether the data packet must be forwarded or blocked. Responsive to a determination that the data packet must be delivered, subsequently sending the data packet to a target computing device; and in response to a determination that the data packet must be blocked, preventing subsequent transmission of the data packet to any computing device. The present application also relates to a corresponding network management system and network management method.

Description

Network management device, network management system and network management method

technical field

The present application relates to network management, in particular to a network management device, a network management system and a network management method.

Background technique

In a computing system such as a server network, multiple server nodes are interconnected to form a network system. Each server node includes logical processing functions, memory storage, and input/output (I/O) interfaces for connectivity. Management and control of the server network is required to optimize utilization of server node resources and prevent any potential malicious activity from external devices.

Contents of the invention

In one aspect, the present application provides a network management device, which includes a logic processor, and a first communication interface and a second communication interface coupled to the logic processor. The first communication interface can be coupled to the network switch. The second communication interface can be coupled to one or more computing devices. The logic processor is configured to receive a data packet from the network switch through the first communication interface, and determine whether the data packet must be forwarded or blocked. Responsive to a determination that the data packet must be delivered, the data packet is subsequently sent to the target computing device. Responsive to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented.

The logical processor determining whether the data packet must be transmitted or blocked also includes determining whether the data packet is a unicast packet or a non-unicast packet. Responsive to a determination that the data packet is a unicast packet, the data packet is transmitted to the target computing device. Responsive to a determination that the data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented.

The logical processor may also be configured to receive a query packet from an external device, and to transmit information stored in a database to the external device in response to receiving the query packet.

The logical processor may also be configured to receive a second data packet from one of the one or more computing devices and determine whether the second data packet must be transmitted or blocked. Responsive to a determination that the second data packet must be transmitted, the second data packet is subsequently transmitted to a network switch. Responsive to a determination that the second data packet must be blocked, subsequent transmission of the second data packet to the network switch is prevented.

The logic processor determining whether the second data packet must be transmitted or blocked further includes determining whether the second data packet is a non-multicast packet or a multicast packet. Responsive to a determination that the second data packet is a non-multicast packet, the data packet is transmitted to the network switch. In response to a determination that the second data packet is a multicast packet, subsequent transmission of the second data packet to the network switch is prevented.

The logical processor may also be configured to receive status packets from the one or more computing devices, and store status information for the one or more computing devices in a database.

According to one embodiment, the information of the one or more computing devices includes Address Resolution Protocol (Address Resolution Protocol, ARP), Service Location Protocol (Service Location Protocol, SLP), Simple Service Discovery Protocol (Simple Service Discovery Protocol, SSDP), and Link Layer Discovery Protocol (Link Layer Discovery Protocol, LLDP).

The one or more computing devices may include a plurality of server nodes.

In another aspect, the present application provides a network management system, the network management system includes a plurality of network management devices according to the present disclosure coupled to each other, wherein one network management device in the plurality of network management devices Can be set as a rack proxy. The rack agent is configured to receive a data packet from a network switch and determine whether the data packet must be forwarded or blocked. In response to a determination that the data packet must be transmitted, the data packet is sent to the target computing device. Responsive to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented.

The network management device may be configured as a rack agent and may be further configured to determine whether the data packet is a unicast packet or a non-unicast packet. Responsive to a determination that the data packet is a unicast packet, the data packet is transmitted to the target computing device. Responsive to a determination that the data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented.

According to one embodiment, said plurality of network management devices are arranged in a daisy chain topology arrangement.

Preferably, the plurality of network management devices are configured to form a closed-loop connection with a network switch.

Preferably, when the closed-loop connection changes, another one of the network management devices can be set as the second rack agent. The second rack agent is configured to receive a second data packet from the network switch and determine whether the second data packet must be forwarded or blocked. Responsive to a determination that the second data packet is to be transmitted, the second data packet is transmitted to a second target computing device. Responsive to a determination that the second data packet is to be blocked, subsequent transmission of the second data packet to any computing device is prevented.

The other network management device that can be set as the second rack agent can be further set to determine whether the second data packet is a unicast packet or a non-unicast packet. Responsive to a determination that the second data packet is a unicast packet, the second data packet is transmitted to the target computing device. Responsive to a determination that the second data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented.

