Data packet filtering method, apparatus and device

Abstract

The application provides a data packet filtering method, device and equipment, the method comprising: obtaining at least one first data packet to be filtered, the second data packet is; in the user state, filtering the at least one first data packet according to the pre-configured five tuple information, and obtaining the second data packet; in the user state, filtering the second data packet using the pre-configured filtering rule; the filtering rule comprises: the rule obtained based on the Berkeley packet filter (BPF) expression.The method of the embodiment of the application can support BPF expression filtering in the user state program, and has less influence on the performance of the network equipment starting BPF packet capture in a large flow scenario, is suitable for high-end network equipment, and is suitable for the packet capture scenario of the configuration BPF expression filtering in a large flow scenario.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and particularly relates to a data packet filtering method, device and equipment. BACKGROUND

[0002] Firewall is a very important network security mechanism, which is used as a network traffic filter to filter all traffic entering or leaving a local network.

[0003] At present, data packet transceiving is generally based on a user mode network card driver. In the user mode, data packet filtering is generally performed by filtering five tuple information of the data packet in a data packet analysis process, and the five tuple information includes source IP, destination IP, source port, destination port and protocol. The filtering mode can only filter the five tuple information, is not flexible enough, and has poor filtering effect. SUMMARY

[0004] In view of the problems in the prior art, the embodiments of the present application provide a data packet filtering method, device and equipment.

[0005] The present application provides a data packet filtering method, comprising:

[0006] Obtaining at least one second data packet to be filtered, wherein the second data packet is obtained by filtering at least one first data packet according to preconfigured first five tuple information in a user mode.

[0007] In the user mode, the second data packet is filtered by using a preconfigured filtering rule, wherein the filtering rule includes a rule obtained based on a Berkeley Packet Filter (BPF) expression.

[0008] According to the data packet filtering method provided by the present application, the filtering of the second data packet by using the preconfigured filtering rule comprises:

[0009] Determining whether the processing mode is an engine filtering mode.

[0010] In the case that the processing mode is not the engine filtering mode, the second data packet is filtered by using the filtering rule through a Capture packet capture program.

[0011] In the case that the processing mode is the engine filtering mode, the second data packet is filtered by using the filtering rule through a data processing engine program.

[0012] According to the data packet filtering method provided by the present application, before the filtering of the second data packet by using the preconfigured filtering rule, the method further comprises:

[0013] configuring filtering rules and processing modes of the Capture packet capturing program and the data processing engine program by calling a configuration program;

[0014] The filtering rules of the data processing engine program further include second quintuple information.

[0015] According to the data packet filtering method provided by the present application, the method further comprises:

[0016] filtering the at least one first data packet according to the pre-configured first quintuple information by using the data processing engine program to obtain second data packets;

[0017] After the second data packets are obtained, the method further comprises:

[0018] storing the second data packets in a shared memory when the processing mode is not the engine filtering mode;

[0019] filtering the second data packets by using the Capture packet capturing program according to the filtering rules, comprising:

[0020] obtaining the second data packets from the shared memory by using the Capture packet capturing program and filtering the second data packets according to the filtering rules;

[0021] when the processing mode is the engine filtering mode, filtering the second data packets by using the data processing engine program according to the filtering rules and storing third data packets filtered in the shared memory.

[0022] According to the data packet filtering method provided by the present application, when the processing mode is the engine filtering mode, after the third data packets filtered are stored in the shared memory, the method further comprises:

[0023] obtaining the third data packets from the shared memory by using the Capture packet capturing program;

[0024] generating a packet capturing file according to the third data packets by using the Capture packet capturing program;

[0025] when the processing mode is not the engine filtering mode, after the second data packets are filtered according to the filtering rules, the method further comprises:

[0026] generating a packet capturing file according to the fourth data packets filtered by using the Capture packet capturing program.

[0027] According to the data packet filtering method provided by the present application, the method further comprises:

[0028] Obtain third five tuple information in a socket buffer (SKB) data structure in the first data packet;

[0029] Match the third five tuple information in the SKB data structure with the preconfigured first five tuple information;

[0030] Filter out the matched first data packet to obtain the second data packet.

