Real-time analysis method of multi-segment link network and bypass packet capturing system

Abstract

The invention provides a real-time analysis method of a multi-segment link network and a bypass packet capturing system. The method comprises the steps: establishing a plurality of work queues and configuring a predefined storage space for each work queue, wherein a plurality of analysis strategies used for analyzing the multi-segment link network protocol are stored in the predefined storage spaces; capturing a data packet in the multi-segment link network in real time, and distributing a working queue for the data packet according to a preset distribution strategy; calling, by the work queue distributed to the data packet, a corresponding analysis strategy in a predefined storage space to analyze the data packet according to a cache link in the current cache; and in response to the quintuple information of the next-stage link obtained by the data packet, updating the cache link in the corresponding working queue cache according to a preset allocation strategy. According to the method, the cache links in the caches of the corresponding working queues are updated in advance by configuring the plurality of working queues, so that real-time analysis of the multi-segment link network is realized, and the analysis capability and the analysis speed are improved.

Description

technical field [0001] The invention relates to the technical field of network information, in particular to a real-time analysis method of a multi-segment link network and a bypass packet capture system. Background technique [0002] In a network composed of multi-segment links (with multiple communication protocols), a complete communication process may involve multi-segment protocols of multi-segment links. [0003] Therefore, when using the existing bypass packet capture system to analyze multi-segment protocols, since the characteristics of the above-mentioned multi-segment protocols cannot be determined in advance, and it is impossible to configure all protocol analysis methods when the packet capture system is started, the bypass packet capture system does not In the case of an interruption, the communication content of the multi-segment protocol cannot be completely analyzed, but the backtracking analysis can only be performed by periodically saving the pcap data pac...

AI Technical Summary

Problems solved by technology

[0003] Therefore, when using the existing bypass packet capture system to analyze multi-segment protocols, since the characteristics of the above-mentioned multi-segment protocols cannot be determined in advance, and it is impossible to configure all protocol analysis methods when the packet capture system is started, the bypass packet capture system does not In the case of an interruption, the communication content of the multi-segment protocol cannot be completely analyzed, but only the pcap data packet (a kind of Python data) saved at regular intervals can be used for backtracking analysis

After the backtracking analysis is completed, the bypass packet capture system has completed the operations of capturing, analyzing, writing to disk and reading data packets from the pcap file for multiple data packets at this time, and has experienced at least two operations Disk read and write operations, which leads to the poor real-time performance of the existing bypass packet capture system for multi-segment protocol analysis

Images