Data packet acquisition method and apparatus

Abstract

The application provides a data packet acquisition method and device, and relates to the technical field of network security. The method comprises the following steps: acquiring corresponding network data packets from a user state through at least one engine of a network device; storing the network data packets in a shared buffer area corresponding to each engine; the shared buffer area is a buffer area set in advance for the corresponding engine, and the shared buffer areas corresponding to the engines are different; and acquiring the network data packets in at least one shared buffer area through a packet capturing program. The application temporarily stores the network data packets in the shared buffer area, and the packet capturing program reads the network data packets in the shared buffer area, so that the network device does not need to switch between the user state and the kernel state, and the network data packets do not need to be copied multiple times, thereby reducing the occupied memory resources and processor resources, and improving the performance of the network device.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a data packet acquisition method and apparatus. Background Technology

[0002] Packet capture involves intercepting, retransmitting, editing, and saving data packets transmitted and received over a network, which is used to check network security. Packet capture is also frequently used for data interception and locating network topology problems.

[0003] In related technologies, network devices typically use tools like tcpdump to capture network packets, such as... Figure 1 As shown, a virtual network interface is created in the kernel. Network data packets received or sent by the user-mode engine are sent to the virtual network interface created in the kernel. Then, the tcpdump tool is used to read network data packets from the virtual network interface through the socket system call. This process copies the data packets from the kernel mode back to the user mode and uses the data packets to generate a packet capture file, thus completing the packet capture process.

[0004] However, the above-mentioned use of tcpdump to capture network packets involves copying network packets from user space to kernel space and then copying network packets from kernel space back to user space. This multiple copying of memory data and switching between kernel space and user space consumes a lot of memory and processor resources, thus leading to a decrease in the performance of network devices. Summary of the Invention

[0005] To address the problems existing in the prior art, embodiments of the present invention provide a data packet acquisition method and apparatus.

[0006] This invention provides a data packet acquisition method, comprising:

[0007] The network device obtains the corresponding network data packets from user space through at least one engine.

[0008] For each engine, the network data packets are stored in a shared cache area corresponding to that engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different;

[0009] At least one network data packet in the shared buffer is obtained using a packet capture program.

[0010] According to a data packet acquisition method provided by the present invention, storing the network data packet in a shared buffer corresponding to the engine includes:

[0011] The network data packet's attribute information is obtained through the engine; the network data packet's attribute information includes: the network interface corresponding to the network data packet, and / or, the direction of the network data packet;

[0012] The network data packets and the attribute information are stored in the shared cache area corresponding to the engine;

[0013] The step of obtaining at least one network data packet from the shared buffer using a packet capture program includes:

[0014] The packet capture program obtains at least one network data packet and its corresponding attribute information from the shared buffer.

[0015] According to a data packet acquisition method provided by the present invention, after acquiring at least one network data packet in the shared buffer through a packet capture program, the method further includes:

[0016] A corresponding packet capture sub-file is generated based on network data packets from the same network interface, and a packet capture file is generated based on at least one network data packet and its corresponding attribute information;

[0017] Export the packet capture file and / or each of the packet capture sub-files.

[0018] According to a data packet acquisition method provided by the present invention, before acquiring at least one network data packet in the shared buffer through a packet capture program, the method further includes:

[0019] For each of the network interfaces, create a file handle for the initial file corresponding to the network interface;

[0020] Write file header data into the initial file based on the file handle;

[0021] The generation of corresponding packet capture sub-files based on network data packets from the same network interface includes:

[0022] The network data packets of the same network interface are written after the header data to obtain the packet capture sub-file.

[0023] According to a data packet acquisition method provided by the present invention, before storing the network data packet in the shared buffer corresponding to the engine, the method further includes:

[0024] Create the shared cache area corresponding to each of the engines;

[0025] For each of the shared cache areas, the packet capture program is configured to access each of the shared cache areas.

[0026] According to a data packet acquisition method provided by the present invention, the step of acquiring the corresponding network data packet from user space through at least one engine of a network device includes:

[0027] Obtain the packet capture rules corresponding to each engine; the packet capture rules are used to indicate the data type of the network data packets acquired by the engine;

[0028] Based on the packet capture rules corresponding to each engine, network data packets corresponding to the data type are obtained from user space through the corresponding engine.