[0031] According to the data packet filtering method provided by the application, the Capture packet capture program and the data processing engine program include a transplanted BPF library.

[0032] The application further provides a data packet filtering device, comprising:

[0033] An obtaining module is configured to obtain at least one second data packet to be filtered; the second data packet is obtained by filtering at least one first data packet according to preconfigured first five tuple information in a user mode.

[0034] A processing module is configured to filter the second data packet according to a preconfigured filtering rule in the user mode; the filtering rule includes a rule obtained based on a Berkeley packet filter (BPF) expression.

[0035] The application further provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the data packet filtering method according to any of the above when executing the program.

[0036] The application further provides a non-transitory computer readable storage medium having a computer program stored thereon, and the computer program is executable on a processor to implement the data packet filtering method according to any of the above.

[0037] The application further provides a computer program product including a computer program, and the computer program is executable on a processor to implement the data packet filtering method according to any of the above.

[0038] The data packet filtering method, device, and equipment provided by the application obtain at least one second data packet to be filtered; the second data packet is obtained by filtering at least one first data packet according to preconfigured first five tuple information in a user mode; further, the second data packet is filtered according to a preconfigured filtering rule in the user mode; the filtering rule includes a rule obtained based on a Berkeley packet filter (BPF) expression, and the above scheme can support BPF expression filtering in the user mode, and the preliminary filtering based on five tuple information is performed, and then the filtering rule obtained based on the BPF expression is used for filtering, and the filtering effect is better. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the present application or the prior art, the drawings required to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0040] Figure 1 is one of the flowcharts of the data packet filtering method provided by the present application;

[0041] Figure 2 is one of the principle diagrams of the data packet filtering method provided by the present application;

[0042] Figure 3 is the second principle diagram of the data packet filtering method provided by the present application;

[0043] Figure 4 is a structural diagram of the data packet filtering device provided by the present application;

[0044] Figure 5 is a structural diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0045] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely in combination with the drawings in the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort belong to the scope of protection of the present application.

[0046] Firstly, the technical terms and application scenarios related to the embodiments of the present application are introduced:

[0047] Packet capture: capturing, retransmitting, editing, storing, etc. of data packets transmitted in network devices, also used to check network security. Packet capture is also often used for data interception, network topology environment problem positioning, etc.

[0048] Berkeley Packet Filter (BPF) is a very powerful filtering mechanism, which is widely used in various packet sniffing software, such as network data collection and analysis tool TCPDump, wireshark, etc., which rely on the packet capture function library libpcap / WinPcap library using BPF.

[0049] Network equipment: Specialized hardware devices used to connect various servers, personal computers (PCs), terminals and other nodes to form an information communication network.

[0050] The method of this invention can be applied in the field of network security to network devices that need to analyze network traffic, such as firewall devices, intrusion detection devices, and intrusion prevention devices.

[0051] In the process of implementing the embodiments of the present invention, the inventors discovered that:

[0052] Data packet transmission and reception on high-performance dedicated network devices are generally based on user-space network card drivers.

[0053] In user space, packet filtering is generally done by filtering the five-tuple information of the packet during the packet parsing process. However, this method has few filtering factors, is not flexible enough, and has poor filtering effect.

[0054] Alternatively, data packets can be sent to the virtual network interface in the kernel, and the TCPDump tool can be used to capture packets on the virtual network interface. TCPDump supports BPF filtering.

[0055] However, this requires creating a kernel virtual network interface. After the network device receives network packets in user space, it sends the packets to the kernel for filtering using the TCPDump tool (TCPDump carries BPF parameters, allowing BPF filtering to be performed within the kernel). This process involves copying network packets from user space into the kernel for filtering, and then copying the kernel-mode packets back to user space. Due to these multiple data memory copies and the switching between kernel and user modes, the packet processing flow becomes lengthy and inefficient, leading to a decrease in device performance. This is especially problematic during high-volume data processing, impacting overall device performance.

[0056] The following is combined with Figures 1-5 The technical solutions of the embodiments of the present invention will be described in detail with reference to specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes may not be described again in some examples.

