A message capturing method and device, electronic equipment and storage medium

Abstract

The application provides a packet capturing method and device, electronic equipment and storage medium, which can capture packets of a specific format under a specified packet processing process. The method comprises: setting a plurality of position identifiers and a plurality of callback functions in a packet processing task, wherein the plurality of position identifiers and the plurality of callback functions correspond to a plurality of packet processing processes of the packet processing task, and the callback function is used to return the position identifier corresponding to the packet processing process; obtaining a packet capturing rule, the packet capturing rule comprising a target position identifier and a capturing rule for a target packet in a packet processing process corresponding to the target position identifier; when any packet processing process is performed, executing the callback function, and when the position identifier corresponding to the packet processing process matches the target position identifier, capturing the target packet in the packet processing process corresponding to the target position identifier according to the capturing rule for the target packet.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a message capturing method and device, an electronic device and a storage medium. BACKGROUND

[0002] Message capturing is a basic data processing method in the field of digital communication, which is needed in fault positioning and special message analysis. A data packet dump (pdump) program for message capturing is provided by a data plane development kit (DPDK) mainly used for high-performance processing of data packets in a network. The program can capture messages on a specified interface and a specified queue.

[0003] However, with the continuous construction of the network, the content of the messages contained in a large amount of network traffic is becoming increasingly complex. The pdump program provided by the DPDK can only capture message information under a fixed packet capturing node, and the format and capturing rules of the captured messages are relatively simple, which cannot meet the capturing needs of messages of different formats under different nodes in actual situations. SUMMARY

[0004] The present application provides a message capturing method, device, equipment and storage medium, which can capture messages of a specific format in a specific packet capturing process.

[0005] In a first aspect, the present application provides a message capturing method, which comprises:

[0006] setting a plurality of position identifiers and a plurality of callback functions in a message processing task, wherein the plurality of position identifiers and the plurality of callback functions correspond to a plurality of message processing processes of the message processing task, and the callback function is used to return the position identifier corresponding to the message processing process;

[0007] obtaining a packet capturing rule, wherein the packet capturing rule comprises a target position identifier and a capturing rule of a target message in a message processing process corresponding to the target position identifier;

[0008] when any message processing process of the message processing task is performed, executing the callback function, and when the position identifier corresponding to the message processing process matches the target position identifier, capturing the target message in the message processing process corresponding to the target position identifier according to the capturing rule of the target message.

[0009] Further, the capturing rule is contained in an extended Berkeley packet filter (eBPF) instruction code, and the capturing of the target message in the message processing process corresponding to the target position identifier according to the capturing rule of the target message comprises:

[0010] The eBPF is invoked to execute the eBPF instruction code, and the target packet in the target position identified by the target position identifier is captured.

[0011] Further, the eBPF is invoked to execute the eBPF instruction code, and the target packet in the target position identified by the target position identifier is captured, including:

[0012] The eBPF is invoked to execute the eBPF instruction code, and the target packet in the target position identified by the target position identifier is marked.

[0013] According to the marking of the target packet, the target packet is captured.

[0014] Further, when a plurality of position identifiers and a plurality of callback functions are set in the packet processing task, the method further includes:

[0015] For any packet processing process of the packet processing task, a kernel for executing packet capture is set for the packet processing process.

[0016] Further, the method further includes:

[0017] The captured target packet is copied to a packet resource pool, and the address of the target packet in the packet resource pool is stored in a packet address set.

[0018] Further, the method further includes:

[0019] After the target packet in the target position identified by the target position identifier is captured, the packet capture rule is deleted.

[0020] In a second aspect, the application provides a packet capture device, which includes:

[0021] The processing module is configured to set a plurality of position identifiers and a plurality of callback functions in a packet processing task, wherein the plurality of position identifiers and the plurality of callback functions correspond to a plurality of packet processing processes of the packet processing task, and the callback function is used to return the position identifier corresponding to the packet processing process.

[0022] The acquisition module is configured to acquire a packet capture rule, wherein the packet capture rule includes a target position identifier and a capture rule of a target packet in a target position identified by the target position identifier.

[0023] The processing module is further configured to execute the callback function when proceeding to any packet processing process of the packet processing task, and perform packet capturing on the target packet in the packet processing process corresponding to the target location identifier according to the packet capturing rule of the target packet when the location identifier corresponding to the packet processing process matches the target location identifier.

