CN111884871A - Method and equipment for detecting discarded message of switch - Google Patents

Abstract

The present invention provides a method and device for detecting discarded packets of a switch. The method includes the following steps: establishing a discarding table entry for discarding packets in a monitoring server; The feature of each packet is matched with the record in the discard entry; in response to the feature of the first packet matching the feature recorded in the discard entry, the count recorded in the discard entry corresponding to the feature is increased. By using the solution of the present invention, the real-time monitoring of the discarded packets can be realized, and the problem that the traditional network cannot monitor the discarded packets and the reasons in real time can be solved.

Description

A method and device for detecting discarded packets of a switch

technical field

The field relates to the field of computers, and more particularly, to a method and device for detecting discarded packets of a switch.

Background technique

In the data center network, when a network failure causes data packets to be discarded, the switch will count the packets into RX_DROP, but the specific packet loss reason of the switch cannot be detected in detail. Therefore, when a network packet loss failure occurs, how to effectively detect the network packet loss cause , is the problem that needs to be solved the most.

SUMMARY OF THE INVENTION

In view of this, the purpose of the embodiments of the present invention is to propose a method and device for detecting discarded packets of a switch. By using the method of the present invention, real-time monitoring of discarded packets can be realized, and the problem that traditional networks cannot detect discarded packets and The reason is the problem of real-time monitoring.

Based on the above purpose, an aspect of the embodiments of the present invention provides a method for detecting discarded packets by a switch, including the following steps:

Create a discard table entry for discarded packets (DROP packets) in the monitoring server;

In response to the discarded packet entering the data center white box switch, the characteristics of the first packet are matched with the records in the discarded table entry;

In response to the feature of the first packet matching the feature recorded in the discard entry, the count recorded in the discard entry corresponding to the feature is incremented.

According to an embodiment of the present invention, it also includes:

In response to the characteristics of the first packet not completely matching the characteristics recorded in the discard entry, the characteristics of the first packet are recorded in the discard entry.

According to an embodiment of the present invention, in response to the discarded packets entering the data center white-box switch, matching the characteristics of the first packet with the records in the discarding table entry includes: matching the first packet in the discarded packets with the same characteristics. When a packet is sent to the CPU, the source IP, destination IP, source port, destination port, and protocol number of the discarded packet are matched with the records in the discard table entry, and the CPU analyzes the discard reason of the discarded packet;

In response to the characteristics of the first packet not completely matching the characteristics recorded in the discard entry, recording the characteristics of the first packet into the discard entry includes: in response to the discard The source IP, destination IP, source port, destination port, and protocol number of the packet do not exactly match the records in the discard entry, and the source IP, destination IP, source port, destination port, protocol number, and discard reason record in the discard entry.

According to an embodiment of the present invention, the discard entry record includes source IP, destination IP, source port, destination port, protocol number, statistical value, and discard reason information of the packet.

According to an embodiment of the present invention, it also includes:

In response to a certain record in the discard table entry that does not have the same feature for a threshold time and does not enter the switch, the record is deleted;

In response to dropped packets with the same characteristics entering the switch within the threshold time, the time is recalculated.

Another aspect of the embodiments of the present invention further provides a device for detecting discarded packets by a switch, the device comprising:

establishing a module, and the establishing module is configured to establish a discarding table entry for discarding packets in the monitoring server;

a matching module, where the matching module is configured to match the feature of the first packet with the record in the discard table entry in response to the discarded packet entering the data center white box switch;

A counting module, where the counting module is configured to increase the count recorded in the discarding table entry corresponding to the characteristic in response to matching the characteristic of the first packet with the characteristic recorded in the discarding table entry.

According to an embodiment of the present invention, a recording module is further included, and the recording module is configured to record the characteristic of the first packet in the discarding table in response to the characteristic of the first packet not completely matching the characteristic recorded in the discarding table entry item.

According to an embodiment of the present invention, the matching module is further configured to: send the first packet in the discarded packets with the same characteristics to the CPU, and send the source IP, destination IP, source port, and destination of the discarded packet to the CPU. The port and protocol number are matched with the records in the discard entry, and the reason for discarding the discarded packets is analyzed by the CPU;

The recording module is further configured to record the source IP, destination IP, source IP, The port, destination port, protocol number and discarding reason are recorded in the discarding table entry.

According to an embodiment of the present invention, the discard entry record includes source IP, destination IP, source port, destination port, protocol number, statistical value, and discard reason information of the packet.

According to an embodiment of the present invention, it further includes a timing module, and the timing module is configured as:

In response to a certain record in the discard table entry that does not have the same feature for a threshold time and does not enter the switch, the record is deleted;

In response to dropped packets with the same characteristics entering the switch within the threshold time, the time is recalculated.