Preferably, the network management device is configured to: determine at least one candidate rack proxy, wherein each of the at least one candidate rack proxy is one of the network management devices directly connected to the network switch , calculating a respective priority value for each candidate rack agent, and determining the rack agent based on the minimum priority value.

In yet another aspect, the present application provides a network management method. The method includes receiving a data packet from a network switch via a first communication interface, and determining whether the data packet must be transmitted or blocked. Responsive to a determination that the data packet must be delivered, the data packet is subsequently sent to the target computing device. Responsive to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented.

The method may further include determining whether the data packet is a unicast packet or a non-unicast packet. Responsive to a determination that the data packet is a unicast packet, the data packet is transmitted to the target computing device. Responsive to a determination that the data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented.

The method may further include receiving an inquiry packet from an external device. In response to receiving the query packet, the information stored in the database is sent to the external device.

The method may also include receiving a second data packet from the computing device or one of the plurality of computing devices, and determining whether the second data packet must be transmitted or blocked. Responsive to a determination that the second data packet must be transmitted, the second data packet is subsequently sent to a network switch. Responsive to a determination that the second data packet must be blocked, subsequent transmission of the second data packet to the network switch is prevented.

The method may also include receiving a status packet from the one or more computing devices, and storing status information for the one or more computing devices in a database.

Description of drawings

FIG. 1 is a schematic diagram of a network management system according to an embodiment of the present application;

Fig. 2 is a schematic diagram of an example of a network management device in the embodiment shown in Fig. 1;

Fig. 3 is a schematic diagram of connection and data packet transmission between the network switch and the network management device according to the embodiment of Fig. 1;

Fig. 4 is a schematic diagram of the connection between the network switch and the network management device in the embodiment of Fig. 1 and a schematic diagram of sending another data packet;

5 is a schematic diagram of a network management system forming a closed-loop connection with a network switch according to another embodiment of the present application;

FIG. 6 is a schematic diagram of determining a rack agent according to the network management system in FIG. 5 .

Fig. 7 is a schematic diagram showing that the closed-loop connection of the network management system according to the embodiment of Fig. 5 changes;

FIG. 8 is a schematic diagram of determining a rack agent according to the network management system in FIG. 7 .

FIG. 9 is a schematic diagram of another change in the closed-loop connection of the network management system according to the embodiment of FIG. 5 .

FIG. 10 is a schematic diagram of determining a rack agent according to the network management system in FIG. 9 .

Fig. 11 is a schematic diagram according to an embodiment of the rack proxy determination method of the present application; and

Fig. 12 is a schematic diagram of a server management method according to an embodiment of the present application.

Detailed ways

A typical data center network can be divided into a data network and a management network. The management network connects multiple physical network devices, such as a system management module (System Management Module, SMM), a board management controller (Board Management Controller, BMC), server nodes, and the like. Administrators can centrally monitor and manage these devices through the management network. For example, the system management module is connected to the network switch through a daisy-chain topology setup, which helps to reduce the interface usage in the network switch, thereby enabling the scalability of the network.

When each network device sends broadcast (Broadcast) data packets, unknown unicast (Unknown unicast) data packets and multicast (Multicast) data packets to other parts of the network through the network switch, collectively referred to as BUM data packets, a large number of data packets in the network transmissions can cause congestion on the management network. Similarly, each network device also needs to process the BUM data packets received from the network switch, thus causing performance degradation of the network device. In addition, unicast data packets from unknown sources may also become a security risk to the network.

Fig. 1 shows a network management system 100 according to an embodiment of the present application. The network management system 100 includes a plurality of network management devices 112/122/132/142 coupled to each other, and a plurality of other network devices, such as computing devices, compatible with the network management devices 112/122/132/142. Each network management device 112/122/132/142 is coupled to at least one computing device 114/124/134/144, respectively. As an example, as shown in FIG. 1, the computing device may be an array of 4 server nodes 114/124/134/144, each having 3 server nodes. The plurality of network management devices 112/122/132/142 are arranged to be coupled in a daisy-chain topology arrangement, ie, the plurality of network management devices 112/122/132/142 are connected in series. Corresponding server nodes 114/124/134/144 are connected in series with corresponding network management devices 112/122/132/142 coupled to each group, so that server nodes 114 are connected in parallel to server nodes 124, and server nodes 134 are connected in parallel to server nodes 144 et al. The network management system 100 is configured to be coupled to a Top of Rack (Top of Rack) network switch 200 or similar devices.