[0024] Further, the packet capturing rule is contained in an extended Berkeley Packet Filter (eBPF) instruction code, and the processing module is specifically configured to invoke eBPF to execute the eBPF instruction code to perform packet capturing on the target packet in the packet processing process corresponding to the target location identifier when performing packet capturing on the target packet in the packet processing process corresponding to the target location identifier according to the packet capturing rule of the target packet.

[0025] Further, the processing module is specifically configured to invoke eBPF to execute the eBPF instruction code to mark the target packet in the packet processing process corresponding to the target location identifier, and perform packet capturing on the target packet according to the mark of the target packet when invoking eBPF to execute the eBPF instruction code to perform packet capturing on the target packet in the packet processing process corresponding to the target location identifier.

[0026] Further, the processing module is further configured to set a kernel for performing packet capturing for any packet processing process of the packet processing task.

[0027] Further, the processing module is further configured to copy the captured target packet to a packet resource pool, and store an address of the target packet in the packet resource pool in a packet address set.

[0028] Further, the processing module is further configured to delete the packet capturing rule after performing packet capturing on the target packet in the packet processing process corresponding to the target location identifier.

[0029] In a third aspect, the present application provides an electronic device, which comprises at least a processor and a memory, and the processor executes a computer program or instruction stored in the memory to implement the method in the first aspect.

[0030] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program or instruction, and the computer program or instruction is executed by a processor to implement the method in the first aspect.

[0031] In the present application, by correspondingly setting multiple position identifiers and multiple callback functions in multiple packet processing processes of a packet processing task, when any packet processing process of the packet processing task is performed, the callback function under the packet processing process is executed to return the position identifier corresponding to the packet processing process, and when the position identifier corresponding to the packet processing process matches the target position identifier in the packet capturing rule, the target packet under the packet processing process corresponding to the target position identifier is captured according to the capturing rule of the target packet, and then the packet in a specified packet capturing process in a specific format can be obtained. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0033] Figure 1 A flowchart of a packet capturing method provided in an embodiment of the present application.

[0034] Figure 2a A schematic diagram of setting a position identifier and a DPDK internal thread for any packet processing process of IP packet forwarding in an embodiment of the present application.

[0035] Figure 2b A process schematic diagram of a packet saving based on DPDK provided in an embodiment of the present application.

[0036] Figure 3 A schematic diagram of a packet capturing process provided in an embodiment of the present application.

[0037] Figure 4 A flowchart of another packet capturing method provided in an embodiment of the present application.

[0038] Figure 5 A structural schematic diagram of a packet capturing device provided in an embodiment of the present application.

[0039] Figure 6 A structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose and implementation of the present application more clear, the exemplary embodiments of the present application will be described clearly and completely in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only some embodiments of the present application, not all embodiments.

[0041] It should be noted that the brief description of the terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of the application. Unless otherwise specified, these terms should be understood according to their ordinary and general meanings.

[0042] The terms "first", "second", "third" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar or similar objects or text entities, and do not necessarily mean a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchanged under appropriate circumstances.

[0043] The terms "include" and "have" and any variations thereof are intended to cover but not exclusive inclusion, for example, a product or device including a series of components does not have to be limited to all components clearly listed, but can include other components not clearly listed or inherent to these products or devices.

[0044] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware or / and software code capable of performing functions related to the element.

[0045] Packet capture is a basic data processing method in the field of digital communication, for example, packet capture is required in fault positioning and special packet analysis. A data plane development kit (DPDK) mainly used for high-performance processing of data packets in a network provides a packet dump (pdump) program for packet capture, which can capture packets on a specified interface and a specified queue.

[0046] However, as the network is continuously built, the content of the packets contained in a large amount of network traffic is becoming increasingly complex, and the pdump program provided by the DPDK can only capture packet information at a fixed packet capture node (i.e., the receiving packet and the sending packet in the actual packet processing task), and the format and capture rules of the captured packets are relatively simple (i.e., all packets in the receiving packet and the sending packet are captured in full), which cannot meet the capture requirements of packets of different formats at different nodes in actual situations.

[0047] Based on this, the present application provides a packet capture method, device, equipment and storage medium, by returning the position identifier corresponding to the current packet processing process through the callback function, and when the position identifier matches the target position identifier, the target packet in the packet processing process corresponding to the target position identifier is captured according to the capture rule of the target packet, so that the packet of a specific format in different packet capture processing processes can be obtained.

