Message detection method, network equipment and storage medium
By implementing message detection methods in network devices, dynamically learning and updating preset source address table items and protocol frame parameters, the problem of large workload and maintenance difficulties in layer two protocol prevention methods is solved, and the stability and security of the network is improved sex.
Patent Information
- Application Number
- CN202310955139.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-31
- Publication Date
- 2025-02-14
AI Technical Summary
In the prior art, the second-tier protocol's attack prevention methods have a large workload and are difficult to maintain, and there is a lack of effective attack prevention methods.
By implementing the message detection method in a network device, responding to the received target message, it determines its corresponding target source address table entry and target protocol frame parameters, and processes it according to the preset message parameters, dynamically learns and updates the preset Source address table entry and preset protocol frame parameters.
Reduces the frequency of users updating protection lists, improves network stability and security, and enhances the reliability of network operation.
Smart Images
Figure CN119449918A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication technology, and in particular to a message detection method, a network device and a storage medium. Background Art
[0002] As the network environment becomes more and more complex and diverse, the requirements for network equipment to process protocol packets and autonomously defend against attacks are becoming more and more urgent. Network elements running in the existing network are often attacked by protocol packets in the network or abnormal packets generated unconsciously by the network or intentional attacks by malicious attackers, which causes abnormal status of network equipment and thus affects the normal use of business functions. In the relevant technologies, no effective means of defending against attacks on the second layer protocol have been found. Summary of the invention
[0003] The main purpose of the embodiments of the present application is to provide a message detection method, a network device and a storage medium, aiming to solve the problem that the workload required for the second-layer protocol anti-attack means is large and the maintenance is difficult.
[0004] In a first aspect, an embodiment of the present application provides a message detection method, the method comprising:
[0005] In response to the received target message, determining a target source address table entry and a target protocol frame parameter corresponding to the target message;
[0006] When the target source address table entry and the target protocol frame parameters are matched in the preset message parameters, the target message is processed according to the first processing level, and the preset message parameters include the preset source address table entry and the preset protocol frame parameters that the device has learned.
[0007] In a second aspect, an embodiment of the present application provides a network device, the network device comprising:
[0008] A processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of the message detection method as described above are realized.
[0009] In a third aspect, an embodiment of the present application provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the message detection method as described above.
[0010] The embodiment of the present application provides a message detection method, a network device and a storage medium, which responds to a received target message, determines the target source address table entry and the target protocol frame parameter corresponding to the target message; when the target source address table entry and the target protocol frame parameter are matched in the preset message parameters, the target message is processed according to the first processing level, and the preset message parameters include the preset source address table entry and the preset protocol frame parameter that the device has learned. In this way, after the device enables the Layer 2 protocol, the corresponding preset source address table entry and the preset protocol frame parameter can be dynamically learned, and the user does not need to frequently update the protection list, thereby ensuring the stability and security of the network and improving the reliability of network operation. BRIEF DESCRIPTION OF THE DRAWINGS
[0011] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0012] Figure 1 A schematic diagram of a flow chart of a message detection method provided in an embodiment of the present application;
[0013] Figure 2 A schematic diagram of an application scenario of a message detection method provided in an embodiment of the present application;
[0014] Figure 3 A schematic diagram of the overall process of a message detection method provided in an embodiment of the present application;
[0015] Figure 4 A schematic block diagram of the structure of a message detection device provided in an embodiment of the present application;
[0016] Figure 5 A schematic block diagram of the structure of a network device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0017] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0018] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.
[0019] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.
[0020] As the network continues to expand, the methods of attack become more and more complex, and the difficulty of tracing the source becomes higher and higher. The demand for autonomous intelligent self-learning anti-attack devices is becoming more and more urgent. Related methods often use pre-made protection lists to ensure that such protocols are processed first; however, manually pre-made device protection lists face increasingly complex dynamic networks, which has the pain points of large workload and difficult maintenance. At present, no very effective second-layer protocol anti-attack methods have been found in the industry.
