A data link layer traffic analysis method

Abstract

The present invention relates to a data link layer traffic analysis method, belonging to the field of communication technology, wherein the method comprises: obtaining a network message; parsing the data structure of the network message to obtain message data of a data link layer protocol type; parsing the data structure corresponding to the message data of the data link layer to obtain DMAC, SMAC and protocol type; performing hash calculation on DMAC and / or SMAC and the protocol type to obtain a hash result; inserting the hash result into a hash table as a key value; inserting the message data of the data link layer corresponding to the hash result into the hash table as a value value; and analyzing the network message based on the hash table. The present invention realizes the parsing of link layer protocol traffic and performs statistics on the parsed data.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data link layer traffic analysis method. Background Art

[0002] The data link layer protocol is located at the second layer of the OSI model, so it is also called the second layer protocol. Compared with common network layer protocols such as IP, IPv6, ICMP, etc., the data link layer protocol is generally used in specific fields to control and manage the network, rather than to carry business traffic.

[0003] Since the link layer protocol is not connection-oriented, it is not possible to directly create sessions for statistics and management through five-tuple information like TCP, UDP and other high-level protocols. In terms of network traffic monitoring, general traffic monitoring products do not effectively monitor and count data link layer protocols. However, in fact, many network attacks such as ARP spoofing, flooding attacks, and some network failures are related to link layer protocols. Therefore, effective monitoring and statistics of link layer protocol traffic is also an urgent problem that needs to be faced and solved.

[0004] In summary, the prior art lacks a method for parsing link layer protocol traffic and performing statistics. Summary of the invention

[0005] In view of this, it is necessary to provide a data link layer traffic analysis method to achieve the purpose of parsing link layer protocol traffic and performing statistics.

[0006] In order to achieve the above object, the present invention provides a data link layer traffic analysis method, comprising:

[0007] Get network messages;

[0008] Parsing the data structure of the network message to obtain message data whose protocol type is data link layer;

[0009] Parse the data structure corresponding to the message data of the data link layer to obtain DMAC, SMAC and protocol type;

[0010] Perform hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result;

[0011] Insert the hash result into the hash table as the key value;

[0012] Insert the data link layer message data corresponding to the hash result as value into the hash table to obtain the inserted hash table;

[0013] The network message is analyzed based on the inserted hash table.

[0014] In a possible implementation, parsing the data structure of the network message to obtain message data whose protocol type is a data link layer includes:

[0015] Determine the protocol layer of the network message based on the bytes after DMAC and / or SMAC in the data structure of the network message;

[0016] The message data corresponding to the non-data link layer in the protocol layer is eliminated to obtain the message data corresponding to the data link layer.

[0017] In a possible implementation, the determining the protocol layer of the network message based on the bytes after the DMAC and / or SMAC in the data structure of the network message includes:

[0018] When the DMAC in the data structure of the network message is a value of a preset protocol, determining that the network message is data link layer data;

[0019] When the DMAC in the data structure of the network message is not a value of a preset protocol, the protocol layer of the network message is determined according to the number of bytes after SMAC.

[0020] In a possible implementation, determining the protocol layer of the network message according to the number of bytes after SMAC includes:

[0021] When the first byte number after SMAC is greater than a first preset value, it is determined that the Ethernet frame of the network message is Ethernet II, and the protocol layer of the network message is determined according to the type field in the Ethernet frame, and the first byte number is the two byte numbers after SMAC;

[0022] When the first byte number after SMAC is not greater than a first preset value, the protocol layer of the network message is determined according to the second byte number after SMAC, where the second byte number is the last two digits of the first byte number.

[0023] In a possible implementation, determining the protocol layer of the network message according to the second byte number after the SMAC includes:

[0024] When the second number of bytes after SMAC is a second preset value, it is determined that the Ethernet frame of the network message is IEEE802.3RAW, and it is determined that the network message is network layer data;

[0025] When it is determined that the second byte number after SMAC is not the second preset value, and the second byte number after SMAC is equal to the third preset value, determining that the Ethernet frame of the network message is IEEE 802.3SNAP, and determining the protocol layer of the network message according to the SNAP field in the Ethernet frame;

[0026] When it is determined that the second byte number after SMAC is not the second preset value, and the second byte number after SMAC is not equal to the third preset value, the Ethernet frame of the network message is determined to be IEEE 802.3LLC, and the protocol layer of the network message is determined according to the DSAP and SSAP fields in the Ethernet frame.