[0029] According to a data packet acquisition method provided by the present invention, the shared buffer includes a ring-shaped shared buffer.

[0030] The present invention also provides a data packet acquisition device, comprising:

[0031] The first acquisition unit is used to acquire the corresponding network data packets from the user space through at least one engine of the network device;

[0032] A storage unit is used to store the network data packets in a shared cache area corresponding to each engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different;

[0033] The second acquisition unit is used to acquire at least one network data packet in the shared buffer through a packet capture program.

[0034] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the data packet acquisition methods described above.

[0035] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data packet acquisition method as described above.

[0036] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the data packet acquisition methods described above.

[0037] The data packet acquisition method and apparatus provided by this invention acquire corresponding network data packets from user space through at least one engine of a network device, and store the acquired network data packets in a shared buffer corresponding to each engine. A packet capture program then retrieves the network data packets from the shared buffer to complete the packet capture task. It can be seen that this invention temporarily stores network data packets in a shared buffer, and the packet capture program can read the network data packets directly from the shared buffer. This eliminates the need to switch between user space and kernel space, and avoids multiple copies of network data packets, thus reducing the amount of memory and processor resources required and improving the performance of the network device. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1 This is a schematic diagram of the data packet capture architecture in related technologies;

[0040] Figure 2 This is one of the flowcharts illustrating the data packet acquisition method provided in this embodiment of the invention;

[0041] Figure 3 This is a second schematic flowchart of the data packet acquisition method provided in the embodiments of the present invention;

[0042] Figure 4 This is the third flowchart illustrating the data packet acquisition method provided in this embodiment of the invention;

[0043] Figure 5 This is the fourth flowchart illustrating the data packet acquisition method provided in this embodiment of the invention;

[0044] Figure 6 This is the fifth flowchart illustrating the data packet acquisition method provided in this embodiment of the invention;

[0045] Figure 7 This is a schematic diagram of the packet capture architecture based on a shared buffer provided in an embodiment of the present invention;

[0046] Figure 8 This is a schematic diagram of the data packet acquisition device provided in an embodiment of the present invention;

[0047] Figure 9 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0049] The following is combined Figures 2-7 The data packet acquisition method of the present invention is described.

[0050] Figure 2 This is one of the flowcharts illustrating the data packet acquisition method provided in this embodiment of the invention, such as... Figure 2 As shown, the data packet acquisition method includes the following steps:

[0051] Step 201: Obtain the corresponding network data packets from user space through at least one engine of the network device.

[0052] Among them, network devices are dedicated hardware devices used to connect various servers, computers, application terminals and other nodes to form an information communication network; network devices can be firewall devices, intrusion detection devices or intrusion prevention devices, etc.; the engine can be the engine program of the network device. Each central processing unit (CPU) core of the network device runs an engine program. For example, if the network device has 4 CPU cores, namely CPU core 1, CPU core 2, CPU core 3 and CPU core 4, then engine 1 can run on CPU core 1, engine 2 can run on CPU core 2, engine 3 can run on CPU core 3 and engine 4 can run on CPU core 4.

[0053] For example, after the network device starts the packet capture function, for each CPU core running the engine, when there is network traffic data, the engine can obtain the corresponding network data packets from user space through the user space network card driver.

[0054] Step 202: For each engine, store the network data packet in the shared cache area corresponding to the engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different.

[0055] In this process, a different shared cache area is pre-configured for each engine.

[0056] For example, when each engine obtains the corresponding network data packet, it can filter out data in the network data packet that does not conform to the predetermined rules, and then store the filtered network data packet in the shared buffer corresponding to that engine, that is, write it into the shared buffer corresponding to that engine; for example, taking four engines as an example, engine 1 writes the obtained network data packet 1 into the corresponding shared buffer 1, engine 2 writes the obtained network data packet 2 into the corresponding shared buffer 2, engine 3 writes the obtained network data packet 3 into the corresponding shared buffer 3, and engine 4 writes the obtained network data packet 4 into the corresponding shared buffer 4.