[0021] The embodiment of the present application provides a message detection method, a network device and a storage medium. The method can be applied to a network device, wherein the network device can be a server, a base station, a switch, a router, an IPRAN product and an ITN product, etc., but is not limited thereto. Thus, after the device enables the layer 2 protocol, the corresponding preset source address table entry and preset protocol frame parameters can be dynamically learned, and the user does not need to frequently update the protection list, thereby ensuring the stability and security of the network and improving the reliability of network operation.
[0022] Please refer to Figure 1 , Figure 1 A flow chart of a message detection method provided in an embodiment of the present application. The message detection method can dynamically learn the corresponding preset source address table entry and preset protocol frame parameters after the device enables the Layer 2 protocol, and the user does not need to frequently update the protection list, thereby ensuring the stability and security of the network and improving the reliability of network operation.
[0023] like Figure 1 As shown, the message detection method may include S101 to S102.
[0024] S101. In response to a received target message, determine a target source address table entry and a target protocol frame parameter corresponding to the target message.
[0025] The target message may be a protocol message received by the device, and the protocol message may be an attack message or a service message, etc. The target source address table entry may be a source MAC address forwarding table entry or an ARP address table entry, etc. The target protocol frame parameters may include but are not limited to one or more of Ethernet type (ETHER TYPE, ETYPE), destination MAC address (destination MAC, DMAC) and Ethernet subtype (SUBTYPE).
[0026] In some embodiments, before determining the target source address table entry and target protocol frame parameters corresponding to the target message in response to the received target message, when it is detected that the target port of the device is enabled, the preset message parameters are determined according to the target port. Thus, the corresponding preset message parameters can be extracted by detecting the target port that receives the target message.
[0027] The device may be a network device, such as a server, a base station, a switch, a router, an IPRAN product, an ITN product, etc. The target port may be a port corresponding to the target message received in the device.
[0028] Specifically, when it is detected that the target port of the device is enabled, port detection can be performed on the target port, and the preset source address table entry and preset protocol frame parameters that have been learned by the device can be extracted.
[0029] Exemplarily, the preset source address table entries and preset protocol frame parameters are automatically updated through machine learning of the device. When it is detected that the target port of the device is enabled, the preset source address table entries and preset protocol frame parameters corresponding to the requirements of the target port can be extracted from the device.
[0030] In some embodiments, a port detection is performed on the target port to determine the port protocol type corresponding to the target port; when the port protocol type of the target port is a preset port protocol type, the protocol frame parameters corresponding to the preset port protocol type are used as preset protocol frame parameters. Thus, the preset source address table entry and the preset protocol frame parameters corresponding to the target port can be accurately determined.
[0031] Among them, the preset port protocol type can be an Ethernet Layer 2 protocol, which can include EFM, CFM, 802.1X, PPP, LLDP, LACP, STP / RSTP and ISIS, etc.
[0032] Specifically, a port detection is performed on the target port to determine the port protocol type corresponding to the target port; it is determined whether the port protocol type corresponding to the target port is a preset port protocol type, and when the port protocol type of the target port is the preset port protocol type, the protocol frame parameters corresponding to the preset port protocol type are used as the preset protocol frame parameters.
[0033] As shown in Table 1, the protocol frame parameters corresponding to the preset port protocol type can be represented by Table 1:
[0034]
[0035] Table 1
[0036] Exemplarily, a port detection is performed on the target port. If it is determined that the port protocol type corresponding to the target port is 802.1X, it can be determined that the protocol frame parameters corresponding to 802.1X include destination MAC, ETHERTYPE and SUBTYPE. The corresponding destination MAC is FF-FF-FF-FF-FF-FF, ETHERTYPE is 0x888E, SUBTYPE is 0x01-0x04, and the above protocol frame parameters are used as preset protocol frame parameters.
[0037] Exemplarily, a port detection is performed on the target port. If it is determined that the port protocol type corresponding to the target port is CFM, it can be determined that the protocol frame parameters corresponding to CFM include destination MAC and ETHERTYPE. The corresponding destination MAC is 01-80-c2-00-00-34, and ETHERTYPE is 0x8902, and the above protocol frame parameters are used as preset protocol frame parameters.