[0027] In a possible implementation, performing hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result includes:

[0028] Perform hash calculation on DMAC, SMAC and the protocol type to obtain a first hash result;

[0029] Perform hash calculation on SMAC, DMAC and the protocol type to obtain a second hash result;

[0030] The first hash result and the second hash result are marked as the same data link layer session, and the marked first hash result and the marked second hash result are inserted into the first hash table as key values.

[0031] In a possible implementation, performing hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result includes:

[0032] Perform hash calculation on the SMAC and the protocol type to obtain a third hash result;

[0033] Insert the third hash result as the key value into the second hash table.

[0034] In a possible implementation, analyzing the network message based on the hash table includes:

[0035] The key value in the hash table is used to determine the session node;

[0036] The value in the hash table is used to count the traffic data of the network message.

[0037] In a possible implementation, the traffic data includes: number of packets, number of bytes, bit rate, packet length, number of broadcast packets, and session duration.

[0038] In a possible implementation, the method further includes:

[0039] A preset aging time is set, and the hash table is cleared based on the preset aging time.

[0040] The beneficial effects of the present invention are as follows: a data link layer traffic analysis method provided by the present invention first obtains a network message, then parses the data structure of the network message, obtains message data of the protocol type being the data link layer, further parses the data structure corresponding to the message data of the link layer, obtains DMAC, SMAC and the protocol type, further hashes the DMAC and / or SMAC with the protocol type to obtain a hash result, thereby storing the data in a hash table, then inserts the hash result into the hash table as a key value, inserts the message data of the data link layer corresponding to the hash result into the hash table as a value value to obtain an inserted hash table, thereby making the key values ​​correspond one to one, and finally analyzes the network message based on the inserted hash table. The present invention parses the network message data to obtain the data of the data link layer, thereby providing a basis for judging network attacks and network failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A method flow chart of an embodiment of a data link layer traffic analysis method provided by the present invention;

[0042] Figure 2 For the present invention Figure 1 A schematic flow chart of an embodiment of S102;

[0043] Figure 3 A schematic flow chart of an embodiment of a data link layer traffic analysis device provided by the present invention;

[0044] Figure 4 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0045] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0046] Before presenting the embodiments, the network protocol architecture of ISO / OSI is introduced first.

[0047] The ISO / OSI network protocol architecture consists of seven layers, from low to high:

[0048] Physical layer: responsible for transmitting the original bit stream on the physical media, defining the electrical, mechanical and process specifications of the network, such as cable specifications, interface standards, etc.

[0049] Data link layer: establishes, maintains, and releases data links between adjacent nodes, is responsible for combining bit streams into frames, and performs error detection and flow control.

[0050] Network layer: responsible for establishing, maintaining and terminating network connections on the communication subnet between two end systems. Its main tasks are routing selection and congestion control.

[0051] Transport layer: Provides end-to-end transparent data transmission services for communications between session layer entities, such as TCP and UDP protocols.

[0052] Session layer: responsible for establishing, managing and synchronizing sessions between two communicating entities, handling synchronization of data exchange and dialogue control.

[0053] Presentation layer: encodes and decodes data, handles data format conversion, encryption and decryption, etc., to ensure that the data format between the sender and the receiver is consistent.

[0054] Application layer: Provides network service access points for applications, such as FTP, HTTP, SMTP and other protocols, and directly provides services for user applications.

[0055] Among them, the encapsulation message is from the upper layer to the lower layer, that is, the application layer --> transport layer --> network layer --> data link layer --> physical layer, and the decapsulation message is from the lower layer to the upper layer.

[0056] Messages are generated by the application layer and are called messages / data. They are encapsulated by the transport layer to form segments / datagrams, and then encapsulated by the network layer to form packets / packets. They are then encapsulated by the data link layer to form frames, and finally the data is transmitted in the form of binary bit streams at the physical layer. During the transmission process, each layer will add some control information to the header, which is the message header. At the receiving end, each layer will remove the header it added and restore the original data.

[0057] The present invention provides a data link layer traffic analysis method, which is described below.

