CN106209456A - A kind of kernel state lower network fault detection method and device - Google Patents

Abstract

The invention discloses a network fault detection method and device in a kernel state. The method comprises the following steps: when an error message is detected in the fault collection function by the protocol layer event collection module, a fault event is generated according to the error message, and the error message is an error message in the data packet transmission process; The sending module encapsulates the fault events, and adds the encapsulated fault events to the fault event list; monitors the fault event list through the event receiving module, and analyzes the fault events in the fault event list to obtain fault details and output fault information For system users, the fault information carries fault details. By applying the technical solutions provided by the embodiments of the present invention, the automatic detection of data packet transmission errors in the kernel state is realized, and it is convenient for system users to know the details of network errors in time.

Description

A method and device for network fault detection in kernel state

technical field

The invention relates to the technical field of operating systems, in particular to a network fault detection method and device in a kernel state.

Background technique

In the information age, the network plays a very important role. Whether in a personal host or in a server, the availability and reliability of the network directly affect the system performance and determine the quality of communication between hosts.

When a network failure occurs in a computer system, users usually use external network management tools to detect network problems. Commonly used network management tools, such as ping, netstat, ip, etc., all detect network problems from the perspective of user mode. Users need to be familiar with the corresponding network management tools to detect network problems. The operation is relatively passive, and it is not convenient for users to know the details of network errors in a timely manner.

Contents of the invention

In order to solve the above technical problems, the present invention provides a network fault detection method and device in a kernel state.

A network fault detection method in a kernel state, comprising:

When detecting that there is an error message in the fault collection function by the protocol layer event collection module, according to the error message, a fault event is generated, and the error message is an error message in the data packet transmission process;

Encapsulate the fault event through the event sending module, and add the encapsulated fault event to the fault event list;

The event receiving module monitors the fault event list, and analyzes the fault events in the fault event list to obtain fault details, and outputs fault information to system users, and the fault information carries the fault details.

In a specific implementation manner of the present invention, said generating a fault event according to said error message includes:

Analyzing the error message by using an error handling function;

A fault event is generated according to the header information of the error message.

In a specific implementation manner of the present invention, adding the encapsulated fault event to the fault event list includes:

The encapsulated fault event is added to the fault event list by calling the registered event sending function, which is registered by the event receiving module for the event sending module to call.

In a specific embodiment of the present invention, the fault event includes fault event linked list pointer information, IP version number information, message type information, message type subcode information, error code information, and the severity of the error message information.

A network fault detection device in a kernel state, comprising:

The protocol layer event collection module is used to generate a fault event according to the error message when detecting that there is an error message in the fault collection function, and the error message is an error message in the data packet transmission process;

An event sending module, configured to encapsulate the fault event, and add the encapsulated fault event to the fault event list;

The event receiving module is configured to monitor the fault event list, analyze the fault events in the fault event list, obtain fault details, and output fault information to system users, and the fault information carries the fault details.

In a specific implementation manner of the present invention, the protocol layer event collection module is specifically used for:

Analyzing the error message by using an error handling function;

A fault event is generated according to the header information of the error message.

In a specific implementation manner of the present invention, the event sending module is specifically used for:

The encapsulated fault event is added to the fault event list by calling the registered event sending function, which is registered by the event receiving module for the event sending module to call.

In a specific embodiment of the present invention, the fault event includes fault event linked list pointer information, IP version number information, message type information, message type subcode information, error code information, and the severity of the error message information.

Application of the technical solution provided by the embodiment of the present invention can detect whether there is an error message in the fault collection function through the protocol layer event collection module. Fault events can be encapsulated, and the encapsulated fault events can be added to the fault event list. The event receiving module can monitor the fault event list, analyze the monitored fault events, obtain fault details, and output faults to system users information. The automatic detection of data packet transmission errors in the kernel mode is realized, which is convenient for system users to know the details of network errors in time.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only For some embodiments of the present invention, those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is the implementation flow chart of a kind of network fault detection method under kernel state in the embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a network fault detection device in a kernel state in an embodiment of the present invention.

detailed description

In order to enable those skilled in the art to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. Apparently, the described embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Referring to Fig. 1, it is an implementation flowchart of a network fault detection method in a kernel mode provided by an embodiment of the present invention, the method may include the following steps:

S110: When an error packet is detected in the fault collection function by the protocol layer event collection module, a fault event is generated according to the error packet.

The error message is an error message in the process of data packet transmission.