[0057] Step 203: Obtain at least one network data packet from the shared buffer using a packet capture program.

[0058] The packet capture program can be the fast_capture program or a packet capture tool from related technologies.

[0059] For example, the packet capture program and the engine can share a common buffer. The packet capture program reads network packets from each shared buffer and writes each network packet into a packet capture file in a specified data format to complete the packet capture task. The specified data format can be a format that can be recognized by detection tools such as Wireshark, which facilitates network security analysis of the network packets in the packet capture file by detection tools such as Wireshark.

[0060] The data packet acquisition method provided by this invention obtains corresponding network data packets from user space through at least one engine of a network device, and stores the obtained network data packets in a shared buffer corresponding to each engine. A packet capture program then retrieves the network data packets from the shared buffer to complete the packet capture task. It can be seen that this invention temporarily stores network data packets in a shared buffer, and the packet capture program can read the network data packets directly from the shared buffer. This eliminates the need to switch back and forth between user space and kernel space, and avoids multiple copies of network data packets, thus reducing the amount of memory and processor resources required and improving the performance of the network device.

[0061] In one embodiment, steps 202 and 203 described above can be implemented in the following ways:

[0062] The network data packet's attribute information is obtained through the engine; the network data packet's attribute information includes: the network interface corresponding to the network data packet, and / or, the direction of the network data packet;

[0063] The network data packets and the attribute information are stored in the shared cache area corresponding to the engine;

[0064] The packet capture program obtains at least one network data packet and its corresponding attribute information from the shared buffer.

[0065] Each shared buffer can consist of two parts: packet information and packet content. The packet information may include at least one of the following: the direction of the network packet, the network interface corresponding to the network packet, and the Virtual Local Area Network (VLAN) information within the network packet. The packet content may include the specific network frame data within the network packet. The network interface refers to the physical network interface configured on the network device, indicating the source of the network packet. The direction of the network packet is relative to the network device; if the network packet is data received by the network device, the direction is "received"; if the network packet is data sent by the network device, the direction is "sent".

[0066] For example, taking packet information including the direction of the network data packet, the network interface corresponding to the network data packet, and the VLAN information in the network data packet as an example, the engine can obtain the network interface corresponding to the network data packet, the direction of the network data packet, and the network data packet itself. The network interface corresponding to the network data packet, the direction of the network data packet, and the VLAN information in the network data packet are stored in the storage location corresponding to the packet information in the shared buffer, while the specific network frame data in the network data packet is stored in the storage location corresponding to the packet content in the shared buffer. In this way, the packet capture program can read both packet information and packet content in the shared buffer at the same time.

[0067] The data packet acquisition method provided in this embodiment of the invention can obtain the direction of network data packets, the network interface corresponding to the network data packets, and the network data packets themselves through an engine. These information are then written into a shared buffer. In this way, the packet capture program can not only read the network data packets in the shared buffer, but also their direction and the corresponding network interface, thus enriching the packet capture information. This allows network security detection tools or network security analysts to obtain more information about the network data packets, enabling more accurate security analysis of the network data packets.

[0068] In one embodiment, Figure 3 This is a second flowchart illustrating the data packet acquisition method provided in this embodiment of the invention, as shown below. Figure 3 As shown, after step 203 above, the data packet acquisition method further includes the following steps:

[0069] Step 204: Generate a corresponding packet capture sub-file based on network data packets from the same network interface, and generate a packet capture file based on at least one network data packet and its corresponding attribute information.

[0070] For example, when the packet capture program obtains network packets and their attribute information in each shared buffer, it can obtain network packets belonging to the same network interface based on the network interface included in the attribute information, generate a packet capture sub-file corresponding to that network interface based on the network packets of the same network interface, and write all network packets and their corresponding attribute information obtained from all shared buffers into the packet capture file.

[0071] It should be noted that the difference between a packet capture sub-file and a packet capture file is that a packet capture sub-file only includes network data packets from the same network interface; a packet capture file, on the other hand, is a mixture of network data packets from each network interface. Therefore, the packet capture file includes the network interface corresponding to each network data packet and the direction of each network data packet, making it easier for network security analysts or network security testing tools to distinguish each network data packet based on the network interface and the direction of the network data packet.

