A pcap data packet segmentation method, device, equipment and storage medium

Abstract

The present application discloses a pcap data packet segmentation method, device, equipment and storage medium, including: creating a CSV blank file, and writing the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file; obtaining a target pcap file containing the pcap data packet to be segmented; matching the five-tuple information in the target CSV file with the target pcap file, and if the match is successful, segmenting the matched pcap data packet to be segmented from the target pcap file. It can be seen that the present application generates a target CSV file by writing the five-tuple information corresponding to the pcap data packet to be segmented into a CSV blank file, and then uses the target CSV file to segment the pcap data packet to be segmented in the target pcap file. The entire segmentation process is automatically completed by the machine without manual intervention, and the operation is simple and convenient, thereby avoiding errors in manual search of data packets and improving the efficiency and accuracy of pcap data packet segmentation.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a pcap data packet segmentation method, device, equipment and storage medium. Background Art

[0002] The pcap file is a commonly used datagram storage format. A pcap file contains multiple pcap data packets. In the process of daily research and development and test analysis, for a large pcap file, the file contains a lot of session information. If we want to segment some of the session data packets we want and then analyze these sessions separately, we need to search them one by one manually, and then save the searched data packets in pcap format. If there are only a few data packets to be segmented, manual search can also be achieved quickly, but if there are thousands of data packets, manual search and segmentation will waste a lot of time and be difficult, resulting in very low segmentation efficiency.

[0003] Therefore, how to realize the automatic segmentation of pcap data packets simply and efficiently is a technical problem to be solved urgently by those skilled in the art. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a pcap data packet segmentation method, device, equipment and storage medium, which can avoid errors in manual search of data packets and improve the efficiency and accuracy of pcap data packet segmentation. The specific scheme is as follows:

[0005] The first aspect of the present application provides a pcap data packet segmentation method, comprising:

[0006] Create a CSV blank file, and write the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file;

[0007] Obtain a target pcap file containing the pcap data packets to be segmented;

[0008] The five-tuple information in the target CSV file is matched with the target pcap file. If the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file.

[0009] Optionally, the step of writing the five-tuple information corresponding to the pcap data packet to be segmented into the blank CSV file to obtain a target CSV file includes:

[0010] Determine the five-tuple information of the pcap data packet to be segmented, and generate a file name of the pcap data packet to be segmented that has a unique corresponding relationship with the five-tuple information according to target requirements;

[0011] According to the unique correspondence between the five-tuple information and the file name, the five-tuple information and the file name corresponding to the pcap data packet to be segmented are written into the CSV blank file to obtain the target CSV file.

[0012] Optionally, the step of obtaining a target pcap file containing the pcap data packets to be segmented includes:

[0013] Read the target pcap file containing the pcap data packets to be segmented, and load the read target pcap file into memory for matching.

[0014] Optionally, the reading of the target pcap file containing the pcap data packets to be segmented includes:

[0015] The target pcap file containing the pcap data packets to be segmented is read using the pcapreader method of the scapy library.

[0016] Optionally, matching the five-tuple information in the target CSV file with the target pcap file includes:

[0017] Read the five-tuple information and the file name corresponding to the pcap data packet to be segmented in the target CSV file, and store the five-tuple information and the file name in a dictionary to obtain a target dictionary corresponding to the target CSV file;

[0018] Match the five-tuple information in the target dictionary with the target pcap file.

[0019] Optionally, after matching the five-tuple information in the target dictionary with the target pcap file, the method further includes:

[0020] If the match is successful, the pcap data packet to be segmented corresponding to the matched five-tuple information is segmented from the target pcap file, and the segmented corresponding pcap data packet is named using the file name corresponding to the matched five-tuple information.

[0021] Optionally, the step of segmenting the matched pcap data packet to be segmented from the target pcap file includes:

[0022] The pcapwriter method of the scapy library is used to segment the matched pcap data packets to be segmented from the target pcap file.

[0023] A second aspect of the present application provides a pcap data packet segmentation device, comprising:

[0024] A CSV file generation module is used to create a CSV blank file and write the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file;

[0025] A pcap file acquisition module is used to acquire a target pcap file containing the pcap data packets to be segmented;

[0026] A matching module is used to match the five-tuple information in the target CSV file with the target pcap file. If the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file.

[0027] A third aspect of the present application provides an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the aforementioned pcap data packet segmentation method.

[0028] The fourth aspect of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, the aforementioned pcap data packet segmentation method is implemented.

