A method and device for TCP session reassembly

Abstract

The present invention provides a method and apparatus for TCP session reorganization. A method and apparatus for TCP session reorganization, wherein a TCP session reorganization apparatus includes a TCP transmission channel establishment module, a data packet acquisition module, a data processing module, a TCP session linked list management module, a TCP session assembly linked list management module, a positioning node management module, and a session ID matching module. The present invention is based on the fact that in a high-traffic network environment, multiple data packets split into a segment of data are always transmitted in adjacent order. By matching data packets near the last located node, the number of matches is reduced, thereby improving the positioning and reorganization efficiency of the TCP session.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and more particularly to a method and device for TCP session reassembly. Background Art

[0002] In the current Internet data transmission process, the local host needs to follow strict Internet protocols when transmitting data to the target host. Internet protocols include Ethernet protocol, IP protocol, TCP transmission control protocol and application layer protocol. Since the Ethernet data packets defined in the Ethernet protocol have a fixed size, it is often necessary to split a piece of data into multiple data packets when transmitting data; then the multiple data packets are restored into a complete piece of data and transmitted to the application layer.

[0003] The TCP Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol widely used for network data transmission. When using TCP to transmit data, data must be split into multiple packets and reassembled to restore a complete TCP session. In real-world networks, especially those with high traffic volume, numerous TCP sessions can occur simultaneously on the same network node. The efficiency of TCP session reassembly directly impacts data parsing at the application layer.

[0004] Currently, TCP session reassembly typically uses the following method: upon receiving a data packet, the destination TCP session is located by sequentially comparing the five-tuple information in the TCP session list. The current session is then reassembled using information such as the sequence number in the data packet. This reassembly method is suitable for networks with low traffic volume. However, on high-traffic networks, comparing the TCP session five-tuple consumes significant computer performance and time, making it less practical. This, in turn, impacts subsequent data parsing at the application layer. Summary of the Invention

[0005] The present invention is based on the fact that in a high-traffic network environment, a piece of data is split into multiple data packets that are always transmitted in adjacent order. According to the node located last time, the data packets are matched near this node, thereby reducing the number of matches and improving the positioning and reorganization efficiency of the TCP session.

[0006] A method for TCP session reassembly, comprising the following steps:

[0007] S1: Establish a connection between the target host and the local host, create an empty TCP session list TcpSessionList, and enter S2;

[0008] S2: Get the data packet, which includes Ethernet header information, IP header information, and TCP data. The TCP data includes the syn layer, fin layer, seq layer, len layer, prev layer, next layer, and tcpdata layer, and enter S3.

[0009] S3: Search the value syn stored in the syn layer of this data packet according to the index, and determine whether "syn==1" is true. If "syn==1" is true, enter S4; if "syn==1" is not true, enter S7;

[0010] S4: Determine whether the TCP session list TcpSessionList is empty. If the TCP session list TcpSessionList is empty, proceed to S5; if the TCP session list TcpSessionList is not empty, proceed to S6.

[0011] S5: Search for the IP header information of this data packet according to the index, generate a unique session ID based on the IP header information, generate a node sequence number TSLindex and establish a corresponding TCP session assembly list TcpList, and map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet to the TCP session list TcpSessionList one by one, where each node sequence number TSLindex corresponds to a node; at the same time, add the TCP data corresponding to this data packet to the TCP session assembly list TcpList, store this node sequence number TSLindex in the positioning node management module, record it as the positioning node PostLindex, and return to S2;

[0012] S6: Release the node sequence number TSLindex stored in the positioning node management module, search the IP header information of this data packet according to the index, generate a unique session ID according to the IP header information, obtain the largest TSLindex in the TCP session list TcpSessionList, and assign TSLindex+1 to TSLindex. This TSLindex is the node sequence number TSLindex corresponding to this data packet, establish the corresponding TCP session assembly list TcpList, map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet to the end of the TCP session list TcpSessionList one by one, and add the TCP data corresponding to this data packet to the TCP session assembly list TcpList. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2;

[0013] S7: Find the corresponding node in the TCP session list TcpSessionList according to the node sequence number TSLindex stored in the positioning node management module, search the IP header information of the data packet according to the index, generate a session ID based on the IP header information, and enter S8;

[0014] S8: Match this session ID with the session IDs corresponding to all node numbers TSLindex that satisfy "PostLindex-r≤TSLindex≤PostLindex+r" one by one, where r is a preset node range. If the match is successful, proceed to S9; if the match fails, proceed to S10;

[0015] S9: Obtain the node sequence number TSLindex corresponding to the successful match, and add the TCP data corresponding to this data packet to the TCP session assembly linked list TcpList corresponding to this node sequence number TSLindex. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2;

[0016] S10: Determine whether all nodes have been traversed during the matching process. If not, proceed to S11; if all nodes have been traversed, proceed to S12.