FIG. 2 shows an example of a network management device 112 in the network management system 100 . The network management device 112 includes a logic processor, such as a board management controller (Board Management Controller, BMC) 160, a switch chip 170, a programmable system on chip (Programmable System on Chip, PSoC) 180, and an in-band management interface (In-band Management Port, IMP) 190. The logical processor is coupled to the database 150 . The switch chip 170 is coupled to the board management controller 160 through, for example, a serial peripheral interface. The programmable SoC 180 is coupled to the board management controller 160 through an Inter-Integrated Circuit (I2C) and a General Purpose Input/Output (GPIO). The in-band management interface 190 is disposed on the switch chip 170 . Further, the network management device 112 includes a first communication interface, a second communication interface and a third communication interface. The first communication interface can be, for example, the interface “A” 172 for coupling to the network switch 200 . The second communication interface may be, for example, the interface "B" 174 for coupling to another network management device among the network management devices 112/122/132/142. The third communication interface may be, for example, interface "N" 176 for coupling to server nodes 114/124/134/144. The database 150 of the network management device 112 is arranged to store information of the network management device 112/122/132/142 as well as information of other server nodes 114/124/134/144.

In the embodiments shown in FIG. 1 and FIG. 2 , one of the network management devices is set as the rack agent 102 . As an example, the network management device 112 directly connected to the network switch 200 is set as the rack proxy 102 . The rack proxy 102 can serve as a gateway between the network switch 200 and the network management system 100 . Alternatively, the selection or determination of the rack agent 102 may be based on other criteria or rules, which will be described in detail below. The rack proxy 102 is configured to determine the processing mode of the received data packet according to the characteristics of the received data packet.

Referring to FIG. 3, when the network management system 100 is connected to the network switch 200, the rack agent 102 receives the data packet 410a/420 from the network switch 200, and determines the processing mode of the data packet 410a/420, that is, whether the data packet must be transmitted or be blocked. If rack agent 102 determines that a data packet (eg, data packet 410a ) must be transmitted, ie, in response to the determination that data packet 410a must be transmitted, rack agent 102 subsequently sends data packet 410a to the target computing device. Conversely, if rack agent 102 determines that a packet (e.g., packet 420) must be blocked, i.e., in response to the determination that the packet must be blocked, rack agent 102 prevents subsequent sending of packet 420 to any computing equipment.

Rack agent 102 may also be configured to determine a target computing device based on data packet 410a/420. For example, rack agent 102 determines the target computing device based on information in database 150 and data packets 410a/420. If the Rack Agent cannot determine the target computing device, the packet will be blocked from delivery. The rack agent 102 may further be configured to determine whether the data packet 410a/420 is a unicast packet or a non-unicast packet. After determining the target computing device, rack agent 102 transmits the unicast packet to server node 134 in response to determining that the data packet (eg, data packet 410a ) is a unicast packet. Conversely, in response to a determination that a data packet (eg, data packet 420 ) is a non-unicast packet, rack agent 102 prevents transmission of data packet 420 . According to the above settings, the rack agent 102 determines the target computing device, determines the nature of the data packet, and transmits the data packet or prevents the transmission of the data packet, while other network management devices 122/132/142 are set as data packet transmission channels .

FIG. 4 illustrates another exemplary scenario in which a data packet is sent from one of the computing devices to the network switch 200 . In this scenario, the rack agent 102 is configured to receive the second data packet 430a/440 from a computing device such as the server node 134, and determine the first The processing mode of the second data packet 430a/440, that is, whether the data packet must be transmitted or blocked. If the rack agent 102 determines that a second data packet (e.g., the second data packet 430a) must be transmitted, that is, in response to the determination that the second data packet 430a must be transmitted, the rack agent 102 sends the second data packet 430a. to the network switch 200. Conversely, if the rack agent 102 determines that a second data packet (e.g., the second data packet 440) must be prevented from being transmitted, that is, in response to the determination that the second data 440 must be prevented, the rack agent 102 prevents the second data packet from being transmitted. 440 transmission to the network switch 200.