[0057] Figure 1 This is a flowchart illustrating the data packet filtering method provided by the present invention. Figure 1 As shown, the method provided in this embodiment includes:

[0058] Step 101: Obtain at least one second data packet to be filtered; the second data packet is obtained in user space after filtering at least one first data packet according to the pre-configured first 5-tuple information;

[0059] Specifically, the user state data processing engine program is adopted, after receiving the data packet in the user state, the data packet filtering is performed, and the first data packet can be matched and filtered by using the pre-configured first five tuple information to obtain the second data packet.

[0060] In step 102, the pre-configured filtering rule is used to filter the second data packet in the user state; the filtering rule includes the rule obtained based on the Berkeley packet filter (BPF) expression.

[0061] Specifically, the pre-configured filtering rule is used to filter the second data packet obtained by filtering in the user state, without copying the second data packet into the kernel, filtering by means of the kernel, and switching between the kernel state and the user state, so that the processing flow is simplified, and the processing efficiency is high.

[0062] Moreover, the BPF expression is pre-configured, and the filtering rule is generated based on the BPF expression, so that the data packet is more flexible to capture, and the BPF mechanism can be fully utilized to capture specific messages.

[0063] In the above scheme, the five tuple matching filtering + BPF filtering mode can improve the performance of the network device under the BPF expression filtering.

[0064] The method of the embodiment, by obtaining at least one second data packet to be filtered; the second data packet is obtained by filtering at least one first data packet according to the pre-configured first five tuple information in the user state; further, the pre-configured filtering rule is used to filter the second data packet in the user state; the filtering rule includes the rule obtained based on the Berkeley packet filter (BPF) expression, the above scheme can support the BPF expression filtering in the user state, and the preliminary filtering based on the five tuple information is performed, and then the pre-configured filtering rule based on the BPF expression is used for filtering, so that the filtering effect is good.

[0065] On the basis of the above embodiment, step 103 can be implemented by the following method:

[0066] Determine whether the processing mode is an engine filtering mode;

[0067] In the case that the processing mode is not the engine filtering mode, the second data packet is filtered by using the filtering rule by means of the Capture packet capture program;

[0068] In the case that the processing mode is the engine filtering mode, the second data packet is filtered by using the filtering rule by means of the data processing engine program.

[0069] Specifically, different processing modes correspond to different filtering processes, and optionally, the data processing engine program can be a program for transmitting and receiving network data packets.

[0070] As shown in Figure 2 If the processing mode is not the engine filtering mode, that is, without affecting the performance of the data processing engine program, the second data packet can be filtered by the Capture packet capture program using the filter rule; if the processing mode is the engine filtering mode, the second data packet can be directly filtered by the data processing engine program using the filter rule.

[0071] In the above embodiments, different programs are used to perform BPF filtering under different processing modes, which has greater flexibility and does not affect the performance of the network device under the setting of the BPF expression filter.

[0072] Optionally, as shown in Figure 3 Before step 103, the following operations can also be performed:

[0073] The filter rules and processing modes of the Capture packet capture program and the data processing engine program are configured by calling the configuration program.

[0074] The filter rules of the data processing engine program further include second five-tuple information.

[0075] Specifically, the Capture packet capture program and the data processing engine program are configured by using the configuration program, for example, the configuration program is called on the management interface of the network device to configure the filter rules and processing modes of the Capture packet capture program and the data processing engine program.

[0076] The processing mode can be an engine filtering mode or other modes (such as a non-engine filtering mode or a capture filtering mode).

[0077] The filter rule can be a matching function generated based on a BPF expression.

[0078] Figure 3 In the network device Web management interface, a configuration program is called to configure the filter rules and processing modes of the Capture packet capture program and the data processing engine program. For the data processing engine program, the filter rules include second five-tuple information and a BPF expression; for the Capture packet capture program, the filter rules include a BPF expression. Optionally, the first five-tuple information and the second five-tuple information can be the same or different.

[0079] The configuration program uses the data processing engine program to adopt the DPDK BPF library to generate a matching function from a BPF expression during the configuration process.

[0080] The configuration program uses the Capture packet capturing program to adopt the DPDK BPF library to generate a matching function from a BPF expression during the configuration process.

[0081] Optionally, the Capture packet capturing program and the data processing engine program include a transplanted BPF library.

