A dedicated network message TCP segmentation method and device

Abstract

The present application provides a method and device for TCP segmentation of a dedicated network message. A transmission message protocol is used in a dedicated network, and the message structure in the Ethernet network is modified one by one, so that the devices in this network can perform dedicated transmission. First, the type field in the Ethernet frame in the Ethernet message is modified to distinguish between ordinary network and dedicated network devices. In order to ensure the network security in the link, the dedicated network needs to add an internal dedicated check code to the TCP header of the Ethernet data message. After adding the check code, the maximum transmission unit of the data message that has been TCP segmented in the Ethernet network may exceed the set maximum transmission unit again. In this embodiment, during the three-way handshake process, the maximum segment size in the handshake message is changed to the MSS setting value. When the MTU in the dedicated network message exceeds the set maximum transmission unit, it can be segmented again according to the MSS setting value.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for TCP segmentation of a dedicated network message. Background Art

[0002] At present, there are few solutions for the special transmission protocol message structure network whose Ethernet frame type is not IPv4 (for example, 0x0800). Existing network forwarding devices all use fragmentation technology for IP protocol when transmitting messages with MTU exceeding 1500 to ensure that the data frame is not larger than the MTU of the network. The message must be divided into multiple data packets that are no larger than the Ethernet interface before it can be sent. After the data arrives at the destination server, these fragmented messages are reassembled into a complete message and handed over to the upper-level application.

[0003] However, fragmentation and reassembly will consume certain CPU and other resources of the sender and receiver. In addition, fragmentation consumes more memory resources of the receiver, because the receiver needs to allocate memory space for each received fragment message so that reassembly can be completed after the last fragment message arrives. If a fragment message is lost during network transmission, the receiver will not be able to complete the reassembly. If the application process requires retransmission, the sender must retransmit all fragment messages instead of just the discarded fragment message. This inefficient retransmission behavior will bring additional consumption to the end system and network resources. Especially for the segmented messages constructed by hackers, but do not want the receiver to send the last fragment message, the receiver has to allocate memory space for all fragment messages. However, since the last fragment message will never arrive, the receiver's memory cannot be released in time, which is easy to fill up the receiver's memory, leaving the receiver with no memory resources to handle normal business, achieving the DOS attack effect.

[0004] In general, when the network forwarding device between the client and the dedicated network server transmits messages for the IP protocol, it uses fragmentation technology for messages with an MTU exceeding 1500, which may cause serious resource consumption. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a dedicated network message TCP segmentation method and device, so as to solve the problem that when the network forwarding device between the client and the dedicated network server transmits messages for the IP protocol, the fragmentation technology is used for the messages with MTU exceeding 1500, which may cause serious resource consumption.

[0006] A dedicated network message TCP segmentation method provided in an embodiment of the present application is applied to a network forwarding device between a client and a dedicated network server, and the method includes:

[0007] Obtain the Ethernet message sent by the client to the private network server, and change the Ethernet frame type field of the Ethernet message to the private network;

[0008] Determine whether the Ethernet message is a TCP message;

[0009] If the Ethernet message is a TCP message, a checksum with a fixed number of bytes is added to the TCP message;

[0010] Determine whether the TCP message is a handshake message;

[0011] If the TCP message is a handshake message, the MSS value in the handshake message is changed to the MSS setting value, and the data packet is encapsulated.

[0012] In the above technical scheme, first, in the Ethernet environment, the original Ethernet message is obtained. The transmission message protocol is used in the dedicated network, and the message structure in the Ethernet network is modified one by one, so that the devices in this network can perform dedicated transmission, making the network more secure. First, the type field in the Ethernet frame in the Ethernet message is modified, such as changing it to 0x8871. This type of message is a dedicated network identifier, which is used to distinguish between ordinary networks and dedicated network devices. In addition, for the security of the network in the link, the dedicated network needs to add an internal dedicated check code to the TCP header of the Ethernet data message, so that the special routing in the dedicated network can accurately forward it. After adding the check code, the data message that has been TCP segmented in the Ethernet network may have its MTU exceeding the set maximum transmission unit (usually 1500) again. In this embodiment, in the process of the three-way handshake, the MSS value in the handshake message is changed to the MSS setting value. When the MTU in the dedicated network message exceeds the set maximum transmission unit, it can be segmented again according to the MSS setting value. The data packet can be sent without using the fragmentation technology, avoiding the situation where the fragmentation technology causes serious resource consumption.

