CN101471822A - Method and system for locating network fault - Google Patents

Abstract

The present invention relates to the communication field. The present invention provides a method for locating network faults. When using the traceroute program, dynamically adjust the protocol type and port number of the detection message, and send out the adjusted detection message for detection; according to the application of the traceroute program The detected connectivity in the network is judged to determine the location of the network fault. It also provides a system for locating network faults, including an information acquisition unit, a detection message sending unit, and a network fault locating unit. The invention provides a method for detecting and locating specific application network faults, which solves the problem that the original traceroute program uses a fixed The port number and protocol cannot detect and locate the fault point of a specific network and the application layer of the network.

Description

A method and system for locating network faults

technical field

The invention relates to the communication field, in particular to a method and system for locating network faults by using a traceroute program.

Background technique

With the rapid development of the Internet, the scale of the network is getting larger and larger. For a network administrator, maintaining such a large network will face many challenges. One of the challenges is that when the network fails and the business is interrupted. The first thing the network administrator needs to do is to quickly find the fault point. Only after the fault point is found can the cause of the fault be analyzed and located, and then the network can be restored quickly.

Network interruption can be summarized into three levels: one is link interruption, which mainly refers to the interruption of the physical connection in the network, for example, a certain optical fiber in the network is broken, a certain device is dead, etc.; the other is network layer interruption , that is, the physical connections in the network are all good, but the routing and other faults in the network cause the hosts in the network to be unable to send and receive peer messages; the third is the application layer interruption, that is, the hosts in the network It can still be connected, and the message can still be forwarded. For example, it can be pinged (a small program to detect network connectivity), but it can no longer play games online or video chat. For the first two kinds of interruptions, the faulty node can be located by the prior art described below, but for the third type of network service interruption, the prior art cannot locate the faulty node.

The traceroute program written by Van Jacobson is a program to obtain the network path between the source and destination hosts. It can send data to the destination host, such as a server, through the source host, such as a PC. package and test the gateway through which the data packet passes from the source host (PC) to the destination host (application server), to check whether the network connection is reachable, and to analyze where a fault occurs in the network. The execution process of applying traceroute is: the source host first sends an IP packet with a TTL (Time To Live) of 1 to the destination host, and when the first-hop routing device on the path receives this packet, the TTL is reduced by 1 , and check whether the TTL of this data packet is 0, if it is 0, then discard the data packet and send back an ICMP (Internet Control Message Protocol, Internet Control Message Protocol) error message to the source host, if it is not 0, then continue to forward this packet. Since the TTL of the data packet becomes 0 at this time, the first-hop routing device will discard the data packet and send back an ICMP (Internet Control Message Protocol, Internet Control Message Protocol) error message to indicate that the data packet is due to TTL timeout Instead of being sent, the ICMP error message is sent through an ICMP timeout error message. Afterwards, the source host resends an IP data packet with a TTL of 2, and after receiving the data packet, the second-hop routing device will return an ICMP error message indicating that the TTL has expired and cannot be sent. This process continues until the destination host is reached. The purpose of performing these processes is to record the source address of each ICMP timeout error message, so as to provide the path experienced by an IP data packet to reach the destination host. When the ICMP response message from the destination host is finally received, it means that the network from the source host to the destination host is connected, and according to the source address of the ICMP timeout error message recorded above, you can know which hosts have crossed between the source and destination hosts. gateway device. When a node or link in the network fails, each gateway device passing through from the source node to the failed node or link will respond with an ICMP timeout error message, and the failed node and subsequent devices will not There will be a response, which can determine the faulty node or link in the network.

However, in the existing network, in order to prevent attacks, many gateway devices are configured with the function of prohibiting ICMP detection packets, but generally do not prohibit the returned ICMP error packets. However, the traditional traceroute program detects a fixed packet type. In this way, it is often encountered that it is impossible to detect whether the network is reachable through the traditional traceroute program. Because it is impossible to know whether the node cannot pass the message because the detection message is prohibited or the node fails, so that the faulty node cannot be accurately found. When some network service interruptions occur, the network layer is connected, but the application layer cannot be connected. That is, the traditional traceroute program can reach the destination host, but applications such as games and videos cannot be used. In this case, the faulty node cannot be detected.