[0072] Step 205: Export the packet capture file and / or each of the packet capture sub-files.

[0073] For example, when network packets and corresponding attribute information are read from at least one shared buffer by the packet capture program, a packet capture sub-file is generated for each network interface, and a packet capture file is generated based on the specified data format of the network packets and corresponding attribute information obtained from at least one shared buffer. The packet capture file and each packet capture sub-file are then exported.

[0074] The data packet acquisition method provided in this embodiment of the invention can generate corresponding packet capture sub-files based on network data packets acquired from the same network interface, and can generate packet capture files based on all network data packets and corresponding attribute information read by the packet capture program, and export the generated packet capture files and each packet capture sub-file, so that network security analysts can view the network data packets in the packet capture files or packet capture sub-files, or facilitate network security detection tools to import network data packets.

[0075] In one embodiment, Figure 4 This is the third flowchart illustrating the data packet acquisition method provided in this embodiment of the invention, as shown below. Figure 4 As shown, before step 203 above, the data packet acquisition method further includes steps 206 and 207. In step 204 above, the generation of corresponding packet capture sub-files based on network data packets of the same network interface can be specifically implemented through step 2041:

[0076] Step 206: For each network interface, create a file handle for the initial file corresponding to the network interface.

[0077] For example, each network interface can correspond to an initial file. Network packets can be data from any network interface. To distinguish each initial file, a file handle for the initial file is created based on the network interface. Each initial file is distinguished by its file handle. The initial file can be a .pcap file, which is a file format used to store network packets.

[0078] Step 207: Write file header data into the initial file based on the file handle.

[0079] For example, the corresponding file handle can be found based on the network interface to which the network data packet belongs, and file header data can be written into the initial file based on the corresponding file handle. The file header data contains basic information about the initial file, such as the file version number, timestamp precision, and maximum length of the data packet.

[0080] Step 2041: Write network data packets from the same network interface after the file header data to obtain the packet capture sub-file.

[0081] For example, after writing the header data to the initial file, the packet capture program writes network packets belonging to the same network interface after the header data. During the process of writing the corresponding network packets to the initial file, the packet capture program checks whether the number of network packets written to the initial file has reached the preset number after each network packet is written. If it determines that the number of network packets written has not reached the preset number, it continues to write network packets belonging to the same network interface until the number of network packets written reaches the preset number. Then, it closes the file handle of the initial file. At this time, the initial file is the packet capture sub-file corresponding to that network interface, which is a file that includes the header data and multiple network packets.

[0082] The data packet acquisition method provided in this embodiment of the invention adds the network interface corresponding to each network data packet and the direction of each network data packet to the packet capture file, so that network security analysts or network security detection tools can distinguish each network data packet based on the network interface and the direction of the network data packet.

[0083] In one embodiment, Figure 5 This is the fourth flowchart illustrating the data packet acquisition method provided in this embodiment of the invention, as shown below. Figure 5 As shown, prior to step 201 or step 202 above, the data packet acquisition method further includes the following steps:

[0084] Step 208: Create the shared cache area corresponding to each engine.

[0085] For example, each shared cache is a resource requested by the network device from the system. It can be that the network device requests resources from the system after enabling the packet capture function, and creates a shared cache corresponding to each engine based on the requested resources, or it can request resources from the system when the engine starts, and create a corresponding shared cache based on the requested resources. This invention does not limit this.

[0086] It should be noted that when the packet capture function is turned off, the shared cache can be released to save system resources.

[0087] Step 209: For each of the shared cache areas, set the permissions for the packet capture program to access each of the shared cache areas.

[0088] For example, when creating each shared buffer, permissions for the packet capture program to access each shared buffer can be set. When the permission is set to "Allow," the packet capture program can read network packets from that shared buffer; when the permission is set to "Disallow," the packet capture program cannot read network packets from that shared buffer. Additionally, permissions for the engine to access the corresponding shared buffer can be set. When the permission is set to "Allow," the engine can write network packets to that shared buffer; when the permission is set to "Disallow," the engine cannot write network packets to that shared buffer. When both the packet capture program and the engine have "Allow" permissions set for the shared buffer, the sharing of network packets within the shared buffer is achieved.