[0017] S11: Assign r+w to r, where w is the node range expansion coefficient, which can be adjusted through autonomous learning, and return to S8;

[0018] S12: Get the largest TSLindex in the TCP session list TcpSessionList, and assign TSLindex+1 to TSLindex. This TSLindex is the node sequence number TSLindex corresponding to this data packet, establish the corresponding TCP session assembly list TcpList, map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet one by one and add them to the end of the TCP session list TcpSessionList, and add the TCP data corresponding to this data packet to the TCP session assembly list TcpList. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2;

[0019] While executing step S5, step S6, step S9 and step S12, the TCP session assembly list TcpList reassembles the data packets according to the TCP data to restore the original data.

[0020] As a preferred aspect, in TCP data, the syn layer is used to record the beginning of a segment of data, represented by 1; the fin layer is used to record the end of a segment of data, represented by 0; the seq layer is used to record the data sequence number of this data packet; the len layer is used to record the length of the data to be transmitted in this data packet; the prev layer is used to record the data sequence number of the previous data packet in sequence; the next layer is used to record the data sequence number of the next data packet in sequence; and the tcpdata layer is used to store the data to be transmitted in this data packet.

[0021] As a preferred aspect, in the same TCP data, the data sequence number of the next layer is the data sequence number of the seq layer plus the length of the data to be transmitted in this data packet.

[0022] As a preferred aspect, in the TCP session assembly list TcpList, a data packet with a syn layer value of 1 is selected as the starting node of the TCP session assembly list TcpList, the data sequence number of the next layer corresponding to this data packet is obtained, and the data packet corresponding to the seq layer with the same data sequence number is found as the next data node of the TCP session assembly list TcpList, and the data sequence number of the prev layer corresponding to this data node is matched with the data sequence number corresponding to the seq layer of the previous data node. If the match fails, the link of this data packet is disconnected, and the search for the data packet corresponding to the seq layer with the same data sequence number as the next layer corresponding to this data packet continues; if the match is successful, the search for the next data node of the TCP session assembly list TcpList is continued, and the data nodes in the TCP session assembly list TcpList are assembled. When the data sequence number of the next layer corresponding to the data packet is empty and the value of the fin layer is 0, the assembly of the TCP session is completed.

[0023] As a preferred aspect, the IP header information is stored in the form of a five-tuple, including a source IP address, a destination IP address, a source port, a destination port and a protocol number.

[0024] As a preferred aspect, in step S10, after determining that all nodes have been traversed, the process does not proceed to S12; instead, the session ID corresponding to the data packet is stored. In steps S5 and S6, whenever a unique session ID is generated, it is matched with the stored session ID. If the match fails, no operation is performed. If the match is successful, a prompt message is sent to the local host corresponding to the source IP address based on the source IP address corresponding to the successfully matched session ID, reminding the local host to transmit data again, and the stored session ID is deleted.

[0025] A device for TCP session reassembly, comprising:

[0026] TCP transmission channel establishment module, used to establish a connection between the target host and the local host;

[0027] The data packet acquisition module is used to acquire data packets, which include Ethernet header information, IP header information and TCP data. The TCP data includes syn layer, fin layer, seq layer, len layer, prev layer, next layer and tcpdata layer.

[0028] The data processing module is used to judge the value stored in the syn layer of the data packet, determine whether the TCP session list is empty, generate a session ID, and generate a node sequence number;

[0029] TCP session list management module, used to establish, store and modify the TCP session list;

[0030] TCP session assembly linked list management module, used to establish, store and modify the TCP session assembly linked list;

[0031] Positioning node management module, used to store and release the node serial number corresponding to each successful session ID match;

[0032] The session ID matching module is used to match the session ID corresponding to the data packet with the session ID inside the TCP session list.

[0033] As a preferred aspect, it also includes:

[0034] A session ID storage module is used to store the session ID of the data packet whose beginning cannot be found;

[0035] The reminding module is used to remind the local host to perform data transmission again according to the session ID stored in the session ID storage module.