[0082] In the above embodiment, the processing mode and the filtering rule are preconfigured by the configuration program, and the filtering efficiency can be improved.

[0083] On the basis of existing five-tuple information message filtering, the BPF library of DPDK is transplanted to support bpf filtering expressions in the user mode, and the packet capturing is more flexible, and the bpf syntax can be fully utilized to capture specific packets.

[0084] Optionally, step 102 can be implemented in the following manner:

[0085] Obtain third five-tuple information in a socket buffer (SKB) data structure in the first data packet;

[0086] Match the third five-tuple information in the SKB data structure with the preconfigured first five-tuple information;

[0087] Filter out the matched first data packet to obtain the second data packet.

[0088] Specifically, the third five-tuple information in the SKB data structure in the first data packet is obtained, and the third five-tuple information in the SKB data structure is matched with the preconfigured first five-tuple information, for example, the corresponding information in the third five-tuple information and the first five-tuple information is matched, such as at least one of source IP, destination IP, source port, destination port, and protocol, if one item is matched, the first data packet is filtered out, and the second data packet is obtained by filtering, or if at least two items are matched, the first data packet is filtered out, or if all items are matched, the first data packet is filtered out.

[0089] For example, the pre-configured first five-tuple information includes: source IP {IPi, IPi+1, …, IPi+m}, destination IP {IPk, IPk+1, …, IPk+m}, source port {port j, port j+1, …, port j+n}, destination port {port l, portl+1, …, port l+n}, protocol {protocol 1, protocol 2, …, protocol L}, and the SKB data structure for parsing the first data packet. The third five-tuple information is obtained as follows: the source IP is IPi+1, the destination IP is IP2, the source port is port j+1, the destination port is port2, and the protocol is protocol n. The source IP and the source port are matched with the source IP and the source port in the pre-configured first five-tuple information, respectively. The first data packet is filtered out.

[0090] Optionally, the method further includes:

[0091] filtering the at least one first data packet according to the pre-configured first five-tuple information by using the data processing engine program to obtain a second data packet;

[0092] After obtaining the second data packet, the method further includes:

[0093] storing the second data packet in shared memory when the processing mode is not the engine filtering mode;

[0094] filtering the second data packet by using the Capture packet capturing program and the filtering rule, including:

[0095] obtaining the second data packet from the shared memory by using the Capture packet capturing program and filtering the second data packet by using the filtering rule;

[0096] when the processing mode is the engine filtering mode, performing the step of filtering the second data packet by using the data processing engine program and the filtering rule, and storing a third data packet obtained by filtering in shared memory.

[0097] Specifically, as shown in Figure 2 the step 102 can be performed by using the data processing engine program (five-tuple information filtering). After the step 102 is performed, if a non-engine filtering mode is used, the second data packet is stored in shared memory. The second data packet is obtained from the shared memory by using the Capture packet capturing program, and the second data packet is filtered by using the filtering rule.

[0098] If the engine filtering mode is used, the second data packet is directly filtered by using the data processing engine program according to the filtering rule, and the third data packet obtained by filtering is stored in the shared memory.

[0099] In the above embodiment, the BPF filtering is realized by using the Capture packet capturing program or the data processing engine program, and the filtering effect is good.

[0100] Optionally, in the case where the processing mode is the engine filtering mode, after the third data packet obtained by filtering is stored in the shared memory, the method further comprises:

[0101] The third data packet is obtained from the shared memory by using the Capture packet capturing program;

[0102] The packet capturing file is generated by using the Capture packet capturing program according to the third data packet;

[0103] In the case where the processing mode is not the engine filtering mode, after the second data packet is filtered according to the filtering rule, the method further comprises:

[0104] The packet capturing file is generated by using the Capture packet capturing program according to the fourth data packet obtained by filtering.

[0105] Specifically, the packet capturing file is generated by using the Capture packet capturing program after filtering, in the case where the processing mode is the engine filtering mode, the third data packet is obtained from the shared memory by using the Capture packet capturing program; and the packet capturing file is generated by using the Capture packet capturing program according to the third data packet.

[0106] In the case where the processing mode is not the engine filtering mode, since the BFP filtering is performed by using the Capture packet capturing program, the packet capturing file is directly generated by using the Capture packet capturing program according to the fourth data packet obtained by filtering.