In the embodiment of the present invention, the error handling method of each protocol in the original Linux kernel protocol layer can be modified by modifying the error handling function err_handler. Specifically, a fault collection function can be added to the error handling function so that it has a fault collection function.

In the process of data packet transmission, if there is a problem, the error handling function err_handler of the protocol structure net_protocol will be called, and the error message can be recorded in the fault collection function of the error handling function, and the error message is the error message in the process of data packet transmission error message.

The protocol layer event collection module can detect whether there is an error message in the fault collection function, and if there is, the protocol layer event collection module can generate a fault event according to the error message.

In a specific embodiment of the present invention, according to the error message, the step of generating a fault event may specifically include the following steps:

Step 1: Use the error handling function to analyze the error message;

Step 2: Generate a fault event according to the header information of the error message.

For ease of description, the above two steps are combined for description.

In practical applications, when the protocol layer event collection module detects that there is an error message in the fault collection function, it can analyze the error message by using its member error handling function err_handler based on the structure struct net_protocol in the kernel code, that is, to The error message data packet is analyzed to obtain the header information of the error message. According to the header information of the error message, a fault event can be generated.

In the embodiment of the present invention, the fault event includes fault event linked list pointer information, IP version number information, message type information, message type subcode information, error code information, and error message severity information.

The fault event structure is defined as follows:

In the fault event structure, list is the fault event linked list pointer; ipv represents the IP version number; type is the message type, among them, in ipv4, ICMP_TIME_EXCEEDED, ICMP_SOURCE_QUENCH, ICMP_PARAMETERPROB, ICMP_DEST_UNREACH are error messages, in ipv6, ICMPV6_DEST_UNREACH , ICMPV6_PKT_TOOBIG, ICMPV6_TIME_EXCEED, and ICMPV6_PARAMPROB are error messages; code is the subcode of the message type, and the error type can be further determined through this information; err is the error code, and the error codes of different types of error messages are different, indicating that the fault type is different; harderr Indicates the severity of the error message and whether it can be repaired.

The protocol layer event collection module analyzes the error message, and after obtaining the header information of the error message, it can assign values to the members in the fault event structure protocol_evt according to the header information of the error message to generate a fault event. For example, in UDP, err_handler is assigned as __udp4_lib_err(), and adding corresponding codes in __udp4_lib_err() can realize the assignment of each member in protocol_evt.

After the fault event is generated by the protocol layer event collection module, the operation of step S120 can be continued.

S120: Encapsulate the fault event through the event sending module, and add the encapsulated fault event to the fault event list.

In step S110, after the fault event is generated by the protocol layer event collection module, the fault event can be further encapsulated by the event sending module, and the encapsulated fault event can be added to the fault event list.

In a specific embodiment of the present invention, the step of adding the encapsulated fault event to the fault event list may specifically include the following steps:

The encapsulated fault event is added to the fault event list by calling the registered event sending function, and the event sending function is registered by the event receiving module for the event sending module to call.

The event sending module calls the registered event sending function to add the encapsulated fault event to the fault event list, and the event receiving module will monitor the fault event list.

For example, the event sending function protocol_post_error can be expressed as follows:

In the above code, protocol_evt_post is a specific sending function, which is implemented by an external module. In practical applications, the above code can be loaded into the kernel with the kpatch dynamic patch mechanism.

The external module implements the function of sending fault events and loads the work in the form of ko module. For details, please refer to the following code:

S130: Monitor the fault event list through the event receiving module, analyze the fault events in the fault event list, obtain fault details, and output the fault information to the system user, and the fault information carries the fault details.

In step S110 and step S120, the fault event can be generated by the protocol layer event collection module, the fault event can be encapsulated by the event sending module, and the encapsulated fault event can be added to the fault event list.

In the embodiment of the present invention, the fault event list can be monitored by the event receiving module. When a fault event is detected in the fault event list, the fault event can be analyzed to obtain fault details, and the fault information is output to the system user, and the fault information carries the fault details.

For example, the specific working process of the event receiving module can refer to the following code:

Among them, the structure protocol_evt_u is the event structure in the user mode, and errmsg_parse() can analyze the fault details and output the fault information according to the member values of the fault event.

In the embodiment of the present invention, the kpatch dynamic kernel patch method is used to modify the error handling method of each protocol in the Linux original kernel protocol layer, and a fault collection function is added to realize the error detection of data packet transmission.

