A network packet capturing method

Abstract

The application relates to a network message packet capturing method and belongs to the technical field of communication. The method can facilitate a developer to process special network messages in a user state, can process common network protocol messages by using an operating system network protocol stack, is easy to debug a program, reduces the development cost of special network equipment, and shortens a project cycle. Therefore, the application program packet capturing method has the characteristics of high efficiency, low time delay, self-controllability and the like, and can fully utilize the network protocol stack of the operating system to process some common messages. The method is suitable for being applied to various network equipment and has a good market prospect.

Description

A method for capturing network packets Technical Field

[0001] This invention belongs to the field of communication technology, specifically relating to a method for capturing network packets. Background Technology

[0002] With the development of information technology, network devices are constantly evolving and their functions are continuously improving. Previously, there were two main types of packet processing software technologies for network devices on the market:

[0003] ① Network packet processing based on the netfilter framework. This technology is developed in kernel mode, which requires high technical expertise from the R&D personnel and is not easy to debug and locate. Its R&D cost is high and the project cycle is long.

[0004] ② Network packet processing based on virtual network cards. This technology is mainly developed in user space, but it cannot use the network protocol stack of the operating system. Commonly used packets need to be processed by themselves (e.g., ARP, RARP, neighbor discovery, IGMP, etc.), which requires a certain level of technical expertise from the R&D personnel and the R&D cost is relatively high. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] The technical problem to be solved by this invention is: how to design a method that can autonomously control the capture of any desired message without affecting the operation of the network protocol stack itself and other applications.

[0007] (II) Technical Solution

[0008] To address the aforementioned technical problems, this invention provides a method for capturing network packets, comprising the following steps:

[0009] Step 1: Create a virtual bridge and add the network card that receives special packets to the virtual bridge. Then the network card will switch to promiscuous mode, which can receive all packets passing through it and hand them over to the bound virtual bridge for processing.

[0010] Step 2: Register a packet splitter at the embedded point on the virtual bridge to preprocess the packets. The packet splitter is a specific kernel module. After the virtual bridge receives a packet, it will first hand it over to the packet splitter for processing.

[0011] Step 3: Establish two channels between the special message processing application and the message splitter. One channel is used to send control commands, and the other channel is used to transmit special messages. When the special message processing application starts working, it sends a control command to the message splitter. After receiving the start command, the message splitter updates its status to start and updates the special message parameters.

[0012] Step 4: The packets received by the network card are handed over to the virtual bridge for processing. The packets received by the virtual bridge are handed over to the packet splitter for processing. The packet splitter determines whether the received control command is a special packet: if it is a special packet, it is transmitted to the special packet application for processing through a dedicated channel; if it is not a special packet, it is returned to the system network protocol stack for processing.

[0013] Step 5: The special message processing application reads its own special message for business processing; the system network protocol stack continues to process non-special messages;

[0014] Step 6: When the special message processing application stops working, it sends a stop command to the message splitter. After receiving the stop command, the message splitter updates its status to stopped.

[0015] Preferably, a virtual bridge can add multiple network interface cards (NICs).

[0016] Preferably, for the Linux operating system, the embedding point is located at the NF_BR_PRE_ROUTING hook point in netfilter.

[0017] Preferably, the control command includes special message parameters and a start command.

[0018] The present invention also provides a network device that applies the method described herein.

[0019] Preferably, the network device is a special network device.

[0020] Preferably, the special network device is a network cryptographic machine.

[0021] Preferably, the special network device is a network tester.

[0022] The present invention also provides an application of the method in the field of communication technology.

[0023] The present invention also provides an application of the network device in the field of communication technology.

[0024] (III) Beneficial Effects

[0025] This invention provides a network packet capture method that allows an application, based on the operating system's network protocol stack framework, to autonomously control the capture of any desired packets without affecting the network protocol stack itself or the operation of other applications. This method facilitates developers in handling special network packets in user space while also utilizing the operating system's network protocol stack to handle common network protocol packets. It is also easy to debug, reducing the development costs of specialized network equipment and shortening project cycles. Therefore, this application-based packet capture method features high efficiency, low latency, and autonomous controllability, and can fully utilize the operating system's network protocol stack to handle some common packets. This method is suitable for application on various network devices (especially specialized network devices, such as network cryptographic machines and network testers), and has a promising market prospect. Attached Figure Description

[0026] Figure 1 is a schematic diagram of the method design principle of the present invention;

[0027] Figure 2 is a flowchart of the message splitter processing in this invention. Detailed Implementation

[0028] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0029] Referring to Figures 1 and 2, the network packet capture method provided by the present invention includes the following steps:

[0030] Step 1: Create a virtual bridge and add the network interface card (NIC) that receives special packets to the virtual bridge. Multiple NICs can be added to a single bridge. The NIC will then switch to promiscuous mode, enabling it to receive all packets passing through it and hand them over to the bound virtual bridge for processing.