The rack agent 102 may also be configured to determine whether the second data packet is a multicast packet or a non-multicast packet. If it is determined that the second data packet is a non-multicast packet, such as the non-multicast packet 430a shown in FIG. Packet 430a is sent to network switch 200 . Conversely, if it is determined that the second data packet is a multicast packet, such as the multicast packet 440 shown in FIG. The second data packet 440 is sent to the network switch 200 . By performing the above operations, the rack proxy 102 only allows data packets with specific receiver addresses or specific types of data packets to be transmitted, that is, the rack proxy 102 reduces the possibility of network saturation. Beneficially, the above scheme can reduce network congestion and improve the performance of computing devices. In addition, the above solution can also reduce security risks that may be caused by unicast data packets from unknown sources.

Each network management device 112/122/132/142 can also be configured to obtain the information. The information is stored in the database 150 of each network management device 112/122/132/142 and may be updated periodically or upon any state change in the network management system 100 accordingly. Each network management device 122/132/142 sends corresponding status information for a computing device (eg, server node 114/124/134/144 or network management device 122/132/142) to rack agent 102 using unicast status packets. Therefore, the rack agent 102 directly or indirectly receives the status packet from the network management device 122 / 132 / 142 , and stores the status information corresponding to the received status packet in the database 150 of the rack agent 102 . Status information may include information about the operating environment, connection status, device health status, device runtime, etc. of all computing devices.

When receiving a query request from an external device, such as a query packet sent by the external device, the rack agent 102 sends the information stored in the database 150 to the external device in response to the query request. As an example, the external device may be a network switch 200, wherein the query packet may be, for example, an address resolution protocol (ARP), a service location protocol (SLP), a simple service discovery protocol (SSDP), and a link layer discovery protocol (LLDP). A sort of. This ensures that rack agents 102 respond to query requests efficiently, increasing network efficiency and reducing resource usage. In another example, the external device may be other network management devices or server nodes other than the network management system 100, where the query packet may be, for example, Address Resolution Protocol (ARP), Service Location Protocol (SLP), Simple Service Discovery Protocol (SSDP) ) and Link Layer Discovery Protocol (LLDP).

In yet another example, the external device may be a network administrator device 300, wherein the network administrator queries the rack agent 102 for information about all devices within the network management system 100, such as the status of a particular server node 114/124/134/144 and health status. According to the solution provided in this example, the network administrator can directly obtain all the information of the corresponding equipment from the rack agent 102 without querying and accessing each equipment one by one. The network administrator can also send instruction packets through the rack agent to control the devices in the network management system 100 . The solution can beneficially improve the efficiency and reduce the workload of the network administrator.

Table 1 shows an example of information tables stored in the database 150 related to server node 1, server node 2, and server node 3 coupled to the network management device (network management device #1). Table 2 shows an example of an information table stored in the database 150 related to the server node 10, the server node 11, and the server node 12 coupled to the network management device (network management device #4). The example information table stores and constantly updates the information of each corresponding node, such as IP address, MAC address, allowed protocol.

Table 1

Table 2

table 3

All information tables, such as Table 1 and Table 2 shown above, are jointly stored in the database 150 of the rack agent 102 . The rack agent 102 generates a rule table (Table 3) through the database 150 and in combination with the information table and predetermined rules. Table 3 includes rules such as blocking non-unicast packets from network switch 200 and blocking multicast packets from server nodes 114/124/134/144. When receiving a data packet, the rack agent 102 determines the corresponding operation according to the rule table. As an illustrative example, refer to Rule 1 of Table 3 as the decision rule for receiving data packets at the interface “A”, that is, data packets from the network switch 200 . Since the MAC address was determined to be unknown, the packet was rejected and prevented from being sent further. Referring to rule 2 and rule 3, when interface "A" receives a multicast packet or a broadcast packet, the packet is also rejected and prevented from being sent further. When a multicast data packet is received at interface "B", ie, from another network management device or server node, the data packet is rejected and blocked from further transmission. When receiving a query request such as SLP, ARP, SSDP from the network switch 200, the shelf agent 102 replies to the query request with reference to the operations shown in rules 5-7. When a unicast packet is received on interface "A" or "B" and the forwarding destination address is valid, the unicast packet is allowed to pass and sent to the target computing device matching the destination address. The above-mentioned examples are for illustration only and should not be construed that the present disclosure is limited to the above-mentioned examples. Any other rules that are applicable to the network are within the scope of this disclosure.