[0048] Figure 1 A flowchart of a packet capturing method, which can be applied to an electronic device, for example, implemented by a program for packet processing running in the electronic device, is described below with the program for packet processing as DPDK as an example. The method comprises:

[0049] S101: setting a plurality of position identifiers and a plurality of callback functions in a packet processing task, wherein the plurality of position identifiers and the plurality of callback functions correspond to a plurality of packet processing processes of the packet processing task, and the callback function is used to return the position identifier corresponding to the packet processing process.

[0050] The packet capturing method provided in the present application is described with DPDK as an example. In the embodiment of the present application, the DPDK primary process can call an application programming interface (API) to set a plurality of position identifiers in at least one packet processing task, wherein each position identifier can be an identity document (id) composed of numbers and / or characters, and each id uniquely corresponds to a packet processing process of a packet processing task.

[0051] Meanwhile, while setting the position identifier for any packet processing process using the above API, a callback function (hook function) can be set for the packet processing process to return the position identifier corresponding to the packet processing process to a specified process. Wherein the callback function can be executed after the corresponding event is triggered to return the execution result of the callback function to the specified program, process, terminal, etc.

[0052] Wherein different types of packets, such as Internet Protocol (IP) packets, User Datagram Protocol (UDP) packets, Transmission Control Protocol (TCP) packets, and HyperText Transfer Protocol (HTTP) packets, etc., have their own at least one packet processing process in different packet processing tasks such as forwarding, encryption, decryption, etc. Taking the forwarding of IP packets as an example, its corresponding packet processing process has 1. receiving IP packet data, 2. parsing the header information of the IP packet through Transmission Control Protocol / Internet Protocol (TCP / IP), 3. repackaging the IP packet according to the router table, and 4. sending the IP packet.

[0053] In order to make the packet capture can be orderly, efficiently, in a possible implementation, in the packet processing task is set to a plurality of position identification and a plurality of callback function, the method further comprises:

[0054] For any packet processing process of the packet processing task, a kernel for performing packet capture is set for the packet processing process.

[0055] Specifically, in order to make the packet capture can be orderly, efficiently, DPDK master process in for packet processing process is set to a unique id, also can be for the packet processing process set a kernel (lcore) for performing packet capture and the identification of the kernel, for example, the kernel can be DPDK internal thread, the identification of the kernel is the identification of the DPDK internal thread.

[0056] Also take the forwarding of IP packet as an example of a packet processing process, Figure 2a A schematic diagram for setting position identification and DPDK internal thread for any packet processing process of the forwarding of IP packet provided in the embodiment of the application. As shown in Figure 2a For any packet processing process of the forwarding of IP packet, the DPDK master process calls API to set a unique position identification for it, and sets a DPDK internal thread for performing packet capture and the identification of the DPDK internal thread for the packet processing process. Among them, the corresponding position identification 1 and the identification a of the DPDK internal thread for receiving IP packet data packet; the corresponding position identification 2 and the identification b of the DPDK internal thread for parsing the header information of IP packet through TCP / IP protocol; the corresponding position identification 3 and the identification c of the DPDK internal thread for repackaging IP packet according to the router table; the corresponding position identification 4 and the identification d of the DPDK internal thread for sending IP data packet. It should be understood that the position identification uniquely corresponds to a packet processing process, and for the identification of the DPDK internal thread of any two packet processing processes, when the DPDK internal threads allocated for the two packet processing processes are the same, the identification of the DPDK internal thread corresponding to the two packet processing processes can be the same, for example. When the receiving IP packet data packet and the sending IP data packet are allocated with the same DPDK internal thread for capturing packets, the identification a of the DPDK internal thread and the identification d of the DPDK internal thread can be the same.

[0057] In addition, the callback function in the application can be used to return the position identification corresponding to the packet processing process, but also can return one or more of the following, including but not limited to: the address of the packet under the packet processing process, the number of packets, the identification of the DPDK internal thread.

[0058] S102: Obtain a packet capturing rule, the packet capturing rule comprising a target position identifier and a capturing rule of a target packet in a packet processing process corresponding to the target position identifier.

