Universal protocol analysis framework implementation method and device

Abstract

The invention relates to a universal protocol analysis framework implementation method and device, and the method comprises the steps: S1, building an association relation among a protocol name, a port number and an analysis function, and storing the association relation in a global hash table; s2, acquiring a protocol data message needing to be analyzed; s3, decomposing the protocol data messageneeding to be analyzed, and extracting one or more port numbers from the protocol data message; s4, carrying out searching in a global hash table according to the extracted one or more port numbers, and if an analytical function associated with the one or more port numbers is found, executing the step S5; and S5, analyzing the protocol data message needing to be analyzed by utilizing the searchedanalysis function to obtain an analysis result. The method has the advantages of cross-platform, wide protocol support, simple message analysis, convenient deployment and the like.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a method and device for realizing a general protocol analysis framework. Background technique [0002] The description of the background technology in the present invention belongs to the related technology of the present invention, and is only used to illustrate and facilitate the understanding of the content of the present invention. prior art as of the filing date. [0003] In network traffic analysis, tcpdump (UNIX) and wireshark (Windows) are usually used to collect and analyze traffic. For tcpdump, it can capture, filter, save, etc. in various ways, but the data it collects is the original network traffic and cannot analyze the traffic packets. As for wireshark, it has powerful functions, which can capture packets and analyze them. But wireshark also has some disadvantages as follows: [0004] 1. For deployment on the server (UNIX / Linux), it usually relies on other thi...

AI Technical Summary

Problems solved by technology

[0004] 1. For the deployment on the server (UNIX / Linux), it usually relies on other third-party libraries. This feature will bring great troubles to the early deployment work, especially for the internal LAN with high security requirements.

[0005] 2. The display results of some protocols / messages do not conform to the OSI specification, and the readability is poor

[0006] 3. Once the port number of a certain protocol changes, wireshark itself cannot recognize the protocol

[0007] 4. Cannot do anything for protocols with multiple port numbers / multi-links

Images