Application of the method provided by the embodiment of the present invention can detect whether there is an error message in the fault collection function through the protocol layer event collection module. When there is an error message, a fault event can be generated according to the error message, and the event sending module can Encapsulate the fault events and add the encapsulated fault events to the fault event list. The event receiving module can monitor the fault event list, analyze the monitored fault events, obtain fault details, and output fault information to system users . The automatic detection of data packet transmission errors in the kernel mode is realized, which is convenient for system users to know the details of network errors in time.

Corresponding to the above method embodiments, the present invention also provides a network fault detection device in the kernel state.

Referring to shown in Figure 2, the device can include the following modules:

The protocol layer event collection module 210 is used to generate a fault event according to the error message when detecting that there is an error message in the fault collection function, and the error message is an error message in the data packet transmission process;

The event sending module 220 is configured to encapsulate the fault event, and add the encapsulated fault event to the fault event list;

The event receiving module 230 is used to monitor the fault event list, analyze the fault events in the fault event list, obtain fault details, and output fault information to system users, and the fault information carries the fault details.

Application of the device provided by the embodiment of the present invention can detect whether there is an error message in the fault collection function through the protocol layer event collection module. When there is an error message, a fault event can be generated according to the error message, and the event sending module can Encapsulate the fault events and add the encapsulated fault events to the fault event list. The event receiving module can monitor the fault event list, analyze the monitored fault events, obtain fault details, and output fault information to system users . The automatic detection of data packet transmission errors in the kernel mode is realized, which is convenient for system users to know the details of network errors in time.

In a specific implementation manner of the present invention, the protocol layer event collection module 210 is specifically used for:

Use the error handling function to analyze the error message;

According to the header information of the error message, a fault event is generated.

In a specific implementation manner of the present invention, the event sending module 220 is specifically used for:

The encapsulated fault event is added to the fault event list by calling the registered event sending function, and the event sending function is registered by the event receiving module 230 for the event sending module 220 to call.

In a specific embodiment of the present invention, the fault event includes fault event linked list pointer information, IP version number information, message type information, message type subcode information, error code information and error message severity information.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related part, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

A network fault detection method and device in the kernel state provided by the present invention has been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention, and the descriptions of the above embodiments are only used to help understand the method and core idea of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, some improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (8)

1. a kernel state lower network fault detection method, it is characterised in that including:

When there is error message by protocol layer events collection module in fault collection function being detected, according to described mistake report Literary composition, generates event of failure, and described error message is the error message in transmission of data packets；

By event sending module, described event of failure is packaged, and adds the event of failure after encapsulation to event of failure In list；

Monitor described event of failure list by event receiver module, and the event of failure in described event of failure list is carried out Resolving, it is thus achieved that fault details, output fault message, to system user, carries described fault details in described fault message.

Method the most according to claim 1, it is characterised in that described according to described error message, generates event of failure, bag Include:

Utilize fault processing function that described error message is resolved；

According to the header information of described error message, generate event of failure.

Method the most according to claim 1 and 2, it is characterised in that described will encapsulation after event of failure add fault to In list of thing, including:

Calling the event of failure after registered event transmission function will encapsulate and add in event of failure list, described event is sent out Sending function is that the registration of described event receiver module is called for described event sending module.

Method the most according to claim 3, it is characterised in that comprise event of failure chain list index letter in described event of failure Breath, IP version information, type of message information, type of message subcode information, error code information and the order of severity of error message Information.

5. a kernel state lower network failure detector, it is characterised in that including:

Protocol layer events collection module, during for there is error message in fault collection function being detected, according to described mistake Message, generates event of failure, and described error message is the error message in transmission of data packets；

Event sending module, for being packaged described event of failure, and adds the event of failure after encapsulation to fault thing In part list；

Event receiver module, is used for monitoring described event of failure list, and enters the event of failure in described event of failure list Row resolves, it is thus achieved that fault details, and output fault message, to system user, carries described fault details in described fault message.

Device the most according to claim 5, it is characterised in that described protocol layer events collection module, specifically for:

Utilize fault processing function that described error message is resolved；

According to the header information of described error message, generate event of failure.

7. according to the device described in claim 5 or 6, it is characterised in that described event sending module, specifically for:

Calling the event of failure after registered event transmission function will encapsulate and add in event of failure list, described event is sent out Sending function is that the registration of described event receiver module is called for described event sending module.

Device the most according to claim 7, it is characterised in that comprise event of failure chain list index letter in described event of failure Breath, IP version information, type of message information, type of message subcode information, error code information and the order of severity of error message Information.