Method and device for capturing, storing and replaying data packet in high-speed scene

Abstract

The invention relates to the technical field of communication, in particular to a data packet capturing, storing and playback method and device under a high-speed scenario, and the method comprises the following steps: before starting to capture data, a configuration unit identifies the number of available disks, tests the sequential read-write performance of the disks, counts the input flow, and stores the input flow; automatically or manually configuring the corresponding relationship between the data packet input queues and the disks, and grouping and distributing the input queues to appropriate disks according to traffic; when a storage data packet is captured, a packet receiving unit directly receives a data packet in a network card queue in a user mode, and places data packet information into the queue according to a queue disk corresponding relation, and the data packet information is assembled and written into a disk by a storage unit; when the data packet is played back at a high speed, the configuration unit identifies the number of disks and additional write-in information, the reading unit reads disk sequence blocks in a user mode according to configuration analyzed by the configuration unit, the read data blocks are put into a playback queue, and the playback unit reads data in the playback queue.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for capturing, storing and replaying data packets in a high-speed scenario. Background Art

[0002] In the field of communications, packet capture and storage tools and packet playback tools are frequently used. Currently, the common method is to use tcpdump to capture packets and replay them through tcpreplay. However, due to the limitations of tcpdump in receiving packet performance and disk writing speed, these tools can usually only cope with low-speed environments, such as Gigabit networks, far from the requirements of 100G network environments. In this field, high-speed means: compared with the use range of traditional packet capture and playback tools and equipment less than 10Gbps, the rate range covered by high-speed packet capture and playback tools and equipment is within the range of 100G interfaces, that is, between 10Gbps and 100Gbps. When using components such as dpdk to improve packet reception performance, another challenge is the storage and reading of packets. In high-speed scenarios, high-speed disk writing and reading operations need to be performed continuously. The usual practice is to use RAID cards and file systems to store data, but this method relies on RAID cards and requires more disk resources. In addition, when the read and write performance of the disk is inconsistent, the performance potential of the disk cannot be fully utilized due to the limitations of RAID and file systems. Therefore, it is urgent to design a method and device that can realize data packet capture, storage and playback in high-speed scenarios and optimize resource allocation and improve computing speed. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method and device for data packet capture, storage and playback in a high-rate scenario, so as to meet the data packet capture and storage requirements in a high-rate scenario, improve the data packet playback rate, improve the resource utilization in terms of the number of required disks and the disk read and write performance, and at the same time realize data migration and analysis of pcap files.

[0004] In order to achieve the above purpose, a method for data packet capture, storage and playback in a high-speed scenario is designed, and the method is as follows: before starting to capture data, the configuration unit will first identify the number of available disks and test the sequential read and write performance of the disks, count the input traffic, automatically or manually configure the corresponding relationship between the data packet input queue and the disk, and allocate the input queue to the appropriate disk according to the traffic grouping to ensure that the read and write performance of the disk can meet the data packet capture, storage and read playback; when capturing and storing data packets, the packet receiving unit directly receives the data packets in the network card queue in the user state, and according to the queue disk correspondence, the data packet content and length are and timestamp records and places them in the corresponding queue, while the storage unit reads the queue data, assembles the data and performs sequential block write operations on the disk in user mode. When the capture task is completed, the additional write information will be recorded in the reserved disk header space; when playing back data packets at high speed, the configuration unit will identify the number of disks and additional write information, thereby configuring the number of reading threads and the parameters used for disk reading. The reading unit will perform sequential block reads on the disk in user mode according to the configuration parsed by the configuration unit, and put the read data blocks into the playback queue. The playback unit will read the data in the playback queue, split it into data packets and send them at a rate controlled by the timestamp.

[0005] Preferably, the method designed by the present invention also includes other technical features, wherein the method also includes exporting the data stored in the disk as a block device to other storage systems at a relatively low rate through an export unit after completing the data packet capture.