As an improvement of the traceroute program, there is another technique: the source host sends a UDP detection packet instead of an ICMP detection packet. The source port of the UDP (User Message Protocol) detection message uses any random high-end port greater than 32768, and the destination port starts from 33434 and increases sequentially every time a detection message is sent, and the TTL increases sequentially from 1 at the same time. The intermediate router finds that the TTL has expired and sends an ICMP timeout error message indicating that the datagram cannot be sent. When the final destination host receives the UDP detection packet sent by the source host, the destination host will parse the UDP detection packet and check whether the port required in the packet is being used. Since the port number of the UDP detection message is a high-end port number greater than 33434, ordinary applications usually do not use this type of high-end port number (port number greater than 30000), so the destination host will send an ICMP port unreachable Error message to the source host. However, in this technical solution, the port number is fixed by the program. If the network intermediate device prohibits these high-end port numbers, it will not work normally; in addition, the port number is generated by the program itself and is fixed, but different applications in actual applications The port numbers corresponding to different layers are different, so the traceroute program cannot be used to detect whether the application layer is connected.

Contents of the invention

Embodiments of the present invention provide a method and system for locating network faults, which can solve the problem that the traceroute program cannot be used to detect network connectivity and correctly locate network faults due to the configuration of certain ports and protocol filtering in network intermediate devices.

The method and system embodiments for locating network faults provided by the embodiments of the present invention are realized through the following technical solutions:

A method for locating network faults, comprising the steps of:

Obtain information about network connectivity;

If the network is unreachable, adjust the protocol type and/or port number of the detection message;

Send a detection message after adjusting the protocol type and/or port number;

Determine the location of the network fault according to the network connectivity detected by the detection packet after adjusting the protocol type and/or port number.

The embodiment of the present invention also provides a system for locating network faults using the traceroute program, including:

an information acquisition unit, configured to acquire information about network connectivity;

An information adjustment unit, configured to adjust the protocol type and/or port number of the detection message;

A detection message sending unit, configured to send a detection message after adjusting the protocol type and/or port number;

The network fault location unit judges and determines the location of the network fault according to the network connectivity detected by the detection message after adjusting the protocol type and/or port number.

The embodiment of the present invention provides a method and system for locating network faults. Due to the flexible adjustment of the protocol type and/or port number of the detection message, it solves the problems caused by the configuration of some excessively high port numbers and protocol filtering in the network intermediate equipment. Unable to detect network connectivity and correctly locate network faults.

Description of drawings

Fig. 1 is the implementation schematic diagram of the application of the traceroute program provided by Embodiment 1 of the present invention to traverse the firewall to detect the network connectivity;

Fig. 2 is the implementation schematic diagram of detecting application layer failure nodes by using the traceroute program provided by Embodiment 2 of the present invention;

Fig. 3 is the flow chart of the application traceroute program location network failure that the embodiment of the present invention provides;

FIG. 4 is a schematic structural diagram of a system for locating network faults using a traceroute program provided by an embodiment of the present invention.

Detailed ways

Embodiments of the present invention provide a method and system for locating network faults using the traceroute program, adjust the protocol type and/or port number of the detection message, and then issue the detection message after adjusting the protocol type and/or port number; according to the The location of the network fault is determined by adjusting the network connectivity detected by the detection packet after adjusting the protocol type and/or port number.

Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, so as to better understand the technical solution of the present invention.

Embodiment 1 provided by the present invention: refer to FIG. 1 , which is a schematic diagram of implementing a traceroute program to traverse a firewall to detect network connectivity.

In the prior art, the network connectivity can be detected through the existing traceroute program, and the network topology can be understood. However, when there is a firewall in the network, the firewall may prohibit the protocol type and port number used by the existing traceroute program, such as ICMP, UDP port with a port number greater than 30000, etc. At this time, the corresponding traceroute program cannot be used. detected. Figure 1 is a schematic diagram of a small network application. The network between the terminal PC 10 (source host) and the application server 14 (destination host) spans two routers (router 11 and router 13) and a firewall device 12, and the firewall device 12 prohibits the ICMP protocol and the port number is greater than 30000 UDP packets, while other port numbers and protocols are generally not prohibited, such as ICMP error packets. The IP address of each network device interface is described in FIG. 1 . The above figure is the flow of the application of the improved traceroute program provided by the embodiment of the present invention to traverse the firewall to detect the network connectivity. When using the traceroute program, adjust the protocol type and port number of the detection message for detection, and solve the problem that the fixed protocol and port number used are prohibited by the firewall and cannot successfully locate network faults. The specific process is described as follows:

Step 101, PC10 sends out the first UDP detection message and specifies the destination address of the first UDP detection message as 4.4.4.2, the port number as 12345, and the TTL as 1.

