Message processing method and device and network equipment

Abstract

The invention discloses a message processing method and device and network equipment, and the method comprises the steps: receiving a communication message, and extracting the features of the message;determining a type value of the communication message according to the message characteristics and a PCAM strategy table; according to the type value, shunting the communication message to an attackcache pool or a service cache pool corresponding to the type value, wherein the attack cache pool is used for storing the attack message, and the space size of the attack cache pool is configurable; and when the communication message is shunted to the attack cache pool and the space of the attack cache pool is insufficient, discarding the communication message. Before cache allocation, the type value of the message is calculated according to the PCAM strategy table, and the message is shunted. The attack message can be shunted to the attack cache pool according to the type value, the attack cache pool can be flexibly configured, the situation of insufficient cache exists, and at the moment, the hardware directly discards the shunted message, so that the waste of hardware resources is reduced, the CPU pressure is reduced, the normal message processing is ensured, and the overall processing efficiency of the equipment is improved.

Description

technical field [0001] The present application relates to network communication technology, in particular to a message processing method, device and network equipment. Background technique [0002] The firewall often acts as an important threshold for intranet security. When the firewall device detects that certain types of communication packets are attack communication packets, the firewall will discard all detected attack packets, thereby realizing the protection of the intranet system. [0003] In the current related technology, when the firewall receives a communication message, it first allocates buffer space to store the communication message, and then sends the communication message to the anti-attack detection module through the underlying network card driver. Perform feature extraction, and compare the extracted packet features with the attack features stored in the feature database. If it is determined that the communication message contains the attack signature i...

AI Technical Summary

Problems solved by technology

When there are a large number of attack packets, the attack packets will occupy too many hardware resources, resulting in no hardware resources for storing normal business packets, affecting the processing of normal business packets

Images