[0006] Preferably, the method designed by the present invention also includes other technical features, wherein the method is specifically as follows: S1. Configuration phase: a) read the CPU core usage range, capture network ports and queue numbers from the startup parameters; b) read disk information from the configuration file; c) configure the number of CPU cores to be twice the number of disks plus 1; d) perform traffic statistics, count the number of bytes received by each network port queue, if not performed, it is assumed that the traffic size on each network port queue is basically the same; e) perform disk performance analysis, test the sequential write performance of all disks, if not performed, it is assumed that the write performance of each disk is the same; f) automatically assign the correspondence between network port queues and disks according to disk performance and network port queue traffic distribution; S2. Data packet capture and storage phase: a) create the same number of packet receiving threads as the number of queues, each thread runs on an independent core; b) use the DPDK interface to batch receive packets in user mode, and record the timestamp and length of the data packets; c) create the same number of storage threads as the number of queues, each thread is responsible for the data storage of a queue; d) use the SPDK block device layer interface to write to the disk in user mode; e) Record the packet information and original bytes to the data block, and perform corresponding processing according to the remaining space of the data block; S3. Packet playback stage: a) Configure playback parameters, including CPU core range, network port name, playback rate control parameters and disk information; b) Create the same number of read threads as the number of disks, and use the SPDK interface to read disk data; c) Create the same number of playback threads as the number of queues, restore the data packet and control the sending rate; d) Control the packet sending according to the selected rate control strategy; e) Use the DPDK interface to send the data packet from the corresponding network port sending queue; Export and import functions: a) Provide an export unit to export the data packet on the block storage device as a pcap file; b) Provide an import unit to import the pcap file to the specified disk for subsequent high-speed playback.

[0007] Preferably, the method designed by the present invention also includes other technical features, wherein the CPU core configuration step in the s1 configuration stage includes: setting the number of used cores to twice the number of disks plus 1; allocating two cores to each disk, one core is responsible for writing and the other core is responsible for receiving packets; and allocating an additional core to be responsible for program management and control.

[0008] Preferably, the method designed by the present invention also includes other technical features, wherein the traffic statistics step in the s1 configuration stage includes: counting the number of bytes received by each network port queue within a set time; judging the traffic size differences of each network port queue based on the statistical results; and using the traffic statistics results as the basis for setting the correspondence between the network port queue and the disk; the disk performance analysis step in the s1 configuration stage includes: performing performance tests on all configured disks using preset performance test parameters; focusing on testing and recording the sequential write performance of each disk; and using the disk performance test results as the basis for subsequent queue allocation.

[0009] Preferably, the method designed by the present invention also includes other technical features, wherein the automatic allocation step in the s1 configuration stage includes: initializing the remaining write performance of each disk according to the disk performance test results; sorting all network port queues from large to small according to traffic; selecting the network port queue with the largest traffic and assigning it to the disk with the largest remaining write performance; updating the remaining write performance of the assigned disk; repeating the above allocation process until all network port queues are allocated.

[0010] Preferably, the method designed by the present invention also includes other technical features, wherein the s2 data packet capture and storage stage is specifically as follows: the packet receiving step in the data packet capture and storage stage includes: creating an equal number of packet receiving threads according to the number of queues allocated in the configuration stage, each packet receiving thread runs on an independent core, and each thread is responsible for the packet receiving work of all packet receiving queues corresponding to a queue; using the DPDK batch packet receiving interface to receive packets in user mode; recording timestamp and length information for each received data packet; the storage step in the data packet capture and storage stage includes: creating storage threads with the same number of queues, each thread is responsible for the data storage of a queue; using the SPDK block device layer interface to write to the disk in user mode; recording the additional information of the data packet together with the original bytes in the data block; the storage step also includes the processing of the following situations: when the remaining space of the data block is sufficient, directly copy the entire content of the data packet; when the remaining space of the data block is just sufficient, copy the entire content of the data packet and then apply for a new data block; when the remaining space of the data block is insufficient, fill the current data block and store the remaining content in the new data block.

[0011] Preferably, the method designed by the present invention also includes other technical features, wherein the reading step in the s3 data packet playback stage includes: creating a reading thread with the same number of disks in use; using the SPDK block device layer interface to read disk data; storing the read data blocks in a queue; the playback step in the data packet playback stage includes: creating a playback thread with the same number of queues; reading data blocks from the queue and restoring them into multiple data packets; controlling the sending of data packets according to a selected rate control strategy; using the DPDK interface to send data packets from the corresponding network port sending queue; the rate control strategy includes: sending at original speed: controlling the sending time according to the data packet timestamp; controlling the number of packets per second: limiting the sending rate according to the cumulative number of packets sent; controlling the number of bytes per second: limiting the sending rate according to the cumulative number of bytes sent.