[0058] Figure 1 A flow chart of an embodiment of the data link layer traffic analysis method provided by the present invention is as follows: Figure 1 As shown, the data link layer traffic analysis method includes:

[0059] S101, obtaining network messages;

[0060] S102, parsing the data structure of the network message to obtain message data whose protocol type is data link layer;

[0061] S103, parsing the data structure corresponding to the message data of the data link layer to obtain DMAC, SMAC and protocol type;

[0062] S104, performing hash calculation on DMAC and / or SMAC and the protocol type to obtain a hash result;

[0063] S105, inserting the hash result into the hash table as the key value;

[0064] S106, inserting the data link layer message data corresponding to the hash result as value into the hash table to obtain the inserted hash table;

[0065] S107: Analyze the network message based on the inserted hash table.

[0066] Compared with the prior art, the data link layer traffic analysis method provided in this embodiment first obtains the network message, then parses the data structure of the network message, obtains the message data of the protocol type as the data link layer, further parses the data structure corresponding to the message data of the link layer, obtains DMAC, SMAC and the protocol type, further performs hash calculation on DMAC and / or SMAC and the protocol type to obtain the hash result, thereby storing the data in the hash table, and then inserts the hash result into the hash table as the key value, inserts the message data of the data link layer corresponding to the hash result into the hash table as the value value to obtain the inserted hash table, thereby making the key values ​​correspond one to one, and finally analyzes the network message based on the inserted hash table. The present invention parses the network message data to obtain the data of the data link layer, thereby providing a basis for the judgment of network attacks and network failures.

[0067] It should be noted that data packets are called "frames" in the data link layer. There are four frame data encapsulation formats, namely Ethernet Ⅱ, Novell Ethernet / 802.3 RAW, IEEE802.3 LLC, and IEEE 802.3 SNAP. The detailed differences between each format are as follows:

[0068] EthernetⅡ is the most commonly used Ethernet format, including 6-byte DMAC, 6-byte SMAC, and 2-byte protocol type, which is used to mark the upper layer protocol, and its value must be greater than 0x05dc. Common high-level protocols such as IP, IPv6 (network layer), TCP, UDP (transport layer), HTTP (application layer) are basically carried by EthernetⅡ. The EthernetⅡ frame format is shown in Table 1:

[0069] Table 1: Ethernet II frame format

[0070]

[0071] Novell Ethernet / 802.3 RAW is a dedicated Ethernet standard frame format announced by Novell in 1983. It specifically separates the data field of IEEE 802.3 to transmit NetWare type data. It currently only supports carrying IPX / SPX protocol (network layer). In addition to the MAC address, it includes a 2-byte length followed by two bytes of 0xFFFF. The 802.3RAW frame format is shown in Table 2:

[0072] Table 2: 802.3 RAW frame format

[0073]

[0074] 802.3 LLC, the 802.3 standard frame format established by IEEE, compared with the EthernetⅡ format, the protocol field is changed to the length field, and an LLC header is added at the end, which consists of three fields: DSAP, SSAP, and CTRL. The upper layer protocol can be determined by the values ​​of the DSAP and SSAP fields. The 802.3 LLC frame format is shown in Table 3:

[0075] Table 3: 802.3 LLC frame format

[0076]

[0077] 802.3 SNAP, IEEE developed the SNAP format to solve the incompatibility problem between 802.3LLC and EthernetⅡ. A 5-byte SNAP field is added after the LLC header, including a 3-byte organization identifier (OUI) and a 2-byte protocol type. At this time, the DSAP and SSAP fields are fixed to 0xAA, and when the OUI field is all 0, the protocol type is defined the same as the protocol type in EthernetⅡ, so theoretically IP packets can also be encapsulated in this format. The 802.3 SNAP frame format is shown in Table 4:

[0078] Table 4: 802.3 SNAP frame format

[0079]

[0080] In some embodiments of the present invention, in step S102, parsing the data structure of the network message to obtain message data whose protocol type is a data link layer includes:

[0081] S201, determining the protocol layer of the network message based on the bytes after DMAC and / or SMAC in the data structure of the network message;

[0082] S202: Eliminate message data corresponding to non-data link layers in the protocol layer to obtain message data corresponding to the data link layer.

[0083] In some embodiments of the present invention, the determining the protocol layer of the network message based on the bytes after the DMAC and / or SMAC in the data structure of the network message includes:

[0084] When the DMAC in the data structure of the network message is a value of a preset protocol, determining that the network message is data link layer data;

[0085] When the DMAC in the data structure of the network message is not a value of a preset protocol, the protocol layer of the network message is determined according to the number of bytes after SMAC.