[0029] In this application, a CSV blank file is first created, and the five-tuple information corresponding to the pcap data packet to be segmented is written into the CSV blank file to obtain a target CSV file; then the target pcap file containing the pcap data packet to be segmented is obtained; finally, the five-tuple information in the target CSV file is matched with the target pcap file, and if the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file. It can be seen that this application generates a target CSV file by writing the five-tuple information corresponding to the pcap data packet to be segmented in the CSV blank file, and then uses the target CSV file to segment the pcap data packet to be segmented in the target pcap file. The entire segmentation process is automatically completed by the machine without manual intervention, and the operation is simple and convenient, thereby avoiding errors in manual search of data packets and improving the efficiency and accuracy of pcap data packet segmentation. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0031] Figure 1 A flow chart of a pcap data packet segmentation method provided by this application;

[0032] Figure 2 A schematic diagram of a specific pcap data packet segmentation method provided by this application;

[0033] Figure 3 A schematic diagram of the structure of a pcap data packet segmentation device provided by this application;

[0034] Figure 4 A structural diagram of a pcap data packet segmentation electronic device provided in this application. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Existing pcap data packet segmentation is mostly completed by manual operation. For a pcap file of large magnitude, the file contains a lot of session information. If we want to segment some of the session data packets we want and then analyze these sessions separately, we need to search manually one by one at this time, and then save the searched data packets in pcap format. If there are only a few data packets to be segmented, manual search can also be achieved quickly, but if there are thousands of data packets to be segmented, still using manual search and segmentation methods will waste a lot of time and be difficult, resulting in very low segmentation efficiency. In view of the above technical defects, the present application provides a pcap data packet segmentation solution, which generates a target CSV file by writing the five-tuple information corresponding to the pcap data packet to be segmented in a CSV blank file, and then uses the target CSV file to segment the pcap data packets to be segmented in the target pcap file. The entire segmentation process is automatically completed by the machine without manual intervention, and the operation is simple and convenient, thereby avoiding errors in manual search of data packets and improving the efficiency and accuracy of pcap data packet segmentation.

[0037] Figure 1A flow chart of a pcap data packet segmentation method provided in an embodiment of the present application. Figure 1 As shown, the pcap data packet segmentation method includes:

[0038] S11: Create a CSV blank file, and write the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file.

[0039] In this embodiment, a CSV blank file is created, and the five-tuple information corresponding to the pcap data packet to be segmented is written into the CSV blank file to obtain a target CSV file. The user writes the five-tuple information related to the data packet to be found into the CSV blank file, wherein the five-tuple information refers to a set consisting of five quantities: source IP address, source port, destination IP address, destination port and transport layer protocol, corresponding to the session information of a pcap data packet. Using CSV files to segment pcap files can better adapt to script programs. Of course, an EXCL file with the five-tuple information can be used to replace the target CSV file in this embodiment.

[0040] Prior to this, it is necessary to first determine the five-tuple information of the pcap data packet to be segmented, and generate a file name of the pcap data packet to be segmented that has a unique correspondence with the five-tuple information according to the target requirements; then, according to the unique correspondence between the five-tuple information and the file name, the five-tuple information and the file name corresponding to the pcap data packet to be segmented are written into the CSV blank file to obtain the target CSV file. The file name is used to name the pcap data packet to be segmented when exporting it. At the same time, one pcap data packet to be segmented uniquely corresponds to one file name and one five-tuple information, which is convenient for subsequent storage in the form of key-value pairs to improve matching efficiency.

[0041] S12: Obtain a target pcap file containing the pcap data packets to be segmented.

[0042] In this embodiment, after obtaining the target CSV file, the target pcap file containing the pcap data packet to be segmented is obtained. Specifically, the target pcap file containing the pcap data packet to be segmented is first read, and then the read target pcap file is loaded into the memory for matching. For example, the pcapreader method of the scapy library can be used to read the target pcap file containing the pcap data packet to be segmented, that is, the original pcap file is read into the memory through the PcapReader method of the scapy library of python.

[0043] S13: Match the five-tuple information in the target CSV file with the target pcap file. If the match is successful, segment the matched pcap data packet to be segmented from the target pcap file.

[0044] In this embodiment, the five-tuple information in the target CSV file is matched with the target pcap file. If the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file. The above process specifies the conditions for segmenting data packets and is automatically completed by the machine. The whole process does not require manual intervention and takes only seconds, which is very convenient and fast, greatly saving labor costs.