Table 4 shows the state changes of devices coupled to network management device #1 relative to Table 1 presented above. Specifically, the address of node 2 is updated, and node 3 allows the SSDP in the protocol to be deleted, as shown in Table 4, and the rule table corresponding to the state change is shown in Table 5 (Table 3 before the change) , Rule 7 and Rule 8 in Table 5 present corresponding changes. Therefore, referring to the modified rule 7, the previously allowed SSDP protocol on node 3 should be denied. Furthermore, referring to the revised rule 8, since the MAC address is no longer valid, the previously allowed unicast packets about node 2 are modified to be denied, and subsequent transmissions are blocked. The dynamic update of information and rule tables does not require the intervention of external systems. Therefore, the network management system 100 can adjust the corresponding rule table according to any dynamic changes of the system.

Table 4

table 5

FIG. 5 shows another embodiment of a network management system 500 in which server nodes are omitted for clarity and intuitive presentation. The network switch 200 is sequentially connected in series to the network management devices 112/122/132/142 through the first link 201 . Compared with the above embodiments, the network management system 500 further includes a second link 202 coupling the network switch 200 to the network management device 142 at the end of the first link 201 . Through the first link 201 and the second link 202 , the network management device 112 / 122 / 132 / 142 forms a closed-loop connection with the network switch 200 .

FIG. 6 is a schematic diagram of determining the rack agent by the network management system 500 shown in FIG. 5 . Since the network management device 112 (network management device #1) and the network management device 142 (network management device #4) are directly connected to the network switch 200 through the first link 201 and the second link 202 respectively, the network management device 112 and 142 are each determined as candidate rack agents 112a, 142a, respectively. The candidate rack agents 112a, 142a then calculate respective respective priority values 112p, 142p. As an example, a priority value may be calculated from a Bridge Protocol Data Unit (BPDU) as follows:

Priority value (64 bits) = MAC address (48 bits): interface (16 bits).

Each candidate rack agent adds corresponding priority values 112p, 142p, that is, type, length and value (TL) in the Link Layer Discovery Protocol (Link Layer Discovery Protocol, LLDP), and sends to the adjacent network management equipment . The candidate rack agent with the smallest priority value, such as the candidate rack agent 112a, is selected as the rack agent 102, and the information "112a=102" that it is selected as the rack agent 102 is sent to the network management system All network management devices 112 , 122 , 132 , 142 in 500 . All network management devices 112, 122, 132, 142 confirm and transmit information to the rack agent 102 through unicast packets. Similar to the above operations, the rack agent 102 operates through the generated rule table, so as to decide whether to allow or deny the transmission of the data packet according to the rule table. In addition, external devices such as the network switch 200 or the network manager device 300 can directly obtain the information of all devices in the network management system 500 from the rack agent 102 .

Fig. 7 shows the situation that the first link 201 connecting the network management system 500 and the network management device 112/122/132/142 changes, for example, the connection 204 between the network management device 122 and the network management device 132 is interrupted Condition. A link interruption may occur in the event of a failure of a connection, such as a cable or connection interface "A" and/or interface "B". In this case, although the first link 201 connected in series between the network management devices 112/122/132/142 is interrupted, the second link 202 still constitutes the link between the network switch 200 and the network management devices 132 and 142. connect. Thus, two independent network management systems 510, 520 are formed. The process of determining the rack proxy is performed automatically in each network management system 510, 520 when the connection status changes.

Figure 8 shows a network management system 510, 520 performing rack proxy determination. Since the candidate rack agents 112a and 142a of each network management system 510, 520 are respectively the only candidate rack agents directly connected to the network switch 200, the two candidate rack agents 112a, 142a are respectively determined as independent network management systems 510 , 520 of the corresponding rack agent 102, 104, and the information "112a=102", "114a=104" determined to be the rack agent 102, 104 is sent to the network management device 112, 104 in the network management system 500 respectively 122 and 132, 142. . Accordingly, each rack agent 102, 104 operates through a respective rule table to allow or block transmission of data packets in the respective network management system 510, 520 according to the respective rule table. In addition, external devices can directly obtain information about all devices in the network management systems 510 and 520 from the rack agents 102 and 104 respectively.

Fig. 9 shows another example of the present application, wherein the connection of the network management system 500 changes, that is, the network management device 132 itself fails, thus causing the connection between the network management device 122 and the network management device 142 to pass through the first link 201 The connection was lost. In this case, the second link 202 still constitutes the connection between the network switch 200 and the network management device 142 . Thus, two independent network management systems 530, 540 are formed. The rack proxy determination process is automatically performed in each network management system 530/540 when the connection state changes.