[0038] In some embodiments, it is determined whether the target port is a global port; if the target port is a global port, preset message parameters are determined according to the target port, and the preset message parameters include preset source address table items and preset protocol frame parameters; if the target port is not a global port, preset message parameters are determined according to the target port, and the preset message parameters include preset source address table items, preset protocol frame parameters and preset port type. In this way, the preset message parameters corresponding to the target port can be accurately determined.
[0039] The global port may be a global debugging port. The preset port type may be an Ethernet port type, which may specifically include an optical port, an electrical port, a combo port, and a console port.
[0040] Specifically, determine whether the target port is a global port; when the target port is a global port, determine the preset message parameters according to the target port, and the preset message parameters may only include preset source address table entries and preset protocol frame parameters; when the target port is not a global port, determine the preset message parameters according to the target port, and the preset message parameters may include preset source address table entries, preset protocol frame parameters and preset port type.
[0041] In some embodiments, the target message is parsed to obtain the data flow type corresponding to the target message, and the target source address table entry and target protocol frame parameters corresponding to the target message are determined according to the data flow type corresponding to the target message. Thus, the corresponding target source address table entry and target protocol frame parameters can be accurately parsed.
[0042] Among them, the data flow type can include various types of attack flows and business flows, such as routing protocol ospf / isis / bgp / ldp attack flow, application protocol tcp / udp / ssh attack flow, management protocol netconf / pcep / snmp attack flow, multicast protocol pim / igmp attack flow, layer 2 protocol lag / ppp attack flow and other abnormal protocol message attack flow, etc.
[0043] Specifically, the target message can be parsed to obtain the data flow type corresponding to the target message; and determine whether the target port is a global port. When the target port is a global port, the target source address table entry and target protocol frame parameters corresponding to the target message can be determined according to the data flow type corresponding to the target message.
[0044] Specifically, the data flow type corresponding to the target message can be obtained by parsing the target message; and it can be determined whether the target port is a global port. When the target port is not a global port, the preset source address table entry, preset protocol frame parameters and preset port type corresponding to the target message can be determined according to the data flow type corresponding to the target message.
[0045] Exemplarily, the target message is parsed to obtain the target source address table entry, target protocol frame parameters and target port type corresponding to the target message; if the target source address table entry matches the preset source address table entry, the target protocol frame parameters match the preset protocol frame parameters and the target port type matches the preset port type, then the processing level of the protocol message is determined to be the first processing level, and the target message is processed according to the message processing parameters corresponding to the first processing level; if the target source address table entry does not match the preset source address table entry, and / or the target protocol frame parameters do not match the preset protocol frame parameters, and / or the target port type does not match the preset port type, then the processing level of the protocol message is determined to be the second processing level, and the target message is processed according to the message processing parameters corresponding to the second processing level.
[0046] S102: When a target source address table entry and a target protocol frame parameter are matched in preset message parameters, the target message is processed according to a first processing level, and the preset message parameters include preset source address table entries and preset protocol frame parameters that have been learned by the device.
[0047] The first processing level may be to process the target message at a level of bandwidth 1 and priority 1, that is, compared with normal message processing and normal bandwidth allocation and priority configuration, it has higher bandwidth resource allocation and higher priority.
[0048] Exemplarily, the preset source address table entries and preset protocol frame parameters are automatically updated through machine learning of the device. When it is detected that the target port of the device is enabled, the preset source address table entries and preset protocol frame parameters corresponding to the requirements of the target port can be extracted from the device.
[0049] Specifically, determine whether the preset message parameters match the target source address table entry and the target protocol frame parameters; if the preset message parameters match the target source address table entry and the target protocol frame parameters, process the target message according to the first processing level; if the target source address table entry does not match the preset source address table entry, and / or the target protocol frame parameter does not match the preset protocol frame parameter, process the target message according to the second processing level. In this way, the corresponding target message can be processed at different processing levels, so that when the attack message is received, the running Layer 2 protocol session is not affected and the service is not interrupted, thereby ensuring the stability and security of the network and improving the reliability of network operation.