[0013] In some optional implementations, after determining whether the Ethernet message is a TCP message, the method further includes:

[0014] If the Ethernet message is not a TCP message, the data packet is directly encapsulated.

[0015] In the above technical solution, currently only TCP messages can be segmented, and non-TCP messages are directly encapsulated into data packets.

[0016] In some optional implementations, determining whether the TCP message is a handshake message includes:

[0017] Determine whether the Flags field type of the TCP message is request synchronization or confirm synchronization;

[0018] If the Flags field type of the TCP message is request synchronization or confirm synchronization, the TCP message is determined to be a handshake message;

[0019] If the Flags field type of the TCP message is not request synchronization or confirm synchronization, it is determined that the TCP message is a transmission message.

[0020] In some optional implementations, after determining that the TCP message is a transmission message, the method further includes:

[0021] Determine whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit;

[0022] If the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the TCP message is segmented according to the MSS setting value to obtain new data packets and encapsulate them.

[0023] In some optional implementations, segmenting the TCP message according to the MSS setting value includes:

[0024] Save the sequence number and confirmation number of the TCP message;

[0025] The TCP message is intercepted according to the MSS setting value, and the first sequence number and confirmation number of the first message intercepted are consistent with the sequence number and confirmation number of the TCP message; wherein, the intercepted transmission content length LEN=MSS setting value-TCP header data length, TCP header data length=IP packet header length+TCP packet header length;

[0026] The intercepted remaining data information is integrated with the TCP header data to obtain a second message; wherein the sequence number of the second message is the second sequence number, the second sequence number = the first sequence number + LEN, and the confirmation number of the second message is consistent with the confirmation number of the TCP message.

[0027] In some optional implementations, after determining whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the method further includes:

[0028] If the total IP length of the TCP message is less than the set maximum transmission unit, the data packet is directly encapsulated.

[0029] An embodiment of the present application provides a network forwarding device, including:

[0030] A change module is used to obtain an Ethernet message sent by a client to a private network server, and change an Ethernet frame type field of the Ethernet message to a private network;

[0031] The first judgment module is used to judge whether the Ethernet message is a TCP message; if the Ethernet message is a TCP message, a check code with a fixed number of bytes is filled into the TCP message;

[0032] The second judgment module is used to judge whether the TCP message is a handshake message; if the TCP message is a handshake message, the MSS value in the handshake message is changed to the MSS setting value, and the data packet is encapsulated.

[0033] In some optional implementations, the second determination module is further configured to determine that the TCP message is a transmission message when determining that the TCP message is not a handshake message;

[0034] The device also includes:

[0035] The third judgment module is used to judge whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit when the TCP message is a transmission message; if the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the TCP message is segmented according to the MSS setting value to obtain a new data packet and encapsulate it.

[0036] An electronic device provided in an embodiment of the present application includes: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, any of the above methods is performed.

[0037] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, any of the above methods is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A flowchart of a dedicated network message TCP segmentation method provided in an embodiment of the present application;

[0040] Figure 2 A functional module diagram of a network forwarding device provided in an embodiment of the present application;

[0041] Figure 3 A possible structural diagram of an electronic device provided in an embodiment of the present application.