[0059] The DPDK secondary process can obtain the target position identifier sent by the user or locally saved, and the capturing rule of the target packet in the packet processing process corresponding to the target position identifier. The target position identifier is used to determine the packet processing process in which packet capturing is required. In order to improve the single capturing rule of the packet in the existing DPDK, the capturing rule of the target packet can be implemented by other programs for packet filtering, that is, the capturing rule of the target packet is included in the instruction code of the other programs for packet filtering, and the instruction code is executed by the other programs for packet filtering to implement capturing of the packet based on an arbitrary capturing rule.

[0060] Optionally, there can be one DPDK primary process and multiple DPDK secondary processes in the DPDK program, that is, multiple DPDK secondary processes can simultaneously construct multiple different packet capturing rules and send them to the DPDK primary process. The DPDK primary process can save multiple target position identifiers and the capturing rule of the packet processing process corresponding to each target position identifier.

[0061] S103: When proceeding to any packet processing process of the packet processing task, the callback function is executed, and when the position identifier corresponding to the packet processing process matches the target position identifier, the target packet in the packet processing process corresponding to the target position identifier is captured according to the capturing rule of the target packet.

[0062] When the DPDK primary process proceeds to any packet processing process of the packet processing task, the callback function is executed and returns the position identifier corresponding to the packet processing process to the DPDK primary process. When the position identifier corresponding to the packet processing process matches the target position identifier, the DPDK primary process can call other programs for packet filtering corresponding to the capturing rule of the target packet, and execute the instructions, instruction codes, etc. corresponding to the capturing rule of the target packet by the other programs to complete capturing of the target packet in the packet processing process corresponding to the target position identifier.

[0063] Optionally, after capturing the target packet in the packet processing process corresponding to the target position identifier, the capturing rule corresponding to the target position identifier in the packet capturing rule and the target position identifier can be deleted.

[0064] In the present application, by correspondingly setting multiple location identifiers and multiple callback functions in multiple packet processing processes of a packet processing task, when any packet processing process of the packet processing task is performed, the callback function under the packet processing process is executed to return the location identifier corresponding to the packet processing process, and when the location identifier corresponding to the packet processing process matches the target location identifier in the packet capturing rule, the target packet under the packet processing process corresponding to the target location identifier is captured according to the capturing rule of the target packet, and then the packet of a specific format under the specified packet capturing process can be obtained.

[0065] In a possible implementation, the capturing rule is contained in an extended Berkeley Packet Filter (eBPF) instruction code, and the capturing of the target packet under the packet processing process corresponding to the target location identifier according to the capturing rule of the target packet includes:

[0066] The eBPF is called to execute the eBPF instruction code to capture the target packet under the packet processing process corresponding to the target location identifier.

[0067] The capturing rule obtained by the DPDK secondary process can be contained in the eBPF instruction code. Specifically, the DPDK secondary process can obtain the target location identifier sent by the user and the eBPF instruction code, and construct the target location identifier and the eBPF instruction code and other information into a packet capturing rule, and send the packet capturing rule to the DPDK primary process through the mp_channel under the DPDK program. After obtaining the packet capturing rule sent by the DPDK secondary process, the DPDK primary process parses the target location identifier and the eBPF instruction code and other information and saves them. The eBPF instruction code can be input by the user or obtained from other electronic devices or networks.

[0068] The DPDK primary process can call the eBPF to start the eBPF packet filtering callback function, and send the packet address under the packet processing process corresponding to the target location identifier, the number of packets, the identifier of the DPDK internal thread, and the eBPF instruction code and other information to the eBPF packet filtering callback function under the eBPF. The eBPF packet filtering callback function captures the target packet under the packet processing process corresponding to the target location identifier according to the capturing rule of the target packet under the packet processing process corresponding to the target location identifier in the eBPF instruction code.

[0069] Optionally, after capturing the target packet under the packet processing process corresponding to the target location identifier, the eBPF instruction code corresponding to the target location identifier in the packet capturing rule can be deleted, or a packet capturing rule containing a specified eBPF instruction code to be deleted can be received to delete the specified eBPF instruction code.

[0070] Optionally, there can be one DPDK master process and multiple DPDK secondary processes under the DPDK program, that is, multiple DPDK secondary processes can simultaneously construct multiple different packet capture rules and send them to the DPDK master process, and the DPDK master process can save multiple target location identifiers and the corresponding eBPF instruction codes of the packet capture rules under the packet processing process corresponding to each target location identifier.