[0050] The second processing level may be to process the target message at a level of bandwidth 2 and priority 2, that is, bandwidth allocation and priority configuration that are not higher than normal processing.
[0051] In some embodiments, a timeliness check is performed on a preset source address table entry to determine the generation time of the preset source address table entry; when the generation time of the preset source address table entry exceeds a preset time threshold, the preset source address table entry is determined to be invalid, and the preset source address table entry is cleared.
[0052] Among them, the generation time of the preset source address table entry is used to indicate the difference between the generation time of the preset source address table entry and the current time; the preset time threshold is a preset time threshold, which can be determined according to actual conditions, such as 5 days or 1 month, and is not specifically limited here.
[0053] Specifically, a timeliness check is performed on the preset source address table entry to determine the generation time of the preset source address table entry; it is determined whether the generation time of the preset source address table entry exceeds the preset time threshold; when the generation time of the preset source address table entry exceeds the preset time threshold, it is determined that the preset source address table entry is invalid, and the preset source address table entry is cleared; when the generation time of the preset source address table entry does not exceed the preset time threshold, it can be determined that the preset source address table entry is not invalid, and there is no need to clear the preset source address table entry.
[0054] Exemplarily, a time validity check is performed on the preset source address table entry to determine that the generation time of the preset source address table entry is 20 days. If the preset time threshold is 15 days, it can be determined that the generation time of the preset source address table entry exceeds the preset time threshold, so that it can be determined that the preset source address table entry is invalid, and the preset source address table entry is cleared.
[0055] Exemplarily, a time validity check is performed on the preset source address table entry to determine that the generation time of the preset source address table entry is 10 days. If the preset time threshold is 15 days, it can be determined that the generation time of the preset source address table entry exceeds the preset time threshold. Therefore, it can be determined that the preset source address table entry is not invalid and there is no need to clear the preset source address table entry.
[0056] In some embodiments, when it is detected that the first protocol of the target port is disabled, the preset source address table entry and preset protocol frame parameters corresponding to the first protocol are cleared from the preset message parameters; and / or, when it is detected that any preset source address table entry is invalid, the invalid preset source address table entry and its corresponding preset protocol frame parameters are cleared from the preset message parameters.
[0057] The first protocol may be a layer 2 protocol, such as LLDP, LACP, or EFM.
[0058] Specifically, it is detected whether the first protocol of the target port is in a disabled state. When it is detected that the first protocol of the target port is disabled, the preset source address table entry and preset protocol frame parameters corresponding to the first protocol are cleared from the preset message parameters, that is, the whitelist information is deleted from the protection list.
[0059] Exemplarily, taking the first protocol LLDP as an example, it is detected whether the LLDP protocol of the target port is in a disabled state. When it is detected that the LLDP protocol of the target port is disabled, the preset source address table entry and preset protocol frame parameters corresponding to the LLDP protocol are cleared, that is, the whitelist information corresponding to the LLDP protocol is deleted from the protection list.
[0060] Specifically, the status of all preset source address entries is detected, and when it is detected that any preset source address entry is invalid, the preset source address entry and the preset protocol frame parameters corresponding to the preset source address entry are cleared from the preset message parameters.
[0061] Exemplarily, if the preset message parameters include a preset source address table entry A, a preset source address table entry B, and a preset source address table entry C; the status of the preset source address table entry A, the preset source address table entry B, and the preset source address table entry C are detected, and when it is detected that the preset source address table entry B is invalid, the preset source address table entry B and the preset protocol frame parameters corresponding to the preset source address table entry B are cleared from the preset message parameters.