[0089] The data packet acquisition method provided in this embodiment of the invention creates a corresponding shared cache for each engine, sets the permissions for the packet capture program to access each shared cache, and sets the permissions for the engine to access the corresponding shared cache, thereby enabling the packet capture program and the engine to apply for the shared cache.

[0090] In one embodiment, Figure 6 This is the fifth flowchart illustrating the data packet acquisition method provided in this embodiment of the invention, as shown below. Figure 6 As shown, step 201 above can be implemented through the following steps:

[0091] Step 2011: Obtain the packet capture rules corresponding to each engine; the packet capture rules are used to indicate the data type of the network data packets acquired by the engine.

[0092] For example, packet capture rules for each engine can be configured in advance on the network device's management page. After starting the packet capture task, each engine can obtain the corresponding packet capture rules, which are used to indicate the data type of network packets that the engine needs to capture. For example, the packet capture rules can be to capture Layer 2 protocol data, Layer 3 protocol data, Internet Protocol (IP) addresses, and port information in network packets; or, the packet capture rules can be to capture IP addresses and port information in network packets, etc.

[0093] Step 2012: Based on the packet capture rules corresponding to each engine, obtain the network data packets corresponding to the data type from the user space through the corresponding engine.

[0094] For example, when each engine obtains the corresponding packet capture rule, it retrieves network data packets of the corresponding data type from the user space based on the packet capture rule.

[0095] The data packet acquisition method provided in this embodiment of the invention allows the engine to acquire corresponding network data packets based on pre-set packet capture rules, so that the acquired network data packets meet the needs of network security analysis.

[0096] In one embodiment, the shared cache area includes a ring-shaped shared cache area.

[0097] For example, a shared buffer can be a circular shared buffer. A large block of memory can be requested from the system and divided into multiple units. For instance, if 1000 kilobytes (KB) of memory are requested from the system, and each unit can be 10KB, then there are 100 units. Each unit is numbered from 0 to 99, meaning each unit has an index from 0 to 99. The unit preceding the unit with index 0 has an index of 99, and the unit following the unit with index 99 has an index of 0. During use, there are read packet indexes and store packet indexes. The engine uses the store packet index to write packets to memory, i.e., write network data packets, while the packet capture program uses the read packet index to read packets from memory, i.e., read network data packets.

[0098] Initially, the read packet index equals the store packet index, which is 0. This equals the store packet index, indicating the shared buffer is empty. When the store packet index is filled to its full circle, the buffer is full immediately following the read packet index. When the engine writes a packet, the store packet index increments by 1, up to 99, then returns to 0. Similarly, when the packet capture program reads a packet, the read packet index increments by 1, up to 99, then returns to 0, thus demonstrating the circular structure of the shared buffer.

[0099] It should be noted that the engine can only store packets when there is free space in the circular shared buffer. The packet capture program can only read packets when the circular shared buffer is in use. The engine stores packets based on the state of the stored packet index, and the packet capture program reads packets based on the state of the read packet index.

[0100] Figure 7 This is a schematic diagram of the packet capture architecture based on a shared buffer provided in an embodiment of the present invention, as shown below. Figure 7 As shown, taking a network device with four CPU cores as an example, the engines running in the four CPU cores are Engine 1, Engine 2, Engine 3, and Engine 4, respectively. Engine 1 corresponds to shared buffer 1, Engine 2 corresponds to shared buffer 2, Engine 3 corresponds to shared buffer 3, and Engine 4 corresponds to shared buffer 4. Engines 1, 2, 3, and 4 are all used to acquire network data packets and corresponding attribute information in user space, and write the acquired network data packets and corresponding attribute information into their respective shared buffers. When the packet capture program can access shared buffers 1, 2, 3, and 4, the packet capture program reads the network data packets and corresponding attribute information in shared buffers 1, 2, 3, and 4, and generates a packet capture file based on the read network data packets and corresponding attribute information.