[0036] The present invention has the following advantages:

[0037] 1. The present invention is based on the fact that in a high-traffic network environment, a piece of data is split into multiple data packets that are always transmitted in adjacent order. According to the node located last time, the data packets are matched near this node to reduce the number of matches and improve the positioning and reorganization efficiency of the TCP session.

[0038] 2. The present invention ensures the integrity and accuracy of the data packet during the reassembly process by matching the data sequence number of the prev layer corresponding to this data node with the data sequence number of the seq layer corresponding to the previous data node.

[0039] 3. The present invention stores the session ID of the data packet that cannot be found at the beginning instead of storing the entire data packet, thereby reducing storage space and the number of times the data packet is matched, further improving the reorganization efficiency of the TCP session. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic diagram of the structure of the device for TCP session reassembly adopted in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention. Example 1

[0042] In a specific embodiment, taking 10G bandwidth to transmit TCP data as an example, the traffic volume per second is approximately 1.25G. Assuming that the average length of each data packet is 1000 bytes (in actual networks, the average length of a data packet is generally around 500 to 700 bytes), the number of data packets transmitted per second is approximately 1.34 million. Among these approximately 1.34 million data packets, assuming that every 10 data packets belong to the same TCP session, the TCP reassembly list has approximately 134,000 TCP sessions. Assuming that each data packet only needs to compare 1 / 3 of the list to find the corresponding TCP session, it will take approximately 5.98 million matches to find the corresponding TCP session for all 1.34 million data packets. If the TCP five-tuple is not processed accordingly during the matching process, the number of matches will double accordingly. It can be seen that in a high-traffic network, in the process of TCP session reassembly, finding the corresponding TCP session for each data packet consumes a lot of computer performance. In response to this situation, a method for TCP session reassembly is proposed, which includes the following steps:

[0043] S1: Establish a connection between the target host and the local host, create an empty TCP session list TcpSessionList, and enter S2;

[0044] S2: Get the data packet, which includes Ethernet header information, IP header information and TCP data. The IP header information is stored in the form of a five-tuple, including source IP address, destination IP address, source port, destination port and protocol number. The TCP data includes syn layer, fin layer, seq layer, len layer, prev layer, next layer and tcpdata layer, and enters S3. The syn layer is used to record the beginning of a piece of data, represented by 1; the fin layer is used to record the end of a piece of data, represented by 0; among the multiple data packets split into a piece of data, only one data packet has a syn layer of 1, one data packet has a fin layer of 0, and the syn layer and fin layer of the remaining data packets are both 2; the seq layer is used to record the data sequence number of this data packet; the len layer is used to record the length of the data to be transmitted in this data packet; the prev layer is used to record the data sequence number of the previous data packet in sequence; the next layer is used to record the data sequence number of the next data packet in sequence; the tcpdata layer is used to store the data to be transmitted in this data packet; in the same TCP data, the data sequence number of the next layer is the data sequence number of the seq layer plus the length of the data to be transmitted in this data packet;

[0045] S3: Search the value syn stored in the syn layer of this data packet according to the index and determine whether "syn==1" is true. If "syn==1" is true, it means that the obtained data packet is the beginning of a data segment and enters S4; if "syn==1" is not true, it means that this data packet is part of the ongoing TCP session reassembly and enters S7;

[0046] S4: Determine whether the TCP session list TcpSessionList is empty. If the TCP session list TcpSessionList is empty, it means that there is no content in the TCP session list TcpSessionList, and enter S5; if the TCP session list TcpSessionList is not empty, it means that there is content in the TCP session list TcpSessionList, and enter S6;

[0047] S5: Search for the IP header information of this data packet according to the index, calculate the five-tuple information of the IP header information through the hash algorithm, generate a unique session ID, generate the node sequence number TSLindex and establish the corresponding TCP session assembly list TcpList, and map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet to the TCP session list TcpSessionList one by one, where each node sequence number TSLindex corresponds to a node; at the same time, add the TCP data corresponding to this data packet to the TCP session assembly list TcpList, store this node sequence number TSLindex in the positioning node management module, record it as the positioning node PostLindex, and return to S2;