[0062] like Figure 2 As shown, exemplarily, the device receives various types of attack flow messages and business flow messages from the network connected to the device, wherein the attack flow messages include but are not limited to: routing protocol ospf / isis / bgp / ldp attack flow, application protocol tcp / udp / ssh attack flow, management protocol netconf / pcep / snmp attack flow, multicast protocol pim / igmp attack flow, layer 2 protocol lag / ppp attack flow and other abnormal protocol message attack flows.
[0063] Exemplarily, the Layer 2 protocol messages protected by the dynamic whitelist (i.e., preset message parameters) include but are not limited to: Layer 2 detection protocol: EFM, CFM, Layer 2 link protocol: 802.1X, PPP, Layer 2 link discovery protocol: LLDP, Layer 2 link aggregation protocol: LACP / 802.3ad, Layer 2 network protocol: STP RSTP and Layer 2 routing protocol: ISIS.
[0064] In some embodiments, Figure 3 As shown, the message detection method proposed in an embodiment of the present application is introduced from the overall process of message detection, including S201-S209.
[0065] S201, determine whether the device is enabled for the layer 2 protocol port, if so, go to S202; if not, go to S209.
[0066] S202, determine whether the target port is a global port, if so, go to S203; if not, go to S204.
[0067] S203: Determine preset message parameters according to the target port, where the preset message parameters include preset source address table entries and preset protocol frame parameters.
[0068] S204. Determine preset message parameters according to the target port, where the preset message parameters include preset source address table entries, preset protocol frame parameters, and preset port type.
[0069] S205: The device receives the target message and determines the target source address table entry and target protocol frame parameters corresponding to the target message.
[0070] S206, determine whether the target source address table entry and the target protocol frame parameters are matched in the preset message parameters, if so, go to S207; if not, go to S208.
[0071] S207: Process the target message according to the first processing level.
[0072] S208: Process the target message according to the second processing level.
[0073] S209: Clear the originally stored preset source address table entries and preset protocol frame parameters.
[0074] The embodiment of the present application provides a message detection method, which responds to a received target message, determines the target source address table entry and target protocol frame parameters corresponding to the target message; when the target source address table entry and the target protocol frame parameters are matched in the preset message parameters, processes the target message according to the first processing level, and the preset message parameters include the preset source address table entry and preset protocol frame parameters that the device has learned. After the device enables the Layer 2 protocol, the corresponding preset source address table entry and preset protocol frame parameters are dynamically learned, and the user does not need to frequently update the protection list. When the device is attacked by an attack message, the running Layer 2 protocol session is not affected and the service is not interrupted, thereby ensuring the stability and security of the network and improving the reliability of network operation.
[0075] See also Figure 4 , Figure 4 It is a schematic block diagram of a message detection device provided in an embodiment of the present application. The message detection device can be configured in a server to execute the aforementioned message detection method.
[0076] like Figure 4 As shown, the message detection device 300 includes: a message parsing module 301 and a message processing module 302.
[0077] The message parsing module 301 is used to determine the target source address table entry and target protocol frame parameters corresponding to the target message in response to the received target message;
[0078] The message processing module 302 is used to process the target message according to the first processing level when the target source address table entry and the target protocol frame parameters are matched in the preset message parameters, and the preset message parameters include the preset source address table entry and preset protocol frame parameters that the device has learned.
[0079] The parameter acquisition module 303 is used to determine the preset message parameters according to the target port when it is detected that the target port of the device is enabled.
[0080] The parameter acquisition module 303 is also used to perform port detection on the target port to determine the port protocol type corresponding to the target port; when the port protocol type of the target port is a preset port protocol type, the protocol frame parameters corresponding to the preset port protocol type are used as the preset protocol frame parameters.
[0081] The parameter acquisition module 303 is also used to determine whether the target port is a global port; when the target port is a global port, the preset message parameters are determined according to the target port, and the preset message parameters include preset source address table entries and preset protocol frame parameters; when the target port is not a global port, the preset message parameters are determined according to the target port, and the preset message parameters include preset source address table entries, preset protocol frame parameters and preset port type.