[0071] Further, in order to protect the original packet under the packet processing process corresponding to the target location identifier from being damaged, the eBPF is called to execute the eBPF instruction code to capture the target packet under the packet processing process corresponding to the target location identifier, comprising:

[0072] The eBPF is called to execute the eBPF instruction code to mark the target packet under the packet processing process corresponding to the target location identifier.

[0073] According to the marking of the target packet, the target packet is captured.

[0074] After the DPDK master process calls the eBPF to execute the eBPF instruction code, the eBPF packet filtering callback function marks the target packet in the packet under the packet processing process corresponding to the target location identifier according to the packet capture rule of the target packet under the packet processing process corresponding to the target location identifier contained in the eBPF instruction code.

[0075] The DPDK master process obtains the target packet according to the marking of the target packet, for example, by using the pdump program provided by DPDK to obtain the target packet.

[0076] In a possible implementation, in order to facilitate the user to obtain the target packet at any time, the captured target packet can be copied to a packet resource pool, and the address of the target packet in the packet resource pool can be stored in a packet address set, and the user can find and download the target packet according to the address in the packet resource pool.

[0077] Optionally, in DPDK, the packet resource pool can correspond to a memory pool (mempool), and the packet address set can correspond to a queue (ring). The DPDK master process can apply for memory space in the mempool, copy the target packet to the mempool, and store the address of the target packet in the mempool in the ring. The mempool and the ring can be created when the DPDK program constructs the packet capture rule, and the path of the mempool and the ring can be constructed in the packet capture rule.

[0078] The DPDK can receive an instruction sent by a user for obtaining a target packet, find a packet address of the target packet from the ring, and download and save the target packet in the mempool. The target packet can also be saved by a DPDK secondary process for packet saving which loops through the packet addresses in the ring, saves the target packet, and Figure 2b For example, Figure 2b is a process diagram of a packet saving method based on DPDK provided in an embodiment of the present application. As shown in Figure 2b , the DPDK secondary process for packet saving loops through the packet addresses saved in the ring, finds the saving address of the target packet, and then obtains the target packet from the mempool and downloads and saves it.

[0079] Optionally, in order to facilitate subsequent processing of the packet, the DPDK secondary process can convert the packet in the memory buffer (mbuf) format obtained by the DPDK secondary process into a packet in the packet capture (pacp) format.

[0080] Figure 3 is a diagram of a packet capturing process provided in an embodiment of the present application. As shown in Figure 3 , the eBPF can receive an eBPF rule written by a user in a high-level assembly language (such as C language, Python, etc.), compile to generate a corresponding eBPF instruction code, and save the eBPF instruction code to an electronic device running a DPDK program. The DPDK secondary process receives a start instruction, obtains a target location identifier and a corresponding eBPF instruction, and constructs a packet capturing rule which can contain the target location identifier, the eBPF instruction code, the path of the mempool, and the path of the ring. The DPDK secondary process sends the constructed packet capturing rule to the DPDK primary process through the mp_channel. The DPDK primary process receives and parses the packet capturing rule, monitors and identifies the location identifier corresponding to the currently executing packet processing process, and if the location identifier matches the target location identifier, calls the eBPF to execute the eBPF instruction code to mark the packet in the packet processing process corresponding to the target location identifier. The DPDK primary process copies the marked target packet to the mempool according to the path of the mempool and the path of the ring, saves the address of the target packet in the ring, sends a message to the DPDK secondary process that the target packet has been captured successfully, and the DPDK secondary process obtains the address of the target packet from the ring and downloads the target packet from the mempool for saving.

[0081] Figure 4 is a flow diagram of another packet capturing method provided in an embodiment of the present application. As shown in Figure 4 , the method comprises:

[0082] S401: Receive a set of message addresses from the network card.

[0083] The DPDK master process receives a set of message addresses from the network card (the message addresses can be the message addresses under a message processing process, or the message addresses under the message processing task). Among them, the message addresses can be a set of mbuf format message addresses.

[0084] S402: Execute the callback function under the current message processing process.

[0085] When the DPDK master process proceeds to any message processing process of the message processing task, the callback function is triggered to execute, and the callback function returns the position identifier corresponding to the message processing process to the DPDK master process. The callback function can also return the number of messages under the message processing process, the identifier of the DPDK internal thread, and other information to the DPDK master process.

[0086] S403: The position identifier matches the target position identifier.