[0101] The data packet acquisition method provided in this invention involves each engine writing the acquired network data packets and corresponding attribute information into a corresponding shared buffer. The packet capture program then reads the network data packets and corresponding attribute information from each shared buffer to complete the packet capture task. In other words, this invention uses a packet capture program instead of the existing tcpdump tool. The packet capture program and engine work together to complete the packet capture task, eliminating the need to switch between user mode and kernel mode or to copy network data packets multiple times. This results in lower memory and processor resource consumption and effectively solves the problem of decreased network device throughput performance when packet capture is enabled in high-traffic scenarios, ensuring the overall performance of the network device. Furthermore, this invention can capture network data packets corresponding to any network interface using the corresponding engine, without limiting the number of network interfaces that can be captured.

[0102] The data packet acquisition device provided by the present invention is described below. The data packet acquisition device described below can be referred to in correspondence with the data packet acquisition method described above.

[0103] Figure 8 This is a schematic diagram of the data packet acquisition device provided in an embodiment of the present invention, as shown below. Figure 8 As shown, the data packet acquisition device 800 includes a first acquisition unit 801, a storage unit 802, and a second acquisition unit 803; wherein:

[0104] The first acquisition unit 801 is used to acquire the corresponding network data packet from the user space through at least one engine of the network device;

[0105] Storage unit 802 is used to store the network data packets in a shared cache area corresponding to each engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different;

[0106] The second acquisition unit 803 is used to acquire at least one network data packet in the shared buffer through a packet capture program.

[0107] The data packet acquisition device provided by this invention acquires corresponding network data packets from user space through at least one engine of the network device, and stores the acquired network data packets in a shared buffer corresponding to each engine. A packet capture program then retrieves the network data packets from the shared buffer to complete the packet capture task. It can be seen that this invention temporarily stores network data packets in a shared buffer, and the packet capture program can read the network data packets directly from the shared buffer. This eliminates the need to switch back and forth between user space and kernel space, and avoids multiple copies of network data packets, thus reducing the memory and processor resources required and improving the performance of the network device.

[0108] Based on any of the above embodiments, the storage unit 802 is specifically used for:

[0109] The network data packet's attribute information is obtained through the engine; the network data packet's attribute information includes: the network interface corresponding to the network data packet, and / or, the direction of the network data packet;

[0110] The network data packets and the attribute information are stored in the shared cache area corresponding to the engine;

[0111] The second acquisition unit 803 is specifically used for:

[0112] The packet capture program obtains at least one network data packet and its corresponding attribute information from the shared buffer.

[0113] Based on any of the above embodiments, the data packet acquisition device 800 further includes:

[0114] The generation unit is used to generate a corresponding packet capture sub-file based on network data packets of the same network interface, and to generate a packet capture file based on at least one network data packet and its corresponding attribute information;

[0115] An export unit is used to export the packet capture file and / or each of the packet capture sub-files.

[0116] Based on any of the above embodiments, the data packet acquisition device 800 further includes:

[0117] The first creation unit is used to create a file handle for the initial file corresponding to each network interface;

[0118] A writing unit is used to write file header data to the initial file based on the file handle;

[0119] The generation unit is specifically used for:

[0120] The network data packets of the same network interface are written after the header data to obtain the packet capture sub-file.

[0121] Based on any of the above embodiments, the data packet acquisition device 800 further includes:

[0122] The second creation unit is used to create the shared cache area corresponding to each engine.

[0123] The setting unit is used to set the permissions for the packet capture program to access each of the shared cache areas.

[0124] Based on any of the above embodiments, the first acquisition unit 801 is specifically used for:

[0125] Obtain the packet capture rules corresponding to each engine; the packet capture rules are used to indicate the data type of the network data packets acquired by the engine;

[0126] Based on the packet capture rules corresponding to each engine, network data packets corresponding to the data type are obtained from user space through the corresponding engine.

[0127] Based on any of the above embodiments, the shared cache area includes a ring-shaped shared cache area.

[0128] Figure 9 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 9 As shown, the electronic device may include a processor 910, a communications interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communications interface 920, and the memory 930 communicate with each other via the communication bus 940. The processor 910 can call logical instructions in the memory 930 to execute a data packet acquisition method, which includes: acquiring corresponding network data packets from user space through at least one engine of the network device;

[0129] For each engine, the network data packets are stored in a shared cache area corresponding to that engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different;

[0130] At least one network data packet in the shared buffer is obtained using a packet capture program.

