Network failure detection method and network failure detection device

A network failure detection method and a network failure detection device are provided. The network failure detection method includes capturing a plurality of packets, analyzing contents of the plurality of packets and determining whether a network failure occurs to generate a determination result according to the contents of the plurality of packets, and outputting an alarm signal to implement an alarm function according to the determination result.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a network failure detection method and a network failure detection device, and more particularly, to a network failure detection method and a network failure detection device capable of automatically detecting network failure events and performing alarm function in real time.

2. Description of the Prior Art

With the rapid development of information technology and the Internet, the demand for Internet services has gradually increased. For example, emerging network technologies, such as data centers, cloud services, and virtual private networks (VPNs), are also being widely used in life. There may be multiple servers and various devices in a network environment architecture. Current network management control systems usually include functions such as environmental monitoring, remote control and error detection. An error detection module can instantly detect the hardware status of the servers and related accessories, and provide error alarm information or record error logs in real time. For example, the error detection module may detect whether the temperature of the central processing unit of the server is too high, detect whether the motherboard voltage or current is too high, detect whether the temperature of the case is too high, detect whether the fan speed is too high, whether the hard disk is damaged, or the network or detect whether a certain port of the switch is dropped. However, conventional network management control system does not provide corresponding detection and reporting functions for network environment failure or network architecture failure. The system maintenance person usually uses the packet capture software (e.g., Wireshark) to manually check packets in order to find out the cause of the abnormality and the point of failure. But the manually check operation is quite time consuming and labor intensive. Moreover, the network failures may directly lead to the collapse of the entire environmental service. For example, if a user accidentally inserts a network cable into a wrong port to make two network switches or two local area network (LAN) ports to form a loop or the user accidentally sets multiple dynamic host configuration protocol (DHCP) servers on the network during setting the network device, the network data will be blocked, the packet will be lost or the internet protocol (IP) address will not be obtained correctly, such that the preboot execution environment (PXE) may fail to start, the trivial file transfer protocol (TFTP)/file transfer protocol (FTP) file may fail to be transferred, the network service may be abnormal. Thus, there is a need for improvement over the prior art.

SUMMARY OF THE INVENTION

Therefore, the present invention primarily provides a network failure detection method and a network failure detection device capable of automatically detecting network failure events and performing alarm function in real time, in order to solve the above mentioned problems.

According to an aspect of an embodiment, a network failure detection method is disclosed. The network failure detection method comprises capturing a plurality of packets; analyzing contents of the plurality of packets and determining whether a network failure occurs to generate a determination result according to the contents of the plurality of packets; and outputting an alarm signal to implement an alarm function according to the determination result.

According to an aspect of another embodiment, a network failure detection device is disclosed. The network failure detection device comprises a packet capture module configured to capture a plurality of packets; a packet filter module configured to analyze contents of the plurality of packets and determine whether a network failure occurs to generate a determination result according to the contents of the plurality of packets; and an alarm module configured to output an alarm signal to implement an alarm function according to the determination result.

DETAILED DESCRIPTION

Please refer toFIG. 1, which is a schematic diagram of a network failure detection device1according to an embodiment of the present invention. The network failure detection device1can be applied in an electronic system with network applications. The network failure detection device1includes a packet capture module10, a packet filter module20and an alarm module30. The packet capture module10is configured to capture and receive packets. The packet filter module20is coupled to the packet capture module10. The packet filter module20is configured to analyze contents of packets and determine whether a network failure occurs according to the contents of the plurality of packets so as to generate a corresponding determination result. The alarm module30is coupled to the packet filter module20and configured to output an alarm signal to implement an alarm function according to the determination result generated by the packet filter module20.

For an illustration of the operations of the network failure detection device1, please refer toFIG. 2.FIG. 2is a flow diagram of a procedure2according to an embodiment of the present invention. The flowchart inFIG. 2mainly corresponds to the operations on the network failure detection device1shown inFIG. 1. The procedure2includes the following steps:

Step S204: Analyze contents of packets and determine whether a network failure occurs to generate a determination result according to the contents of the plurality of packets.

Step S206: Output an alarm signal to implement an alarm function according to the determination result.