[0012] Preferably, the method designed by the present invention also includes other technical features, wherein the export function includes: creating a pcap file under a specified file system path; reading data packet information on a block storage device; converting the data packet information into a pcap format and writing it into a file; the import function includes: reading a specified pcap file; converting the data packet in the pcap file into a block storage format; and using the SPDK block device layer interface to write the converted data into a specified disk.

[0013] The present invention also provides a device for capturing, storing and replaying data packets in a high-speed scenario including the method, comprising: a configuration unit: used for system configuration, network port configuration, traffic statistics, disk performance analysis and queue allocation; a packet receiving unit, used for batch receiving packets in user mode using a DPDK interface; a storage unit, used for filling data packets into data blocks and using an SPDK interface to write disk sequential blocks; a reading unit, used for reading data blocks from a disk using an SPDK interface; a playback unit, used for restoring data packets and controlling the sending rate; an export unit, used for converting data stored in a block device into a pcap file; an import unit, used for importing the pcap file into a specified disk; the configuration unit also includes a queue allocation module, used for generating a corresponding relationship between a network port queue and a disk according to disk performance and network port queue traffic distribution; the storage unit and the reading unit both use an SPDK block device layer interface to achieve high-performance disk read and write operations in user mode; the playback unit includes a plurality of rate control strategy modules, used for achieving different playback rate control modes of original speed sending, controlling the number of packets per second and controlling the number of bytes per second.

[0014] Compared with the prior art, the present invention has the following advantages: Through the optimized packet playback method, high-speed packet playback can be achieved to support network performance testing and analysis; the configuration unit can automatically identify the number of available disks and test the disk read and write performance, and automatically or manually configure the corresponding relationship between the packet input queue and the disk according to the traffic, thereby improving resource utilization efficiency; by storing data in the form of block devices, the limitations of the file system are avoided, making the storage and reading of data packets more efficient; the export unit can export the data stored in the block device as a pcap file, and the import unit can import the pcap file to the disk, facilitating data migration and analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 , is a schematic diagram of disk storage format; Figure 2 , is a flowchart of the configuration unit workflow when performing data packet capture; Figure 3 , is a flowchart of the packet receiving unit when performing data packet capture; Figure 4 , is a flowchart of the storage unit when performing data packet capture; Figure 5 , is to export the unit workflow diagram when performing data packet capture; Figure 6 , is a flowchart of the configuration unit workflow when performing data packet playback; Figure 7 , is a flowchart of the reading unit workflow when replaying a data packet; Figure 8 , is a flowchart of the playback unit workflow when playing back data packets; Fig. 9 , is the workflow diagram of the import unit when playing back the data packet. DETAILED DESCRIPTION

[0016] In order to make the purpose, principle and structure of the present invention more clear, it is further described below in conjunction with the drawings and specific embodiments.

[0017] Embodiment 1: This embodiment provides a device for capturing, storing and replaying data packets in a high-rate scenario, as follows: 1Packet capture storage.

[0018] The configuration unit, packet receiving unit, storage unit, and export unit are described respectively.

[0019] 1.1 Configuration unit.

[0020] The configuration unit can read from the startup parameters: the range of CPU cores used, the captured network ports, the number of network port queues. The configuration unit can read from the configuration file: the disk information used.

[0021] Configure the range of CPU cores used by the program through startup parameters. The number of cores used should be twice the number of disks + 1 (each disk is written by an independent core, and another core is responsible for receiving data packets that need to be written to the disk; the entire program is managed and controlled by an independent core).

[0022] The name of the network port to be captured is configured through the startup parameters, including the number of network port queues. The subsequent packet receiving unit will receive packets from the network port queue of the network port.

[0023] The disk information to be used is read from the configuration file, including the disk name and identification information. According to the configuration, the number of disks used by the storage unit, as well as the number of queues and threads used by the packet receiving unit and the storage unit are identified.

[0024] After obtaining the captured network port name and the number of network port queues, the configuration unit will configure the network port. At this time, the program can receive packets from the network port.

