User-defined packet capture system

Abstract

The invention relates to a user-defined packet capture system. The system comprises a network card system optimization system, a lock-free queuing system, and user-defined capture conditions, wherein the network card system optimization system ignores a protocol stack of the Linux system, directly transmits packets from a kernel to user space through mmap ring, and adopts an NAPI-based zero-copy design; the lock-free queuing system judges whether a head pointer and a tail pointer are identical or not; and the user-defined capture conditions are combinations of various complex conditions such as a source destination IP, a source destination port, a protocol type and a port number, and an internal program inspects the filtering conditions in a real-time manner during storage of captured packets. The system provided by the invention has the advantages that the problem of the traditional capture method that the captured packet loss rate for 10Gbps traffics is high is solved; and through a user-defined capture filtering algorithm, the capture performance can be effectively optimized, the sizes of the captured files can be reduced, and the analysis efficiency can be improved.

Description

technical field [0001] The invention relates to network security technology, in particular to a user-defined network capture system. Background technique [0002] With the rapid development of Internet technology, network connections are facing more and more various connection anomalies or attack events. Network packet capture (packet capture) technology is to intercept, resend, edit, Operations such as dumping are also used to check network security. Packet capture is also often used for data interception and so on. By analyzing and understanding the captured packets, it can help O&M personnel or other engineers quickly locate problems and analyze fault causes. [0003] Traditional network packet capture completes the packet capture task by calling the Libpcap library function (or WinPcap library function). This packet capture method has a high packet loss rate (up to 60%) in a high-traffic network environment. This processing method first reads a group of data packets f...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is: aiming at the above-mentioned technical problems existing in the prior art, through the technical advantages in the 10 Gigabit network card driver optimization technology and the x86 multi-core parallel technology, a traditional packet capture method that can solve the problem of using the traditional packet capture method under 10 Gigabit traffic is invented A user-defined network packet capture system based on the user-defined network packet capture system to solve the problem of high packet loss rate, optimize the packet capture performance, reduce the size of the packet capture file, and improve the analysis efficiency

Images