CN106209456B - A kind of kernel state lower network fault detection method and device - Google Patents
A kind of kernel state lower network fault detection method and device Download PDFInfo
- Publication number
- CN106209456B CN106209456B CN201610551725.9A CN201610551725A CN106209456B CN 106209456 B CN106209456 B CN 106209456B CN 201610551725 A CN201610551725 A CN 201610551725A CN 106209456 B CN106209456 B CN 106209456B
- Authority
- CN
- China
- Prior art keywords
- event
- failure
- message
- error message
- error
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 16
- 238000005538 encapsulation Methods 0.000 claims abstract description 22
- 238000000034 method Methods 0.000 claims abstract description 16
- 230000005540 biological transmission Effects 0.000 claims abstract description 11
- 238000012544 monitoring process Methods 0.000 claims description 3
- 230000006870 function Effects 0.000 description 35
- 230000004048 modification Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000006872 improvement Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000007257 malfunction Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 238000010791 quenching Methods 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a kind of kernel state lower network fault detection method and devices.Method includes the following steps: according to error message, generating event of failure, error message is the error message in transmission of data packets there are when error message in detecting failure collection function by protocol layer events collection module；Event of failure is packaged by event sending module, and the event of failure after encapsulation is added in event of failure list；Event of failure list is monitored by event receiving module, and the event of failure in event of failure list is parsed, fault details are obtained, fault message is exported to system user, carries fault details in fault message.It using technical solution provided by the embodiment of the present invention, realizes data packet loading error occurring under kernel state and detects automatically, facilitate the timely awareness network error details of system user.
Description
Technical field
The present invention relates to operation system technology fields, more particularly to a kind of kernel state lower network fault detection method and dress
It sets.
Background technique
In the information age, network shows very important effect.Either personal host still in the server,
The availability and reliability of network all directly affect system performance, determine the quality communicated between host.
When network failure occurs in computer system, user would generally detect network by external network-management tool
Problem, common network-management tool, such as ping, netstat, ip are the angles from User space to network problem
It is detected, needing user to be familiar with corresponding network-management tool just can be carried out the detection of network problem, and it is more passive to operate, no
Facilitate the timely awareness network error details of user.
Summary of the invention
In order to solve the above technical problems, the present invention provides a kind of kernel state lower network fault detection method and device.
A kind of kernel state lower network fault detection method, comprising:
Detecting that failure collects in function there are when error message, according to the difference by protocol layer events collection module
Text is misrepresented deliberately, event of failure is generated, the error message is the error message in transmission of data packets；
The event of failure is packaged by event sending module, and the event of failure after encapsulation is added to failure
In list of thing；
The event of failure list is monitored by event receiving module, and to the event of failure in the event of failure list
It is parsed, obtains fault details, exported fault message to system user, carry the fault details in the fault message.
It is described according to the error message in a kind of specific embodiment of the invention, generate event of failure, comprising:
The error message is parsed using error handle function；
According to the header information of the error message, event of failure is generated.
In a kind of specific embodiment of the invention, the event of failure by after encapsulation is added to event of failure list
In, comprising:
It calls registered event to send function the event of failure after encapsulation is added in event of failure list, the thing
It is that event receiving module registration is called for the event sending module that part, which sends function,.
In a kind of specific embodiment of the invention, in the event of failure comprising event of failure chain table pointer information,
The severity letter of IP version information, type of message information, type of message subcode information, error code information and error message
Breath.
A kind of kernel state lower network fault detection means, comprising:
Protocol layer events collection module, for detecting that failure collects in function there are when error message, according to described
Error message, generates event of failure, and the error message is the error message in transmission of data packets；
Event sending module is added to event for being packaged to the event of failure, and by the event of failure after encapsulation
Hinder in list of thing；
Event receiving module, for monitoring the event of failure list, and to the failure thing in the event of failure list
Part is parsed, and fault details are obtained, and exports fault message to system user, it is detailed to carry the failure in the fault message
Feelings.
In a kind of specific embodiment of the invention, the protocol layer events collection module is specifically used for:
The error message is parsed using error handle function；
According to the header information of the error message, event of failure is generated.
