Network detecting method using intelligent network card

Abstract

The invention discloses a network detecting method using an intelligent network card, wherein the intelligent network card is serially connected with an exit of a local network or a small industry network, and stores an ACL (access control list) rule; a quintuple group ACL (access control list) rule of a server end is transmitted to an intelligent network card storing module by a network card management module firstly, then the intelligent network card receives network data and performs stream reverting treatment to the data; in a data processing module of the intelligent network card, the treated message is matched with the existing ACL (access control list) rule in the storing module, and corresponding actions of discarding, transmitting, marking, massage transmitting or log transmitting are adopted. According to the method, analysis and detection actions for the network data by the server is delivered to the intelligent network card for treating, so that the load of the background server CPU (central processing unit) is reduced effectively, and meanwhile, a plurality of standard compatible interfaces are provided, thereby enabling the existing associated network processing program to use the intelligent network card in seamless manner, and further developing the advantages of the intelligent network card on the analysis and detection of the network data. The method is suitable for various situations such as network detection.

Description

technical field [0001] The invention relates to the application field of network detection, in particular to a network detection method using an intelligent network card. Background technique [0002] In the local area network or small enterprise network, a series of intranet attacks such as ARP spoofing, IP spoofing, false IP, IP fragmentation, false MAC, oversized Ping packets, wrongly formatted data, excessive packet sending frequency, etc. Disconnected, stuck, etc. These intranet attacks are common in the network. The common detection method is that the network detection software on the background server scans the content of the IP packets entering and leaving the subnet, and matches the sensitive information according to the characteristic string, so as to judge whether the data packet is legal information. This network detection method undoubtedly increases the burden on the CPU of the background server and reduces system performance. When the network peak occurs, th...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to use the software on the backstage server to detect the network information received by the network card in the network detection of local area network or small enterprise network. The burden of the existing backstage server CPU is heavy, the system performance is poor, and the application program cannot be processed quickly.

Images