[0087] If the position identifier matches the target position identifier, S404 is executed.

[0088] S404: Call eBPF to mark the target message in the message under the message processing process corresponding to the target position identifier.

[0089] Call eBPF to start eBPF message filtering callback function to execute eBPF instruction code, and mark the target message in the message under the message processing process corresponding to the target position identifier.

[0090] S405: Copy the target message and save the message address of the target message.

[0091] The DPDK master program copies the target message to the memory pool (mempool) according to the marking of the target message and stores the message address in the ring (ring).

[0092] It should be noted that the packet capturing method provided by the embodiments of the present application can also be applied to programs for packet processing other than DPDK, such as eXpress Data Path dump (xdpdump) and the like. The method sets a unique corresponding position identifier and a callback function corresponding to each packet processing process of a packet processing task, so that when the program for packet processing proceeds to any packet processing process, the callback function under the packet processing process is executed to return the position identifier corresponding to the packet processing process to the program. The program for packet processing matches the position identifier with the target position identifier in the captured packet rule, and when the position identifier corresponding to the packet processing process matches the target position identifier in the captured packet rule, the eBPF is called to execute the eBPF instruction code in the captured packet rule to capture the target packet under the target position identifier corresponding to the packet processing process, thereby being able to obtain the packet in a specific format under the specified captured packet processing process.

[0093] Based on the above packet capturing method, the present application provides a packet capturing device, Figure 5 A structural schematic diagram of a packet capturing device provided in the embodiments of the present application, the device comprises:

[0094] The processing module 501 is configured to set a plurality of position identifiers and a plurality of callback functions in a packet processing task, wherein the plurality of position identifiers and the plurality of callback functions correspond to a plurality of packet processing processes of the packet processing task, and the callback function is used to return the position identifier corresponding to the packet processing process;

[0095] The acquisition module 502 is configured to acquire a captured packet rule, wherein the captured packet rule comprises a target position identifier and a capturing rule of a target packet under a packet processing process corresponding to the target position identifier;

[0096] The processing module 501 is further configured to execute the callback function when proceeding to any packet processing process of the packet processing task, and capture the target packet under the packet processing process corresponding to the target position identifier according to the capturing rule of the target packet when the position identifier corresponding to the packet processing process matches the target position identifier.

[0097] Further, the capturing rule is contained in an extended Berkeley Packet Filter (eBPF) instruction code, and when the processing module 501 captures the target packet under the packet processing process corresponding to the target position identifier according to the capturing rule of the target packet, it is specifically configured to call the eBPF to execute the eBPF instruction code to capture the target packet under the packet processing process corresponding to the target position identifier.

[0098] Further, the processing module 501 invokes eBPF to execute the eBPF instruction code, and when the target packet in the target position identified corresponding to the packet processing process is captured, the processing module 501 is specifically configured to: invoke eBPF to execute the eBPF instruction code, and mark the target packet in the target position identified corresponding to the packet processing process; and according to the marking of the target packet, capture the target packet.

[0099] Further, when the processing module 501 sets multiple position identifiers and multiple callback functions in the packet processing task, the processing module 501 is further configured to: for any packet processing process of the packet processing task, set a kernel for executing packet capture for the packet processing process.

[0100] Further, the processing module 501 is further configured to: copy the captured target packet to a packet resource pool, and store the address of the target packet in the packet resource pool in a packet address set.

[0101] Further, the processing module 501 is further configured to: after capturing the target packet in the target position identified corresponding to the packet processing process, delete the packet capture rule.

[0102] Figure 6 It is a schematic diagram of an electronic device structure. As shown in the figure, Figure 6 The electronic device includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0103] The memory 603 stores a computer program, and when the program is executed by the processor 601, the processor 601 implements the steps of any of the above-mentioned packet capture methods.

[0104] The communication bus mentioned in the above electronic device can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication bus can be divided into address bus, data bus, control bus, etc. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or one type of bus.

[0105] The communication interface 602 is used for communication between the above-mentioned electronic device and other devices.

[0106] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0107] The aforementioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc., and can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, etc.

[0108] On the basis of the above-mentioned embodiments, the embodiments of the present application further provide a computer readable storage medium, wherein the computer readable storage medium stores a computer program executable by an electronic device, and when the program runs on the electronic device, the program causes the electronic device to execute the steps of any one of the above-mentioned packet capturing methods.