In a kind of specific embodiment of the invention, the event sending module is specifically used for:
It calls registered event to send function the event of failure after encapsulation is added in event of failure list, the thing
It is that event receiving module registration is called for the event sending module that part, which sends function,.
In a kind of specific embodiment of the invention, in the event of failure comprising event of failure chain table pointer information,
The severity letter of IP version information, type of message information, type of message subcode information, error code information and error message
Breath.
Using technical solution provided by the embodiment of the present invention, failure can detecte by protocol layer events collection module and receive
It whether there is error message in set function, when there are error message, can generate event of failure according to error message, pass through
Event sending module can be packaged event of failure, and the event of failure after encapsulation is added in event of failure list,
Event of failure list can be monitored by event receiving module, and the event of failure listened to is parsed, it is detailed to obtain failure
Feelings export fault message to system user.Data packet loading error occurring under kernel state is realized to detect automatically, facilitate system user and
When awareness network malfunction details.
Detailed description of the invention
It, below will be to embodiment or existing for the clearer technical solution for illustrating the embodiment of the present invention or the prior art
Attached drawing needed in technical description is briefly described, it should be apparent that, the accompanying drawings in the following description is only this hair
Bright some embodiments for those of ordinary skill in the art without creative efforts, can be with root
Other attached drawings are obtained according to these attached drawings.
Fig. 1 is a kind of implementation flow chart of kernel state lower network fault detection method in the embodiment of the present invention；
Fig. 2 is a kind of structural schematic diagram of kernel state lower network fault detection means in the embodiment of the present invention.
Specific embodiment
In order to enable those skilled in the art to better understand the solution of the present invention, with reference to the accompanying drawings and detailed description
The present invention is described in further detail.Obviously, described embodiments are only a part of the embodiments of the present invention, rather than
Whole embodiments.Based on the embodiments of the present invention, those of ordinary skill in the art are not making creative work premise
Under every other embodiment obtained, shall fall within the protection scope of the present invention.
It is shown in Figure 1, it is a kind of implementation of kernel state lower network fault detection method provided by the embodiment of the present invention
Flow chart, this method may comprise steps of:
S110: detecting that failure collects in function there are when error message by protocol layer events collection module, according to
Error message generates event of failure.
Error message is the error message in transmission of data packets.
In embodiments of the present invention, can be by modifying error handle function err_handler, modification Linux is original interior
The error handling method of each agreement in core protocol layer.Specifically, can add failure in error handle function collects function, it is allowed to
With failure collecting function.
In transmission of data packets, if encountered problems, by the error handle of invocation protocol structure net_protocol
Function err_handler, collecting in function in the failure of error handle function can recorde error message, which is
Error message in transmission of data packets.
It can detecte failure by protocol layer events collection module to collect with the presence or absence of error message in function, if deposited
, then protocol layer events collection module can according to the error message, generate event of failure.
In a kind of specific embodiment of the invention, according to error message, the step of generating event of failure, specifically can be with
The following steps are included:
Step 1: error message is parsed using error handle function；
Step 2: according to the header information of error message, event of failure is generated.
It is illustrated for ease of description, above-mentioned two step is combined.
In practical applications, when protocol layer events collection module detects that failure is collected in function there are when error message,
Its member's error handle function err_ can be utilized based on structural body struct net_protocol in kernel code
Handler parses error message, i.e., analyzes error message data packet, obtains the head letter of the error message
Breath.According to the header information of error message, event of failure can be generated.
It in embodiments of the present invention, include event of failure chain table pointer information, IP version information, message in event of failure
Type information, type of message subcode information, the severity information of error code information and error message.
Event of failure structural body is defined as follows:
In the event of failure structural body, list is event of failure chain table pointer；Ipv represents IP version number；Type is report
Literary type, wherein in ipv4, ICMP_TIME_EXCEEDED, ICMP_SOURCE_QUENCH, ICMP_
PARAMETERPROB, ICMP_DEST_UNREACH are error message, in ipv6, ICMPV6_DEST_UNREACH,
ICMPV6_PKT_TOOBIG, ICMPV6_TIME_EXCEED, ICMPV6_PARAMPROB are error message；Code is message class
Type subcode may further determine that type of error by the information；Err is error code, the mistake of different types of error message
Code is different, illustrates fault type difference；The severity of harderr expression error message, if can repair.