Figure 10 shows a network management system 530, 540 performing rack proxy determination. Since the candidate rack agents 112a and 142a of each network management system 530, 540 are respectively the only candidate rack agents directly connected to the network switch 200, the two candidate rack agents 112a, 142a are respectively determined as independent network management systems 530, 540 the corresponding rack agent 102/104, and the information "112a=102", "114a=104" determined to be the rack agent 102, 104 is sent to the network management device 112 in the network management system 500 respectively , 122 and 142. . Thus, the rack agents 102, 104 operate through the respective rule tables to allow or block the transmission of data packets in the respective network management systems 530, 540 according to the respective rule tables. In addition, external devices can directly obtain information about all devices in the network management systems 530 and 540 from the rack agents 102 and 104 respectively.

FIG. 11 illustrates a rack proxy determination method 700 . The method 700 includes: in step 710, determining at least one candidate rack proxy, each of the at least one candidate rack proxy is directly connected to an external device. In step 720, each candidate rack agent calculates a respective priority value. In step 730, a rack proxy is determined based on the lowest priority value. Optionally, each candidate rack agent calculates a priority value based on the interface connection with the external device and its respective network address. Method 700 may also include the step of determining one or more rack agents when a connection status in the server management system changes.

Fig. 12 shows a server management method according to an embodiment of the present application. The method 800 includes: at step 810, receiving a data packet from a network switch. In step 820, it is determined whether the data packet must be transmitted or blocked. In step 830, in response to a determination that the data packet must be transmitted, the data packet is subsequently sent to the target computing device. In step 840, in response to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented.

The method according to the present application further includes, determining whether the data packet is a unicast packet or a non-unicast packet; in response to the determination that the data packet is a unicast packet, transmitting the data packet to the target computing device; and preventing subsequent transmission of the data packet to any computing device in response to a determination that the data packet is a non-unicast packet. The method according to the embodiment of the present application may further include receiving a query packet from an external device; and in response to receiving the query packet, sending the information stored in the database to the external device. A method according to the present application may further include receiving a second data packet from one of the one or more computing devices; determining whether the second data packet must be transmitted or blocked. Responsive to a determination that the second data packet must be transmitted, subsequently sending the second data packet to the network switch; and, in response to a determination that the second data packet must be blocked, preventing subsequent transmission of the second data packet to the network switch. The method according to the present application may further include receiving a status packet from the one or more computing devices; and storing the status information of the one or more computing devices in a database.

As used herein, the singular "a" and "an" may be construed to include the plural "one or more" unless expressly stated otherwise.

The foregoing disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limiting. Many modifications and changes will be apparent to those of ordinary skill in the art. The exemplary embodiments were chosen and described in order to explain the principles and practical application, and to enable others of ordinary skill in the art to understand the disclosure for various embodiments with various modifications as are suited to the particular use contemplated.

Accordingly, although illustrative example embodiments are described herein with reference to the accompanying drawings, it should be understood that this description is not limiting and that various other changes and modifications can be effected therein by those skilled in the art without departing from the scope of the present disclosure, the inventive concept and technical solutions.

Claims (20)