[0086] It should be noted that both the LACP protocol and the STP protocol are data link layer protocols. In a specific embodiment of the present invention, the preset protocol is the LACP protocol or the STP protocol. When the protocol is the LACP protocol, the value of DMAC is 01-80-C2-00-00-02, and when the protocol is the STP protocol, the value of DMAC is 01-80-C2-00-00-00. It can be understood that this embodiment can also be other data link layer protocols.

[0087] In some embodiments of the present invention, determining the protocol layer of the network message according to the number of bytes after SMAC includes:

[0088] When the first byte number after SMAC is greater than a first preset value, it is determined that the Ethernet frame of the network message is Ethernet II, and the protocol layer of the network message is determined according to the type field in the Ethernet frame, and the first byte number is the two byte numbers after SMAC;

[0089] When the first byte number after SMAC is not greater than a first preset value, the protocol layer of the network message is determined according to the second byte number after SMAC, where the second byte number is the last two digits of the first byte number.

[0090] In some embodiments of the present invention, determining the protocol layer of the network message according to the second byte number after SMAC includes:

[0091] When the second number of bytes after SMAC is a second preset value, it is determined that the Ethernet frame of the network message is IEEE802.3RAW, and it is determined that the network message is network layer data;

[0092] When it is determined that the second byte number after SMAC is not the second preset value, and the second byte number after SMAC is equal to the third preset value, determining that the Ethernet frame of the network message is IEEE 802.3SNAP, and determining the protocol layer of the network message according to the SNAP field in the Ethernet frame;

[0093] When it is determined that the second byte number after SMAC is not the second preset value, and the second byte number after SMAC is not equal to the third preset value, the Ethernet frame of the network message is determined to be IEEE 802.3LLC, and the protocol layer of the network message is determined according to the DSAP and SSAP fields in the Ethernet frame.

[0094] In a specific embodiment of the present invention, the specific process of identifying the protocol of the network message is as follows:

[0095] Step 1: First check whether the DMAC of the network message data structure is a special value fixed by some Layer 2 protocols. This can quickly screen out some protocols, such as LACP protocol and STP protocol, which can be determined by DMCA value;

[0096] Step 2: If the value of the two bytes after SMAC is greater than the first preset value, i.e., 1500, it indicates that this is an Ethernet II type data frame, and then the protocol layer carried is identified according to the Type field. For protocols such as VLAN and MPLS that can be nested in headers, it is necessary to parse layer by layer according to the protocol specification until the type of the high-level protocol carried is identified;

[0097] Step 3: If the values ​​of the third and fourth bytes after SMAC are the second preset value, ie, 0xFFFF, it indicates that this is an 802.3RAW type frame, which can only carry the IPX protocol.

[0098] Step 4: If the values ​​of the third and fourth bytes after SMAC are the third preset value, i.e., 0xAAAA, it indicates that this is an 802.3SNAP type frame, and the protocol layer needs to be further identified based on the value of the SNAP header field;

[0099] Step 5: If none of the above conditions are met, it indicates an 802.3 LLC type frame. In this case, the protocol layer is identified based on DSAP and SSAP.

[0100] In some embodiments of the present invention, performing hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result includes:

[0101] Perform hash calculation on DMAC, SMAC and the protocol type to obtain a first hash result;

[0102] Perform hash calculation on SMAC, DMAC and the protocol type to obtain a second hash result;

[0103] The first hash result and the second hash result are marked as the same data link layer session, and the marked first hash result and the marked second hash result are inserted into the first hash table as key values.

[0104] In some embodiments of the present invention, performing hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result includes:

[0105] Perform hash calculation on the SMAC and the protocol type to obtain a third hash result;

[0106] Insert the third hash result as the key value into the second hash table.

[0107] In a specific embodiment of the present invention, after the second-layer protocol is identified, DMAC, SMAC, and the protocol type are hashed, and the previously created second-layer session table is searched to see if there is an identical session. If not, a new second-layer session data structure a is created and inserted into the second-layer session hash table. In order to identify the data in both directions of the communication node, SMAC and DMAC are exchanged, and a hash value is calculated with the protocol type. Similarly, a second-layer session structure b is created and inserted into the second-layer session table, and a and b are marked as belonging to the same second-layer session. In this way, the two-way traffic between the two communicating nodes is recorded, and the two-way traffic can be found when the hash table is searched.