The present invention has the following beneficial technical effects: the method for detecting discarded packets of a data center white box switch provided by the embodiment of the present invention establishes a discarding table entry for discarding packets in a monitoring server; The switch sends the first packet of the discarded packets with the same characteristics to the CPU, and matches the characteristics of the first packet with the records in the discard table entry; The feature matches the feature recorded in the discard entry, and the technical solution of increasing the count recorded in the discard entry corresponding to the feature can realize real-time monitoring of discarded packets, and solve the problem that traditional networks cannot monitor discarded packets and the reasons in real time. .

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other embodiments can also be obtained according to these drawings without creative efforts.

1 is a schematic flowchart of a method for detecting discarded packets of a data center white box switch according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a device for detecting discarded packets of a white box switch in a data center according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention will be further described in detail below with reference to the specific embodiments and the accompanying drawings.

Based on the above objective, in a first aspect of the embodiments of the present invention, an embodiment of a method for detecting discarded packets by a switch is proposed. Figure 1 shows a schematic flow chart of the method.

As shown in Figure 1, the method may include the following steps:

S1 establishes a discard entry for discarded packets in the monitoring server. The discard entry records the relevant information of discarded packets. The main information includes the source IP, destination IP, source port, destination port, protocol number, and statistical value of discarded packets. , switch ID identification, port ID identification and discard reason information, etc.;

In response to the discarded packets entering the data center white box switch, S2 sends the first packet of discarded packets with the same characteristics to the CPU, and compares the characteristics of the first packet with the records in the discarded table entry. For matching, since only the first packet is sent, and subsequent discarded packets of the same type can be sent periodically, the number of packets processed by the server can be greatly reduced, and the five-tuple (source IP, destination IP, source port, destination port and protocol number) as the unique feature information of discarded packets, packets with the same feature information are regarded as the same packet, as long as there is a difference in the quintuple information, it is a different feature;

In response to the feature of the first packet matching the feature recorded in the discard entry, S3 increases the count recorded in the discard entry corresponding to the feature. For example, when monitoring the feature information (source IP, destination IP, When the IP, source port, destination port, protocol number) all match in the discard entry, add a to the statistics value of the entry, when the feature information (source IP, destination IP, source port, destination port, protocol number) exists When an entry is inconsistent with the discarded entry, a discarded entry is added, and the discarded entry aging timer is started for the newly added entry.

The technical scheme of the present invention sends the discarded message to the CPU by monitoring discarding, and sends the discarded characteristic information (source IP, destination IP, source port, destination port, protocol number) + switch id identifier according to the defined message discarding reason. It records the number of discarded packets and the port ID + the number of discarded packets, and generates entries to report to the monitoring server, so that the network can monitor discarded packets in real time.

In a preferred embodiment of the present invention, it also includes:

In response to the characteristics of the first packet not completely matching the characteristics recorded in the discard entry, the characteristics of the first packet are recorded in the discard entry. The features used for matching here include source IP, destination IP, source port, destination port, and protocol number. When recording the packet feature in the discard entry, you also need to record the discard reason. The discard reason is obtained by the CPU analysis.

In a preferred embodiment of the present invention, in response to the discarded packets entering the data center white box switch, matching the characteristics of the first packet with the records in the discarding table entry includes: adding discarded packets with the same characteristics to The first packet is sent to the CPU, the source IP, destination IP, source port, destination port, and protocol number of the discarded packet are matched with the records in the discard entry, and the discarded packet is analyzed by the CPU. reason;

In response to the characteristics of the first packet not completely matching the characteristics recorded in the discard entry, recording the characteristics of the first packet into the discard entry includes: in response to the discard The source IP, destination IP, source port, destination port, and protocol number of the packet do not exactly match the records in the discard entry, and the source IP, destination IP, source port, destination port, protocol number, and discard reason record in the discard entry. The characteristics of discarded packets include source IP, destination IP, source port, destination port, and protocol number. If more than one of these five items does not match the record in the discard entry, the discarded packet will be recorded in the discard entry. As the object matched by other discarded packets.

The switch CPU checks the reasons for discarding packets, analyzes the reasons for discarding packets by detecting the ttl field, ipv4, ipv6 packet header field, mtu field, vlan field information, routing information, crc information, outgoing port queue depth and utilization information, and defines packet discarding The reasons are as follows:

Ttl (time to live, time to live) = 0 discarded packets;

Discard packets with incorrect IP (Internet Protocol, Internet Protocol) headers;

IPV6 (Internet Protocol Version 6, Internet Protocol Version 6) header error discarded packets;

Discarded packets exceeding the MTU (Maximum Transmission Unit) of the switch;

Discard packets that do not match the attributes of the port Vlan (Virtual Local Area Network);

Unknown Layer 3 forwarding discards traffic;

CRC (Cyclic Redundancy Check, Cyclic Redundancy Check) check error discarded traffic;

Traffic discarded by congestion in the egress port queue of the switch.