[0045] Based on the above embodiment, the matching process of step S13 is as follows: Figure 2 As shown, first read the five-tuple information and the file name corresponding to the pcap data packet to be segmented in the target CSV file, and the CSV file can be read through the open function of Python and the reader method in the CSV library. Then store the five-tuple information and the file name in a dictionary to obtain a target dictionary corresponding to the target CSV file. Save the read five-tuple information and the pre-segmented file name as a dictionary dict1, where the key of the dictionary dict1 is the file name, and the value of the dictionary dict1 is the five-tuple information.

[0046] Finally, the five-tuple information in the target dictionary is matched with the target pcap file. The contents of the dictionary dict1 can be traversed through a for loop, and the five-tuple information in the dictionary dict1 can be matched one by one from the memory block of the original pcap that has been read. If the match is successful, the pcap data packet to be segmented corresponding to the matched five-tuple information is segmented from the target pcap file, and the pcapwriter method of the scapy library can be used to segment the matched pcap data packet to be segmented from the target pcap file. And the corresponding pcap data packet segmented is named using the file name corresponding to the matched five-tuple information. That is, if the match is successful, the data packet corresponding to the five-tuple is segmented through the PcapWriter method of python, and the name of the segmented data packet is the key corresponding to the dictionary element; if the match fails, the next element of the dictionary is read, and the data packets are matched one by one from the memory block of the original pcap that has been read until all elements in the dictionary are traversed. The above process writes the packet segmentation conditions into a CSV file and then combines the Python dictionary and scapy library to read the original pcap file to segment the desired pcap packets. As long as the user writes the specified five-tuple information, the entire process of searching and segmenting the packet is automatically completed by the machine, and the desired pcap packets can be segmented automatically and quickly.

[0047] It can be seen that the embodiment of the present application first creates a CSV blank file, and writes the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file; then obtains the target pcap file containing the pcap data packet to be segmented; finally, the five-tuple information in the target CSV file is matched with the target pcap file, and if the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file. The embodiment of the present application generates a target CSV file by writing the five-tuple information corresponding to the pcap data packet to be segmented in the CSV blank file, and then uses the target CSV file to segment the pcap data packet to be segmented in the target pcap file. The entire segmentation process is automatically completed by the machine without manual intervention, and the operation is simple and convenient, thereby avoiding errors in manual search of data packets and improving the efficiency and accuracy of pcap data packet segmentation.

[0048] See also Figure 3 As shown, the embodiment of the present application also discloses a pcap data packet segmentation device, including:

[0049] The CSV file generation module 11 is used to create a CSV blank file and write the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file;

[0050] A pcap file acquisition module 12 is used to acquire a target pcap file containing the pcap data packets to be segmented;

[0051] The matching module 13 is used to match the five-tuple information in the target CSV file with the target pcap file. If the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file.

[0052] It can be seen that the embodiment of the present application first creates a CSV blank file, and writes the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file; then obtains the target pcap file containing the pcap data packet to be segmented; finally, the five-tuple information in the target CSV file is matched with the target pcap file, and if the match is successful, the matched pcap data packet to be segmented is segmented from the target pcap file. The embodiment of the present application generates a target CSV file by writing the five-tuple information corresponding to the pcap data packet to be segmented in the CSV blank file, and then uses the target CSV file to segment the pcap data packet to be segmented in the target pcap file. The entire segmentation process is automatically completed by the machine without manual intervention, and the operation is simple and convenient, thereby avoiding errors in manual search of data packets and improving the efficiency and accuracy of pcap data packet segmentation.

[0053] In some specific embodiments, the CSV file generation module 11 specifically includes:

[0054] A determination unit, used for determining the five-tuple information of the pcap data packet to be segmented, and generating a file name of the pcap data packet to be segmented that has a unique corresponding relationship with the five-tuple information according to target requirements;

[0055] A writing unit is used to write the quintuple information and the file name corresponding to the pcap data packet to be segmented into the CSV blank file according to the unique correspondence between the quintuple information and the file name, so as to obtain the target CSV file.

[0056] In some specific embodiments, the pcap file acquisition module 12 is specifically used to read the target pcap file containing the pcap data packets to be segmented, and load the read target pcap file into the memory for matching.