[0082] The message parsing module 301 is further used to parse the target message to obtain the data flow type corresponding to the target message; and determine the target source address table entry and target protocol frame parameters corresponding to the target message according to the data flow type corresponding to the target message.
[0083] The message processing module 302 is further configured to process the target message according to the second processing level when the target source address entry does not match the preset source address entry and / or the target protocol frame parameter does not match the preset protocol frame parameter.
[0084] The parameter clearing module 304 is used to perform timeliness detection on the preset source address table entry and determine the generation time of the preset source address table entry; when the generation time of the preset source address table entry exceeds the preset time threshold, it is determined that the preset source address table entry is invalid and the preset source address table entry is cleared.
[0085] The parameter clearing module 304 is also used to clear the preset source address table items and preset protocol frame parameters corresponding to the first protocol from the preset message parameters when it is detected that the first protocol of the target port is disabled; and / or, when it is detected that any one of the preset source address table items is invalid, clear the invalid preset source address table items and their corresponding preset protocol frame parameters from the preset message parameters.
[0086] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.
[0087] The method and apparatus of the present application can be used in many general or special computing system environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer terminal devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices.
[0088] See also Figure 5 , Figure 5A schematic block diagram of the structure of a network device provided in an embodiment of the present application.
[0089] like Figure 5 As shown, the network device 400 may include a processor 401 and a memory 402 , and the processor 401 and the memory 402 are connected via a bus 403 , such as an I2C (Inter-integrated Circuit) bus.
[0090] In an exemplary embodiment, the processor 401 can be used to provide computing and control capabilities to support the operation of the entire terminal device. The processor 401 can be a central processing unit (CPU), and the processor 401 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.
[0091] Specifically, the memory 402 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.
[0092] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present application, and does not constitute a limitation on the terminal device to which the embodiment of the present application is applied. The specific server may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.
[0093] The processor 401 is used to run a computer program stored in the memory, and implement any one of the message detection methods provided in the embodiments of the present application when executing the computer program.
[0094] In one embodiment, the processor 401 is used to run a computer program stored in a memory, and implement the following steps when executing the computer program: in response to a received target message, determine a target source address table entry and a target protocol frame parameter corresponding to the target message; when the target source address table entry and the target protocol frame parameter are matched in preset message parameters, process the target message according to a first processing level, and the preset message parameters include preset source address table entries and preset protocol frame parameters that the device has learned.
[0095] In one embodiment, before implementing the step of determining the target source address table entry and target protocol frame parameters corresponding to the target message in response to the received target message, the processor 401 is used to implement: when it is detected that the target port of the device is enabled, determining the preset message parameters according to the target port.
[0096] In one embodiment, when the processor 401 implements the determination of the preset message parameters according to the target port, it is used to implement: performing port detection on the target port to determine the port protocol type corresponding to the target port; when the port protocol type of the target port is a preset port protocol type, using the protocol frame parameters corresponding to the preset port protocol type as the preset protocol frame parameters.
[0097] In one embodiment, when the processor 401 implements the determining of the preset message parameters according to the target port, it is used to implement: determining whether the target port is a global port; when the target port is a global port, determining the preset message parameters according to the target port, the preset message parameters include preset source address table entries and preset protocol frame parameters; when the target port is not a global port, determining the preset message parameters according to the target port, the preset message parameters include preset source address table entries, preset protocol frame parameters and preset port type.
[0098] In one embodiment, when the processor 401 implements the step of determining the target source address table entry and target protocol frame parameters corresponding to the target message in response to the received target message, it is used to implement: parsing the target message to obtain the data flow type corresponding to the target message; and determining the target source address table entry and target protocol frame parameters corresponding to the target message based on the data flow type corresponding to the target message.
[0099] In one embodiment, after implementing the determination of the target source address table entry and target protocol frame parameters corresponding to the target message, the processor 401 is used to implement: when the target source address table entry does not match the preset source address table entry, and / or the target protocol frame parameter does not match the preset protocol frame parameter, the target message is processed according to the second processing level.