According to the procedure2, in Step S202, the packet capture module10captures and receives a plurality of packets through connecting to the network applied by the network failure detection device1. The packet capture module10can capture and receive packets at intervals. The packet capture module10can capture and receive packets within a predetermined duration of each interval. In an embodiment, the packet capture module10can capture packets for a certain time period by using a packet capture library, such as libpcap function library, but not limited thereto.

In Step S204, the packet filter module20is configured to analyze contents of the packets captured by the packet capture module10and determine whether a network failure occurs according to the contents of packets so as to generate a corresponding determination result. In an embodiment, the packet filter module20analyzes the contents of the packets captured by the packet capture module10and detects time to live (TTL) values of the packets from the contents of the packets. Further, the packet filter module20determines whether the network failure occurs according to the TTL values of the plurality of packets. For example, the packet filter module20detects variations of the TTL value of each packet. When detecting that at least one TTL value of the packets is not decreased sequentially, the packet filter module20determines that a network failure has occurred and accordingly generates a corresponding determination result indicating that a network failure has occurred. For example, the packet capture module10captures and receives a plurality of packets between a time point t0and a time point t4. Suppose the packet capture module10captures and receives a packet P1at time points t1, t2and t3, and the time points t1, t2and t3are between the time point t0and the time point t4. The TTL value recorded in a TTL field of the packet P1which is received at the time point t1by the packet capture module10is 255 (i.e. the TTL value of the packet P1received at the time point t1is 255). The TTL value recorded in the TTL field of the packet P1which is received at the time point t2by the packet capture module10is 254 (i.e. the TTL value of the packet P1received at the time point t2is 254). The TTL value recorded in the TTL field of the packet P1which is received at the time point t3by the packet capture module10is 254 (i.e. the TTL value of the packet P1received at the time point t3is 253). The packet filter module20determines that the variation of the TTL value of the packet P1is decreased sequentially since the variation of the TTL value of the packet P1is as follows: 255, 254, 253. Under such a situation, when determining that the TTL value of the packet P1is decreased sequentially and the TTL values of the other packets are decreased sequentially, the packet filter module20determines that the current network is normal without any network failure and accordingly generates a corresponding determination result indicating that no network failure occurs.

For example, suppose the packet capture module10captures and receives a packet P1at time points t1, t2and t3. The TTL values recorded in a TTL field of the packet P1received at the time points t1, t2and t3are 255, 253, 254 (i.e. the TTL value of the packet P1received at the time points t1, t2and t3are 255, 253, 254). The packet filter module20determines that the TTL value of the packet P1is decreased and then is changed to increase since the variation of the TTL value of the packet P1is as follows: 255, 253, 254. Since there has been an increment in the TTL value of the packet P1, the packet filter module20determines that the TTL value of the packet P1is not decreased sequentially and determines that a network failure has occurred. Therefore, the packet filter module20generates a corresponding determination result indicating that a network failure has occurred. For example, suppose The TTL values recorded in a TTL field of the packet P1received at the time points t1, t2and t3are 255, 255, 255 (i.e. the TTL value of the packet P1received at the time points t1, t2and t3are 255, 255, 255). As such, the packet filter module20determines that the TTL value of the packet P1remains unchanged. Since the TTL value of the packet P1remains unchanged, the packet filter module20determines that the TTL value of the packet P1is not decreased sequentially and determines that a network failure has occurred. According, the packet filter module20generates a corresponding determination result indicating that a network failure has occurred.

In an alternative embodiment, in Step S204, the packet filter module20is configured to analyze contents of the packets captured by the packet capture module10and determine whether a network failure occurs according to the contents of packets so as to generate a corresponding determination result. In an embodiment, the packet filter module20analyzes the contents of the packets captured by the packet capture module10and detects whether the packets include an address of a dynamic host configuration protocol (DHCP) server. The address of the DHCP server may be a physical address, a media access control (MAC) address or an internet protocol (IP) address, but not limited thereto. Further, the packet filter module20calculates the number of addresses of the DHCP server included in the plurality of packets. When calculating that the plurality of packets include only one address of the DHCP server, the packet filter module20determines that the current network is normal without any network failure and accordingly generates a corresponding determination result indicating that no network failure occurs. When calculating that the plurality of packets include more than one address (e.g., two addresses) of the DHCP server, this means that the DHCP service redundancy occurs. Accordingly, the packet filter module20determines that a network failure has occurred and generates a corresponding determination result indicating that a network failure has occurred.