[0109] The aforementioned computer readable storage medium can be any available medium or data storage device accessible by a processor in an electronic device, including but not limited to a magnetic storage such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc., an optical storage such as a CD, a DVD, a BD, a HVD, etc., and a semiconductor memory such as a ROM, an EPROM, an EEPROM, a non-volatile memory (NAND FLASH), a solid state disk (SSD), etc.

[0110] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

[0111] For the convenience of explanation, the above description has been made in combination with specific embodiments. However, the above exemplary discussion is not intended to exhaust or limit the embodiments to the specific forms disclosed above. Various modifications and variations can be derived according to the above teachings. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different modified embodiments suitable for specific use considerations.

[0112] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0113] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0114] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0115] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0116] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 means for functionally implementing the steps listed in the flowchart block or blocks.

[0117] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A packet capturing method, characterized by, The method comprises the following steps: setting multiple position identifiers and multiple callback functions in a packet processing task, wherein the multiple position identifiers and the multiple callback functions correspond to multiple packet processing processes of the packet processing task, and the callback function is used to return a position identifier corresponding to a packet processing process; wherein each position identifier is an identity number composed of numbers and / or characters, and each position identifier uniquely corresponds to a packet processing process of a packet processing task; obtaining a packet capture rule, wherein the packet capture rule comprises a target position identifier and a capture rule for a target packet in a packet processing process corresponding to the target position identifier; when any packet processing process of the packet processing task is performed, executing the callback function, and when the position identifier corresponding to the packet processing process matches the target position identifier, capturing the target packet in the packet processing process corresponding to the target position identifier according to the capture rule for the target packet.

2. The method of claim 1, wherein, The capture rule is contained in an extended Berkeley packet filter (eBPF) instruction code, and the capturing of the target packet in the packet processing process corresponding to the target position identifier according to the capture rule for the target packet comprises: calling an eBPF to execute the eBPF instruction code to capture the target packet in the packet processing process corresponding to the target position identifier.

3. The method of claim 2, wherein, The calling of the eBPF to execute the eBPF instruction code to capture the target packet in the packet processing process corresponding to the target position identifier comprises: calling the eBPF to execute the eBPF instruction code to mark the target packet in the packet processing process corresponding to the target position identifier; capturing the target packet according to the marking of the target packet.

4. The method of claim 1, wherein, When the multiple position identifiers and the multiple callback functions are set in the packet processing task, the method further comprises: for any packet processing process of the packet processing task, setting a kernel for executing packet capture for the packet processing process.

5. The method according to any one of claims 1-4, characterized in that, The method further comprises: copying the captured target packet to a packet resource pool, and storing an address of the target packet in the packet resource pool in a packet address set.

6. The method according to any one of claims 1-4, characterized in that, The method further comprises: after capturing the target packet in the packet processing process corresponding to the target position identifier, deleting the packet capture rule.

7. A packet capturing device, characterized by, The device comprises: a processing module configured to set multiple position identifiers and multiple callback functions in a packet processing task, wherein the multiple position identifiers and the multiple callback functions correspond to multiple packet processing processes of the packet processing task, and the callback function is used to return a position identifier corresponding to a packet processing process; wherein each position identifier is an identity number composed of numbers and / or characters, and each position identifier uniquely corresponds to a packet processing process of a packet processing task; an obtaining module configured to obtain a packet capture rule, wherein the packet capture rule comprises a target position identifier and a capture rule for a target packet in a packet processing process corresponding to the target position identifier; The processing module is further configured to execute the callback function when proceeding to any packet processing process of the packet processing task, and perform packet capturing on the target packet in the packet processing process corresponding to the target location identifier according to the packet capturing rule of the target packet when the location identifier corresponding to the packet processing process matches the target location identifier.

8. The apparatus of claim 7, wherein, The packet capturing rule is contained in an extended Berkeley Packet Filter (eBPF) instruction code, and the processing module is specifically configured to: invoke the eBPF to execute the eBPF instruction code to perform packet capturing on the target packet in the packet processing process corresponding to the target location identifier.

9. An electronic device, comprising: The electronic device at least includes a processor and a memory, and the processor executes the computer program or instruction stored in the memory to implement the method in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer program or instruction is stored in the memory, and the computer program or instruction is executed by the processor to implement the method in any one of claims 1-6.

Images