A message processing method and device

Abstract

The present invention provides a message processing method and device, the method comprising: an NQA process sends an ICMP echo request message to the RAWIP protocol through a raw socket; Add a preset identification field in the header, and send an ICMP echo request message carrying the preset identifier field; when the RAWIP protocol receives an ICMP echo response message, judge the ICMP echo response message Whether the preset identifier field is carried in the ICMP header of the text; if so, the RAWIP protocol caches the ICMP echo response message to the socket receiving buffer queue; otherwise, the RAWIP protocol discards the ICMP Echo the response message. The application of the embodiments of the present invention can avoid the impact of the ICMP echo response attack message on the normal processing of the ICMP echo response message returned by the destination device, and improve the accuracy of network connection state detection.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a message forwarding method and device. Background technique [0002] Ping is a command under Windows, Unix and Linux systems. Its main function is to detect whether the network can be connected, so that it can be used to help users analyze and judge network failures. [0003] The main process of the Ping command to detect whether the network can be connected is as follows: [0004] The initiator device constructs an ICMP (Internet Control Message Protocol, Internet Control Message Protocol) echo (echo) request (request) message, and sends it to the destination device; [0005] When the destination device receives the ICMP echo request message, it replies with an ICMP echo reply (response); [0006] If the initiator device receives the ICMP echo reply message sent by the destination device within the preset time, it is determined that the network can be connected ...

AI Technical Summary

Problems solved by technology

[0008] However, it has been found in practice that when there are a large number of ICMP echo reply attack packets, the ICMP echo reply packets sent by the destination device may be discarded because the receiving buffer queue is full of ICMP echo reply attack packets, or because the ICMP echo reply Too many attack packets cause the initiator device to fail to process the ICMP echo reply packet sent by the destination device within the preset time, and then the network connectivity status detection error occurs, that is, the destination device replies with the ICMP echo reply In the case of a packet, the initiator device detects that the network cannot be connected

Images