[0025] After the network port configuration is completed, you can optionally perform traffic statistics. In a short period of time, you can count the number of bytes received on each network port queue to determine the difference in the traffic size of each network port queue, and provide a basis for the subsequent setting of the corresponding relationship between the network port queue and the disk. If it is not enabled, the traffic size on each network port queue is basically the same by default.

[0026] The configuration unit contains a disk performance analysis function. It performs performance tests on all disks in the configuration file through preset performance test parameters, focusing on sequential write performance. The sequential write performance of each disk provides a basis for subsequent queue allocation. If it is not enabled, the write performance of each disk is assumed to be the same.

[0027] In the queue allocation phase, queues equal to the number of disks used will be created. Each queue is bound to a disk. The data in the queue will only be stored in the corresponding disk, and the disk will only contain the data of the queue. At the same time, this phase also determines which network port queues each queue receives data packets, which can be determined by the user through configuration. For example, 0:0-3;1:4-7 means that queue 0 receives data packets from network port queues 0, 1, 2, and 3, and queue 1 receives data packets from network port queues 4, 5, 6, and 7; and the data packets in queue 0 will be stored in disk 0, and the data packets in queue 1 will be stored in disk 1. In addition, the method of self-allocation by the configuration unit is also supported. The allocation strategy is as follows: the write performance of each disk is obtained based on the disk performance test. At the beginning, this value is the remaining write performance of the disk, and all network port queues are added to the queue to be matched, and sorted from large to small according to traffic. Then select the network port queue with the largest traffic in the network port queue and assign it to the disk with the largest remaining write performance. At this time, remove the network port queue from the queue to be matched, and deduct the traffic size from the remaining write performance of the allocated disk as the new remaining write performance for subsequent matching until all network port queues are allocated. If the value calculated in the process is less than 0, it means that the disk write performance may not be sufficient to support the input flow and prompts you to use the user-configured binding method. This self-allocation strategy cannot ensure the optimal solution in all cases, but it is feasible when the traffic size of each network port queue is similar and the number of network port queues is several times the number of disks. The user-configured binding method can be used when the queue traffic difference is large or the number of queues is small.

[0028] 1.2 Packet receiving unit.

[0029] The packet receiving unit will create an equal number of packet receiving threads according to the number of queues allocated in the configuration unit. Each packet receiving thread runs on an independent core, and each thread is responsible for receiving packets from all packet receiving queues corresponding to one queue.

[0030] According to the queue allocation relationship between the configuration unit and the network port queue generated in the queue allocation phase, the packet receiving thread traverses all packet receiving queues corresponding to the queue, calls the dpdk batch packet receiving interface to receive packets in user mode, and improves the packet receiving performance. After receiving the data packet, use the additional space to record the timestamp and length of the data packet. After the above operations are completed, the network port queue is polled again to receive packets. When the task time exceeds the specified time or a stop task signal is received, no new data packets will be received from the network port queue. After the last remaining data packet is placed in the queue, the packet receiving thread ends.

[0031] Use an independent core to receive packets, reduce other business tasks on the packet receiving thread, and cooperate with the core isolation and other configurations of the operating system to allow the program to receive data packets from the network port more timely, avoiding packet loss due to untimely packet reception in high-speed situations.

[0032] 1.3 Storage unit.

[0033] The storage unit will create an equal number of storage threads according to the number of queues allocated by the unit. Each storage thread runs on an independent core. Each thread is responsible for the data storage work corresponding to a queue and the storage disk configuration corresponding to the queue. The storage thread will initialize and configure the disk it manages to prepare for the subsequent call of the spdk block device layer interface. Using the spdk block device layer interface, you can write to the disk directly in user mode, while also avoiding the block size limitation under the file system. In the scenario of continuous appending of content, the maximum performance of disk sequential read and write cannot be fully utilized. Using the high-performance Intel P5510 solid-state drive, by calling the spdk block device write interface and the algorithm design of sequential block write, you can achieve a read and write performance close to 100Gbps under the condition of using four solid-state drives.