1. A network management device, characterized in that, the network management device comprises: logical processors, and The first communication interface and the second communication interface coupled to the logic processor, wherein the first communication interface can also be coupled to a network switch and the second communication interface can also be coupled to one or more computing equipment; Wherein, the logical processor is set as: receiving a data packet from the network switch through the first communication interface; determining whether the data packet must be transmitted or blocked; Responsive to a determination that the data packet must be transmitted, subsequently sending the data packet to a target computing device; and Responsive to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented. 2. The device according to claim 1, wherein the logic processor determining whether the data packet must be transmitted or blocked further comprises, determining whether the data packet is a unicast packet or a non-unicast packet ,and Responsive to a determination that the data packet is a unicast packet, transmitting the data packet to the target computing device; and Responsive to a determination that the data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented. 3. The device according to claim 1, wherein the logic processor is further configured to: receiving query packets from external devices; and In response to receiving the query packet, the information stored in the database is sent to the external device. 4. The device according to claim 1, wherein the logic processor is further configured to: receiving a second data packet from a computing device of the one or more computing devices; determining whether the second data packet must be transmitted or blocked; responsive to a determination that the second data packet must be transmitted, subsequently transmitting the second data packet to a network switch; and Responsive to a determination that the second data packet must be blocked, subsequent transmission of the second data packet to the network switch is prevented. 5. The device of claim 4, wherein the logic processor determining whether the second data packet must be transmitted or blocked further comprises determining whether the second data packet is a non-multicast packet or multicast packets, and transmitting the second data packet to the network switch in response to a determination that the second data packet is a non-multicast packet; and In response to a determination that the second data packet is a multicast packet, subsequent transmission of the second data packet to the network switch is prevented. 6. The device according to claim 1, wherein the logic processor is further configured to: receiving a status packet from the one or more computing devices; and State information for the one or more computing devices is stored in a database. 7. The device of claim 1, wherein the information of the one or more computing devices includes Address Resolution Protocol (ARP), Service Location Protocol (SLP), Simple Service Discovery Protocol (SSDP), and link Layer Discovery Protocol (LLDP). 8. The device of claim 1, wherein the one or more computing devices comprise a plurality of server nodes. 9. A network management system, characterized in that the network management system comprises: a plurality of network management devices according to claim 1 coupled to each other; and at least one computing device coupled to each network management device of the plurality of network management devices; Wherein one network management device among the plurality of network management devices is set as a rack proxy, and the rack proxy is set as: Receive packets from network switches; determining whether the data packet must be transmitted or blocked; Responsive to a determination that the data packet must be transmitted, sending the data packet to a target computing device; and Responsive to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented. 10. The system according to claim 9, wherein the network management device can be set as a rack agent and can be further set as: determining whether the data packet is a unicast packet or a non-unicast packet; and Responsive to a determination that the data packet is a unicast packet, transmitting the data packet to the target computing device; and Responsive to a determination that the data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented. 11. The system of claim 9, wherein the plurality of network management devices are arranged in a daisy chain topology arrangement. 12. The system of claim 11, wherein the plurality of network management devices are arranged to form a closed-loop connection with a network switch. 13. The system according to claim 12, wherein when the closed-loop connection changes, another one of the network management devices can be set as a second rack agent, and the second rack The proxy is set to: receiving a second data packet from the network switch; determining whether the second data packet must be transmitted or blocked; in response to a determination that the second data packet is to be transmitted, transmitting the second data packet to a second target computing device; and Responsive to a determination that the second data packet is to be blocked, subsequent transmission of the second data packet to any computing device is prevented. 14. The system according to claim 13, wherein the other network management device that can be set as the second rack agent is further set to: determining whether the second data packet is a unicast packet or a non-unicast packet, and; transmitting the second data packet to the target computing device in response to a determination that the second data packet is a unicast packet; and Responsive to a determination that the second data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented. 15. The system according to claim 9, wherein the network management device is configured to: determining at least one candidate chassis agent, wherein each of the at least one candidate chassis agent is one of the network management devices directly connected to the network switch; computing a respective priority value for each candidate rack agent; and The rack agent is determined based on a minimum priority value. 16. A network management method, characterized in that the method comprises: receiving a data packet from a network switch through a first communication interface; determining whether the data packet must be transmitted or blocked; Responsive to a determination that the data packet must be transmitted, subsequently sending the data packet to a target computing device; and Responsive to a determination that the data packet must be blocked, subsequent transmission of the data packet to any computing device is prevented. 17. The method of claim 16, further comprising: Determine whether the data packet is a unicast packet or a non-unicast packet; Responsive to a determination that the data packet is a unicast packet, transmitting the data packet to the target computing device; and Responsive to a determination that the data packet is a non-unicast packet, subsequent transmission of the data packet to any computing device is prevented. 18. The method of claim 16, further comprising: receiving query packets from external devices; and In response to receiving the query packet, the information stored in the database is sent to the external device. 19. The method of claim 16, further comprising: receiving a second data packet from a computing device or a computing device of a plurality of computing devices; determining whether the second data packet must be transmitted or blocked; responsive to a determination that the second data packet must be transmitted, subsequently sending the second data packet to a network switch; and Responsive to a determination that the second data packet must be blocked, subsequent transmission of the second data packet to the network switch is prevented. 20. The method of claim 16, further comprising: receiving a status packet from the one or more computing devices; and State information for the one or more computing devices is stored in a database.

Images