In Step S206, the alarm module30outputs an alarm signal for implementing an alarm function according to the determination result generated by the packet filter module20. When the determination result indicates that a network failure has occurred, the alarm module30outputs the alarm signal to notify the user of the occurrence of the network failure for implementing the alarm function. For example, the alarm module30generates an alarm signal by using an email function. When the determination result indicates that a network failure has occurred, the alarm module30sends an email to a mail recipient to notify the occurrence of the network failure according to a preset email address (e.g., administrator's email address). After receiving the email notification, the mail recipient begins to implement the following precautions in response to the network failure event. For example, the alarm signal can be an email. For example, the alarm module30generates an alarm signal by using a short message service (SMS) function. When the determination result indicates that a network failure has occurred, the alarm module30sends a short message to a message recipient to notify the occurrence of the network failure according to a preset phone number (e.g., administrator's phone number). After receiving the message notification, the message recipient begins to implement the following precautions in response to the network failure event. For example, the alarm signal can be a short message. For example, the alarm module30generates an alarm signal by using instant messaging software. The instant messaging software may be Facebook Messenger, WeChat, LINE, Skype, Whats App, Telegram or QQ, but not limited thereto. When the determination result indicates that a network failure has occurred, the alarm module30sends an instant message to an instant message recipient to notify the occurrence of the network failure according to a preset user account (e.g., administrator's user account). After receiving the instant message notification, the instant message recipient begins to implement the following precautions in response to the network failure event. For example, the alarm signal can be an instant message. For example, the alarm module30generates an alarm signal by using web notification function. When the determination result indicates that a network failure has occurred, the alarm module30sends a web page display content to a website such that web page display content can be displayed on the web page of the website in order to notify the occurrence of the network failure according to a preset website address (e.g., website address that the administrator can browse). For example, the alarm signal can be a web page display content.

For an illustration of an alternative embodiment of the operations of the network failure detection device1, please refer toFIG. 3.FIG. 3is a flow diagram of a procedure3according to an alternative embodiment of the present invention. In Step S302, the packet capture module10captures and receives a plurality of packets through connecting to the applied network. In Step S304, the packet filter module20analyzes the contents of the packets captured by the packet capture module10, detects TTL values of the packets and determines whether a network failure occurs according to the TTL values of the packets. The packet filter module20detects variations of the TTL value of each packet and detects whether a TTL value of the packets is not decreased sequentially. When detecting that at least one TTL value of the packets is not decreased sequentially, the packet filter module20determines that a network failure has occurred and accordingly generates a corresponding determination result indicating that a network failure has occurred, and then Step S306is executed. In Step S306, the alarm module30outputs an alarm signal to notify the user about the occurrence of the network failure. After that, Step S308is executed. In Step S308, the packet filter module20analyzes the contents of the packets captured by the packet capture module10and detects whether the packets include an address of the DHCP server. The packet filter module20calculates the number of addresses of the DHCP server included in the plurality of packets and determines whether the packets include more than one address of the DHCP server. When determining that the packets include more than one address of the DHCP server, the procedure3goes to Step S310. In Step S310, the alarm module30outputs an alarm signal again to notify the user about the occurrence of the network failure. In other words, the packet filter module20can detect whether a network failure occurs according to different detection and determination conditions and accordingly the alarm module30outputs an alarm signal to notify the user that the network failure has occurred.

Please refer toFIG. 4.FIG. 4is a schematic diagram illustrating the network failure detection device1applied in a data center management system4according to an embodiment of the present invention. The data center management system4is connected to a local area network (LAN)40. The data center management system4includes a web graphical user interface (Web GUI)400, a security manager402, a firmware and operating system manager404, a remote control manager406, a hardware health detector408, a system manager410, an administration412, a network service414, a data center manageability interface (DCMI)416and an operating system418. As shown inFIG. 4, the network failure detection device1can be applied in the data center management system4. The security manager402, the firmware and operating system manager404, a remote control manager406, a hardware health detector408, the system manager410and the administration412can be set on the Web GUI400. The administration412can set email addresses, mobile phone numbers, WeChat accounts, etc. The network failure detection device1is configured to implement the network failure detection function and implement the alarm function by utilizing the email addresses, mobile phone numbers, WeChat accounts preset by the administration412while determining that the network failure occurs for realizing the network failure detection and notification function.