[0042] Icons: 1-change module, 2-first judgment module, 3-second judgment module, 41-processor, 42-memory, 43-communication interface, 44-communication bus. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0044] Please refer to Figure 1 , Figure 1 A flowchart of a dedicated network message TCP segmentation method provided in an embodiment of the present application is applied to a network forwarding device between a client and a dedicated network server, specifically including:

[0045] Step 100: Obtain an Ethernet message sent by the client to the private network server, and change the Ethernet frame type field of the Ethernet message to a private network;

[0046] Step 200, determine whether the Ethernet message is a TCP message; if the Ethernet message is a TCP message, proceed to step 300;

[0047] Step 300: Fill the TCP message with a checksum of a fixed number of bytes;

[0048] Step 400, determine whether the TCP message is a handshake message; if the TCP message is a handshake message, proceed to step 500;

[0049] Step 500: Change the MSS value in the handshake message to the MSS setting value, and encapsulate the data packet.

[0050] In the embodiment of the present application, first, in the Ethernet environment, the original Ethernet message is obtained. The transmission message protocol is used in the dedicated network, and the message structure in the Ethernet network is modified one by one, so that the devices in this network can perform dedicated transmission, making its network more secure. First, the type field in the Ethernet frame in the Ethernet message is modified, such as changing it to 0x8871. This type of message is a dedicated network identifier, which is used to distinguish between ordinary networks and dedicated network devices. In addition, for the security of the network in the link, the dedicated network needs to add an internal dedicated check code to the TCP header of the Ethernet data message, so that the special routing in the dedicated network can accurately forward it. After adding the check code, the data message that has been TCP segmented in the Ethernet network may have its MTU exceeding the set maximum transmission unit (usually 1500) again. In this embodiment, in the process of the three-way handshake, the MSS value in the handshake message is changed to the MSS setting value. When the MTU in the dedicated network message exceeds the set maximum transmission unit, it can be segmented again according to the MSS setting value. The data packet can be sent without using the fragmentation technology, avoiding the situation where the fragmentation technology causes serious resource consumption.

[0051] Among them, during the TCP three-way handshake, the client sends a syn data packet to the server. The option in this data packet contains Maximum segment size: which is the abbreviation of the MSS field in this article. The meaning of this field: Maximum segment size (MaximumSegmentSize) is a parameter of the transmission control protocol, which defines the maximum amount of data in bytes that a computer or communication device can accept in a segment. It does not calculate the size of the TCP or IP protocol header. The IP data packet containing the TCP segment can be self-contained in a data packet or reconstructed from multiple IP fragments. In any case, the MSS limit is effective for the final reconstructed segment. The default TCP maximum segment size is 536. When a host wants to set the MSS to a non-default value, the MSS size is defined in the SYN packet during the handshake as a TCP option. Since the maximum segment size is controlled by a TCP parameter, the host can change it in any subsequent segment. Different MSS can be used for each direction of the data flow. To avoid IP fragmentation, the host should define the maximum segment size as the maximum IP data packet size minus the size of the IP and TCP protocol headers. A lower maximum segment size can reduce or eliminate IP fragmentation, but will result in increased protocol overhead.

[0052] In some optional implementations, after determining whether the Ethernet message is a TCP message, the method further includes: if the Ethernet message is not a TCP message, directly encapsulating the data packet. In the embodiment of the present application, currently only TCP messages can be segmented, and if it is not a TCP message, the data packet is directly encapsulated.

[0053] In some optional implementations, determining whether a TCP message is a handshake message includes: determining whether the Flags field type of the TCP message is request synchronization or confirmation synchronization; if the Flags field type of the TCP message is request synchronization or confirmation synchronization, determining that the TCP message is a handshake message; if the Flags field type of the TCP message is not request synchronization or confirmation synchronization, determining that the TCP message is a transmission message.

[0054] In some optional implementations, after determining that the TCP message is a transmission message, it also includes: judging whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit; if the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, segmenting the TCP message according to the MSS setting value, obtaining new data packets and encapsulating them.

