Multilink message capturing method, and method and system for processing multilink message

Abstract

The embodiment of the present invention relates to a multilink message capturing method, each link is respectively corresponding to a circular buffer in a system kernel layer, a plurality of links are corresponding to a sequencing circular queue in the system kernel layer; the method comprises the steps: by means of direct memory access mode, writing the messages resulted from each link into the reserved storage nodes in the circular buffers to which each link is corresponding, and writing memory addresses of the messages in the circular buffers thereof into the sequencing circular queue according to a synchronization mechanism adopted by the sequencing circular queue. The embodiment of the invention further provides a method for processing multilink message and a system corresponding thereto. The method and the system according to the embodiment of the invention can completely avoid the participation of a central processing unit in the process of capturing network message, achieve no loss of message during the capture in network environment more than kilomega, lessen the load of multilink message capturing system and enhance the performance of capturing message.

Description

technical field [0001] The invention relates to the communication field, in particular to a method for capturing multi-link messages, a method for processing multi-link messages and a corresponding system. Background technique [0002] With the rapid development of the Internet and network switching hardware, the data throughput of the LAN network egress is increasing day by day. For example, many large enterprises, schools and other institutions currently use core switches with a data throughput greater than Gigabit. Because such data throughput has exceeded the limit of traditional Gigabit network card packet capture, the application of network audit products using Gigabit network card packet capture has encountered difficulties. In order to solve the above problems, the Internet audit industry generally adopts zero-copy to capture network packets to achieve the effect of increasing the packet capture rate, or uses hardware with faster processing speed, such as Intel (Int...

AI Technical Summary

Problems solved by technology

[0003] However, in the face of the ever-increasing network data throughput, even if the zero-copy technology and the Intel e1000e network card are used at the same time, data packets will inevitably be lost. In addition, increasing the received message cache can only solve the speed of packet capture and message analysis. The problem caused by the speed difference between them, but it cannot solve the bottleneck problem that the packet capture speed cannot keep up with the actual image data speed

Images