[0131] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to execute the data packet acquisition method provided by the above methods, the method including: acquiring the corresponding network data packet from user space through at least one engine of the network device;

[0133] For each engine, the network data packets are stored in a shared cache area corresponding to that engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different;

[0134] At least one network data packet in the shared buffer is obtained using a packet capture program.

[0135] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the data packet acquisition method provided by the above methods, the method comprising: acquiring a corresponding network data packet from user space through at least one engine of a network device;

[0136] For each engine, the network data packets are stored in a shared cache area corresponding to that engine; the shared cache area is a cache area pre-set for the corresponding engine, and the shared cache area corresponding to each engine is different;

[0137] At least one network data packet in the shared buffer is obtained using a packet capture program.

[0138] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0139] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0140] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method of obtaining a data packet, characterized by, include: The network device obtains the corresponding network data packets from user space through at least one engine. For each engine, the network data packets are stored in the shared buffer corresponding to that engine; The shared cache is a cache pre-set for the corresponding engine, and the shared cache corresponding to each engine is different; At least one network data packet in the shared buffer is obtained using a packet capture program; The step of storing the network data packets in the shared cache area corresponding to the engine includes: The network data packet's attribute information is obtained through the engine; the network data packet's attribute information includes: the network interface corresponding to the network data packet, and / or, the direction of the network data packet; The network data packets and the attribute information are stored in the shared cache area corresponding to the engine; The step of obtaining at least one network data packet from the shared buffer using a packet capture program includes: The packet capture program obtains at least one network data packet and its corresponding attribute information from the shared buffer.

2. The data packet acquisition method of claim 1, wherein, After obtaining at least one network data packet from the shared buffer using a packet capture program, the method further includes: A corresponding packet capture sub-file is generated based on network data packets from the same network interface, and a packet capture file is generated based on at least one network data packet and its corresponding attribute information; Export the packet capture file and / or each of the packet capture sub-files.

3. The data packet acquisition method of claim 2, wherein, Before obtaining at least one network packet from the shared buffer using a packet capture program, the method further includes: For each of the network interfaces, create a file handle for the initial file corresponding to the network interface; Write file header data into the initial file based on the file handle; The generation of corresponding packet capture sub-files based on network data packets from the same network interface includes: The network data packets of the same network interface are written after the header data to obtain the packet capture sub-file.

4. The data packet acquisition method according to any one of claims 1 to 3, characterized by, Before storing the network data packet in the shared buffer corresponding to the engine, the method further includes: Create the shared cache area corresponding to each of the engines; For each of the shared cache areas, the packet capture program is configured with permissions to access each of the shared cache areas.

5. The data packet acquisition method according to any one of claims 1 to 3, characterized by, The step of obtaining the corresponding network data packets from user space through at least one engine of the network device includes: Obtain the packet capture rules corresponding to each engine; the packet capture rules are used to indicate the data type of the network data packets acquired by the engine; Based on the packet capture rules corresponding to each engine, network data packets corresponding to the data type are obtained from user space through the corresponding engine.

6. The data packet acquisition method according to any one of claims 1 to 3, wherein, The shared cache area includes a circular shared cache area.

7. A data packet acquisition apparatus, characterized by comprising: include: The first acquisition unit is used to acquire the corresponding network data packets from the user space through at least one engine of the network device; A storage unit is used to store the network data packets in a shared cache area corresponding to each engine. The shared cache is a cache pre-set for the corresponding engine, and the shared cache corresponding to each engine is different; The second acquisition unit is used to acquire at least one network data packet in the shared buffer through a packet capture program; The storage unit is specifically used for: The network data packet's attribute information is obtained through the engine; the network data packet's attribute information includes: the network interface corresponding to the network data packet, and / or, the direction of the network data packet; The network data packets and the attribute information are stored in the shared cache area corresponding to the engine; The second acquisition unit is specifically used for: The packet capture program obtains at least one network data packet and its corresponding attribute information from the shared buffer.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the data packet acquisition method as described in any one of claims 1 to 6. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the data packet acquisition method as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the data packet acquisition method as described in any one of claims 1 to 6.

Images