Protocol layer events collection module parses error message, after the header information for obtaining error message, Ke Yigen
According to the header information of the error message, assignment is carried out to the member in event of failure structural body protocol_evt, generates failure
Event.For example, err_handler is assigned _ _ udp4_lib_err () in UDP, add in () in _ _ udp4_lib_err
Add respective code, the assignment to member each in protocol_evt may be implemented.
After generating event of failure by protocol layer events collection module, the operation of step S120 can be continued to execute.
S120: being packaged event of failure by event sending module, and the event of failure after encapsulation is added to event
Hinder in list of thing.
In step S110, after generating event of failure by protocol layer events collection module, can further be sent out by event
It send module to be packaged event of failure, and the event of failure after encapsulation is added in event of failure list.
In a kind of specific embodiment of the invention, the event of failure after encapsulation is added in event of failure list
Step can specifically include following steps:
It calls registered event to send function the event of failure after encapsulation is added in event of failure list, event hair
Sending function is that the registration of event receiving module is called for event sending module.
Event sending module calls registered event transmission function that the event of failure after encapsulation is added to event of failure
In list, event receiving module can monitor the event of failure list.
For example, event sends function protocol_post_error and can be expressed as follows:
In above-mentioned code, protocol_evt_post is specific transmission function, is realized by external module.In reality
In, above-mentioned code can be loaded onto Core Operational with kpatch dynamic patch mechanism.
External module realize send event of failure function, in the form of ko module load work, specifically can with reference to
Lower code:
S130: by event receiving module monitor event of failure list, and to the event of failure in event of failure list into
Row parsing, obtains fault details, exports fault message to system user, carries fault details in fault message.
In step S110 and step S120, event of failure can be generated by protocol layer events collection module, pass through thing
Part sending module can be packaged event of failure, and the event of failure after encapsulation is added in event of failure list.
In embodiments of the present invention, event of failure list can be monitored by event receiving module.When listening to failure thing
There are when event of failure in part list, event of failure can be parsed, obtain fault details, and by fault message export to
System user carries fault details in fault message.
For example, the specific work process of event receiving module can refer to following code:
Wherein, structural body protocol_evt_u is the event structure under User space, and errmsg_parse () can basis
The member value of event of failure parses fault details, exports fault message.
In embodiments of the present invention, it in the way of kpatch runtime kernel patching, modifies in the original core protocol layer of Linux
The error handling method of each agreement adds failure and collects function, realizes the detection of data packet loading error occurring.
Using method provided by the embodiment of the present invention, failure can detecte by protocol layer events collection module and collect letter
It whether there is error message in number, when there are error message, can generate event of failure according to error message, pass through event
Sending module can be packaged event of failure, and the event of failure after encapsulation is added in event of failure list, pass through
Event receiving module can monitor event of failure list, and parse to the event of failure listened to, obtain fault details, to
System user exports fault message.It realizes data packet loading error occurring under kernel state to detect automatically, facilitates system user timely
Solve network error details.
Corresponding to above method embodiment, the present invention also provides a kind of kernel state lower network fault detection means.
Shown in Figure 2, the apparatus may include with lower module:
Protocol layer events collection module 210, for detecting that failure collects in function there are when error message, according to difference
Text is misrepresented deliberately, event of failure is generated, error message is the error message in transmission of data packets；
Event sending module 220 is added to failure for being packaged to event of failure, and by the event of failure after encapsulation
In list of thing；
Event receiving module 230 is carried out for monitoring event of failure list, and to the event of failure in event of failure list
Parsing obtains fault details, exports fault message to system user, carries fault details in fault message.
Using device provided by the embodiment of the present invention, failure can detecte by protocol layer events collection module and collect letter
It whether there is error message in number, when there are error message, can generate event of failure according to error message, pass through event
Sending module can be packaged event of failure, and the event of failure after encapsulation is added in event of failure list, pass through
Event receiving module can monitor event of failure list, and parse to the event of failure listened to, obtain fault details, to
System user exports fault message.It realizes data packet loading error occurring under kernel state to detect automatically, facilitates system user timely
Solve network error details.