[0048] S6: Release the node sequence number TSLindex stored in the positioning node management module, search for the IP header information of this data packet according to the index, calculate the unique session ID according to the five-tuple information of the IP header information through the hash algorithm, obtain the largest TSLindex in the TCP session list TcpSessionList, and assign TSLindex+1 to TSLindex. This TSLindex is the node sequence number TSLindex corresponding to this data packet, establish the corresponding TCP session assembly list TcpList, map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet to the end of the TCP session list TcpSessionList one by one, and add the TCP data corresponding to this data packet to the TCP session assembly list TcpList. Store this node sequence number TSLindex in the positioning node management module and record it as positioning node PostLindex. Return to S2;

[0049] S7: Find the corresponding node in the TCP session list TcpSessionList according to the node sequence number TSLindex stored in the positioning node management module, search for the IP header information of this data packet according to the index, calculate the session ID based on the five-tuple information of the IP header information through the hash algorithm, and enter S8;

[0050] S8: Match this session ID with the session IDs corresponding to all node numbers TSLindex that satisfy "PostLindex-r≤TSLindex≤PostLindex+r" one by one, where r is a preset node range determined by the actual network environment traffic. If the match is successful, it means that the TCP session corresponding to this data packet has been found, and enter S9; if the match fails, it means that the TCP session corresponding to this data packet has not been found, and enter S10;

[0051] In a high-traffic network environment, multiple data packets split from a piece of data are always transmitted in adjacent order. Based on the node last located, the data packets are matched near this node to reduce the number of matches and improve the efficiency of TCP session location and reassembly.

[0052] S9: Obtain the node sequence number TSLindex corresponding to the successful match, and add the TCP data corresponding to this data packet to the TCP session assembly linked list TcpList corresponding to this node sequence number TSLindex. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2;

[0053] S10: Determine whether all nodes have been traversed during the matching process. If not, proceed to S11; if all nodes have been traversed, proceed to S12.

[0054] S11: Assign r+w to r, where w is the node range expansion coefficient, which can be adjusted through autonomous learning, and return to S8;

[0055] S12: Get the largest TSLindex in the TCP session list TcpSessionList, and assign TSLindex+1 to TSLindex. This TSLindex is the node sequence number TSLindex corresponding to this data packet, establish the corresponding TCP session assembly list TcpList, map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet one by one and add them to the end of the TCP session list TcpSessionList, and add the TCP data corresponding to this data packet to the TCP session assembly list TcpList. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2;

[0056] While executing step S5, step S6, step S9 and step S12, the TCP session assembly list TcpList reassembles the data packets according to the TCP data to restore the original data.

[0057] In the TCP session assembly list TcpList, select the data packet with the syn layer value of 1 as the starting node of the TCP session assembly list TcpList, obtain the data sequence number of the next layer corresponding to this data packet, find the data packet corresponding to the seq layer with the same data sequence number as the next data node of the TCP session assembly list TcpList, and match the data sequence number of the prev layer corresponding to this data node with the data sequence number corresponding to the seq layer of the previous data node. If the match fails, it means that the data packet corresponding to this data node does not belong to the same type of data. Disconnect the link of this data packet and continue to look for the data packet corresponding to the seq layer with the same data sequence number of the next layer corresponding to this data packet; if the match is successful, continue to search for the next data node of the TCP session assembly list TcpList, assemble the data nodes in the TCP session assembly list TcpList, and when the data sequence number of the next layer corresponding to the data packet is empty and the value of the fin layer is 0, the assembly of the TCP session is completed.

[0058] The present invention ensures the integrity and accuracy of the data packet during the reassembly process by matching the data sequence number of the prev layer corresponding to the data node with the data sequence number of the seq layer corresponding to the previous data node.

[0059] In specific implementation, due to network fluctuations and data verification errors, problems such as mistransmission or retransmission may occur during the transmission of data packets. In the case of mistransmission, a data packet cannot find its beginning. If a node in the TCP session list TcpSessionList is also established for it in step S12, it is obviously a waste of space and will increase the number of matches of the session ID in step S8, reducing the efficiency of the TCP session reorganization. Therefore, in step S10, it is determined that all nodes have been traversed and S12 is no longer entered; instead, the session ID corresponding to this data packet is stored. In steps S5 and S6, whenever a unique session ID is generated, it is matched with the stored session ID. If the match fails, no operation is performed. If the match is successful, a prompt message is sent to the local host corresponding to the source IP address according to the source IP address corresponding to the successfully matched session ID, reminding the local host to transmit data again and deleting the stored session ID.

