Megabit protocol analysis method and megabit protocol analysis method

Abstract

The invention discloses a megabit protocol analysis method. The megabit protocol analysis method includes steps that a network card driving unit computes first hash values of data packets and data packet processing thread IDs (identities) and distributes the data packets to data packet processing threads of corresponding CPUs (central processing units); a data packet processing unit creates a corresponding virtual network interface for each CPU, and received data packets are filtered and are transmitted to the corresponding CPUs; and after monitoring that the virtual network interfaces receive the data packets, a protocol analysis unit computes second hash values of the data packets and protocol analysis thread IDs, whether first hash values equal to the second hash values are available in a data packet distribution list or not is judged, the data packets are distributed onto protocol analysis data link lists corresponding to the protocol analysis thread IDs in a semaphore manner, and the data packets on the protocol analysis data link lists in the semaphore manner are subjected to protocol analysis, reassembling, in-storeroom and indexing operation. The invention further discloses a megabit protocol analysis system.

Description

technical field [0001] The invention relates to a ten-gigabit protocol analysis method and system. Background technique [0002] Due to the rapid development of the Internet, the structured, unstructured, and semi-structured data traffic on the Internet has also increased exponentially. According to the monitoring of ISP and IDC data computer rooms, the gigabit data entrances and exits of many Internet service providers' computer rooms have been popularized. Gigabit is also under rapid development and construction, so the protocol analysis system that adapts to 10 Gigabit traffic will be the mainstream. For the protocol analysis of mirror data, the performance of protocol analysis is the key. The current 100M and 1000M protocol analysis systems are based on libpcap (network packet capture function) to capture packets, which is limited by the impact of libpcap's own packet capture performance. Its packet loss rate is very serious, and the effect is very bad. When the data fl...

AI Technical Summary

Problems solved by technology

For the protocol analysis of mirror data, the performance of protocol analysis is the key. The current 100M and 1000M protocol analysis systems are based on libpcap (network packet capture function) to capture packets, which is limited by the impact of libpcap's own packet capture performance. Its packet loss rate is very serious, and the effect is very bad. When the data flow exceeds the bottleneck of protocol analysis, the data that can be parsed or restored will be parsed incorrectly or cannot be restored. With the upgrade of Internet service provider computer room equipment, 100M , Gigabit mode, its usable value will gradually weaken and eventually disappear

[0003] Most of the 100M and 1000M protocol analysis systems do not consider multi-process and multi-thread to process data packets in parallel, and do not make full use of hardware resources. The main reason is that the protocol analysis itself needs to group and filter the received data packets. , analysis, a parallel processing framework is needed to realize the correct restoration of 10 Gigabit protocol data

Images