Step 102, router 11 receives the first UDP detection message, finds that the destination address is not itself, and TTL is 1, so the ICMP error message of constructing TTL overtime is sent to PC 10. The source address of this ICMP error message is the interface address of router 11, and the destination address is the address of PC 10.

Step 103, PC 10 After receiving the ICMP error message returned by router 11, record the source address of the message, i.e. the interface address of router 11, thus knowing that the first hop address from PC 10 to the application server 14 network is 1.1.1.2.

Step 104, PC 10 sends a second UDP detection message, and specifies that the destination address of the second UDP detection message is 4.4.4.2, the port number is 12345, and the TTL is 2.

Step 105, the router 11 receives the second UDP detection message, finds that the destination address is not itself, and the TTL is 2, so it forwards the second UDP detection message after decrementing the TTL by 1.

Step 106, firewall 12 receives this second UDP detection message, finds that the destination address is not oneself, and TTL is 1, so the ICMP error message of constructing TTL overtime is sent to PC 10. The source address of this ICMP error message is the interface address of firewall 12, and the destination address is the address of PC 10. Router 11 forwards the ICMP error message to PC 10.

Step 107, after PC 10 receives the ICMP error message that firewall 12 returns, record the source address of this message, i.e. the interface address of firewall 12, thus know that the second hop address from PC 10 to application server 14 network is 2.2.2.2.

Step 108, PC 10 sends a third UDP detection message, and specifies that the destination address of the third UDP detection message is 4.4.4.2, the port number is 12345, and the TTL is 3. Since the protocol type and port number of the detection message can be dynamically adjusted, according to the forbidden range set by the firewall 12, the protocol type and port number of the detection message can be specified outside the forbidden range of the firewall 12. As mentioned above, neither the protocol type nor the port number of the third UDP detection message is within the prohibition range of the firewall 12 , so the third UDP detection message will pass through the firewall 12 smoothly. Processed in the foregoing manner, PC 10 will receive the ICMP error message returned by router 13, and thus know the third hop address in the network, that is, the interface address of router 13 is 3.3.3.2.

Step 109, in the above manner, the PC 10 sends the fourth UDP detection message, after being forwarded by the router 11, the router 13 and the firewall 12, the application server 14 receives the fourth UDP detection message. The application server 14 finds that the destination address of the detection message is itself, and then sends it to the application layer for processing. If there is an application with a UDP port number of 12345, the application server 14 accepts the UDP detection message and will not send an ICMP error message.

Step 110 , if there is no application with the UDP port number 12345, the application server 14 sends an ICMP error message stating that the port is unreachable to the PC 10 . If PC 10 receives the ICMP error message that the port sent by application server 14 is unreachable, it knows that the fourth UDP detection message has been forwarded from PC 10 to port 14 of application server, so it can be known that PC 10 reaches the application server The network path at terminal 14 will pass through several network devices with IP addresses 1.1.1.2, 2.2.2.2, 3.3.3.2, and 4.4.4.2 in sequence.

After the above steps are completed, if PC 10 does not receive a response after sending the fourth UDP detection message, after waiting for a period of time, send the fifth UDP detection message, the detection message and the fourth UDP detection message Similar, just change the UDP port number to another relatively large value, such as 29999. If an ICMP port unreachable error message is received after the detection message is sent, the network connectivity has been detected. If there is still no response after waiting for a period of time, then PC10 uses the traceroute program to change another port number to send the UDP detection message. If do not receive ICMP port unreachable error message all the time, then PC 10 changes port number and continues to send detection message, until stopping application traceroute program. From this, the connectivity of the network can be judged.

Embodiment 2 provided by the present invention: refer to FIG. 2 , which is an implementation principle diagram of detecting faulty nodes in the application layer by using the traceroute program.

The network connectivity can be detected through the traceroute program in the prior art, and the fault nodes of the network can be located. However, when there is a firewall in the network, the firewall may prohibit some application port numbers and protocol types. At this time, the traceroute program in the prior art detects that the network is connected, but the user service obtains a specific service, that is to say, the application layer of the network may not be connected.

Fig. 2 is another embodiment that the present invention is applied in small-scale network, and the network between terminal PC10 and application server 14 has crossed two routers (router 11 and router 13) and a firewall 12, and firewall 12 has prohibited UDP port For the application numbered 12345, the interface IP address of each network device is as described in Figure 2. Through the method for locating network faults provided by the embodiments of the present invention, application layer faults are detected and located, and the specific process is described as follows:

Step 201, PC 10 sends the first UDP detection message, and designates the destination address of the first UDP detection message as 4.4.4.2, the port number as 12345, and the TTL as 1.

Step 202, router 11 receives the first UDP detection message, finds that the destination address is not itself, and TTL is 1, so the ICMP error message of constructing TTL overtime is sent to PC 10. The source address of this ICMP error message is the interface address of router 11, and the destination address is the address of PC 10.

Step 203, after the PC 10 end receives the ICMP error message returned by the router 11, record the source address of the message, i.e. the interface address of the router 11, thus knowing the first hop from the PC 10 end to the application server 14 network The address is 1.1.1.2.

Step 204, PC 10 sends out a second UDP detection message, and specifies that the destination address of the second UDP detection message is 4.4.4.2, the port number is 12345, and the TTL is 2.

Step 205, the router 11 receives the second UDP detection message, finds that the destination address is not itself, and the TTL is 2, so it forwards the second UDP detection message after decrementing the TTL by 1.

Step 206, when the firewall 12 receives the second UDP detection message, different firewalls 12 may perform different processing, which will be divided into three cases, Situation 1, Situation 2.1, and Situation 2.2.

For situation 1, firewall 12 finds that the application layer port number of the corresponding network (port number less than 30000 after adjustment) is prohibited, and sends an ICMP error message that a destination host is prohibited, and PC 10 receives this ICMP error message After that, it is known that the application layer failure node is the firewall 12 at the IP address of 2.2.2.2;

For situation 2.1, the firewall 12 finds that the destination address is not itself, and the TTL is 1, so it constructs an ICMP error message whose TTL has expired and sends it to the PC. The PC adds 1 to the TTL and sends the third UDP detection packet. After the firewall 12 receives the detection message, it finds that the corresponding application layer port number (port number less than 30000 after adjustment) is prohibited, and sends an ICMP error message that the destination host is prohibited, and the PC 10 receives the ICMP error message After the message, it is known that the faulty node is 2.2.2.2 firewall 12 at the IP address;

For situation 2.2, after the firewall 12 receives the third UDP detection message sent by the PC, it finds that the corresponding application layer port number (port number less than 30000 after adjustment) is prohibited, so it directly discards the detection message , do not send the ICMP error message; PC 10 waits for a period of time, after changing the UDP port number to 10000, sends the fourth UDP detection message. Now router 13 can reply the ICMP error message of a TTL overtime, after PC 10 end receives this error message, it can be judged that the previous node of router 13, that is, firewall 12 is a failure node.

The first embodiment of the present invention and the second embodiment of the present invention can make according to the traceroute program instruction, the UDP detection message sent by the PC 10 smoothly traverse the network with the firewall through the detection message protocol type and port number adjusted during the application of the traceroute program, and The network connectivity of the specified application layer can be detected. The embodiment of the present invention can also expand the type of the detection message sent by the traceroute program, including UDP, TCP (without existing automatic sending), etc., according to the protocol type and port number information of the adjusted specific detection message, detect network Points of failure at the network layer and the application layer of the network. Embodiments 1 and 2 take the UDP application as an example, and describe the basic implementation principle of using an optimized traceroute program to detect application layer network connectivity and locate application layer network faults.

Fig. 3 is a flow chart of a general method for locating network faults using the traceroute program provided by an embodiment of the present invention. With reference to this figure, steps are included:

30. Knowing the failure to use a certain network;

31. First use the PING command to detect the connection between the network and the application server;

32. Determine whether the PING is successful;

33. If the PING fails, it may be that the network layer cannot be connected, or the application server may be faulty; if the PING is successful, it means that the network layer is connected and the application server is running normally;

34. Use the traditional traceroute program to automatically detect the connection between the PC and the application server;

35. Detect whether the network is connected;

36. Judging the connectivity of the network according to the route track of the automatically detected detection message;

37. Since there may be devices such as firewalls and gateways in the network, according to the embodiment of the present invention, a method for locating network faults is provided using the traceroute program, adjusting the protocol type and port number, sending a detection message, and detecting the connectivity of the network;

38. Combining the track of the route of the detected message with the automatic detection and the track of the route of the detected message after adjusting the protocol type and port number to locate the location of the network fault.