[0034] After completing the disk configuration, the storage thread obtains the data packet from the queue and records the additional information of the data packet (data packet length and timestamp) and the original bytes of the data packet into the data block. At this time, there will be the following situations: In case 1, the remaining space of the data block is enough to record all the information of the packet and there is still space, then copy all the contents of the data packet into the data block, and update the write offset and remaining space of the data block; In case 2, the remaining space of the data block is just enough to store all the information of the packet and there is no space, then copy all the contents of the data packet into the data block, and apply for a new data block for subsequent data packet records; In case 3, the remaining space of the data block is not enough to store all the information of the packet and there is no space, then copy the data packet record to fill the remaining part of the data block, apply for a new data block, copy the uncopied part of the previous data packet record, and update the write offset and remaining space of the data block. Then release the data packet. If a data block is full, call the spdk block device write interface to write to the corresponding disk. After the write is completed, update the disk write record (including the number of bytes written and the block number) for subsequent sequential write actions. After completing the above actions, continue to obtain data packets from the queue and start a new round of processing.

[0035] When the task stops, the total length of data written to disk, the starting offset of the data, and the timestamp of the task start are finally written to the reserved header space on the disk.

[0036] The above operation is to improve the subsequent storage performance. The data blocks are basically filled and written to the disk in a sequential manner (except for the last data block remaining at the end of the task, which may not be filled).

[0037] 1.4 Export unit.

[0038] The export unit is used to export the data packets on the block storage device as pcap files used in the file system. The export unit will create a pcap file in the file system path specified by the user, and then determine the reading start position and total length of the data packet on the block device by reading the information on the block storage device, locate the position of the subsequent packets according to the length information and timestamp information before each data packet, and convert this information into a pcap header and write the original bytes of the data packet. After completion, read the content of the next data packet on the block device and append it to the pcap file until the number of bytes read by the block device reaches the total length.

[0039] 2 Packet playback.

[0040] Describe the configuration unit, reading unit, playback unit, and import unit respectively 2.1 Configuration unit.

[0041] The configuration unit reads the CPU core range used by the program, the network port name used for playback, and the playback rate control parameters from the startup parameters, and reads the block device disk information used for playback from the configuration file. The configuration unit then creates the disk's spdk read channel, initializes the network port for packet playback, and configures the number of network port send queues to the number of disks used. The configuration unit will finally create queues for data transfer between the reading unit and the sending unit, and the number of queues is the same as the number of disks used.

[0042] 2.2 Reading unit.

[0043] The reading unit will create the same number of threads according to the number of disks in use. Each thread will use the interface of the spdk block device layer to read the corresponding disk. First, it will determine the starting position and total length of the data packet information based on the disk header information, then read a data block size (the default is 8M) from the disk and store it in the data block, put it in the queue, and then update the read offset to read the content of the next data block until all the data is read. During the reading process, there may be a backlog of data blocks due to the control of the sending rate. When the number of data blocks in the queue exceeds an upper limit, the disk reading will be temporarily stopped. At this time, the disk reading will not continue until the number of data blocks in the queue falls below another threshold.

[0044] 2.3 Playback unit.

[0045] The playback unit will create the same number of threads according to the number of queues. Each thread will process the data blocks in the corresponding queue, restore them into multiple data packets and send them out from the corresponding network port sending queue.

[0046] The playback unit reads the data block from the queue and restores the content of the data block into multiple data packets: through the additional information of the data packet (length information and timestamp) contained in the data block, the subsequent data can be restored to the data packet as the original bytes of the data packet and marked with time information. There are several situations in the processing process: Situation 1, the additional information of the data packet (length and timestamp) and all the original bytes of the data packet are in the same data block. In this case, it can be directly restored to the data packet; Situation 2, the additional information structure of the data packet is not in the same data block. In this case, since the length of the additional information structure of the data packet itself is fixed, we will cache the existing data and record the number of bytes that need to be supplemented to parse the additional information structure. Then, when processing the next data block, we will fill in the remaining bytes and parse the additional information of the data packet, and then restore the subsequent bytes to the data packet; Situation 3, the additional information structure of the data packet is in the same data block, but the original bytes of the data packet are not all in one data block. In this case, we will generate a data packet based on the existing information in the previous data block, and record the number of bytes that have not been copied in this data packet. When processing the next data block, we will fill in the previously uncopied bytes.

[0047] After restoring the data block into multiple data packets, the processed data block will be released, and then the playback unit will control the sending rate according to different rate control strategies.