[0031] Step 2: Register a packet splitter at the preprocessing point on the virtual bridge (in Linux operating systems, this point is located at the NF_BR_PRE_ROUTING hook in netfilter). This packet splitter is a specific kernel module. After receiving a packet, the virtual bridge will first hand it over to the packet splitter for processing.

[0032] Step 3: Establish two channels between the special message processing application and the message splitter. One channel is used to send control commands, and the other channel is used to transmit special messages. When the special message processing application starts working, it sends control commands (including special message parameters, start commands, etc.) to the message splitter. After receiving the start command, the message splitter updates its status to start and updates the special message parameters.

[0033] Step 4: Packets received by the network card are handed over to the virtual bridge for processing, and packets received by the virtual bridge are handed over to the packet splitter for processing. The packet splitter determines whether a packet is special based on the received control command: if it is a special packet, it is transmitted to the special packet application for processing through a dedicated channel; otherwise, it is returned to the system network protocol stack for processing.

[0034] Step 5: The special message processing application reads its own special message for business processing; the system network protocol stack continues to process non-special messages;

[0035] Step 6: When the special message processing application stops working, it sends a stop command to the message splitter. After receiving the stop command, the message splitter updates its status to stopped.

[0036] As can be seen, this invention adds a network card that receives special messages to a virtual bridge, registers a message splitter in the virtual bridge, and establishes two channels between the special message processing application and the message splitter for sending control commands and transmitting special messages, respectively. The message splitter, based on the received control commands, directly transmits the special messages to the application through a dedicated channel, while returning other messages to the system network protocol stack for further processing. This achieves autonomous control in capturing any required message. This method is convenient for developers to process special network messages in user space, and it also allows for the use of the operating system's network protocol stack to process common network protocol messages, while facilitating program debugging.

[0037] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for capturing network packets, characterized in that, Includes the following steps: Step 1: Create a virtual bridge and add the network card that receives special packets to the virtual bridge. Then the network card will switch to promiscuous mode, which can receive all packets passing through it and hand them over to the bound virtual bridge for processing. Step 2: Register a packet splitter at the embedded point on the virtual bridge to preprocess the packets. The packet splitter is a specific kernel module. After the virtual bridge receives a packet, it will first hand it over to the packet splitter for processing. Step 3: Establish two channels between the special message processing application and the message splitter. One channel is used to send control commands, and the other channel is used to transmit special messages. When the special message processing application starts working, it sends a control command to the message splitter. After receiving the start command, the message splitter updates its status to start and updates the special message parameters. Step 4: The packets received by the network card are handed over to the virtual bridge for processing. The packets received by the virtual bridge are handed over to the packet splitter for processing. The packet splitter determines whether the received control command is a special packet: if it is a special packet, it is transmitted to the special packet application for processing through a dedicated channel; if it is not a special packet, it is returned to the system network protocol stack for processing. Step 5: The special message processing application reads its own special message for business processing; the system network protocol stack continues to process non-special messages; Step 6: When the special message processing application stops working, it sends a stop command to the message splitter. After receiving the stop command, the message splitter updates its status to stopped.

2. The method as described in claim 1, characterized in that, A virtual bridge can add multiple network cards.

3. The method as described in claim 1, characterized in that, For the Linux operating system, the embedding point is located at the NF_BR_PRE_ROUTING hook point in netfilter.

4. The method as described in claim 1, characterized in that, The control commands include special message parameters and start commands.

5. A network device that applies the method as described in any one of claims 1 to 4.

6. The network device as described in claim 5, characterized in that, The network device in question is a special-purpose network device.

7. The network device as described in claim 6, characterized in that, The special network device is a network cryptographic machine.

8. The network device as described in claim 6, characterized in that, The special network equipment mentioned is a network tester.

Images