[0060] The present invention stores the session ID of the data packet that cannot be found at the beginning instead of storing the entire data packet, thereby reducing storage space and the number of times the data packet is matched, thereby further improving the reorganization efficiency of the TCP session. Example 2

[0061] A device for TCP session reassembly, such as Figure 1 Shown, including:

[0062] The TCP transmission channel establishment module is used to establish a connection between the target host and the local host, and realizes the connection by exchanging three messages;

[0063] The data packet acquisition module is used to obtain data packets during TCP transmission. The data packets include Ethernet header information, IP header information and TCP data. The TCP data includes syn layer, fin layer, seq layer, len layer, prev layer, next layer and tcpdata layer.

[0064] The data processing module is used to judge the value stored in the syn layer of the data packet, determine whether the TCP session list is empty, generate a session ID, and generate a node sequence number;

[0065] TCP session list management module, used to establish, store and modify the TCP session list;

[0066] TCP session assembly linked list management module, used to establish, store and modify the TCP session assembly linked list;

[0067] The positioning node management module is used to store and release the node serial number corresponding to each successful session ID match, which facilitates the positioning of subsequent session ID matches;

[0068] The session ID matching module is used to match the session ID corresponding to the data packet with the session ID in the TCP session list according to the positioning node and the preset node range;

[0069] In order to store the session ID of the data packet that cannot be found at the beginning, such as Figure 1 As shown, the system also includes:

[0070] The session ID storage module is used to store the session ID of the data packet whose beginning cannot be found, so as to facilitate the subsequent retrieval of the data packet with the same session ID.

[0071] The reminder module is used to remind the local host to transmit data again according to the session ID stored in the session ID storage module to avoid data packet loss.

[0072] It should be understood that those skilled in the art may make improvements or modifications based on the above description, and all such improvements and modifications shall fall within the scope of protection of the appended claims. Any portion of this specification not described in detail is prior art known to those skilled in the art.

Claims

1. A method for TCP session reassembly, characterized in that: The steps include: S1: Establish a connection between the target host and the local host, create an empty TCP session list TcpSessionList, and enter S2; S2: Get the data packet, which includes Ethernet header information, IP header information, and TCP data. The TCP data includes the syn layer, fin layer, seq layer, len layer, prev layer, next layer, and tcpdata layer, and enter S3. S3: Search the value syn stored in the syn layer of this data packet according to the index, and determine whether "syn==1" is true. If "syn==1" is true, enter S4; if "syn==1" is not true, enter S7; S4: Determine whether the TCP session list TcpSessionList is empty. If the TCP session list TcpSessionList is empty, proceed to S5; if the TCP session list TcpSessionList is not empty, proceed to S6. S5: Search for the IP header information of this data packet according to the index, generate a unique session ID based on the IP header information, generate a node sequence number TSLindex and establish a corresponding TCP session assembly list TcpList, and map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet to the TCP session list TcpSessionList one by one, where each node sequence number TSLindex corresponds to a node; at the same time, add the TCP data corresponding to this data packet to the TCP session assembly list TcpList, store this node sequence number TSLindex in the positioning node management module, record it as the positioning node PostLindex, and return to S2; S6: Release the node sequence number TSLindex stored in the positioning node management module, search the IP header information of this data packet according to the index, generate a unique session ID according to the IP header information, obtain the largest TSLindex in the TCP session list TcpSessionList, and assign TSLindex+1 to TSLindex. This TSLindex is the node sequence number TSLindex corresponding to this data packet, establish the corresponding TCP session assembly list TcpList, map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet to the end of the TCP session list TcpSessionList one by one, and add the TCP data corresponding to this data packet to the TCP session assembly list TcpList. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2; S7: Find the corresponding node in the TCP session list TcpSessionList according to the node sequence number TSLindex stored in the positioning node management module, search the IP header information of the data packet according to the index, generate a session ID based on the IP header information, and enter S8; S8: Match this session ID with the session IDs corresponding to all node numbers TSLindex that satisfy "PostLindex-r≤TSLindex≤PostLindex+r" one by one, where r is a preset node range. If the match is successful, proceed to S9; if the match fails, proceed to S10; S9: Obtain the node sequence number TSLindex corresponding to the successful match, and add the TCP data corresponding to this data packet to the TCP session assembly linked list TcpList corresponding to this node sequence number TSLindex. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2; S10: Determine whether all nodes have been traversed during the matching process. If not, proceed to S11; if all nodes have been traversed, proceed to S12. S11: Assign r+w to r, where w is the node range expansion coefficient, which can be adjusted through autonomous learning, and return to S8; S12: Get the largest TSLindex in the TCP session list TcpSessionList, and assign TSLindex+1 to TSLindex. This TSLindex is the node sequence number TSLindex corresponding to this data packet, establish the corresponding TCP session assembly list TcpList, map the node sequence number TSLindex, session ID and TCP session assembly list TcpList corresponding to this data packet one by one and add them to the end of the TCP session list TcpSessionList, and add the TCP data corresponding to this data packet to the TCP session assembly list TcpList. Store this node sequence number TSLindex in the positioning node management module and record it as the positioning node PostLindex. Return to S2; While executing step S5, step S6, step S9 and step S12, the TCP session assembly list TcpList reassembles the data packets according to the TCP data to restore the original data.