In a kind of specific embodiment of the invention, protocol layer events collection module 210 is specifically used for:
Error message is parsed using error handle function；
According to the header information of error message, event of failure is generated.
In a kind of specific embodiment of the invention, event sending module 220 is specifically used for:
It calls registered event to send function the event of failure after encapsulation is added in event of failure list, event hair
Sending function is that the registration of event receiving module 230 is called for event sending module 220.
It include event of failure chain table pointer information, IP editions in event of failure in a kind of specific embodiment of the invention
This number information, type of message information, type of message subcode information, the severity information of error code information and error message.
Each embodiment in this specification is described in a progressive manner, the highlights of each of the examples are with it is other
The difference of embodiment, same or similar part may refer to each other between each embodiment.For being filled disclosed in embodiment
For setting, since it is corresponded to the methods disclosed in the examples, so being described relatively simple, related place is referring to method part
Explanation.
Professional further appreciates that, unit described in conjunction with the examples disclosed in the embodiments of the present disclosure
And algorithm steps, can be realized with electronic hardware, computer software, or a combination of the two, in order to clearly demonstrate hardware and
The interchangeability of software generally describes each exemplary composition and step according to function in the above description.These
Function is implemented in hardware or software actually, the specific application and design constraint depending on technical solution.Profession
Technical staff can use different methods to achieve the described function each specific application, but this realization is not answered
Think beyond the scope of this invention.
The step of method described in conjunction with the examples disclosed in this document or algorithm, can directly be held with hardware, processor
The combination of capable software module or the two is implemented.Software module can be placed in random access memory (RAM), memory, read-only deposit
Reservoir (ROM), electrically programmable ROM, electrically erasable ROM, register, hard disk, moveable magnetic disc, CD-ROM or technology
In any other form of storage medium well known in field.
A kind of kernel state lower network fault detection method provided by the present invention and device are described in detail above.
Used herein a specific example illustrates the principle and implementation of the invention, and the explanation of above embodiments is only used
In facilitating the understanding of the method and its core concept of the invention.It should be pointed out that for those skilled in the art,
Without departing from the principle of the present invention, can be with several improvements and modifications are made to the present invention, these improvement and modification
It falls into the protection scope of the claims in the present invention.
Claims (8)
1. a kind of kernel state lower network fault detection method characterized by comprising
Detecting that failure collects in function there are when error message, according to the mistake report by protocol layer events collection module
Text, generates event of failure, and the error message is the error message in transmission of data packets；
The event of failure is packaged by event sending module, and the event of failure after encapsulation is added to event of failure
In list；
The event of failure list is monitored by event receiving module, and the event of failure in the event of failure list is carried out
Parsing obtains fault details, exports fault message to system user, carries the fault details in the fault message.
2. being wrapped the method according to claim 1, wherein described generate event of failure according to the error message
It includes:
The error message is parsed using error handle function；
According to the header information of the error message, event of failure is generated.
3. method according to claim 1 or 2, which is characterized in that the event of failure by after encapsulation is added to failure
In list of thing, comprising:
It calls registered event to send function the event of failure after encapsulation is added in event of failure list, the event hair
Sending function is that event receiving module registration is called for the event sending module.
4. according to the method described in claim 3, it is characterized in that, believing in the event of failure comprising event of failure chain table pointer
Breath, IP version information, type of message information, type of message subcode information, the severity of error code information and error message
Information.
5. a kind of kernel state lower network fault detection means characterized by comprising
Protocol layer events collection module, for detecting that failure collects in function there are when error message, according to the mistake
Message, generates event of failure, and the error message is the error message in transmission of data packets；
Event of failure after encapsulation for being packaged to the event of failure, and is added to failure thing by event sending module
In part list；
Event receiving module, for monitoring the event of failure list, and to the event of failure in the event of failure list into
Row parsing, obtains fault details, exports fault message to system user, carries the fault details in the fault message.
