Data packet filtering method and device

Abstract

The invention provides a data packet filtering method and device. The method comprises the steps that network equipment divides a plurality of preset packet filtering rules into a plurality of grouping rules, wherein all the grouping rules each correspond to different preset fields, and all the grouping rules are formed by corresponding field values of the preset fields corresponding to the grouping rules in a plurality of the packet filtering rules; the network equipment extracts field values of received target data packets corresponding to all the preset fields, and all the extracted field values are each parallel-matched with corresponding grouping rules; then an intersection of matching results of all the field values and the grouping rules corresponding to the field values is calculated out, the packet filtering rule matched with the target data packet can be determined based on the intersection, and the target data packet is subjected to pack filtering based on a packet filter strategy corresponding to the packet filtering rule. The data packet filtering method solves the problem that matching efficiency is reduced as the amount of packet filtering rules is increased in preprocessing the packet filtering rules in the prior art.

Description

Technical field [0001] This application relates to the field of network security, in particular to a data packet filtering method and device. Background technique [0002] In the field of network security, packet filtering rules are user-configured rules for filtering data packets entering and leaving the network, usually composed of fields such as source IP address, destination IP address, port number, and protocol. The network device adopts different filtering strategies according to different packet filtering rules configured. In order to enable network devices to quickly match data packets according to packet filtering rules, it is usually necessary to preprocess the packet filtering rules. The network device matches the received data packet according to the preprocessed packet filtering rules. [0003] Since the packet filtering rule is a multi-dimensional data composed of multiple fields, some of the fields may be split during the preprocessing process, resulting in an incr...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the present application provides a data packet filtering method and device to solve the problem in the prior art that the matching efficiency decreases due to the increase in the number of packet filtering rules in the process of preprocessing the packet filtering rules

Images