In a preferred embodiment of the present invention, the discard entry record includes source IP, destination IP, source port, destination port, protocol number, statistical value and discard reason information of the packet.

In a preferred embodiment of the present invention, it also includes:

In response to a certain record in the discard table entry that does not have the same feature for a threshold time and does not enter the switch, the record is deleted;

In response to dropped packets with the same characteristics entering the switch within the threshold time, the timer recalculates the time.

When an entry in the discard entry does not have the same (source IP, destination IP, source port, destination port, protocol number) packet entering the switch for t seconds, the discard entry will be deleted. If the same (source IP, destination IP, source port, destination port, protocol number) packets enter the device, the timer will be recalculated. After t seconds, if there is no same packet, it will be deleted. The default aging time for discarding is 3. minutes, the settable range is 1-5 minutes.

The drop table entry can be set to the sending period. When a drop table entry monitors a discarded packet with the same (source IP, destination IP, source port, destination port, and protocol number), the corresponding statistical value of the table entry will increase. a, but the monitoring server does not know the change of the statistical value at this time. Therefore, after the sending period of the discard table entry arrives, the statistical value is sent to the monitoring server, so as to realize the purpose of real-time monitoring and avoid the Send it to the monitoring server to reduce the number of packets processed by the monitoring server.

Example

The following is an exemplary embodiment for implementing the method of the present invention

1. Monitor the discarded packets, and send the discarded packets to the CPU through the cos=40 queue;

2. Monitor the packets entering the switch. When monitoring the discarded packets, analyze the discarding reasons according to the defined discarding reasons. When monitoring discarded packets, check the ttl field, ipv4, ipv6 header field, and mtu field. , vlan field information, routing information, crc information, outgoing port queue depth and utilization information to analyze the reasons for packet discarding;

3. The CPU analyzes and obtains the characteristic information of the packet (source IP, destination IP, source port, destination port, protocol number), and records the information of the incoming and outgoing ports of the packet;

4. Generate discard entries, record feature information (source IP, destination IP, source port, destination port, protocol number) + statistical value + discard reason, and start a timer to prevent the entry from being used indefinitely and not aging;

5. The acl (access control list) entry (source IP, destination IP, source port, destination port, protocol number) delivered by the bottom layer, when the subsequent discarded packets with the same feature information, directly match the acl, and at the same time for the statistical value Increase;

6. Send the discarded packet + discard reason + inbound and outbound port ID + switch ID to the monitoring server.

Through the technical scheme of the present invention, real-time monitoring of discarded packets can be realized, and the problem that traditional networks cannot monitor discarded packets and the reasons in real-time can be solved.

It should be noted that those of ordinary skill in the art can understand that all or part of the process in the method of the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the above-mentioned program can be stored in a computer-readable storage medium. When the program is executed, it may include the flow of the embodiments of the above-mentioned methods. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM) or the like. The above computer program embodiments can achieve the same or similar effects as any of the foregoing method embodiments corresponding thereto.

In addition, the methods disclosed according to the embodiments of the present invention may also be implemented as a computer program executed by the CPU, and the computer program may be stored in a computer-readable storage medium. When the computer program is executed by the CPU, the above-mentioned functions defined in the methods disclosed in the embodiments of the present invention are executed.

Based on the above purpose, a second aspect of the embodiments of the present invention provides a device for detecting discarded packets by a switch. As shown in FIG. 2 , the device 200 includes:

establishing a module, and the establishing module is configured to establish a discarding table entry for discarding packets in the monitoring server;

a matching module, where the matching module is configured to enter the data center white box switch in response to the discarded packet, and to match the feature of the first packet with the record in the discarded table entry;

A counting module, where the counting module is configured to increase the count recorded in the discarding table entry corresponding to the characteristic in response to matching the characteristic of the first packet with the characteristic recorded in the discarding table entry.

In a preferred embodiment of the present invention, a recording module is further included, and the recording module is configured to record the characteristics of the first packet in response to the characteristics of the first packet not completely matching the characteristics recorded in the discard table entry discarded in the entry.

In a preferred embodiment of the present invention, the matching module is further configured to: send the first packet in the discarded packets with the same characteristics to the CPU, and send the source IP, destination IP, and source port of the discarded packet to the CPU. , The destination port and protocol number are matched with the records in the discard entry, and the reason for discarding the discarded packets is analyzed by the CPU;

The recording module is further configured to: in response to the source IP, destination IP, source port, destination port and protocol number of the discarded packet not completely matching the record in the discard table entry, record the source IP, destination IP, The source port, the destination port, the protocol number and the discarding reason are recorded in the discarding table entry.

In a preferred embodiment of the present invention, the discard entry record includes source IP, destination IP, source port, destination port, protocol number, statistical value and discard reason information of the packet.

