Data packet capturing, processing and sending method and system

Abstract

The invention provides a data packet capturing, processing and sending method which comprises the following steps: a memory space with a preset size is distributed according to the page size of a system; a memory is mapped to a user address space from a kernel space to make a user program be associated with the memory in the kernel space; received data packets are sequentially stored into multiple continuous DMA buffer areas in the memory space in the mode of direct memory access; the use program conducts concurrent processing on the data packets in the N DMA buffer areas through m threads, wherein m refers to the number of kernels of a processor; the data packets which are processed in the N DMA buffer areas are sequentially sent out. By means of the data packet capturing, processing and sending method, quick capture, concurrent processing and linear speed sending are combined organically, as a result, the defect that a zero copy technology cannot timely process captured data packets is overcome, and certain technical support is provided for a safety audit system. The invention further provides a data packet capturing, processing and sending system.

Description

technical field [0001] The invention relates to the technical field of Internet network security, in particular to a method and system for capturing, processing and sending data packets. Background technique [0002] With the rapid development of the Internet, it is more and more important to conduct security audits on Internet content, and network security technology has also developed rapidly. Existing content-based security audits are mainly divided into capturing, filtering and processing of data packets. A fast data packet capture mechanism is the premise of security audit, and the rate of capturing data packets directly affects the performance of the entire system. [0003] Some of the existing data packet capture mechanisms are based on software, and some are based on hardware. With the popularization of gigabit network cards, although the performance of hardware has been improved rapidly, from the perspective of cost performance, people are more concerned about rea...

AI Technical Summary

Problems solved by technology

The implementation of existing zero-copy technology is mostly based on the nopage memory mapping method, and this mechanism is difficult to meet the requirements of parallel processing of data packets. Once the system cannot process the captured data packets in time, the system memory will be exhausted soon.

At the same time, the existing capture mechanism has modified the network card driver, which affects the normal use of the system protocol stack, so that the captured data packets can only be used by specific programs, and other user programs in the system cannot normally send and receive data packets through the network card.

Images