[0107] In summary, in the scheme of the embodiment of the application, one configuration program and two user state processing programs are cooperated to finally generate the packet capturing file. The configuration program supports the configuration of the interface, the five-tuple information of the data packet, the BPF expression and the processing mode. In the non-engine filtering mode, the BFP filtering is performed by using the Capture packet capturing program; and in the engine filtering mode, the BFP filtering is performed by using the data processing engine program.

[0108] The data packet filtering device provided by the application is described below, and the data packet filtering device described below can be correspondingly referred to the data packet filtering method described above.

[0109] Figure 4 is a structural schematic diagram of a data packet filtering device provided by the present application. As shown in Figure 4 the embodiment provides a data packet filtering device, which comprises:

[0110] The acquisition module 410 is configured to acquire at least one second data packet to be filtered; the second data packet is obtained by filtering at least one first data packet according to preconfigured first quintuple information in a user mode.

[0111] The processing module 420 is configured to filter the second data packet according to a preconfigured filtering rule in the user mode; the filtering rule comprises a rule obtained based on a Berkeley packet filter (BPF) expression.

[0112] Optionally, the processing module 420 is specifically configured to:

[0113] determine whether the processing mode is an engine filtering mode;

[0114] if the processing mode is not the engine filtering mode, filter the second data packet according to the filtering rule by using a capture packet program;

[0115] if the processing mode is the engine filtering mode, filter the second data packet according to the filtering rule by using a data processing engine program.

[0116] Optionally, the processing module 420 is further configured to:

[0117] before filtering the second data packet according to the preconfigured filtering rule, configure the filtering rule and the processing mode of the capture packet program and the data processing engine program by calling a configuration program;

[0118] the filtering rule of the data processing engine program further comprises second quintuple information.

[0119] Optionally, the processing module 420 is specifically configured to:

[0120] filter the at least one first data packet according to the preconfigured first quintuple information by using the data processing engine program to obtain the second data packet;

[0121] if the processing mode is not the engine filtering mode, store the second data packet in a shared memory;

[0122] acquire the second data packet from the shared memory by using the capture packet program, and filter the second data packet according to the filtering rule;

[0123] In a case where the processing mode is the engine filtering mode, a step of filtering the second data packet by using a data processing engine program to adopt the filtering rule is performed, and a third data packet filtered is stored in a shared memory.

[0124] Optionally, the processing module 420 is further configured to:

[0125] In a case where the processing mode is the engine filtering mode, after the third data packet filtered is stored in the shared memory, the third data packet is acquired from the shared memory by using the Capture packet capturing program.

[0126] A packet capturing file is generated by using the Capture packet capturing program according to the third data packet.

[0127] In a case where the processing mode is not the engine filtering mode, after the second data packet is filtered by using the filtering rule, a packet capturing file is generated by using the Capture packet capturing program according to a fourth data packet filtered.

[0128] Optionally, the processing module 420 is specifically configured to:

[0129] Third quintuple information in a socket buffer (SKB) data structure in the first data packet is acquired.

[0130] The third quintuple information in the SKB data structure is matched with the preconfigured first quintuple information.

[0131] The matched first data packet is filtered out to obtain the second data packet.

[0132] Optionally, the Capture packet capturing program and the data processing engine program include a transplanted BPF library.

[0133] The device of the embodiment of the application is used to execute the method in any one of the method embodiments, and has similar implementation principles and technical effects, which will not be described herein again.

[0134] Figure 5 An example of an entity structure diagram of an electronic device is shown in FIG. 1. Figure 5 As shown in FIG. 1, the electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 complete mutual communication through the communications bus 540. The processor 510 can invoke a logical instruction in the memory 530 to execute a data packet filtering method, and the method includes:

[0135] obtaining at least one second data packet to be filtered, the second data packet being obtained by filtering at least one first data packet according to pre-configured five-tuple information under a user mode;

[0136] filtering the second data packet by using a pre-configured filtering rule under the user mode; the filtering rule comprises a rule obtained based on a Berkeley Packet Filter (BPF) expression.