In a preferred embodiment of the present invention, it also includes a timing module, and the timing module is configured as:

In response to a certain record in the discard table entry that does not have the same feature for a threshold time and does not enter the switch, the record is deleted;

In response to dropped packets with the same characteristics entering the switch within the threshold time, the timer recalculates the time.

It should be particularly pointed out that the embodiments of the above system use the embodiments of the above method to specifically describe the working process of each module, and those skilled in the art can easily think of applying these modules to other embodiments of the above method.

In addition, the above-mentioned method steps and system units or modules can also be implemented by using a controller and a computer-readable storage medium for storing a computer program that enables the controller to implement the functions of the above-mentioned steps or units or modules.

Those skilled in the art will also appreciate that the various exemplary logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described generally in terms of their functionality. Whether such functionality is implemented as software or hardware depends on the specific application and design constraints imposed on the overall system. Those skilled in the art may implement the functions in various ways for each specific application, but such implementation decisions should not be interpreted as causing a departure from the scope of the disclosed embodiments of the present invention.

The above-described embodiments, particularly any "preferred" embodiments, are possible examples of implementations, and are presented merely for a clear understanding of the principles of the invention. Numerous changes and modifications may be made to the above-described embodiments without departing from the spirit and principles of the technology described herein. All modifications are intended to be included within the scope of this disclosure and protected by the appended claims.

Claims (10)

1. A method for detecting the discarded message of a switch is characterized by comprising the following steps:

establishing a discarding list item of the discarded message in the monitoring server;

responding to a discarded message entering a data center white box switch, and matching the characteristics of the first message with the records in the discarded table item;

and in response to the feature of the first packet matching the feature recorded in the discarded entry, increasing the count of the record in the discarded entry corresponding to the feature.

2. The method of claim 1, further comprising:

and recording the characteristics of the first message into the discarding table entry in response to the incomplete matching between the characteristics of the first message and the characteristics recorded in the discarding table entry.

3. The method of claim 2, wherein matching the characteristic of the first packet with the record in the drop table entry in response to the drop packet entering a data center white box switch comprises: sending a first message in discarded messages with the same characteristics to a CPU (central processing unit), matching a source IP (Internet protocol), a destination IP, a source port, a destination port and a protocol number of the discarded message with records in the discarded table entry, and analyzing the discarding reason of the discarded message through the CPU;

in response to the feature of the first packet not completely matching the feature recorded in the discard entry, recording the feature of the first packet in the discard entry comprises: and in response to that the source IP, the destination IP, the source port, the destination port and the protocol number of the discarded message are not completely matched with the record in the discarded table entry, recording the source IP, the destination IP, the source port, the destination port, the protocol number and the discarding reason into the discarded table entry.

4. The method of claim 1, wherein the discard entry record comprises a source IP, a destination IP, a source port, a destination port, a protocol number, statistics, and discard cause information of the packet.

5. The method of claim 1, further comprising:

in response to the fact that a certain record in the discarded table entry does not have the discarded message with the same characteristics for the threshold duration time, the record is deleted;

and responding to the discarded message with the same characteristics in the threshold time to enter the switch, and recalculating the time.

6. An apparatus for switch drop message detection, the apparatus comprising:

the system comprises an establishing module, a judging module and a sending module, wherein the establishing module is configured to establish a discarding table item of a discarded message in a monitoring server;

a matching module configured to match a feature of the first packet with a record in the discard entry in response to a discard packet entering a data center white box switch;

a counting module configured to increase a count of the records in the discard entry corresponding to the feature in response to the feature of the first packet matching the feature recorded in the discard entry.

7. The device of claim 6, further comprising a logging module configured to log the feature of the first packet into the discard entry in response to the feature of the first packet not completely matching the feature recorded in the discard entry.

8. The device of claim 7, wherein the matching module is further configured to upload a first message in the discarded messages with the same characteristics to a CPU, match a source IP, a destination IP, a source port, a destination port, and a protocol number of the discarded message with records in the discarded table entry, and analyze, by the CPU, a discard reason of the discarded message;

the recording module is further configured to record the source IP, the destination IP, the source port, the destination port, the protocol number, and the discard reason into the discard entry in response to the source IP, the destination IP, the source port, the destination port, and the protocol number of the discard packet not completely matching the record in the discard entry.

9. The apparatus of claim 6, wherein the discard entry record comprises a source IP, a destination IP, a source port, a destination port, a protocol number, statistics, and discard cause information of the packet.

10. The device of claim 6, further comprising a timing module configured to:

in response to the fact that a certain record in the discarded table entry does not have the discarded message with the same characteristics for the threshold duration time, the record is deleted;

and responding to the discarded message with the same characteristics in the threshold time to enter the switch, and recalculating the time.

Images