[0048] The playback unit controls the sending rate based on the timestamp under the original speed sending strategy: the timestamp recorded on the data packet is tsp, the timestamp of starting packet capture recorded on the disk is tss, the current timestamp is tsc, and the timestamp of starting the playback task is tsb. The data packet is allowed to be sent only when tsc – tsb>= tsp – tss, otherwise it continues to wait.

[0049] The playback unit will limit the number of packets per second based on the timestamp and the cumulative number of packets sent: the data packet is allowed to be sent only when the running time of the current playback task * the number of packets allowed to be sent per unit time >= the current cumulative number of packets sent, otherwise it will continue to wait.

[0050] The playback unit will limit the number of bytes per second based on the timestamp and the cumulative number of bytes sent: the data packet is allowed to be sent only when the running time of the current playback task * the number of bytes allowed to be sent per unit time >= the current cumulative number of bytes sent, otherwise it will continue to wait.

[0051] When the data packet passes the rate control, the playback unit will call the dpdk sending interface to send the data packet from the corresponding network port sending queue.

[0052] 2.4 Import unit.

[0053] The import unit can import the specified pcap file to the specified disk and write it using the interface of the block device layer, so that it can be played back at a high rate later.

[0054] After the import unit reads the pcap file, it reads the data packet content, converts it, and fills the data block with the original bytes of the data packet. Finally, it calls the interface of the spdk block device layer to write it to the disk. When all the data packets in the pcap are written to the disk, the total length, data start offset, and task start timestamp are written to the disk header.

[0055] Embodiment 2: This embodiment provides a method for capturing, storing and replaying data packets in a high-rate scenario.

[0056] 1. Packet capture and storage method.

[0057] 1.1 The configuration unit is set up including: Configuration input, you can enter the following configurations: number of CPU cores to use, specified disk, specified network port, disk block size, and number of network port queues.

[0058] Network port configuration, the number of network port queues is set by the input configuration.

[0059] Traffic statistics: statistics on the traffic information input from the 100G network port, and identification of the traffic distribution of each queue.

[0060] Disk performance analysis: perform disk sequential read and write tests on all specified disks in 4MB units, and count the sequential read and write performance of each disk.

[0061] Queue allocation, based on the disk performance and traffic distribution of each queue of the network port, generates the correspondence between the network port queue and the disk. The network port queue corresponding to the same disk is processed by the same packet receiving thread, and a queue is allocated to this thread to transfer data blocks to subsequent storage units for processing.

[0062] 1.2 The packet receiving unit is set up, including: For data packet reception, the number of packet receiving cores is set according to the number of disks. Each packet receiving core uses the DPDK interface to directly receive packets in batches from the specified network port queue in user mode to improve performance.

[0063] Record the timestamp information of the data packet, and then put the data packet into the queue for processing by the storage unit.

[0064] 1.3 The setting of the storage unit includes: Data packets are taken from the queue and filled into the data block. The information of each data packet includes the length of the data packet content, the timestamp of the data packet and the load of the data packet. There are the following situations when writing: if the data block is not full, continue to get data packets from the queue to fill the data block; if the data block is full, call the bdev interface of spdk in user mode to write sequential blocks to the disk to maximize the use of disk performance, and record the modified disk offset position and write length for subsequent sequential block writing.

[0065] 1.4 The mechanical energy setting of the export unit includes: converting the data stored in the block device into a pcap file under the file system.

[0066] 2. Packet capture and playback method.

[0067] 2.1 The configuration unit is set up including: Configuration settings, you can import the following configurations: use the number of CPU cores, specify the disk, specify the network port, disk block size.

[0068] 2.2 The setting of the reading unit includes: For data block reading, a disk reading thread is assigned to each disk. Each thread first calls the spdk interface to read the data starting offset position information, block size and total length information from the disk header in a predetermined format, and then continues to call the spdk interface to sequentially read the data content and store it in the playback queue.

[0069] 2.3 The settings for the playback unit include: Read data blocks from the queue, parse them into packet contents and additional information, construct packets, and control the sending rate based on timestamps.

[0070] 2.4 The setting of the import unit includes: importing the pcap file under the file system to the specified disk, writing it to the disk via the block device layer interface, so that the data packet can be played back at high speed by utilizing the sequential reading performance of the disk.