6. device according to claim 5, which is characterized in that the protocol layer events collection module is specifically used for:
The error message is parsed using error handle function；
According to the header information of the error message, event of failure is generated.
7. device according to claim 5 or 6, which is characterized in that the event sending module is specifically used for:
It calls registered event to send function the event of failure after encapsulation is added in event of failure list, the event hair
Sending function is that event receiving module registration is called for the event sending module.
8. device according to claim 7, which is characterized in that believe in the event of failure comprising event of failure chain table pointer
Breath, IP version information, type of message information, type of message subcode information, the severity of error code information and error message
Information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610551725.9A CN106209456B (en) | 2016-07-13 | 2016-07-13 | A kind of kernel state lower network fault detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610551725.9A CN106209456B (en) | 2016-07-13 | 2016-07-13 | A kind of kernel state lower network fault detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106209456A CN106209456A (en) | 2016-12-07 |
| CN106209456B true CN106209456B (en) | 2019-08-02 |
Family
ID=57477543
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610551725.9A Active CN106209456B (en) | 2016-07-13 | 2016-07-13 | A kind of kernel state lower network fault detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106209456B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483287B (en) * | 2017-08-17 | 2021-07-20 | 郑州云海信息技术有限公司 | System and method for automatically monitoring network port data packet receiving and sending faults |
| CN107766167A (en) * | 2017-10-23 | 2018-03-06 | 郑州云海信息技术有限公司 | A kind of fault log repeats to report an error the method for merger |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103001811A (en) * | 2012-12-31 | 2013-03-27 | 北京启明星辰信息技术股份有限公司 | Method and device for fault locating |
| CN104993584A (en) * | 2015-06-03 | 2015-10-21 | 广西电网有限责任公司 | Information preserving failure generating method and system |
-
2016
- 2016-07-13 CN CN201610551725.9A patent/CN106209456B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103001811A (en) * | 2012-12-31 | 2013-03-27 | 北京启明星辰信息技术股份有限公司 | Method and device for fault locating |
| CN104993584A (en) * | 2015-06-03 | 2015-10-21 | 广西电网有限责任公司 | Information preserving failure generating method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106209456A (en) | 2016-12-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7643431B2 (en) | Distributed packet group identification for network testing | |
| US7523198B2 (en) | Integrated testing approach for publish/subscribe network systems | |
| EP2810412B1 (en) | Systems and methods for extracting structured application data from a communications link | |
| EP3140960B1 (en) | Methods, systems, and computer readable media for providing fuzz testing functionality | |
| US9699059B2 (en) | Dedicated network interface | |
| CN102098227B (en) | Packet capture method and kernel module | |
| CN108718347A (en) | A kind of domain name analytic method, system, device and storage medium | |
| US7515585B2 (en) | Data communication optimization | |
| CN106209456B (en) | A kind of kernel state lower network fault detection method and device | |
| Gad et al. | Employing the CEP paradigm for network analysis and surveillance | |
| CN109981377B (en) | Distributed data center link monitoring method and system | |
| CN108809677A (en) | The system of testing characteristics of network | |
| US8966321B2 (en) | Logical port and layer protocol test configuration resource manager | |
| CN109471763A (en) | Grab method, apparatus, equipment and the system of NVME hard disk trace | |
| Wallschläger et al. | Automated anomaly detection in virtualized services using deep packet inspection | |
| Enger et al. | FYI on a network management tool catalog: Tools for monitoring and debugging TCP/IP Internets and interconnected devices | |
| US8725901B2 (en) | Analysis tool for intra-node application messaging | |
| CN114461350A (en) | Method and device for testing availability of container | |
| CN114205218A (en) | Method and system for diagnosing container network fault | |
| WO2011135181A1 (en) | Method and arrangement for message analysis | |
| CN111211926B (en) | Communication fault monitoring method and device, storage medium and equipment | |
| EP2028821A1 (en) | Dedicated network interface | |
| Krejčí | Network Traffic Collection with IPFIX Protocol | |
| Pennefather et al. | An exploration of geolocation and traffic visualisation using network flows | |
| CN116980333A (en) | Network detection method and system based on data development plane suite |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |