Background technology
At present, though main process equipments such as various multibusiness exchanger, Trunk Media Gateway are supported maintenance modes such as webmaster and Remote client, aspect the trace analysis of arrowband signaling, the main process equipment inter-process is relatively weaker.Main cause: the one, main process equipment is not sent to maintenance terminal by the connection of a special use with signaling tracing information, but by the general way of output, for example serial ports, virtual terminal etc., finally on screen, signaling tracing information is shown, but the signaling tracing information that obtains like this is entrained in other useless output informations; The 2nd, main process equipment itself is subjected to the restriction of disposal ability performance and two aspects of output module flow, can not in real time signaling tracing information all be translated as the text mode that can read and show, can only on maintenance terminal, show the synopsis and the 16 system byte code streams of some signaling tracing information.For above-mentioned reasons, the attendant can't intuitively handle and read signaling tracing information, let alone utilizes signaling tracing information that problem is positioned.
Signaling Analyzer mostly is a separate equipment entity greatly at present, lays particular emphasis on hardware device, simultaneously the function of support software statistics.Its implementation is: use the E1 interface that instrument is parallel on the transmission equipment of switch, adopt independently that the signaling tracing form carries out information gathering, then signaling tracing information is made an explanation.Independently the signaling tracing form is meant that Signaling Analyzer shows that the form of signaling tracing information fixes.The signaling tracing information that Signaling Analyzer collects is binary code stream.Signaling Analyzer can be analyzed the signaling tracing information of multiple form, for example, Q.931, Q.921, the signaling of V5.1/V5.2, forwards partial data link layer (MTP2), forwards subnetwork layer (MTP3), Telephone User Part (TUP)/integrated services network User Part (ISUP)/SCCP (SCCP)/TCAP Transaction Capability Application Part (TCAP)/MAP protocol formats such as (MAP).
Before the tracking signaling, choose the signaling type that needs tracking on Signaling Analyzer, next Signaling Analyzer only carries out information gathering to the signaling that belongs to this signaling type, then its binary code stream is analyzed.For example selected Signaling System Number 7, the signaling tracing information that Signaling Analyzer collects all belongs to Signaling System Number 7, then the Signaling System Number 7 binary code stream is analyzed.
The signaling tracing information filtering function that Signaling Analyzer is supported is simple, only support that pressing protocol hierarchy filters signaling tracing information, for example Signaling Analyzer can be classified according to communicating between data link layer and network layer, and the signaling tracing information of this class is filtered.Because Signaling Analyzer is only supported the floppy disk storage, so the analysis result of signaling tracing information can not dump on other computers easily, for example, model is that the floppy disk storage is used in the Signaling Analyzer support of PT500, but owing to be subjected to the restriction of capacity and form, can't preserve complete signaling tracing information analysis result on other computer, be unfavorable for signaling is managed.In addition, Signaling Analyzer costs an arm and a leg, easily hundreds of thousands even RMB up to a million; And Signaling Analyzer is bulky, complicated operation, and operating personnel must pass through special training, could the operation and maintenance Signaling Analyzer.
Summary of the invention
In view of this, the object of the present invention is to provide a kind of method of analyzing signaling, make and analyze signaling simple and flexible more.
In order to achieve the above object, the invention provides a kind of method of analyzing signaling, it is characterized in that the method includes the steps of:
A, read the signaling message code stream, described signaling message code stream is to catch and tracking signaling obtains from maintenance terminal;
B, encode according to signaling message sender coding and signaling message recipient and to determine signaling type under the signaling message;
The signaling protocol form of the corresponding signaling type that C, basis have loaded carries out analysis interpretation to signaling message;
The analysis interpretation result of D, display signaling message.
Described steps A further comprises: judge whether the signaling message code stream that reads is binary code stream, if, execution in step B; Otherwise, non-binary signaling message code stream is converted to binary code stream, then execution in step B.
Described step C further comprises following steps:
The message header of C1, analysis interpretation signaling message;
C2, judged whether that information unit does not carry out analysis interpretation, if, execution in step C3, otherwise, the signalling analysis flow process finished;
The signaling protocol form of the corresponding signaling type that C3, basis have loaded carries out analysis interpretation to information unit, then execution in step C2.
Described step C3 further comprises:
C31, analysis interpretation information unit title and information unit length;
C32, judge whether have the information unit byte not carry out analysis interpretation in the information unit, if, the information unit byte is carried out analysis interpretation, otherwise, execution in step C2.
Described signaling message code stream is the track record file.
Preferably, described track record file is original signaling tracing log file, or the editor's track record file that generates after editing.
Described signaling message code stream is for filtering the initial data listing file that the back generates according to the characteristic matching character to the track record file.
Described signaling message code stream is for filtering the control listing file that the back generates according to the given filter rule to the initial data listing file.
Preferably, the described analysis interpretation result of the step D analysis interpretation result that is information unit in the signaling message; The analysis interpretation of information unit further comprises as a result the time in the described display signaling message of step D: information unit content byte and corresponding mask are put 1 corresponding bit position and carried out the logical AND operation, according to the value that draws bit, demonstrate the corresponding meaning of its expression.
Further comprise before the steps A: the track record file is carried out the order traversal search, go out the starting point of signaling message according to characteristic specified coupling character locating, in follow-up scope, search the end point of this signaling message, search next characteristic specified coupling character with this end point as new starting point then, until definite each bar signaling message.
Described step C further comprises: the parameter value implication that defines in the signaling protocol form according to the corresponding signaling type that has loaded is carried out analysis interpretation to signaling message.
The analysis Signalling method that the present invention proposes can assist the attendant to deal with upper-layer user's call signaling problem, and this method is easy to use simultaneously, can be applicable on the computer.Signalling analysis visual result, detailed can be realized multiple editting functions such as searching, copy, save as, can save as text, and can the record result preserve on computers.Simultaneously, the invention provides secondary filter mechanism, obtain different listing files by the change filtering rule, saved system resource at identical file.
Embodiment
For making the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in further detail below in conjunction with accompanying drawing.
The basic principle of the analysis Signalling method that the present invention proposes is: catch on maintenance terminal and tracking signaling, it is saved as the track record file of text or binary file format; Track record file to storage carries out signalling analysis then, mates according to output format, and filters according to the given filter rule, generates the control listing file.Can in the track record file of directly opening, select signaling to analyze, also can in the control listing file that generates, select signaling to analyze.Can adopt multiple editor's means to the track record file of text file format, for example, search, choose, duplicate, revise, deletion etc.Can sort to the control listing file, for example, arrange according to the time, or arrange according to title.The final signalling analysis visual result that shows, in detail can save as text, and operation such as can search, copy, save as to it.
Comprise many in a kind of signaling and have the message of concrete title and the interactive relation between message, actual to the analysis of signaling is analysis to every message in the signaling.
For being easier to understand analysis Signalling method of the present invention, at first describe below with the corresponding module structure that realizes this signalling analysis method.
Fig. 1 is according to signalling analysis modular structure schematic diagram of the present invention, as shown in Figure 1, the signalling analysis module comprises: multiple text editing module 101, filtering option module 102, message screening and list block 103, signaling protocol module 104, signaling explanation module 105 and signaling display module 106.
Multiple text editing module 101 is supported multiple text function, not limited by the file size of 64K; Realization is opened, the function of editing text file form track record file, supports multiple display format and editting function, for example, searches, chooses, duplicates, revises, deletes, changes font size, adds boldface type etc.; When selecting signaling to analyze, provide selectable code stream.Code stream is encoding stream, and a string code stream comprises one or several message.
Accept characteristic matching character and given filter rule in the filtering option module 102.The characteristic matching character is used for characterizing the feature of message, and message screening and list block 103 go out the message that needs carry out analysis interpretation according to the characteristic matching chracter search in the filtering option module 102.The principle of being followed when given filter rule carries out filtering for the second time for message screening and 103 pairs of message of list block.
The given filter rule comprises: at Q.931 expanding (Q.931+) signaling: designated ends slogan or designated call reference or various message direction, and above-mentioned every combination in any; At the V5 signaling: designated ends slogan or protocol address or network layer address, or message direction or diverse network layer type of message, and above-mentioned every combination in any; At Signaling System Number 7: former signaling point code (OPC) scope of the Destination Point Code of appointment (DPC) scope or appointment or cic circuit identification code (CIC) scope or the message direction or the type of message of appointment, and above-mentioned every combination in any; At R2 signaling: the circuit number of appointment or message direction or type of message or call direction and above-mentioned every combination in any.Above-mentioned each message direction only finger is received message or is sent the direction of message, and call direction is and a certain calling binding, and the call initiator call that the back causes that makes a call is encompassed in the call direction equally.
Characteristic matching character that message screening and list block 103 provide according to filtering option module 102 and given filter rule are finished the secondary filter to message, generate the control listing file, and realize the editting function to the control listing file; When selecting signaling to analyze, providing can be by the message code stream of user's selection.The track record file that filters in message screening and the list block 103 can be original signaling tracing log file, also can be the editor track record file of original signaling tracing log file behind multiple text editing module editor.
Load various signaling protocols in the signaling protocol module 104, provide form, parametric description and the value implication of various signalings to explain, be signalling analysis interpretative rule is provided.
The code stream of 105 pairs of inputs of signaling explanation module is analyzed, relevant sender and recipient's coded message in the signaling interpretative rule that provides according to signaling protocol module 104 and the message, determine the signaling type that this message is affiliated, the signaling interpretative rule that provides according to signaling protocol module 104 makes an explanation to the content of this message again, promptly signaling format and the parameter value implication according to the respective protocol regulation that has loaded makes an explanation, and generates interpretative version then.The message of analyzing in the signaling explanation module 105 can also can be come runback text editing module 101 from message screening and list block 103, also can be directly from the track record file.
The interpretative version that signaling display module 106 generates signaling explanation module 105 shows with form more intuitively.
Can realize secondary filter mechanism in message screening and the list block 103, Fig. 2 is the secondary filter schematic diagram of mechanism according to message screening of the present invention and list block 103, as shown in Figure 2, once filter: at first, 103 pairs of track record files of message screening and list block 201 carry out the order traversal and search, orient the starting point of tracking message according to characteristic specified coupling character 204, in a follow-up segment limit, find the end point of this tracking message again, search next characteristic matching character 204 as starting point then; The rest may be inferred, determines each tracking message, will be stored in initial data listing file 202 by filtering whole tracking message records of choosing for the first time then.Track record file 201 can be original signaling tracing log file, also can be the editor track record file of original signaling tracing log file behind multiple text editing module editor.Secondary filter: successively each the bar tracking message record in the initial data listing file 202 is analyzed and filtered according to given filter rule 205, meeting data in each bar tracking message record of given filter rule 205 all is divided into some hurdles and shows that the title on corresponding hurdle shows the corresponding contents of this tracking message down.Whole demonstrations of content are as a tracking message record under each hurdle, and finally all tracking message records of choosing by secondary filter generate control listing file 203; The tracking message data that do not meet characteristic matching character 204 and given filter rule 205 will be left in the basket.At same track record file 201,, can obtain different initial data listing files 202 by change characteristic matching character 204; Similarly,,, can obtain different control listing files 203, can avoid the wasting of resources at same resource recycling like this by change given filter rule 205 at same initial data listing file 202.When the rule of given filter not 205, control listing file 203 is initial data listing file 202.
Fig. 3 is that as shown in Figure 3, the analytic process of signaling may further comprise the steps according to signalling analysis flow chart of the present invention:
Step 301~step 302: after the signaling explanation module reads code stream, judge whether code stream is binary code stream, if, execution in step 304; Otherwise, execution in step 303.
Step 303: the signaling explanation module is changed to binary code stream with the nonbinary code circulation.
Step 304~step 305: the signaling explanation module is analyzed binary code stream, then signaling display module display message analysis result.
The signaling explanation module generally reads is binary code stream or character string font code stream, if the signaling explanation module reads is character string font code stream, must be converted to binary code stream earlier, could analyze information wherein.For example, the character string type code stream that the signaling explanation module reads is " 00_12_3B ", this string length is 8 bytes, wherein there are two to be the space, the signaling explanation module is converted to this character string the binary code stream of " 00000000,00010010,00111010 ", and length is 3 bytes, and the signaling explanation module intercepts significant character in twos during conversion, filter out idle characters such as space, carriage return, all character leachings finish in character string.
Fig. 4 is the structural representation of binary code flow message, and as shown in Figure 4, the structure of binary code flow message is: sender of the message's coding, message recipient coding, message header and information unit (IE, Information Item) etc., above content is arranged in order.Wherein, sender of the message's coding and message recipient coding are one group of nonnegative integers, have identified the process module coding that switch or server may send message and receive message respectively.Message header comprises the title of message, total length and other relevant reference informations of this binary code flow message.IE is used for further explaining message, for example, sets up when calling out, and describes the situation that this calling takies resource, the form that takies resource etc. by IE.In message, IE has a plurality of also possibility no ones.
Fig. 5 is that as shown in Figure 5, the analytic process of binary code stream may further comprise the steps according to binary code stream analysis process figure of the present invention:
Step 501~step 502: the signaling explanation module is according to the signaling type under sender of the message's coding and definite this message of message recipient coding, and the signaling protocol that calls the type that loads in the signaling protocol module then carries out analysis interpretation to this message.Content in the signaling display module display message head, the i.e. information such as length of the title of message, message.
Step 503: whether the signaling explanation module is judged not analysis interpretation of IE in this message, if having, and execution in step 504; Otherwise, finish analysis process to this binary code flow message.
Step 504~step 505: the signaling explanation module carries out analysis interpretation to IE, and the signaling display module shows the IE analysis result.
The relation of information receiving and transmitting person and signaling type is as follows:
Q.931 signaling type: call out the message of control process module transmitting-receiving, and integrated services network (ISDN) user is to the data link layer of network interface and the message of network layer process module transmitting-receiving.
V5 signaling type: the message of V5 data link layer and the transmitting-receiving of network layer process module.
Signaling System Number 7 type: the message of Signaling System Number 7 MTP process module transmitting-receiving.
Sender of the message's coding and message recipient coding are corresponding one by one with signaling type, and the coding of the process module of different signaling types is inequality, so the signaling explanation module can be determined signaling type by sender of the message's coding and message recipient coding.
Fig. 6 is the structural representation of IE in the message, and as shown in Figure 6, the IE structure is: IE title, IE length, IE content byte 1, IE content byte 2 or the like.The signaling explanation module takes out each IE successively according to the length of the total length of message and each IE, then according to the title of IE, calls the data structure of corresponding IE in the signaling protocol of the type that loads in the signaling protocol module, and IE is carried out analysis interpretation.
The signaling explanation module according to the total length of message and each IE length of having extracted and, judge whether in addition not analysis interpretation of IE, if each IE length of having extracted and less than the total length of message, then also have not analysis interpretation of IE in this message; Otherwise, in this message IE all analysis interpretation finish.Similarly, according to the length of IE total length and each IE content byte can judge among the IE whether whole IE content bytes analysis interpretation finish.
For the ease of problem being positioned and comparing, when showing each IE, the signaling display module all shows except full content byte this IE, also the bit and the value thereof of each field correspondence among the IE can be shown.Describe for example below.
A name is called the IE of " calling number ", its IE content byte 3 expressions " type of number ", particular location is at 6 bits of the 4th bit to the of the 0th figure place from the right of IE content byte 3, therefore, the mask of " type of number " field is " 0x70 ", is shown " 01110000 " with binary form.When the actual value of IE content byte 3 is " 0x41 ", be shown " 01000001 " with binary form, the logical AND operation is carried out in the corresponding position with " type of number " mask of IE content byte 3 actual values, last 3 bits of 6 bits of the 4th bit to the of the 0th figure place from the right accordingly of only getting, obtain binary system and show " 100 ", value is 4, and its expression implication is that the type of number is a Subscriber Number.Mask is used for representing the bit position of field, belongs to the corresponding bits position 1 of this field, does not belong to the corresponding bits position 0 of this field.Corresponding relation is as shown in the table.
Bit |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
Value |
Actual value |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
1 |
0x41 |
Mask |
0 |
1 |
1 |
1 |
0 |
0 |
0 |
0 |
0x70 |
Show |
- |
1 |
0 |
0 |
- |
- |
- |
- |
4 |
Obtain means of signaling among the present invention and be not limited to off line, can pass through connected modes such as Internet protocol (IP) message, serial ports and link to each other, obtain signaling in real time and it is analyzed and manages with switch or server etc.
Code stream also can be the IP message, and for the code stream of IP type of message, the signaling explanation module at first unpacks the IP message, extracts the message code stream content then from the IP message, and following analytic process is same as above.
By to signaling protocol module loading different agreement, method provided by the invention can be applied to the signaling of number of different types.At some broadband signallings, for example H.245 signaling, RAS message, data structure and above-mentioned arrowband signaling are different, the data structure that is broadband signalling is the nested form of tree-shaped catalogue, for example, the IE in the message no longer is simple coordination, and may be that an IE comprises a plurality of subordinate IE, but process and said process to its analysis interpretation are identical, and only final display format can be because the nested form of tree-shaped catalogue and different with the display format of arrowband signaling.
In a word, the above is preferred embodiment of the present invention only, is not to be used to limit protection scope of the present invention.