[0055] In some optional embodiments, the TCP message is segmented according to the MSS setting value, including: saving the sequence number and confirmation number of the TCP message; intercepting the TCP message according to the MSS setting value, and the first sequence number and confirmation number of the intercepted first message are consistent with the sequence number and confirmation number of the TCP message; wherein, the intercepted transmission content length LEN = MSS setting value - TCP header data length, TCP header data length = IP packet header length + TCP packet header length; the intercepted remaining data information is integrated with the TCP header data to obtain a second message; wherein, the sequence number of the second message is the second sequence number, the second sequence number = the first sequence number + LEN, and the confirmation number of the second message is consistent with the confirmation number of the TCP message.

[0056] In some optional implementations, after determining whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, it also includes: if the total IP length of the TCP message is less than the set maximum transmission unit, directly encapsulating the data packet.

[0057] Please refer to Figure 2 , Figure 2 A functional module diagram of a network forwarding device provided in an embodiment of the present application specifically includes:

[0058] Modify module 1, used for obtaining the Ethernet message sent by the client to the private network server, and changing the Ethernet frame type field of the Ethernet message to the private network;

[0059] The first judgment module 2 is used to judge whether the Ethernet message is a TCP message; if the Ethernet message is a TCP message, fill the TCP message with a check code of a fixed number of bytes;

[0060] The second judgment module 3 is used to judge whether the TCP message is a handshake message; if the TCP message is a handshake message, the MSS value in the handshake message is changed to the MSS setting value, and the data packet is encapsulated.

[0061] In some optional implementations, the second judgment module is also used to determine that the TCP message is a transmission message when the TCP message is not a handshake message. In this embodiment, the network forwarding device also includes: a third judgment module, which is used to determine whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit when the TCP message is a transmission message; if the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the TCP message is segmented according to the MSS setting value to obtain a new data packet and encapsulate it.

[0062] This embodiment applies the above solution to the test of the private network intrusion detection device, and performs TCP segmentation again for the message with MTU exceeding 1500 in the private network, so that the device in the private network can receive and generate attack log information.

[0063] This example is based on a fully self-defined intrusion detection product, and describes the method for constructing test data for intrusion detection equipment in a dedicated network under an Ethernet network environment proposed by the present invention and the solution to the problem. According to the method described in the detailed description of the present invention, the specific process is as follows:

[0064] Build a test environment and connect the host directly to the intrusion detection device. The intrusion detection device directly detects the message traffic sent by the host.

[0065] Prepare Ethernet attack detection HTTP packets as original Ethernet packets.

[0066] All data packets in the Ethernet message are traversed through the Python script, and the type field in the Ethernet frame in the Ethernet message is changed to 0x8871 for the private network.

[0067] Determine whether the type field in the private network IP layer header message is TCP. If the type is not TCP, there is no need to change the message, and the message will not be unpacked or encapsulated. If the type is TCP, proceed to the next step.

[0068] In order to ensure the network security in the link, the private network needs to add a 20-byte internal special check code to the TCP header of the Ethernet message, so that the special routing in the private network can accurately forward it. By parsing the structure of the Ethernet message, the 20-byte check code content can be inserted after the IP header of the Ethernet message and before the TCP header. The original TCP header message contains a 14-byte Ethernet frame and a 20-byte IP header. The specific insertion position is a hexadecimal encoding length of 34 bytes, and the private network message can be obtained at 35 bytes. The header of the dedicated data packet includes a 20-byte IP packet header, a 20-byte check code, and a 20-byte TCP header.

[0069] The private network message adds 20 bytes to the Ethernet message, so the total length field of the message IP layer needs to be changed, adding 20 bytes to the original basic length to meet the message characteristics in the private network. The message length + 20 is the actual value in the private network message, and it is converted into a hexadecimal number to replace the original message value.

[0070] Use Python script to traverse and read Ethernet message files, and determine whether the Flags field type in the TCP header message is SYN_ACK or SYN message. TCP's SYN_ACK and SYN messages carry a 12-byte option field, which includes the MSS field. Then modify this field to the set MSS field length. Among them, SYN (synchronize) means requesting synchronization, and ACK means confirming synchronization.