[0108] For some Layer 2 protocols such as ARP, according to the protocol initiation process specification, the DMAC of the first packet is a broadcast packet with all Fs, and there is no specific recipient. This message cannot be attributed to any Layer 2 session. Therefore, this kind of message needs to be classified and recorded separately. Through SMAC and protocol type, the hash value is calculated using these two fields and the hash value is inserted into the Layer 2 broadcast packet record table.

[0109] Optionally, if you need to count the first broadcast packet into the subsequent associated session, you need to save the hash value calculated by SMAC and protocol type in the session data of the Layer 2 protocol. In this way, after finding the Layer 2 session, you can search the broadcast packet table for the corresponding first packet based on this hash value. In order to improve the accuracy of association identification, you can also add a timestamp to the above data structure to limit the association of only the first packet found within a short period of time to the Layer 2 session.

[0110] In some embodiments of the present invention, the analyzing the network message based on the inserted hash table includes:

[0111] The key value in the inserted hash table is used to determine the session node;

[0112] The value in the inserted hash table is used to count the traffic data of the network message.

[0113] In some embodiments of the present invention, the flow data includes: number of packets, number of bytes, bit rate, packet length, number of broadcast packets and session duration. In a specific embodiment of the present invention, it is possible to determine whether there is an attack on the network data based on the statistics of the flow data, or to determine a network failure based on the statistical data.

[0114] It should be noted that most of the data link layer protocol interactions are very short processes and do not need to be recorded and saved for a long time. Therefore, it is necessary to start a scheduled task to regularly clean up the recorded data link layer session table and broadcast packet table to save memory resources. Generally, an aging time is set according to the session creation time to achieve scheduled cleaning. In some embodiments of the present invention, it also includes:

[0115] A preset aging time is set, and the hash table is cleared based on the preset aging time.

[0116] In order to better implement a data link layer traffic analysis method in an embodiment of the present invention, based on a data link layer traffic analysis method, correspondingly, as Figure 3 As shown, an embodiment of the present invention further provides a data link layer traffic analysis device, a data link layer traffic analysis device 300 includes:

[0117] The message acquisition module 301 is used to acquire network messages;

[0118] The message parsing module 302 is used to parse the data structure of the network message to obtain link layer message data whose protocol type is data link layer;

[0119] The data acquisition module 303 is used to parse the data structure corresponding to the message data of the data link layer to obtain the DMAC, SMAC and protocol type;

[0120] A hash calculation module 304 is used to perform a hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result;

[0121] A hash key value insertion module 305 is used to insert the hash result as a key value into the hash table;

[0122] A hash value insertion module 306 is used to insert the data link layer message data corresponding to the hash result as the value into the hash table to obtain the inserted hash table;

[0123] The data analysis module 307 is used to analyze the network message based on the inserted hash table.

[0124] The data link layer traffic analysis device 300 provided in the above embodiment can implement the technical solution described in the above data link layer traffic analysis method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above data link layer traffic analysis method embodiment, which will not be repeated here.

[0125] like Figure 4 As shown, the present invention also provides an electronic device 400. The electronic device 400 includes a processor 401, a memory 402 and a display 403. Figure 4 Only some components of the electronic device 400 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0126] In some embodiments, the processor 401 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 402, such as a data link layer traffic analysis method in the present invention.

[0127] In some embodiments, processor 401 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, processor 401 may be local or remote. In some embodiments, processor 401 may be implemented in a cloud platform. In some embodiments, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0128] In some embodiments, the memory 402 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. In other embodiments, the memory 402 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 400.

[0129] Furthermore, the memory 402 may include both an internal storage unit of the electronic device 400 and an external storage device. The memory 402 is used to store application software installed in the electronic device 400 and various data.

[0130] In some embodiments, the display 403 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 403 is used to display information on the electronic device 400 and to display a visual user interface. The components 401-403 of the electronic device 400 communicate with each other via a system bus.