Please refer toFIG. 5.FIG. 5is a schematic diagram illustrating the network failure detection device1applied in an internet of things (IoT) device5according to an embodiment of the present invention. The IoT device5includes a web graphical user interface (Web GUI)500, a device manager502, a user manager504, a processor506, a storage device508, a network interface controller (NIC)510, a universal serial bus (USB) interface512and a RJ45 communication port514. The processor506is coupled to the storage device508, the NIC510, the USB interface512and the RJ45 communication port514. The device manager502, a user manager504can be set on the Web GUI500. The network failure detection device1, the Web GUI500, the device manager502and the user manager504can be stored in the storage device508. The storage device508can be a flash memory. The processor506can access data stored in the storage device508for implementing related functions. The IoT device5can be powered via the USB interface512. The IoT device5can be connected to a required network (e.g., LAN50) via the RJ45 communication port514. When the IoT device5has powered, the network failure detection device1applied in the IoT device5, the device manager502and the user manager504begin to perform network failure detection service for detecting the network failure in real time. The system administrator can log in to the Web GUI500through the IP address. The device manager502can set physical address of the switch or the DHCP server for accurately detecting range of failure. The user manager504can set and manage user information, such as email addresses, mobile phone numbers, WeChat accounts, etc. The network failure detection device1is configured to implement the network failure detection function and implement the alarm function by utilizing the email addresses, mobile phone numbers, WeChat accounts preset by the user manager504while determining that the network failure occurs for realizing the network failure detection and notification function.

Please refer toFIG. 6.FIG. 6is a schematic diagram illustrating the network failure detection device1applied in a virtual network6according to an embodiment of the present invention. The virtual network6is implemented based on software defined networking (SDN) architecture. In the virtual network6, virtual machines (VMs)602,604and606, a kernel608and a service console610are respectively coupled to a hypervisor/virtual switch (vSwitch)612via a virtual network interface controller vNIC. The hypervisor/vSwitch612is coupled to a NIC614via a physical network interface controller (pNIC). The network interface controller614is coupled to a physical port616. A physical/virtual switch618is coupled to the physical port616. A network kernel switch620of an LAN60is coupled to the physical port616. The network kernel switch620, a DHCP and domain name system (DNS) server624, a database and network server626and a terminal device628are coupled to a network switch622. The network failure detection device1can be applied in the virtual network6for realizing the network failure detection and notification function.

Those skilled in the art should readily make combinations, modifications and/or alterations on the abovementioned description and examples. The abovementioned description, steps, procedures and/or processes including suggested steps can be realized by means that could be hardware, software, firmware (known as a combination of a hardware device and computer instructions and data that reside as read-only software on the hardware device), an electronic system, or combination thereof. Examples of hardware can include analog, digital and mixed circuits known as microcircuit, microchip, or silicon chip. Examples of the electronic system may include a system on chip (SoC), system in package (SiP), a computer on module (CoM). Circuits/modules in the embodiments of the invention may include function that may be implemented as software executed by a processor, hardware circuits or structures, or a combination of both. The processor may be a general-purpose or dedicated processor. The software may comprise programming logic, instructions, commands or data to implement certain function for an embodiment of the invention. The software may be stored in a medium accessible by a machine or computer-readable storage medium. The method, or certain aspects or portions thereof, may take the form of a program code. Any of the abovementioned procedures and examples above may be compiled into program codes or instructions that are stored in the storage circuit or computer-readable storage medium. A processor may read and execute the program codes or the instructions stored in the computer-readable storage medium for realizing the abovementioned functions. The computer-readable storage medium or a computer program product for storing program codes or instructions may include read-only memory (ROM), flash memory, random-access memory (RAM), hard disk, floppy diskette, or CD-ROM/DVD-ROM, flash drive, but not limited thereto.

In summary, embodiments of the invention can automatically detect network failure events and perform alarm function in real time so as to notify the user that a network failure event has occurred, thus realizing the network failure detection and notification function.