Web service monitoring method of server protection equipment in bypass mode

A technology of WEB service and WEB server, which is applied in the field of WEB service monitoring of server protection equipment in bypass mode, can solve problems such as network speed delay, and achieve the effect of ensuring seamless integration

CN105897909BActive Publication Date: 2019-06-14西安交大捷普网络科技有限公司
3 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Publication Date
2019-06-14

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses a WEB service monitoring method for use in a bypass mode of server protection equipment. The method comprises the following steps: acquiring a SYN request packet sent to a WEB server by a client in the bypass mode through the server protection equipment; establishing a virtual connection between an Apache server and the client through the SYN request packet; and starting data of the Apache server for responding to the WEB server to perform rule checking. Monitoring of WEB services can be finished in the bypass mode without influencing actual network flow of a user. Meanwhile, user flow can effectively flow into the Apache server in a virtual connection way, so that seamless combination of the user flow and the Apache server is ensured, and later expansion of an Apache module is ensured.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention belongs to the technical field of network data packet analysis, and in particular relates to a method for monitoring a WEB service of a server protection device in a bypass mode. Background technique

[0002] Common network monitoring modes can be divided into two types: one is serial monitoring mode, and the other is bypass monitoring mode. The series mode is generally monitored through the mode of gateway, bridge or proxy server. Since the monitoring device is used as a gateway or bridge in the network connected in series, all data must first pass through the monitoring system, and only after the analysis and inspection of the monitoring system. It can be sent to each client, so there will be a certain delay in the network speed. Bypass monitoring mode refers to monitoring through the port mirroring function of network devices such as switches. In this mode, the monitoring device only needs to be connected to the designated mirroring p...

Examples

Embodiment

[0017] Such as figure 1 As shown, the client establishes a virtual connection process diagram with the Apache server, which specifically includes the following steps:

[0018] Step 101: The client sends a TCP SYN (s=100, a=0) request to the WEB server, and the request enters a switch with a mirror port, and the mirror port copies a copy of the data and sends it to the server protection device.

[0019] Step 102: The server protection device judges whether the packet destination address of the SYN request is the protected WEB server address, and if so, modifies the destination address and port of the SYN request packet to be the address and port of the Apache server.

[0020] Step 103: After the Apache server receives the SYN request packet, the first handshake is successful, and replies with a SYN-ACK packet, adding a seq value of 500 to the packet and sending it to the server protection device.

[0021] Step 104: The server protection device records the data packet and does ...