[0131] In one embodiment, when the processor 401 executes a data link layer traffic analysis program in the memory 402, the following steps may be implemented:

[0132] Get network messages;

[0133] Parsing the data structure of the network message to obtain message data whose protocol type is data link layer;

[0134] Parse the data structure corresponding to the message data of the data link layer to obtain DMAC, SMAC and protocol type;

[0135] Perform hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result;

[0136] Insert the hash result into the hash table as the key value;

[0137] Insert the data link layer message data corresponding to the hash result as value into the hash table to obtain the inserted hash table;

[0138] The network message is analyzed based on the inserted hash table.

[0139] It should be understood that: when the processor 401 executes a data link layer traffic analysis program in the memory 402, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.

[0140] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 400 mentioned, and the electronic device 400 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 400 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0141] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0142] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A data link layer traffic analysis method, characterized in that: include: Get network messages; Parsing the data structure of the network message to obtain message data whose protocol type is data link layer; Parse the data structure corresponding to the message data of the data link layer to obtain DMAC, SMAC and protocol type; Perform hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result; Insert the hash result into the hash table as the key value; Insert the data link layer message data corresponding to the hash result as value into the hash table to obtain the inserted hash table; Analyzing the network message based on the inserted hash table; The parsing of the data structure of the network message to obtain message data of a protocol type of a data link layer includes: Determine the protocol layer of the network message based on the bytes after DMAC and / or SMAC in the data structure of the network message; Eliminate the message data corresponding to the non-data link layer in the protocol layer to obtain the message data corresponding to the data link layer; The determining the protocol layer of the network message based on the bytes after the DMAC and / or SMAC in the data structure of the network message includes: When the DMAC in the data structure of the network message is a value of a preset protocol, determining that the network message is data link layer data; When the DMAC in the data structure of the network message is not a value of a preset protocol, determining the protocol layer of the network message according to the number of bytes after SMAC; Determining the protocol layer of the network message according to the number of bytes after SMAC includes: When the first byte number after SMAC is greater than a first preset value, it is determined that the Ethernet frame of the network message is Ethernet II, and the protocol layer of the network message is determined according to the type field in the Ethernet frame, and the first byte number is the two byte numbers after SMAC; When the first byte number after SMAC is not greater than a first preset value, the protocol layer of the network message is determined according to the second byte number after SMAC, where the second byte number is the last two digits of the first byte number.

2. The data link layer traffic analysis method according to claim 1, characterized in that: Determining the protocol layer of the network message according to the second byte number after SMAC includes: When the second number of bytes after SMAC is a second preset value, it is determined that the Ethernet frame of the network message is IEEE802.3RAW, and it is determined that the network message is network layer data; When it is determined that the second byte number after SMAC is not the second preset value, and the second byte number after SMAC is equal to the third preset value, determining that the Ethernet frame of the network message is IEEE 802.3SNAP, and determining the protocol layer of the network message according to the SNAP field in the Ethernet frame; When it is determined that the second byte number after SMAC is not the second preset value, and the second byte number after SMAC is not equal to the third preset value, the Ethernet frame of the network message is determined to be IEEE 802.3LLC, and the protocol layer of the network message is determined according to the DSAP and SSAP fields in the Ethernet frame.

3. The data link layer traffic analysis method according to claim 1, characterized in that: The step of performing hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result includes: Perform hash calculation on DMAC, SMAC and the protocol type to obtain a first hash result; Perform hash calculation on SMAC, DMAC and the protocol type to obtain a second hash result; The first hash result and the second hash result are marked as the same data link layer session, and the marked first hash result and the marked second hash result are inserted into the first hash table as key values.

4. The data link layer traffic analysis method according to claim 1, characterized in that: The step of performing hash calculation on the DMAC and / or SMAC and the protocol type to obtain a hash result includes: Perform hash calculation on the SMAC and the protocol type to obtain a third hash result; Insert the third hash result as the key value into the second hash table.

5. The data link layer traffic analysis method according to claim 1, characterized in that: The analyzing the network message based on the inserted hash table includes: The key value in the inserted hash table is used to determine the session node; The value in the inserted hash table is used to count the traffic data of the network message.

6. The data link layer traffic analysis method according to claim 5, characterized in that: The traffic data includes: number of packets, number of bytes, bit rate, packet length, number of broadcast packets and session duration.

7. The data link layer traffic analysis method according to claim 1, characterized in that: Also includes: A preset aging time is set, and the inserted hash table is cleaned up based on the preset aging time.

Images