[0071] Determine whether the total length of the IP header field of the message is greater than 1500. If the total length of the IP header does not exceed 1500, the message does not need to be segmented to meet the MTU less than 1500, and the intrusion detection device can receive the message. If the total length of the IP header field is greater than 1500, perform the following segmentation operations:

[0072] First, save the values ​​of the two fields Sequence number (948220590) and Acknowledgment number (2310020627) in the TCP header of this message. Because TCP is a reliable transmission protocol, the Sequence number and Acknowledgment number of the segmented message need to be modified accordingly to ensure the reliability of the test message. And copy the data before the TCP header of this message.

[0073] The TCP content of this message is segmented according to the set MSS value (the value is 1200), and this part generates the message Sequence number (948220590), Acknowledgment number (2310020627), and Len=1160.

[0074] The remaining data information intercepted from the TCP message is integrated with the TCP header data of this message, and the fields are set to Sequence number (948221915 = 948220590 + 1160), Acknowledgment number (2310020627), Len = 130. Since the service in the actual Ethernet message environment has already confirmed this part of the data, the original ACK confirmation message can be copied, and the fields are set to Acknowledgment number (948221915) and Sequence number (2310020627).

[0075] Figure 3 A possible structure of an electronic device provided by an embodiment of the present application is shown. Figure 3The electronic device includes: a processor 41, a memory 42 and a communication interface 43. These components are interconnected and communicate with each other through a communication bus 44 and / or other forms of connection mechanisms (not shown).

[0076] The memory 42 includes one or more (only one is shown in the figure), which may be, but not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The processor 41 and other possible components may access the memory 42, and read and / or write data therein.

[0077] The processor 41 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 41 can be a general-purpose processor, including a central processing unit (CPU), a micro control unit (MCU), a network processor (NP) or other conventional processors; it can also be a dedicated processor, including a neural network processor (NPU), a graphics processor (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. In addition, when there are multiple processors 41, some of them can be general-purpose processors and the other part can be dedicated processors.

[0078] The communication interface 43 includes one or more (only one is shown in the figure), which can be used to communicate directly or indirectly with other devices to exchange data. The communication interface 43 can include an interface for wired and / or wireless communication.

[0079] One or more computer program instructions may be stored in the memory 42 , and the processor 41 may read and execute these computer program instructions to implement the method provided in the embodiment of the present application.

[0080] Understandably, Figure 3 The structure shown is for illustration only. The electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different structures are shown. Figure 3 The components shown in the figure can be implemented by hardware, software or a combination thereof. The electronic device may be a physical device, such as a PC, a laptop, a tablet computer, a mobile phone, a server, an embedded device, etc., or a virtual device, such as a virtual machine, a virtualized container, etc. Moreover, the electronic device is not limited to a single device, but may also be a combination of multiple devices or a cluster consisting of a large number of devices.

[0081] The present application also provides a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are read and executed by a computer processor, the method provided by the present application is executed. For example, the computer-readable storage medium can be implemented as Figure 3 A memory 42 in an electronic device.

[0082] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0083] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0084] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0085] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0086] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A dedicated network message TCP segmentation method, characterized in that: A network forwarding device applied between a client and a dedicated network server, the method comprising: Obtaining an Ethernet message sent by a client to a private network server, and changing an Ethernet frame type field of the Ethernet message to a private network; Determine whether the Ethernet message is a TCP message; If the Ethernet message is a TCP message, fill the TCP message with a check code of a fixed number of bytes; Determine whether the TCP message is a handshake message; If the TCP message is a handshake message, then change the MSS value in the handshake message to the MSS setting value, and encapsulate the data packet; If the TCP message is a transmission message, determine whether the total IP length of the TCP message is greater than or equal to a set maximum transmission unit; If the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the TCP message is segmented according to the MSS setting value to obtain a new data packet and encapsulate it; The segmenting the TCP message according to the MSS setting value includes: Save the sequence number and confirmation number of the TCP message; The TCP message is intercepted according to the MSS setting value, and the first sequence number and confirmation number of the intercepted first message are consistent with the sequence number and confirmation number of the TCP message; wherein the intercepted transmission content length LEN=MSS setting value-TCP header data length, TCP header data length=IP packet header length+TCP packet header length; The intercepted remaining data information is integrated with the TCP header data to obtain a second message; wherein the sequence number of the second message is the second sequence number, the second sequence number = the first sequence number + LEN, and the confirmation number of the second message is consistent with the confirmation number of the TCP message.

