Method for quickly positioning parallel storage high speed network flow

Abstract

The invention discloses a method for quickly positioning multi-queue parallel storage network flow based on a new indexed mode. In the capture process of the flow, partial index nodes are set up at a certain time interval for all queues, the time stamps of the index nodes of all queues are synchronous, and a playback starting point of the flow is located according to a starting time of the flow or a serial number of a starting data packet. After the flow capture is finished, a partial index does not need to be updated into a global index, long time waiting for an index updating process is avoided, flow files can be replayed after the capture is finished, and capture playback is efficient.

Description

technical field [0001] The invention relates to a network traffic positioning method, in particular to a fast positioning method for parallel storage of high-speed network traffic in multiple queues. Background technique [0002] The traffic playback method is a network test method that stores and records real network traffic and restores it for playback. By replaying the captured real network traffic to the test network, the traffic playback method can reproduce the actual network scene and achieve the purpose of examining the function and performance of the system under test in the actual network environment. The flow playback method has become an important method for objectively, comprehensively and systematically testing various network / security devices (such as IDS, Firewall, IPS, etc.). [0003] At present, in order to ensure the performance of traffic capture and playback, multi-queue parallel storage and playback methods are often used for high-speed network traffic...

AI Technical Summary

Problems solved by technology

[0005] The main disadvantage of this technical solution is that after the traffic capture is completed, the local index needs to be updated to the global index. During the update process, the local index needs to be used. At the same time, the original traffic file needs to be opened to view the timestamp of the data packet to compare the data packets in different queues. The order of arrival, and usually the number of data packets stored in each queue in the captured high-speed network traffic is relatively large, so the update process will take up a lot of system resources, and it is very time-consuming. After the capture is completed, you need to wait for the update process The traffic file can only be played back after the completion of the process. The long wait seriously affects the use of the system. In addition, if an error occurs during the update process, the traffic file will not be available, and the captured traffic will become system garbage. Therefore, for the capture process, Saying that updating the index process is a big burden

Images