[0100] In one embodiment, the processor 401 is also used to implement: performing a time detection on the preset source address table entry to determine the generation time of the preset source address table entry; when the generation time of the preset source address table entry exceeds a preset time threshold, determining that the preset source address table entry is invalid, and clearing the preset source address table entry.
[0101] In one embodiment, the processor 401 is also used to implement: when it is detected that the first protocol of the target port is disabled, clearing the preset source address table entry and preset protocol frame parameters corresponding to the first protocol from the preset message parameters; and / or, when it is detected that any one of the preset source address table entries is invalid, clearing the invalid preset source address table entry and its corresponding preset protocol frame parameters from the preset message parameters.
[0102] It should be noted that technicians in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working process of the network device described above can refer to the corresponding process in the aforementioned terminal capability reporting method embodiment, and will not be repeated here.
[0103] An embodiment of the present application also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any message detection method provided in the description of the embodiment of the present application.
[0104] The storage medium may be an internal storage unit of the network device described in the foregoing embodiment, such as a hard disk or memory of the network device. The storage medium may also be an external storage device of the network device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc., provided on the network device.
[0105] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.
[0106] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.
[0107] The serial numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.
Claims
1. A message detection method, characterized in that: The method comprises: In response to the received target message, determining a target source address table entry and a target protocol frame parameter corresponding to the target message; When the target source address table entry and the target protocol frame parameters are matched in the preset message parameters, the target message is processed according to the first processing level, and the preset message parameters include the preset source address table entry and the preset protocol frame parameters that the device has learned.
2. The method according to claim 1, characterized in that Before determining the target source address table entry and the target protocol frame parameter corresponding to the target message in response to the received target message, the method further includes: When it is detected that the target port of the device is enabled, the preset message parameters are determined according to the target port.
3. The method according to claim 2, characterized in that The step of determining the preset message parameters according to the target port includes: Performing port detection on the target port to determine the port protocol type corresponding to the target port; In a case where the port protocol type of the target port is a preset port protocol type, the protocol frame parameters corresponding to the preset port protocol type are used as the preset protocol frame parameters.
4. The method according to claim 2, characterized in that: The step of determining the preset message parameters according to the target port includes: Determine whether the target port is a global port; In the case where the target port is a global port, determining preset message parameters according to the target port, the preset message parameters including preset source address table entries and preset protocol frame parameters; In the case that the target port is not a global port, preset message parameters are determined according to the target port, and the preset message parameters include preset source address table entries, preset protocol frame parameters and preset port type.
5. The method according to claim 1, characterized in that The step of determining, in response to the received target message, a target source address table entry and a target protocol frame parameter corresponding to the target message includes: Parsing the target message to obtain a data flow type corresponding to the target message; The target source address table entry and the target protocol frame parameters corresponding to the target message are determined according to the data flow type corresponding to the target message.
6. The method according to claim 1, characterized in that After determining the target source address table entry and the target protocol frame parameter corresponding to the target message, the method further includes: In the case that the target source address table entry does not match the preset source address table entry, and / or the target protocol frame parameter does not match the preset protocol frame parameter, the target message is processed according to the second processing level.
7. The method according to claim 1, characterized in that The method further comprises: Performing time detection on the preset source address table entry to determine the generation time of the preset source address table entry; When the generation time of the preset source address table entry exceeds a preset time threshold, it is determined that the preset source address table entry is invalid, and the preset source address table entry is cleared.
8. The method according to claim 1, characterized in that: The method further comprises: When it is detected that the first protocol of the target port is disabled, the preset source address table entry and preset protocol frame parameters corresponding to the first protocol are cleared from the preset message parameters; and / or, when it is detected that any one of the preset source address table entries is invalid, the invalid preset source address table entry and its corresponding preset protocol frame parameters are cleared from the preset message parameters.
9. A network device, characterized in that: The network equipment includes: A processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of the message detection method according to any one of claims 1 to 8 are realized.
10. A storage medium for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the message detection method according to any one of claims 1 to 8.