[0137] In addition, the logical instructions in the memory 530 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0138] On the other hand, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program is executed by a processor, so that the computer can execute the data packet filtering method provided by the above-mentioned methods, and the method comprises:

[0139] obtaining at least one second data packet to be filtered, the second data packet being obtained by filtering at least one first data packet according to pre-configured five-tuple information under a user mode;

[0140] filtering the second data packet by using a pre-configured filtering rule under the user mode; the filtering rule comprises a rule obtained based on a Berkeley Packet Filter (BPF) expression.

[0141] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the data packet filtering method provided by the above-mentioned methods, and the method comprises:

[0142] obtaining at least one second data packet to be filtered, the second data packet being obtained by filtering at least one first data packet according to pre-configured five-tuple information under a user mode;

[0143] In the user mode, the second data packet is filtered by using a preconfigured filtering rule, and the filtering rule includes a rule obtained based on a Berkeley Packet Filter (BPF) expression.

[0144] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0145] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and the necessary general hardware platform, and of course, it can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0146] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data packet filtering method, characterized in that, include: Obtain at least one second data packet to be filtered, wherein the second data packet is obtained in user space after filtering at least one first data packet according to pre-configured first 5-tuple information; In user space, the second data packet is filtered using pre-configured filtering rules; The filtering rules include: rules derived from the Berkeley Package Filter (BPF) expression; The filtering of the second data packet using pre-configured filtering rules includes: Determine if the processing mode is engine filtering mode; If the processing mode is not the engine filtering mode, the second data packet is filtered using the filtering rules by the Capture packet capture program; When the processing mode is engine filtering mode, the second data packet is filtered using the filtering rules by the data processing engine program.

2. The data packet filtering method according to claim 1, characterized in that, Before filtering the second data packet using pre-configured filtering rules, the process further includes: The filtering rules and processing modes of the Capture packet capture program and the data processing engine program are configured by calling the configuration program; The filtering rules of the data processing engine program also include: second quintuple information.

3. The data packet filtering method according to claim 1 or 2, characterized in that, The method further includes: The data processing engine program filters the at least one first data packet based on the pre-configured first quintuple information to obtain a second data packet; After obtaining the second data packet, the process also includes: If the processing mode is not the engine filtering mode, the second data packet is stored in shared memory; The second data packet is filtered using the aforementioned filtering rules through the Capture packet capture program, including: The second data packet is obtained from shared memory using the Capture packet capture program, and the second data packet is filtered using the filtering rules. When the processing mode is engine filtering mode, the step of filtering the second data packet using the filtering rules by the data processing engine program is executed, and the filtered third data packet is stored in shared memory.

4. The data packet filtering method according to claim 3, characterized in that, When the processing mode is engine filtering mode, after storing the filtered third data packet in shared memory, the method further includes: The third data packet is obtained from the shared memory using the Capture packet capture program; The Capture packet capture program is used to generate a packet capture file based on the third data packet; If the processing mode is not the engine filtering mode, after filtering the second data packet using the filtering rules, the process further includes: The Capture packet capture program is used to generate a packet capture file based on the filtered fourth data packet.

5. The data packet filtering method according to claim 1 or 2, characterized in that, The method further includes: Obtain the third quintuple information from the socket cache SKB data structure in the first data packet; Match the third quintuple information in the SKB data structure with the pre-configured first quintuple information; The first matching data packet is filtered out to obtain the second data packet.

6. The data packet filtering method according to claim 1 or 2, characterized in that, The Capture packet capture program and the data processing engine program include a ported BPF library.

7. A data packet filtering device, characterized in that, include: The acquisition module is used to acquire at least one second data packet to be filtered; The second data packet is obtained in user space by filtering at least one first data packet according to the pre-configured first 5-tuple information; The processing module is used to filter the second data packet in user space using pre-configured filtering rules; the filtering rules include rules obtained based on Berkeley Packet Filter (BPF) expressions. The processing module is specifically used for: Determine if the processing mode is engine filtering mode; If the processing mode is not the engine filtering mode, the second data packet is filtered using the filtering rules by the Capture packet capture program; When the processing mode is engine filtering mode, the second data packet is filtered using the filtering rules by the data processing engine program.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the packet filtering method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the packet filtering method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the packet filtering method as described in any one of claims 1 to 6.

Images