[0071] The technical solution design principle of this embodiment is as follows: Before starting to capture data, the configuration unit will first identify the number of available disks and test the disk sequential read and write performance, count the input traffic, automatically or manually configure the corresponding relationship between the packet input queue and the disk, and allocate the input queue to the appropriate disk according to the traffic grouping to ensure that the read and write performance of the disk can meet the data packet capture, storage and read playback. When capturing and storing data packets, the packet receiving unit directly receives the data packets in the network card queue in the user state, and records the data packet content, length and timestamp according to the queue disk correspondence and places them in the corresponding queue buffer block for assembly operation, while the storage unit reads the queue buffer block and performs the disk block sequential write operation in the user state. When the capture task is completed, the additional write information (including the number of bytes written, recording time, block size, etc.) will be recorded in the reserved disk header space. In addition, after completing the data packet capture, the data stored in the disk as a block device can be exported to other storage systems at a relatively low rate through the export unit.

[0072] When playing back data packets at a high rate, the configuration unit will identify the number of disks and additional write information, thereby configuring the number of read threads and the parameters used for disk reading. The reading unit will read the disk sequential blocks in user mode according to the configuration parsed by the configuration unit, and put the read data blocks into the playback queue. The playback unit will read the data in the playback queue, split it into data packets, and send it at a rate controlled by the timestamp.

[0073] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent substitutions or changes according to the technical solutions and novel concepts of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for capturing, storing and replaying data packets in a high-rate scenario, characterized in that: The method is as follows: Before starting to capture data, the configuration unit will first identify the number of available disks and test the disk sequential read and write performance, count the input traffic, automatically or manually configure the corresponding relationship between the packet input queue and the disk, and allocate the input queue to the appropriate disk according to the traffic grouping to ensure that the read and write performance of the disk can meet the data packet capture storage and read playback; When capturing and storing data packets, the packet receiving unit directly receives the data packets in the network card queue in the user state, and records the data packet content, length and timestamp according to the queue-disk correspondence and places them in the corresponding queue. The storage unit reads the queue data, assembles the data and writes the blocks to the disk in user state. When the capture task is completed, the additional write information will be recorded in the reserved disk header space. When playing back data packets at a high rate, the configuration unit will identify the number of disks and additional write information, thereby configuring the number of read threads and the parameters used for disk reading. The reading unit will perform sequential block reads of the disk in user mode according to the configuration parsed by the configuration unit, and put the read data blocks into the playback queue. The playback unit will read the data in the playback queue, split it into data packets, and send them at a rate controlled by the timestamp.

2. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 1, characterized in that: The method further comprises, after completing the data packet capture, exporting the data stored in the disk in the block device mode to other storage systems at a relatively low rate through an export unit.

3. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 2, characterized in that: The method is specifically as follows: S1. Configuration phase: a) Read the CPU core usage range, capture network ports and queue numbers from the startup parameters; b) Read disk information from the configuration file; c) Configure the number of CPU cores to be twice the number of disks plus 1; d) Execute traffic statistics to count the number of bytes received by each network port queue. If not executed, it is assumed that the traffic size on each network port queue is basically the same; e) Perform disk performance analysis to test the sequential write performance of all disks. If not performed, it is assumed that the write performance of each disk is the same; f) Automatically assign the correspondence between network port queues and disks based on disk performance and network port queue traffic distribution; S2. Packet capture and storage phase: a) Create the same number of packet receiving threads as the number of queues, and each thread runs on an independent core; b) Use the DPDK interface to receive packets in batches in user mode and record the timestamp and length of the data packets; c) Create the same number of storage threads as queues, and each thread is responsible for the data storage of one queue; d) Use the SPDK block device layer interface to write to disk in user mode; e) Record the data packet information and original bytes into the data block and process them accordingly based on the remaining space in the data block; S3. Data packet playback phase: a) Configure playback parameters, including CPU core range, network port name, playback rate control parameters, and disk information; b) Create the same number of read threads as the number of disks and use the SPDK interface to read disk data; c) Create playback threads with the same number of queues, restore data packets and control the sending rate; d) controlling data packet transmission according to the selected rate control strategy; e) Use the DPDK interface to send data packets from the corresponding network port sending queue; Export and import functions: a) Provide an export unit to export data packets on the block storage device as pcap files; b) Provide an import unit to import the pcap file to a specified disk for subsequent high-speed playback.

4. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 3, characterized in that: The CPU core configuration steps in the s1 configuration phase include: Set the number of used cores to twice the number of disks plus 1; Assign two cores to each disk, one core is responsible for writing and the other core is responsible for receiving packets; An additional core is allocated to be responsible for process management and control.

5. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 3, characterized in that: The traffic statistics steps in the s1 configuration phase include: Count the number of bytes received by each network port queue within the set time; Determine the traffic size differences of each network port queue based on the statistical results; Use traffic statistics results as the basis for setting the correspondence between network port queues and disks; The disk performance analysis steps in the s1 configuration phase include: Use the preset performance test parameters to perform performance tests on all configured disks; Focus on testing and recording the sequential write performance of each disk; Use the disk performance test results as a basis for subsequent queue assignments.

6. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 3, characterized in that: The automatic allocation steps in the s1 configuration phase include: Initialize the remaining write performance of each disk according to the disk performance test results; Sort all network port queues by traffic volume from large to small; Select the network port queue with the largest traffic and allocate it to the disk with the largest remaining write performance; Update the remaining write performance of the allocated disk; Repeat the above allocation process until all network port queues are allocated.

7. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 3, characterized in that: The s2 packet capture and storage phase is as follows: The packet receiving step in the data packet capture and storage stage includes: Create an equal number of packet receiving threads according to the number of queues allocated in the configuration phase. Each packet receiving thread runs on an independent core and is responsible for receiving packets from all packet receiving queues corresponding to one queue. Use the DPDK batch packet receiving interface to receive packets in user mode; Record timestamp and length information for each received packet; The storage step in the data packet capture and storage phase includes: Create the same number of storage threads as queues. Each thread is responsible for the data storage of one queue. Use the SPDK block device layer interface to write to disk in user mode; Record the extra information of the data packet into the data block together with the original bytes; The storage step also includes processing of the following situations: When there is enough remaining space in the data block, the entire content of the data packet is directly copied; When there is just enough remaining space in the data block, copy the entire content of the data packet and apply for a new data block; When the remaining space in a data block is insufficient, the current data block is filled up and the remaining content is stored in a new data block.

8. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 3, characterized in that: The reading steps in the s3 data packet playback phase include: Create the same number of read threads as the number of disks in use; Use the SPDK block device layer interface to read disk data; Store the read data blocks in the queue; The replay step in the data packet replay stage includes: Create the same number of playback threads as the number of queues; Read data blocks from the queue and restore them into multiple data packets; Controlling data packet sending according to the selected rate control strategy; Use the DPDK interface to send data packets from the corresponding network port sending queue; The rate control strategy includes: Send at original speed: control the sending time according to the timestamp of the data packet; Control the number of packets per second: limit the sending rate according to the cumulative number of packets sent; Control bytes per second: Limit the sending rate based on the cumulative number of bytes sent.

9. The method for capturing, storing and replaying data packets in a high-rate scenario as claimed in claim 3, characterized in that: The export functions include: Create a pcap file in the specified file system path; Read data packet information on block storage devices; Convert data packet information into pcap format and write it to a file; The import functionality includes: Read the specified pcap file; Convert the data packets in the pcap file into block storage format; Use the SPDK block device layer interface to write the converted data to the specified disk.

10. A device for capturing, storing and replaying data packets in a high-rate scenario comprising the method according to any one of claims 1 to 9, characterized in that: include Configuration unit: used for system configuration, network port configuration, traffic statistics, disk performance analysis and queue allocation; The packet receiving unit is used to receive packets in batches in user mode using the DPDK interface; Storage unit, which is used to fill data packets into data blocks and use SPDK interface for disk sequential block writing; The read unit is used to read data blocks from disk using the SPDK interface; A playback unit, used to restore data packets and control the sending rate; The export unit is used to convert the data stored in the block device into a pcap file; Import unit, used to import pcap files to a specified disk; The configuration unit also includes a queue allocation module, which is used to generate a corresponding relationship between a network port queue and a disk according to disk performance and network port queue traffic distribution; The storage unit and the reading unit both use the SPDK block device layer interface to achieve high-performance disk read and write operations in user mode; The playback unit includes a plurality of rate control strategy modules for realizing different playback rate control modes including original rate sending, controlling the number of packets per second and controlling the number of bytes per second.

Images