2. The method according to claim 1, characterized in that After determining whether the Ethernet message is a TCP message, the method further includes: If the Ethernet message is not a TCP message, the data packet is directly encapsulated.

3. The method according to claim 1, characterized in that The determining whether the TCP message is a handshake message includes: Determine whether the Flags field type of the TCP message is request synchronization or confirm synchronization; If the Flags field type of the TCP message is request synchronization or confirm synchronization, determining that the TCP message is a handshake message; If the Flags field type of the TCP message is not request synchronization or confirm synchronization, it is determined that the TCP message is a transmission message.

4. The method according to claim 1, characterized in that After determining whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the method further includes: If the total IP length of the TCP message is less than the set maximum transmission unit, the data packet is directly encapsulated.

5. A network forwarding device, characterized in that: include: A changing module, used for acquiring an Ethernet message sent by a client to a private network server, and changing an Ethernet frame type field of the Ethernet message to a private network; A first judging module, used to judge whether the Ethernet message is a TCP message; If the Ethernet message is a TCP message, fill the TCP message with a check code of a fixed number of bytes; A second judgment module is used to judge whether the TCP message is a handshake message; If the TCP message is a handshake message, then change the MSS value in the handshake message to the MSS setting value, and encapsulate the data packet; A third judgment module is used to judge whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit when the TCP message is a transmission message; If the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the TCP message is segmented according to the MSS setting value to obtain a new data packet and encapsulate it; The segmenting the TCP message according to the MSS setting value includes: Save the sequence number and confirmation number of the TCP message; The TCP message is intercepted according to the MSS setting value, and the first sequence number and confirmation number of the intercepted first message are consistent with the sequence number and confirmation number of the TCP message; wherein the intercepted transmission content length LEN=MSS setting value-TCP header data length, TCP header data length=IP packet header length+TCP packet header length; The intercepted remaining data information is integrated with the TCP header data to obtain a second message; wherein the sequence number of the second message is the second sequence number, the second sequence number = the first sequence number + LEN, and the confirmation number of the second message is consistent with the confirmation number of the TCP message. If the TCP message is a transmission message, determine whether the total IP length of the TCP message is greater than or equal to the set maximum transmission unit; If the total IP length of the TCP message is greater than or equal to the set maximum transmission unit, the TCP message is segmented according to the MSS setting value to obtain a new data packet and encapsulate it; The segmenting the TCP message according to the MSS setting value includes: Save the sequence number and confirmation number of the TCP message; The TCP message is intercepted according to the MSS setting value, and the first sequence number and confirmation number of the intercepted first message are consistent with the sequence number and confirmation number of the TCP message; wherein the intercepted transmission content length LEN=MSS setting value-TCP header data length, TCP header data length=IP packet header length+TCP packet header length; The intercepted remaining data information is integrated with the TCP header data to obtain a second message; wherein the sequence number of the second message is the second sequence number, the second sequence number = the first sequence number + LEN, and the confirmation number of the second message is consistent with the confirmation number of the TCP message.

6. The device according to claim 5, characterized in that The second judgment module is further configured to determine that the TCP message is a transmission message when it is determined that the TCP message is not a handshake message.

7. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method according to any one of claims 1 to 4 is performed.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, executes the method according to any one of claims 1 to 4.

Images