[0057] In some specific embodiments, the matching module 13 specifically includes:

[0058] A dictionary generating unit, used for reading the five-tuple information and the file name corresponding to the pcap data packet to be segmented in the target CSV file, and storing the five-tuple information and the file name in a dictionary manner to obtain a target dictionary corresponding to the target CSV file;

[0059] A traversal unit, used for matching the five-tuple information in the target dictionary with the target pcap file;

[0060] A segmentation unit is used to segment the matched pcap data packets to be segmented from the target pcap file by using the pcapwriter method of the scapy library;

[0061] Correspondingly, in some specific embodiments, the pcap data packet segmentation device also includes:

[0062] A naming module is used to segment the pcap data packets to be segmented corresponding to the matched five-tuple information from the target pcap file if the match is successful, and name the segmented corresponding pcap data packets using the file name corresponding to the matched five-tuple information.

[0063] Furthermore, an embodiment of the present application also provides an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0064] Figure 4 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the pcap data packet segmentation method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be a server.

[0065] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0066] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0067] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the pcap data packet segmentation method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. The data 223 can include the five-tuple information collected by the electronic device 20.

[0068] Furthermore, an embodiment of the present application also discloses a storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the pcap data packet segmentation method steps disclosed in any of the aforementioned embodiments are implemented.

[0069] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0070] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0071] The pcap data packet segmentation method, device, equipment and storage medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A pcap data packet segmentation method, characterized in that, include: Create a CSV blank file, and write the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file; Obtain a target pcap file containing the pcap data packets to be segmented; Match the five-tuple information in the target CSV file with the target pcap file, and if the match is successful, segment the matched pcap data packets to be segmented from the target pcap file; Among them, matching the quintuple information in the target CSV file with the target pcap file includes: reading the quintuple information and file name corresponding to the pcap data packet to be segmented in the target CSV file, and storing the quintuple information and the file name in a dictionary manner to obtain a target dictionary corresponding to the target CSV file; matching the quintuple information in the target dictionary with the target pcap file.

2. The pcap data packet segmentation method according to claim 1, wherein The five-tuple information corresponding to the pcap data packet to be segmented is written into the blank CSV file to obtain the target CSV file, including: Determine the five-tuple information of the pcap data packet to be segmented, and generate a file name of the pcap data packet to be segmented that has a unique corresponding relationship with the five-tuple information according to target requirements; According to the unique correspondence between the five-tuple information and the file name, the five-tuple information and the file name corresponding to the pcap data packet to be segmented are written into the CSV blank file to obtain the target CSV file.

3. pcap data packet segmentation method according to claim 2, characterized in that, The step of obtaining a target pcap file containing the pcap data packets to be segmented comprises: Read the target pcap file containing the pcap data packets to be segmented, and load the read target pcap file into memory for matching.

4. The pcap data packet segmentation method according to claim 3, wherein: The reading of the target pcap file containing the pcap data packets to be segmented comprises: The target pcap file containing the pcap data packets to be segmented is read using the pcapreader method of the scapy library.

5. The pcap data packet segmentation method according to claim 1, wherein: After matching the five-tuple information in the target dictionary with the target pcap file, the method further includes: If the match is successful, the pcap data packet to be segmented corresponding to the matched five-tuple information is segmented from the target pcap file, and the segmented corresponding pcap data packet is named using the file name corresponding to the matched five-tuple information.

6. The pcap data packet segmentation method according to any one of claims 1 to 5, characterized in that: The step of segmenting the matched pcap data packet to be segmented from the target pcap file comprises: The pcapwriter method of the scapy library is used to segment the matched pcap data packets to be segmented from the target pcap file.

7. A pcap data packet segmentation device, characterized in that: include: A CSV file generation module is used to create a CSV blank file and write the five-tuple information corresponding to the pcap data packet to be segmented into the CSV blank file to obtain a target CSV file; A pcap file acquisition module is used to acquire a target pcap file containing the pcap data packets to be segmented; A matching module, used for matching the five-tuple information in the target CSV file with the target pcap file, and if the match is successful, segmenting the matched pcap data packet to be segmented from the target pcap file; Among them, matching the quintuple information in the target CSV file with the target pcap file includes: reading the quintuple information and file name corresponding to the pcap data packet to be segmented in the target CSV file, and storing the quintuple information and the file name in a dictionary manner to obtain a target dictionary corresponding to the target CSV file; matching the quintuple information in the target dictionary with the target pcap file.

8. An electronic device, characterized in that: The electronic device comprises a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the pcap data packet segmentation method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Used to store computer executable instructions, which, when loaded and executed by a processor, implement the pcap data packet segmentation method as described in any one of claims 1 to 6.

Images