2. A method for TCP session reorganization according to claim 1, characterized in that: In TCP data, the syn layer is used to record the beginning of a segment of data, represented by 1; the fin layer is used to record the end of a segment of data, represented by 0; the seq layer is used to record the data sequence number of this data packet; the len layer is used to record the length of the data to be transmitted in this data packet; the prev layer is used to record the data sequence number of the previous data packet in sequence; the next layer is used to record the data sequence number of the next data packet in sequence; and the tcpdata layer is used to store the data to be transmitted in this data packet.

3. A method for TCP session reorganization according to claim 2, characterized in that: In the same TCP data, the data sequence number of the next layer is the data sequence number of the seq layer plus the length of the data to be transmitted in this data packet.

4. A method for TCP session reorganization according to claim 3, characterized in that: In the TCP session assembly list TcpList, select the data packet with the syn layer value of 1 as the starting node of the TCP session assembly list TcpList, obtain the data sequence number of the next layer corresponding to this data packet, find the data packet corresponding to the seq layer with the same data sequence number as the next data node of the TCP session assembly list TcpList, and match the data sequence number of the prev layer corresponding to this data node with the data sequence number corresponding to the seq layer of the previous data node. If the match fails, disconnect the link of this data packet and continue to look for the data packet corresponding to the seq layer with the same data sequence number of the next layer corresponding to this data packet; if the match is successful, continue to search for the next data node of the TCP session assembly list TcpList, assemble the data nodes in the TCP session assembly list TcpList, and complete the assembly of the TCP session when the data sequence number of the next layer corresponding to the data packet is empty and the value of the fin layer is 0.

5. A method for TCP session reorganization according to claim 4, characterized in that: The IP header information is stored in the form of a five-tuple, including the source IP address, destination IP address, source port, destination port, and protocol number.

6. A method for TCP session reorganization according to claim 5, characterized in that: In step S10, after determining that all nodes have been traversed, the process does not proceed to S12; instead, the session ID corresponding to the data packet is stored. In steps S5 and S6, each time a unique session ID is generated, it is matched with the stored session ID. If the match fails, no operation is performed. If the match is successful, a prompt message is sent to the local host corresponding to the source IP address of the successfully matched session ID, reminding the local host to transmit data again, and the stored session ID is deleted.

7. A device for implementing the TCP session reassembly method according to any one of claims 1 to 6, characterized in that: include: TCP transmission channel establishment module, used to establish a connection between the target host and the local host; The data packet acquisition module is used to acquire data packets, which include Ethernet header information, IP header information and TCP data. The TCP data includes syn layer, fin layer, seq layer, len layer, prev layer, next layer and tcpdata layer. The data processing module is used to judge the value stored in the syn layer of the data packet, determine whether the TCP session list is empty, generate a session ID, and generate a node sequence number; TCP session list management module, used to establish, store and modify the TCP session list; TCP session assembly linked list management module, used to establish, store and modify the TCP session assembly linked list; Positioning node management module, used to store and release the node serial number corresponding to each successful session ID match; The session ID matching module is used to match the session ID corresponding to the data packet with the session ID inside the TCP session list.

8. The device according to claim 7, characterized in that Also includes: A session ID storage module is used to store the session ID of the data packet whose beginning cannot be found; The reminder module is used to remind the local host to perform data transmission again according to the session ID stored in the session ID storage module.

Images