If the traceroute program is used to connect successfully after adjusting the protocol type and port number, it means that the network layer is normal, and the application layer may be faulty;

If the connection with the traceroute program is unsuccessful after adjusting the protocol type and port number, determine the faulty node according to the connection with the traceroute program after adjusting the protocol type and port number, and the network connection automatically detected by the traditional traceroute program . That is, the node behind the last reachable node in the detection message after adjusting the protocol type and port number is the faulty node.

The embodiment of the present invention also provides a system for locating network faults using the traceroute program. Referring to FIG. 4, the system includes:

An information acquisition unit 41, configured to acquire information about network connectivity;

An information adjustment unit 42, configured to adjust the protocol type and port number of the detection message;

The detection message sending unit 43 sends out the detection message after adjusting the protocol type and the port number of the message;

The network fault location unit 44 judges and determines the location of the network fault according to the connectivity of the detection message in the network.

In order to better realize the purpose of the invention, the system information acquisition unit 41 for locating network faults is used to automatically detect the connection status of the network to the application server. If the automatic detection is unsuccessful, the network layer is blocked; if the automatic detection is successful, the network layer is connected. is connected.

In the network fault locating unit 44 of the system for locating network faults provided in the embodiments of the present invention, if the detection message after the application of the adjusted protocol type and port number is successfully connected, the network layer is normal and the application layer is faulty;

When the traceroute program is used in all the above-mentioned embodiments of the present invention, the protocol type of the adjusted detection message can be UDP, ICMP or TCP or any other protocol type, and it can be adjusted to different protocol types and port numbers according to different applications.

The method and system for locating network faults provided by the embodiments of the present invention have been introduced in detail above. For those of ordinary skill in the art, based on the idea of the embodiments of the present invention, there will be specific implementation methods and application scopes. Changes, in summary, the content of the embodiments of this specification should not be construed as limiting the present invention.

Claims (6)

1. A method for locating network faults, characterized in that, Obtain information about network connectivity; If the network is unreachable, adjust the protocol type and/or port number of the detection message; Send a detection message after adjusting the protocol type and/or port number; Determine the location of the network fault according to the network connectivity detected by the detection packet after adjusting the protocol type and/or port number. 2. The method for locating network faults according to claim 1, wherein said obtaining information about network connectivity specifically includes: Automatically detect the connection status from the network to the application server. If the automatic detection is unsuccessful, the network is disconnected; if the automatic detection is successful, the network connection is connected. 3. The method for locating network faults according to claim 2, characterized in that: According to the network connectivity detected by the detection message after adjusting the protocol type and/or port number, the determination of the location of the network fault specifically includes: if the detection message after adjusting the protocol type and/or port number is applied If the document detects that the network connection is successful, it is judged that the network layer is normal and the application layer is faulty; If the application of the detection message after adjusting the protocol type and/or port number detects that the network connection is unsuccessful, the location of the network failure is determined in combination with the result of the automatic detection. 4. A system for locating network faults, characterized in that it includes an information acquisition unit, configured to acquire information about network connectivity; An information adjustment unit, configured to adjust the protocol type and/or port number of the detection message; A detection message sending unit, configured to send a detection message after adjusting the protocol type and/or port number; The network fault location unit judges and determines the location of the network fault according to the network connectivity detected by the detection message after adjusting the protocol type and/or port number. 5. The system for locating network faults according to claim 4, wherein the information acquisition unit is used to automatically detect the connection status from the network to the application server, if the automatic detection is unsuccessful, the network layer is unavailable; if the automatic detection If successful, the network layer connection is connected. 6. The system for locating network faults using traceroute program according to claim 5, characterized in that: In the network fault locating unit, if the detection message after adjusting the protocol type and/or port number is successfully connected, the network layer is normal and the application layer is faulty; If the connection of the detection message after the application adjusts the protocol type and/or port number is not successful, the position of the faulty node is determined in combination with the result of the automatic detection described by the application.

Images